diff --git a/.ai/lessons.md b/.ai/lessons.md
index c8e986bd99..339fc7e60d 100644
--- a/.ai/lessons.md
+++ b/.ai/lessons.md
@@ -4,21 +4,27 @@
 - Reproduce the reported failure on the unchanged baseline before adding a fix.
 - When a symptom matches an earlier fix, inspect that fix and prove why it no longer works before adding another workaround.
 - Test old reports against the current branch because later changes can make the report obsolete.
+- Test serialized worker tasks with the real process driver. An in-process test does not prove that captured models or nested closures survive serialization.
 - Use the same regression test before and after the production change so the result shows the behavior difference.
 - Several dev instances can run from one checkout (see `./scripts/dev urls`). After you add a migration, run it on each running instance of that checkout, or those instances fail on the new code.
 - The checkout is shared with other sessions. When the full suite fails, rerun each failing file alone and compare with a clean `git archive HEAD` copy before you connect a failure to your change. The dev instance of the checkout runs its live files, so a live repro also runs the uncommitted edits of other sessions: run `git diff` on the code under test before you trust the result.
 - Run seeders and other artisan commands that write SSH keys in a dev container as `www-data` (`docker exec -u www-data`). Root-owned files in `storage/app/ssh` make every SSH call from the web process fail.
 - Files written on a server with `tee` get the server umask (027/077 on hardened hosts). Set the mode explicitly (`chmod 644`) for files that a non-root container user reads through a read-only bind mount.
 - `sshd` keeps the login shell of an open multiplexed SSH connection. Call `SshMultiplexingHelper::removeMuxFile()` before a live test of SSH or login-shell behavior.
+- Remote command batches run in `bash -se` (`sh -se` only when the host has no bash). A command that can fail without being an error (such as `cat` of an optional file) stops the batch unless it ends with `|| true`. `Process::fake()` cannot show this, so run such a command once in a real `bash -se` on the target host.
 - SSH retries replay the full command batch. Only exit code 255 is an SSH transport failure; other exit codes come from the remote command, so do not retry them. Keep batches safe to run twice (for example `docker rm -f <name> || true` before `docker run --name <name>`).
 - Do not put `pkill -f "playwright run-server"` in the same shell command as other work; the pattern matches that shell and kills it. Run it as its own command.
 - Redirect browser test output to a file (`> /tmp/x.log 2>&1`); piping it (`| tail`) hangs because the Playwright server keeps the pipe open.
-- Browser `click('Text')` can match a hidden element first (for example inactive modal steps) and wait forever; use `button:visible:has-text("Text")`.
+- Browser `click()`/`assertSee()` wait forever when nothing matches, so a bad selector hangs the run instead of failing it. `click('Text')` can match a hidden element first (use `button:visible:has-text("Text")`); `:text-is()` on an element with child elements and `assertSee()` text with double quotes never match. Prefer plain CSS selectors.
+- A new worktree has no `vendor/` or `public/build/`. Run `composer install --ignore-platform-req=ext-zip` on the host and copy `public/build` from the main checkout before page-rendering tests; otherwise they fail with a Vite manifest error.
 - Never run `php artisan test` inside a dev container (`./scripts/dev exec` or `docker exec coolify-dev-*`). The container sets `DB_CONNECTION=pgsql` as a real environment variable, which wins over `phpunit.xml`, so `RefreshDatabase` runs `migrate:fresh` on the dev database and wipes it. Run tests on the host only.
 - The helper image runs `docker compose` for deployments and for the Coolify upgrade itself. Before you bump its Docker CLI or Compose, test them against the oldest supported Docker Engine (for example a `docker:<version>-dind` container); newer clients can reject data from older daemons.
 - Do not symlink `vendor` into another worktree. Composer resolves the base path from the real `vendor` path, so the tests load the app classes of the other checkout. Run `composer install --ignore-platform-req=ext-zip` in the worktree.
 - To assert that the unsaved-changes bar shows, check `el.classList.contains('is-dirty')`. Playwright treats the hidden bar (`opacity-0`) as visible, and its class attribute always contains the text `is-dirty` from Tailwind variants.
+- Do not call `sleep()` in a browser test. The app server runs in the test process, so `sleep()` stops it; use `$page->wait()`.
+- In tests, turning on `is_metrics_enabled` (and other Sentinel settings) with `save()`/`update()` runs the settings hook, which starts Sentinel over a real SSH connection on the sync queue. Use `saveQuietly()` or `Queue::fake()`.
 - Call `visit()` directly in each `tests/v4/Browser` test body; Pest does not mark a test that only uses helper-wrapped `visit()` as a browser test, so it fails with `sendText() on null`.
+- SQLite returns `0`/`1` for boolean columns without a `boolean` cast, while Postgres returns real booleans. A strict `=== false` check on such a column never matches in tests, so tests can pass on behavior that Postgres blocks. Add the cast or compare loosely.
 
 ## Verify the complete user flow
 - Do not use a passing unit test, a successful build, or a healthy process as proof for a reported UI failure.
@@ -110,9 +116,15 @@
 - The parsers add sudo only to line starts (and after `&&`, `||`, `|`, `$(`). Put `if`/`else` branches on their own lines. When a redirect or `cd` must stay, make the whole line one `sh -c '...'` script; it runs as `sudo sh -c` without inner sudo or bash.
 - Tests that replace `DatabaseStartCommandExecutor` or use root servers miss non-root bugs. Test the parsed commands of a non-root server.
 
+## Redact sensitive output before every sink
+- Use one fail-closed redaction policy for database logs, framework logs, notifications, API output, exports, and MCP responses.
+- Replace known resource secrets before storage; format detection is only a second layer.
+- Keep read-time redaction for legacy records, but do not use it as the primary control.
+
 ## Cached and stored state
 - `StandaloneDocker`/`SwarmDocker` `server` uses `Server::findCached()`, a per-process identity map that is flushed only when the `servers` row updates. A `ServerSetting` save does not flush it, so pass the current `Server` instance (`setRelation('server', $server)`) when generated output depends on just-saved settings.
 - Application deployments use the stored `custom_labels` when they exist. When a server-level setting changes the generated labels, regenerate the stored labels of read-only (`is_container_label_readonly_enabled`) applications, or a redeploy keeps the old labels.
+- Tailwind `text-base` is a colour utility here (`--color-base`, near-black), not a font size. Use `text-[16px]` for size.
 
 ## Keep browser form restore away from app state
 - Firefox session restore writes saved input values back and fires a trusted `input` event. Add `autocomplete="off"` to inputs that only mirror client state (for example an Alpine-bound color picker), or their handlers run without a user action.
diff --git a/.github/workflows/coolify-release.yml b/.github/workflows/coolify-release.yml
index 9f83302ee9..70bb5d6af5 100644
--- a/.github/workflows/coolify-release.yml
+++ b/.github/workflows/coolify-release.yml
@@ -30,7 +30,8 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Reject releases outside the production branch
-        if: ${{ github.ref_name != 'main' }}
+        # tmp: allow the 4.4.7 security release from fix/v4.4.7
+        if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'fix/v') }}
         run: |
           echo "Stable releases must run from main, not ${{ github.ref_name }}."
           exit 1
diff --git a/.github/workflows/tmp-coolify-hotfix-release.yml b/.github/workflows/tmp-coolify-hotfix-release.yml
new file mode 100644
index 0000000000..2ef14b3597
--- /dev/null
+++ b/.github/workflows/tmp-coolify-hotfix-release.yml
@@ -0,0 +1,159 @@
+# Temporary: releases the 4.0 to 4.3 security fixes from the v4.0.x to v4.3.x branches without moving latest.
+# Delete this workflow once 4.5 ships.
+name: TMP Release Coolify Hotfix
+run-name: tmp ${{ inputs.branch }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: Release line branch
+        required: true
+        type: choice
+        options:
+          - v4.3.x
+          - v4.2.x
+          - v4.1.x
+          - v4.0.x
+
+permissions: {}
+
+concurrency:
+  group: tmp-coolify-hotfix-release
+  cancel-in-progress: false
+
+env:
+  GITHUB_REGISTRY: ghcr.io
+  DOCKER_REGISTRY: docker.io
+  IMAGE_NAME: coollabsio/coolify
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      sha: ${{ steps.version.outputs.sha }}
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.branch }}
+          persist-credentials: false
+
+      - name: Resolve version
+        id: version
+        env:
+          BRANCH: ${{ inputs.branch }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)
+          if [[ "${VERSION}" != "${BRANCH:1:3}."* || ! "${VERSION}" =~ ^4\.[0-3]\.[0-9]+$ ]]; then
+            echo "Version ${VERSION} does not belong to ${BRANCH}."
+            exit 1
+          fi
+          if gh release view "v${VERSION}" --repo "${GITHUB_REPOSITORY}" > /dev/null 2>&1; then
+            echo "Release v${VERSION} already exists."
+            exit 1
+          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: validate
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            platform: linux/aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ needs.validate.outputs.sha }}
+          persist-credentials: false
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push image (${{ matrix.arch }})
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/production/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          build-args: |
+            COOLIFY_VERSION=${{ needs.validate.outputs.version }}
+          labels: |
+            org.opencontainers.image.revision=${{ needs.validate.outputs.sha }}
+          tags: |
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:release-${{ needs.validate.outputs.version }}-${{ needs.validate.outputs.sha }}-${{ matrix.arch }}
+            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:release-${{ needs.validate.outputs.version }}-${{ needs.validate.outputs.sha }}-${{ matrix.arch }}
+
+  publish:
+    needs: [validate, build]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Publish the version tag
+        env:
+          VERSION: ${{ needs.validate.outputs.version }}
+          SHA: ${{ needs.validate.outputs.sha }}
+        run: |
+          for REGISTRY in "${GITHUB_REGISTRY}" "${DOCKER_REGISTRY}"; do
+            IMAGE="${REGISTRY}/${IMAGE_NAME}"
+            docker buildx imagetools create \
+              "${IMAGE}:release-${VERSION}-${SHA}-amd64" \
+              "${IMAGE}:release-${VERSION}-${SHA}-aarch64" \
+              --tag "${IMAGE}:${VERSION}"
+          done
+
+      - name: Publish the GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.validate.outputs.version }}
+          SHA: ${{ needs.validate.outputs.sha }}
+        run: |
+          gh release create "v${VERSION}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --target "${SHA}" \
+            --title "v${VERSION}" \
+            --latest=false \
+            --notes "Security fix release for Coolify ${VERSION%.*}. Apply it with: curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash"
diff --git a/.github/workflows/tmp-php-base-image.yml b/.github/workflows/tmp-php-base-image.yml
new file mode 100644
index 0000000000..f8c1839e33
--- /dev/null
+++ b/.github/workflows/tmp-php-base-image.yml
@@ -0,0 +1,134 @@
+# Temporary: builds PHP from the signed php.net release and rebuilds serversideup/php v4.5.1 on it for the 4.x security fixes.
+# Delete this workflow and docker/tmp-php once 4.5 ships on serversideup/php v5.
+name: TMP Build Patched PHP Base
+run-name: tmp php ${{ inputs.php_version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      php_version:
+        description: Patched PHP 8.4 release, for example 8.4.27
+        required: true
+        type: string
+      php_sha256:
+        description: SHA256 of php-<version>.tar.xz from https://www.php.net/downloads.php
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: tmp-php-base-image
+  cancel-in-progress: false
+
+env:
+  GITHUB_REGISTRY: ghcr.io
+  PHP_IMAGE: ghcr.io/coollabsio/php
+  BASE_IMAGE: ghcr.io/coollabsio/serversideup-php
+  # serversideup/docker-php v4.5.1
+  SERVERSIDEUP_CONTEXT: https://github.com/serversideup/docker-php.git#92b16c9ee63bde4f75cdcc7ebe96aee36a896f88
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            platform: linux/aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Validate inputs
+        env:
+          PHP_VERSION: ${{ inputs.php_version }}
+          PHP_SHA256: ${{ inputs.php_sha256 }}
+        run: |
+          if [[ ! "${PHP_VERSION}" =~ ^8\.4\.[0-9]+$ ]]; then
+            echo "Unsupported PHP version: ${PHP_VERSION}"
+            exit 1
+          fi
+          if [[ ! "${PHP_SHA256}" =~ ^[0-9a-f]{64}$ ]]; then
+            echo "Invalid SHA256: ${PHP_SHA256}"
+            exit 1
+          fi
+
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build PHP from the signed release (${{ matrix.arch }})
+        uses: docker/build-push-action@v6
+        with:
+          context: docker/tmp-php
+          platforms: ${{ matrix.platform }}
+          push: true
+          build-args: |
+            PHP_VERSION=${{ inputs.php_version }}
+            PHP_SHA256=${{ inputs.php_sha256 }}
+          tags: ${{ env.PHP_IMAGE }}:${{ inputs.php_version }}-fpm-alpine3.24-${{ matrix.arch }}
+
+      - name: Rebuild serversideup/php v4.5.1 on it (${{ matrix.arch }})
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.SERVERSIDEUP_CONTEXT }}
+          file: src/variations/fpm-nginx/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          build-args: |
+            BASE_IMAGE=${{ env.PHP_IMAGE }}:${{ inputs.php_version }}-fpm-alpine3.24-${{ matrix.arch }}
+            PHP_VERSION=8.4
+            BASE_OS_VERSION=alpine3.24
+            PHP_VARIATION=fpm-nginx
+            NGINX_VERSION=1.30.4-r1
+            REPOSITORY_BUILD_VERSION=v4.5.1-php${{ inputs.php_version }}
+          tags: ${{ env.BASE_IMAGE }}:${{ inputs.php_version }}-fpm-nginx-alpine-v4.5.1-${{ matrix.arch }}
+
+      - name: Check the PHP version (${{ matrix.arch }})
+        env:
+          IMAGE: ${{ env.BASE_IMAGE }}:${{ inputs.php_version }}-fpm-nginx-alpine-v4.5.1-${{ matrix.arch }}
+          PHP_VERSION: ${{ inputs.php_version }}
+        run: |
+          BUILT_VERSION=$(docker run --rm --entrypoint php "${IMAGE}" -r 'echo PHP_VERSION;')
+          if [ "${BUILT_VERSION}" != "${PHP_VERSION}" ]; then
+            echo "The base image runs PHP ${BUILT_VERSION}, expected ${PHP_VERSION}."
+            exit 1
+          fi
+
+  publish:
+    needs: build
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish multi-arch images
+        env:
+          PHP_VERSION: ${{ inputs.php_version }}
+        run: |
+          docker buildx imagetools create \
+            "${PHP_IMAGE}:${PHP_VERSION}-fpm-alpine3.24-amd64" \
+            "${PHP_IMAGE}:${PHP_VERSION}-fpm-alpine3.24-aarch64" \
+            --tag "${PHP_IMAGE}:${PHP_VERSION}-fpm-alpine3.24"
+          docker buildx imagetools create \
+            "${BASE_IMAGE}:${PHP_VERSION}-fpm-nginx-alpine-v4.5.1-amd64" \
+            "${BASE_IMAGE}:${PHP_VERSION}-fpm-nginx-alpine-v4.5.1-aarch64" \
+            --tag "${BASE_IMAGE}:${PHP_VERSION}-fpm-nginx-alpine-v4.5.1" \
+            --tag "${BASE_IMAGE}:8.4-fpm-nginx-alpine-v4.5.1-hotfix"
diff --git a/AGENTS.md b/AGENTS.md
index ce9efdde49..3016656c89 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -191,6 +191,22 @@ Because the "server" and the test share one PHP process, they share the phpunit
 - **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
 - **Proxy** — Traefik reverse proxy managed per server.
 
+### Server transfer (keep it complete)
+
+A server transfer moves a server and every record that belongs to it to another Coolify instance: `ServerTransferExporter` writes the bundle, `ServerTransferImporter` reads it (`app/Services/ServerTransfer/`). `ServerTransferCoverage` records the transfer decision for every model and every column.
+
+- When you add a model, a column, or a relation that belongs to a server or to a resource on a server (application, preview, database, service, volume, environment variable, backup, scheduled task, tag, or setting), decide whether a transfer moves it:
+  - **Moved:** export and import it, and add a round-trip assertion to `tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php`. For a new model, also add it to `ServerTransferCoverage::TRANSFERRED`.
+  - **Not moved:** add the model to `ServerTransferCoverage::NOT_TRANSFERRED`, or the column to `NOT_EXPORTED_COLUMNS`, with the reason. If the data is lost for the user, also add an export warning.
+- `tests/Unit/ServerTransfer/ServerTransferCoverageTest.php` exports a server with one record of every transferred model. It fails when a model or a column has no decision. When you add a transferred model, add a record of it to the fixture of that test.
+- `docs/server-transfer-full-coverage.md` lists what to set up on a source server for a manual transfer test that covers every transferred model and setting. Add new transferred models and settings to it.
+- `scripts/transfer-test/` has live end-to-end transfer tests between two dev instances (see its README). Run them after a change to the transfer flow. When you add transferred data that the unit tests cannot prove (remote commands, provider calls, queue behavior), add a check to `extras-e2e.sh`.
+- Application, Service, and the standalone databases export their `$fillable` columns, plus hand-written lists for hidden columns. A column that is not fillable is lost unless you add it to those lists.
+- Do not copy a foreign key as a raw ID. IDs are different on the target. Link the record by UUID, or leave the column out with a reason.
+- Team credentials that a moved record needs (integration tokens, S3 storages, git sources, private keys, cloud provider tokens) move with it.
+- When the user must do a step after the transfer (for example, change a webhook URL at GitHub), add an item type to `TransferFinishChecklist`: the "Finish the transfer" list on the server page of the instance that manages the server now. Give it a check where Coolify can verify the step, and a fix where it can do the step. Also add it to the `post_transfer_checklist` of the bundle (`{target_url}` stands for the URL of the target), which the source shows as text.
+- On the source, a transferred server (`Server::isTransferredAway()`) is only an archive, because another instance manages the host. Do not run remote commands, cloud provider calls, or DNS provider calls for it, also not when the archive is deleted.
+
 ### Instance sentinels (`id = 0`)
 
 Coolify seeds **instance-owned** rows at primary key `0`. That value is a sentinel meaning “this is the Coolify instance itself”, not a normal autoincrement id. Do not migrate, resequence, or “fix” these to a positive id.
diff --git a/DESIGN.md b/DESIGN.md
index 1226dd0587..ef61480091 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -1,9 +1,415 @@
 # Coolify UI design system
 
-This document defines Coolify's UI design system for its Livewire + Blade +
-Alpine + Tailwind v4 frontend. The visual system covers the global shell,
-project and environment pages, application navigation, settings surfaces,
-tables, modals, toasts, terminals, and metrics.
+This file has two parts:
+
+- **Part 1, Portable design language:** the look and feel of the Coolify UI,
+  with no dependency on Coolify code. It has the principles, a copy-paste token
+  sheet in plain CSS, and the anatomy of each component with exact values. Use
+  it to give another app the same feel. It works with any stack (plain CSS,
+  Tailwind, React, Vue, Blade).
+- **Part 2, Coolify implementation:** how Coolify applies the language with its
+  Livewire + Blade + Alpine + Tailwind v4 frontend: the components, routes, page
+  shells, and the rules for this repository.
+
+When you change a shared value in Coolify, update Part 1 and Part 2 in the same
+change.
+
+---
+
+# Part 1. Portable design language
+
+## P1. The feel
+
+- **Compact and calm.** 13–14px UI text, 32px controls, small radii, short
+  labels. The data is the hero, not the chrome.
+- **Layers, not boxes.** Depth comes from a few surface steps (canvas, card,
+  well, control), 1px borders, and very soft shadows. Never use thick borders or
+  heavy floating shadows.
+- **Card and well.** Content sits in a darker inset panel (the well) inside a
+  soft outer box with a small title row.
+- **Tactile buttons.** Buttons and navigation icon tiles have a 2px bottom
+  edge. They lift 1px on hover and press down on click.
+- **Dark gray, not black.** Dark mode is a pure neutral dark gray (page
+  canvas about sRGB 10,10,10). Light mode is pure neutral
+  gray.
+- **One accent per theme.** Purple in light mode, yellow in dark mode (purple
+  has too little contrast on dark surfaces). Everything else is neutral.
+- **Quiet text.** Sentence case. A clear text ladder: primary, dim, faint.
+  No em dashes in UI copy.
+
+## P2. Token sheet
+
+Copy this sheet into the app's global CSS. Put the dark values on the selector
+the app uses for dark mode (here `.dark` on `<html>`). Use the tokens in every
+component; do not hard-code a gray in a component, because then it does not
+follow the theme.
+
+```css
+:root {
+    /* Type */
+    --ui-font-sans: 'Geist Sans', Inter, system-ui, sans-serif;
+    --ui-font-mono: 'Geist Mono', ui-monospace, SFMono-Regular, Menlo, monospace;
+
+    /* Surfaces (light: pure neutral) */
+    --ui-canvas: oklch(98.5% 0 0);          /* page background and sidebar */
+    --ui-panel: #ffffff;                    /* top header bar */
+    --ui-card-bg: rgb(0 0 0 / 0.75%);       /* card outer box */
+    --ui-card-border: rgb(0 0 0 / 9%);
+    --ui-well-bg: #ffffff;                  /* card body (inset well) */
+    --ui-well-border: rgb(0 0 0 / 8%);
+    --ui-well-shadow: 0 1px 2px rgb(0 0 0 / 6%);
+    --ui-control-bg: oklch(96% 0 0);        /* inputs, select triggers */
+    --ui-control-border: oklch(14.5% 0 0 / 0.1);
+    --ui-menu-bg: oklch(96% 0 0);           /* dropdown, listbox, popover (opaque) */
+    --ui-menu-border: oklch(14.5% 0 0 / 0.1);
+    --ui-hover: oklch(92.2% 0 0);           /* menu option and row hover */
+    --ui-divider: oklch(92.2% 0 0);
+    --ui-chrome-border: rgb(0 0 0 / 6%);    /* sidebar and header edges */
+
+    /* Text */
+    --ui-fg: oklch(14.5% 0 0);
+    --ui-fg-dim: oklch(40% 0 0);            /* card titles */
+    --ui-fg-faint: oklch(50% 0 0);          /* labels, descriptions, meta */
+
+    /* Accent and status */
+    --ui-accent: oklch(49.65% 0.2709 289.33);     /* purple */
+    --ui-accent-top: oklch(52.34% 0.287 289.16);  /* primary button gradient */
+    --ui-accent-bottom: oklch(43.76% 0.2369 289.82);
+    --ui-accent-edge: oklch(38.04% 0.2031 290.47); /* primary button depth edge */
+    --ui-accent-fg: #ffffff;
+    --ui-success: oklch(48% 0.135 149.58);
+    --ui-warning: oklch(50% 0.105 80);
+    --ui-error: oklch(52% 0.2 27.33);
+
+    /* Depth */
+    --ui-card-shadow: 0 1px 2px rgb(0 0 0 / 5%);
+    --ui-menu-shadow: 0 4px 12px rgb(0 0 0 / 0.12), 0 2px 4px rgb(0 0 0 / 0.08);
+    --ui-modal-shadow: 0 24px 64px rgb(0 0 0 / 0.55), 0 4px 16px rgb(0 0 0 / 0.4);
+    --ui-depth-color: rgb(0 0 0 / 0.22);    /* button and tile bottom edge */
+
+    /* Motion */
+    --ui-ease-out: cubic-bezier(0.23, 1, 0.32, 1);
+    --ui-ease-drawer: cubic-bezier(0.32, 0.72, 0, 1);
+}
+
+.dark {
+    /* Surfaces (dark: pure neutral dark gray) */
+    --ui-canvas: oklch(14.48% 0 0);   /* sRGB 10,10,10 */
+    --ui-panel: oklch(19.13% 0 0);     /* sRGB 20,20,20: header bar, card and table headers */
+    --ui-card-bg: rgb(255 255 255 / 6%);
+    --ui-card-border: rgb(255 255 255 / 8%);
+    --ui-well-bg: rgb(0 0 0 / 34%);
+    --ui-well-border: rgb(255 255 255 / 7%);
+    --ui-well-shadow: 0 1px 2px rgb(0 0 0 / 25%);
+    --ui-control-bg: rgb(255 255 255 / 3%);
+    --ui-control-border: rgb(255 255 255 / 8%);
+    --ui-menu-bg: oklch(25.2% 0 0);
+    --ui-menu-border: oklch(36% 0 0);
+    --ui-hover: oklch(29.31% 0 0);
+    --ui-divider: rgb(255 255 255 / 7%);
+    --ui-chrome-border: rgb(255 255 255 / 4%);
+
+    /* Text */
+    --ui-fg: oklch(96.12% 0 0);
+    --ui-fg-dim: oklch(76.99% 0 0);
+    --ui-fg-faint: oklch(65% 0 0);
+
+    /* Accent and status: yellow accent in dark mode */
+    --ui-accent: oklch(88.13% 0.1507 91.7);
+    --ui-success: oklch(72.27% 0.192 149.58);
+    --ui-warning: oklch(88.13% 0.1507 91.7);
+    --ui-error: oklch(66% 0.2 27.33);
+
+    --ui-depth-color: rgb(255 255 255 / 0.08);
+}
+```
+
+Rules for the tokens:
+
+- Translucent surfaces (`--ui-card-bg`, `--ui-well-bg`, `--ui-control-bg`) take
+  the color of what is below them.
+- Floating surfaces (menus, popovers, tooltips, modals) must be opaque. Use
+  `--ui-menu-bg`, never a translucent value, or the content behind shows
+  through.
+- Keep the dark surfaces pure neutral (chroma 0). A brand tint on the
+  surfaces was tried and removed.
+- **Dark lightness level.** The canvas is at 14.48% and the header panel at
+  19.13%. To
+  change the level, move every dark surface and border token by the same
+  amount (canvas, panel, menu, hover, borders, and the Coolify surface ladder),
+  so the steps between layers stay the same. If you move only some of them, a
+  hover fill can become darker than its menu.
+- The primary buttons use purple in both themes. Only focus rings, active
+  navigation, and other accent states change to yellow in dark mode.
+
+## P3. Scales
+
+| Scale | Values | Use |
+|---|---|---|
+| Text | 11px | meta, section labels, card descriptions, header links |
+| | 12px | badges, small descriptions, code snippets |
+| | 13px | navigation, buttons, table cells, card titles (semibold) |
+| | 14px | inputs, menu options, empty-state titles |
+| | 24px | page titles (with a 13px faint summary below) |
+| Weight | 500 / 600 | 500 for labels and buttons, 600 for titles |
+| Height | 24px | badges |
+| | 32px | buttons, inputs, select triggers, menu options |
+| | 36px | navigation rows with tiles |
+| | 40px / 48px | table header / table rows |
+| Radius | 6px | menu options |
+| | 8px | buttons, inputs, card wells, navigation tiles |
+| | 10px | menus and popovers (6px options + 4px inset) |
+| | 12px | card outer box |
+| | full | badges, pills |
+| Spacing | 6px | card outer padding |
+| | 16px | well padding, page gutters on small screens |
+| | 24px | gap between cards (use a flex or grid gap, not margins) |
+| Motion | 80ms | button lift and press |
+| | 120ms | color, border, and focus changes |
+| | 150ms | menu swaps, row hover |
+
+Nested boxes normally follow `outer radius = inner radius + inset`. The card
+(12px outer, 8px well, 6px inset) is an accepted exception.
+
+## P4. Components
+
+Class names below are examples. Keep the values and structure.
+
+### App shell
+
+- Three layers: the canvas (page and sidebar, `--ui-canvas`), the top header
+  bar (`--ui-panel`, 48px high), and the cards on the canvas.
+- In dark mode, the header bar, the outer box of a top-level card, and the
+  header row of a table use the same color (`--ui-panel`). The card wells and
+  table rows are the darker content layer below them.
+- The sidebar is the canvas color and has a 1px `--ui-chrome-border` right
+  edge. The brand block (product name and version) at the top of the sidebar
+  column also uses the canvas color, with a 1px bottom border.
+- Keep the chrome borders faint. A strong border on near-black looks like a
+  line drawn on the page.
+
+### Sidebar navigation
+
+```css
+.nav-section { padding: 4px 10px; font-size: 11px; font-weight: 500; color: var(--ui-fg-faint); }
+.nav-item {
+    display: flex; align-items: center; gap: 10px;
+    height: 36px; padding: 0 10px 0 4px;
+    font-size: 13px; font-weight: 500; color: var(--ui-fg-dim);
+    background: transparent;                /* the row itself never fills */
+}
+.nav-item:hover, .nav-item.is-active { color: var(--ui-fg); }
+.nav-tile {                                 /* 30px tile: 16px icon + 6px padding + 1px border */
+    box-sizing: content-box; width: 16px; height: 16px; padding: 6px;
+    border: 1px solid rgb(0 0 0 / 9%); border-radius: 8px; background: #fafafa;
+    box-shadow: 0 2px 0 var(--ui-depth-color);
+    transition: transform 80ms, box-shadow 80ms, border-color 120ms, background-color 120ms;
+}
+.dark .nav-tile { border-color: rgb(255 255 255 / 9%); background: rgb(255 255 255 / 4%); }
+.nav-item:hover .nav-tile { transform: translateY(-1px); box-shadow: 0 3px 0 var(--ui-depth-color); }
+.nav-item:active .nav-tile { transform: translateY(2px); box-shadow: none; }
+.nav-item.is-active .nav-tile {
+    color: var(--ui-accent);
+    border-color: color-mix(in oklab, var(--ui-accent) 45%, transparent);
+    --ui-depth-color: color-mix(in oklab, var(--ui-accent) 45%, transparent);
+}
+```
+
+- Use outline icons (1.5px stroke) at 16px. A brand item can use a one-color
+  brand mark when it is clearer than an outline icon.
+- Rows with a submenu end in a 12px chevron: accent in light mode, faint gray
+  in dark mode.
+- Group rows under 11px section labels, and separate groups with a 1px divider.
+
+### Card (outer box, title row, well)
+
+```css
+.card {
+    display: flex; flex-direction: column;
+    border: 1px solid var(--ui-card-border); border-radius: 12px; padding: 6px;
+    background: var(--ui-card-bg); box-shadow: var(--ui-card-shadow);
+    overflow: visible;                      /* menus and tooltips must escape */
+}
+.dark .card { background: var(--ui-panel); }  /* top-level card: same as the header bar */
+.card-header {
+    display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between;
+    gap: 16px; padding: 4px 8px 10px;
+}
+.card-title { font-size: 13px; font-weight: 600; line-height: 20px; color: var(--ui-fg-dim); }
+.card-description { margin-top: 2px; font-size: 11px; line-height: 16px; color: var(--ui-fg-faint); }
+.card-header a { font-size: 11px; font-weight: 500; color: var(--ui-fg-faint); }
+.card-header a:hover { color: var(--ui-fg); }
+.card-well {
+    position: relative; padding: 16px;
+    border: 1px solid var(--ui-well-border); border-radius: 8px;
+    background: var(--ui-well-bg); box-shadow: var(--ui-well-shadow);
+}
+.card-well.is-flush { padding: 0; }        /* tables and lists that touch the edge */
+```
+
+- Card actions (buttons, badges, a filter) go in the title row on the right.
+- Keep one collection in one card: its toolbar at the top of a flush well, its
+  table below, and its pagination in the same well.
+
+### Inputs and select triggers
+
+```css
+.input {
+    display: block; width: 100%; height: 32px; padding: 0 12px;
+    border: 1px solid var(--ui-control-border); border-radius: 8px;
+    background: var(--ui-control-bg); color: var(--ui-fg); font-size: 14px;
+    transition: border-color 120ms var(--ui-ease-out), box-shadow 120ms var(--ui-ease-out);
+}
+.input::placeholder { color: var(--ui-fg-faint); }
+.input:focus-visible { outline: none; border-color: var(--ui-accent); }
+.label { display: block; margin-bottom: 6px; font-size: 13px; font-weight: 500; color: var(--ui-fg-dim); }
+```
+
+- Use a custom listbox, not the native `<select>`.
+- Show a text input and a select trigger with the same height, fill, border,
+  and radius.
+
+### Buttons
+
+```css
+.button {
+    display: inline-flex; align-items: center; justify-content: center; gap: 6px;
+    height: 32px; padding: 0 10px; border-radius: 6px;
+    border: 1px solid rgb(0 0 0 / 9%); background: #ffffff; color: var(--ui-fg);
+    font-size: 13px; font-weight: 500; white-space: nowrap;
+    box-shadow: 0 2px 0 var(--ui-depth-color);
+    transition: color 120ms, background-color 120ms, border-color 120ms,
+                box-shadow 80ms, transform 80ms;
+    transition-timing-function: var(--ui-ease-out);
+}
+.dark .button:not(.button-primary) { border-color: rgb(255 255 255 / 8%); background: rgb(255 255 255 / 6%); }
+.button:hover { transform: translateY(-1px); box-shadow: 0 3px 0 var(--ui-depth-color); }
+.button:active { transform: translateY(2px); box-shadow: none; }
+.button:focus-visible { outline: none; box-shadow: 0 2px 0 var(--ui-depth-color), 0 0 0 1px var(--ui-accent); }
+.button:disabled { box-shadow: none; transform: none; opacity: 0.5; cursor: not-allowed; }
+.button-primary {
+    --ui-depth-color: var(--ui-accent-edge);
+    border-color: var(--ui-accent-bottom); color: var(--ui-accent-fg);
+    background: linear-gradient(to bottom, var(--ui-accent-top), var(--ui-accent-bottom));
+}
+```
+
+- Use one primary button per area. Other actions are neutral buttons.
+- Destructive actions use the error color for text and focus ring.
+
+### Menus, listboxes, and popovers
+
+```css
+.menu {
+    min-width: max(100%, 13rem); max-height: 16rem; overflow-y: auto;
+    display: flex; flex-direction: column; gap: 1px; padding: 4px;
+    border: 1px solid var(--ui-menu-border); border-radius: 10px;
+    background: var(--ui-menu-bg); box-shadow: var(--ui-menu-shadow);
+}
+.menu-option {
+    display: flex; align-items: center; justify-content: space-between; gap: 8px;
+    min-height: 32px; padding: 6px 8px; border-radius: 6px;
+    font-size: 14px; color: var(--ui-fg); white-space: nowrap; cursor: pointer;
+}
+.menu-option:hover { background: var(--ui-hover); }
+```
+
+- Mark the selected option with a check mark on the right, not with a fill.
+- Keep trigger labels static (`Filter`, `Sort`); show the selection in the menu.
+- Render menus above everything; never clip them at a card or modal edge.
+
+### Tables
+
+- Header row: 40px, 13px medium, `--ui-fg-faint`, and a 1px `--ui-divider`
+  bottom border. Fill: `rgb(0 0 0 / 2%)` in light mode, `--ui-panel` in dark
+  mode (the same as the header bar and the card outer box).
+- Dark mode rows use the card well color
+  (`color-mix(in srgb, var(--ui-panel) 66%, black)`, the same as
+  `--ui-well-bg` over the panel), so a table looks like a card: header on
+  top, content below.
+- Data rows: about 48px, 10px 16px padding, a 1px divider, and a faint hover
+  fill. Put the row action at the far right.
+- Toolbar on top (search left; filter, sort, and add right), pagination in the
+  footer. Hide the footer when there is only one page.
+- Use a table, not cards, for a collection that can grow.
+- Grid view tiles of a collection are cards without a well. In dark mode they
+  are `--ui-panel`, the same as the header bar.
+
+### Status badge
+
+```css
+.badge {
+    display: inline-flex; align-items: center; gap: 6px; height: 24px; padding: 0 8px;
+    border: 1px solid rgb(0 0 0 / 9%); border-radius: 999px; background: rgb(0 0 0 / 4%);
+    font-size: 12px; font-weight: 500; line-height: 1; color: var(--ui-fg-dim);
+}
+.dark .badge { border-color: rgb(255 255 255 / 12%); background: rgb(255 255 255 / 7%); color: var(--ui-fg); }
+.badge-dot { width: 6px; height: 6px; border-radius: 999px; background: currentColor; }
+```
+
+- The pill stays neutral. Only the 6px dot has the status color (success,
+  warning, error, neutral). Use a pulsing dot for a state in progress.
+
+### Empty state
+
+- On its own: the card outer box and well, with centered text, at least 160px
+  high (128px small, 384px large).
+- Inside a card: only the centered text, because the card is the frame.
+- Optional 44px icon tile, a 14px medium title (`--ui-fg`), a 13px faint
+  description (max width 28rem), and an optional action. No dashed border.
+
+### Modals and toasts
+
+- Modals use the card anatomy (outer box, title row, well), size to their
+  content on desktop, and put the actions on the right below a divider. Use
+  `--ui-modal-shadow`.
+- Toasts are compact cards (max width 26rem) with a status icon tile, a title,
+  an optional description, and a dismiss button. They close after 4 seconds
+  and pause on hover.
+
+### Logs and code
+
+- A monospace viewport on an opaque surface a little darker than the card
+  (dark: `oklch(15.91% 0 0)`), with one compact toolbar on top.
+- Code snippets: 12px mono, 8px radius, 1px border, the control fill.
+
+## P5. Traps
+
+- **Translucent fills stack.** A control fill of `rgb(255 255 255 / 3%)` looks
+  right on the dark well but is invisible on a menu. If you change a control
+  token for one area, set the opaque value again on the floating panels in it.
+- **Global overrides of utility classes.** If the app has a global rule that
+  replaces a border or fill utility (for example, to make borders crisper),
+  that rule also hits new elements. Check the computed value, not the class.
+- **Dark default tokens.** Define every text token for both themes. A token
+  that has only a dark value makes light-mode text too pale.
+- **`overflow: hidden` on a card** clips menus and tooltips. Keep cards
+  visible; clip only an inner scroll area.
+- **Near-black hues.** oklch lightness below about 15% compresses toward black,
+  and a hue can render bluer than expected. Check the rendered sRGB value.
+
+## P6. Adopting the language in another app
+
+1. Copy the P2 token sheet and load the fonts (Geist Sans, Geist Mono).
+2. Set the canvas on the page and the sidebar, and the panel on the header bar.
+3. Build the card, input, button, menu, badge, and empty-state components from
+   P4 before the pages. Use only the tokens in them.
+4. Put every page section in a card. Stack cards with a 24px gap.
+5. Use a table for collections, and the status badge for states.
+6. Check in light and dark mode, with the sidebar expanded and collapsed, and
+   with a menu open inside a card. Measure the computed colors of the canvas,
+   card, well, input, and menu; they must match the token sheet.
+
+---
+
+# Part 2. Coolify implementation
+
+This part defines how Coolify applies the design language with its Livewire +
+Blade + Alpine + Tailwind v4 frontend. It covers the global shell, project and
+environment pages, application navigation, settings surfaces, tables, modals,
+toasts, terminals, and metrics. In Coolify, the tokens of Part 1 map to the
+`--coollabs-*`, `--color-*`, `--card-*`, and `--well-*` variables in
+`resources/css/app.css`.
 
 Use this file as the source of truth for frontend design work. Update it in the
 same change whenever a new shared visual pattern or component is introduced.
@@ -33,9 +439,9 @@ The interface is compact and product-focused:
 
 - near-neutral layered surfaces instead of large bordered boxes;
 - 13–14px UI typography and 32px controls;
-- crisp hairline rings plus a restrained card lift (single 1px ring +
-  `0 1px 2px rgb(0 0 0 / 0.05)`) so cards and tables separate from the canvas,
-  never heavy borders or a strong floating shadow;
+- layer cards are a soft outer box around a darker inset well (see section 5),
+  with 1px borders and a restrained `0 1px 2px rgb(0 0 0 / 0.05)` lift, never
+  heavy borders or a strong floating shadow;
 - full-width data tables for dense collections;
 - outline Reicon glyphs through `<x-reicon>`;
 - the Coolify purple brand accent in light mode;
@@ -104,13 +510,21 @@ The surface ladder is defined in `resources/css/app.css`.
 
 | Token | Light | Dark | Use |
 |---|---|---|---|
-| `--coollabs-canvas` | 97% off-white | 14.48% neutral | page canvas (kept below card fills so cards lift) |
-| `--coollabs-elevated` | 98% neutral | 20.02% neutral | shells and card headers |
-| `--coollabs-base` | white | 22.64% neutral | nested card bodies |
-| `--coollabs-recessed` | 96% neutral | 25.2% neutral | inputs and listboxes |
-| `--coollabs-fill` | 92.2% neutral | 29.31% neutral | dividers and passive fills |
-| `--coollabs-line` | translucent dark | 32% neutral | control borders |
-| `--coollabs-hairline` | 85.5% neutral | 32% neutral | shell rings (crisp enough to read as a card edge, ~1.5:1) |
+| `--coollabs-canvas` | 97% off-white | 14.48% (= `--color-app`) | page canvas (kept below card fills so cards lift) |
+| `--color-panel` | white | 19.13% | topbar, top-level card outer box, table header row |
+| `--coollabs-elevated` | 98% neutral | 20.02% | shells and modal headers |
+| `--coollabs-base` | white | 22.64% | nested modal bodies and legacy panels |
+| `--coollabs-recessed` | 96% neutral | 25.2% | inputs and listboxes (`rgb(255 255 255 / 3%)` inside the dark card well) |
+| `--coollabs-fill` | 92.2% neutral | 29.31% | dividers, passive fills, menu hover |
+| `--coollabs-line` | translucent dark | 36% | control borders (`rgb(255 255 255 / 8%)` inside the dark card well) |
+| `--coollabs-hairline` | 85.5% neutral | 36% | shell rings (crisp enough to read as a card edge, ~1.6:1) |
+
+The dark level is fixed: canvas 14.48%, panel 19.13%. Also `--color-surface`
+20.02%, `--color-raised` 22.64%, `--color-selected` 26.86%, and `--color-log`
+15.91%. All dark surfaces are pure neutral (chroma 0). To change the level, move the full ladder
+by the same amount, including the opaque reset values for floating panels in
+the card well (`.dark .application-settings-section-body :is(.listbox-panel,
+...)`).
 | `--coollabs-subtle` | 50% neutral | 70.8% neutral | labels and muted titles (light darkened for WCAG AA 4.5:1) |
 
 Accent behavior is intentionally theme-aware:
@@ -133,33 +547,51 @@ opacity rather than a fully saturated fill.
 
 ### Shell layering
 
-The app shell is three distinct surface layers, not one flat color. Chrome
-lifts, content is the base, cards lift off the content:
+The app shell is three distinct surface layers, not one flat color. The
+content canvas is the base, the topbar breadcrumb bar lifts off it, and cards
+lift off the content:
 
 - **Content canvas** is the base layer: `bg-app` in dark (deepest,
-  `--color-app` `oklch(14.48% 0 0)`, sRGB 10), `bg-neutral-50` in light. The
+  `--color-app` `oklch(14.48% 0 0)`, sRGB 10,10,10), `bg-neutral-50` in light. The
   `<main>` content area and page body use it.
-- **Sidebar and topbar chrome** use `bg-panel` in dark (`--color-panel`
-  `oklch(19.13% 0 0)`, sRGB 20, a clear step lighter than the content canvas)
-  and `bg-white` in light, so the chrome reads as a separate panel from the content.
+- **Topbar chrome** uses `bg-panel` in dark (`--color-panel`
+  `oklch(19.13% 0 0)`, sRGB 20,20,20, a clear step lighter than the content canvas)
+  and `bg-white` in light, so the header reads as a separate panel. In dark
+  mode, top-level layer cards and table header rows use the same `--color-panel`.
+- **Desktop sidebar and the topbar brand block** (Coolify name and version)
+  use the content canvas color (`bg-neutral-50` / `dark:bg-app`). The sidebar
+  has a 1px right border, and the brand block has a 1px bottom border. These
+  chrome borders stay faint (`border-black/[0.06]`, `dark:border-white/[0.04]`);
+  do not use `dark:border-white/[0.06]`, which a global rule forces to the
+  solid hairline grey. The mobile drawer keeps `bg-panel` / `bg-white`.
 
 Dark surface tokens are exact oklch equivalents of chosen sRGB steps. oklch
-lightness compresses toward pure black below ~15%, so do not pick dark values by
-round oklch percentages. The dark ladder is `--color-app` 10,
-`--coollabs-elevated` 22, `--coollabs-base` 28, `--coollabs-recessed` 34 (sRGB),
-which reads as distinct surfaces.
+lightness compresses toward pure black below ~15%, so check the rendered sRGB
+value. The dark ladder is `--color-app` 10, `--color-panel` 20,
+`--coollabs-elevated` 22, `--coollabs-base` 28,
+`--coollabs-recessed` 34 (sRGB, r=g=b), which reads as distinct surfaces.
 
-Temperature: every panel is **pure neutral gray** (r=g=b), one consistent
-temperature across the sidebar, tables, cards, inputs, dividers, borders, and
-text, in both modes. Do not give one surface a cool (blue) or warm cast while
-the others stay neutral. The light page canvas uses `bg-neutral-50` (not
+Temperature: in both modes every panel is **pure neutral gray** (r=g=b).
+In dark mode, every surface token (`--color-app`, `--color-panel`,
+`--coollabs-*`, `--color-surface`, `--color-raised`, `--color-selected`,
+`--color-log`) has chroma 0, so menus, listbox panels, modals, logs, and the
+command palette match the canvas. Do not give one surface a cast (blue, warm,
+or purple). The light page canvas uses `bg-neutral-50` (not
 `bg-gray-50`, which is faintly cool) so it matches the neutral cards and chrome.
 The only intentional color is the purple/yellow brand accent.
-- **Cards, tables, and collection tiles** lift off the content canvas with
-  `dark:bg-white/[0.05]` plus the crisp `--coollabs-hairline` ring; in light
-  they are `bg-white` with the ring and the restrained card lift.
+- **Layer cards** use the outer box and inset well from section 5.
+- **Tables and collection tiles** outside a layer card use the
+  `rounded-xl border … dark:bg-white/[0.05]` shell plus the crisp
+  `--coollabs-hairline` ring; in light they are `bg-white` with the ring and
+  the restrained card lift. In dark mode these shells are painted like layer
+  cards. A tile, a separate pagination bar, or an empty box is a card without a
+  well, so it is `--color-panel`. A table (a shell whose first child is a
+  `border-b` header row) has a `--color-panel` header row and rows in the well
+  color (`color-mix(in srgb, var(--color-panel) 66%, black)`).
+  These rules match the Tailwind classes in `resources/css/app.css`, because
+  the table shells are copied markup without a shared class.
 
-Do not paint the content area with the same `bg-panel` as the sidebar, and do
+Do not paint the content area with the same `bg-panel` as the topbar, and do
 not drop card fills below `dark:bg-white/[0.05]`; both make surfaces read as one
 color. Row-hover states keep the lighter `dark:hover:bg-white/[0.025]`.
 
@@ -169,16 +601,26 @@ color. Row-hover states keep the lighter `dark:hover:bg-white/[0.025]`.
 
 ### Global shell
 
-- Main sidebar groups are compact, use outline Reicons, and keep a 32px row
-  height.
-- Active sidebar rows are rounded pills (`rounded-md`) with a solid neutral
-  selected fill (`bg-black/5` light, `bg-white/6` dark) and no accent rail.
-  Hover rows use the same radius. Do not use accent-tinted gradients on nav
+- Main sidebar groups are compact and use outline Reicons. With Appearance →
+  Navigation items → Flat, rows are 32px high.
+- With the default tile items (not Appearance → Navigation items → Flat), each
+  icon sits in a 30px 3D tile (16px icon, 6px padding, 1px border) in a 36px row.
+- With tile items, the row has no fill: the current item shows through its
+  accent tile (purple light, yellow dark) and its brighter label.
+- With Flat items, active rows are rounded pills (`rounded-md`) with a solid
+  neutral selected fill (`bg-black/5` light, `bg-white/6` dark) and no accent
+  rail. Hover rows use the same radius. Do not use accent-tinted gradients on nav
   rows; yellow washes look muddy on dark UI.
 - Nested items sit behind a thin 1px guide line (`.nav-children`) and use the
   same selected pill, not a thick box border.
 - The update badge sits on the version row and uses a tiny fully rounded
   primary-action pill.
+- Submenu chevrons (the right chevron on rows that open a submenu and the back
+  chevron) are `text-coollabs` in light mode and grey in dark mode
+  (`dark:text-fg-faint` right, `dark:text-fg-dim` back).
+- Brand items use a one-color brand glyph in `<x-reicon>` instead of an outline
+  icon when the brand mark is clearer (for example `cloudflare` for Cloudflare
+  Tunnel, drawn from `public/svgs/cloudflared.svg`).
 
 ### Resource navigation
 
@@ -229,8 +671,13 @@ sub-header.
 The dashboard is a compact overview, not a metrics wall. It has no page header:
 live active deployments come first as a compact table, followed by traffic
 analytics when a server has it enabled, then two full-width sections (Projects,
-then Servers) that follow the projects-page grid pattern. Each section uses
-`x-section-heading` linking to its full index. Communicate server health with
+then Servers). Each section uses `x-section-heading` with a small "View all"
+link to its full index (next to the switcher) and a table / grid `x-canvas-view-toggle` (no canvas
+link). Table is the default; each section remembers its own choice. A page-level
+List / Canvas switch at the top opens `/dashboard/canvas`: the servers canvas
+with a "Deploying" / "Queued" pill on each application card that has an active
+deployment, and a foldable Recent deployments panel at the bottom left (active, then
+recent; a row shows its card, the status opens the deployment). Communicate server health with
 the shared status badge.
 
 ### Top-level dashboard destinations
@@ -359,17 +806,44 @@ replace a manual shell when modifying it instead of creating another variant.
 
 Anatomy:
 
-- 8px shell radius;
-- elevated header strip;
-- no divider below the header;
-- nested base-color body with its own fill ring;
+- soft outer box: 12px radius, 1px border, 6px padding, faint fill
+  (`rgb(0 0 0 / 0.75%)` light). In dark mode a top-level card is
+  `--color-panel`, the same as the topbar; a nested card keeps
+  `rgb(255 255 255 / 6%)` over its parent;
+- small title row on the outer box (13px semibold title, 11px description and
+  header links), no divider below it;
+- body is an inset well: 8px radius, 1px border, white in light and
+  `rgb(0 0 0 / 34%)` in dark;
 - 16px body padding;
 - optional `flush` mode for full-bleed tables;
-- card-level actions belong in the header slot.
+- card-level actions belong in the header slot;
+- theme colors are CSS variables on the card (`--card-bg`, `--card-border`,
+  `--well-bg`, `--well-border`, `--well-shadow`, `--card-fg*`), overridden in
+  `.dark .application-settings-section`.
 
-Header actions use an 8px top/right inset while the title keeps its 16px left
-inset. Do not leave a larger empty strip between the final action and the
-card's top-right corner.
+The title row has `4px 8px 10px` padding inside the 6px outer padding, so
+header actions sit 10px from the top and 14px from the right edge.
+
+The card keeps `overflow: visible` so listbox panels and tooltips can escape
+it. Do not add `overflow: hidden` to the card or the well.
+
+Some pages put a well (`.application-settings-section-body`) directly on the
+page without a card, for example the domains and environment variable tables.
+The well colors are defined on the well itself as well as on the card, so a
+standalone well keeps its background and border. In dark mode a standalone well
+uses the card outer-box surface (`--card-bg`, `--card-border`) instead of the
+black well fill, because the black fill directly on the canvas is darker than
+the page. An `x-empty` inside a
+standalone well shows only its centered text, as it does inside a card.
+
+Inside the dark well, controls use a darker translucent fill and border
+(`--coollabs-recessed: rgb(255 255 255 / 3%)`, `--coollabs-line:
+rgb(255 255 255 / 8%)`), set on `.dark .application-settings-section-body`.
+The global opaque values look too light on the dark well. Floating panels in
+the well (`.listbox-panel`, `.searchable-listbox-panel`, `[role="listbox"]`,
+`[role="menu"]`) set the opaque values again, so they are not see-through. A
+new floating panel that uses `--coollabs-recessed` in a card needs the same
+reset.
 
 Do not split one collection into a summary card followed by a table or log
 card. Keep its status/action in the header, its view switcher or toolbar at the
@@ -392,8 +866,14 @@ Examples:
 
 Do not give visibly inset parent and child boxes the same radius. Flush or
 edge-to-edge children are exempt because there is no visible inset to add.
+The layer card is an intentional exception: its 12px outer box and 8px well
+with a 6px inset match the reference design.
 
-Use an empty state when the section has no usable controls:
+Use an empty state when the section has no usable controls. On its own,
+`x-empty` is the layer-card outer box and inset well with a centered 14px title
+and a 13px muted description (minimum height 160px; `sm` 128px, `lg` 384px).
+Inside a layer card, the card is the frame, so it shows only the centered text.
+Do not use a dashed border for empty states.
 
 ```blade
 <x-empty size="sm" title="Nothing here" description="Explain what enables it.">
@@ -628,8 +1108,7 @@ targets.
 
 `x-modal-input` and confirmation dialogs reuse the layer-card shell:
 
-- compact elevated header;
-- nested base-color body;
+- the same outer box, title row, and inset well as layer cards;
 - content-width desktop sizing;
 - shared 32px controls;
 - no redundant description below a self-explanatory title;
@@ -736,10 +1215,14 @@ Charts follow the application metrics implementation:
 - downsample long time ranges before rendering.
 
 Only add a metric if Sentinel exposes historical data for it. Current Sentinel
-history endpoints store CPU and memory. Root filesystem usage is included in
-the periodic push payload for threshold notifications, but it is not stored as
-a historical Sentinel metric and has no history endpoint, so it cannot power a
-disk-usage graph yet.
+history endpoints store CPU, memory, disk, network throughput, and load average
+(Sentinel PR #47 added disk, network, and load). Bulk snapshot endpoints
+(`/api/summary`, `/api/containers/current`) return the latest host and
+per-container values in one call for fleet-wide views.
+
+The fleet Metrics page (`/metrics`, top-level sidebar) aggregates these across
+every team server: KPI tiles, per-metric trend cards, a threshold-colored
+servers table, and a fleet-wide hottest-containers list.
 
 ---
 
@@ -759,6 +1242,7 @@ Use these as implementation references:
 | Dense environment table and footer | `resources/views/livewire/project/shared/environment-variable/all.blade.php` |
 | Standard table toolbar controls | `resources/views/components/table/*` |
 | Application metrics charts | `resources/views/livewire/project/shared/metrics.blade.php` |
+| Fleet metrics page | `resources/views/livewire/fleet/metrics.blade.php` |
 | Browser terminal workspace | `resources/views/livewire/terminal/index.blade.php` |
 | Layer card | `resources/views/components/application/settings-section.blade.php` |
 | Custom dropdown | `resources/views/components/forms/listbox.blade.php` |
diff --git a/app/Actions/Application/CleanupCancelledDeployment.php b/app/Actions/Application/CleanupCancelledDeployment.php
index 171e660e66..5da94db3cb 100644
--- a/app/Actions/Application/CleanupCancelledDeployment.php
+++ b/app/Actions/Application/CleanupCancelledDeployment.php
@@ -28,6 +28,12 @@ class CleanupCancelledDeployment
                     if (str($containerExists)->trim()->isNotEmpty()) {
                         instant_remote_process(["docker rm -f {$deploymentUuid}"], $server);
                         $containerStopped = true;
+
+                        // A removed helper cannot stop the Railpack builder, which keeps the memory of its builds.
+                        if ($deployment->application?->build_pack === 'railpack') {
+                            $helperImage = coolifyHelperImage().':'.getHelperVersion();
+                            instant_remote_process([railpackBuilderHelperCommand(railpackBuildxMetadataVolume($server), $helperImage, 'true')], $server, false);
+                        }
                     }
                 } catch (\Throwable $e) {
                     $firstError ??= $e;
diff --git a/app/Actions/Application/GetRollbackImages.php b/app/Actions/Application/GetRollbackImages.php
new file mode 100644
index 0000000000..73ab3931fa
--- /dev/null
+++ b/app/Actions/Application/GetRollbackImages.php
@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Actions\Application;
+
+use App\Enums\ApplicationDeploymentStatus;
+use App\Models\Application;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+/**
+ * Lists the images an application can roll back to: the images on its server, and the images of
+ * recent successful deployments that were pushed to the Docker registry. The deployment pulls a
+ * registry image again when the server no longer has it.
+ */
+class GetRollbackImages
+{
+    use AsAction;
+
+    public const REGISTRY_DEPLOYMENTS_LIMIT = 10;
+
+    /**
+     * @return array{current: ?string, images: list<array{tag: string, created_at: ?string, is_current: bool, source: 'local'|'registry'}>}
+     */
+    public function handle(Application $application): array
+    {
+        $current = null;
+        $images = collect();
+
+        $server = $application->destination?->server;
+        if ($server?->isFunctional()) {
+            $output = instant_remote_process([
+                "docker inspect --format='{{.Config.Image}}' {$application->uuid}",
+            ], $server, throwError: false);
+            $current = self::imageTag(str($output)->trim()->toString());
+
+            $repository = $application->docker_registry_image_name ?: $application->uuid;
+            $output = instant_remote_process([
+                "docker images --format '{{.Repository}}#{{.Tag}}#{{.CreatedAt}}'",
+            ], $server);
+            $images = str($output)->trim()->explode("\n")
+                ->map(fn (string $line) => explode('#', $line))
+                // Exact repository match only, so other images with a similar name are not listed.
+                ->filter(fn (array $parts) => $parts[0] === $repository && filled($parts[1] ?? null))
+                ->map(fn (array $parts) => [
+                    'tag' => $parts[1],
+                    'created_at' => $parts[2] ?? null,
+                    'is_current' => $parts[1] === $current,
+                    'source' => 'local',
+                ])
+                ->keyBy('tag');
+        }
+
+        foreach ($this->registryImages($application, $current) as $image) {
+            if (! $images->has($image['tag'])) {
+                $images->put($image['tag'], $image);
+            }
+        }
+
+        return [
+            'current' => $current,
+            'images' => $images->values()->all(),
+        ];
+    }
+
+    /**
+     * Each successful deployment pushes `<image name>:<commit>` to the registry, so the commits of
+     * recent deployments are rollback targets. Docker image applications do not push, and
+     * Dockerfile-only applications always push the `latest` tag.
+     *
+     * @return list<array{tag: string, created_at: ?string, is_current: bool, source: 'registry'}>
+     */
+    private function registryImages(Application $application, ?string $current): array
+    {
+        if (blank($application->docker_registry_image_name)
+            || in_array($application->build_pack, ['dockerimage', 'dockercompose'], true)
+            || filled($application->dockerfile)) {
+            return [];
+        }
+
+        return $application->deployment_queue()
+            ->where('status', ApplicationDeploymentStatus::FINISHED->value)
+            ->where('pull_request_id', 0)
+            ->whereNotNull('commit')
+            ->where('commit', '!=', 'HEAD')
+            ->select('commit')
+            ->selectRaw('max(updated_at) as deployed_at')
+            ->groupBy('commit')
+            ->orderByDesc('deployed_at')
+            ->limit(self::REGISTRY_DEPLOYMENTS_LIMIT)
+            ->get()
+            ->map(function ($deployment) use ($current) {
+                // The same tag as the deployment job builds in generate_image_names().
+                $tag = substr($deployment->commit, 0, 128);
+
+                return [
+                    'tag' => $tag,
+                    'created_at' => $deployment->deployed_at,
+                    'is_current' => $tag === $current,
+                    'source' => 'registry',
+                ];
+            })
+            ->values()
+            ->all();
+    }
+
+    /**
+     * The tag of an image reference such as `registry.example.com:5000/team/app:tag`, or null for a digest.
+     */
+    public static function imageTag(string $imageReference): ?string
+    {
+        if (str_contains($imageReference, '@')) {
+            return null;
+        }
+
+        $lastColon = strrpos($imageReference, ':');
+        $lastSlash = strrpos($imageReference, '/');
+
+        if ($lastColon === false || ($lastSlash !== false && $lastColon < $lastSlash)) {
+            return null;
+        }
+
+        return substr($imageReference, $lastColon + 1) ?: null;
+    }
+}
diff --git a/app/Actions/CoolifyTask/RunRemoteProcess.php b/app/Actions/CoolifyTask/RunRemoteProcess.php
index 90affa8db2..4f525ebcc8 100644
--- a/app/Actions/CoolifyTask/RunRemoteProcess.php
+++ b/app/Actions/CoolifyTask/RunRemoteProcess.php
@@ -6,19 +6,33 @@ use App\Enums\ActivityTypes;
 use App\Enums\ProcessStatus;
 use App\Helpers\SshMultiplexingHelper;
 use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\EnvironmentVariable;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Services\Security\SensitiveDataRedactor;
 use App\Support\DatabaseImport\DatabaseImportCleanup;
 use App\Support\RemoteProcessCommand;
 use App\Support\ResourceStartActivity;
 use App\Traits\BroadcastsToTeam;
 use Illuminate\Contracts\Process\ProcessResult;
+use Illuminate\Process\Exceptions\ProcessTimedOutException;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Process;
 use Spatie\Activitylog\Models\Activity;
+use Symfony\Component\Process\Exception\ProcessTimedOutException as SymfonyProcessTimedOutException;
+use Throwable;
 
 class RunRemoteProcess
 {
+    /**
+     * A private key block that has no END line yet.
+     */
+    private const UNFINISHED_PRIVATE_KEY_PATTERN = '/-----BEGIN [A-Z ]*PRIVATE KEY-----(?![\s\S]*-----END [A-Z ]*PRIVATE KEY-----)[\s\S]*/';
+
     public Activity $activity;
 
     public bool $hide_from_output;
@@ -39,6 +53,21 @@ class RunRemoteProcess
 
     protected int $counter = 1;
 
+    /**
+     * Output of each stream that is not redacted yet, because its line or private key block is not complete.
+     *
+     * @var array<string, string>
+     */
+    private array $pendingOutput = [];
+
+    /**
+     * Environment values of the activity's resource to hide in its output, resolved once.
+     * False when resolving them failed, so the output is fully redacted.
+     *
+     * @var array{known: list<string>, locked: list<string>}|false|null
+     */
+    private array|false|null $logSecrets = null;
+
     /**
      * Create a new job instance.
      */
@@ -83,16 +112,23 @@ class RunRemoteProcess
 
         $status = ProcessStatus::IN_PROGRESS;
         $timeout = config('constants.ssh.command_timeout');
-        $process = Process::timeout($timeout)->start($this->getCommand(), $this->handleOutput(...));
-        // Start from the stored properties and save now, so later output writes only change the log and
-        // never write back an old copy over a status that Coolify set meanwhile (for example a stopped import).
-        $stored = Activity::query()->whereKey($this->activity->getKey())->first()?->properties ?? $this->activity->properties;
-        $this->activity->properties = $stored->merge([
-            'process_id' => $process->id(),
-        ]);
-        $this->activity->save();
+        try {
+            $process = Process::timeout($timeout)->start($this->getCommand(), $this->handleOutput(...));
+            // Start from the stored properties and save now, so later output writes only change the log and
+            // never write back an old copy over a status that Coolify set meanwhile (for example a stopped import).
+            $stored = Activity::query()->whereKey($this->activity->getKey())->first()?->properties ?? $this->activity->properties;
+            $this->activity->properties = $stored->merge([
+                'process_id' => $process->id(),
+            ]);
+            $this->activity->save();
 
-        $processResult = $process->wait();
+            $processResult = $process->wait();
+        } catch (ProcessTimedOutException|SymfonyProcessTimedOutException) {
+            // The timeout message contains the full SSH command, which can contain secrets.
+            throw new \RuntimeException("The command on the server timed out after {$timeout} seconds.", 124);
+        } finally {
+            $this->flushPendingOutput();
+        }
 
         // A database import whose SSH command ended without the restore result keeps blocking the
         // database until its restore is stopped. The stop event also cleans up, so the normal
@@ -103,13 +139,13 @@ class RunRemoteProcess
             && DatabaseImportCleanup::stopAfterTransportFailure($this->activity, $processResult->exitCode())) {
             $this->activity->properties = $this->activity->properties->merge([
                 'exitCode' => $processResult->exitCode(),
-                'stdout' => $processResult->output(),
-                'stderr' => $processResult->errorOutput(),
+                'stdout' => $this->redact($processResult->output()),
+                'stderr' => $this->redact($processResult->errorOutput()),
             ]);
             $this->activity->save();
 
             if (! $this->ignore_errors) {
-                throw new \RuntimeException($processResult->errorOutput(), $processResult->exitCode());
+                throw new \RuntimeException($this->redact($processResult->errorOutput()), $processResult->exitCode());
             }
 
             return $processResult;
@@ -127,8 +163,8 @@ class RunRemoteProcess
 
         $properties = [
             'exitCode' => $processResult->exitCode(),
-            'stdout' => $processResult->output(),
-            'stderr' => $processResult->errorOutput(),
+            'stdout' => $this->redact($processResult->output()),
+            'stderr' => $this->redact($processResult->errorOutput()),
             'status' => $status->value,
         ];
 
@@ -148,12 +184,12 @@ class RunRemoteProcess
         if ($this->call_event_on_finish) {
             try {
                 self::dispatchFinishEvent($this->activity, $this->call_event_on_finish, $this->call_event_data);
-            } catch (\Throwable $e) {
+            } catch (Throwable $e) {
                 Log::error('Error calling event: '.$e->getMessage());
             }
         }
         if ($processResult->exitCode() != 0 && ! $this->ignore_errors) {
-            throw new \RuntimeException($processResult->errorOutput(), $processResult->exitCode());
+            throw new \RuntimeException($this->redact($processResult->errorOutput()), $processResult->exitCode());
         }
 
         return $processResult;
@@ -192,6 +228,11 @@ class RunRemoteProcess
         if ($this->hide_from_output) {
             return;
         }
+        $this->pendingOutput[$type] = ($this->pendingOutput[$type] ?? '').$output;
+        $output = self::takeCompleteOutput($this->pendingOutput[$type]);
+        if ($output === '') {
+            return;
+        }
         $this->current_time = $this->elapsedTime();
         $this->activity->description = $this->encodeOutput($type, $output);
         if ($this->isAfterLastThrottle()) {
@@ -203,6 +244,51 @@ class RunRemoteProcess
         }
     }
 
+    /**
+     * Write the output that is still buffered when the process ends, also after a timeout or failure.
+     */
+    private function flushPendingOutput(): void
+    {
+        $written = false;
+        foreach ($this->pendingOutput as $type => $pending) {
+            $output = self::takeCompleteOutput($this->pendingOutput[$type], final: true);
+            if ($output !== '') {
+                $this->activity->description = $this->encodeOutput($type, $output);
+                $written = true;
+            }
+        }
+        if ($written) {
+            $this->activity->save();
+        }
+    }
+
+    /**
+     * Take the complete lines from the buffered output of a stream, so a secret split across output
+     * chunks is redacted as a whole. A private key block stays buffered until its END line. With
+     * $final, all buffered output is taken, and an unfinished private key block is hidden.
+     */
+    public static function takeCompleteOutput(string &$pending, bool $final = false): string
+    {
+        if ($final) {
+            $output = preg_replace(self::UNFINISHED_PRIVATE_KEY_PATTERN, REDACTED, $pending) ?? REDACTED;
+            $pending = '';
+
+            return $output;
+        }
+
+        $end = max(strrpos($pending, "\n"), strrpos($pending, "\r"));
+        if ($end === false) {
+            return '';
+        }
+        $output = substr($pending, 0, $end + 1);
+        if (preg_match(self::UNFINISHED_PRIVATE_KEY_PATTERN, $output, $match, PREG_OFFSET_CAPTURE) === 1) {
+            $output = substr($output, 0, $match[0][1]);
+        }
+        $pending = substr($pending, strlen($output));
+
+        return $output;
+    }
+
     protected function elapsedTime(): int
     {
         $timeMs = (hrtime(true) - $this->time_start) / 1_000_000;
@@ -215,7 +301,7 @@ class RunRemoteProcess
         $outputStack = json_decode($this->activity->description, associative: true, flags: JSON_THROW_ON_ERROR | JSON_UNESCAPED_UNICODE);
         $outputStack[] = [
             'type' => $type,
-            'output' => $output,
+            'output' => $this->redact($output),
             'timestamp' => hrtime(true),
             'batch' => ApplicationDeploymentJob::$batch_counter,
             'order' => $this->getLatestCounter(),
@@ -234,6 +320,50 @@ class RunRemoteProcess
         return end($description)['order'] + 1;
     }
 
+    private function redact(string $value): string
+    {
+        $this->logSecrets ??= $this->resolveLogSecrets();
+        if ($this->logSecrets === false) {
+            return REDACTED;
+        }
+
+        return resolve(SensitiveDataRedactor::class)->redactText($value, $this->logSecrets['known'], $this->logSecrets['locked']);
+    }
+
+    /**
+     * The environment values of the application or service this activity runs for, following
+     * the resource's log redaction setting.
+     *
+     * @return array{known: list<string>, locked: list<string>}|false
+     */
+    private function resolveLogSecrets(): array|false
+    {
+        try {
+            return EnvironmentVariable::logRedactionSecretsFor($this->logResource());
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
+    private function logResource(): Application|Service|null
+    {
+        $subject = $this->activity->subject_type !== null ? $this->activity->subject : null;
+        if ($subject instanceof ServiceApplication || $subject instanceof ServiceDatabase) {
+            return $subject->service;
+        }
+        if ($subject instanceof Application || $subject instanceof Service) {
+            return $subject;
+        }
+
+        $typeUuid = $this->activity->getExtraProperty('type_uuid');
+        if (! is_string($typeUuid) || $typeUuid === '') {
+            return null;
+        }
+
+        return Service::query()->where('uuid', $typeUuid)->first()
+            ?? Application::query()->where('uuid', $typeUuid)->first();
+    }
+
     /**
      * Determines if it's time to write again to database.
      *
diff --git a/app/Actions/Database/FlushDatabase.php b/app/Actions/Database/FlushDatabase.php
new file mode 100644
index 0000000000..d6fd152490
--- /dev/null
+++ b/app/Actions/Database/FlushDatabase.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Actions\Database;
+
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneRedis;
+use Lorisleiva\Actions\Concerns\AsAction;
+use RuntimeException;
+
+class FlushDatabase
+{
+    use AsAction;
+
+    public function handle(StandaloneRedis|StandaloneKeydb|StandaloneDragonfly $database): void
+    {
+        $cli = $database instanceof StandaloneKeydb ? 'keydb-cli' : 'redis-cli';
+        if ($database instanceof StandaloneDragonfly && $database->enable_ssl) {
+            $cli .= ' --tls --cacert /etc/dragonfly/certs/coolify-ca.crt --cert /etc/dragonfly/certs/server.crt --key /etc/dragonfly/certs/server.key';
+        }
+
+        $output = instant_remote_process(
+            ["docker exec {$database->uuid} sh -c 'REDISCLI_AUTH=\"\$REDIS_PASSWORD\" {$cli} FLUSHALL ASYNC'"],
+            $database->destination->server,
+        );
+
+        if ($output !== 'OK') {
+            throw new RuntimeException($output ?: 'Failed to flush the database.');
+        }
+    }
+}
diff --git a/app/Actions/Database/StartClickhouse.php b/app/Actions/Database/StartClickhouse.php
index 6463b70cdf..86545e010f 100644
--- a/app/Actions/Database/StartClickhouse.php
+++ b/app/Actions/Database/StartClickhouse.php
@@ -81,7 +81,7 @@ class StartClickhouse
             data_set($docker_compose, "services.{$container_name}.cpuset", $this->database->limits_cpuset);
         }
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
         if (count($this->database->ports_mappings_array) > 0) {
             $docker_compose['services'][$container_name]['ports'] = $this->database->ports_mappings_array;
diff --git a/app/Actions/Database/StartDragonfly.php b/app/Actions/Database/StartDragonfly.php
index 72f66a64ce..2602de63d1 100644
--- a/app/Actions/Database/StartDragonfly.php
+++ b/app/Actions/Database/StartDragonfly.php
@@ -130,7 +130,7 @@ class StartDragonfly
         }
 
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
 
         if (count($this->database->ports_mappings_array) > 0) {
diff --git a/app/Actions/Database/StartKeydb.php b/app/Actions/Database/StartKeydb.php
index 75827b4bac..dddb86e2c2 100644
--- a/app/Actions/Database/StartKeydb.php
+++ b/app/Actions/Database/StartKeydb.php
@@ -132,7 +132,7 @@ class StartKeydb
         }
 
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
 
         if (count($this->database->ports_mappings_array) > 0) {
diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index 5440ed8611..234583a538 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -123,7 +123,7 @@ class StartMariadb
         }
 
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
 
         if (count($this->database->ports_mappings_array) > 0) {
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index 49cee8ea3f..0064b43e38 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -130,7 +130,7 @@ class StartMongodb
         }
 
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
 
         if (count($this->database->ports_mappings_array) > 0) {
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index 6fb288b7b0..e8c24d5179 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -125,7 +125,7 @@ class StartMysql
         }
 
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
 
         if (count($this->database->ports_mappings_array) > 0) {
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 835b0f18d4..fa1224d9cc 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -131,7 +131,7 @@ class StartPostgresql
         }
 
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
 
         if (count($this->database->ports_mappings_array) > 0) {
diff --git a/app/Actions/Database/StartRedis.php b/app/Actions/Database/StartRedis.php
index 3d447d91da..b0ac2e7001 100644
--- a/app/Actions/Database/StartRedis.php
+++ b/app/Actions/Database/StartRedis.php
@@ -133,7 +133,7 @@ class StartRedis
         }
 
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
 
         if (count($this->database->ports_mappings_array) > 0) {
diff --git a/app/Actions/Database/StartSqlite.php b/app/Actions/Database/StartSqlite.php
index b85d4e73e3..b63598f998 100644
--- a/app/Actions/Database/StartSqlite.php
+++ b/app/Actions/Database/StartSqlite.php
@@ -69,7 +69,7 @@ class StartSqlite
             data_set($docker_compose, "services.{$container_name}.cpuset", $this->database->limits_cpuset);
         }
         if ($this->database->destination->server->isLogDrainEnabled() && $this->database->isLogDrainEnabled()) {
-            $docker_compose['services'][$container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$container_name]['logging'] = generate_log_drain_configuration($this->database->destination->server);
         }
         if (count($persistent_storages) > 0) {
             $docker_compose['services'][$container_name]['volumes'] = $persistent_storages;
diff --git a/app/Actions/Development/StartDevelopmentInstanceDatabase.php b/app/Actions/Development/StartDevelopmentInstanceDatabase.php
new file mode 100644
index 0000000000..41b8428bd4
--- /dev/null
+++ b/app/Actions/Development/StartDevelopmentInstanceDatabase.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Actions\Development;
+
+use App\Models\Server;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+/**
+ * Starts a `coolify-db` container on a development VM that acts as the localhost server.
+ *
+ * The instance backup reads the credentials from this container and dumps it, like on a self-hosted install.
+ * The real development database runs on the host, so the VM cannot reach it.
+ */
+class StartDevelopmentInstanceDatabase
+{
+    use AsAction;
+
+    public function handle(Server $server): void
+    {
+        $environment = collect([
+            'POSTGRES_USER' => config('database.connections.pgsql.username'),
+            'POSTGRES_PASSWORD' => config('database.connections.pgsql.password'),
+            'POSTGRES_DB' => config('database.connections.pgsql.database'),
+        ])->map(fn ($value, string $key): string => '-e '.escapeshellarg("{$key}={$value}"))->implode(' ');
+
+        instant_remote_process([
+            'if ! docker inspect coolify-db >/dev/null 2>&1; then',
+            "docker run -d --name coolify-db --restart unless-stopped {$environment} postgres:15-alpine",
+            'fi',
+            'docker start coolify-db',
+        ], $server, disableMultiplexing: true);
+    }
+}
diff --git a/app/Actions/Development/StartDevelopmentQemuVm.php b/app/Actions/Development/StartDevelopmentQemuVm.php
index 52570dc42e..5815185508 100644
--- a/app/Actions/Development/StartDevelopmentQemuVm.php
+++ b/app/Actions/Development/StartDevelopmentQemuVm.php
@@ -73,7 +73,24 @@ class StartDevelopmentQemuVm
             return;
         }
 
-        $this->runOrFail(($state === 'paused' ? 'virsh resume ' : 'virsh start ').escapeshellarg($domain));
+        if ($state === 'paused') {
+            $this->runOrFail('virsh resume '.escapeshellarg($domain));
+
+            return;
+        }
+
+        $this->applyMemory($domain);
+        $this->runOrFail('virsh start '.escapeshellarg($domain));
+    }
+
+    /**
+     * Sets the configured memory on a stopped VM, so VMs created with a larger size shrink on their next start.
+     */
+    private function applyMemory(string $domain): void
+    {
+        $memory = (int) config('development-qemu.memory').'M';
+        $this->runOrFail(sprintf('virsh setmaxmem %s %s --config', escapeshellarg($domain), $memory));
+        $this->runOrFail(sprintf('virsh setmem %s %s --config', escapeshellarg($domain), $memory));
     }
 
     private function destroyVm(string $domain): void
diff --git a/app/Actions/Proxy/StartProxy.php b/app/Actions/Proxy/StartProxy.php
index 169064e180..98c0e0bc64 100644
--- a/app/Actions/Proxy/StartProxy.php
+++ b/app/Actions/Proxy/StartProxy.php
@@ -56,10 +56,11 @@ class StartProxy
                 "echo 'Successfully started coolify-proxy.'",
             ]);
         } else {
-            $caddyfile = 'import /dynamic/*.caddy';
+            // The base Caddyfile also holds the maintenance blocks (see Server::caddyBaseCaddyfile()).
+            $caddyfile = base64_encode($server->caddyBaseCaddyfile());
             $commands = $commands->merge([
                 "mkdir -p $proxy_path/dynamic",
-                "echo '$caddyfile' | tee $proxy_path/dynamic/Caddyfile > /dev/null",
+                "echo '$caddyfile' | base64 -d | tee $proxy_path/dynamic/Caddyfile > /dev/null",
                 "echo 'Creating required Docker Compose file.'",
                 "echo 'Pulling docker image.'",
                 "docker compose -f $compose_file pull",
diff --git a/app/Actions/Proxy/StopProxy.php b/app/Actions/Proxy/StopProxy.php
index d3999a6e30..881aa0252f 100644
--- a/app/Actions/Proxy/StopProxy.php
+++ b/app/Actions/Proxy/StopProxy.php
@@ -23,11 +23,16 @@ class StopProxy
                 ProxyStatusChangedUI::dispatch($server->team_id);
             }
 
+            $errorPageCommands = $server->isSwarm() ? [] : [
+                'docker rm -f '.Server::PROXY_ERROR_PAGE_CONTAINER.' 2>/dev/null || true',
+            ];
+
             instant_remote_process(command: [
                 dockerStopCommand($timeout, $containerName, $server).' 2>/dev/null || true',
                 "docker rm -f $containerName 2>/dev/null || true",
                 // The Traefik traffic analytics log rotation sidecar must not outlive the proxy.
                 'docker rm -f '.TRAEFIK_LOGROTATE_CONTAINER.' 2>/dev/null || true',
+                ...$errorPageCommands,
                 '# Wait for container to be fully removed',
                 'for i in {1..10}; do',
                 "    if ! docker ps -a --format \"{{.Names}}\" | grep -q \"^$containerName$\"; then",
diff --git a/app/Actions/Server/CheckUpdates.php b/app/Actions/Server/CheckUpdates.php
index 5cf5658f8f..d0586f2d16 100644
--- a/app/Actions/Server/CheckUpdates.php
+++ b/app/Actions/Server/CheckUpdates.php
@@ -12,6 +12,97 @@ class CheckUpdates
 
     public string $jobQueue = 'high';
 
+    /**
+     * Package managers that only support a full system upgrade. A partial upgrade on Arch Linux is not supported.
+     *
+     * @see https://wiki.archlinux.org/title/System_maintenance#Partial_upgrades_are_unsupported
+     */
+    public const FULL_UPGRADE_ONLY = ['pacman'];
+
+    /**
+     * Latest upgrade of each installed package. dnf5 does not add a newline after --qf, dnf4 does, so empty lines are skipped.
+     */
+    public const DNF_UPGRADES_COMMAND = 'LANG=C dnf repoquery -q --refresh --upgrades --latest-limit 1 --qf "%{name} %{arch} %{evr} %{repoid}\n"';
+
+    public const RPM_INSTALLED_COMMAND = 'rpm -qa --qf "%{NAME} %{ARCH} %{VERSION}-%{RELEASE}\n"';
+
+    /**
+     * Lists pacman updates without `pacman -Sy` on the live database (that would make the next single install a partial upgrade).
+     * `checkupdates` needs fakeroot when it runs as root. Without it, the same sync runs into a temporary database.
+     * pacman 7 downloads as the `alpm` user, so the temporary directory must be readable (755).
+     *
+     * @see https://man.archlinux.org/man/checkupdates.8
+     */
+    public const PACMAN_CHECK_COMMAND = "sh -c 'if command -v checkupdates >/dev/null 2>&1 && command -v fakeroot >/dev/null 2>&1; then checkupdates; rc=\$?; if [ \$rc -eq 2 ]; then exit 0; fi; exit \$rc; fi; db=\$(mktemp -d) || exit 1; chmod 755 \"\$db\"; ln -s /var/lib/pacman/local \"\$db/local\"; if ! LANG=C pacman -Sy --dbpath \"\$db\" --logfile /dev/null >/dev/null; then rm -rf \"\$db\"; exit 1; fi; pacman -Qu --dbpath \"\$db\" 2>/dev/null; rm -rf \"\$db\"; exit 0'";
+
+    /**
+     * Security advisories of the available updates. dnf5 still accepts `updateinfo` as an alias of `advisory`.
+     *
+     * @see https://dnf5.readthedocs.io/en/latest/commands/advisory.8.html
+     */
+    public const DNF_SECURITY_COMMAND = "sh -c 'LANG=C dnf updateinfo list --security -q 2>/dev/null; exit 0'";
+
+    /**
+     * Packages that the security patches would upgrade. `zypper -x list-patches` ignores --category, and it does
+     * not contain package names, so a dry run of `zypper patch` is used.
+     *
+     * @see https://github.com/openSUSE/zypper/blob/master/doc/zypper.8.txt
+     */
+    public const ZYPPER_SECURITY_COMMAND = "sh -c 'LANG=C zypper -n -x patch --dry-run --category security 2>/dev/null; exit 0'";
+
+    /**
+     * Prints REBOOT=yes|no|unknown. Debian/Ubuntu write /var/run/reboot-required; needrestart batch mode reports the
+     * kernel status (KSTA 2 and 3 mean a newer kernel is installed); dnf needs-restarting and zypper needs-rebooting
+     * (exit code 102) cover the RHEL and SUSE families. Text is matched because a missing dnf plugin also exits 1.
+     *
+     * @see https://github.com/liske/needrestart/blob/master/README.batch.md
+     * @see https://dnf-plugins-core.readthedocs.io/en/latest/needs_restarting.html
+     */
+    public const REBOOT_CHECK_COMMAND = <<<'SH'
+sh -c 'if [ -f /var/run/reboot-required ]; then echo REBOOT=yes; exit 0; fi; if command -v needrestart >/dev/null 2>&1; then k=$(needrestart -b 2>/dev/null | sed -n "s/^NEEDRESTART-KSTA: *//p"); case "$k" in 2|3) echo REBOOT=yes; exit 0;; 1) echo REBOOT=no; exit 0;; esac; fi; if command -v dnf >/dev/null 2>&1; then o=$(LANG=C dnf needs-restarting -r 2>/dev/null); case "$o" in *"Reboot is required"*) echo REBOOT=yes; exit 0;; *"should not be necessary"*) echo REBOOT=no; exit 0;; esac; fi; if command -v zypper >/dev/null 2>&1; then zypper -q needs-rebooting >/dev/null 2>&1; rc=$?; if [ $rc -eq 102 ]; then echo REBOOT=yes; exit 0; fi; if [ $rc -eq 0 ]; then echo REBOOT=no; exit 0; fi; fi; if [ -d /var/lib/dpkg ]; then echo REBOOT=no; exit 0; fi; echo REBOOT=unknown'
+SH;
+
+    /**
+     * Packages whose update can interrupt the server, per package manager. `*` matches like a shell glob.
+     * docker: restarts the Docker daemon and with it the running containers. kernel: needs a reboot.
+     * system: core libraries and services that are restarted or need a reboot to apply fully.
+     *
+     * @var array<string, array<string, list<string>>>
+     */
+    public const RISKY_PACKAGES = [
+        'apt' => [
+            'docker' => ['docker-ce', 'docker-ce-cli', 'docker-ce-rootless-extras', 'docker-buildx-plugin', 'docker-compose-plugin', 'containerd.io', 'containerd', 'runc', 'docker.io'],
+            'kernel' => ['linux-image-*', 'linux-modules-*', 'linux-generic*', 'linux-virtual*', 'linux-aws*', 'linux-azure*', 'linux-gcp*', 'linux-oracle*', 'linux-kvm*', 'linux-raspi*'],
+            'system' => ['libc6', 'libc-bin', 'systemd', 'systemd-sysv', 'libsystemd0', 'udev', 'dbus', 'openssh-server', 'openssh-sftp-server'],
+        ],
+        'dnf' => [
+            'docker' => ['docker-ce', 'docker-ce-cli', 'docker-ce-rootless-extras', 'docker-buildx-plugin', 'docker-compose-plugin', 'containerd.io', 'containerd', 'runc', 'moby-engine', 'docker'],
+            'kernel' => ['kernel', 'kernel-core', 'kernel-modules', 'kernel-modules-core', 'kernel-modules-extra', 'kernel-uek', 'kernel-uek-core', 'kernel-uek-modules'],
+            'system' => ['glibc', 'glibc-common', 'glibc-langpack-*', 'systemd', 'systemd-libs', 'systemd-udev', 'dbus', 'dbus-broker', 'openssh-server'],
+        ],
+        'zypper' => [
+            'docker' => ['docker', 'docker-ce', 'containerd', 'runc', 'docker-compose', 'docker-buildx'],
+            'kernel' => ['kernel-default', 'kernel-default-base', 'kernel-azure', 'kernel-kvmsmall'],
+            'system' => ['glibc', 'systemd', 'libsystemd0', 'udev', 'dbus-1', 'openssh', 'openssh-server'],
+        ],
+        'pacman' => [
+            'docker' => ['docker', 'containerd', 'runc', 'docker-compose', 'docker-buildx'],
+            'kernel' => ['linux', 'linux-lts', 'linux-zen', 'linux-hardened'],
+            'system' => ['glibc', 'systemd', 'systemd-libs', 'dbus', 'openssh'],
+        ],
+        'apk' => [
+            'docker' => ['docker', 'docker-engine', 'docker-cli', 'docker-openrc', 'docker-cli-compose', 'docker-cli-buildx', 'containerd', 'runc'],
+            'kernel' => ['linux-lts', 'linux-virt', 'linux-edge'],
+            'system' => ['musl', 'openrc', 'openssh', 'openssh-server'],
+        ],
+    ];
+
+    public const RISK_LABELS = [
+        'docker' => 'Restarts Docker and the running containers',
+        'kernel' => 'Needs a reboot to apply',
+        'system' => 'Restarts core system services',
+    ];
+
     public function handle(Server $server)
     {
         $osId = 'unknown';
@@ -74,49 +165,29 @@ class CheckUpdates
                 default => null
             };
 
+            $securityPackages = null;
             switch ($packageManager) {
                 case 'zypper':
-                    $output = instant_remote_process(['LANG=C zypper -tx list-updates'], $server);
-                    $out = $this->parseZypperOutput($output);
-                    $out['osId'] = $osId;
-                    $out['package_manager'] = $packageManager;
-
-                    return $out;
+                    $out = $this->parseZypperOutput(instant_remote_process(['LANG=C zypper -tx list-updates'], $server));
+                    $securityPackages = $this->parseZypperSecurityPackages((string) instant_remote_process([self::ZYPPER_SECURITY_COMMAND], $server, false));
+                    break;
                 case 'dnf':
-                    $output = instant_remote_process(['LANG=C dnf list -q --updates --refresh'], $server);
-                    $out = $this->parseDnfOutput($output);
-                    $out['osId'] = $osId;
-                    $out['package_manager'] = $packageManager;
-
-                    return $out;
+                    $output = instant_remote_process([self::DNF_UPGRADES_COMMAND], $server);
+                    $installed = instant_remote_process([self::RPM_INSTALLED_COMMAND], $server);
+                    $out = $this->parseDnfOutput($output, $installed);
+                    $securityPackages = $this->parseDnfSecurityPackages((string) instant_remote_process([self::DNF_SECURITY_COMMAND], $server, false));
+                    break;
                 case 'apt':
                     instant_remote_process(['apt-get update -qq'], $server);
-                    $output = instant_remote_process(['LANG=C apt list --upgradable 2>/dev/null'], $server);
-
-                    $out = $this->parseAptOutput($output);
-                    $out['osId'] = $osId;
-                    $out['package_manager'] = $packageManager;
-
-                    return $out;
+                    $out = $this->parseAptOutput(instant_remote_process(['LANG=C apt list --upgradable 2>/dev/null'], $server));
+                    break;
                 case 'pacman':
-                    // Sync database first, then check for updates
-                    // Using -Sy to refresh package database before querying available updates
-                    instant_remote_process(['pacman -Sy'], $server);
-                    $output = instant_remote_process(['pacman -Qu 2>/dev/null'], $server);
-                    $out = $this->parsePacmanOutput($output);
-                    $out['osId'] = $osId;
-                    $out['package_manager'] = $packageManager;
-
-                    return $out;
+                    $out = $this->parsePacmanOutput(instant_remote_process([self::PACMAN_CHECK_COMMAND], $server));
+                    break;
                 case 'apk':
                     instant_remote_process(['apk update -q'], $server);
-                    $output = instant_remote_process(['LANG=C apk list --upgradable 2>/dev/null'], $server);
-
-                    $out = $this->parseApkOutput($output);
-                    $out['osId'] = $osId;
-                    $out['package_manager'] = $packageManager;
-
-                    return $out;
+                    $out = $this->parseApkOutput(instant_remote_process(['LANG=C apk list --upgradable 2>/dev/null'], $server));
+                    break;
                 default:
                     return [
                         'osId' => $osId,
@@ -124,18 +195,117 @@ class CheckUpdates
                         'package_manager' => $packageManager,
                     ];
             }
+
+            $out = $this->addUpdateDetails($out, $packageManager, $securityPackages);
+            $out['reboot_required'] = $this->parseRebootStatus((string) instant_remote_process([self::REBOOT_CHECK_COMMAND], $server, false));
+            $out['osId'] = $osId;
+            $out['package_manager'] = $packageManager;
+
+            return $out;
         } catch (\Throwable $e) {
+            Log::warning('Server patch check failed', ['server_uuid' => $server->uuid, 'error' => $e->getMessage()]);
 
             return [
                 'osId' => $osId,
                 'package_manager' => $packageManager,
                 'error' => $e->getMessage(),
-                'trace' => $e->getTraceAsString(),
             ];
         }
     }
 
-    private function parseZypperOutput(string $output): array
+    /**
+     * Adds the security flag and the risk to each update, and the number of security updates.
+     * The security count is null when the package manager cannot tell (pacman, apk) or the advisory query failed.
+     *
+     * @param  list<string>|null  $securityPackages  Package names with a security advisory (dnf, zypper).
+     */
+    public function addUpdateDetails(array $out, string $packageManager, ?array $securityPackages = null): array
+    {
+        $knowsSecurity = $packageManager === 'apt' || $securityPackages !== null;
+
+        $out['updates'] = array_map(function (array $update) use ($packageManager, $securityPackages) {
+            $update['security'] = match ($packageManager) {
+                'apt' => collect(explode(',', (string) ($update['repository'] ?? '')))->contains(fn (string $suite) => str_ends_with($suite, '-security')),
+                default => in_array($update['package'], $securityPackages ?? [], true),
+            };
+            $update['risk'] = self::riskFor($packageManager, $update['package']);
+
+            return $update;
+        }, $out['updates'] ?? []);
+        $out['security_updates'] = $knowsSecurity ? count(array_filter($out['updates'], fn (array $update) => $update['security'])) : null;
+
+        return $out;
+    }
+
+    /**
+     * @return 'docker'|'kernel'|'system'|null
+     */
+    public static function riskFor(?string $packageManager, string $package): ?string
+    {
+        foreach (self::RISKY_PACKAGES[$packageManager] ?? [] as $risk => $patterns) {
+            foreach ($patterns as $pattern) {
+                if (fnmatch($pattern, $package)) {
+                    return $risk;
+                }
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Package names from `dnf updateinfo list --security` (dnf4: "RLSA-2024:1234 Important/Sec. openssl-1:3.0.7-27.el9.x86_64",
+     * dnf5: "FEDORA-2024-1 security Critical curl-8.6.0-1.fc40.x86_64 2024-01-01 00:00:00").
+     *
+     * @return list<string>
+     */
+    public function parseDnfSecurityPackages(string $output): array
+    {
+        $packages = [];
+        foreach (preg_split('/\s+/', $output) as $token) {
+            // name-[epoch:]version-release.arch: the name is everything before the last two dashes.
+            if (preg_match('/^(.+)-[^-\/]+-[^-\/]+\.[A-Za-z0-9_]+$/', $token, $matches)) {
+                $packages[] = $matches[1];
+            }
+        }
+
+        return array_values(array_unique($packages));
+    }
+
+    /**
+     * Package names that `zypper -x patch --dry-run --category security` would upgrade.
+     *
+     * @return list<string>
+     */
+    public function parseZypperSecurityPackages(string $output): array
+    {
+        if (! preg_match_all('#<to-upgrade>(.*?)</to-upgrade>#s', $output, $blocks)) {
+            return [];
+        }
+
+        $packages = [];
+        foreach ($blocks[1] as $block) {
+            preg_match_all('#<solvable\b[^>]*>#', $block, $solvables);
+            foreach ($solvables[0] as $solvable) {
+                if (preg_match('#\bkind="package"#', $solvable) && preg_match('#\bname="([^"]+)"#', $solvable, $name)) {
+                    $packages[] = $name[1];
+                }
+            }
+        }
+
+        return array_values(array_unique($packages));
+    }
+
+    public function parseRebootStatus(string $output): ?bool
+    {
+        return match (true) {
+            str_contains($output, 'REBOOT=yes') => true,
+            str_contains($output, 'REBOOT=no') => false,
+            default => null,
+        };
+    }
+
+    public function parseZypperOutput(string $output): array
     {
         $updates = [];
 
@@ -177,44 +347,45 @@ class CheckUpdates
         }
     }
 
-    private function parseDnfOutput(string $output): array
+    /**
+     * @param  string  $output  Output of DNF_UPGRADES_COMMAND: "name arch evr repoid" per line.
+     * @param  string  $installed  Output of RPM_INSTALLED_COMMAND: "name arch version-release" per line.
+     */
+    public function parseDnfOutput(string $output, string $installed = ''): array
     {
-        $updates = [];
-        $lines = explode("\n", $output);
-
-        foreach ($lines as $line) {
-            if (empty($line)) {
-                continue;
-            }
-
-            // Split by multiple spaces/tabs and filter out empty elements
-            $parts = array_values(array_filter(preg_split('/\s+/', $line)));
-
-            if (count($parts) >= 3) {
-                $package = $parts[0];
-                $new_version = $parts[1];
-                $repository = $parts[2];
-
-                // Extract architecture from package name (e.g., "cloud-init.noarch" -> "noarch")
-                $architecture = str_contains($package, '.') ? explode('.', $package)[1] : 'noarch';
-
-                $updates[] = [
-                    'package' => $package,
-                    'new_version' => $new_version,
-                    'repository' => $repository,
-                    'architecture' => $architecture,
-                    'current_version' => 'unknown', // DNF doesn't show current version in check-update output
-                ];
+        $installedVersions = [];
+        foreach (explode("\n", $installed) as $line) {
+            $parts = preg_split('/\s+/', trim($line));
+            if (count($parts) === 3) {
+                $installedVersions["{$parts[0]}.{$parts[1]}"] = $parts[2];
             }
         }
 
+        $updates = [];
+        foreach (explode("\n", $output) as $line) {
+            $parts = preg_split('/\s+/', trim($line));
+            if (count($parts) !== 4) {
+                continue;
+            }
+            [$package, $architecture, $newVersion, $repository] = $parts;
+
+            $updates["{$package}.{$architecture}"] = [
+                'package' => $package,
+                'new_version' => preg_replace('/^0:/', '', $newVersion),
+                'repository' => $repository,
+                'architecture' => $architecture,
+                'current_version' => $installedVersions["{$package}.{$architecture}"] ?? 'unknown',
+            ];
+        }
+        $updates = array_values($updates);
+
         return [
             'total_updates' => count($updates),
             'updates' => $updates,
         ];
     }
 
-    private function parseAptOutput(string $output): array
+    public function parseAptOutput(string $output): array
     {
         $updates = [];
         $lines = explode("\n", $output);
@@ -243,7 +414,7 @@ class CheckUpdates
         ];
     }
 
-    private function parsePacmanOutput(string $output): array
+    public function parsePacmanOutput(string $output): array
     {
         $updates = [];
         $unparsedLines = [];
@@ -284,7 +455,7 @@ class CheckUpdates
         return $result;
     }
 
-    private function parseApkOutput(string $output): array
+    public function parseApkOutput(string $output): array
     {
         $updates = [];
         $lines = explode("\n", $output);
diff --git a/app/Actions/Server/CleanupDocker.php b/app/Actions/Server/CleanupDocker.php
index b43e199555..f439e01af5 100644
--- a/app/Actions/Server/CleanupDocker.php
+++ b/app/Actions/Server/CleanupDocker.php
@@ -132,9 +132,6 @@ class CleanupDocker implements ShouldBeUnique
         }
         $helperImageVersion = getHelperVersion();
         $helperImageWithVersion = coolifyHelperImage().":$helperImageVersion";
-        $buildxMetadataVolume = isDev() && $server->isLocalhost()
-            ? 'coolify-buildx'
-            : '$HOME/.docker/buildx';
 
         $cleanupLog = [];
 
@@ -161,7 +158,8 @@ class CleanupDocker implements ShouldBeUnique
             $this->buildContainerPruneCommand(),
             $imagePruneCmd,
             'docker builder prune -af',
-            "docker run --rm -v {$buildxMetadataVolume}:/root/.docker/buildx -v /var/run/docker.sock:/var/run/docker.sock {$helperImageWithVersion} docker buildx prune --builder coolify-railpack -af 2>/dev/null || true",
+            // The prune fails on a stopped builder, so start it first.
+            railpackBuilderHelperCommand(railpackBuildxMetadataVolume($server), $helperImageWithVersion, 'docker buildx inspect --bootstrap coolify-railpack >/dev/null 2>&1; docker buildx prune --builder coolify-railpack -af'),
             $this->buildCoolifyImageCleanupCommand($helperImageVersion),
         ];
 
@@ -178,7 +176,7 @@ class CleanupDocker implements ShouldBeUnique
             if ($commandOutput !== null) {
                 $cleanupLog[] = [
                     'command' => $command,
-                    'output' => $commandOutput,
+                    'output' => remove_iip($commandOutput),
                 ];
             }
         }
@@ -379,7 +377,7 @@ class CleanupDocker implements ShouldBeUnique
             $deleteOutput = $this->runRemoteCommand($deleteCommand, $server);
             $cleanupLog[] = [
                 'command' => $deleteCommand,
-                'output' => $deleteOutput ?? 'Images removed or were in use',
+                'output' => remove_iip($deleteOutput ?? 'Images removed or were in use'),
             ];
         }
 
diff --git a/app/Actions/Server/ConfigureAutomaticSecurityUpdates.php b/app/Actions/Server/ConfigureAutomaticSecurityUpdates.php
new file mode 100644
index 0000000000..6d1e046291
--- /dev/null
+++ b/app/Actions/Server/ConfigureAutomaticSecurityUpdates.php
@@ -0,0 +1,171 @@
+<?php
+
+namespace App\Actions\Server;
+
+use App\Models\Server;
+use InvalidArgumentException;
+use Lorisleiva\Actions\Concerns\AsAction;
+use RuntimeException;
+
+/**
+ * Turns automatic security updates on or off on a server.
+ *
+ * apt (Debian, Ubuntu): unattended-upgrades with a Coolify file that allows only the security origins.
+ * `#clear` drops the origin lists of the distro files (apt.conf(5),
+ * https://manpages.debian.org/bookworm/apt/apt.conf.5.en.html); the origin patterns follow
+ * https://github.com/mvo5/unattended-upgrades/blob/master/README.md. The Debian security suite keeps
+ * the `<codename>-security` codename (for Debian 12 the suite is now `oldstable-security`). The Ubuntu Pro (ESM)
+ * security origins are kept, as in the Ubuntu default file.
+ * The time is set with a drop-in for `apt-daily-upgrade.timer`.
+ *
+ * dnf (RHEL family, Fedora): dnf-automatic with `upgrade_type = security` and `apply_updates = yes` in
+ * `/etc/dnf/automatic.conf`. dnf4 reads only that file (https://dnf.readthedocs.io/en/latest/automatic.html);
+ * dnf5 reads its defaults from /usr/share/dnf5/dnf5-plugins/automatic.conf and the overrides from that file
+ * (https://dnf5.readthedocs.io/en/latest/dnf5_plugins/automatic.8.html). The timer is `dnf5-automatic.timer`
+ * on dnf5 and `dnf-automatic.timer` on dnf4.
+ *
+ * Commands are written for non-root SSH users: files are written with `tee`, and multi-step logic is one
+ * `sh -c` script, so `parseCommandsByLineForSudo()` only puts sudo in front.
+ */
+class ConfigureAutomaticSecurityUpdates
+{
+    use AsAction;
+
+    public const TIME_PATTERN = '/^([01]\d|2[0-3]):[0-5]\d$/';
+
+    public const APT_CONFIG_FILE = '/etc/apt/apt.conf.d/52coolify-unattended-upgrades';
+
+    public const APT_TIMER_DROP_IN_DIRECTORY = '/etc/systemd/system/apt-daily-upgrade.timer.d';
+
+    public const DNF_CONFIG_FILE = '/etc/dnf/automatic.conf';
+
+    private const SUPPORTED_PACKAGE_MANAGERS = ['apt', 'dnf'];
+
+    public function handle(Server $server, string $packageManager, bool $enabled, string $time): void
+    {
+        if (preg_match(self::TIME_PATTERN, $time) !== 1) {
+            throw new InvalidArgumentException('The time must be in HH:MM format (00:00 to 23:59).');
+        }
+        if (! self::supportFor($packageManager)) {
+            throw new RuntimeException("Automatic security updates are not supported for the package manager {$packageManager}.");
+        }
+
+        instant_remote_process(self::commands($packageManager, $enabled, $time), $server);
+    }
+
+    public static function supportFor(?string $packageManager): bool
+    {
+        return in_array($packageManager, self::SUPPORTED_PACKAGE_MANAGERS, true);
+    }
+
+    /**
+     * @return list<string>
+     */
+    public static function commands(string $packageManager, bool $enabled, string $time): array
+    {
+        return match ($packageManager) {
+            'apt' => $enabled ? self::aptEnableCommands($time) : self::aptDisableCommands(),
+            'dnf' => $enabled ? self::dnfEnableCommands($time) : self::dnfDisableCommands(),
+            default => throw new RuntimeException("Automatic security updates are not supported for the package manager {$packageManager}."),
+        };
+    }
+
+    public static function aptConfig(): string
+    {
+        return <<<'CONF'
+            // Managed by Coolify: install security updates only.
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Unattended-Upgrade "1";
+            #clear Unattended-Upgrade::Allowed-Origins;
+            #clear Unattended-Upgrade::Origins-Pattern;
+            Unattended-Upgrade::Origins-Pattern {
+                "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+                "origin=Debian,codename=${distro_codename},label=Debian-Security";
+                "origin=Ubuntu,archive=${distro_codename}-security";
+                "origin=UbuntuESMApps,archive=${distro_codename}-apps-security";
+                "origin=UbuntuESM,archive=${distro_codename}-infra-security";
+            };
+
+            CONF;
+    }
+
+    public static function timerDropIn(string $time): string
+    {
+        return "[Timer]\nOnCalendar=\nOnCalendar=*-*-* {$time}\nRandomizedDelaySec=0\n";
+    }
+
+    /**
+     * @return list<string>
+     */
+    private static function aptEnableCommands(string $time): array
+    {
+        $dropIn = self::APT_TIMER_DROP_IN_DIRECTORY.'/coolify.conf';
+
+        return [
+            "sh -c 'command -v unattended-upgrade >/dev/null 2>&1 || { apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y unattended-upgrades; }'",
+            'mkdir -p '.self::APT_TIMER_DROP_IN_DIRECTORY,
+            "echo '".base64_encode(self::aptConfig())."' | base64 -d | tee ".self::APT_CONFIG_FILE.' > /dev/null',
+            "echo '".base64_encode(self::timerDropIn($time))."' | base64 -d | tee {$dropIn} > /dev/null",
+            'chmod 644 '.self::APT_CONFIG_FILE." {$dropIn}",
+            'systemctl daemon-reload',
+            'systemctl enable --now apt-daily.timer apt-daily-upgrade.timer',
+        ];
+    }
+
+    /**
+     * @return list<string>
+     */
+    private static function aptDisableCommands(): array
+    {
+        return [
+            'rm -f '.self::APT_CONFIG_FILE.' '.self::APT_TIMER_DROP_IN_DIRECTORY.'/coolify.conf',
+            'systemctl daemon-reload',
+        ];
+    }
+
+    /**
+     * The settings are removed wherever they are and written again right below `[commands]`, which works for
+     * the full dnf4 file and for a missing or short dnf5 override file.
+     *
+     * @return list<string>
+     */
+    private static function dnfEnableCommands(string $time): array
+    {
+        $file = self::DNF_CONFIG_FILE;
+        $dropIn = base64_encode(self::timerDropIn($time));
+
+        return [
+            'dnf install -y dnf-automatic',
+            "sh -c 'set -e; f={$file}; touch \$f; "
+                .'sed -i -E "/^[[:space:]]*(upgrade_type|apply_updates)[[:space:]]*=/d" $f; '
+                .'grep -q "^\[commands\]" $f || printf "\n[commands]\n" >> $f; '
+                .'sed -i -e "/^\[commands\]/a upgrade_type = security" -e "/^\[commands\]/a apply_updates = yes" $f; '
+                ."chmod 644 \$f'",
+            "sh -c 'set -e; ".self::dnfTimerSelection()
+                .'mkdir -p /etc/systemd/system/$t.d; '
+                ."echo {$dropIn} | base64 -d > /etc/systemd/system/\$t.d/coolify.conf; "
+                .'chmod 644 /etc/systemd/system/$t.d/coolify.conf; '
+                ."systemctl daemon-reload; systemctl enable --now \$t'",
+        ];
+    }
+
+    /**
+     * @return list<string>
+     */
+    private static function dnfDisableCommands(): array
+    {
+        return [
+            "sh -c 'set -e; ".self::dnfTimerSelection()
+                .'if [ -e /usr/lib/systemd/system/$t ]; then systemctl disable --now $t; fi; '
+                ."rm -f /etc/systemd/system/\$t.d/coolify.conf; systemctl daemon-reload'",
+        ];
+    }
+
+    /**
+     * Sets `$t` to the timer unit of the installed dnf-automatic (dnf5 or dnf4).
+     */
+    private static function dnfTimerSelection(): string
+    {
+        return 't=dnf-automatic.timer; if [ -e /usr/lib/systemd/system/dnf5-automatic.timer ]; then t=dnf5-automatic.timer; fi; ';
+    }
+}
diff --git a/app/Actions/Server/DeleteServer.php b/app/Actions/Server/DeleteServer.php
index c6f0320133..bcffee2a50 100644
--- a/app/Actions/Server/DeleteServer.php
+++ b/app/Actions/Server/DeleteServer.php
@@ -8,6 +8,7 @@ use App\Models\Team;
 use App\Notifications\Server\HetznerDeletionFailed;
 use App\Services\DigitalOceanService;
 use App\Services\HetznerService;
+use App\Services\HostingerService;
 use App\Services\VultrService;
 use Lorisleiva\Actions\Concerns\AsAction;
 
@@ -15,7 +16,7 @@ class DeleteServer
 {
     use AsAction;
 
-    public function handle(int $serverId, bool $deleteFromHetzner = false, ?int $hetznerServerId = null, ?int $cloudProviderTokenId = null, ?int $teamId = null, bool $deleteFromVultr = false, ?string $vultrInstanceId = null, bool $deleteFromDigitalOcean = false, ?int $digitalOceanDropletId = null)
+    public function handle(int $serverId, bool $deleteFromHetzner = false, ?int $hetznerServerId = null, ?int $cloudProviderTokenId = null, ?int $teamId = null, bool $deleteFromVultr = false, ?string $vultrInstanceId = null, bool $deleteFromDigitalOcean = false, ?int $digitalOceanDropletId = null, bool $deleteFromHostinger = false, ?int $hostingerVirtualMachineId = null)
     {
         $server = Server::withTrashed()->find($serverId);
 
@@ -44,6 +45,14 @@ class DeleteServer
             );
         }
 
+        if ($deleteFromHostinger && ($hostingerVirtualMachineId || ($server && $server->hostinger_virtual_machine_id))) {
+            $this->deleteFromHostingerById(
+                $hostingerVirtualMachineId ?? $server->hostinger_virtual_machine_id,
+                $cloudProviderTokenId ?? $server->cloud_provider_token_id,
+                $teamId ?? $server->team_id
+            );
+        }
+
         logger()->debug($server ? 'Deleting server from Coolify' : 'Server already deleted from Coolify, skipping Coolify deletion');
 
         // If server is already deleted from Coolify, skip this part
@@ -99,7 +108,7 @@ class DeleteServer
 
             // Notify the team about the failure
             $team = Team::find($teamId);
-            $team?->notify(new HetznerDeletionFailed($hetznerServerId, $teamId, $e->getMessage()));
+            $team?->notify(new HetznerDeletionFailed($hetznerServerId, $teamId, remove_iip($e->getMessage())));
         }
     }
 
@@ -182,4 +191,50 @@ class DeleteServer
             throw $e;
         }
     }
+
+    private function deleteFromHostingerById(int $hostingerVirtualMachineId, ?int $cloudProviderTokenId, int $teamId): void
+    {
+        try {
+            $token = null;
+
+            if ($cloudProviderTokenId) {
+                $token = CloudProviderToken::where('id', $cloudProviderTokenId)
+                    ->where('team_id', $teamId)
+                    ->where('provider', 'hostinger')
+                    ->first();
+            }
+
+            if (! $token) {
+                $token = CloudProviderToken::where('team_id', $teamId)
+                    ->where('provider', 'hostinger')
+                    ->first();
+            }
+
+            if (! $token) {
+                throw new \RuntimeException('No Hostinger token found for the server team.');
+            }
+
+            $hostingerService = new HostingerService($token->token);
+            $subscriptionId = $hostingerService->getVirtualMachine($hostingerVirtualMachineId)['subscription_id'] ?? null;
+
+            if (! $subscriptionId) {
+                throw new \RuntimeException('The Hostinger VPS has no subscription.');
+            }
+
+            $hostingerService->disableAutoRenewal($subscriptionId);
+
+            logger()->debug('Disabled Hostinger auto-renewal, so Hostinger deletes the VPS at the end of the paid period', [
+                'hostinger_virtual_machine_id' => $hostingerVirtualMachineId,
+                'team_id' => $teamId,
+            ]);
+        } catch (\Throwable $e) {
+            logger()->error('Failed to delete VPS from Hostinger', [
+                'error' => $e->getMessage(),
+                'hostinger_virtual_machine_id' => $hostingerVirtualMachineId,
+                'team_id' => $teamId,
+            ]);
+
+            throw $e;
+        }
+    }
 }
diff --git a/app/Actions/Server/RebootServer.php b/app/Actions/Server/RebootServer.php
new file mode 100644
index 0000000000..0ca6a25f6b
--- /dev/null
+++ b/app/Actions/Server/RebootServer.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Actions\Server;
+
+use App\Jobs\ServerPatchCheckJob;
+use App\Models\Server;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class RebootServer
+{
+    use AsAction;
+
+    /**
+     * Starts the reboot a few seconds later, so the SSH command returns before the connection drops.
+     * systemd-run runs the reboot outside of the SSH session; other systems use a detached `reboot`.
+     */
+    public const COMMAND = <<<'SH'
+sh -c 'if command -v systemd-run >/dev/null 2>&1; then systemd-run --on-active=5 --timer-property=AccuracySec=1s systemctl reboot >/dev/null 2>&1; else nohup sh -c "sleep 5; reboot" >/dev/null 2>&1 </dev/null & fi; echo REBOOT_SCHEDULED'
+SH;
+
+    public function handle(Server $server): void
+    {
+        if ($server->isTransferredAway()) {
+            throw new \RuntimeException('This server is managed by another Coolify instance.');
+        }
+        if (! $server->isFunctional()) {
+            throw new \RuntimeException('Server is not reachable or not ready.');
+        }
+
+        $output = instant_remote_process([self::COMMAND], $server);
+        if (! str_contains((string) $output, 'REBOOT_SCHEDULED')) {
+            throw new \RuntimeException('The reboot could not be started.');
+        }
+
+        // Check again when the server is back, so the "Reboot required" state is cleared.
+        ServerPatchCheckJob::dispatch($server, true)->delay(now()->addMinutes(5));
+    }
+}
diff --git a/app/Actions/Server/StartLogDrain.php b/app/Actions/Server/StartLogDrain.php
index 638f4a0103..93774a0be2 100644
--- a/app/Actions/Server/StartLogDrain.php
+++ b/app/Actions/Server/StartLogDrain.php
@@ -23,9 +23,17 @@ class StartLogDrain
             $type = 'axiom';
         } elseif ($server->settings->is_logdrain_custom_enabled) {
             $type = 'custom';
+        } elseif ($server->settings->is_logdrain_cloudwatch_enabled) {
+            $type = 'cloudwatch';
         } else {
             $type = 'none';
         }
+        if ($type === 'cloudwatch') {
+            // Containers ship logs directly via Docker's awslogs driver; no Fluent Bit container is needed.
+            StopLogDrain::run($server);
+
+            return 'Amazon CloudWatch Logs uses the built-in Docker awslogs driver.';
+        }
         if ($type !== 'none') {
             StopLogDrain::run($server);
         }
@@ -231,7 +239,7 @@ Files:
 
     private function logDrainNetworkConnectCommands(Server $server): array
     {
-        if (! $server->isLogDrainEnabled()) {
+        if (! $server->isFluentBitLogDrainEnabled()) {
             return [];
         }
 
diff --git a/app/Actions/Server/UpdateCoolify.php b/app/Actions/Server/UpdateCoolify.php
index 3c60c34379..f0701977b1 100644
--- a/app/Actions/Server/UpdateCoolify.php
+++ b/app/Actions/Server/UpdateCoolify.php
@@ -2,9 +2,10 @@
 
 namespace App\Actions\Server;
 
+use App\Jobs\DatabaseBackupJob;
 use App\Models\Server;
+use App\Models\StandalonePostgresql;
 use App\Services\CoolifyUpgradeStatus;
-use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Sleep;
 use Lorisleiva\Actions\Concerns\AsAction;
@@ -22,6 +23,7 @@ class UpdateCoolify
     public function handle($manual_update = false)
     {
         if (isDev()) {
+            $this->backupDatabase();
             Sleep::for(10)->seconds();
 
             return;
@@ -34,7 +36,8 @@ class UpdateCoolify
 
         // Fetch fresh version from CDN instead of using cache
         try {
-            $response = Http::retry(3, 1000)->timeout(10)
+            // A manual update runs in the web request, so it does not wait for a retry; it falls back to the cache.
+            $response = cdn_http(tries: $manual_update ? 1 : 3)
                 ->get(config('constants.coolify.versions_url'));
 
             if ($response->successful()) {
@@ -110,11 +113,28 @@ class UpdateCoolify
             );
         }
 
+        $this->backupDatabase();
         $this->update();
         $settings->new_version_available = false;
         $settings->save();
     }
 
+    private function backupDatabase(): void
+    {
+        $backup = StandalonePostgresql::find(0)?->scheduledBackups()->first();
+        if (! $backup || ! instanceSettings()->is_backup_before_update_enabled) {
+            return;
+        }
+
+        // Runs inline so the update waits for the result. dispatchSync() would go through the job's
+        // WithoutOverlapping middleware, which silently drops the run while the scheduled backup is running.
+        $job = new DatabaseBackupJob($backup);
+        $job->handle();
+        if ($job->backup_log?->status !== 'success') {
+            throw new \Exception('The database backup failed, so the update was not started.');
+        }
+    }
+
     private function update()
     {
         $this->ensureNoUpgradeIsRunning();
diff --git a/app/Actions/Server/UpdatePackage.php b/app/Actions/Server/UpdatePackage.php
index 2b06e06011..58e88ccc51 100644
--- a/app/Actions/Server/UpdatePackage.php
+++ b/app/Actions/Server/UpdatePackage.php
@@ -3,6 +3,7 @@
 namespace App\Actions\Server;
 
 use App\Models\Server;
+use Illuminate\Support\Str;
 use Lorisleiva\Actions\Concerns\AsAction;
 use Spatie\Activitylog\Contracts\Activity;
 
@@ -41,41 +42,61 @@ class UpdatePackage
                 $sanitizedPackage = escapeshellarg($package);
             }
 
-            switch ($packageManager) {
-                case 'zypper':
-                    $commandAll = 'zypper update -y';
-                    $commandInstall = 'zypper install -y '.$sanitizedPackage;
-                    break;
-                case 'dnf':
-                    $commandAll = 'dnf update -y';
-                    $commandInstall = 'dnf update -y '.$sanitizedPackage;
-                    break;
-                case 'apt':
-                    $commandAll = 'apt update && apt upgrade -y';
-                    $commandInstall = 'apt install -y '.$sanitizedPackage;
-                    break;
-                case 'pacman':
-                    $commandAll = 'pacman -Syu --noconfirm';
-                    $commandInstall = 'pacman -S --noconfirm '.$sanitizedPackage;
-                    break;
-                case 'apk':
-                    $commandAll = 'apk update && apk upgrade';
-                    $commandInstall = 'apk upgrade '.$sanitizedPackage;
-                    break;
-                default:
-                    return [
-                        'error' => 'OS not supported',
-                    ];
-            }
-            if ($all) {
-                return remote_process([$commandAll], $server);
+            if (! $all && in_array($packageManager, CheckUpdates::FULL_UPGRADE_ONLY, true)) {
+                return [
+                    'error' => 'This operating system supports only a full system upgrade. Use "Update all packages".',
+                ];
             }
 
-            return remote_process([$commandInstall], $server);
+            $commands = self::commands($packageManager, $all ? null : $sanitizedPackage);
+            if ($commands === null) {
+                return [
+                    'error' => 'OS not supported',
+                ];
+            }
+
+            $updateId = (string) Str::uuid();
+            $packages = $all ? [] : [$package];
+            $user = auth()->user();
+
+            return remote_process($commands, $server, type_uuid: $updateId, callEventOnFinish: 'ServerPackagesUpdateFinished', callEventData: [
+                'update_id' => $updateId,
+                'server_uuid' => $server->uuid,
+                'packages' => $packages,
+                'package_manager' => $packageManager,
+                'actor_id' => $user?->id,
+                'actor_name' => $user?->name,
+                'actor_email' => $user?->email,
+            ]);
         } catch (\Exception $e) {
             return [
                 'error' => $e->getMessage(),
             ];
         }
     }
+
+    /**
+     * Update commands that never wait for input. apt keeps changed configuration files (confold) and uses the
+     * package default for unchanged ones (confdef). A null package updates all packages.
+     *
+     * @return array<int, string>|null
+     */
+    public static function commands(?string $packageManager, ?string $escapedPackage = null): ?array
+    {
+        $aptOptions = '-y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold';
+
+        return match ($packageManager) {
+            'apt' => [
+                'env DEBIAN_FRONTEND=noninteractive apt-get update -qq',
+                $escapedPackage === null
+                    ? "env DEBIAN_FRONTEND=noninteractive apt-get {$aptOptions} upgrade"
+                    : "env DEBIAN_FRONTEND=noninteractive apt-get {$aptOptions} install --only-upgrade {$escapedPackage}",
+            ],
+            'dnf' => [$escapedPackage === null ? 'dnf upgrade -y' : "dnf upgrade -y {$escapedPackage}"],
+            'zypper' => [$escapedPackage === null ? 'zypper --non-interactive update' : "zypper --non-interactive update {$escapedPackage}"],
+            'pacman' => $escapedPackage === null ? ['pacman -Syu --noconfirm'] : null,
+            'apk' => ['apk update', $escapedPackage === null ? 'apk upgrade' : "apk upgrade {$escapedPackage}"],
+            default => null,
+        };
+    }
 }
diff --git a/app/Actions/Server/ValidateServer.php b/app/Actions/Server/ValidateServer.php
index 9bb15c2053..7c973130c4 100644
--- a/app/Actions/Server/ValidateServer.php
+++ b/app/Actions/Server/ValidateServer.php
@@ -63,6 +63,15 @@ class ValidateServer
             }
         }
 
+        if ($server->hostinger_virtual_machine_id) {
+            $status = $server->refreshHostingerState();
+            if (in_array($status, ['stopping', 'stopped', 'suspending', 'suspended', 'destroying', 'destroyed', 'error'], true)) {
+                $this->error = 'Hostinger VPS is '.($status ?? 'not running').'. Power it on before validating.';
+                $server->update(['validation_logs' => $this->error]);
+                throw new \Exception($this->error);
+            }
+        }
+
         ['uptime' => $this->uptime, 'error' => $error] = $server->validateConnection();
         if (! $this->uptime) {
             $sanitizedError = htmlspecialchars($error ?? '', ENT_QUOTES, 'UTF-8');
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 709e459956..6d938c9ac4 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -8,6 +8,7 @@ use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Log;
 use Lorisleiva\Actions\Concerns\AsAction;
 use Lorisleiva\Actions\Decorators\JobDecorator;
 
@@ -72,6 +73,14 @@ class StartService
         }
         $commands[] = "docker network connect $service->uuid coolify-proxy >/dev/null 2>&1 || true";
         $commands = array_merge($commands, $this->logDrainNetworkConnectCommands($service));
+        if ($service->is_maintenance_enabled) {
+            // Domains can change with the compose file, so the maintenance routes follow them.
+            try {
+                $service->syncMaintenancePage();
+            } catch (\Throwable $e) {
+                Log::warning('Maintenance page update failed while starting service.', ['service_uuid' => $service->uuid, 'error' => $e->getMessage()]);
+            }
+        }
 
         return remote_process($commands, $service->server, type_uuid: $service->uuid, callEventOnFinish: 'ServiceStartFinished', callEventData: $service->id, queue: deployment_queue());
     }
@@ -131,7 +140,7 @@ class StartService
             return [];
         }
 
-        if (! $service->destination?->server?->isLogDrainEnabled()) {
+        if (! $service->destination?->server?->isFluentBitLogDrainEnabled()) {
             return [];
         }
 
diff --git a/app/Actions/Shared/DeleteScheduledVolumeBackup.php b/app/Actions/Shared/DeleteScheduledVolumeBackup.php
index d56cce9384..afeb44fce6 100644
--- a/app/Actions/Shared/DeleteScheduledVolumeBackup.php
+++ b/app/Actions/Shared/DeleteScheduledVolumeBackup.php
@@ -4,6 +4,7 @@ namespace App\Actions\Shared;
 
 use App\Jobs\VolumeBackupJob;
 use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
 use Illuminate\Support\Facades\Cache;
 use Lorisleiva\Actions\Concerns\AsAction;
@@ -52,23 +53,10 @@ class DeleteScheduledVolumeBackup
             }
 
             if ($deleteS3Archives) {
-                $s3Executions = $backup->executions()
-                    ->with('s3')
-                    ->where('s3_uploaded', true)
-                    ->where('s3_storage_deleted', false)
-                    ->get();
-
-                foreach ($s3Executions->groupBy('s3_storage_id') as $executions) {
-                    $s3 = $executions->first()->s3;
-                    if (! $s3) {
-                        throw new \RuntimeException('The S3 storage used by an existing backup is unavailable.');
-                    }
-
-                    $filenames = $executions->pluck('filename')->filter()->all();
-                    if ($filenames !== []) {
-                        deleteBackupsS3($filenames, $s3);
-                    }
-                }
+                $backup->executions()
+                    ->whereHas('s3Replicas', fn ($query) => $query->where('s3_uploaded', true)->where('s3_storage_deleted', false))
+                    ->get()
+                    ->each(fn (ScheduledVolumeBackupExecution $execution) => $execution->deleteS3Copies());
             }
 
             $backup->delete();
diff --git a/app/Console/Commands/Generate/OpenApi.php b/app/Console/Commands/Generate/OpenApi.php
index d1e018b0c4..0a91e6e9cf 100644
--- a/app/Console/Commands/Generate/OpenApi.php
+++ b/app/Console/Commands/Generate/OpenApi.php
@@ -17,22 +17,20 @@ class OpenApi extends Command
         // Generate OpenAPI documentation
         echo "Generating OpenAPI documentation.\n";
         // https://github.com/OAI/OpenAPI-Specification/releases
-        $process = Process::run([
+        // swagger-php 6 leaves PHP warnings to PHP itself; with Xdebug each one carries a stack trace and exhausts memory.
+        $process = Process::env(['XDEBUG_MODE' => 'off'])->run([
             './vendor/bin/openapi',
             'app',
-            // Server transfer endpoints are development-only (isDev()), so they stay out of the public docs.
-            '--exclude',
-            'Http/Controllers/Api/ServerTransferController.php',
             '-o',
             'openapi.yaml',
             '--version',
             '3.1.0',
         ]);
-        $error = $process->errorOutput();
-        $error = preg_replace('/^.*an object literal,.*$/m', '', $error);
-        $error = preg_replace('/^\h*\v+/m', '', $error);
-        echo $error;
-        echo $process->output();
+        foreach ([$process->errorOutput(), $process->output()] as $output) {
+            $output = preg_replace('/^.*an object literal,.*$/m', '', $output);
+            $output = preg_replace('/^\h*\v+/m', '', $output);
+            echo $output;
+        }
 
         $yaml = file_get_contents('openapi.yaml');
 
diff --git a/app/Console/Commands/ReencryptWithAppKey.php b/app/Console/Commands/ReencryptWithAppKey.php
new file mode 100644
index 0000000000..68ae2acf4d
--- /dev/null
+++ b/app/Console/Commands/ReencryptWithAppKey.php
@@ -0,0 +1,216 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\GitlabApp;
+use App\Models\OauthSetting;
+use App\Models\ServerSetting;
+use Illuminate\Console\Command;
+use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Encryption\Encrypter;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Str;
+use ReflectionClass;
+use Symfony\Component\Finder\Finder;
+
+class ReencryptWithAppKey extends Command
+{
+    protected $signature = 'app-key:reencrypt
+        {--dry-run : Count the values that use an old key without changing them}
+        {--force : Re-encrypt without asking for confirmation}';
+
+    protected $description = 'Re-encrypt stored secrets with the current APP_KEY after a key rotation (old keys in APP_PREVIOUS_KEYS)';
+
+    /**
+     * Columns that model accessors encrypt instead of an encrypted cast.
+     * A guard test fails when a model encrypts data in a way this command does not know.
+     *
+     * @var array<class-string<Model>, list<string>>
+     */
+    public const ACCESSOR_ENCRYPTED_COLUMNS = [
+        GitlabApp::class => ['webhook_token'],
+        OauthSetting::class => ['client_secret'],
+    ];
+
+    private Encrypter $currentKeyOnly;
+
+    public function handle(): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $this->currentKeyOnly = new Encrypter(Crypt::getKey(), config('app.cipher'));
+
+        if (Crypt::getPreviousKeys() === []) {
+            $this->warn('APP_PREVIOUS_KEYS is empty. Values encrypted with an old key cannot be decrypted.');
+        }
+
+        if (! $dryRun && ! $this->option('force') && ! $this->confirm('Re-encrypt all stored secrets with the current APP_KEY?')) {
+            return self::FAILURE;
+        }
+
+        $rows = [];
+        $reencrypted = 0;
+        $undecryptable = 0;
+        foreach (self::encryptedColumns() as $class => $columns) {
+            foreach ($columns as $column) {
+                [$changed, $failed] = $this->reencryptColumn(new $class, $column, $dryRun);
+                $reencrypted += $changed;
+                $undecryptable += $failed;
+                if ($changed + $failed > 0) {
+                    $rows[] = [class_basename($class), $column, $changed, $failed];
+                }
+            }
+        }
+        $sentinelTokens = $this->regenerateSentinelTokens($dryRun);
+
+        if ($rows !== []) {
+            $this->table(['Model', 'Column', $dryRun ? 'Uses an old key' : 'Re-encrypted', 'Undecryptable'], $rows);
+        }
+
+        if ($dryRun) {
+            $this->info("{$reencrypted} values and {$sentinelTokens} Sentinel tokens use an old key. Nothing was changed.");
+        } else {
+            $this->info("Re-encrypted {$reencrypted} values.");
+            $this->info("Regenerated {$sentinelTokens} Sentinel tokens. Sentinel restarts on the servers where it is enabled.");
+        }
+
+        if ($undecryptable > 0) {
+            $this->error("{$undecryptable} values cannot be decrypted with APP_KEY or APP_PREVIOUS_KEYS. Do not remove APP_PREVIOUS_KEYS until you fix them.");
+
+            return self::FAILURE;
+        }
+
+        if (! $dryRun) {
+            $this->info('You can remove APP_PREVIOUS_KEYS when queued jobs finished. Sessions, invitation links, and old backups still need the previous key.');
+        }
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Every model column that holds a Laravel encrypted payload.
+     *
+     * @return array<class-string<Model>, list<string>>
+     */
+    public static function encryptedColumns(): array
+    {
+        $columns = [];
+        foreach (Finder::create()->files()->in(app_path('Models'))->name('*.php') as $file) {
+            $class = 'App\\Models\\'.str_replace(['/', '.php'], ['\\', ''], $file->getRelativePathname());
+            if (! is_subclass_of($class, Model::class) || (new ReflectionClass($class))->isAbstract()) {
+                continue;
+            }
+
+            $castColumns = collect((new $class)->getCasts())
+                ->filter(fn ($cast) => is_string($cast) && Str::contains($cast, 'encrypted', ignoreCase: true))
+                ->keys()
+                ->all();
+            $encrypted = array_values(array_unique([...$castColumns, ...(self::ACCESSOR_ENCRYPTED_COLUMNS[$class] ?? [])]));
+            if ($encrypted !== []) {
+                $columns[$class] = $encrypted;
+            }
+        }
+        ksort($columns);
+
+        return $columns;
+    }
+
+    /**
+     * Decrypts and encrypts the raw string, so serialized (encrypt()) and plain (encryptString())
+     * payloads keep their format. Plaintext legacy values are left as they are.
+     *
+     * @return array{int, int} The re-encrypted and the undecryptable value counts.
+     */
+    private function reencryptColumn(Model $model, string $column, bool $dryRun): array
+    {
+        $schema = Schema::connection($model->getConnectionName());
+        if (! $schema->hasTable($model->getTable()) || ! $schema->hasColumn($model->getTable(), $column)) {
+            return [0, 0];
+        }
+
+        $keyName = $model->getKeyName();
+        $changed = 0;
+        $failed = 0;
+        $model->newQueryWithoutScopes()->toBase()
+            ->select([$keyName, $column])
+            ->whereNotNull($column)
+            ->chunkById(500, function ($rows) use ($model, $keyName, $column, $dryRun, &$changed, &$failed) {
+                foreach ($rows as $row) {
+                    $payload = $row->{$column};
+                    if (! $this->usesOldKey($payload)) {
+                        continue;
+                    }
+
+                    try {
+                        $plaintext = Crypt::decryptString($payload);
+                    } catch (DecryptException) {
+                        $failed++;
+
+                        continue;
+                    }
+
+                    if (! $dryRun) {
+                        // Compare-and-set, so a value saved during the run is not overwritten.
+                        $model->newQueryWithoutScopes()->toBase()
+                            ->where($keyName, $row->{$keyName})
+                            ->where($column, $payload)
+                            ->update([$column => Crypt::encryptString($plaintext)]);
+                    }
+                    $changed++;
+                }
+            }, $keyName);
+
+        return [$changed, $failed];
+    }
+
+    /**
+     * A Sentinel token is an encrypted payload itself, and Sentinel sends it back on every push.
+     * Saving a new token restarts Sentinel with it (see ServerSetting::booted()).
+     */
+    private function regenerateSentinelTokens(bool $dryRun): int
+    {
+        $count = 0;
+        ServerSetting::query()->with('server')->chunkById(100, function (Collection $settings) use ($dryRun, &$count) {
+            foreach ($settings as $setting) {
+                try {
+                    $token = $setting->sentinel_token;
+                } catch (DecryptException) {
+                    continue;
+                }
+
+                if ($setting->server === null || ! $this->usesOldKey($token)) {
+                    continue;
+                }
+
+                if (! $dryRun) {
+                    $setting->generateSentinelToken();
+                }
+                $count++;
+            }
+        });
+
+        return $count;
+    }
+
+    private function usesOldKey(mixed $value): bool
+    {
+        if (! is_string($value)) {
+            return false;
+        }
+
+        $payload = json_decode(base64_decode($value, true) ?: '', true);
+        if (! is_array($payload) || ! isset($payload['iv'], $payload['value'], $payload['mac'])) {
+            return false;
+        }
+
+        try {
+            $this->currentKeyOnly->decryptString($value);
+
+            return false;
+        } catch (DecryptException) {
+            return true;
+        }
+    }
+}
diff --git a/app/Console/Commands/SeedDevelopmentQemuServerCommand.php b/app/Console/Commands/SeedDevelopmentQemuServerCommand.php
index 082ad83ae2..26fc463ff7 100644
--- a/app/Console/Commands/SeedDevelopmentQemuServerCommand.php
+++ b/app/Console/Commands/SeedDevelopmentQemuServerCommand.php
@@ -3,7 +3,9 @@
 namespace App\Console\Commands;
 
 use App\Actions\Development\SeedDevelopmentQemuServer;
+use App\Actions\Development\StartDevelopmentInstanceDatabase;
 use Illuminate\Console\Command;
+use Throwable;
 
 class SeedDevelopmentQemuServerCommand extends Command
 {
@@ -22,6 +24,15 @@ class SeedDevelopmentQemuServerCommand extends Command
         $server = SeedDevelopmentQemuServer::run($this->argument('profile'), ! $this->option('keep-others'), (bool) $this->option('as-localhost'), $this->option('ip') ?: null, (int) $this->option('port'));
         $this->info("Seeded {$server->name} at {$server->ip}.");
 
+        if ($this->option('as-localhost')) {
+            try {
+                StartDevelopmentInstanceDatabase::run($server);
+                $this->info('Started the coolify-db container for instance backups.');
+            } catch (Throwable $e) {
+                $this->warn("Could not start the coolify-db container for instance backups: {$e->getMessage()}");
+            }
+        }
+
         return self::SUCCESS;
     }
 }
diff --git a/app/Console/Commands/SyncCdn.php b/app/Console/Commands/SyncCdn.php
index 3e7be78b4a..c447c5f726 100644
--- a/app/Console/Commands/SyncCdn.php
+++ b/app/Console/Commands/SyncCdn.php
@@ -312,6 +312,7 @@ class SyncCdn extends Command
         $install_script_location = "$parent_dir/scripts/install.sh";
         $upgrade_script_location = "$parent_dir/scripts/upgrade.sh";
         $upgrade_postgres_script_location = "$parent_dir/scripts/upgrade-postgres.sh";
+        $patch_script_location = "$parent_dir/scripts/patch.sh";
         $production_env_location = "$parent_dir/.env.production";
         $service_template_location = "$parent_dir/templates/$service_template";
         $versions_location = "$parent_dir/$versions";
@@ -346,6 +347,7 @@ class SyncCdn extends Command
                     $install_script_location => 'json/coolify/install.sh',
                     $upgrade_script_location => 'json/coolify/upgrade.sh',
                     $upgrade_postgres_script_location => 'json/coolify/upgrade-postgres.sh',
+                    $patch_script_location => 'json/coolify/patch.sh',
                     $service_template_location => 'json/coolify/service-templates-latest.json',
                 ];
             }
diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index 7f3e5fb8bf..cd63d3502f 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -20,12 +20,13 @@ use App\Jobs\ServerManagerJob;
 use App\Jobs\UpdateCoolifyJob;
 use App\Models\InstanceSettings;
 use App\Services\ScheduledJobDeliveryService;
+use Cron\CronExpression;
 use Illuminate\Console\Scheduling\Schedule;
 use Illuminate\Foundation\Console\Kernel as ConsoleKernel;
 
 class Kernel extends ConsoleKernel
 {
-    private const CDN_JITTER_SECONDS = 600;
+    private const MAX_CDN_DELAY_SECONDS = 3600;
 
     private Schedule $scheduleInstance;
 
@@ -51,6 +52,11 @@ class Kernel extends ConsoleKernel
             ->name('cleanup:ssh-mux')
             ->hourly()
             ->when(fn () => config('constants.ssh.mux_enabled') && ! config('constants.coolify.is_windows_docker_desktop'));
+        // Every cloud node reads its own versions.json, so each node refreshes it (no onOneServer).
+        $this->scheduleInstance->call(fn () => refresh_versions_file())
+            ->name('versions:refresh-local')
+            ->hourly()
+            ->when(fn () => isCloud());
         $this->scheduleInstance->command('cleanup:redis --clear-locks')->daily();
         $this->scheduleInstance->call(fn () => app(ScheduledJobDeliveryService::class)->deleteOldOccurrences())
             ->name('cleanup:scheduled-job-occurrences')
@@ -93,8 +99,8 @@ class Kernel extends ConsoleKernel
             $this->scheduleInstance->command('horizon:snapshot')->everyFiveMinutes();
             $this->scheduleInstance->command('cleanup:unreachable-servers')->daily()->onOneServer();
 
-            $this->scheduleInstance->job($this->withCdnJitter(new PullTemplatesFromCDN))->cron($this->updateCheckFrequency)->timezone($this->instanceTimezone)->onOneServer();
-            $this->scheduleInstance->job($this->withCdnJitter(new PullChangelog))->cron($this->updateCheckFrequency)->timezone($this->instanceTimezone)->onOneServer();
+            $this->scheduleInstance->job($this->withCdnDelay(new PullTemplatesFromCDN, $this->updateCheckFrequency))->cron($this->updateCheckFrequency)->timezone($this->instanceTimezone)->onOneServer();
+            $this->scheduleInstance->job($this->withCdnDelay(new PullChangelog, $this->updateCheckFrequency))->cron($this->updateCheckFrequency)->timezone($this->instanceTimezone)->onOneServer();
 
             $this->scheduleInstance->job(new CleanupInstanceStuffsJob)->everyTwoMinutes()->onOneServer();
             $this->scheduleUpdates();
@@ -102,8 +108,6 @@ class Kernel extends ConsoleKernel
             // Server Jobs
             $this->scheduleInstance->job(new ServerManagerJob)->everyMinute()->onOneServer();
 
-            $this->pullImages();
-
             // Scheduled Jobs (Backups & Tasks)
             $this->scheduleScheduledJobManager();
 
@@ -117,14 +121,6 @@ class Kernel extends ConsoleKernel
         }
     }
 
-    private function pullImages(): void
-    {
-        $this->scheduleInstance->job($this->withCdnJitter(new CheckHelperImageJob))
-            ->cron($this->updateCheckFrequency)
-            ->timezone($this->instanceTimezone)
-            ->onOneServer();
-    }
-
     /**
      * Run the manager from the scheduler, not from a queue worker. A busy queue could delay it
      * past the catch-up window, and then due backups and tasks would be skipped.
@@ -164,14 +160,14 @@ class Kernel extends ConsoleKernel
 
     private function scheduleUpdates(): void
     {
-        $this->scheduleInstance->job($this->withCdnJitter(new CheckForUpdatesJob))
+        $this->scheduleInstance->job($this->withCdnDelay(new CheckForUpdatesJob, $this->updateCheckFrequency))
             ->cron($this->updateCheckFrequency)
             ->timezone($this->instanceTimezone)
             ->onOneServer();
 
         if ($this->settings->is_auto_update_enabled) {
             $autoUpdateFrequency = $this->settings->auto_update_frequency;
-            $this->scheduleInstance->job($this->withCdnJitter(new UpdateCoolifyJob))
+            $this->scheduleInstance->job($this->withCdnDelay(new UpdateCoolifyJob, $autoUpdateFrequency))
                 ->cron($autoUpdateFrequency)
                 ->timezone($this->instanceTimezone)
                 ->onOneServer();
@@ -179,12 +175,29 @@ class Kernel extends ConsoleKernel
     }
 
     /**
-     * All instances share the same default cron, so without a random delay they all request the CDN
-     * at the same second and Cloudflare rejects the burst (error 1200).
+     * All instances share the same default cron, so without a delay they all request the CDN at the
+     * same second and Cloudflare rejects the burst (error 1200). Each instance gets a stable offset
+     * inside the cron interval (at most one hour), so the requests spread evenly and each instance
+     * still runs at a regular interval.
      */
-    private function withCdnJitter(object $job): object
+    private function withCdnDelay(object $job, string $cron): object
     {
-        return $job->delay(random_int(0, self::CDN_JITTER_SECONDS));
+        return $job->delay(self::cdnDelaySeconds($cron));
+    }
+
+    public static function cdnDelaySeconds(string $cron): int
+    {
+        try {
+            $expression = new CronExpression($cron);
+            $nextRun = $expression->getNextRunDate();
+            $interval = $expression->getNextRunDate($nextRun)->getTimestamp() - $nextRun->getTimestamp();
+        } catch (\Throwable) {
+            $interval = self::MAX_CDN_DELAY_SECONDS;
+        }
+        $window = max(1, min($interval, self::MAX_CDN_DELAY_SECONDS));
+        $instanceId = (string) (config('app.id') ?: config('app.key'));
+
+        return crc32('cdn-delay:'.$instanceId) % $window;
     }
 
     protected function commands(): void
diff --git a/app/Data/FileEntry.php b/app/Data/FileEntry.php
new file mode 100644
index 0000000000..7e01793ea3
--- /dev/null
+++ b/app/Data/FileEntry.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Data;
+
+class FileEntry
+{
+    public function __construct(
+        public string $name,
+        public string $type,
+        public int $size,
+        public int $mtime,
+        public string $perms = '',
+        public string $owner = '',
+        public string $group = '',
+    ) {}
+
+    public function isDir(): bool
+    {
+        return $this->type === 'dir';
+    }
+
+    public function isEditableCandidate(): bool
+    {
+        return ! $this->isDir();
+    }
+
+    /**
+     * @param  array<int, self>  $entries
+     * @return array<int, self>
+     */
+    public static function sort(array $entries): array
+    {
+        usort($entries, function (self $a, self $b) {
+            if ($a->isDir() !== $b->isDir()) {
+                return $a->isDir() ? -1 : 1;
+            }
+
+            return strcasecmp($a->name, $b->name);
+        });
+
+        return $entries;
+    }
+}
diff --git a/app/Data/RepositoryDetectionResult.php b/app/Data/RepositoryDetectionResult.php
new file mode 100644
index 0000000000..b0f47a0f5c
--- /dev/null
+++ b/app/Data/RepositoryDetectionResult.php
@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Data;
+
+use App\Enums\BuildPackTypes;
+use Spatie\LaravelData\Data;
+
+class RepositoryDetectionResult extends Data
+{
+    /**
+     * @param  array<int, string>  $dockerfiles  e.g. ['Dockerfile', 'apps/api/Dockerfile']
+     * @param  array<int, string>  $dockerComposeFiles  e.g. ['docker-compose.yml']
+     * @param  array<string, string|null>  $envFiles  e.g. ['.env.example' => 'KEY=val...', '.env.dist' => null]
+     * @param  array<string, int|null>  $dockerfilePorts  e.g. ['Dockerfile' => 3000, 'apps/api/Dockerfile' => 8080]
+     */
+    public function __construct(
+        public array $dockerfiles = [],
+        public array $dockerComposeFiles = [],
+        public array $envFiles = [],
+        public array $dockerfilePorts = [],
+    ) {}
+
+    public static function none(): self
+    {
+        return new self;
+    }
+
+    /**
+     * Build pack for the files in the base directory. Files in subdirectories are often examples,
+     * tests, or other services, so they do not select a build pack.
+     */
+    public function getSuggestedBuildPack(): ?BuildPackTypes
+    {
+        if ($this->baseDirectoryFile($this->dockerComposeFiles)) {
+            return BuildPackTypes::DOCKERCOMPOSE;
+        }
+
+        if ($this->baseDirectoryFile($this->dockerfiles)) {
+            return BuildPackTypes::DOCKERFILE;
+        }
+
+        return null;
+    }
+
+    /**
+     * The first file that is directly in the base directory, not in a subdirectory.
+     *
+     * @param  array<int, string>  $files
+     */
+    public function baseDirectoryFile(array $files): ?string
+    {
+        return collect($files)->first(fn (string $file): bool => ! str_contains($file, '/'));
+    }
+
+    public function hasDockerfile(): bool
+    {
+        return count($this->dockerfiles) > 0;
+    }
+
+    public function hasDockerCompose(): bool
+    {
+        return count($this->dockerComposeFiles) > 0;
+    }
+
+    public function hasEnvFiles(): bool
+    {
+        return count($this->envFiles) > 0;
+    }
+}
diff --git a/app/Data/Traffic/TrafficBreakdownData.php b/app/Data/Traffic/TrafficBreakdownData.php
index a98e5323a4..47114f1362 100644
--- a/app/Data/Traffic/TrafficBreakdownData.php
+++ b/app/Data/Traffic/TrafficBreakdownData.php
@@ -10,14 +10,23 @@ class TrafficBreakdownData extends Data
         public string $value,
         public int $requests,
         public int $bytesOut,
+        public ?float $lat = null,
+        public ?float $lon = null,
     ) {}
 
     public static function fromSentinel(array $row): self
     {
+        $lat = data_get($row, 'lat');
+        $lon = data_get($row, 'lon');
+        $hasCoordinates = is_numeric($lat) && is_numeric($lon)
+            && abs((float) $lat) <= 90 && abs((float) $lon) <= 180;
+
         return new self(
             value: (string) data_get($row, 'value', ''),
             requests: (int) data_get($row, 'requests', 0),
             bytesOut: (int) data_get($row, 'bytes_out', 0),
+            lat: $hasCoordinates ? (float) $lat : null,
+            lon: $hasCoordinates ? (float) $lon : null,
         );
     }
 }
diff --git a/app/Enums/HttpBasicAuthHashAlgorithm.php b/app/Enums/HttpBasicAuthHashAlgorithm.php
new file mode 100644
index 0000000000..c6340c0a1f
--- /dev/null
+++ b/app/Enums/HttpBasicAuthHashAlgorithm.php
@@ -0,0 +1,9 @@
+<?php
+
+namespace App\Enums;
+
+enum HttpBasicAuthHashAlgorithm: string
+{
+    case BCRYPT = 'bcrypt';
+    case ARGON2ID = 'argon2id';
+}
diff --git a/app/Enums/NewResourceTypes.php b/app/Enums/NewResourceTypes.php
index 4fee12e131..2fccc3208b 100644
--- a/app/Enums/NewResourceTypes.php
+++ b/app/Enums/NewResourceTypes.php
@@ -6,6 +6,7 @@ enum NewResourceTypes: string
 {
     case PUBLIC = 'public';
     case PRIVATE_GH_APP = 'private-gh-app';
+    case PRIVATE_GITEA_APP = 'private-gitea-app';
     case PRIVATE_DEPLOY_KEY = 'private-deploy-key';
     case DOCKERFILE = 'dockerfile';
     case DOCKERCOMPOSE = 'dockercompose';
diff --git a/app/Enums/TrafficIpMode.php b/app/Enums/TrafficIpMode.php
index 6f2b09d89a..4b9f5f48d1 100644
--- a/app/Enums/TrafficIpMode.php
+++ b/app/Enums/TrafficIpMode.php
@@ -44,7 +44,8 @@ enum TrafficIpMode: string
     }
 
     /**
-     * Drop the `ip` dimension when Sentinel does not record it.
+     * Drop the `ip` and `city` dimensions when Sentinel does not record them
+     * (Sentinel finds the city from the client IP, so `off` stores no cities).
      *
      * @param  array<int, string>  $dimensions
      * @return array<int, string>
@@ -55,7 +56,7 @@ enum TrafficIpMode: string
             return $dimensions;
         }
 
-        return array_values(array_filter($dimensions, fn (string $dimension): bool => $dimension !== 'ip'));
+        return array_values(array_filter($dimensions, fn (string $dimension): bool => ! in_array($dimension, ['ip', 'city'], true)));
     }
 
     public function breakdownLabel(): string
diff --git a/app/Events/ServerPackageUpdated.php b/app/Events/ServerPackageUpdated.php
deleted file mode 100644
index 88c8c52bb7..0000000000
--- a/app/Events/ServerPackageUpdated.php
+++ /dev/null
@@ -1,14 +0,0 @@
-<?php
-
-namespace App\Events;
-
-use App\Traits\BroadcastsToTeam;
-use Illuminate\Broadcasting\InteractsWithSockets;
-use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
-use Illuminate\Foundation\Events\Dispatchable;
-use Illuminate\Queue\SerializesModels;
-
-class ServerPackageUpdated implements ShouldBroadcast
-{
-    use BroadcastsToTeam, Dispatchable, InteractsWithSockets, SerializesModels;
-}
diff --git a/app/Events/ServerPackagesUpdateFinished.php b/app/Events/ServerPackagesUpdateFinished.php
new file mode 100644
index 0000000000..1d0f8db830
--- /dev/null
+++ b/app/Events/ServerPackagesUpdateFinished.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+
+/**
+ * Dispatched by the remote process of a package update when it finishes (also when it fails).
+ */
+class ServerPackagesUpdateFinished
+{
+    use Dispatchable;
+
+    /**
+     * @param  array{server_uuid: string, packages: array<int, string>}  $data
+     */
+    public function __construct(public readonly array $data) {}
+}
diff --git a/app/Events/ServerPatchCheckFinished.php b/app/Events/ServerPatchCheckFinished.php
new file mode 100644
index 0000000000..c9d8cb269e
--- /dev/null
+++ b/app/Events/ServerPatchCheckFinished.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Events;
+
+use App\Traits\BroadcastsToTeam;
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class ServerPatchCheckFinished implements ShouldBroadcast
+{
+    use BroadcastsToTeam, Dispatchable, InteractsWithSockets, SerializesModels;
+
+    public function __construct(?int $teamId, public ?string $serverUuid = null)
+    {
+        $this->teamId = $teamId;
+    }
+
+    public function broadcastAs(): string
+    {
+        return 'ServerPatchCheckFinished';
+    }
+
+    /**
+     * @return array{serverUuid: string|null}
+     */
+    public function broadcastWith(): array
+    {
+        return ['serverUuid' => $this->serverUuid];
+    }
+}
diff --git a/app/Events/TransferFinishChanged.php b/app/Events/TransferFinishChanged.php
new file mode 100644
index 0000000000..15fd906b90
--- /dev/null
+++ b/app/Events/TransferFinishChanged.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Events;
+
+use App\Models\Server;
+use App\Traits\BroadcastsToTeam;
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Contracts\Events\ShouldDispatchAfterCommit;
+use Illuminate\Foundation\Events\Dispatchable;
+
+/**
+ * A step of the "Finish the transfer" list changed, so open server pages show it without a reload.
+ */
+class TransferFinishChanged implements ShouldBroadcast, ShouldDispatchAfterCommit
+{
+    use BroadcastsToTeam, Dispatchable, InteractsWithSockets;
+
+    public string $serverUuid;
+
+    public function __construct(Server $server)
+    {
+        $this->teamId = $server->team_id;
+        $this->serverUuid = $server->uuid;
+    }
+}
diff --git a/app/Http/Controllers/Api/ApplicationPreviewsController.php b/app/Http/Controllers/Api/ApplicationPreviewsController.php
index 453d605695..a2c8a90d2c 100644
--- a/app/Http/Controllers/Api/ApplicationPreviewsController.php
+++ b/app/Http/Controllers/Api/ApplicationPreviewsController.php
@@ -6,6 +6,7 @@ use App\Enums\BuildPackTypes;
 use App\Http\Controllers\Controller;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use Illuminate\Http\JsonResponse;
@@ -214,7 +215,7 @@ class ApplicationPreviewsController extends Controller
         if (! $isDockerImage && $gitType === null) {
             return response()->json([
                 'message' => 'Validation failed.',
-                'errors' => ['git_type' => ['The git type field is required for applications without a GitHub or GitLab App source.']],
+                'errors' => ['git_type' => ['The git type field is required for applications without a GitHub, GitLab, or Gitea App source.']],
             ], 422);
         }
         if ($isDockerImage && $dockerTag === null && blank($preview?->docker_registry_image_tag)) {
@@ -303,6 +304,7 @@ class ApplicationPreviewsController extends Controller
         return match ($application->source?->getMorphClass()) {
             GithubApp::class => 'github',
             GitlabApp::class => 'gitlab',
+            GiteaApp::class => 'gitea',
             default => null,
         };
     }
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index c39ea3c977..de01074b5a 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -3,9 +3,11 @@
 namespace App\Http\Controllers\Api;
 
 use App\Actions\Application\CleanupPreviewDeployment;
+use App\Actions\Application\GetRollbackImages;
 use App\Actions\Application\LoadComposeFile;
 use App\Actions\Application\StopApplication;
 use App\Enums\BuildPackTypes;
+use App\Enums\HttpBasicAuthHashAlgorithm;
 use App\Http\Controllers\Controller;
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
@@ -50,6 +52,7 @@ class ApplicationsController extends Controller
         'inject_build_args_to_dockerfile',
         'include_source_commit_in_build',
         'is_env_sorting_enabled',
+        'redact_all_env_values_in_logs',
         'is_pr_deployments_public_enabled',
         'stop_grace_period',
         'docker_images_to_keep',
@@ -77,6 +80,7 @@ class ApplicationsController extends Controller
         'inject_build_args_to_dockerfile',
         'include_source_commit_in_build',
         'is_env_sorting_enabled',
+        'redact_all_env_values_in_logs',
         'is_pr_deployments_public_enabled',
         'is_gzip_enabled',
         'is_stripprefix_enabled',
@@ -452,6 +456,7 @@ class ApplicationsController extends Controller
                             'inject_build_args_to_dockerfile' => ['type' => 'boolean', 'description' => 'Inject build arguments into the Dockerfile build.'],
                             'include_source_commit_in_build' => ['type' => 'boolean', 'description' => 'Include the source commit in the build.'],
                             'is_env_sorting_enabled' => ['type' => 'boolean', 'description' => 'Sort environment variables.'],
+                            'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'],
                             'is_pr_deployments_public_enabled' => ['type' => 'boolean', 'description' => 'Make pull request deployments public.'],
                             'stop_grace_period' => ['type' => 'integer', 'nullable' => true, 'minimum' => 1, 'maximum' => 3600, 'description' => 'Container stop grace period in seconds.'],
                             'docker_images_to_keep' => ['type' => 'integer', 'minimum' => 0, 'maximum' => 100, 'description' => 'Number of Docker images to retain.'],
@@ -474,6 +479,10 @@ class ApplicationsController extends Controller
                             'is_http_basic_auth_enabled' => ['type' => 'boolean', 'description' => 'HTTP Basic Authentication enabled.'],
                             'http_basic_auth_username' => ['type' => 'string', 'nullable' => true, 'description' => 'Username for HTTP Basic Authentication'],
                             'http_basic_auth_password' => ['type' => 'string', 'nullable' => true, 'description' => 'Password for HTTP Basic Authentication'],
+                            'http_basic_auth_hash_algorithm' => ['type' => 'string', 'enum' => ['bcrypt', 'argon2id'], 'default' => 'bcrypt', 'description' => 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'],
+                            'http_basic_auth_bcrypt_cost' => ['type' => 'integer', 'minimum' => 4, 'maximum' => 14, 'default' => 10, 'description' => 'Bcrypt cost for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_memory_cost' => ['type' => 'integer', 'minimum' => 8192, 'maximum' => 262144, 'default' => 65536, 'description' => 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_time_cost' => ['type' => 'integer', 'minimum' => 1, 'maximum' => 12, 'default' => 4, 'description' => 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'],
                             'connect_to_docker_network' => ['type' => 'boolean', 'description' => 'The flag to connect the service to the predefined Docker network.'],
                             'force_domain_override' => ['type' => 'boolean', 'description' => 'Force domain usage even if conflicts are detected. Default is false.'],
                             'autogenerate_domain' => ['type' => 'boolean', 'default' => true, 'description' => 'If true and domains is empty, auto-generate a domain using the server\'s wildcard domain or sslip.io fallback. Ignored for the dockercompose build pack, which uses docker_compose_domains. Default: true.'],
@@ -653,6 +662,7 @@ class ApplicationsController extends Controller
                             'inject_build_args_to_dockerfile' => ['type' => 'boolean', 'description' => 'Inject build arguments into the Dockerfile build.'],
                             'include_source_commit_in_build' => ['type' => 'boolean', 'description' => 'Include the source commit in the build.'],
                             'is_env_sorting_enabled' => ['type' => 'boolean', 'description' => 'Sort environment variables.'],
+                            'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'],
                             'is_pr_deployments_public_enabled' => ['type' => 'boolean', 'description' => 'Make pull request deployments public.'],
                             'stop_grace_period' => ['type' => 'integer', 'nullable' => true, 'minimum' => 1, 'maximum' => 3600, 'description' => 'Container stop grace period in seconds.'],
                             'docker_images_to_keep' => ['type' => 'integer', 'minimum' => 0, 'maximum' => 100, 'description' => 'Number of Docker images to retain.'],
@@ -675,6 +685,10 @@ class ApplicationsController extends Controller
                             'is_http_basic_auth_enabled' => ['type' => 'boolean', 'description' => 'HTTP Basic Authentication enabled.'],
                             'http_basic_auth_username' => ['type' => 'string', 'nullable' => true, 'description' => 'Username for HTTP Basic Authentication'],
                             'http_basic_auth_password' => ['type' => 'string', 'nullable' => true, 'description' => 'Password for HTTP Basic Authentication'],
+                            'http_basic_auth_hash_algorithm' => ['type' => 'string', 'enum' => ['bcrypt', 'argon2id'], 'default' => 'bcrypt', 'description' => 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'],
+                            'http_basic_auth_bcrypt_cost' => ['type' => 'integer', 'minimum' => 4, 'maximum' => 14, 'default' => 10, 'description' => 'Bcrypt cost for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_memory_cost' => ['type' => 'integer', 'minimum' => 8192, 'maximum' => 262144, 'default' => 65536, 'description' => 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_time_cost' => ['type' => 'integer', 'minimum' => 1, 'maximum' => 12, 'default' => 4, 'description' => 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'],
                             'connect_to_docker_network' => ['type' => 'boolean', 'description' => 'The flag to connect the service to the predefined Docker network.'],
                             'force_domain_override' => ['type' => 'boolean', 'description' => 'Force domain usage even if conflicts are detected. Default is false.'],
                             'autogenerate_domain' => ['type' => 'boolean', 'default' => true, 'description' => 'If true and domains is empty, auto-generate a domain using the server\'s wildcard domain or sslip.io fallback. Ignored for the dockercompose build pack, which uses docker_compose_domains. Default: true.'],
@@ -854,6 +868,7 @@ class ApplicationsController extends Controller
                             'inject_build_args_to_dockerfile' => ['type' => 'boolean', 'description' => 'Inject build arguments into the Dockerfile build.'],
                             'include_source_commit_in_build' => ['type' => 'boolean', 'description' => 'Include the source commit in the build.'],
                             'is_env_sorting_enabled' => ['type' => 'boolean', 'description' => 'Sort environment variables.'],
+                            'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'],
                             'is_pr_deployments_public_enabled' => ['type' => 'boolean', 'description' => 'Make pull request deployments public.'],
                             'stop_grace_period' => ['type' => 'integer', 'nullable' => true, 'minimum' => 1, 'maximum' => 3600, 'description' => 'Container stop grace period in seconds.'],
                             'docker_images_to_keep' => ['type' => 'integer', 'minimum' => 0, 'maximum' => 100, 'description' => 'Number of Docker images to retain.'],
@@ -876,6 +891,10 @@ class ApplicationsController extends Controller
                             'is_http_basic_auth_enabled' => ['type' => 'boolean', 'description' => 'HTTP Basic Authentication enabled.'],
                             'http_basic_auth_username' => ['type' => 'string', 'nullable' => true, 'description' => 'Username for HTTP Basic Authentication'],
                             'http_basic_auth_password' => ['type' => 'string', 'nullable' => true, 'description' => 'Password for HTTP Basic Authentication'],
+                            'http_basic_auth_hash_algorithm' => ['type' => 'string', 'enum' => ['bcrypt', 'argon2id'], 'default' => 'bcrypt', 'description' => 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'],
+                            'http_basic_auth_bcrypt_cost' => ['type' => 'integer', 'minimum' => 4, 'maximum' => 14, 'default' => 10, 'description' => 'Bcrypt cost for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_memory_cost' => ['type' => 'integer', 'minimum' => 8192, 'maximum' => 262144, 'default' => 65536, 'description' => 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_time_cost' => ['type' => 'integer', 'minimum' => 1, 'maximum' => 12, 'default' => 4, 'description' => 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'],
                             'connect_to_docker_network' => ['type' => 'boolean', 'description' => 'The flag to connect the service to the predefined Docker network.'],
                             'force_domain_override' => ['type' => 'boolean', 'description' => 'Force domain usage even if conflicts are detected. Default is false.'],
                             'autogenerate_domain' => ['type' => 'boolean', 'default' => true, 'description' => 'If true and domains is empty, auto-generate a domain using the server\'s wildcard domain or sslip.io fallback. Ignored for the dockercompose build pack, which uses docker_compose_domains. Default: true.'],
@@ -1026,6 +1045,7 @@ class ApplicationsController extends Controller
                             'inject_build_args_to_dockerfile' => ['type' => 'boolean', 'description' => 'Inject build arguments into the Dockerfile build.'],
                             'include_source_commit_in_build' => ['type' => 'boolean', 'description' => 'Include the source commit in the build.'],
                             'is_env_sorting_enabled' => ['type' => 'boolean', 'description' => 'Sort environment variables.'],
+                            'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'],
                             'is_pr_deployments_public_enabled' => ['type' => 'boolean', 'description' => 'Make pull request deployments public.'],
                             'stop_grace_period' => ['type' => 'integer', 'nullable' => true, 'minimum' => 1, 'maximum' => 3600, 'description' => 'Container stop grace period in seconds.'],
                             'docker_images_to_keep' => ['type' => 'integer', 'minimum' => 0, 'maximum' => 100, 'description' => 'Number of Docker images to retain.'],
@@ -1048,6 +1068,10 @@ class ApplicationsController extends Controller
                             'is_http_basic_auth_enabled' => ['type' => 'boolean', 'description' => 'HTTP Basic Authentication enabled.'],
                             'http_basic_auth_username' => ['type' => 'string', 'nullable' => true, 'description' => 'Username for HTTP Basic Authentication'],
                             'http_basic_auth_password' => ['type' => 'string', 'nullable' => true, 'description' => 'Password for HTTP Basic Authentication'],
+                            'http_basic_auth_hash_algorithm' => ['type' => 'string', 'enum' => ['bcrypt', 'argon2id'], 'default' => 'bcrypt', 'description' => 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'],
+                            'http_basic_auth_bcrypt_cost' => ['type' => 'integer', 'minimum' => 4, 'maximum' => 14, 'default' => 10, 'description' => 'Bcrypt cost for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_memory_cost' => ['type' => 'integer', 'minimum' => 8192, 'maximum' => 262144, 'default' => 65536, 'description' => 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_time_cost' => ['type' => 'integer', 'minimum' => 1, 'maximum' => 12, 'default' => 4, 'description' => 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'],
                             'connect_to_docker_network' => ['type' => 'boolean', 'description' => 'The flag to connect the service to the predefined Docker network.'],
                             'force_domain_override' => ['type' => 'boolean', 'description' => 'Force domain usage even if conflicts are detected. Default is false.'],
                             'autogenerate_domain' => ['type' => 'boolean', 'default' => true, 'description' => 'If true and domains is empty, auto-generate a domain using the server\'s wildcard domain or sslip.io fallback. Ignored for the dockercompose build pack, which uses docker_compose_domains. Default: true.'],
@@ -1194,6 +1218,7 @@ class ApplicationsController extends Controller
                             'inject_build_args_to_dockerfile' => ['type' => 'boolean', 'description' => 'Inject build arguments into the Dockerfile build.'],
                             'include_source_commit_in_build' => ['type' => 'boolean', 'description' => 'Include the source commit in the build.'],
                             'is_env_sorting_enabled' => ['type' => 'boolean', 'description' => 'Sort environment variables.'],
+                            'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'],
                             'is_pr_deployments_public_enabled' => ['type' => 'boolean', 'description' => 'Make pull request deployments public.'],
                             'stop_grace_period' => ['type' => 'integer', 'nullable' => true, 'minimum' => 1, 'maximum' => 3600, 'description' => 'Container stop grace period in seconds.'],
                             'docker_images_to_keep' => ['type' => 'integer', 'minimum' => 0, 'maximum' => 100, 'description' => 'Number of Docker images to retain.'],
@@ -1216,6 +1241,10 @@ class ApplicationsController extends Controller
                             'is_http_basic_auth_enabled' => ['type' => 'boolean', 'description' => 'HTTP Basic Authentication enabled.'],
                             'http_basic_auth_username' => ['type' => 'string', 'nullable' => true, 'description' => 'Username for HTTP Basic Authentication'],
                             'http_basic_auth_password' => ['type' => 'string', 'nullable' => true, 'description' => 'Password for HTTP Basic Authentication'],
+                            'http_basic_auth_hash_algorithm' => ['type' => 'string', 'enum' => ['bcrypt', 'argon2id'], 'default' => 'bcrypt', 'description' => 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'],
+                            'http_basic_auth_bcrypt_cost' => ['type' => 'integer', 'minimum' => 4, 'maximum' => 14, 'default' => 10, 'description' => 'Bcrypt cost for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_memory_cost' => ['type' => 'integer', 'minimum' => 8192, 'maximum' => 262144, 'default' => 65536, 'description' => 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_time_cost' => ['type' => 'integer', 'minimum' => 1, 'maximum' => 12, 'default' => 4, 'description' => 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'],
                             'connect_to_docker_network' => ['type' => 'boolean', 'description' => 'The flag to connect the service to the predefined Docker network.'],
                             'force_domain_override' => ['type' => 'boolean', 'description' => 'Force domain usage even if conflicts are detected. Default is false.'],
                             'autogenerate_domain' => ['type' => 'boolean', 'default' => true, 'description' => 'If true and domains is empty, auto-generate a domain using the server\'s wildcard domain or sslip.io fallback. Ignored for the dockercompose build pack, which uses docker_compose_domains. Default: true.'],
@@ -1297,6 +1326,9 @@ class ApplicationsController extends Controller
 
         $this->authorize('create', Application::class);
 
+        // removeUnnecessaryFieldsFromRequest() strips force_domain_override before the docker_compose_domains checks run.
+        $forceDomainOverride = $request->boolean('force_domain_override');
+
         if ($request->instant_deploy) {
             abort_unless($request->user()->tokenCan('deploy') || $request->user()->tokenCan('root'), 403, 'Missing required permissions: deploy');
         }
@@ -1305,7 +1337,7 @@ class ApplicationsController extends Controller
         if ($return instanceof JsonResponse) {
             return $return;
         }
-        $allowedFields = ['project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'type', 'name', 'description', 'is_static', 'is_spa', 'is_auto_deploy_enabled', 'is_force_https_enabled', 'is_preview_deployments_enabled', 'domains', 'noindex_domains', 'git_repository', 'git_branch', 'git_commit_sha', 'private_key_uuid', 'docker_registry_image_name', 'docker_registry_image_tag', 'build_pack', 'install_command', 'build_command', 'start_command', 'ports_exposes', 'ports_mappings', 'custom_network_aliases', 'base_directory', 'publish_directory', 'health_check_enabled', 'health_check_type', 'health_check_command', 'health_check_path', 'health_check_port', 'health_check_host', 'health_check_method', 'health_check_return_code', 'health_check_scheme', 'health_check_response_text', 'health_check_interval', 'health_check_timeout', 'health_check_retries', 'health_check_start_period', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'custom_labels', 'custom_docker_run_options', 'post_deployment_command', 'post_deployment_command_container', 'pre_deployment_command', 'pre_deployment_command_container',  'manual_webhook_secret_github', 'manual_webhook_secret_gitlab', 'manual_webhook_secret_bitbucket', 'manual_webhook_secret_gitea', 'redirect', 'github_app_uuid', 'instant_deploy', 'dockerfile', 'dockerfile_location', 'docker_compose_location', 'docker_compose_raw', 'docker_compose_custom_start_command', 'docker_compose_custom_build_command', 'docker_compose_domains', 'watch_paths', 'use_build_server', 'use_build_secrets', 'static_image', 'custom_nginx_configuration', 'is_http_basic_auth_enabled', 'http_basic_auth_username', 'http_basic_auth_password', 'connect_to_docker_network', 'force_domain_override', 'autogenerate_domain', 'is_container_label_escape_enabled', 'tags', 'is_preserve_repository_enabled', 'preview_url_template', 'max_restart_count', ...self::APPLICATION_SETTING_FIELDS];
+        $allowedFields = ['project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'type', 'name', 'description', 'is_static', 'is_spa', 'is_auto_deploy_enabled', 'is_force_https_enabled', 'is_preview_deployments_enabled', 'domains', 'noindex_domains', 'git_repository', 'git_branch', 'git_commit_sha', 'private_key_uuid', 'docker_registry_image_name', 'docker_registry_image_tag', 'build_pack', 'install_command', 'build_command', 'start_command', 'ports_exposes', 'ports_mappings', 'custom_network_aliases', 'base_directory', 'publish_directory', 'health_check_enabled', 'health_check_type', 'health_check_command', 'health_check_path', 'health_check_port', 'health_check_host', 'health_check_method', 'health_check_return_code', 'health_check_scheme', 'health_check_response_text', 'health_check_interval', 'health_check_timeout', 'health_check_retries', 'health_check_start_period', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'custom_labels', 'custom_docker_run_options', 'post_deployment_command', 'post_deployment_command_container', 'pre_deployment_command', 'pre_deployment_command_container',  'manual_webhook_secret_github', 'manual_webhook_secret_gitlab', 'manual_webhook_secret_bitbucket', 'manual_webhook_secret_gitea', 'redirect', 'github_app_uuid', 'instant_deploy', 'dockerfile', 'dockerfile_location', 'docker_compose_location', 'docker_compose_raw', 'docker_compose_custom_start_command', 'docker_compose_custom_build_command', 'docker_compose_domains', 'watch_paths', 'use_build_server', 'use_build_secrets', 'static_image', 'custom_nginx_configuration', 'is_http_basic_auth_enabled', 'http_basic_auth_username', 'http_basic_auth_password', 'http_basic_auth_hash_algorithm', 'http_basic_auth_bcrypt_cost', 'http_basic_auth_argon2id_memory_cost', 'http_basic_auth_argon2id_time_cost', 'connect_to_docker_network', 'force_domain_override', 'autogenerate_domain', 'is_container_label_escape_enabled', 'tags', 'is_preserve_repository_enabled', 'preview_url_template', 'max_restart_count', ...self::APPLICATION_SETTING_FIELDS];
 
         $validator = customApiValidator($request->all(), [
             'name' => 'string|max:255',
@@ -1317,7 +1349,9 @@ class ApplicationsController extends Controller
             'destination_uuid' => 'string',
             'is_http_basic_auth_enabled' => 'boolean',
             'http_basic_auth_username' => 'string|nullable',
-            'http_basic_auth_password' => 'string|nullable',
+            // bcrypt ignores everything after 72 bytes. Labels for Traefik always use bcrypt and are also generated on
+            // Caddy servers when "Labels for all supported proxies" is selected, so that the proxy can be switched easily.
+            'http_basic_auth_password' => 'string|nullable|max:72',
             'autogenerate_domain' => 'boolean',
             'tags' => 'array|nullable',
             'tags.*' => 'string|min:2',
@@ -2730,7 +2764,10 @@ class ApplicationsController extends Controller
 
         $lines = normalizeLogLines($request->query('lines'));
         $showTimestamps = parseLogTimestampFlag($request->query('show_timestamps'));
-        $logs = getContainerLogs($application->destination->server, $container['ID'], $lines, $showTimestamps);
+        $logs = sanitizeLogsForExport(
+            getContainerLogs($application->destination->server, $container['ID'], $lines, $showTimestamps),
+            EnvironmentVariable::logRedactionSecretsFor($application, includePreview: $pullRequestId !== null),
+        );
 
         return response()->json([
             'logs' => $logs,
@@ -3188,6 +3225,10 @@ class ApplicationsController extends Controller
                             'watch_paths' => ['type' => 'string', 'description' => 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'],
                             'use_build_server' => ['type' => 'boolean', 'nullable' => true, 'description' => 'Use build server.'],
                             'use_build_secrets' => ['type' => 'boolean', 'description' => 'Use Docker Build Secrets for build-time environment variables.'],
+                            'http_basic_auth_hash_algorithm' => ['type' => 'string', 'enum' => ['bcrypt', 'argon2id'], 'description' => 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'],
+                            'http_basic_auth_bcrypt_cost' => ['type' => 'integer', 'minimum' => 4, 'maximum' => 14, 'description' => 'Bcrypt cost for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_memory_cost' => ['type' => 'integer', 'minimum' => 8192, 'maximum' => 262144, 'description' => 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'],
+                            'http_basic_auth_argon2id_time_cost' => ['type' => 'integer', 'minimum' => 1, 'maximum' => 12, 'description' => 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'],
                             'is_git_submodules_enabled' => ['type' => 'boolean', 'description' => 'Clone Git submodules.'],
                             'is_git_lfs_enabled' => ['type' => 'boolean', 'description' => 'Enable Git LFS.'],
                             'is_git_shallow_clone_enabled' => ['type' => 'boolean', 'description' => 'Use a shallow Git clone.'],
@@ -3195,6 +3236,7 @@ class ApplicationsController extends Controller
                             'inject_build_args_to_dockerfile' => ['type' => 'boolean', 'description' => 'Inject build arguments into the Dockerfile build.'],
                             'include_source_commit_in_build' => ['type' => 'boolean', 'description' => 'Include the source commit in the build.'],
                             'is_env_sorting_enabled' => ['type' => 'boolean', 'description' => 'Sort environment variables.'],
+                            'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'],
                             'is_pr_deployments_public_enabled' => ['type' => 'boolean', 'description' => 'Make pull request deployments public.'],
                             'stop_grace_period' => ['type' => 'integer', 'nullable' => true, 'minimum' => 1, 'maximum' => 3600, 'description' => 'Container stop grace period in seconds.'],
                             'docker_images_to_keep' => ['type' => 'integer', 'minimum' => 0, 'maximum' => 100, 'description' => 'Number of Docker images to retain.'],
@@ -3306,6 +3348,10 @@ class ApplicationsController extends Controller
 
         $this->authorize('update', $application);
 
+        if ($request->has('redact_all_env_values_in_logs')) {
+            $this->authorize('manageEnvironment', $application);
+        }
+
         if ($request->instant_deploy) {
             abort_unless($request->user()->tokenCan('deploy') || $request->user()->tokenCan('root'), 403, 'Missing required permissions: deploy');
             $this->authorize('deploy', $application);
@@ -3314,7 +3360,7 @@ class ApplicationsController extends Controller
         $dnsCleanup = app(ManagedDnsRecordCleanup::class);
         $previousDnsHostnames = $dnsCleanup->hostnamesOf($application);
         $server = $application->destination->server;
-        $allowedFields = ['name', 'description', 'is_static', 'is_spa', 'is_auto_deploy_enabled', 'is_force_https_enabled', 'is_preview_deployments_enabled', 'domains', 'noindex_domains', 'git_repository', 'git_branch', 'git_commit_sha', 'docker_registry_image_name', 'docker_registry_image_tag', 'build_pack', 'static_image', 'install_command', 'build_command', 'start_command', 'ports_exposes', 'ports_mappings', 'custom_network_aliases', 'base_directory', 'publish_directory', 'health_check_enabled', 'health_check_type', 'health_check_command', 'health_check_path', 'health_check_port', 'health_check_host', 'health_check_method', 'health_check_return_code', 'health_check_scheme', 'health_check_response_text', 'health_check_interval', 'health_check_timeout', 'health_check_retries', 'health_check_start_period', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'custom_labels', 'custom_docker_run_options', 'post_deployment_command', 'post_deployment_command_container', 'pre_deployment_command', 'pre_deployment_command_container', 'watch_paths', 'manual_webhook_secret_github', 'manual_webhook_secret_gitlab', 'manual_webhook_secret_bitbucket', 'manual_webhook_secret_gitea', 'dockerfile_location', 'dockerfile_target_build', 'docker_compose_location', 'docker_compose_custom_start_command', 'docker_compose_custom_build_command', 'docker_compose_domains', 'redirect', 'instant_deploy', 'use_build_server', 'use_build_secrets', 'custom_nginx_configuration', 'is_http_basic_auth_enabled', 'http_basic_auth_username', 'http_basic_auth_password', 'connect_to_docker_network', 'force_domain_override', 'is_container_label_escape_enabled', 'is_preserve_repository_enabled', 'preview_url_template', 'max_restart_count', 'github_app_uuid', 'dockerfile', ...self::APPLICATION_SETTING_FIELDS];
+        $allowedFields = ['name', 'description', 'is_static', 'is_spa', 'is_auto_deploy_enabled', 'is_force_https_enabled', 'is_preview_deployments_enabled', 'domains', 'noindex_domains', 'git_repository', 'git_branch', 'git_commit_sha', 'docker_registry_image_name', 'docker_registry_image_tag', 'build_pack', 'static_image', 'install_command', 'build_command', 'start_command', 'ports_exposes', 'ports_mappings', 'custom_network_aliases', 'base_directory', 'publish_directory', 'health_check_enabled', 'health_check_type', 'health_check_command', 'health_check_path', 'health_check_port', 'health_check_host', 'health_check_method', 'health_check_return_code', 'health_check_scheme', 'health_check_response_text', 'health_check_interval', 'health_check_timeout', 'health_check_retries', 'health_check_start_period', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'custom_labels', 'custom_docker_run_options', 'post_deployment_command', 'post_deployment_command_container', 'pre_deployment_command', 'pre_deployment_command_container', 'watch_paths', 'manual_webhook_secret_github', 'manual_webhook_secret_gitlab', 'manual_webhook_secret_bitbucket', 'manual_webhook_secret_gitea', 'dockerfile_location', 'dockerfile_target_build', 'docker_compose_location', 'docker_compose_custom_start_command', 'docker_compose_custom_build_command', 'docker_compose_domains', 'redirect', 'instant_deploy', 'use_build_server', 'use_build_secrets', 'custom_nginx_configuration', 'is_http_basic_auth_enabled', 'http_basic_auth_username', 'http_basic_auth_password', 'http_basic_auth_hash_algorithm', 'http_basic_auth_bcrypt_cost', 'http_basic_auth_argon2id_memory_cost', 'http_basic_auth_argon2id_time_cost', 'connect_to_docker_network', 'force_domain_override', 'is_container_label_escape_enabled', 'is_preserve_repository_enabled', 'preview_url_template', 'max_restart_count', 'github_app_uuid', 'dockerfile', ...self::APPLICATION_SETTING_FIELDS];
 
         $validationRules = [
             'name' => 'string|max:255',
@@ -3331,7 +3377,9 @@ class ApplicationsController extends Controller
             'is_http_basic_auth_enabled' => 'boolean|nullable',
             'is_preview_deployments_enabled' => 'boolean|nullable',
             'http_basic_auth_username' => 'string',
-            'http_basic_auth_password' => 'string',
+            // bcrypt ignores everything after 72 bytes. Labels for Traefik always use bcrypt and are also generated on
+            // Caddy servers when "Labels for all supported proxies" is selected, so that the proxy can be switched easily.
+            'http_basic_auth_password' => 'string|max:72',
             'include_source_commit_in_build' => 'boolean',
             'ports_exposes' => 'nullable|string|regex:/^(\d+)(,\d+)*$/',
         ];
@@ -3439,6 +3487,24 @@ class ApplicationsController extends Controller
             }
         }
 
+        $githubApp = null;
+        if ($request->has('github_app_uuid')) {
+            if ($application->build_pack === 'dockerimage' || filled($application->dockerfile) || $application->deploymentType() === 'deploy_key') {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => [
+                        'github_app_uuid' => 'The github_app_uuid can only be changed for applications deployed from a GitHub App or public repository.',
+                    ],
+                ], 422);
+            }
+            $githubApp = GithubApp::where('uuid', $request->github_app_uuid)
+                ->where(fn ($query) => $query->where('team_id', $teamId)->orWhere('is_system_wide', true))
+                ->first();
+            if (! $githubApp?->isConnected()) {
+                return response()->json(['message' => 'Github App not found.'], 404);
+            }
+        }
+
         $applicationSettings = $this->applicationSettingsFromRequest($request);
         if ($prefixValidation = $this->containerNamePrefixValidationResponse($applicationSettings, $application->destination->server, $application)) {
             return $prefixValidation;
@@ -3456,9 +3522,15 @@ class ApplicationsController extends Controller
             ], 422);
         }
 
-        $requestHasHttpBasicAuth = $request->has('is_http_basic_auth_enabled')
-            || $request->has('http_basic_auth_username')
-            || $request->has('http_basic_auth_password');
+        $requestHasHttpBasicAuth = $request->hasAny([
+            'is_http_basic_auth_enabled',
+            'http_basic_auth_username',
+            'http_basic_auth_password',
+            'http_basic_auth_hash_algorithm',
+            'http_basic_auth_bcrypt_cost',
+            'http_basic_auth_argon2id_memory_cost',
+            'http_basic_auth_argon2id_time_cost',
+        ]);
 
         if ($request->has('is_http_basic_auth_enabled') && $request->is_http_basic_auth_enabled === true) {
             if (blank($application->http_basic_auth_username) || blank($application->http_basic_auth_password)) {
@@ -5012,6 +5084,15 @@ class ApplicationsController extends Controller
     {
         $teamId = getTeamIdFromToken();
 
+        if ($request->input('http_basic_auth_hash_algorithm') === HttpBasicAuthHashAlgorithm::ARGON2ID->value && ! $server->caddySupportsArgon2idBasicAuth()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => [
+                    'http_basic_auth_hash_algorithm' => 'Argon2id needs a server that runs the Caddy proxy, version 2.11 or newer.',
+                ],
+            ], 422);
+        }
+
         // Validate ports_mappings
         if ($request->has('ports_mappings')) {
             $ports = [];
@@ -6067,7 +6148,7 @@ class ApplicationsController extends Controller
 
     #[OA\Get(
         summary: 'List Rollback Images',
-        description: 'List available Docker images for rolling back an application. Returns an empty list when the server is unavailable or remote inspection is not possible.',
+        description: 'List available Docker images for rolling back an application: images on the server (`local`) and, when a Docker registry image name is set, images of recent successful deployments in the registry (`registry`). Returns an empty list when the server is unavailable or remote inspection is not possible.',
         path: '/applications/{uuid}/rollback-images',
         operationId: 'list-application-rollback-images',
         security: [['bearerAuth' => []]],
@@ -6091,6 +6172,7 @@ class ApplicationsController extends Controller
                                     new OA\Property(property: 'tag', type: 'string'),
                                     new OA\Property(property: 'created_at', type: 'string'),
                                     new OA\Property(property: 'is_current', type: 'boolean'),
+                                    new OA\Property(property: 'source', type: 'string', enum: ['local', 'registry']),
                                 ]
                             )
                         ),
@@ -6115,61 +6197,11 @@ class ApplicationsController extends Controller
 
         $this->authorize('view', $application);
 
-        $current = null;
-        $images = [];
-
         try {
-            $server = $application->destination?->server;
-            if ($server && $server->isFunctional()) {
-                $image = $application->docker_registry_image_name ?? $application->uuid;
-                $output = instant_remote_process([
-                    "docker inspect --format='{{.Config.Image}}' {$application->uuid}",
-                ], $server, throwError: false);
-                $current = self::currentRollbackImageTag(str($output)->trim()->toString());
-
-                $output = instant_remote_process([
-                    "docker images --format '{{.Repository}}#{{.Tag}}#{{.CreatedAt}}'",
-                ], $server);
-                $images = str($output)->trim()->explode("\n")->filter(function ($item) use ($image) {
-                    $repository = str($item)->before('#')->toString();
-
-                    // Exact repository match only — avoid substring collisions across images.
-                    return $repository === $image;
-                })->map(function ($item) use ($current) {
-                    $parts = str($item)->explode('#');
-
-                    return [
-                        'tag' => $parts[1] ?? null,
-                        'created_at' => $parts[2] ?? null,
-                        'is_current' => ($parts[1] ?? null) === $current,
-                    ];
-                })->values()->all();
-            }
+            return response()->json(GetRollbackImages::run($application));
         } catch (\Throwable) {
-            $current = null;
-            $images = [];
+            return response()->json(['current' => null, 'images' => []]);
         }
-
-        return response()->json([
-            'current' => $current,
-            'images' => $images,
-        ]);
-    }
-
-    private static function currentRollbackImageTag(string $imageReference): ?string
-    {
-        if (str_contains($imageReference, '@')) {
-            return null;
-        }
-
-        $lastColon = strrpos($imageReference, ':');
-        $lastSlash = strrpos($imageReference, '/');
-
-        if ($lastColon === false || ($lastSlash !== false && $lastColon < $lastSlash)) {
-            return null;
-        }
-
-        return substr($imageReference, $lastColon + 1) ?: null;
     }
 
     #[OA\Post(
diff --git a/app/Http/Controllers/Api/CloudProviderTokensController.php b/app/Http/Controllers/Api/CloudProviderTokensController.php
index ad699e8f12..eca3397493 100644
--- a/app/Http/Controllers/Api/CloudProviderTokensController.php
+++ b/app/Http/Controllers/Api/CloudProviderTokensController.php
@@ -45,6 +45,10 @@ class CloudProviderTokensController extends Controller
                 'vultr' => Http::withHeaders([
                     'Authorization' => 'Bearer '.$token,
                 ])->timeout(10)->get('https://api.vultr.com/v2/account'),
+                'hostinger' => Http::withToken($token)
+                    ->acceptJson()
+                    ->timeout(10)
+                    ->get('https://developers.hostinger.com/api/vps/v1/virtual-machines'),
                 default => null,
             };
 
@@ -90,7 +94,7 @@ class CloudProviderTokensController extends Controller
                                 properties: [
                                     'uuid' => ['type' => 'string'],
                                     'name' => ['type' => 'string'],
-                                    'provider' => ['type' => 'string', 'enum' => ['hetzner', 'digitalocean', 'vultr']],
+                                    'provider' => ['type' => 'string', 'enum' => ['hetzner', 'digitalocean', 'vultr', 'hostinger']],
                                     'team_id' => ['type' => 'integer'],
                                     'servers_count' => ['type' => 'integer'],
                                     'created_at' => ['type' => 'string'],
@@ -208,7 +212,7 @@ class CloudProviderTokensController extends Controller
                     type: 'object',
                     required: ['provider', 'token', 'name'],
                     properties: [
-                        'provider' => ['type' => 'string', 'enum' => ['hetzner', 'digitalocean', 'vultr'], 'example' => 'hetzner', 'description' => 'The cloud provider.'],
+                        'provider' => ['type' => 'string', 'enum' => ['hetzner', 'digitalocean', 'vultr', 'hostinger'], 'example' => 'hetzner', 'description' => 'The cloud provider.'],
                         'token' => ['type' => 'string', 'example' => 'your-api-token-here', 'description' => 'The API token for the cloud provider.'],
                         'name' => ['type' => 'string', 'example' => 'My Hetzner Token', 'description' => 'A friendly name for the token.'],
                     ],
@@ -263,7 +267,7 @@ class CloudProviderTokensController extends Controller
         $body = $request->json()->all();
 
         $validator = customApiValidator($body, [
-            'provider' => 'required|string|in:hetzner,digitalocean,vultr',
+            'provider' => 'required|string|in:hetzner,digitalocean,vultr,hostinger',
             'token' => 'required|string',
             'name' => 'required|string|max:255',
         ]);
diff --git a/app/Http/Controllers/Api/Concerns/HandlesTagsApi.php b/app/Http/Controllers/Api/Concerns/HandlesTagsApi.php
index 4c15d0726d..80f11802be 100644
--- a/app/Http/Controllers/Api/Concerns/HandlesTagsApi.php
+++ b/app/Http/Controllers/Api/Concerns/HandlesTagsApi.php
@@ -121,8 +121,8 @@ trait HandlesTagsApi
             return response()->json(['message' => 'Tag not found on resource.'], 404);
         }
 
+        // The tag stays, also without resources.
         $resource->tags()->detach($tag->id);
-        $tag->deleteIfOrphaned();
 
         return response()->json(['message' => 'Tag removed.']);
     }
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index cee12701d5..5ecab6ed6d 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -18,6 +18,7 @@ use App\Models\LocalPersistentVolume;
 use App\Models\Project;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\StandaloneDragonfly;
@@ -32,6 +33,8 @@ use Illuminate\Database\Eloquent\Collection as EloquentCollection;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Bus;
 use Illuminate\Support\Facades\DB;
 use OpenApi\Attributes as OA;
@@ -155,6 +158,58 @@ class DatabasesController extends Controller
         }
     }
 
+    /**
+     * Resolves the S3 destinations of a backup request, primary first. `s3_storage_uuids` lists every destination;
+     * `s3_storage_uuid` alone selects a single destination, and sent with `s3_storage_uuids` it must be in the list and
+     * becomes the primary destination.
+     *
+     * @return Collection<int, S3Storage>|JsonResponse|null Null when the request does not select destinations.
+     */
+    private function requestedBackupS3Storages(Request $request, int|string $teamId): Collection|JsonResponse|null
+    {
+        $hasList = $request->has('s3_storage_uuids');
+        if (! $hasList && ! $request->filled('s3_storage_uuid')) {
+            return null;
+        }
+
+        $uuids = collect($hasList ? $request->input('s3_storage_uuids') : [$request->input('s3_storage_uuid')])->unique()->values();
+        $primaryUuid = $request->input('s3_storage_uuid') ?? $uuids->first();
+        $errorField = $hasList ? 's3_storage_uuids' : 's3_storage_uuid';
+
+        if (filled($primaryUuid) && ! $uuids->contains($primaryUuid)) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['s3_storage_uuid' => ['The s3_storage_uuid must be one of the s3_storage_uuids.']],
+            ], 422);
+        }
+
+        $storages = S3Storage::ownedByCurrentTeamAPI($teamId)->whereIn('uuid', $uuids->all())->get();
+        if ($storages->count() !== $uuids->count()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => [$errorField => ['The selected S3 storage is invalid for this team.']],
+            ], 422);
+        }
+
+        return $storages->sortBy(fn (S3Storage $storage): int => $storage->uuid === $primaryUuid ? 0 : 1)->values();
+    }
+
+    /**
+     * Adds the S3 destination UUIDs (primary first) to a serialized backup without exposing the storages themselves.
+     */
+    private function withBackupS3StorageUuids(ScheduledDatabaseBackup $backup): ScheduledDatabaseBackup
+    {
+        $storages = $backup->s3Storages->sortBy(fn (S3Storage $storage): int => $storage->id === $backup->s3_storage_id ? 0 : 1);
+        if ($storages->isEmpty() && $backup->s3) {
+            $storages = collect([$backup->s3]);
+        }
+
+        $backup->setAttribute('s3_storage_uuid', $backup->s3?->uuid);
+        $backup->setAttribute('s3_storage_uuids', $storages->pluck('uuid')->values()->all());
+
+        return $backup->unsetRelation('s3Storages')->unsetRelation('s3');
+    }
+
     private function removeSensitiveData($database, bool $loadNestedServerSecrets = false)
     {
         $database->makeHidden([
@@ -304,10 +359,19 @@ class DatabasesController extends Controller
         }
 
         $databaseIds = $databases->pluck('id')->toArray();
+        $databasesByMorphKey = $databases->keyBy(fn ($database) => $database->getMorphClass().':'.$database->id);
+        $messageSecrets = [];
 
-        $backupConfigs = ScheduledDatabaseBackup::ownedByCurrentTeamAPI($teamId)->with('latest_log')
+        $backupConfigs = ScheduledDatabaseBackup::ownedByCurrentTeamAPI($teamId)->with(['latest_log', 's3', 's3Storages'])
             ->whereIn('database_id', $databaseIds)
             ->get()
+            ->map(function (ScheduledDatabaseBackup $backup) use ($databasesByMorphKey, &$messageSecrets): ScheduledDatabaseBackup {
+                if ($backup->latest_log) {
+                    $this->redactBackupExecutionMessage($backup->latest_log, $databasesByMorphKey->get($backup->database_type.':'.$backup->database_id), $messageSecrets);
+                }
+
+                return $this->withBackupS3StorageUuids($backup);
+            })
             ->groupBy(fn (ScheduledDatabaseBackup $backup) => $backup->database_type.':'.$backup->database_id);
 
         $databases = $databases->map(function ($database) use ($backupConfigs) {
@@ -343,7 +407,7 @@ class DatabasesController extends Controller
         responses: [
             new OA\Response(
                 response: 200,
-                description: 'Get all backups for a database',
+                description: 'Get all backups for a database. Each backup includes s3_storage_uuid (primary S3 destination) and s3_storage_uuids (every S3 destination, primary first).',
                 content: new OA\JsonContent(
                     type: 'string',
                     example: 'Content is very complex. Will be implemented later.',
@@ -379,7 +443,15 @@ class DatabasesController extends Controller
 
         $this->authorize('view', $database);
 
-        $backupConfig = ScheduledDatabaseBackup::ownedByCurrentTeamAPI($teamId)->with('executions')->where('database_id', $database->id)->get();
+        $messageSecrets = [];
+        $backupConfig = ScheduledDatabaseBackup::ownedByCurrentTeamAPI($teamId)->with(['executions', 's3', 's3Storages'])->where('database_id', $database->id)->get()
+            ->map(function (ScheduledDatabaseBackup $backup) use ($database, &$messageSecrets): ScheduledDatabaseBackup {
+                $backup->executions->each(function (ScheduledDatabaseBackupExecution $execution) use ($database, &$messageSecrets): void {
+                    $this->redactBackupExecutionMessage($execution, $database, $messageSecrets);
+                });
+
+                return $this->withBackupS3StorageUuids($backup);
+            });
 
         return response()->json($backupConfig);
     }
@@ -521,6 +593,7 @@ class DatabasesController extends Controller
                         'health_check_timeout' => ['type' => 'integer', 'description' => 'Healthcheck timeout in seconds.', 'minimum' => 1, 'default' => 5],
                         'health_check_retries' => ['type' => 'integer', 'description' => 'Healthcheck retries count.', 'minimum' => 1, 'default' => 5],
                         'health_check_start_period' => ['type' => 'integer', 'description' => 'Healthcheck start period in seconds.', 'minimum' => 0, 'default' => 5],
+                        'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values, database passwords, and remote secrets are redacted. Requires team admin permissions.'],
                     ],
                 ),
             )
@@ -580,6 +653,7 @@ class DatabasesController extends Controller
             'limits_cpuset' => 'string|nullable',
             'limits_cpu_shares' => 'numeric',
             'instant_deploy' => 'boolean',
+            'redact_all_env_values_in_logs' => 'boolean',
         ]);
 
         if ($validator->fails()) {
@@ -590,6 +664,7 @@ class DatabasesController extends Controller
         }
         $uuid = $request->uuid;
         $instantDeploy = $request->boolean('instant_deploy');
+        $redactAllEnvValuesInLogs = $request->has('redact_all_env_values_in_logs') ? $request->boolean('redact_all_env_values_in_logs') : null;
         removeUnnecessaryFieldsFromRequest($request);
         $database = queryDatabaseByUuidWithinTeam($uuid, $teamId);
         if (! $database) {
@@ -603,6 +678,10 @@ class DatabasesController extends Controller
             $this->authorize('manage', $database);
         }
 
+        if ($redactAllEnvValuesInLogs !== null) {
+            $this->authorize('manageEnvironment', $database);
+        }
+
         if ($request->has('is_public') && (bool) $request->is_public !== (bool) $database->is_public) {
             $forbidden = $this->deployAbilityForbiddenResponse($request, 'Making a database public or private starts or stops its proxy on the server, so it needs a token with the deploy permission.');
             if ($forbidden) {
@@ -853,6 +932,9 @@ class DatabasesController extends Controller
         }
 
         // Only update database fields, not backup configuration
+        if ($redactAllEnvValuesInLogs !== null) {
+            $database->redact_all_env_values_in_logs = $redactAllEnvValuesInLogs;
+        }
         $database->update($request->only($allowedFields));
         // The Redis password is stored in the REDIS_PASSWORD variable, not in a column.
         if ($database instanceof StandaloneRedis && filled($request->redis_password)) {
@@ -876,7 +958,10 @@ class DatabasesController extends Controller
             'database_uuid' => $database->uuid,
             'database_name' => $database->name,
             'database_type' => $database->type(),
-            'changed_fields' => array_values(array_intersect($allowedFields, array_keys($request->all()))),
+            'changed_fields' => [
+                ...array_values(array_intersect($allowedFields, array_keys($request->all()))),
+                ...($redactAllEnvValuesInLogs === null ? [] : ['redact_all_env_values_in_logs']),
+            ],
         ]);
 
         return response()->json([
@@ -916,7 +1001,8 @@ class DatabasesController extends Controller
                         'frequency' => ['type' => 'string', 'description' => 'Backup frequency (cron expression or: every_minute, hourly, daily, weekly, monthly, yearly)'],
                         'enabled' => ['type' => 'boolean', 'description' => 'Whether the backup is enabled', 'default' => true],
                         'save_s3' => ['type' => 'boolean', 'description' => 'Whether to save backups to S3', 'default' => false],
-                        's3_storage_uuid' => ['type' => 'string', 'description' => 'S3 storage UUID (required if save_s3 is true)'],
+                        's3_storage_uuid' => ['type' => 'string', 'description' => 'Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination. Either field is required if save_s3 is true.'],
+                        's3_storage_uuids' => ['type' => 'array', 'items' => ['type' => 'string'], 'description' => 'UUIDs of every S3 storage the backup is uploaded to. Replaces the current destinations. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination.'],
                         'databases_to_backup' => ['type' => 'string', 'description' => 'Comma separated list of databases to backup'],
                         'dump_all' => ['type' => 'boolean', 'description' => 'Whether to dump all databases', 'default' => false],
                         'backup_now' => ['type' => 'boolean', 'description' => 'Whether to trigger backup immediately after creation. Needs a token with the deploy permission.'],
@@ -968,7 +1054,7 @@ class DatabasesController extends Controller
     )]
     public function create_backup(Request $request)
     {
-        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout', 'missing_backup_notification_days'];
+        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 's3_storage_uuids', 'timeout', 'missing_backup_notification_days'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -988,6 +1074,8 @@ class DatabasesController extends Controller
             'dump_all' => 'boolean',
             'backup_now' => 'boolean|nullable',
             's3_storage_uuid' => 'string|exists:s3_storages,uuid|nullable',
+            's3_storage_uuids' => 'array',
+            's3_storage_uuids.*' => 'string|distinct',
             'databases_to_backup' => 'string|nullable',
             'database_backup_retention_amount_locally' => 'integer|min:0',
             'database_backup_retention_days_locally' => 'integer|min:0',
@@ -1040,24 +1128,17 @@ class DatabasesController extends Controller
             ], 422);
         }
 
-        // Validate S3 storage if save_s3 is true
-        if ($request->boolean('save_s3') && ! $request->filled('s3_storage_uuid')) {
+        $s3Storages = $this->requestedBackupS3Storages($request, $teamId);
+        if ($s3Storages instanceof JsonResponse) {
+            return $s3Storages;
+        }
+        if ($request->boolean('save_s3') && blank($s3Storages)) {
             return response()->json([
                 'message' => 'Validation failed.',
-                'errors' => ['s3_storage_uuid' => ['The s3_storage_uuid field is required when save_s3 is true.']],
+                'errors' => ['s3_storage_uuid' => ['The s3_storage_uuid or s3_storage_uuids field is required when save_s3 is true.']],
             ], 422);
         }
 
-        if ($request->filled('s3_storage_uuid')) {
-            $existsInTeam = S3Storage::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->s3_storage_uuid)->exists();
-            if (! $existsInTeam) {
-                return response()->json([
-                    'message' => 'Validation failed.',
-                    'errors' => ['s3_storage_uuid' => ['The selected S3 storage is invalid for this team.']],
-                ], 422);
-            }
-        }
-
         // Check for extra fields
         $extraFields = array_diff(array_keys($request->all()), $backupConfigFields, ['backup_now']);
         if (! empty($extraFields)) {
@@ -1072,20 +1153,9 @@ class DatabasesController extends Controller
             ], 422);
         }
 
-        $backupData = $request->only($backupConfigFields);
-
-        // Convert s3_storage_uuid to s3_storage_id
-        if (isset($backupData['s3_storage_uuid'])) {
-            $s3Storage = S3Storage::ownedByCurrentTeamAPI($teamId)->where('uuid', $backupData['s3_storage_uuid'])->first();
-            if ($s3Storage) {
-                $backupData['s3_storage_id'] = $s3Storage->id;
-            } elseif ($request->boolean('save_s3')) {
-                return response()->json([
-                    'message' => 'Validation failed.',
-                    'errors' => ['s3_storage_uuid' => ['The selected S3 storage is invalid for this team.']],
-                ], 422);
-            }
-            unset($backupData['s3_storage_uuid']);
+        $backupData = Arr::except($request->only($backupConfigFields), ['s3_storage_uuid', 's3_storage_uuids']);
+        if ($s3Storages !== null) {
+            $backupData['s3_storage_id'] = $s3Storages->first()?->id;
         }
 
         // Set default databases_to_backup based on database type if not provided
@@ -1124,6 +1194,9 @@ class DatabasesController extends Controller
         }
 
         $backupConfig = ScheduledDatabaseBackup::create($backupData);
+        if ($s3Storages !== null) {
+            $backupConfig->syncS3Storages($s3Storages->pluck('id')->all());
+        }
 
         // Trigger immediate backup if requested
         if ($request->backup_now) {
@@ -1183,7 +1256,8 @@ class DatabasesController extends Controller
                     type: 'object',
                     properties: [
                         'save_s3' => ['type' => 'boolean', 'description' => 'Whether data is saved in s3 or not'],
-                        's3_storage_uuid' => ['type' => 'string', 'description' => 'S3 storage UUID'],
+                        's3_storage_uuid' => ['type' => 'string', 'description' => 'Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination; when it is already a destination, it becomes the primary destination and the other destinations stay.'],
+                        's3_storage_uuids' => ['type' => 'array', 'items' => ['type' => 'string'], 'description' => 'UUIDs of every S3 storage the backup is uploaded to. Replaces the current destinations. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination.'],
                         'backup_now' => ['type' => 'boolean', 'description' => 'Whether to take a backup now or not. Needs a token with the deploy permission.'],
                         'enabled' => ['type' => 'boolean', 'description' => 'Whether the backup is enabled or not'],
                         'databases_to_backup' => ['type' => 'string', 'description' => 'Comma separated list of databases to backup'],
@@ -1230,7 +1304,7 @@ class DatabasesController extends Controller
     )]
     public function update_backup(Request $request)
     {
-        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout', 'missing_backup_notification_days'];
+        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 's3_storage_uuids', 'timeout', 'missing_backup_notification_days'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -1247,6 +1321,8 @@ class DatabasesController extends Controller
             'enabled' => 'boolean',
             'dump_all' => 'boolean',
             's3_storage_uuid' => 'string|exists:s3_storages,uuid|nullable',
+            's3_storage_uuids' => 'array',
+            's3_storage_uuids.*' => 'string|distinct',
             'databases_to_backup' => 'string|nullable',
             'frequency' => 'string',
             'database_backup_retention_amount_locally' => 'integer|min:0',
@@ -1301,20 +1377,9 @@ class DatabasesController extends Controller
             }
         }
 
-        if ($request->boolean('save_s3') && ! $request->filled('s3_storage_uuid')) {
-            return response()->json([
-                'message' => 'Validation failed.',
-                'errors' => ['s3_storage_uuid' => ['The s3_storage_uuid field is required when save_s3 is true.']],
-            ], 422);
-        }
-        if ($request->filled('s3_storage_uuid')) {
-            $existsInTeam = S3Storage::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->s3_storage_uuid)->exists();
-            if (! $existsInTeam) {
-                return response()->json([
-                    'message' => 'Validation failed.',
-                    'errors' => ['s3_storage_uuid' => ['The selected S3 storage is invalid for this team.']],
-                ], 422);
-            }
+        $s3Storages = $this->requestedBackupS3Storages($request, $teamId);
+        if ($s3Storages instanceof JsonResponse) {
+            return $s3Storages;
         }
 
         $backupConfig = ScheduledDatabaseBackup::ownedByCurrentTeamAPI($teamId)->where('database_id', $database->id)
@@ -1324,6 +1389,14 @@ class DatabasesController extends Controller
             return response()->json(['message' => 'Backup config not found.'], 404);
         }
 
+        $saveToS3 = $request->has('save_s3') ? $request->boolean('save_s3') : (bool) $backupConfig->save_s3;
+        if (($request->boolean('save_s3') && $s3Storages === null) || ($saveToS3 && $s3Storages?->isEmpty())) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['s3_storage_uuid' => ['The s3_storage_uuid or s3_storage_uuids field is required when save_s3 is true.']],
+            ], 422);
+        }
+
         $extraFields = array_diff(array_keys($request->all()), $backupConfigFields, ['backup_now']);
         if (! empty($extraFields)) {
             $errors = $validator->errors();
@@ -1337,20 +1410,9 @@ class DatabasesController extends Controller
             ], 422);
         }
 
-        $backupData = $request->only($backupConfigFields);
-
-        // Convert s3_storage_uuid to s3_storage_id
-        if (isset($backupData['s3_storage_uuid'])) {
-            $s3Storage = S3Storage::ownedByCurrentTeamAPI($teamId)->where('uuid', $backupData['s3_storage_uuid'])->first();
-            if ($s3Storage) {
-                $backupData['s3_storage_id'] = $s3Storage->id;
-            } elseif ($request->boolean('save_s3')) {
-                return response()->json([
-                    'message' => 'Validation failed.',
-                    'errors' => ['s3_storage_uuid' => ['The selected S3 storage is invalid for this team.']],
-                ], 422);
-            }
-            unset($backupData['s3_storage_uuid']);
+        $backupData = Arr::except($request->only($backupConfigFields), ['s3_storage_uuid', 's3_storage_uuids']);
+        if ($s3Storages !== null) {
+            $backupData['s3_storage_id'] = $s3Storages->first()?->id;
         }
 
         // Validate databases_to_backup input
@@ -1365,7 +1427,19 @@ class DatabasesController extends Controller
             }
         }
 
+        $storageIds = $s3Storages?->pluck('id');
+        // An older client sends only s3_storage_uuid. When it is already a destination, the other destinations stay.
+        if ($storageIds !== null && ! $request->has('s3_storage_uuids')) {
+            $currentStorageIds = $backupConfig->selectedS3Storages()->pluck('id');
+            if ($currentStorageIds->contains($storageIds->first())) {
+                $storageIds = $currentStorageIds;
+            }
+        }
+
         $backupConfig->update($backupData);
+        if ($storageIds !== null) {
+            $backupConfig->syncS3Storages($storageIds->all());
+        }
 
         if ($request->backup_now) {
             dispatch(new DatabaseBackupJob($backupConfig));
@@ -2803,7 +2877,10 @@ class DatabasesController extends Controller
 
         $lines = normalizeLogLines($request->query('lines'));
         $showTimestamps = parseLogTimestampFlag($request->query('show_timestamps'));
-        $logs = getContainerLogs($database->destination->server, $container['ID'], $lines, $showTimestamps);
+        $logs = sanitizeLogsForExport(
+            getContainerLogs($database->destination->server, $container['ID'], $lines, $showTimestamps),
+            EnvironmentVariable::logRedactionSecretsFor($database),
+        );
 
         return response()->json([
             'logs' => $logs,
@@ -3004,9 +3081,10 @@ class DatabasesController extends Controller
                 if ($execution->filename) {
                     deleteBackupsLocally($execution->filename, $database->destination->server);
 
-                    if ($deleteS3 && $backup->s3) {
-                        deleteBackupsS3($execution->filename, $backup->s3);
-                    }
+                }
+
+                if ($deleteS3) {
+                    $execution->deleteS3Copies();
                 }
 
                 $execution->delete();
@@ -3139,9 +3217,10 @@ class DatabasesController extends Controller
             if ($execution->filename) {
                 deleteBackupsLocally($execution->filename, $database->destination->server);
 
-                if ($deleteS3 && $backup->s3) {
-                    deleteBackupsS3($execution->filename, $backup->s3);
-                }
+            }
+
+            if ($deleteS3) {
+                $execution->deleteS3Copies();
             }
 
             $execution->delete();
@@ -3164,7 +3243,7 @@ class DatabasesController extends Controller
 
     #[OA\Get(
         summary: 'List backup executions',
-        description: 'Get all executions for a specific backup configuration.',
+        description: 'Get all executions for a specific backup configuration. The execution `message` is only returned (redacted) to tokens with the `read:sensitive` or `root` ability; otherwise it is `null`.',
         path: '/databases/{uuid}/backups/{scheduled_backup_uuid}/executions',
         operationId: 'list-backup-executions',
         security: [
@@ -3204,7 +3283,7 @@ class DatabasesController extends Controller
                                     new OA\Property(property: 'filename', type: 'string'),
                                     new OA\Property(property: 'size', type: 'integer'),
                                     new OA\Property(property: 'created_at', type: 'string'),
-                                    new OA\Property(property: 'message', type: 'string'),
+                                    new OA\Property(property: 'message', type: 'string', nullable: true, description: 'Redacted execution output. Null unless the token has the `read:sensitive` or `root` ability.'),
                                     new OA\Property(property: 'status', type: 'string'),
                                 ]
                             )
@@ -3245,10 +3324,13 @@ class DatabasesController extends Controller
         }
 
         // Get all executions for this backup configuration
+        $messageSecrets = [];
         $executions = $backup->executions()
             ->orderBy('created_at', 'desc')
             ->get()
-            ->map(function ($execution) {
+            ->map(function ($execution) use ($database, &$messageSecrets) {
+                $this->redactBackupExecutionMessage($execution, $database, $messageSecrets);
+
                 return [
                     'uuid' => $execution->uuid,
                     'filename' => $execution->filename,
@@ -5273,7 +5355,7 @@ class DatabasesController extends Controller
         }
 
         foreach ($database->scheduledBackups()->get() as $backup) {
-            $backup->replicate([
+            $newBackup = $backup->replicate([
                 'id',
                 'created_at',
                 'updated_at',
@@ -5283,7 +5365,9 @@ class DatabasesController extends Controller
                 'database_id' => $newDatabase->id,
                 'database_type' => $newDatabase->getMorphClass(),
                 'team_id' => $teamId,
-            ])->save();
+            ]);
+            $newBackup->save();
+            $backup->copyS3StoragesTo($newBackup);
         }
 
         foreach ($database->environment_variables()->get() as $environmentVariable) {
@@ -5311,4 +5395,34 @@ class DatabasesController extends Controller
             'message' => 'Database cloned.',
         ], 201);
     }
+
+    /**
+     * Execution output can embed credentials: hide it unless the token can read sensitive data, and redact it when shown.
+     * The database secrets are loaded once per database and kept in $secretsByDatabase for the rest of the request.
+     *
+     * @param  array<string, array{known: array<int, string>, locked: array<int, string>}|null>  $secretsByDatabase
+     */
+    private function redactBackupExecutionMessage(ScheduledDatabaseBackupExecution $execution, ?Model $database, array &$secretsByDatabase): void
+    {
+        $message = $execution->message;
+        if (request()->attributes->get('can_read_sensitive', false) !== true || ! is_string($message) || ! $database) {
+            $execution->setAttribute('message', null);
+
+            return;
+        }
+
+        $key = $database->getMorphClass().':'.$database->getKey();
+        if (! array_key_exists($key, $secretsByDatabase)) {
+            try {
+                // Use a copy so the relations loaded for redaction do not end up in the response.
+                $secretsByDatabase[$key] = EnvironmentVariable::logRedactionSecretsFor(clone $database);
+            } catch (\Throwable $e) {
+                report($e);
+                $secretsByDatabase[$key] = null;
+            }
+        }
+
+        // Without the database secrets the message cannot be redacted reliably, so hide it.
+        $execution->setAttribute('message', $secretsByDatabase[$key] === null ? null : sanitizeLogsForExport($message, $secretsByDatabase[$key]));
+    }
 }
diff --git a/app/Http/Controllers/Api/EnvironmentCanvasController.php b/app/Http/Controllers/Api/EnvironmentCanvasController.php
new file mode 100644
index 0000000000..338cbfee51
--- /dev/null
+++ b/app/Http/Controllers/Api/EnvironmentCanvasController.php
@@ -0,0 +1,264 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Services\EnvironmentCanvas;
+use Illuminate\Contracts\Validation\Validator as ValidatorContract;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Validator;
+
+/**
+ * Environment canvas: a view of one environment's resources with saved card positions and visual-only links.
+ */
+class EnvironmentCanvasController extends Controller
+{
+    private const MAX_POSITIONS = 1000;
+
+    public function __construct(private EnvironmentCanvas $canvas) {}
+
+    public function show(Request $request): JsonResponse
+    {
+        $environment = $this->findEnvironment($request);
+        if ($environment instanceof JsonResponse) {
+            return $environment;
+        }
+        $this->authorize('view', $environment);
+
+        $user = $request->user();
+        $token = $user->currentAccessToken();
+        $canEdit = $user->isAdminOfTeam((int) $environment->project->team_id)
+            && ($token->can('root') || $token->can('write'));
+
+        return response()->json($this->canvas->payload(
+            $environment,
+            canReadSensitive: (bool) $request->attributes->get('can_read_sensitive', false),
+            canEdit: $canEdit,
+        ));
+    }
+
+    public function updatePositions(Request $request): JsonResponse
+    {
+        $environment = $this->findEnvironment($request);
+        if ($environment instanceof JsonResponse) {
+            return $environment;
+        }
+        $this->authorize('update', $environment);
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+        $validator = Validator::make($request->all(), [
+            'positions' => ['present', 'array', 'max:'.self::MAX_POSITIONS],
+        ]);
+        if ($response = $this->validationFailedResponse($request, $validator, ['positions'])) {
+            return $response;
+        }
+
+        $nodeUuids = $this->canvas->resourceIndex($environment)->keys()->all();
+        $positions = collect($request->input('positions'))->only($nodeUuids)->all();
+
+        $coordinateRule = ['required', 'integer', 'between:-'.EnvironmentCanvas::MAX_COORDINATE.','.EnvironmentCanvas::MAX_COORDINATE];
+        $validator = Validator::make(['positions' => $positions], [
+            'positions.*' => ['required', 'array'],
+            'positions.*.x' => $coordinateRule,
+            'positions.*.y' => $coordinateRule,
+        ]);
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $saved = DB::transaction(function () use ($environment, $positions, $nodeUuids) {
+            $locked = Environment::query()->lockForUpdate()->findOrFail($environment->id);
+            $merged = $this->canvas->filterPositions(
+                array_merge($locked->canvas_positions ?? [], $positions),
+                $nodeUuids,
+            );
+            $locked->canvas_positions = $merged;
+            $locked->save();
+
+            return $merged;
+        });
+
+        return response()->json(['positions' => (object) $saved]);
+    }
+
+    public function storeLink(Request $request): JsonResponse
+    {
+        $environment = $this->findEnvironment($request);
+        if ($environment instanceof JsonResponse) {
+            return $environment;
+        }
+        $this->authorize('update', $environment);
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+        $validator = Validator::make($request->all(), [
+            'source' => ['required', 'string', 'max:255'],
+            'target' => ['required', 'string', 'max:255', 'different:source'],
+            'label' => ['nullable', 'string', 'max:64'],
+        ]);
+        if ($response = $this->validationFailedResponse($request, $validator, ['source', 'target', 'label'])) {
+            return $response;
+        }
+
+        $resources = $this->canvas->resourceIndex($environment);
+        $source = $resources->get($request->input('source'));
+        $target = $resources->get($request->input('target'));
+        $errors = [];
+        if (! $source) {
+            $errors['source'] = ['The source must be a resource of this environment.'];
+        }
+        if (! $target) {
+            $errors['target'] = ['The target must be a resource of this environment.'];
+        }
+        if ($errors !== []) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+        }
+
+        $attributes = [
+            'environment_id' => $environment->id,
+            'source_type' => $source['type'],
+            'source_id' => $source['id'],
+            'target_type' => $target['type'],
+            'target_id' => $target['id'],
+        ];
+        $duplicate = ['message' => 'Validation failed.', 'errors' => ['target' => ['These resources are already linked.']]];
+        if (ResourceLink::query()->where($attributes)->exists()) {
+            return response()->json($duplicate, 422);
+        }
+
+        try {
+            $link = ResourceLink::create($attributes + [
+                'label' => $this->normalizeLabel($request->input('label')),
+                'created_by' => $request->user()->id,
+            ]);
+        } catch (UniqueConstraintViolationException) {
+            return response()->json($duplicate, 422);
+        }
+
+        return response()->json(
+            $this->canvas->linkPayload($link, $request->input('source'), $request->input('target')),
+            201,
+        );
+    }
+
+    public function updateLink(Request $request): JsonResponse
+    {
+        $environment = $this->findEnvironment($request);
+        if ($environment instanceof JsonResponse) {
+            return $environment;
+        }
+        $this->authorize('update', $environment);
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+        $validator = Validator::make($request->all(), [
+            'label' => ['present', 'nullable', 'string', 'max:64'],
+        ]);
+        if ($response = $this->validationFailedResponse($request, $validator, ['label'])) {
+            return $response;
+        }
+
+        $link = $environment->resourceLinks()->whereUuid($request->route('link_uuid'))->first();
+        if (! $link) {
+            return response()->json(['message' => 'Link not found.'], 404);
+        }
+        $resources = $this->canvas->resourceIndex($environment);
+        $uuidOf = fn (string $type, int $id) => $resources->search(fn (array $resource) => $resource['type'] === $type && $resource['id'] === $id);
+        $sourceUuid = $uuidOf($link->source_type, (int) $link->source_id);
+        $targetUuid = $uuidOf($link->target_type, (int) $link->target_id);
+        if ($sourceUuid === false || $targetUuid === false) {
+            return response()->json(['message' => 'Link not found.'], 404);
+        }
+
+        $link->update(['label' => $this->normalizeLabel($request->input('label'))]);
+
+        return response()->json($this->canvas->linkPayload($link, $sourceUuid, $targetUuid));
+    }
+
+    public function destroyLink(Request $request): JsonResponse
+    {
+        $environment = $this->findEnvironment($request);
+        if ($environment instanceof JsonResponse) {
+            return $environment;
+        }
+        $this->authorize('update', $environment);
+
+        $link = $environment->resourceLinks()->whereUuid($request->route('link_uuid'))->first();
+        if (! $link) {
+            return response()->json(['message' => 'Link not found.'], 404);
+        }
+        $link->delete();
+
+        return response()->json(['message' => 'Link deleted.']);
+    }
+
+    /**
+     * The environment of the request, within a project of the token's team.
+     */
+    private function findEnvironment(Request $request): Environment|JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $project = Project::whereTeamId($teamId)->whereUuid($request->route('uuid'))->first();
+        if (! $project) {
+            return response()->json(['message' => 'Project not found.'], 404);
+        }
+
+        $environmentNameOrUuid = $request->route('environment_name_or_uuid');
+        $environment = $project->environments()->whereName($environmentNameOrUuid)->first()
+            ?? $project->environments()->whereUuid($environmentNameOrUuid)->first();
+        if (! $environment) {
+            return response()->json(['message' => 'Environment not found.'], 404);
+        }
+        $environment->setRelation('project', $project);
+
+        return $environment;
+    }
+
+    /**
+     * @param  array<int, string>  $allowedFields
+     */
+    private function validationFailedResponse(Request $request, ValidatorContract $validator, array $allowedFields): ?JsonResponse
+    {
+        $extraFields = array_diff(array_keys($request->all()), $allowedFields);
+        if (! $validator->fails() && empty($extraFields)) {
+            return null;
+        }
+
+        $errors = $validator->errors();
+        foreach ($extraFields as $field) {
+            $errors->add($field, 'This field is not allowed.');
+        }
+
+        return response()->json([
+            'message' => 'Validation failed.',
+            'errors' => $errors,
+        ], 422);
+    }
+
+    private function normalizeLabel(mixed $label): ?string
+    {
+        $label = trim((string) $label);
+
+        return $label === '' ? null : $label;
+    }
+}
diff --git a/app/Http/Controllers/Api/HostingerController.php b/app/Http/Controllers/Api/HostingerController.php
new file mode 100644
index 0000000000..34eb2e94bf
--- /dev/null
+++ b/app/Http/Controllers/Api/HostingerController.php
@@ -0,0 +1,376 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Actions\Server\ValidateServer;
+use App\Enums\ProxyTypes;
+use App\Exceptions\RateLimitException;
+use App\Http\Controllers\Api\Concerns\RequiresDeployAbility;
+use App\Http\Controllers\Controller;
+use App\Models\CloudProviderToken;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Rules\ValidHostname;
+use App\Services\HostingerService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use OpenApi\Attributes as OA;
+
+class HostingerController extends Controller
+{
+    use RequiresDeployAbility;
+
+    #[OA\Get(
+        path: '/hostinger/data-centers',
+        operationId: 'get-hostinger-data-centers',
+        summary: 'Get Hostinger VPS data centers',
+        security: [['bearerAuth' => []]],
+        tags: ['Hostinger'],
+        responses: [
+            new OA\Response(response: 200, description: 'List of Hostinger VPS data centers.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Hostinger denied access to this resource for the cloud provider token.'),
+            new OA\Response(response: 422, description: 'Validation failed.'),
+            new OA\Response(response: 429, description: 'Hostinger rate limit exceeded.'),
+        ]
+    )]
+    public function dataCenters(Request $request): JsonResponse
+    {
+        return $this->providerData($request, 'getDataCenters', 'data centers');
+    }
+
+    #[OA\Get(
+        path: '/hostinger/catalog',
+        operationId: 'get-hostinger-catalog',
+        summary: 'Get Hostinger VPS plans and prices',
+        security: [['bearerAuth' => []]],
+        tags: ['Hostinger'],
+        responses: [
+            new OA\Response(response: 200, description: 'List of Hostinger VPS plans and prices.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Hostinger denied access to this resource for the cloud provider token.'),
+            new OA\Response(response: 422, description: 'Validation failed.'),
+            new OA\Response(response: 429, description: 'Hostinger rate limit exceeded.'),
+        ]
+    )]
+    public function catalog(Request $request): JsonResponse
+    {
+        return $this->providerData($request, 'getCatalogItems', 'catalog');
+    }
+
+    #[OA\Get(
+        path: '/hostinger/templates',
+        operationId: 'get-hostinger-templates',
+        summary: 'Get Hostinger VPS operating system templates',
+        security: [['bearerAuth' => []]],
+        tags: ['Hostinger'],
+        responses: [
+            new OA\Response(response: 200, description: 'List of Hostinger VPS templates.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Hostinger denied access to this resource for the cloud provider token.'),
+            new OA\Response(response: 422, description: 'Validation failed.'),
+            new OA\Response(response: 429, description: 'Hostinger rate limit exceeded.'),
+        ]
+    )]
+    public function templates(Request $request): JsonResponse
+    {
+        return $this->providerData($request, 'getTemplates', 'templates');
+    }
+
+    #[OA\Get(
+        path: '/hostinger/ssh-keys',
+        operationId: 'get-hostinger-ssh-keys',
+        summary: 'Get Hostinger account SSH keys',
+        security: [['bearerAuth' => []]],
+        tags: ['Hostinger'],
+        responses: [
+            new OA\Response(response: 200, description: 'List of Hostinger account SSH keys.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Hostinger denied access to this resource for the cloud provider token.'),
+            new OA\Response(response: 422, description: 'Validation failed.'),
+            new OA\Response(response: 429, description: 'Hostinger rate limit exceeded.'),
+        ]
+    )]
+    public function sshKeys(Request $request): JsonResponse
+    {
+        return $this->providerData($request, 'getPublicKeys', 'SSH keys');
+    }
+
+    #[OA\Get(
+        path: '/hostinger/post-install-scripts',
+        operationId: 'get-hostinger-post-install-scripts',
+        summary: 'Get Hostinger post-install scripts',
+        security: [['bearerAuth' => []]],
+        tags: ['Hostinger'],
+        responses: [
+            new OA\Response(response: 200, description: 'List of Hostinger post-install scripts.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Hostinger denied access to this resource for the cloud provider token.'),
+            new OA\Response(response: 422, description: 'Validation failed.'),
+            new OA\Response(response: 429, description: 'Hostinger rate limit exceeded.'),
+        ]
+    )]
+    public function postInstallScripts(Request $request): JsonResponse
+    {
+        return $this->providerData($request, 'getPostInstallScripts', 'post-install scripts');
+    }
+
+    #[OA\Post(
+        path: '/servers/hostinger',
+        operationId: 'create-hostinger-server',
+        summary: 'Purchase a Hostinger VPS and create a linked server',
+        security: [['bearerAuth' => []]],
+        tags: ['Hostinger'],
+        responses: [
+            new OA\Response(response: 201, description: 'Hostinger VPS purchased and linked to a Coolify server.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'The token needs the deploy permission for a post-install script or extra SSH keys.'),
+            new OA\Response(response: 422, description: 'Validation failed.'),
+            new OA\Response(response: 429, description: 'Hostinger rate limit exceeded.'),
+        ]
+    )]
+    public function createServer(Request $request): JsonResponse
+    {
+        $allowedFields = [
+            'cloud_provider_token_uuid',
+            'cloud_provider_token_id',
+            'item_id',
+            'data_center_id',
+            'template_id',
+            'name',
+            'private_key_uuid',
+            'enable_backups',
+            'public_key_ids',
+            'post_install_script_id',
+            'instant_validate',
+        ];
+        $teamId = getTeamIdFromToken();
+
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $this->authorize('create', [Server::class]);
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $validator = customApiValidator($request->all(), [
+            'cloud_provider_token_uuid' => 'required_without:cloud_provider_token_id|string',
+            'cloud_provider_token_id' => 'required_without:cloud_provider_token_uuid|string',
+            'item_id' => 'required|string',
+            'data_center_id' => 'required|integer',
+            'template_id' => 'required|integer',
+            'name' => ['nullable', 'string', 'max:253', new ValidHostname],
+            'private_key_uuid' => 'required|string',
+            'enable_backups' => 'nullable|boolean',
+            'public_key_ids' => 'nullable|array',
+            'public_key_ids.*' => 'integer',
+            'post_install_script_id' => 'nullable|integer',
+            'instant_validate' => 'nullable|boolean',
+        ]);
+        $extraFields = array_diff(array_keys($request->all()), $allowedFields);
+
+        if ($validator->fails() || ! empty($extraFields)) {
+            $errors = $validator->errors();
+            foreach ($extraFields as $field) {
+                $errors->add($field, 'This field is not allowed.');
+            }
+
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $errors,
+            ], 422);
+        }
+
+        if ($request->filled('post_install_script_id') || $request->array('public_key_ids')) {
+            $forbidden = $this->deployAbilityForbiddenResponse($request, 'A post-install script or extra SSH keys run as root on the new server, so it needs a token with the deploy permission.');
+            if ($forbidden) {
+                return $forbidden;
+            }
+        }
+
+        $team = Team::find($teamId);
+        if (Team::serverLimitReached($team)) {
+            return response()->json(['message' => 'Server limit reached for your subscription.'], 400);
+        }
+
+        $token = $this->hostingerToken($request, $teamId);
+        if ($token instanceof JsonResponse) {
+            return $token;
+        }
+
+        $privateKey = PrivateKey::whereTeamId($teamId)->whereUuid($request->private_key_uuid)->first();
+        if (! $privateKey) {
+            return response()->json(['message' => 'Private key not found.'], 404);
+        }
+
+        $virtualMachineId = null;
+
+        try {
+            $hostingerService = new HostingerService($token->token);
+            $normalizedServerName = strtolower(trim($request->name ?: generate_random_name()));
+            $setup = [
+                'data_center_id' => $request->integer('data_center_id'),
+                'template_id' => $request->integer('template_id'),
+                'hostname' => $normalizedServerName,
+                'enable_backups' => $request->boolean('enable_backups'),
+                'public_key' => [
+                    'name' => $privateKey->name,
+                    'key' => $privateKey->getPublicKey(),
+                ],
+            ];
+            if ($request->filled('post_install_script_id')) {
+                $setup['post_install_script_id'] = $request->integer('post_install_script_id');
+            }
+
+            $virtualMachine = $hostingerService->purchaseVirtualMachine([
+                'item_id' => $request->item_id,
+                'setup' => $setup,
+            ]);
+            $virtualMachineId = (int) $virtualMachine['id'];
+
+            $server = Server::create([
+                'name' => $normalizedServerName,
+                'ip' => Server::PLACEHOLDER_IP,
+                'user' => 'root',
+                'port' => 22,
+                'team_id' => $teamId,
+                'private_key_id' => $privateKey->id,
+                'cloud_provider_token_id' => $token->id,
+                'hostinger_virtual_machine_id' => $virtualMachine['id'],
+                'hostinger_virtual_machine_status' => $virtualMachine['state'] ?? null,
+            ]);
+
+            $server->proxy->set('status', 'exited');
+            $server->proxy->set('type', ProxyTypes::TRAEFIK->value);
+            $server->save();
+
+            try {
+                if ($request->array('public_key_ids')) {
+                    $hostingerService->attachPublicKeys((int) $virtualMachine['id'], $request->array('public_key_ids'));
+                }
+                $virtualMachine = $hostingerService->waitForPublicIp($virtualMachine);
+                $ipAddress = $hostingerService->getPublicIpAddress($virtualMachine);
+                if ($ipAddress) {
+                    $server->update([
+                        'ip' => $ipAddress,
+                        'hostinger_virtual_machine_status' => $virtualMachine['state'] ?? $server->hostinger_virtual_machine_status,
+                    ]);
+                }
+            } catch (\Throwable $e) {
+                report($e);
+            }
+
+            $ipAddress = $server->fresh()->ip;
+
+            if ($request->boolean('instant_validate') && ! $server->hasPlaceholderIp()) {
+                ValidateServer::dispatch($server);
+            }
+
+            auditLog('api.hostinger_virtual_machine.created', [
+                'team_id' => $teamId,
+                'server_uuid' => $server->uuid,
+                'server_name' => $server->name,
+                'hostinger_virtual_machine_id' => $virtualMachine['id'],
+                'ip' => $ipAddress,
+            ]);
+
+            return response()->json([
+                'uuid' => $server->uuid,
+                'hostinger_virtual_machine_id' => $virtualMachine['id'],
+                'ip' => $ipAddress,
+                'provisioning' => $ipAddress === Server::PLACEHOLDER_IP,
+            ])->setStatusCode(201);
+        } catch (RateLimitException $e) {
+            return $this->rateLimitResponse($e);
+        } catch (\Throwable $e) {
+            logger()->error('Failed to create Hostinger server', [
+                'error' => $e->getMessage(),
+                'team_id' => $teamId,
+                'hostinger_virtual_machine_id' => $virtualMachineId,
+            ]);
+
+            if ($e->getCode() === 202) {
+                return response()->json(['message' => $e->getMessage()], 202);
+            }
+
+            return response()->json(array_filter([
+                'message' => $virtualMachineId
+                    ? 'The Hostinger VPS was purchased but could not be saved in Coolify. Manage it in hPanel.'
+                    : 'Failed to create Hostinger server.',
+                'hostinger_virtual_machine_id' => $virtualMachineId,
+            ]), 500);
+        }
+    }
+
+    private function providerData(Request $request, string $method, string $resource): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $token = $this->hostingerToken($request, $teamId);
+        if ($token instanceof JsonResponse) {
+            return $token;
+        }
+
+        try {
+            return response()->json((new HostingerService($token->token))->{$method}());
+        } catch (RateLimitException $e) {
+            return $this->rateLimitResponse($e);
+        } catch (\Throwable $e) {
+            $hostingerErrorPrefix = 'Hostinger API error: ';
+            if (in_array($e->getCode(), [401, 403], true) && str_starts_with($e->getMessage(), $hostingerErrorPrefix)) {
+                $hostingerMessage = substr($e->getMessage(), strlen($hostingerErrorPrefix));
+
+                return response()->json(['message' => "Hostinger denied access to {$resource}: {$hostingerMessage}"], 403);
+            }
+
+            return response()->json(['message' => "Failed to fetch Hostinger {$resource}."], 500);
+        }
+    }
+
+    private function rateLimitResponse(RateLimitException $e): JsonResponse
+    {
+        $response = response()->json(['message' => $e->getMessage()], 429);
+        if ($e->retryAfter !== null) {
+            $response->header('Retry-After', $e->retryAfter);
+        }
+
+        return $response;
+    }
+
+    private function hostingerToken(Request $request, int $teamId): CloudProviderToken|JsonResponse
+    {
+        $validator = customApiValidator($request->all(), [
+            'cloud_provider_token_uuid' => 'required_without:cloud_provider_token_id|string',
+            'cloud_provider_token_id' => 'required_without:cloud_provider_token_uuid|string',
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $tokenUuid = $request->cloud_provider_token_uuid ?? $request->cloud_provider_token_id;
+        $token = CloudProviderToken::whereTeamId($teamId)
+            ->whereUuid($tokenUuid)
+            ->where('provider', 'hostinger')
+            ->first();
+
+        if (! $token) {
+            return response()->json(['message' => 'Hostinger cloud provider token not found.'], 404);
+        }
+
+        $this->authorize('view', $token);
+
+        return $token;
+    }
+}
diff --git a/app/Http/Controllers/Api/NotificationsController.php b/app/Http/Controllers/Api/NotificationsController.php
index 1cca69a663..fe38dbd1d5 100644
--- a/app/Http/Controllers/Api/NotificationsController.php
+++ b/app/Http/Controllers/Api/NotificationsController.php
@@ -45,6 +45,7 @@ class NotificationsController extends Controller
                     'use_instance_email_settings' => 'sometimes|boolean',
                     'deployment_success_email_notifications' => 'sometimes|boolean',
                     'deployment_failure_email_notifications' => 'sometimes|boolean',
+                    'deployment_commit_details_email_notifications' => 'sometimes|boolean',
                     'status_change_email_notifications' => 'sometimes|boolean',
                     'restart_limit_reached_email_notifications' => 'sometimes|boolean',
                     'backup_success_email_notifications' => 'sometimes|boolean',
diff --git a/app/Http/Controllers/Api/OtherController.php b/app/Http/Controllers/Api/OtherController.php
index 8fa3125aec..8e36629921 100644
--- a/app/Http/Controllers/Api/OtherController.php
+++ b/app/Http/Controllers/Api/OtherController.php
@@ -50,62 +50,6 @@ class OtherController extends Controller
         return response(config('constants.coolify.version'));
     }
 
-    #[OA\Post(
-        summary: 'Enable API',
-        description: 'Enable API (only with root permissions).',
-        path: '/enable',
-        operationId: 'enable-api',
-        security: [
-            ['bearerAuth' => []],
-        ],
-        responses: [
-            new OA\Response(
-                response: 200,
-                description: 'Enable API.',
-                content: new OA\JsonContent(
-                    type: 'object',
-                    properties: [
-                        new OA\Property(property: 'message', type: 'string', example: 'API enabled.'),
-                    ]
-                )),
-            new OA\Response(
-                response: 403,
-                description: 'You are not allowed to enable the API.',
-                content: new OA\JsonContent(
-                    type: 'object',
-                    properties: [
-                        new OA\Property(property: 'message', type: 'string', example: 'You are not allowed to enable the API.'),
-                    ]
-                )),
-            new OA\Response(
-                response: 401,
-                ref: '#/components/responses/401',
-            ),
-            new OA\Response(
-                response: 400,
-                ref: '#/components/responses/400',
-            ),
-        ]
-    )]
-    public function enable_api(Request $request)
-    {
-        $teamId = getTeamIdFromToken();
-        if (is_null($teamId)) {
-            return invalidTokenResponse();
-        }
-        if ($teamId !== '0') {
-            auditLog('api.instance.enable_denied', ['team_id' => $teamId], 'warning');
-
-            return response()->json(['message' => 'You are not allowed to enable the API.'], 403);
-        }
-        $settings = instanceSettings();
-        $settings->update(['is_api_enabled' => true]);
-
-        auditLog('api.instance.enabled', ['team_id' => $teamId]);
-
-        return response()->json(['message' => 'API enabled.'], 200);
-    }
-
     #[OA\Post(
         summary: 'Disable API',
         description: 'Disable API (only with root permissions).',
diff --git a/app/Http/Controllers/Api/ProjectCanvasController.php b/app/Http/Controllers/Api/ProjectCanvasController.php
new file mode 100644
index 0000000000..534cd7f56a
--- /dev/null
+++ b/app/Http/Controllers/Api/ProjectCanvasController.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Project;
+use App\Services\ProjectCanvas;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * Project canvas: the resources of every environment of one project (or of every project).
+ * Moves and links are saved through EnvironmentCanvasController. Called by resources/js/environment-canvas.js through the /canvas/api session bridge.
+ */
+class ProjectCanvasController extends Controller
+{
+    public function __construct(private ProjectCanvas $canvas) {}
+
+    public function index(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        return response()->json($this->canvas->teamPayload((int) $teamId, (bool) $request->attributes->get('can_read_sensitive', false), $this->canEdit($request, (int) $teamId)));
+    }
+
+    public function show(Request $request, string $uuid): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $project = Project::query()->whereTeamId($teamId)->whereUuid($uuid)->first();
+        if (! $project) {
+            return response()->json(['message' => 'Project not found.'], 404);
+        }
+        $this->authorize('view', $project);
+
+        return response()->json($this->canvas->payload($project, (bool) $request->attributes->get('can_read_sensitive', false), $this->canEdit($request, (int) $project->team_id)));
+    }
+
+    /**
+     * Same rule as the environment canvas: team admins with a write token move cards and draw links.
+     */
+    private function canEdit(Request $request, int $teamId): bool
+    {
+        $user = $request->user();
+        $token = $user->currentAccessToken();
+
+        return $user->isAdminOfTeam($teamId) && ($token->can('root') || $token->can('write'));
+    }
+}
diff --git a/app/Http/Controllers/Api/SecurityController.php b/app/Http/Controllers/Api/SecurityController.php
index f5b0b0366b..9df897caa3 100644
--- a/app/Http/Controllers/Api/SecurityController.php
+++ b/app/Http/Controllers/Api/SecurityController.php
@@ -269,7 +269,6 @@ class SecurityController extends Controller
                     mediaType: 'application/json',
                     schema: new OA\Schema(
                         type: 'object',
-                        required: ['private_key'],
                         properties: [
                             'name' => ['type' => 'string'],
                             'description' => ['type' => 'string'],
@@ -328,7 +327,7 @@ class SecurityController extends Controller
         $validator = customApiValidator($request->all(), [
             'name' => 'string|max:255',
             'description' => 'string|max:255',
-            'private_key' => 'required|string',
+            'private_key' => 'string',
         ]);
 
         $extraFields = array_diff(array_keys($request->all()), $allowedFields);
diff --git a/app/Http/Controllers/Api/ServerCanvasController.php b/app/Http/Controllers/Api/ServerCanvasController.php
new file mode 100644
index 0000000000..79c33553ad
--- /dev/null
+++ b/app/Http/Controllers/Api/ServerCanvasController.php
@@ -0,0 +1,117 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Server;
+use App\Services\ServerCanvas;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * Server canvas: every server of the team (or one server) with the resources on it.
+ * Moves and links are saved through EnvironmentCanvasController. Called by resources/js/environment-canvas.js through the /canvas/api session bridge.
+ */
+class ServerCanvasController extends Controller
+{
+    public function __construct(private ServerCanvas $canvas) {}
+
+    public function index(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $this->authorize('viewAny', Server::class);
+
+        $servers = Server::query()->whereTeamId($teamId)->with('settings')->orderBy('name')->get();
+
+        return response()->json($this->canvas->payload($teamId, $servers, null, $this->canReadSensitive($request), $this->canEdit($request, $teamId)));
+    }
+
+    /**
+     * Dashboard canvas: every server of the team with its resources and their running or queued deployments.
+     */
+    public function dashboard(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $this->authorize('viewAny', Server::class);
+
+        $servers = Server::query()->whereTeamId($teamId)->with('settings')->orderBy('name')->get();
+
+        return response()->json($this->canvas->dashboardPayload($teamId, $servers, $this->canReadSensitive($request), $this->canEdit($request, $teamId)));
+    }
+
+    public function show(Request $request, string $uuid): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $server = Server::query()->whereTeamId($teamId)->whereUuid($uuid)->with('settings')->first();
+        if (! $server) {
+            return response()->json(['message' => 'Server not found.'], 404);
+        }
+        $this->authorize('view', $server);
+
+        return response()->json($this->canvas->payload($teamId, collect([$server]), $server, $this->canReadSensitive($request), $this->canEdit($request, $teamId)));
+    }
+
+    /**
+     * Same rule as the environment canvas: team admins with a write token move cards and draw links.
+     */
+    private function canEdit(Request $request, int $teamId): bool
+    {
+        $user = $request->user();
+        $token = $user->currentAccessToken();
+
+        return $user->isAdminOfTeam($teamId) && ($token->can('root') || $token->can('write'));
+    }
+
+    /**
+     * Unmanaged Docker containers of one server, as read-only cards for its canvas.
+     */
+    public function containers(string $uuid): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $server = Server::query()->whereTeamId($teamId)->whereUuid($uuid)->with('settings')->first();
+        if (! $server) {
+            return response()->json(['message' => 'Server not found.'], 404);
+        }
+        $this->authorize('view', $server);
+
+        return response()->json(['nodes' => $this->canvas->unmanagedContainerNodes($server)->all()]);
+    }
+
+    /**
+     * Latest CPU, memory and disk usage of one server for its zone header on the canvas.
+     */
+    public function usage(string $uuid): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $server = Server::query()->whereTeamId($teamId)->whereUuid($uuid)->with('settings')->first();
+        if (! $server) {
+            return response()->json(['message' => 'Server not found.'], 404);
+        }
+        $this->authorize('view', $server);
+        if (! $server->settings->is_metrics_enabled) {
+            return response()->json(['cpu' => null, 'memory' => null, 'disk' => null]);
+        }
+
+        return response()->json($this->canvas->usage($server));
+    }
+
+    private function canReadSensitive(Request $request): bool
+    {
+        return (bool) $request->attributes->get('can_read_sensitive', false);
+    }
+}
diff --git a/app/Http/Controllers/Api/ServerLogDrainsController.php b/app/Http/Controllers/Api/ServerLogDrainsController.php
index 8084070b82..af5aaa1dfd 100644
--- a/app/Http/Controllers/Api/ServerLogDrainsController.php
+++ b/app/Http/Controllers/Api/ServerLogDrainsController.php
@@ -23,6 +23,10 @@ class ServerLogDrainsController extends Controller
         'is_logdrain_custom_enabled',
         'logdrain_custom_config',
         'logdrain_custom_config_parser',
+        'is_logdrain_cloudwatch_enabled',
+        'logdrain_cloudwatch_region',
+        'logdrain_cloudwatch_group',
+        'logdrain_cloudwatch_stream_prefix',
     ];
 
     private function findServerForTeam(int $teamId, string $uuid): ?Server
@@ -44,6 +48,10 @@ class ServerLogDrainsController extends Controller
             'is_logdrain_axiom_enabled' => (bool) $settings->is_logdrain_axiom_enabled,
             'logdrain_axiom_dataset_name' => $settings->logdrain_axiom_dataset_name,
             'is_logdrain_custom_enabled' => (bool) $settings->is_logdrain_custom_enabled,
+            'is_logdrain_cloudwatch_enabled' => (bool) $settings->is_logdrain_cloudwatch_enabled,
+            'logdrain_cloudwatch_region' => $settings->logdrain_cloudwatch_region,
+            'logdrain_cloudwatch_group' => $settings->logdrain_cloudwatch_group,
+            'logdrain_cloudwatch_stream_prefix' => $settings->logdrain_cloudwatch_stream_prefix,
         ];
 
         if ($this->canReadSensitive()) {
@@ -81,6 +89,10 @@ class ServerLogDrainsController extends Controller
                         new OA\Property(property: 'is_logdrain_custom_enabled', type: 'boolean'),
                         new OA\Property(property: 'logdrain_custom_config', type: 'string', description: 'Only present with read:sensitive.'),
                         new OA\Property(property: 'logdrain_custom_config_parser', type: 'string', description: 'Only present with read:sensitive.'),
+                        new OA\Property(property: 'is_logdrain_cloudwatch_enabled', type: 'boolean'),
+                        new OA\Property(property: 'logdrain_cloudwatch_region', type: 'string', nullable: true),
+                        new OA\Property(property: 'logdrain_cloudwatch_group', type: 'string', nullable: true),
+                        new OA\Property(property: 'logdrain_cloudwatch_stream_prefix', type: 'string', nullable: true, description: 'Prepended to the container name to form the log stream name.'),
                     ],
                     type: 'object',
                 ),
@@ -130,6 +142,10 @@ class ServerLogDrainsController extends Controller
                     new OA\Property(property: 'is_logdrain_custom_enabled', type: 'boolean'),
                     new OA\Property(property: 'logdrain_custom_config', type: 'string'),
                     new OA\Property(property: 'logdrain_custom_config_parser', type: 'string'),
+                    new OA\Property(property: 'is_logdrain_cloudwatch_enabled', type: 'boolean'),
+                    new OA\Property(property: 'logdrain_cloudwatch_region', type: 'string', nullable: true),
+                    new OA\Property(property: 'logdrain_cloudwatch_group', type: 'string', nullable: true),
+                    new OA\Property(property: 'logdrain_cloudwatch_stream_prefix', type: 'string', nullable: true, description: 'Prepended to the container name to form the log stream name.'),
                 ],
                 type: 'object',
             ),
@@ -172,6 +188,10 @@ class ServerLogDrainsController extends Controller
             'is_logdrain_custom_enabled' => 'boolean',
             'logdrain_custom_config' => ['nullable', 'string', new ValidFluentBitConfig],
             'logdrain_custom_config_parser' => ['nullable', 'string', new ValidFluentBitConfig(parsersOnly: true)],
+            'is_logdrain_cloudwatch_enabled' => 'boolean',
+            'logdrain_cloudwatch_region' => ['nullable', 'string', 'max:64', 'regex:/^[a-z]{2}(-[a-z]+)+-\d+$/'],
+            'logdrain_cloudwatch_group' => ['nullable', 'string', 'regex:/^[\.\-_\/#A-Za-z0-9]{1,512}$/'],
+            'logdrain_cloudwatch_stream_prefix' => ['nullable', 'string', 'max:256', 'regex:/^[A-Za-z0-9_\-\.\/#]*$/'],
         ]);
 
         $extraFields = array_diff(array_keys($request->all()), self::ALLOWED_FIELDS);
@@ -229,6 +249,27 @@ class ServerLogDrainsController extends Controller
             ], 422);
         }
 
+        if ($settings->is_logdrain_cloudwatch_enabled) {
+            if ($settings->is_logdrain_newrelic_enabled || $settings->is_logdrain_axiom_enabled || $settings->is_logdrain_custom_enabled || $settings->is_logdrain_highlight_enabled) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => [
+                        'is_logdrain_cloudwatch_enabled' => ['Amazon CloudWatch Logs cannot be enabled together with another log drain.'],
+                    ],
+                ], 422);
+            }
+            $errors = [];
+            if (blank($settings->logdrain_cloudwatch_region)) {
+                $errors['logdrain_cloudwatch_region'] = ['The CloudWatch region is required when Amazon CloudWatch Logs is enabled.'];
+            }
+            if (blank($settings->logdrain_cloudwatch_group)) {
+                $errors['logdrain_cloudwatch_group'] = ['The CloudWatch log group is required when Amazon CloudWatch Logs is enabled.'];
+            }
+            if ($errors !== []) {
+                return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+            }
+        }
+
         $settings->save();
         $server->refresh();
 
diff --git a/app/Http/Controllers/Api/ServerTransferController.php b/app/Http/Controllers/Api/ServerTransferController.php
index cd68d39a1a..6179cb350a 100644
--- a/app/Http/Controllers/Api/ServerTransferController.php
+++ b/app/Http/Controllers/Api/ServerTransferController.php
@@ -3,10 +3,12 @@
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
 use App\Models\Server;
+use App\Rules\ValidServerIp;
 use App\Services\ServerTransfer\ServerTransferBundle;
 use App\Services\ServerTransfer\ServerTransferClaimer;
-use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferImporter;
 use App\Services\ServerTransfer\ServerTransferMigrator;
 use Illuminate\Http\JsonResponse;
@@ -18,17 +20,14 @@ use Throwable;
 class ServerTransferController extends Controller
 {
     public function __construct(
-        private ServerTransferExporter $exporter,
         private ServerTransferImporter $importer,
         private ServerTransferClaimer $claimer,
         private ServerTransferMigrator $migrator,
-    ) {
-        abort_unless(isDev(), 404);
-    }
+    ) {}
 
     #[OA\Post(
         summary: 'Migrate server to another Coolify instance',
-        description: 'One-shot handoff: export this server, import+claim on the target instance (using the provided token), then disable automations here. Requires read:sensitive and write.',
+        description: 'Start a transfer in the background: export this server, import and claim it on the target instance (with the given token), then disable automations here. Follow the progress with GET /servers/{uuid}/transfer. The target URL must use https. Requires read:sensitive and write.',
         path: '/servers/{uuid}/migrate',
         operationId: 'migrate-server-between-instances',
         security: [['bearerAuth' => []]],
@@ -43,13 +42,11 @@ class ServerTransferController extends Controller
                 properties: [
                     new OA\Property(property: 'target_url', type: 'string', example: 'https://coolify-b.example.com'),
                     new OA\Property(property: 'target_token', type: 'string', description: 'API token on the target instance (root or write)'),
-                    new OA\Property(property: 'preserve_uuids', type: 'boolean', default: true),
-                    new OA\Property(property: 'adopt_mode', type: 'boolean', default: true),
                 ]
             )
         ),
         responses: [
-            new OA\Response(response: 200, description: 'Migrated'),
+            new OA\Response(response: 202, description: 'Transfer started'),
             new OA\Response(response: 403, description: 'Missing sensitive permission'),
             new OA\Response(response: 404, ref: '#/components/responses/404'),
             new OA\Response(response: 422, description: 'Validation or remote import failed'),
@@ -83,10 +80,8 @@ class ServerTransferController extends Controller
         $validator = customApiValidator($request->all(), [
             'target_url' => 'required|string|url',
             'target_token' => 'required|string',
-            'preserve_uuids' => 'boolean|nullable',
-            'adopt_mode' => 'boolean|nullable',
         ]);
-        $allowedFields = ['target_url', 'target_token', 'preserve_uuids', 'adopt_mode'];
+        $allowedFields = ['target_url', 'target_token'];
         $extraFields = array_diff(array_keys($request->all()), $allowedFields);
         if ($validator->fails() || $extraFields !== []) {
             $errors = $validator->errors();
@@ -101,59 +96,52 @@ class ServerTransferController extends Controller
         }
 
         try {
-            $result = $this->migrator->migrate(
+            $this->migrator->start(
                 server: $server,
                 targetUrl: $request->string('target_url')->toString(),
                 targetToken: $request->string('target_token')->toString(),
-                preserveUuids: $request->boolean('preserve_uuids', true),
-                adoptMode: $request->boolean('adopt_mode', true),
             );
         } catch (Throwable $e) {
             return response()->json(['message' => $e->getMessage()], 422);
         }
 
+        $server->refresh();
         auditLog('api.server.migrate', [
             'team_id' => $teamId,
             'server_uuid' => $server->uuid,
-            'export_id' => $result['export_id'],
-            'target_url' => $result['target_url'],
+            'target_url' => data_get($server->server_metadata, 'migration.target_url'),
         ]);
 
-        return response()->json($result);
+        return response()->json([
+            'server_uuid' => $server->uuid,
+            'migration' => data_get($server->server_metadata, 'migration'),
+            'message' => 'Transfer started. Follow it with GET /api/v1/servers/'.$server->uuid.'/transfer.',
+        ], 202);
     }
 
     #[OA\Get(
-        summary: 'Export server transfer bundle',
-        description: 'Export a server and all resources hosted on it as a versioned transfer bundle for moving between Coolify instances. Requires read:sensitive.',
-        path: '/servers/{uuid}/export',
-        operationId: 'export-server-transfer-bundle',
+        summary: 'Get server transfer status',
+        description: 'Show the transfer state of a server on this instance: the import/claim state (transfer) and the state of a running or finished transfer to another instance (migration).',
+        path: '/servers/{uuid}/transfer',
+        operationId: 'get-server-transfer-status',
         security: [['bearerAuth' => []]],
         tags: ['Servers'],
         parameters: [
             new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
-            new OA\Parameter(name: 'encrypt', in: 'query', required: false, description: 'If true and passphrase is provided, return an encrypted envelope.', schema: new OA\Schema(type: 'boolean')),
-            new OA\Parameter(name: 'passphrase', in: 'query', required: false, description: 'Passphrase used when encrypt=true.', schema: new OA\Schema(type: 'string')),
         ],
         responses: [
-            new OA\Response(response: 200, description: 'Transfer bundle'),
+            new OA\Response(response: 200, description: 'Transfer status'),
             new OA\Response(response: 401, ref: '#/components/responses/401'),
-            new OA\Response(response: 403, description: 'Missing sensitive permission'),
             new OA\Response(response: 404, ref: '#/components/responses/404'),
         ]
     )]
-    public function export(Request $request, string $uuid): JsonResponse
+    public function status(string $uuid): JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        if (! $this->canReadSensitive($request)) {
-            return response()->json([
-                'message' => 'Exporting a server requires a token with read:sensitive (or root) ability and an admin/owner team role.',
-            ], 403);
-        }
-
         $server = Server::whereTeamId($teamId)->whereUuid($uuid)->first();
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
@@ -161,25 +149,106 @@ class ServerTransferController extends Controller
 
         $this->authorize('view', $server);
 
-        try {
-            $bundle = $this->exporter->export($server, includeSensitive: true);
-        } catch (Throwable $e) {
-            return response()->json(['message' => $e->getMessage()], 422);
-        }
-
-        auditLog('api.server.export', [
-            'team_id' => $teamId,
+        return response()->json([
             'server_uuid' => $server->uuid,
-            'export_id' => data_get($bundle, 'export_id'),
+            'transfer' => collect((array) data_get($server->server_metadata, 'transfer', []))
+                ->only(['status', 'export_id', 'imported_at', 'claimed_at', 'transferred_at', 'target_instance_url'])
+                ->all(),
+            'migration' => data_get($server->server_metadata, 'migration'),
         ]);
+    }
 
-        if ($request->boolean('encrypt') && $request->filled('passphrase')) {
-            return response()->json(
-                ServerTransferBundle::encryptWithPassphrase($bundle, $request->string('passphrase')->toString())
-            );
+    #[OA\Get(
+        summary: 'Check server import',
+        description: 'Check that this instance can import a server, before the source instance starts the transfer. It checks the token, the bundle version, the server limit, servers with the same UUID or IP, and that this instance can reach the SSH port of the server.',
+        path: '/servers/import/check',
+        operationId: 'check-server-import',
+        security: [['bearerAuth' => []]],
+        tags: ['Servers'],
+        parameters: [
+            new OA\Parameter(name: 'server_uuid', in: 'query', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'ip', in: 'query', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'port', in: 'query', required: false, schema: new OA\Schema(type: 'integer', default: 22)),
+            new OA\Parameter(name: 'schema_version', in: 'query', required: false, schema: new OA\Schema(type: 'integer')),
+            new OA\Parameter(name: 'system_github_apps[]', in: 'query', required: false, description: 'UUIDs of system-wide GitHub Apps that the server uses. The response lists the ones this instance does not have.', schema: new OA\Schema(type: 'array', items: new OA\Items(type: 'string'))),
+            new OA\Parameter(name: 'system_gitlab_apps[]', in: 'query', required: false, description: 'UUIDs of system-wide GitLab Apps that the server uses. The response lists the ones this instance does not have.', schema: new OA\Schema(type: 'array', items: new OA\Items(type: 'string'))),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'The server can be imported. Lists every check with its result.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 422, description: 'One or more checks failed. Lists every check with its result.'),
+        ]
+    )]
+    public function check(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
         }
 
-        return response()->json($bundle);
+        $this->authorize('create', Server::class);
+
+        $validator = customApiValidator($request->query(), [
+            'server_uuid' => 'required|string',
+            'ip' => ['required', 'string', new ValidServerIp],
+            'port' => 'nullable|integer|between:1,65535',
+            'schema_version' => 'nullable|integer',
+            'system_github_apps' => 'nullable|array|max:100',
+            'system_github_apps.*' => 'string|max:64',
+            'system_gitlab_apps' => 'nullable|array|max:100',
+            'system_gitlab_apps.*' => 'string|max:64',
+        ]);
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        // System-wide git sources are not transferred. Applications re-link only to one with the same uuid here.
+        $missingSystemSources = [
+            'github' => array_values(array_diff((array) $request->query('system_github_apps', []), GithubApp::query()->where('is_system_wide', true)->whereIn('uuid', (array) $request->query('system_github_apps', []))->pluck('uuid')->all())),
+            'gitlab' => array_values(array_diff((array) $request->query('system_gitlab_apps', []), GitlabApp::query()->where('is_system_wide', true)->whereIn('uuid', (array) $request->query('system_gitlab_apps', []))->pluck('uuid')->all())),
+        ];
+
+        $schemaVersion = (int) $request->query('schema_version', ServerTransferBundle::SCHEMA_VERSION);
+        $ip = trim((string) $request->query('ip'));
+        $port = (int) $request->query('port', 22);
+
+        // The target connects to the server over SSH when it takes over management, so an unreachable
+        // server would leave an imported server here that this instance cannot manage.
+        $connection = @fsockopen($ip, $port, timeout: 5);
+        if ($connection !== false) {
+            fclose($connection);
+        }
+
+        $checks = [
+            [
+                'label' => 'the transfer bundle version is supported',
+                'ok' => $schemaVersion === ServerTransferBundle::SCHEMA_VERSION,
+                'message' => $schemaVersion === ServerTransferBundle::SCHEMA_VERSION ? null
+                    : 'This instance reads transfer bundle version '.ServerTransferBundle::SCHEMA_VERSION.", but the source sends version {$schemaVersion}. Upgrade both instances to the same Coolify version.",
+            ],
+            ...collect($this->importer->importChecks((string) $request->query('server_uuid'), $ip, $teamId))
+                ->map(fn (array $check) => collect($check)->only(['label', 'ok', 'message'])->all())
+                ->all(),
+            [
+                'label' => "the target can reach the SSH port of the server ({$ip}:{$port})",
+                'ok' => $connection !== false,
+                'message' => $connection !== false ? null
+                    : "This instance cannot reach the server at {$ip}:{$port}. Allow SSH from this instance to the server, then transfer again.",
+            ],
+        ];
+
+        $failed = collect($checks)->where('ok', false);
+
+        return response()->json([
+            'message' => $failed->isEmpty()
+                ? 'This instance can import the server.'
+                : $failed->pluck('message')->implode(' '),
+            'checks' => $checks,
+            'missing_system_sources' => $missingSystemSources,
+        ], $failed->isEmpty() ? 200 : 422);
     }
 
     #[OA\Post(
@@ -193,8 +262,7 @@ class ServerTransferController extends Controller
             required: true,
             content: new OA\JsonContent(
                 properties: [
-                    new OA\Property(property: 'bundle', type: 'object', description: 'Plain or encrypted transfer bundle'),
-                    new OA\Property(property: 'passphrase', type: 'string', nullable: true),
+                    new OA\Property(property: 'bundle', type: 'object', description: 'Transfer bundle'),
                     new OA\Property(property: 'dry_run', type: 'boolean', default: false),
                     new OA\Property(property: 'preserve_uuids', type: 'boolean', default: true),
                     new OA\Property(property: 'adopt_mode', type: 'boolean', default: true, description: 'Import without forcing redeploy; keep statuses for adoption'),
@@ -225,12 +293,11 @@ class ServerTransferController extends Controller
 
         $validator = customApiValidator($request->all(), [
             'bundle' => 'required|array',
-            'passphrase' => 'string|nullable',
             'dry_run' => 'boolean|nullable',
             'preserve_uuids' => 'boolean|nullable',
             'adopt_mode' => 'boolean|nullable',
         ]);
-        $allowedFields = ['bundle', 'passphrase', 'dry_run', 'preserve_uuids', 'adopt_mode'];
+        $allowedFields = ['bundle', 'dry_run', 'preserve_uuids', 'adopt_mode'];
         $extraFields = array_diff(array_keys($request->all()), $allowedFields);
         if ($validator->fails() || $extraFields !== []) {
             $errors = $validator->errors();
@@ -244,34 +311,21 @@ class ServerTransferController extends Controller
             ], 422);
         }
 
-        $bundle = $request->input('bundle', []);
-        if (data_get($bundle, 'encrypted')) {
-            if (! $request->filled('passphrase')) {
-                return response()->json(['message' => 'Passphrase is required for encrypted bundles.'], 422);
-            }
-            try {
-                $bundle = ServerTransferBundle::decryptWithPassphrase($bundle, $request->string('passphrase')->toString());
-            } catch (Throwable $e) {
-                return response()->json(['message' => $e->getMessage()], 422);
-            }
-        }
-
         try {
             $result = $this->importer->import(
-                bundle: $bundle,
+                bundle: $request->input('bundle', []),
                 teamId: $teamId,
                 dryRun: $request->boolean('dry_run', false),
                 preserveUuids: $request->boolean('preserve_uuids', true),
                 adoptMode: $request->boolean('adopt_mode', true),
             );
         } catch (Throwable $e) {
-            $status = $e instanceof ValidationException ? 422 : 422;
             $payload = ['message' => $e->getMessage()];
             if ($e instanceof ValidationException) {
                 $payload['errors'] = $e->errors();
             }
 
-            return response()->json($payload, $status);
+            return response()->json($payload, 422);
         }
 
         auditLog('api.server.import', [
@@ -286,7 +340,7 @@ class ServerTransferController extends Controller
 
     #[OA\Post(
         summary: 'Mark server transferred',
-        description: 'Source-instance step: disable automations after a successful export/import handoff.',
+        description: 'Source-instance recovery step: disable automations here when the target already manages the server but the transfer could not finish on this instance.',
         path: '/servers/{uuid}/transfer/complete',
         operationId: 'complete-server-transfer',
         security: [['bearerAuth' => []]],
@@ -351,77 +405,6 @@ class ServerTransferController extends Controller
         return response()->json($result);
     }
 
-    #[OA\Post(
-        summary: 'Write transfer bundle to server mailbox',
-        description: 'Write an export bundle to /data/coolify/exports on the managed host for air-gapped import.',
-        path: '/servers/{uuid}/export/mailbox',
-        operationId: 'export-server-transfer-mailbox',
-        security: [['bearerAuth' => []]],
-        tags: ['Servers'],
-        parameters: [
-            new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
-        ],
-        requestBody: new OA\RequestBody(
-            content: new OA\JsonContent(
-                properties: [
-                    new OA\Property(property: 'passphrase', type: 'string', nullable: true),
-                ]
-            )
-        ),
-        responses: [
-            new OA\Response(response: 200, description: 'Mailbox write result'),
-            new OA\Response(response: 403, description: 'Missing sensitive permission'),
-            new OA\Response(response: 404, ref: '#/components/responses/404'),
-        ]
-    )]
-    public function writeMailbox(Request $request, string $uuid): JsonResponse
-    {
-        $teamId = getTeamIdFromToken();
-        if (is_null($teamId)) {
-            return invalidTokenResponse();
-        }
-
-        if (! $this->canReadSensitive($request)) {
-            return response()->json([
-                'message' => 'Writing a transfer mailbox requires read:sensitive (or root) ability and an admin/owner team role.',
-            ], 403);
-        }
-
-        $server = Server::whereTeamId($teamId)->whereUuid($uuid)->first();
-        if (! $server) {
-            return response()->json(['message' => 'Server not found.'], 404);
-        }
-
-        $this->authorize('view', $server);
-
-        try {
-            $bundle = $this->exporter->export($server, includeSensitive: true);
-            $result = $this->claimer->writeMailbox(
-                $server,
-                $bundle,
-                $request->filled('passphrase') ? $request->string('passphrase')->toString() : null,
-            );
-        } catch (Throwable $e) {
-            return response()->json(['message' => $e->getMessage()], 422);
-        }
-
-        auditLog('api.server.export_mailbox', [
-            'team_id' => $teamId,
-            'server_uuid' => $server->uuid,
-            'export_id' => data_get($bundle, 'export_id'),
-            'path' => $result['path'],
-        ]);
-
-        return response()->json([
-            'export_id' => data_get($bundle, 'export_id'),
-            'path' => $result['path'],
-            'written' => $result['written'],
-            'message' => $result['written']
-                ? 'Transfer bundle written to server mailbox.'
-                : 'Failed to write mailbox on remote host.',
-        ], $result['written'] ? 200 : 422);
-    }
-
     private function canReadSensitive(Request $request): bool
     {
         return (bool) $request->attributes->get('can_read_sensitive', false);
diff --git a/app/Http/Controllers/Api/ServiceApplicationsController.php b/app/Http/Controllers/Api/ServiceApplicationsController.php
index b336259d63..14d8b97924 100644
--- a/app/Http/Controllers/Api/ServiceApplicationsController.php
+++ b/app/Http/Controllers/Api/ServiceApplicationsController.php
@@ -7,6 +7,7 @@ use App\Actions\Service\RestartServiceApplication;
 use App\Actions\Service\StopServiceApplication;
 use App\Actions\Service\UpdateServiceApplicationFromApi;
 use App\Http\Controllers\Controller;
+use App\Models\EnvironmentVariable;
 use App\Models\ServerSetting;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -535,7 +536,10 @@ class ServiceApplicationsController extends Controller
         }
 
         $lines = normalizeLogLines($request->query('lines'));
-        $logs = getContainerLogs($server, $containerName, $lines);
+        $logs = sanitizeLogsForExport(
+            getContainerLogs($server, $containerName, $lines),
+            EnvironmentVariable::logRedactionSecretsFor($serviceApplication->service),
+        );
 
         return response()->json([
             'logs' => $logs,
diff --git a/app/Http/Controllers/Api/ServiceDatabasesController.php b/app/Http/Controllers/Api/ServiceDatabasesController.php
index 6b92bedbaa..fb4ad6d892 100644
--- a/app/Http/Controllers/Api/ServiceDatabasesController.php
+++ b/app/Http/Controllers/Api/ServiceDatabasesController.php
@@ -8,6 +8,7 @@ use App\Actions\Service\DeployServiceApplication;
 use App\Actions\Service\RestartServiceApplication;
 use App\Actions\Service\StopServiceApplication;
 use App\Http\Controllers\Controller;
+use App\Models\EnvironmentVariable;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use Illuminate\Http\JsonResponse;
@@ -411,7 +412,10 @@ class ServiceDatabasesController extends Controller
         $lines = normalizeLogLines($request->query('lines'));
 
         return response()->json([
-            'logs' => getContainerLogs($server, $containerName, $lines),
+            'logs' => sanitizeLogsForExport(
+                getContainerLogs($server, $containerName, $lines),
+                EnvironmentVariable::logRedactionSecretsFor($serviceDatabase->service),
+            ),
         ]);
     }
 
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index 53cd599cf2..2c5e1fcedb 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -324,6 +324,7 @@ class ServicesController extends Controller
                         ],
                         'force_domain_override' => ['type' => 'boolean', 'default' => false, 'description' => 'Force domain override even if conflicts are detected.'],
                         'is_container_label_escape_enabled' => ['type' => 'boolean', 'default' => true, 'description' => 'Escape special characters in labels. By default, $ (and other chars) is escaped. If you want to use env variables inside the labels, turn this off.'],
+                        'redact_all_env_values_in_logs' => ['type' => 'boolean', 'default' => true, 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'],
                         'tags' => ['type' => 'array', 'items' => new OA\Items(type: 'string'), 'description' => 'Tags to assign to the service.'],
                     ],
                 ),
@@ -391,7 +392,7 @@ class ServicesController extends Controller
     )]
     public function create_service(Request $request)
     {
-        $allowedFields = ['type', 'name', 'description', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'docker_compose_raw', 'connect_to_docker_network', 'urls', 'force_domain_override', 'is_container_label_escape_enabled', 'tags'];
+        $allowedFields = ['type', 'name', 'description', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'docker_compose_raw', 'connect_to_docker_network', 'urls', 'force_domain_override', 'is_container_label_escape_enabled', 'redact_all_env_values_in_logs', 'tags'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -426,6 +427,7 @@ class ServicesController extends Controller
             'urls.*.url' => ValidationPatterns::applicationDomainRules(),
             'force_domain_override' => 'boolean',
             'is_container_label_escape_enabled' => 'boolean',
+            'redact_all_env_values_in_logs' => 'boolean',
             'tags' => 'array|nullable',
             'tags.*' => 'string|min:2',
         ];
@@ -558,6 +560,9 @@ class ServicesController extends Controller
                 if ($request->has('is_container_label_escape_enabled')) {
                     $service->is_container_label_escape_enabled = $request->boolean('is_container_label_escape_enabled');
                 }
+                if ($request->has('redact_all_env_values_in_logs')) {
+                    $service->redact_all_env_values_in_logs = $request->boolean('redact_all_env_values_in_logs');
+                }
                 $service->save();
                 if ($oneClickDotEnvs?->count() > 0) {
                     $oneClickDotEnvs->each(function ($value) use ($service) {
@@ -626,7 +631,7 @@ class ServicesController extends Controller
 
             return response()->json(['message' => 'Service not found.', 'valid_service_types' => $serviceKeys], 404);
         } elseif (filled($request->docker_compose_raw)) {
-            $allowedFields = ['name', 'description', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'docker_compose_raw', 'connect_to_docker_network', 'urls', 'force_domain_override', 'is_container_label_escape_enabled', 'tags'];
+            $allowedFields = ['name', 'description', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'docker_compose_raw', 'connect_to_docker_network', 'urls', 'force_domain_override', 'is_container_label_escape_enabled', 'redact_all_env_values_in_logs', 'tags'];
 
             $validationRules = [
                 'project_uuid' => 'string|required',
@@ -645,6 +650,7 @@ class ServicesController extends Controller
                 'urls.*.url' => ValidationPatterns::applicationDomainRules(),
                 'force_domain_override' => 'boolean',
                 'is_container_label_escape_enabled' => 'boolean',
+                'redact_all_env_values_in_logs' => 'boolean',
                 'tags' => 'array|nullable',
                 'tags.*' => 'string|min:2',
             ];
@@ -761,6 +767,9 @@ class ServicesController extends Controller
             if ($request->has('is_container_label_escape_enabled')) {
                 $service->is_container_label_escape_enabled = $request->boolean('is_container_label_escape_enabled');
             }
+            if ($request->has('redact_all_env_values_in_logs')) {
+                $service->redact_all_env_values_in_logs = $request->boolean('redact_all_env_values_in_logs');
+            }
             $service->save();
 
             $service->parse(isNew: true);
@@ -989,7 +998,10 @@ class ServicesController extends Controller
 
         $lines = normalizeLogLines($request->query('lines'));
         $showTimestamps = parseLogTimestampFlag($request->query('show_timestamps'));
-        $logs = getContainerLogs($service->destination->server, $container['ID'], $lines, $showTimestamps);
+        $logs = sanitizeLogsForExport(
+            getContainerLogs($service->destination->server, $container['ID'], $lines, $showTimestamps),
+            EnvironmentVariable::logRedactionSecretsFor($service),
+        );
 
         return response()->json([
             'logs' => $logs,
@@ -1137,6 +1149,7 @@ class ServicesController extends Controller
                             ],
                             'force_domain_override' => ['type' => 'boolean', 'default' => false, 'description' => 'Force domain override even if conflicts are detected.'],
                             'is_container_label_escape_enabled' => ['type' => 'boolean', 'default' => true, 'description' => 'Escape special characters in labels. By default, $ (and other chars) is escaped. If you want to use env variables inside the labels, turn this off.'],
+                            'redact_all_env_values_in_logs' => ['type' => 'boolean', 'default' => true, 'description' => 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'],
                         ],
                     )
                 ),
@@ -1225,12 +1238,16 @@ class ServicesController extends Controller
 
         $this->authorize('update', $service);
 
+        if ($request->has('redact_all_env_values_in_logs')) {
+            $this->authorize('manageEnvironment', $service);
+        }
+
         if ($request->boolean('instant_deploy')) {
             abort_unless($request->user()->tokenCan('deploy') || $request->user()->tokenCan('root'), 403, 'Missing required permissions: deploy');
             $this->authorize('deploy', $service);
         }
 
-        $allowedFields = ['name', 'description', 'instant_deploy', 'docker_compose_raw', 'connect_to_docker_network', 'urls', 'force_domain_override', 'is_container_label_escape_enabled'];
+        $allowedFields = ['name', 'description', 'instant_deploy', 'docker_compose_raw', 'connect_to_docker_network', 'urls', 'force_domain_override', 'is_container_label_escape_enabled', 'redact_all_env_values_in_logs'];
 
         $validationRules = [
             'name' => 'string|max:255',
@@ -1244,6 +1261,7 @@ class ServicesController extends Controller
             'urls.*.url' => ValidationPatterns::applicationDomainRules(),
             'force_domain_override' => 'boolean',
             'is_container_label_escape_enabled' => 'boolean',
+            'redact_all_env_values_in_logs' => 'boolean',
         ];
         $validationMessages = [
             'urls.*.array' => 'An item in the urls array has invalid fields. Only name and url fields are supported.',
@@ -1311,6 +1329,9 @@ class ServicesController extends Controller
         if ($request->has('is_container_label_escape_enabled')) {
             $service->is_container_label_escape_enabled = $request->boolean('is_container_label_escape_enabled');
         }
+        if ($request->has('redact_all_env_values_in_logs')) {
+            $service->redact_all_env_values_in_logs = $request->boolean('redact_all_env_values_in_logs');
+        }
         $previousDnsHostnames = $this->serviceApplicationDnsHostnames($service);
         $service->save();
 
@@ -3416,7 +3437,7 @@ class ServicesController extends Controller
             }
 
             foreach ($sourceDatabase->scheduledBackups()->get() as $backup) {
-                $backup->replicate([
+                $newBackup = $backup->replicate([
                     'id',
                     'created_at',
                     'updated_at',
@@ -3425,7 +3446,9 @@ class ServicesController extends Controller
                     'database_id' => $database->id,
                     'database_type' => $database->getMorphClass(),
                     'team_id' => $teamId,
-                ])->save();
+                ]);
+                $newBackup->save();
+                $backup->copyS3StoragesTo($newBackup);
             }
         }
 
diff --git a/app/Http/Controllers/Api/SharedVariableCanvasController.php b/app/Http/Controllers/Api/SharedVariableCanvasController.php
new file mode 100644
index 0000000000..718dc6bb76
--- /dev/null
+++ b/app/Http/Controllers/Api/SharedVariableCanvasController.php
@@ -0,0 +1,199 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\Team;
+use App\Services\SharedVariableCanvas;
+use App\Traits\EnvironmentVariableProtection;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Validator;
+
+/**
+ * Shared variables canvas: shows which resources use the shared variables of a scope, and adds
+ * a shared variable to a resource (a resource variable that holds {{scope.KEY}}) or removes it.
+ * Called by resources/js/environment-canvas.js through the /canvas/api session bridge.
+ */
+class SharedVariableCanvasController extends Controller
+{
+    use EnvironmentVariableProtection;
+
+    public function __construct(private SharedVariableCanvas $canvas) {}
+
+    public function show(Request $request): JsonResponse
+    {
+        $scope = $this->scope($request);
+        $owner = $this->findOwner($scope, $request->route('uuid'));
+        if ($owner instanceof JsonResponse) {
+            return $owner;
+        }
+        $this->authorize('view', $owner);
+
+        return response()->json($this->canvas->payload($scope, $owner, $this->canEdit($request, $scope, $owner)));
+    }
+
+    public function storeLink(Request $request): JsonResponse
+    {
+        $scope = $this->scope($request);
+        $owner = $this->findOwner($scope, $request->route('uuid'));
+        if ($owner instanceof JsonResponse) {
+            return $owner;
+        }
+        $this->authorize('view', $owner);
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+        $validator = Validator::make($request->all(), [
+            'source' => ['required', 'string', 'max:255'],
+            'target' => ['required', 'string', 'max:255'],
+        ]);
+        if ($validator->fails()) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $validator->errors()], 422);
+        }
+
+        $variable = $this->findVariable($owner, $request->input('source'));
+        $resource = $this->canvas->resources($scope, $owner)->get($request->input('target'));
+        $errors = [];
+        if (! $variable) {
+            $errors['source'] = ['The source must be a shared variable of this scope.'];
+        }
+        if (! $resource) {
+            $errors['target'] = ['The target must be a resource that can use this shared variable.'];
+        }
+        if ($errors !== []) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+        }
+        $this->authorize('manageEnvironment', $resource);
+
+        $existing = $this->canvas->resourceVariables(collect([$resource]))->firstWhere('key', $variable->key);
+        if ($existing) {
+            $message = in_array($variable->key, $this->canvas->referencedKeys($scope, $existing->value), true)
+                ? "{$resource->name} already uses {$variable->key}."
+                : "{$resource->name} already has a variable named {$variable->key}. Rename or remove it first.";
+
+            return response()->json(['message' => $message, 'errors' => ['target' => [$message]]], 422);
+        }
+
+        $environmentVariable = new EnvironmentVariable;
+        $environmentVariable->key = $variable->key;
+        $environmentVariable->value = $this->canvas->reference($scope, $variable->key);
+        $environmentVariable->is_multiline = (bool) $variable->is_multiline;
+        $environmentVariable->is_literal = (bool) $variable->is_literal;
+        $environmentVariable->resourceable_id = $resource->getKey();
+        $environmentVariable->resourceable_type = $resource->getMorphClass();
+        $environmentVariable->save();
+
+        $link = collect($this->canvas->links($scope, collect([$variable]), collect([$resource->uuid => $resource])))
+            ->firstWhere('source', $this->canvas->variableNodeId($variable));
+
+        return response()->json($link, 201);
+    }
+
+    public function destroyLink(Request $request): JsonResponse
+    {
+        $scope = $this->scope($request);
+        $owner = $this->findOwner($scope, $request->route('uuid'));
+        if ($owner instanceof JsonResponse) {
+            return $owner;
+        }
+        $this->authorize('view', $owner);
+
+        [$source, $target] = array_pad(explode('|', (string) $request->route('link_id'), 2), 2, '');
+        $resource = $this->canvas->resources($scope, $owner)->get($target);
+        $variable = $this->findVariable($owner, $source);
+        $key = $variable?->key ?? (str_starts_with($source, 'missing:') ? substr($source, strlen('missing:')) : null);
+        if (! $resource || blank($key)) {
+            return response()->json(['message' => 'Link not found.'], 404);
+        }
+        $this->authorize('manageEnvironment', $resource);
+
+        // Preview copies of application variables are removed together with the variable.
+        $references = EnvironmentVariable::query()
+            ->where('resourceable_type', $resource->getMorphClass())
+            ->where('resourceable_id', $resource->getKey())
+            ->get()
+            ->filter(fn (EnvironmentVariable $environmentVariable) => in_array($key, $this->canvas->referencedKeys($scope, $environmentVariable->value), true));
+        if ($references->where('is_preview', false)->isEmpty()) {
+            return response()->json(['message' => 'Link not found.'], 404);
+        }
+        $embedded = $references->reject(fn (EnvironmentVariable $environmentVariable) => $this->canvas->isExactReference($scope, $key, $environmentVariable->value));
+        if ($embedded->isNotEmpty()) {
+            $message = "{$embedded->pluck('key')->unique()->join(', ')} on {$resource->name} uses {$this->canvas->reference($scope, $key)} inside a longer value. Edit it on the resource.";
+
+            return response()->json(['message' => $message], 422);
+        }
+        if ($this->usesDockerCompose($resource)) {
+            foreach ($references->pluck('key')->unique() as $environmentKey) {
+                [$isUsed, $reason] = $this->isEnvironmentVariableUsedInDockerCompose($environmentKey, $resource->docker_compose);
+                if ($isUsed) {
+                    return response()->json(['message' => "Cannot remove {$environmentKey} from {$resource->name}. {$reason}"], 422);
+                }
+            }
+        }
+
+        DB::transaction(fn () => $references->each->delete());
+
+        return response()->json(['message' => 'Link removed.']);
+    }
+
+    /**
+     * The team routes have no {scope} segment.
+     */
+    private function scope(Request $request): string
+    {
+        return $request->route('scope') ?? 'team';
+    }
+
+    private function findOwner(string $scope, ?string $uuid): Model|JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $owner = match ($scope) {
+            'team' => Team::query()->find($teamId),
+            'project' => Project::query()->where('team_id', $teamId)->where('uuid', $uuid)->first(),
+            'environment' => Environment::query()->where('uuid', $uuid)->whereHas('project', fn ($query) => $query->where('team_id', $teamId))->with('project')->first(),
+            'server' => Server::query()->where('team_id', $teamId)->where('uuid', $uuid)->first(),
+            default => null,
+        };
+
+        return $owner ?? response()->json(['message' => str($scope)->headline().' not found.'], 404);
+    }
+
+    private function findVariable(Model $owner, ?string $nodeId): ?SharedEnvironmentVariable
+    {
+        if (! str_starts_with((string) $nodeId, 'variable:')) {
+            return null;
+        }
+
+        return $owner->environment_variables()->whereKey((int) substr($nodeId, strlen('variable:')))->first();
+    }
+
+    private function canEdit(Request $request, string $scope, Model $owner): bool
+    {
+        $user = $request->user();
+        $token = $user->currentAccessToken();
+
+        return $user->isAdminOfTeam($this->canvas->teamId($scope, $owner))
+            && ($token->can('root') || $token->can('write'));
+    }
+
+    private function usesDockerCompose(Model $resource): bool
+    {
+        return $resource instanceof Service
+            || ($resource instanceof Application && $resource->build_pack === 'dockercompose');
+    }
+}
diff --git a/app/Http/Controllers/Api/TagCanvasController.php b/app/Http/Controllers/Api/TagCanvasController.php
new file mode 100644
index 0000000000..09864d2b8d
--- /dev/null
+++ b/app/Http/Controllers/Api/TagCanvasController.php
@@ -0,0 +1,107 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Tag;
+use App\Services\TagCanvas;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+
+/**
+ * Tags canvas: shows which resources have which tag, and tags or untags a resource.
+ * Called by resources/js/environment-canvas.js through the /canvas/api session bridge.
+ */
+class TagCanvasController extends Controller
+{
+    public function __construct(private TagCanvas $canvas) {}
+
+    public function show(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $this->authorize('viewAny', Tag::class);
+
+        $user = $request->user();
+        $token = $user->currentAccessToken();
+        $canEdit = $user->isAdminOfTeam((int) $teamId) && ($token->can('root') || $token->can('write'));
+
+        return response()->json($this->canvas->payload((int) $teamId, $canEdit));
+    }
+
+    public function storeLink(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+        $validator = Validator::make($request->all(), [
+            'source' => ['required', 'string', 'max:255'],
+            'target' => ['required', 'string', 'max:255'],
+        ]);
+        if ($validator->fails()) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $validator->errors()], 422);
+        }
+
+        $tag = $this->findTag((int) $teamId, $request->input('source'));
+        $resource = $this->canvas->resources((int) $teamId)->get($request->input('target'));
+        $errors = [];
+        if (! $tag) {
+            $errors['source'] = ['The source must be a tag of this team.'];
+        }
+        if (! $resource) {
+            $errors['target'] = ['The target must be a resource of this team.'];
+        }
+        if ($errors !== []) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+        }
+        $this->authorize('update', $resource);
+
+        if ($resource->tags->contains('id', $tag->id)) {
+            $message = "{$resource->name} already has the {$tag->name} tag.";
+
+            return response()->json(['message' => $message, 'errors' => ['target' => [$message]]], 422);
+        }
+        $resource->tags()->attach($tag->id);
+
+        return response()->json($this->canvas->link($tag, $resource), 201);
+    }
+
+    public function destroyLink(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        [$source, $target] = array_pad(explode('|', (string) $request->route('link_id'), 2), 2, '');
+        $tag = $this->findTag((int) $teamId, $source);
+        $resource = $this->canvas->resources((int) $teamId)->get($target);
+        if (! $tag || ! $resource || ! $resource->tags->contains('id', $tag->id)) {
+            return response()->json(['message' => 'Link not found.'], 404);
+        }
+        $this->authorize('update', $resource);
+
+        // The tag stays, also without resources. Delete it on the Tags page.
+        $resource->tags()->detach($tag->id);
+
+        return response()->json(['message' => 'Link removed.']);
+    }
+
+    private function findTag(int $teamId, ?string $nodeId): ?Tag
+    {
+        if (! str_starts_with((string) $nodeId, 'tag:')) {
+            return null;
+        }
+
+        return Tag::query()->where('team_id', $teamId)->where('uuid', substr($nodeId, strlen('tag:')))->first();
+    }
+}
diff --git a/app/Http/Controllers/Api/VolumeBackupsController.php b/app/Http/Controllers/Api/VolumeBackupsController.php
index 97161d3111..16edac3bab 100644
--- a/app/Http/Controllers/Api/VolumeBackupsController.php
+++ b/app/Http/Controllers/Api/VolumeBackupsController.php
@@ -15,6 +15,7 @@ use App\Models\Service;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 use Illuminate\Support\MessageBag;
 use OpenApi\Attributes as OA;
 use RuntimeException;
@@ -28,7 +29,8 @@ use RuntimeException;
         new OA\Property(property: 'save_s3', type: 'boolean', default: false),
         new OA\Property(property: 'disable_local_backup', type: 'boolean', default: false),
         new OA\Property(property: 'stop_during_backup', type: 'boolean', default: false, description: 'Stop the resource containers during the backup. Needs a token with the deploy permission.'),
-        new OA\Property(property: 's3_storage_uuid', type: 'string', nullable: true),
+        new OA\Property(property: 's3_storage_uuid', type: 'string', nullable: true, description: 'Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination.'),
+        new OA\Property(property: 's3_storage_uuids', type: 'array', items: new OA\Items(type: 'string'), description: 'UUIDs of every S3 storage the backup is uploaded to. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination. save_s3 requires at least one destination.'),
         new OA\Property(property: 'retention_amount_locally', type: 'integer', default: 7, minimum: 0, maximum: 10000),
         new OA\Property(property: 'retention_days_locally', type: 'integer', default: 0, maximum: 2147483647, minimum: 0),
         new OA\Property(property: 'retention_max_storage_locally', type: 'number', format: 'float', default: 0, maximum: 9999999999, minimum: 0),
@@ -54,7 +56,8 @@ use RuntimeException;
         new OA\Property(property: 'save_s3', type: 'boolean'),
         new OA\Property(property: 'disable_local_backup', type: 'boolean'),
         new OA\Property(property: 'stop_during_backup', type: 'boolean'),
-        new OA\Property(property: 's3_storage_uuid', type: 'string', nullable: true),
+        new OA\Property(property: 's3_storage_uuid', type: 'string', nullable: true, description: 'Primary S3 destination.'),
+        new OA\Property(property: 's3_storage_uuids', type: 'array', items: new OA\Items(type: 'string'), description: 'Every S3 destination, primary first.'),
         new OA\Property(property: 'retention_amount_locally', type: 'integer'),
         new OA\Property(property: 'retention_days_locally', type: 'integer'),
         new OA\Property(property: 'retention_max_storage_locally', type: 'number', format: 'float'),
@@ -175,7 +178,7 @@ class VolumeBackupsController extends Controller
             return response()->json(['message' => 'Storage not found.'], 404);
         }
 
-        ['errors' => $errors, 's3Storage' => $s3Storage, 'saveToS3' => $saveToS3] = $this->validateUpsertRequest($request, $storage, $teamId);
+        ['errors' => $errors, 's3Storages' => $s3Storages, 'saveToS3' => $saveToS3] = $this->validateUpsertRequest($request, $storage, $teamId);
 
         if ($errors->isNotEmpty()) {
             return response()->json([
@@ -184,11 +187,11 @@ class VolumeBackupsController extends Controller
             ], 422);
         }
 
-        return $this->persistSchedule($request, $storage, $teamId, $s3Storage, $saveToS3, $resourceType, $resource);
+        return $this->persistSchedule($request, $storage, $teamId, $s3Storages, $saveToS3, $resourceType, $resource);
     }
 
     /**
-     * @return array{errors: MessageBag, s3Storage: S3Storage|null, saveToS3: bool}
+     * @return array{errors: MessageBag, s3Storages: Collection<int, S3Storage>, saveToS3: bool}
      */
     private function validateUpsertRequest(
         Request $request,
@@ -202,6 +205,8 @@ class VolumeBackupsController extends Controller
             'disable_local_backup' => 'boolean',
             'stop_during_backup' => 'boolean',
             's3_storage_uuid' => 'nullable|string',
+            's3_storage_uuids' => 'array',
+            's3_storage_uuids.*' => 'string|distinct',
             'retention_amount_locally' => 'integer|min:0|max:10000',
             'retention_days_locally' => 'integer|min:0|max:2147483647',
             'retention_max_storage_locally' => 'numeric|min:0|max:9999999999',
@@ -219,6 +224,7 @@ class VolumeBackupsController extends Controller
             'disable_local_backup',
             'stop_during_backup',
             's3_storage_uuid',
+            's3_storage_uuids',
             'retention_amount_locally',
             'retention_days_locally',
             'retention_max_storage_locally',
@@ -242,16 +248,24 @@ class VolumeBackupsController extends Controller
             $errors->add('disable_local_backup', 'Local backups can only be disabled when S3 backups are enabled.');
         }
 
-        $s3Storage = null;
-        if ($saveToS3) {
-            $s3Storage = S3Storage::query()
+        $s3Storages = collect();
+        if ($saveToS3 && ! $errors->hasAny(['s3_storage_uuid', 's3_storage_uuids', 's3_storage_uuids.*'])) {
+            $hasList = $request->has('s3_storage_uuids');
+            $uuids = collect($hasList ? $request->input('s3_storage_uuids') : [$request->input('s3_storage_uuid')])->filter()->unique()->values();
+            $primaryUuid = $request->input('s3_storage_uuid') ?? $uuids->first();
+
+            $s3Storages = S3Storage::query()
                 ->where('team_id', $teamId)
                 ->where('is_usable', true)
-                ->where('uuid', $request->input('s3_storage_uuid'))
-                ->first();
+                ->whereIn('uuid', $uuids->all())
+                ->get()
+                ->sortBy(fn (S3Storage $s3Storage): int => $s3Storage->uuid === $primaryUuid ? 0 : 1)
+                ->values();
 
-            if (! $s3Storage) {
-                $errors->add('s3_storage_uuid', 'Select a usable S3 storage owned by your team.');
+            if ($hasList && filled($primaryUuid) && ! $uuids->contains($primaryUuid)) {
+                $errors->add('s3_storage_uuid', 'The s3_storage_uuid must be one of the s3_storage_uuids.');
+            } elseif ($uuids->isEmpty() || $s3Storages->count() !== $uuids->count()) {
+                $errors->add($hasList ? 's3_storage_uuids' : 's3_storage_uuid', 'Select a usable S3 storage owned by your team.');
             }
         }
 
@@ -261,7 +275,7 @@ class VolumeBackupsController extends Controller
 
         return [
             'errors' => $errors,
-            's3Storage' => $s3Storage,
+            's3Storages' => $s3Storages,
             'saveToS3' => $saveToS3,
         ];
     }
@@ -270,7 +284,7 @@ class VolumeBackupsController extends Controller
         Request $request,
         LocalPersistentVolume|LocalFileVolume $storage,
         int|string $teamId,
-        ?S3Storage $s3Storage,
+        Collection $s3Storages,
         bool $saveToS3,
         string $resourceType,
         Model $resource,
@@ -282,7 +296,7 @@ class VolumeBackupsController extends Controller
             'save_s3' => $saveToS3,
             'disable_local_backup' => $saveToS3 && $request->boolean('disable_local_backup'),
             'stop_during_backup' => $request->boolean('stop_during_backup'),
-            's3_storage_id' => $s3Storage?->id,
+            's3_storage_id' => $s3Storages->first()?->id,
             'retention_amount_locally' => $request->integer('retention_amount_locally', 7),
             'retention_days_locally' => $request->integer('retention_days_locally'),
             'retention_max_storage_locally' => $request->float('retention_max_storage_locally'),
@@ -298,6 +312,7 @@ class VolumeBackupsController extends Controller
         }
 
         $backup = $storage->scheduledBackups()->updateOrCreate([], $attributes);
+        $backup->syncS3Storages($s3Storages->pluck('id')->all());
         $created = $backup->wasRecentlyCreated;
 
         auditLog('api.volume_backup.schedule_set', [
@@ -308,7 +323,7 @@ class VolumeBackupsController extends Controller
             'backup_uuid' => $backup->uuid,
         ]);
 
-        return response()->json($this->responseData($backup, $storage, $s3Storage, $created), $created ? 201 : 200);
+        return response()->json($this->responseData($backup, $storage, $s3Storages, $created), $created ? 201 : 200);
     }
 
     #[OA\Delete(
@@ -441,7 +456,7 @@ class VolumeBackupsController extends Controller
     private function responseData(
         ScheduledVolumeBackup $backup,
         LocalPersistentVolume|LocalFileVolume $storage,
-        ?S3Storage $s3Storage,
+        Collection $s3Storages,
         bool $created,
     ): array {
         return [
@@ -454,7 +469,8 @@ class VolumeBackupsController extends Controller
             'save_s3' => $backup->save_s3,
             'disable_local_backup' => $backup->disable_local_backup,
             'stop_during_backup' => $backup->stop_during_backup,
-            's3_storage_uuid' => $s3Storage?->uuid,
+            's3_storage_uuid' => $s3Storages->first()?->uuid,
+            's3_storage_uuids' => $s3Storages->pluck('uuid')->all(),
             'retention_amount_locally' => $backup->retention_amount_locally,
             'retention_days_locally' => $backup->retention_days_locally,
             'retention_max_storage_locally' => $backup->retention_max_storage_locally,
diff --git a/app/Http/Controllers/FileBrowserDownloadController.php b/app/Http/Controllers/FileBrowserDownloadController.php
new file mode 100644
index 0000000000..17bed2392e
--- /dev/null
+++ b/app/Http/Controllers/FileBrowserDownloadController.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Server;
+use App\Services\ContainerFilesystemService;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Gate;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+/**
+ * Streams a file browser download straight from the container to the browser.
+ * Livewire download responses are buffered in memory and base64-encoded, so
+ * FileBrowser::download() issues a one-time token and redirects here instead.
+ */
+class FileBrowserDownloadController extends Controller
+{
+    public const TOKEN_TTL_SECONDS = 60;
+
+    public static function cacheKey(string $token): string
+    {
+        return 'file-browser-download:'.$token;
+    }
+
+    public function __invoke(string $token): StreamedResponse
+    {
+        /** @var array{user_id:int,resource_type:class-string,resource_id:int,server_id:int,container:string,path:string,name:string,is_dir:bool}|null $download */
+        $download = Cache::pull(self::cacheKey($token));
+        abort_unless(is_array($download) && $download['user_id'] === auth()->id(), 404);
+
+        Gate::authorize('canAccessTerminal');
+        $resource = $download['resource_type']::findOrFail($download['resource_id']);
+        Gate::authorize('view', $resource);
+        abort_unless((int) $resource->environment->project->team_id === (int) auth()->user()->currentTeam()->id, 403);
+
+        $filesystem = new ContainerFilesystemService(Server::findOrFail($download['server_id']), $download['container']);
+
+        return response()->streamDownload(function () use ($filesystem, $download) {
+            set_time_limit(0);
+            $filesystem->streamDownload($download['path'], $download['is_dir'], function (string $chunk) {
+                echo $chunk;
+                if (ob_get_level() > 0) {
+                    ob_flush();
+                }
+                flush();
+            });
+        }, $download['name'], [
+            'Content-Type' => 'application/octet-stream',
+            // Stop nginx from buffering the response to a temp file on the Coolify host.
+            'X-Accel-Buffering' => 'no',
+        ]);
+    }
+}
diff --git a/app/Http/Controllers/ProfileAvatarController.php b/app/Http/Controllers/ProfileAvatarController.php
index f53cef7c51..d390c26b3a 100644
--- a/app/Http/Controllers/ProfileAvatarController.php
+++ b/app/Http/Controllers/ProfileAvatarController.php
@@ -2,14 +2,24 @@
 
 namespace App\Http\Controllers;
 
+use App\Models\User;
 use App\Services\AvatarStorageService;
 use Illuminate\Http\Response;
 
 class ProfileAvatarController extends Controller
 {
-    public function __invoke(AvatarStorageService $avatarStorage): Response
+    public function __invoke(AvatarStorageService $avatarStorage, ?int $user_id = null): Response
     {
-        $contents = $avatarStorage->contents(auth()->user());
+        $user = auth()->user();
+
+        if ($user_id !== null && $user_id !== $user->id) {
+            $user = User::query()
+                ->whereKey($user_id)
+                ->whereHas('teams', fn ($query) => $query->whereIn('teams.id', auth()->user()->teams()->select('teams.id')))
+                ->firstOrFail();
+        }
+
+        $contents = $avatarStorage->contents($user);
         abort_if($contents === null, 404);
 
         return response($contents, 200, [
diff --git a/app/Http/Controllers/TeamAvatarController.php b/app/Http/Controllers/TeamAvatarController.php
new file mode 100644
index 0000000000..3dfed60b27
--- /dev/null
+++ b/app/Http/Controllers/TeamAvatarController.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Services\TeamAvatarStorageService;
+use Illuminate\Http\Response;
+
+class TeamAvatarController extends Controller
+{
+    public function __invoke(int $team_id, TeamAvatarStorageService $avatarStorage): Response
+    {
+        $team = auth()->user()->teams()->whereKey($team_id)->firstOrFail();
+        $contents = $avatarStorage->teamContents($team);
+
+        abort_if($contents === null, 404);
+
+        return response($contents, 200, [
+            'Content-Type' => 'image/jpeg',
+            'Cache-Control' => 'private, max-age=31536000, immutable',
+        ]);
+    }
+}
diff --git a/app/Http/Controllers/Webhook/Bitbucket.php b/app/Http/Controllers/Webhook/Bitbucket.php
index 489de7e5c5..3138d168a3 100644
--- a/app/Http/Controllers/Webhook/Bitbucket.php
+++ b/app/Http/Controllers/Webhook/Bitbucket.php
@@ -11,6 +11,7 @@ use App\Http\Controllers\Webhook\Concerns\ReadsWebhookPushPayload;
 use App\Http\Controllers\Webhook\Concerns\ValidatesPreviewDeploymentRepository;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
+use App\Services\ServerTransfer\TransferFinishChecklist;
 use Exception;
 use Illuminate\Http\Request;
 
@@ -132,6 +133,7 @@ class Bitbucket extends Controller
 
                     continue;
                 }
+                TransferFinishChecklist::recordWebhook('application', $application->uuid);
                 $isFunctional = $application->destination->server->isFunctional();
                 if (! $isFunctional) {
                     $return_payloads->push([
diff --git a/app/Http/Controllers/Webhook/Gitea.php b/app/Http/Controllers/Webhook/Gitea.php
index 6868ae8fac..bb34413b43 100644
--- a/app/Http/Controllers/Webhook/Gitea.php
+++ b/app/Http/Controllers/Webhook/Gitea.php
@@ -9,10 +9,15 @@ use App\Http\Controllers\Webhook\Concerns\DetectsSkipDeployCommits;
 use App\Http\Controllers\Webhook\Concerns\MatchesManualWebhookApplications;
 use App\Http\Controllers\Webhook\Concerns\ReadsWebhookPushPayload;
 use App\Http\Controllers\Webhook\Concerns\ValidatesPreviewDeploymentRepository;
+use App\Livewire\Source\Gitea\Change as GiteaSource;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
+use App\Models\GiteaApp;
+use App\Services\ServerTransfer\TransferFinishChecklist;
 use Exception;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
 
 class Gitea extends Controller
@@ -22,6 +27,340 @@ class Gitea extends Controller
     use ReadsWebhookPushPayload;
     use ValidatesPreviewDeploymentRepository;
 
+    public function redirect(Request $request)
+    {
+        try {
+            $code = $request->query('code');
+            $state = $request->query('state');
+
+            if (! $code || ! $state) {
+                return redirect()->route('source.all')->with('error', 'Invalid Gitea OAuth callback. Missing code or state.');
+            }
+
+            // Validate the one-time, team-bound state (not a guessable source UUID) to stop forged callbacks from overwriting a source's tokens.
+            $payload = Cache::pull(GiteaSource::oauthStateCacheKey($state));
+            $team_id = $request->user()?->currentTeam()?->id;
+            if (! is_array($payload) || is_null($team_id) || (int) data_get($payload, 'team_id') !== (int) $team_id) {
+                return redirect()->route('source.all')->with('error', 'Invalid or expired Gitea OAuth state. Please start the authorization again.');
+            }
+
+            $giteaApp = GiteaApp::whereKey(data_get($payload, 'gitea_app_id'))->firstOrFail();
+
+            // Only users who may administer the source can complete OAuth and store tokens.
+            if (! $request->user()->can('update', $giteaApp)) {
+                return redirect()->route('source.all')->with('error', 'You are not authorized to connect this Gitea App.');
+            }
+
+            $baseUrl = rtrim($giteaApp->html_url, '/');
+
+            $response = Http::GitSource($baseUrl)->asForm()->post("{$baseUrl}/login/oauth/access_token", [
+                'client_id' => $giteaApp->client_id,
+                'client_secret' => $giteaApp->client_secret,
+                'code' => $code,
+                'grant_type' => 'authorization_code',
+                'redirect_uri' => $giteaApp->redirect_uri,
+            ]);
+
+            if (! $response->successful()) {
+                $error = data_get($response->json(), 'error_description', 'Token exchange failed');
+
+                return redirect()->route('source.gitea.show', ['gitea_app_uuid' => $giteaApp->uuid])
+                    ->with('error', "Gitea OAuth failed: {$error}");
+            }
+
+            $data = $response->json();
+            $giteaApp->update([
+                'access_token' => $data['access_token'],
+                'refresh_token' => $data['refresh_token'],
+                'expires_at' => time() + ($data['expires_in'] ?? 3600),
+            ]);
+
+            return redirect()->route('source.gitea.show', ['gitea_app_uuid' => $giteaApp->uuid]);
+        } catch (Exception $e) {
+            return redirect()->route('source.all')->with('error', $e->getMessage());
+        }
+    }
+
+    public function normal(Request $request)
+    {
+        try {
+            $return_payloads = collect([]);
+            $x_gitea_event = Str::lower((string) $request->header('X-Gitea-Event'));
+
+            if ($x_gitea_event === 'ping') {
+                return response('pong');
+            }
+
+            if (! in_array($x_gitea_event, ['push', 'pull_request'], true)) {
+                return response([
+                    'status' => 'failed',
+                    'message' => 'Event not allowed. Only push and pull_request events are allowed.',
+                ]);
+            }
+
+            $signature = (string) $request->header('X-Gitea-Signature');
+            if ($signature === '') {
+                $signature = Str::after((string) $request->header('X-Hub-Signature-256'), 'sha256=');
+            }
+
+            if ($signature === '') {
+                auditLogWebhookFailure('gitea', 'webhook_signature_missing', [
+                    'event' => $x_gitea_event,
+                ]);
+
+                return response([
+                    'status' => 'failed',
+                    'message' => 'Missing webhook signature.',
+                ], 401);
+            }
+
+            $gitea_app = GiteaApp::findBySignature($request->getContent(), $signature);
+            if (! $gitea_app) {
+                auditLogWebhookFailure('gitea', 'invalid_signature', [
+                    'event' => $x_gitea_event,
+                ]);
+
+                return response([
+                    'status' => 'failed',
+                    'message' => 'Invalid webhook signature.',
+                ], 401);
+            }
+
+            $payload = $request->collect();
+            if (! $request->isJson()) {
+                $form_payload = data_get($payload, 'payload');
+                $payload = is_string($form_payload) ? json_decode($form_payload, true) : null;
+            }
+
+            $repository_id = $this->webhookPayloadDatabaseId($payload, 'repository.id', required: true);
+            $applications = Application::where('source_id', $gitea_app->id)
+                ->where('source_type', GiteaApp::class)
+                ->where('repository_project_id', $repository_id);
+
+            if ($x_gitea_event === 'push') {
+                $branch = $this->webhookPushBranch(data_get($payload, 'ref'));
+                if (! $branch) {
+                    return response([
+                        'status' => 'failed',
+                        'message' => 'No branch found in the request.',
+                    ]);
+                }
+                if ($this->isWebhookBranchDeletionPush($payload)) {
+                    return response([
+                        'status' => 'skipped',
+                        'message' => 'Nothing to do. Branch deleted.',
+                    ]);
+                }
+                $commit = $this->webhookCommitSha($payload, 'after');
+
+                $applications = $applications->where('git_branch', $branch)->get();
+                $changed_files = $this->webhookPushChangedFiles($payload);
+                $skip_deploy_commits = self::shouldSkipDeploy($this->webhookPushCommitMessages($payload));
+
+                foreach ($applications as $application) {
+                    if (! $application->destination->server->isFunctional()) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Server is not functional',
+                        ]);
+
+                        continue;
+                    }
+
+                    if (! $application->isDeployable()) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Deployments disabled',
+                        ]);
+
+                        continue;
+                    }
+
+                    if (! $this->webhookPushMatchesWatchPaths($application, $changed_files)) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Changed files do not match watch paths.',
+                        ]);
+
+                        continue;
+                    }
+
+                    if ($skip_deploy_commits) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'skipped',
+                            'message' => 'All commits contain [skip cd] or [skip ci].',
+                        ]);
+
+                        continue;
+                    }
+
+                    $deployment_uuid = new_public_id();
+                    $result = queue_application_deployment(
+                        application: $application,
+                        deployment_uuid: $deployment_uuid,
+                        commit: $commit ?? 'HEAD',
+                        force_rebuild: false,
+                        is_webhook: true,
+                    );
+
+                    if ($result['status'] === 'queue_full') {
+                        return response($result['message'], 429)->header('Retry-After', 60);
+                    }
+
+                    auditLog('webhook.deployment.queued', [
+                        'provider' => 'gitea',
+                        'mode' => 'app',
+                        'application_uuid' => $application->uuid,
+                        'application_name' => $application->name,
+                        'deployment_uuid' => $deployment_uuid,
+                        'commit' => $commit,
+                    ]);
+
+                    $return_payloads->push([
+                        'application' => $application->name,
+                        'status' => $result['status'] ?? 'success',
+                        'message' => $result['message'] ?? 'Deployment queued.',
+                    ]);
+                }
+            }
+
+            if ($x_gitea_event === 'pull_request') {
+                $branch = $this->webhookString(data_get($payload, 'pull_request.head.ref'));
+                $base_branch = $this->webhookString(data_get($payload, 'pull_request.base.ref'));
+                if (! $branch || ! $base_branch) {
+                    return response([
+                        'status' => 'failed',
+                        'message' => 'No branch found in the request.',
+                    ]);
+                }
+                [
+                    'action' => $action,
+                    'pull_request_id' => $pull_request_id,
+                    'pull_request_html_url' => $pull_request_html_url,
+                    'commit' => $commit,
+                    'skip_deploy' => $skip_deploy_pr,
+                ] = $this->readPullRequestPayload($payload);
+
+                $applications = $applications->where('git_branch', $base_branch)->get();
+
+                foreach ($applications as $application) {
+                    if (! $application->destination->server->isFunctional()) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Server is not functional',
+                        ]);
+
+                        continue;
+                    }
+
+                    if (in_array($action, ['opened', 'synchronized', 'reopened'], true)) {
+                        if (! $application->isPRDeployable()) {
+                            $return_payloads->push([
+                                'application' => $application->name,
+                                'status' => 'failed',
+                                'message' => 'Preview deployments disabled',
+                            ]);
+
+                            continue;
+                        }
+
+                        if (! $this->isPreviewDeploymentRepositoryTrusted(
+                            data_get($payload, 'pull_request.head.repo.id'),
+                            data_get($payload, 'pull_request.base.repo.id'),
+                            data_get($payload, 'repository.id'),
+                            $application->settings->is_pr_deployments_public_enabled,
+                        )) {
+                            continue;
+                        }
+
+                        if ($skip_deploy_pr) {
+                            $return_payloads->push([
+                                'application' => $application->name,
+                                'status' => 'skipped',
+                                'message' => 'PR title contains [skip cd] or [skip ci].',
+                            ]);
+
+                            continue;
+                        }
+
+                        $deployment_uuid = new_public_id();
+                        $found = ApplicationPreview::where('application_id', $application->id)
+                            ->where('pull_request_id', $pull_request_id)
+                            ->first();
+
+                        if (! $found) {
+                            if ($application->build_pack === 'dockercompose') {
+                                $pr_app = ApplicationPreview::create([
+                                    'git_type' => 'gitea',
+                                    'application_id' => $application->id,
+                                    'pull_request_id' => $pull_request_id,
+                                    'pull_request_html_url' => $pull_request_html_url ?? '',
+                                    'docker_compose_domains' => $application->docker_compose_domains,
+                                ]);
+                                $pr_app->generate_preview_fqdn_compose();
+                            } else {
+                                $pr_app = ApplicationPreview::create([
+                                    'git_type' => 'gitea',
+                                    'application_id' => $application->id,
+                                    'pull_request_id' => $pull_request_id,
+                                    'pull_request_html_url' => $pull_request_html_url ?? '',
+                                ]);
+                                $pr_app->generate_preview_fqdn();
+                            }
+                        }
+
+                        $result = queue_application_deployment(
+                            application: $application,
+                            pull_request_id: $pull_request_id,
+                            deployment_uuid: $deployment_uuid,
+                            commit: $commit ?? 'HEAD',
+                            force_rebuild: false,
+                            is_webhook: true,
+                            git_type: 'gitea',
+                        );
+
+                        if ($result['status'] === 'queue_full') {
+                            return response($result['message'], 429)->header('Retry-After', 60);
+                        }
+
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => $result['status'] ?? 'success',
+                            'message' => $result['message'] ?? 'Preview deployment queued.',
+                        ]);
+                    } elseif ($action === 'closed') {
+                        $found = ApplicationPreview::where('application_id', $application->id)
+                            ->where('pull_request_id', $pull_request_id)
+                            ->first();
+
+                        if ($found) {
+                            CleanupPreviewDeployment::run($application, $pull_request_id, $found);
+                            $return_payloads->push([
+                                'application' => $application->name,
+                                'status' => 'success',
+                                'message' => 'Preview deployment closed.',
+                            ]);
+                        }
+                    }
+                }
+            }
+
+            return response($return_payloads);
+        } catch (InvalidWebhookPayloadException $e) {
+            return response([
+                'status' => 'failed',
+                'message' => $e->getMessage(),
+            ]);
+        } catch (Exception $e) {
+            return handleError($e);
+        }
+    }
+
     public function manual(Request $request)
     {
         try {
@@ -51,15 +390,16 @@ class Gitea extends Controller
                 $skip_deploy_commits = self::shouldSkipDeploy($this->webhookPushCommitMessages($payload));
             }
             if ($x_gitea_event === 'pull_request') {
-                $action = $this->webhookPayloadString($payload, 'action');
                 $full_name = data_get($payload, 'repository.full_name');
-                $pull_request_id = $this->webhookPullRequestId($payload, 'number');
-                $pull_request_html_url = $this->webhookPayloadUrl($payload, 'pull_request.html_url');
-                $skip_deploy_pr = self::shouldSkipDeployAny([$this->webhookPayloadString($payload, 'pull_request.title')]);
                 $branch = $this->webhookString(data_get($payload, 'pull_request.head.ref'));
                 $base_branch = $this->webhookString(data_get($payload, 'pull_request.base.ref'));
-                // Gitea sends the head commit in pull_request.head.sha; newer versions also send it as after.
-                $commit = $this->webhookCommitSha($payload, 'pull_request.head.sha') ?? $this->webhookCommitSha($payload, 'after');
+                [
+                    'action' => $action,
+                    'pull_request_id' => $pull_request_id,
+                    'pull_request_html_url' => $pull_request_html_url,
+                    'commit' => $commit,
+                    'skip_deploy' => $skip_deploy_pr,
+                ] = $this->readPullRequestPayload($payload);
             }
             if (! $branch || ($x_gitea_event === 'pull_request' && ! $base_branch)) {
                 return response('Nothing to do. No branch found in the request.');
@@ -117,6 +457,7 @@ class Gitea extends Controller
 
                     continue;
                 }
+                TransferFinishChecklist::recordWebhook('application', $application->uuid);
                 $isFunctional = $application->destination->server->isFunctional();
                 if (! $isFunctional) {
                     $return_payloads->push([
@@ -301,4 +642,23 @@ class Gitea extends Controller
             return handleError($e);
         }
     }
+
+    /**
+     * Read and validate the pull_request payload fields that the handlers use.
+     *
+     * @return array{action: ?string, pull_request_id: int, pull_request_html_url: ?string, commit: ?string, skip_deploy: bool}
+     *
+     * @throws InvalidWebhookPayloadException When a field has a wrong type or format.
+     */
+    private function readPullRequestPayload(mixed $payload): array
+    {
+        return [
+            'action' => $this->webhookPayloadString($payload, 'action'),
+            'pull_request_id' => $this->webhookPullRequestId($payload, 'number'),
+            'pull_request_html_url' => $this->webhookPayloadUrl($payload, 'pull_request.html_url'),
+            // Gitea sends the head commit in pull_request.head.sha; newer versions also send it as after.
+            'commit' => $this->webhookCommitSha($payload, 'pull_request.head.sha') ?? $this->webhookCommitSha($payload, 'after'),
+            'skip_deploy' => self::shouldSkipDeployAny([$this->webhookPayloadString($payload, 'pull_request.title')]),
+        ];
+    }
 }
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index c6a1596143..77e2979ccf 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -19,6 +19,7 @@ use App\Models\GithubRunnerExecution;
 use App\Models\PrivateKey;
 use App\Services\GithubRunner\GithubRunnerApi;
 use App\Services\GithubRunner\GithubRunnerContainer;
+use App\Services\ServerTransfer\TransferFinishChecklist;
 use Exception;
 use Illuminate\Http\Exceptions\HttpResponseException;
 use Illuminate\Http\RedirectResponse;
@@ -135,6 +136,7 @@ class Github extends Controller
 
                         continue;
                     }
+                    TransferFinishChecklist::recordWebhook('application', $application->uuid);
                     $isFunctional = $application->destination->server->isFunctional();
                     if (! $isFunctional) {
                         $return_payloads->push([
@@ -431,6 +433,7 @@ class Github extends Controller
                     return response('Invalid signature.');
                 }
             }
+            TransferFinishChecklist::recordWebhook('github_app', $github_app->uuid);
             if ($x_github_event === 'installation' || $x_github_event === 'installation_repositories') {
                 // Installation handled by setup redirect url. Repositories queried on-demand.
                 $action = data_get($payload, 'action');
@@ -480,6 +483,7 @@ class Github extends Controller
             }
             $applications = Application::where('repository_project_id', $id)
                 ->where('source_id', $github_app->id)
+                ->where('source_type', GithubApp::class)
                 ->whereRelation('source', 'is_public', false);
             if ($x_github_event === 'push') {
                 $applications = $applications->where('git_branch', $branch)->get();
diff --git a/app/Http/Controllers/Webhook/Gitlab.php b/app/Http/Controllers/Webhook/Gitlab.php
index 3d4d22cd85..892408976d 100644
--- a/app/Http/Controllers/Webhook/Gitlab.php
+++ b/app/Http/Controllers/Webhook/Gitlab.php
@@ -13,8 +13,10 @@ use App\Livewire\Source\Gitlab\Change as GitlabSource;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\GitlabApp;
+use App\Services\ServerTransfer\TransferFinishChecklist;
 use Exception;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 
@@ -84,6 +86,9 @@ class Gitlab extends Controller
         try {
             $return_payloads = collect([]);
             $payload = $request->collect();
+            if ($request->header('X-Gitlab-Event') === 'System Hook') {
+                $payload = $this->normalizeSystemHookPayload($payload);
+            }
             $x_gitlab_token = $request->header('X-Gitlab-Token');
             $object_kind = $this->webhookString(data_get($payload, 'object_kind'));
 
@@ -118,6 +123,7 @@ class Gitlab extends Controller
                 ], 401);
             }
 
+            TransferFinishChecklist::recordWebhook('gitlab_app', $gitlab_app->uuid);
             $project_id = $this->webhookPayloadDatabaseId($payload, 'project.id', required: true);
             $applications = Application::where('source_id', $gitlab_app->id)
                 ->where('source_type', GitlabApp::class)
@@ -475,6 +481,7 @@ class Gitlab extends Controller
 
                     continue;
                 }
+                TransferFinishChecklist::recordWebhook('application', $application->uuid);
                 $isFunctional = $application->destination->server->isFunctional();
                 if (! $isFunctional) {
                     $return_payloads->push([
@@ -667,6 +674,30 @@ class Gitlab extends Controller
         }
     }
 
+    /**
+     * Give a system hook payload the project webhook shape. Current GitLab sends
+     * the project webhook data to system hooks, but the documented push payload
+     * has only `event_name` and a top-level `project_id`.
+     *
+     * @see https://docs.gitlab.com/administration/system_hooks/#push-events
+     *
+     * @param  Collection<string, mixed>  $payload
+     * @return Collection<string, mixed>
+     */
+    private function normalizeSystemHookPayload(Collection $payload): Collection
+    {
+        if (! $payload->has('object_kind') && $payload->has('event_name')) {
+            $payload->put('object_kind', $payload->get('event_name'));
+        }
+
+        $project = $payload->get('project');
+        if (is_array($project) && ! array_key_exists('id', $project) && $payload->has('project_id')) {
+            $payload->put('project', ['id' => $payload->get('project_id')] + $project);
+        }
+
+        return $payload;
+    }
+
     /**
      * Read and validate the merge_request payload fields that the handlers use.
      *
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index a42af07c27..48710f88fe 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -4,6 +4,7 @@ namespace App\Http;
 
 use App\Http\Middleware\AddServerTimingHeaders;
 use App\Http\Middleware\ApiAbility;
+use App\Http\Middleware\ApiIpAllowed;
 use App\Http\Middleware\ApiSensitiveData;
 use App\Http\Middleware\Authenticate;
 use App\Http\Middleware\CanAccessTerminal;
@@ -116,6 +117,7 @@ class Kernel extends HttpKernel
         'can.update.resource' => CanUpdateResource::class,
         'can.access.terminal' => CanAccessTerminal::class,
         'mcp.enabled' => EnsureMcpEnabled::class,
+        'api.ip.allowed' => ApiIpAllowed::class,
         'mcp.team.enabled' => EnsureTeamMcpEnabled::class,
     ];
 }
diff --git a/app/Http/Middleware/ApiAllowed.php b/app/Http/Middleware/ApiAllowed.php
index 34e20d2617..541bf3919a 100644
--- a/app/Http/Middleware/ApiAllowed.php
+++ b/app/Http/Middleware/ApiAllowed.php
@@ -13,7 +13,11 @@ class ApiAllowed
         if (isCloud()) {
             return $next($request);
         }
-        if (instanceSettings()->is_api_enabled === false) {
+
+        // MCP write tools run REST routes internally; MCP has its own enable switch.
+        $isMcpRestBridge = $request->attributes->get('mcp_rest_bridge') === true;
+
+        if (! $isMcpRestBridge && instanceSettings()->is_api_enabled === false) {
             return response()->json(['success' => true, 'message' => 'API is disabled.'], 403);
         }
 
diff --git a/app/Http/Middleware/CanAccessTerminal.php b/app/Http/Middleware/CanAccessTerminal.php
index 348f389ea9..94dbae9874 100644
--- a/app/Http/Middleware/CanAccessTerminal.php
+++ b/app/Http/Middleware/CanAccessTerminal.php
@@ -11,7 +11,7 @@ class CanAccessTerminal
     /**
      * Handle an incoming request.
      *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     * @param  Closure(Request): (Response)  $next
      */
     public function handle(Request $request, Closure $next): Response
     {
diff --git a/app/Http/Middleware/CheckForcePasswordReset.php b/app/Http/Middleware/CheckForcePasswordReset.php
index c857cb8363..ad7f6aa42c 100644
--- a/app/Http/Middleware/CheckForcePasswordReset.php
+++ b/app/Http/Middleware/CheckForcePasswordReset.php
@@ -11,7 +11,7 @@ class CheckForcePasswordReset
     /**
      * Handle an incoming request.
      *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     * @param  Closure(Request): (Response)  $next
      */
     public function handle(Request $request, Closure $next): Response
     {
diff --git a/app/Http/Middleware/ConfigurePasskeys.php b/app/Http/Middleware/ConfigurePasskeys.php
new file mode 100644
index 0000000000..e5465c28a4
--- /dev/null
+++ b/app/Http/Middleware/ConfigurePasskeys.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\PasskeyRelyingParty;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class ConfigurePasskeys
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! $request->routeIs('passkey.*')) {
+            return $next($request);
+        }
+
+        $relyingParty = instanceSettings()->is_passkey_enabled ? PasskeyRelyingParty::resolve($request) : null;
+        abort_if($relyingParty === null, 404);
+
+        config([
+            'passkeys.relying_party_id' => $relyingParty['id'],
+            'passkeys.allowed_origins' => $relyingParty['origins'],
+        ]);
+
+        return $next($request);
+    }
+}
diff --git a/app/Http/Middleware/RedirectIfAuthenticated.php b/app/Http/Middleware/RedirectIfAuthenticated.php
index afc78c4e53..b92e43f7ec 100644
--- a/app/Http/Middleware/RedirectIfAuthenticated.php
+++ b/app/Http/Middleware/RedirectIfAuthenticated.php
@@ -13,7 +13,7 @@ class RedirectIfAuthenticated
     /**
      * Handle an incoming request.
      *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     * @param  Closure(Request): (Response)  $next
      */
     public function handle(Request $request, Closure $next, string ...$guards): Response
     {
diff --git a/app/Http/Middleware/UseSessionTeamApiToken.php b/app/Http/Middleware/UseSessionTeamApiToken.php
new file mode 100644
index 0000000000..821b4e5f0f
--- /dev/null
+++ b/app/Http/Middleware/UseSessionTeamApiToken.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Laravel\Sanctum\PersonalAccessToken;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Lets the deploy canvas call API controllers with the browser session.
+ *
+ * Gives the session user an in-memory (never saved) API token for the team of
+ * the canvas page (the X-Canvas-Team header, set when the page was opened), not
+ * the session team, so switching teams in another tab does not change an open
+ * canvas. The token has the abilities an API token of that user may have:
+ * admins and owners get read, write, deploy and read:sensitive, members get
+ * read only. The usual API middleware (api.token.team rejects teams the user is
+ * not a member of, api.ability, api.sensitive) and controllers then enforce
+ * team scope and permissions as for a real token.
+ */
+class UseSessionTeamApiToken
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+        $teamId = $request->header('X-Canvas-Team');
+
+        if (! $user) {
+            return response()->json(['message' => 'Unauthenticated.'], 401);
+        }
+        if (! is_string($teamId) || ! ctype_digit($teamId)) {
+            return response()->json(['message' => 'Missing canvas team.'], 400);
+        }
+        $teamId = (int) $teamId;
+
+        $abilities = $user->isAdminOfTeam($teamId)
+            ? ['read', 'write', 'deploy', 'read:sensitive']
+            : ['read'];
+
+        $token = new PersonalAccessToken;
+        $token->forceFill([
+            'name' => 'deploy-canvas-session',
+            'team_id' => $teamId,
+            'abilities' => $abilities,
+        ]);
+        $user->withAccessToken($token);
+
+        return $next($request);
+    }
+}
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 80b92f7723..eefc9880bb 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -13,7 +13,9 @@ use App\Exceptions\DeploymentException;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\ApplicationPreview;
+use App\Models\ApplicationSetting;
 use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\Server;
@@ -109,7 +111,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private ?string $dockerImagePreviewTag = null;
 
-    private GithubApp|GitlabApp|string $source = 'other';
+    private GithubApp|GitlabApp|GiteaApp|string $source = 'other';
 
     private StandaloneDocker|SwarmDocker $destination;
 
@@ -635,6 +637,15 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             \Log::warning('Post deployment command failed for '.$this->deployment_uuid.': '.$e->getMessage());
         }
 
+        // Domains can change with a deployment, so the maintenance routes follow them.
+        if ($this->pull_request_id === 0 && $this->application->is_maintenance_enabled) {
+            try {
+                $this->application->syncMaintenancePage();
+            } catch (Exception $e) {
+                \Log::warning('Maintenance page update failed for '.$this->deployment_uuid.': '.$e->getMessage());
+            }
+        }
+
     }
 
     private function deploy_simple_dockerfile()
@@ -1575,6 +1586,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             'save' => 'local_image_found',
         ]);
         if (str($this->saved_outputs->get('local_image_found'))->isEmpty() && $this->application->docker_registry_image_name) {
+            $this->application_deployment_queue->addLogEntry("Image ({$this->production_image_name}) not found on the server. Pulling it from the Docker registry.");
             $this->execute_remote_command([
                 'docker pull '.escapeshellarg($this->production_image_name).' 2>/dev/null',
                 'ignore_errors' => true,
@@ -3554,12 +3566,20 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         return $variables;
     }
 
+    /**
+     * Without the `...` entry, the list replaces the packages that Railpack generates
+     * (for example libatomic1, which Node.js 25+ needs at runtime).
+     */
     private function merge_railpack_deploy_apt_packages(Collection $variables): Collection
     {
         $packages = collect(preg_split('/\s+/', trim((string) $variables->get('RAILPACK_DEPLOY_APT_PACKAGES', ''))) ?: [])
             ->filter()
             ->values();
 
+        if (! $packages->contains('...')) {
+            $packages->prepend('...');
+        }
+
         foreach (['curl', 'wget'] as $package) {
             if (! $packages->contains($package)) {
                 $packages->push($package);
@@ -3645,7 +3665,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             ." {$this->workdir}";
 
         return 'DOCKER_CONFIG=/root/.docker docker buildx create --name coolify-railpack --driver docker-container 2>/dev/null || true'
-            .' && '.$this->wrap_build_command_with_env_export($buildxBuildCommand);
+            ."\n".railpackBuilderLockedScript('('.$this->wrap_build_command_with_env_export($buildxBuildCommand).')');
     }
 
     private function decode_railpack_config(string $config, string $source): array
@@ -4245,25 +4265,14 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             $docker_compose['services'][$this->container_name]['labels'] = $labels;
         }
         if ($this->mainServer->isLogDrainEnabled() && $this->application->isLogDrainEnabled()) {
-            $docker_compose['services'][$this->container_name]['logging'] = generate_fluentd_configuration();
+            $docker_compose['services'][$this->container_name]['logging'] = generate_log_drain_configuration($this->mainServer);
         }
         if ($this->application->settings->is_gpu_enabled) {
             $docker_compose['services'][$this->container_name]['deploy']['resources']['reservations']['devices'] = [
-                [
-                    'driver' => data_get($this->application, 'settings.gpu_driver', 'nvidia'),
-                    'capabilities' => ['gpu'],
-                    'options' => data_get($this->application, 'settings.gpu_options', []),
-                ],
+                $this->application->settings->gpuDeviceReservation(),
             ];
-            if (data_get($this->application, 'settings.gpu_count')) {
-                $count = data_get($this->application, 'settings.gpu_count');
-                if ($count === 'all') {
-                    $docker_compose['services'][$this->container_name]['deploy']['resources']['reservations']['devices'][0]['count'] = $count;
-                } else {
-                    $docker_compose['services'][$this->container_name]['deploy']['resources']['reservations']['devices'][0]['count'] = (int) $count;
-                }
-            } elseif (data_get($this->application, 'settings.gpu_device_ids')) {
-                $docker_compose['services'][$this->container_name]['deploy']['resources']['reservations']['devices'][0]['ids'] = data_get($this->application, 'settings.gpu_device_ids');
+            if (ApplicationSetting::parseGpuOptions($this->application->settings->gpu_options) === null) {
+                $this->application_deployment_queue->addLogEntry('GPU options are not a valid key=value list or YAML mapping. They are ignored.');
             }
         }
         if ($this->application->isHealthcheckDisabled()) {
@@ -4293,6 +4302,10 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
 
         if ($this->pull_request_id === 0) {
             $custom_compose = convertDockerRunToCompose($this->application->custom_docker_run_options);
+            if ($this->application->settings->is_gpu_enabled && data_get($custom_compose, 'deploy.resources.reservations.devices')) {
+                data_forget($custom_compose, 'deploy.resources.reservations.devices');
+                $this->application_deployment_queue->addLogEntry('GPU access is enabled in the GPU settings, so --gpus in Custom Docker Options is ignored.');
+            }
             $unsupported_options = unsupportedDockerRunOptions($this->application->custom_docker_run_options);
             if (count($unsupported_options) > 0) {
                 $this->application_deployment_queue->addLogEntry('Warning: These custom Docker options are not supported and were not applied: '.implode(', ', $unsupported_options).'. See https://coolify.io/docs/applications/builds/custom-docker-options for the supported options.', 'stderr');
@@ -6054,9 +6067,11 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         }
 
         $unsuccessful = $deployments->first(fn (ApplicationDeploymentQueue $deployment) => $deployment->status !== ApplicationDeploymentStatus::FINISHED->value);
+        // Additional servers pull the image and do not clone, so only the main deployment has the commit message.
+        $parentDeployment = ApplicationDeploymentQueue::query()->where('deployment_uuid', $parentDeploymentUuid)->first();
         $this->application->environment->project->team?->notify($unsuccessful
-            ? new DeploymentFailed($this->application, $unsuccessful->deployment_uuid, $this->preview)
-            : new DeploymentSuccess($this->application, $parentDeploymentUuid, $this->preview));
+            ? new DeploymentFailed($this->application, $unsuccessful->deployment_uuid, $this->preview, $parentDeployment)
+            : new DeploymentSuccess($this->application, $parentDeploymentUuid, $this->preview, $parentDeployment));
     }
 
     /**
@@ -6065,7 +6080,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
     private function sendDeploymentNotification(string $notificationClass): void
     {
         $this->application->environment->project->team?->notify(
-            new $notificationClass($this->application, $this->deployment_uuid, $this->preview)
+            new $notificationClass($this->application, $this->deployment_uuid, $this->preview, $this->application_deployment_queue)
         );
     }
 
@@ -6091,7 +6106,9 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
     {
         $this->failDeployment();
 
-        // Log comprehensive error information
+        // failed() runs on a fresh job instance, so remote secrets fetched during the deployment are not loaded here.
+        // Every entry still passes through ApplicationDeploymentQueue::redactLogText(); raw stack traces are not written
+        // because their truncated arguments can hold partial secrets that redaction cannot match.
         $errorMessage = $exception->getMessage() ?: 'Unknown error occurred';
         $errorCode = $exception->getCode();
         $errorClass = get_class($exception);
@@ -6119,14 +6136,6 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             $this->application_deployment_queue->addLogEntry("  {$previousClass}: {$previousMessage}", 'stderr', hidden: true);
             $this->application_deployment_queue->addLogEntry("  at {$previous->getFile()}:{$previous->getLine()}", 'stderr', hidden: true);
         }
-
-        // Log first few lines of stack trace for debugging
-        $trace = $exception->getTraceAsString();
-        $traceLines = explode("\n", $trace);
-        $this->application_deployment_queue->addLogEntry('Stack trace (first 5 lines):', 'stderr', hidden: true);
-        foreach (array_slice($traceLines, 0, 5) as $traceLine) {
-            $this->application_deployment_queue->addLogEntry("  {$traceLine}", 'stderr', hidden: true);
-        }
         $this->application_deployment_queue->addLogEntry('========================================', 'stderr');
 
         if ($this->application->build_pack !== 'dockercompose') {
diff --git a/app/Jobs/CheckForUpdatesJob.php b/app/Jobs/CheckForUpdatesJob.php
index b4cb7fe705..2c16b4475e 100644
--- a/app/Jobs/CheckForUpdatesJob.php
+++ b/app/Jobs/CheckForUpdatesJob.php
@@ -8,81 +8,35 @@ use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
-use Illuminate\Support\Facades\File;
-use Illuminate\Support\Facades\Http;
-use Illuminate\Support\Facades\Log;
 
 class CheckForUpdatesJob implements ShouldBeEncrypted, ShouldQueue
 {
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
+    /** A manual check runs in the web request, so it does not wait for CDN retries. */
+    public int $cdnTries = 3;
+
+    public function __construct(int $cdnTries = 3)
+    {
+        $this->cdnTries = $cdnTries;
+    }
+
     public function handle(): void
     {
         try {
             if (isDev() || isCloud()) {
                 return;
             }
-            $settings = instanceSettings();
-            $response = Http::retry(3, 1000)->get(config('constants.coolify.versions_url'));
-            if ($response->successful()) {
-                $versions = $response->json();
-
-                $latest_version = data_get($versions, 'coolify.v4.version');
-                $current_version = config('constants.coolify.version');
-
-                // Read existing cached version
-                $existingVersions = null;
-                $existingCoolifyVersion = null;
-                if (File::exists(base_path('versions.json'))) {
-                    $existingVersions = json_decode(File::get(base_path('versions.json')), true);
-                    $existingCoolifyVersion = data_get($existingVersions, 'coolify.v4.version');
-                }
-
-                // Determine the BEST version to use (CDN, cache, or current)
-                $bestVersion = $latest_version;
-
-                // Check if cache has newer version than CDN
-                if ($existingCoolifyVersion && version_compare($existingCoolifyVersion, $bestVersion, '>')) {
-                    Log::warning('CDN served older Coolify version than cache', [
-                        'cdn_version' => $latest_version,
-                        'cached_version' => $existingCoolifyVersion,
-                        'current_version' => $current_version,
-                    ]);
-                    $bestVersion = $existingCoolifyVersion;
-                }
-
-                // CRITICAL: Never allow bestVersion to be older than currently running version
-                if (version_compare($bestVersion, $current_version, '<')) {
-                    Log::warning('Version downgrade prevented in CheckForUpdatesJob', [
-                        'cdn_version' => $latest_version,
-                        'cached_version' => $existingCoolifyVersion,
-                        'current_version' => $current_version,
-                        'attempted_best' => $bestVersion,
-                        'using' => $current_version,
-                    ]);
-                    $bestVersion = $current_version;
-                }
-
-                // Use data_set() for safe mutation (fixes #3)
-                data_set($versions, 'coolify.v4.version', $bestVersion);
-                $latest_version = $bestVersion;
-
-                // ALWAYS write versions.json (for Sentinel, Helper, Traefik updates)
-                File::put(base_path('versions.json'), json_encode($versions, JSON_PRETTY_PRINT));
-
-                // Invalidate cache to ensure fresh data is loaded
-                invalidate_versions_cache();
-
-                CheckTraefikVersionJob::dispatch();
-
-                // Only mark new version available if Coolify version actually increased
-                if (version_compare($latest_version, $current_version, '>')) {
-                    // New version available
-                    $settings->update(['new_version_available' => true]);
-                } else {
-                    $settings->update(['new_version_available' => false]);
-                }
+            $versions = refresh_versions_file($this->cdnTries);
+            if ($versions === null) {
+                return;
             }
+
+            CheckTraefikVersionJob::dispatch();
+
+            $latestVersion = data_get($versions, 'coolify.v4.version');
+            $newVersionAvailable = version_compare($latestVersion, config('constants.coolify.version'), '>');
+            instanceSettings()->update(['new_version_available' => $newVersionAvailable]);
         } catch (\Throwable $e) {
             // Consider implementing a notification to administrators
         }
diff --git a/app/Jobs/CheckHelperImageJob.php b/app/Jobs/CheckHelperImageJob.php
index 56118a238a..8b8dd16f06 100644
--- a/app/Jobs/CheckHelperImageJob.php
+++ b/app/Jobs/CheckHelperImageJob.php
@@ -8,31 +8,18 @@ use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
-use Illuminate\Support\Facades\Http;
-use Illuminate\Support\Facades\Log;
 
 class CheckHelperImageJob implements ShouldBeEncrypted, ShouldQueue
 {
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
-    public $timeout = 1000;
-
     public function __construct() {}
 
+    /**
+     * Reads the local versions.json. CheckForUpdatesJob refreshes it from the CDN every hour.
+     */
     public function handle(): void
     {
-        $response = Http::retry(3, 1000, throw: false)->get(config('constants.coolify.versions_url'));
-        if ($response->failed()) {
-            // The CDN can be briefly unavailable. The next scheduled run tries again, so do not notify.
-            Log::warning('CheckHelperImageJob could not fetch versions', ['status' => $response->status()]);
-
-            return;
-        }
-
-        $latest_version = data_get($response->json(), 'coolify.helper.version');
-        $settings = instanceSettings();
-        if (version_compare($latest_version, $settings->helper_version, '>')) {
-            $settings->update(['helper_version' => $latest_version]);
-        }
+        update_helper_version(get_versions_data());
     }
 }
diff --git a/app/Jobs/CheckTransferFinishStepsJob.php b/app/Jobs/CheckTransferFinishStepsJob.php
new file mode 100644
index 0000000000..ebd47f5871
--- /dev/null
+++ b/app/Jobs/CheckTransferFinishStepsJob.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Server;
+use App\Services\ServerTransfer\TransferFinishChecklist;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * Checks the open steps of the "Finish the transfer" list in the background, so the page stays fast while
+ * checks call SSH, GitHub, Cloudflare, DNS, and S3. One run per server at a time.
+ */
+class CheckTransferFinishStepsJob implements ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = 120;
+
+    public int $uniqueFor = 120;
+
+    public function __construct(public Server $server) {}
+
+    public function uniqueId(): string
+    {
+        return (string) $this->server->id;
+    }
+
+    public function handle(TransferFinishChecklist $checklist): void
+    {
+        $checklist->checkAll($this->server);
+    }
+}
diff --git a/app/Jobs/CleanupGithubRunnerJob.php b/app/Jobs/CleanupGithubRunnerJob.php
index baca8504f0..2caf75f505 100644
--- a/app/Jobs/CleanupGithubRunnerJob.php
+++ b/app/Jobs/CleanupGithubRunnerJob.php
@@ -36,6 +36,14 @@ class CleanupGithubRunnerJob implements ShouldQueue
             return;
         }
 
+        // Another Coolify instance manages a transferred server and its runners: never touch them from here.
+        if ($execution->server?->isTransferredAway()) {
+            Log::info('Skipped GitHub runner cleanup: the server was transferred to another instance', ['execution' => $execution->uuid]);
+            ProvisionGithubRunnerJob::dispatchQueued($execution->github_app_id);
+
+            return;
+        }
+
         if ($execution->server) {
             instant_remote_process(GithubRunnerContainer::cleanupCommands($execution->uuid), $execution->server, false);
         }
diff --git a/app/Jobs/CoolifyTask.php b/app/Jobs/CoolifyTask.php
index cac687fc85..fe7237ccf4 100755
--- a/app/Jobs/CoolifyTask.php
+++ b/app/Jobs/CoolifyTask.php
@@ -99,14 +99,17 @@ class CoolifyTask implements ShouldBeEncrypted, ShouldQueue
             'job' => 'CoolifyTask',
             'activity_id' => $this->activity->id,
             'server_uuid' => $this->activity->getExtraProperty('server_uuid'),
-            'error' => $exception?->getMessage(),
+            'error' => $exception ? remove_iip($exception->getMessage()) : null,
             'total_attempts' => $this->attempts(),
             'trace' => $exception?->getTraceAsString(),
         ]);
 
         // A database import whose restore can still run in the database container stays in progress
         // until its stop has run, so it keeps blocking other operations on the database.
-        if (DatabaseImportCleanup::stopAfterTaskFailure($this->activity, $exception?->getMessage() ?: 'Job permanently failed')) {
+        // The message can contain command output or the SSH command, so store only a redacted copy.
+        $message = filled($exception?->getMessage()) ? remove_iip($exception->getMessage()) : null;
+
+        if (DatabaseImportCleanup::stopAfterTaskFailure($this->activity, $message ?: 'Job permanently failed')) {
             RemoteProcessCommand::forget($this->activity);
 
             return;
@@ -118,7 +121,7 @@ class CoolifyTask implements ShouldBeEncrypted, ShouldQueue
         $stopRequested = DatabaseImportCleanup::stopRequested($this->activity);
         $this->activity->properties = $this->activity->properties->merge(array_filter([
             'status' => ProcessStatus::ERROR->value,
-            'error' => $stopRequested ? null : ($exception?->getMessage() ?? 'Job permanently failed'),
+            'error' => $stopRequested ? null : ($message ?? 'Job permanently failed'),
             'failed_at' => now()->toIso8601String(),
         ], fn ($value) => $value !== null));
         $this->activity->save();
diff --git a/app/Jobs/DatabaseBackupJob.php b/app/Jobs/DatabaseBackupJob.php
index 54c6a11a81..eb63bdee94 100644
--- a/app/Jobs/DatabaseBackupJob.php
+++ b/app/Jobs/DatabaseBackupJob.php
@@ -20,9 +20,11 @@ use App\Notifications\Database\BackupSuccess;
 use App\Notifications\Database\BackupSuccessWithS3Warning;
 use App\Rules\SafeWebhookUrl;
 use App\Services\ScheduledJobDeliveryService;
+use App\Services\Security\SensitiveDataRedactor;
 use App\Support\BackupCompression;
 use App\Support\ClickhouseBackupCommand;
 use App\Support\DatabaseOperationReservation;
+use App\Support\PostgresUser;
 use App\Support\ResourceStartActivity;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
@@ -83,8 +85,6 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
 
     public ?string $mongo_root_password = null;
 
-    public ?S3Storage $s3 = null;
-
     public $timeout = 3600 + self::WORKER_TIMEOUT_MARGIN_SECONDS;
 
     public ?string $backup_log_uuid = null;
@@ -129,11 +129,9 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             if (data_get($this->backup, 'database_type') === ServiceDatabase::class) {
                 $this->database = data_get($this->backup, 'database');
                 $this->server = $this->database->service->server;
-                $this->s3 = $this->backup->s3;
             } else {
                 $this->database = data_get($this->backup, 'database');
                 $this->server = $this->database->destination->server;
-                $this->s3 = $this->backup->s3;
             }
             if (is_null($this->server)) {
                 throw new \Exception('Server not found?!');
@@ -170,18 +168,11 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                 $this->directory_name = $serviceName.'-'.$this->container_name;
                 $escapedContainerName = escapeshellarg($this->container_name);
                 if (str($databaseType)->contains('postgres')) {
-                    $commands[] = "docker exec {$escapedContainerName} env | grep POSTGRES_";
+                    $commands[] = "docker exec {$escapedContainerName} env | grep -E '^(POSTGRES|PGUSER=)'";
                     $envs = instant_remote_process($commands, $this->server, true, false, null, disableMultiplexing: true);
                     $envs = str($envs)->explode("\n");
 
-                    $user = $envs->filter(function ($env) {
-                        return str($env)->startsWith('POSTGRES_USER=');
-                    })->first();
-                    if ($user) {
-                        $this->database->postgres_user = str($user)->after('POSTGRES_USER=')->value();
-                    } else {
-                        $this->database->postgres_user = 'postgres';
-                    }
+                    $this->database->postgres_user = PostgresUser::fromEnvLines($envs);
 
                     $db = $envs->filter(function ($env) {
                         return str($env)->startsWith('POSTGRES_DB=');
@@ -339,6 +330,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                 $this->backup_location = null;
                 $this->backup_output = null;
                 $this->error_output = null;
+                $this->s3_uploaded = false;
 
                 // Generate unique UUID for each database backup execution
                 $attempts = 0;
@@ -467,10 +459,11 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                 } catch (Throwable $e) {
                     // Local backup failed: the partial file is not tracked, so retention would never remove it.
                     deleteBackupsLocally($this->backup_location, $this->server);
+                    $failureMessage = $this->redact($this->error_output ?? $this->backup_output ?? $e->getMessage());
                     if ($this->backup_log) {
                         $this->backup_log->update([
                             'status' => 'failed',
-                            'message' => $this->error_output ?? $this->backup_output ?? $e->getMessage(),
+                            'message' => $failureMessage,
                             'size' => $size,
                             'filename' => null,
                             's3_uploaded' => null,
@@ -478,7 +471,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                         ]);
                     }
                     try {
-                        $this->team?->notify(new BackupFailed($this->backup, $this->database, $this->error_output ?? $this->backup_output ?? $e->getMessage(), $database));
+                        $this->team?->notify(new BackupFailed($this->backup, $this->database, $failureMessage, $database));
                     } catch (Throwable $notifyException) {
                         Log::channel('scheduled-errors')->warning('Failed to send backup failure notification', [
                             'backup_id' => $this->backup->uuid,
@@ -494,22 +487,22 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                 $localStorageDeleted = false;
                 if ($this->backup->save_s3 && $localBackupSucceeded) {
                     try {
-                        $this->upload_to_s3();
+                        $s3UploadError = $this->uploadToS3Destinations();
 
-                        // If local backup is disabled, delete the local file immediately after S3 upload
-                        if ($this->backup->disable_local_backup) {
+                        // If local backup is disabled, delete the local file only when every destination has a copy
+                        if ($s3UploadError === null && $this->backup->disable_local_backup) {
                             deleteBackupsLocally($this->backup_location, $this->server);
                             $localStorageDeleted = true;
                         }
                     } catch (Throwable $e) {
                         // S3 upload failed but local backup succeeded
-                        $s3UploadError = $e->getMessage();
+                        $s3UploadError = $this->redact($e->getMessage());
                     }
                 }
 
                 // Step 3: Update status and send notifications based on results
                 if ($localBackupSucceeded) {
-                    $message = $this->backup_output;
+                    $message = $this->backup_output === null ? null : $this->redact($this->backup_output);
 
                     if ($s3UploadError) {
                         $message = $message
@@ -853,9 +846,15 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         return devHostDockerPath($this->server, $this->backup_location);
     }
 
-    private function upload_to_s3(): void
+    /**
+     * Uploads the backup file to every selected S3 destination and records one replica per destination.
+     *
+     * @return string|null The failed destinations and their errors, or null when every upload succeeded.
+     */
+    private function uploadToS3Destinations(): ?string
     {
-        if (is_null($this->s3)) {
+        $storages = $this->backup->selectedS3Storages();
+        if ($storages->isEmpty()) {
             $previousS3StorageId = $this->backup->s3_storage_id;
 
             $this->backup->update([
@@ -866,13 +865,43 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             throw new \Exception('S3 storage configuration is missing or has been deleted (S3 storage ID: '.($previousS3StorageId ?? 'null').'). S3 backup has been disabled for this schedule.');
         }
 
+        $failures = [];
+        foreach ($storages as $storage) {
+            $uploaded = false;
+            $uploadError = null;
+            try {
+                $this->upload_to_s3($storage);
+                $uploaded = true;
+            } catch (Throwable $e) {
+                $uploadError = $this->redact($e->getMessage());
+                $failures[] = "{$storage->name}: {$uploadError}";
+            }
+
+            try {
+                $this->backup_log->s3Replicas()->create([
+                    's3_storage_id' => $storage->id,
+                    's3_uploaded' => $uploaded,
+                    'message' => $uploadError,
+                ]);
+            } catch (Throwable $e) {
+                $failures[] = "{$storage->name}: {$this->redact($e->getMessage())}";
+            }
+        }
+
+        $this->backup_log->refreshS3Summary();
+        $this->s3_uploaded = $failures === [];
+
+        return $failures === [] ? null : implode("\n", $failures);
+    }
+
+    protected function upload_to_s3(S3Storage $s3): void
+    {
         try {
-            $key = $this->s3->key;
-            $secret = $this->s3->secret;
-            // $region = $this->s3->region;
-            $bucket = $this->s3->bucket;
-            $endpoint = $this->s3->endpoint;
-            $this->s3->testConnection(shouldSave: true);
+            $key = $s3->key;
+            $secret = $s3->secret;
+            $bucket = $s3->bucket;
+            $endpoint = $s3->endpoint;
+            $s3->testConnection(shouldSave: true);
             if (data_get($this->backup, 'database_type') === ServiceDatabase::class) {
                 $network = $this->database->service->destination->network;
             } else {
@@ -893,7 +922,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             $escapedSecret = escapeshellarg($secret);
             $escapedBackupLocation = escapeshellarg($this->backup_location);
             $escapedS3Destination = escapeshellarg("temporary/{$bucket}{$this->backup_dir}/");
-            $resolveOptions = collect(SafeWebhookUrl::minioClientResolveOptions($endpoint, $this->s3->trustedInternalHosts()))
+            $resolveOptions = collect(SafeWebhookUrl::minioClientResolveOptions($endpoint, $s3->trustedInternalHosts()))
                 ->map(fn (string $resolveOption): string => '--resolve '.escapeshellarg($resolveOption))
                 ->implode(' ');
             $resolveOptions = $resolveOptions === '' ? '' : ' '.$resolveOptions;
@@ -902,9 +931,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc cp{$resolveOptions} {$escapedBackupLocation} {$escapedS3Destination}";
             instant_remote_process($commands, $this->server, true, false, $this->commandTimeout(), disableMultiplexing: true);
 
-            $this->s3_uploaded = true;
         } catch (Throwable $e) {
-            $this->s3_uploaded = false;
             $this->add_to_error_output($e->getMessage());
             throw $e;
         } finally {
@@ -1111,7 +1138,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         foreach ($unfinished as $execution) {
             $execution->update([
                 'status' => 'failed',
-                'message' => 'Job permanently failed after '.$this->attempts().' attempts: '.($exception?->getMessage() ?? 'Unknown error'),
+                'message' => $this->redact('Job permanently failed after '.$this->attempts().' attempts: '.($exception?->getMessage() ?? 'Unknown error')),
                 'size' => 0,
                 'filename' => null,
                 'finished_at' => Carbon::now(),
@@ -1122,7 +1149,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             return;
         }
 
-        $output = $this->backup_output ?? $exception?->getMessage() ?? 'Unknown error';
+        $output = $this->redact($this->backup_output ?? $exception?->getMessage() ?? 'Unknown error');
         $databaseNames = $unfinished->isEmpty() ? ['unknown'] : $unfinished->map(fn (ScheduledDatabaseBackupExecution $execution) => $execution->database_name ?? 'unknown');
         foreach ($databaseNames as $databaseName) {
             try {
@@ -1136,6 +1163,31 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /**
+     * Redact the backed-up database credentials and the key and secret of every S3 destination from text that is stored or sent in notifications.
+     */
+    private function redact(string $text): string
+    {
+        try {
+            $database = $this->database ?? $this->backup->database;
+            $s3 = $this->s3 ?? $this->backup->s3;
+            $lockedSecrets = [$this->postgres_password, $this->mongo_root_password, $s3?->key, $s3?->secret];
+            foreach ($this->backup->selectedS3Storages() as $storage) {
+                $lockedSecrets[] = $storage->key;
+                $lockedSecrets[] = $storage->secret;
+            }
+            foreach (array_keys($database?->getAttributes() ?? []) as $attribute) {
+                if (str_contains($attribute, 'password')) {
+                    $lockedSecrets[] = $database->getAttribute($attribute);
+                }
+            }
+        } catch (Throwable) {
+            return SensitiveDataRedactor::FAILURE_MESSAGE;
+        }
+
+        return app(SensitiveDataRedactor::class)->redactText($text, lockedSecrets: array_filter($lockedSecrets, fn ($secret): bool => is_string($secret) && $secret !== ''));
+    }
+
     /**
      * @return Collection<int, ScheduledDatabaseBackupExecution>
      */
diff --git a/app/Jobs/DeleteFileDownloadJob.php b/app/Jobs/DeleteFileDownloadJob.php
new file mode 100644
index 0000000000..598a2c2041
--- /dev/null
+++ b/app/Jobs/DeleteFileDownloadJob.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\S3Storage;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+
+/**
+ * Deletes a file browser download from S3 when its link expires. The bucket
+ * lifecycle rule removes anything this job misses after one day.
+ */
+class DeleteFileDownloadJob implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable;
+
+    public function __construct(
+        public int $s3StorageId,
+        public string $key,
+    ) {}
+
+    public function handle(FileDownloadStorageService $downloads): void
+    {
+        $storage = S3Storage::find($this->s3StorageId);
+        if ($storage && str_starts_with($this->key, FileDownloadStorageService::PREFIX)) {
+            $downloads->delete($storage, $this->key);
+        }
+    }
+}
diff --git a/app/Jobs/DeleteResourceJob.php b/app/Jobs/DeleteResourceJob.php
index 52fa592766..4749891550 100644
--- a/app/Jobs/DeleteResourceJob.php
+++ b/app/Jobs/DeleteResourceJob.php
@@ -56,7 +56,7 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             return;
         }
 
-        if ($this->deleteFromCoolifyOnly && $this->resource instanceof Service) {
+        if ($this->deleteFromCoolifyOnly) {
             // No remote calls on this path: remove only the schedule records, so the scheduler does
             // not keep running backups of volumes that no longer exist in Coolify.
             $this->volumeBackupSchedules()->each->delete();
@@ -115,7 +115,7 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             $server = data_get($this->resource, 'destination.server');
             if ($server) {
                 $this->resource->team()?->notify(new GeneralNotification(
-                    "'{$this->resource->name}' was removed from Coolify, but its Docker resources could not be removed from server '{$server->name}' and may still exist there. Error: {$e->getMessage()}",
+                    "'{$this->resource->name}' was removed from Coolify, but its Docker resources could not be removed from server '{$server->name}' and may still exist there. Error: ".remove_iip($e->getMessage()),
                     success: false,
                 ));
             }
@@ -131,8 +131,21 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             ]);
         }
 
+        $maintenanceServers = data_get($this->resource, 'is_maintenance_enabled') ? $this->resource->maintenanceServers() : null;
+
         $this->deleteLocalResource();
 
+        if ($maintenanceServers) {
+            try {
+                // Removes the maintenance route of the deleted resource.
+                $this->resource->syncMaintenancePage($maintenanceServers);
+            } catch (\Throwable $e) {
+                Log::warning('Maintenance page cleanup failed while deleting resource.', [
+                    'resource_id' => $this->resource->id,
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
     }
 
     private function deleteLocalResource(): void
diff --git a/app/Jobs/DockerCleanupJob.php b/app/Jobs/DockerCleanupJob.php
index f491f80030..146f751b23 100644
--- a/app/Jobs/DockerCleanupJob.php
+++ b/app/Jobs/DockerCleanupJob.php
@@ -189,14 +189,15 @@ class DockerCleanupJob implements ShouldBeEncrypted, ShouldQueue
             }
         } catch (\Throwable $e) {
             $failed = true;
+            $errorMessage = remove_iip($e->getMessage());
             if ($this->execution_log) {
                 $this->execution_log->update([
                     'status' => 'failed',
-                    'message' => $e->getMessage(),
+                    'message' => $errorMessage,
                 ]);
                 event(new DockerCleanupDone($this->execution_log));
             }
-            $this->server->team?->notify(new DockerCleanupFailed($this->server, 'Docker cleanup job failed with the following error: '.$e->getMessage()));
+            $this->server->team?->notify(new DockerCleanupFailed($this->server, 'Docker cleanup job failed with the following error: '.$errorMessage));
             throw $e;
         } finally {
             if (! $failed && $this->occurrenceUuid) {
@@ -282,7 +283,7 @@ class DockerCleanupJob implements ShouldBeEncrypted, ShouldQueue
             return;
         }
 
-        $message = $exception?->getMessage() ?? 'Docker cleanup job failed without an exception.';
+        $message = remove_iip($exception?->getMessage() ?? 'Docker cleanup job failed without an exception.');
 
         $updated = DockerCleanupExecution::query()
             ->whereKey($execution->id)
diff --git a/app/Jobs/MigrateServerToInstanceJob.php b/app/Jobs/MigrateServerToInstanceJob.php
new file mode 100644
index 0000000000..cba109fb04
--- /dev/null
+++ b/app/Jobs/MigrateServerToInstanceJob.php
@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Server;
+use App\Services\ServerTransfer\ServerTransferMigrator;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Throwable;
+
+/**
+ * Moves a server to another Coolify instance outside the web request, because a large import can take
+ * longer than the nginx request timeout. The job payload is encrypted because it holds the target token.
+ */
+class MigrateServerToInstanceJob implements ShouldBeEncrypted, ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = ServerTransferMigrator::MIGRATION_TIMEOUT_SECONDS;
+
+    public function __construct(
+        public Server $server,
+        public string $targetUrl,
+        public string $targetToken,
+    ) {
+        $this->onQueue('high');
+    }
+
+    public function uniqueId(): string
+    {
+        return (string) $this->server->id;
+    }
+
+    public function handle(ServerTransferMigrator $migrator): void
+    {
+        try {
+            $result = $migrator->migrate($this->server, $this->targetUrl, $this->targetToken);
+            $migrator->recordMigration($this->server, 'succeeded', [
+                'export_id' => $result['export_id'],
+                'warnings' => $result['warnings'],
+                'checklist' => $result['checklist'],
+                'target_server_url' => $result['target_server_url'] ?? null,
+            ]);
+        } catch (Throwable $e) {
+            $migrator->recordMigration($this->server, 'failed', ['error' => $e->getMessage()]);
+        }
+    }
+
+    /**
+     * The worker stopped the job, for example at its timeout. The target can manage the server already,
+     * so the migrator asks the target before it records the result.
+     */
+    public function failed(?Throwable $exception): void
+    {
+        app(ServerTransferMigrator::class)->recordStoppedMigration(
+            $this->server,
+            $this->targetUrl,
+            $this->targetToken,
+            $exception?->getMessage() ?: 'The transfer job stopped before it finished.',
+        );
+    }
+}
diff --git a/app/Jobs/PrepareFileDownloadJob.php b/app/Jobs/PrepareFileDownloadJob.php
new file mode 100644
index 0000000000..b36d5ccd96
--- /dev/null
+++ b/app/Jobs/PrepareFileDownloadJob.php
@@ -0,0 +1,81 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Services\ContainerFilesystemService;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Uploads a download from the managed server to the instance download S3
+ * storage and stores a presigned link for the Livewire component to open.
+ * The source is a path in $container, or a file on the server host (for
+ * example a backup) when $container is null.
+ */
+class PrepareFileDownloadJob implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable;
+
+    public int $tries = 1;
+
+    public int $timeout = 3700;
+
+    public function __construct(
+        public string $downloadId,
+        public int $userId,
+        public int $serverId,
+        public ?string $container,
+        public string $path,
+        public bool $isDir,
+        public string $downloadName,
+        public int $s3StorageId,
+    ) {}
+
+    public static function cacheKey(string $downloadId): string
+    {
+        return 'file-browser-s3-download:'.$downloadId;
+    }
+
+    public function handle(FileDownloadStorageService $downloads): void
+    {
+        try {
+            $storage = S3Storage::query()->whereTeamId(0)->where('is_usable', true)->find($this->s3StorageId);
+            if (! $storage) {
+                throw new \RuntimeException('The file download storage is not available.');
+            }
+            $server = Server::findOrFail($this->serverId);
+
+            $key = FileDownloadStorageService::newObjectKey();
+            // Queue the delete first, so a partial upload is removed as well.
+            DeleteFileDownloadJob::dispatch($storage->id, $key)->delay(now()->addHours(FileDownloadStorageService::OBJECT_TTL_HOURS));
+
+            $upload = $downloads->uploadUrl($storage, $key, $this->downloadName);
+            if ($this->container === null) {
+                instant_remote_process([FileDownloadStorageService::buildHostFileUploadCommand($this->path, $upload['url'], $upload['headers'])], $server, timeout: 3600);
+            } else {
+                (new ContainerFilesystemService($server, $this->container))->uploadToS3($this->path, $this->isDir, $upload['url'], $upload['headers']);
+            }
+
+            $this->store(['status' => 'ready', 'url' => $downloads->downloadUrl($storage, $key)]);
+        } catch (\Throwable $e) {
+            // The message can contain the S3 endpoint or a presigned URL; keep it in the log only.
+            Log::warning('S3 download failed', ['download_id' => $this->downloadId, 'error' => $e->getMessage()]);
+            $this->store(['status' => 'failed', 'message' => 'Download failed. The file could not be uploaded to the download storage. Try again, or ask your administrator to check the storage settings.']);
+        }
+    }
+
+    /**
+     * @param  array<string, string>  $result
+     */
+    private function store(array $result): void
+    {
+        Cache::put(self::cacheKey($this->downloadId), ['user_id' => $this->userId, ...$result], now()->addMinutes(FileDownloadStorageService::LINK_TTL_MINUTES));
+    }
+}
diff --git a/app/Jobs/ProvisionGithubRunnerJob.php b/app/Jobs/ProvisionGithubRunnerJob.php
index c5b1148448..ae9e5e15e7 100644
--- a/app/Jobs/ProvisionGithubRunnerJob.php
+++ b/app/Jobs/ProvisionGithubRunnerJob.php
@@ -85,7 +85,8 @@ class ProvisionGithubRunnerJob implements ShouldBeEncrypted, ShouldQueue
             if ($this->stopIfFinished($execution)) {
                 return;
             }
-            instant_remote_process($container->startCommands($runner['encoded_jit_config']), $server);
+            // stopIfFinished() reloaded the server, so a transfer that just finished stops the start command.
+            instant_remote_process($container->startCommands($runner['encoded_jit_config']), $execution->server);
 
             if ($this->stopIfFinished($execution)) {
                 return;
@@ -120,7 +121,7 @@ class ProvisionGithubRunnerJob implements ShouldBeEncrypted, ShouldQueue
                 ->where('status', GithubRunnerStatus::Provisioning)
                 ->update([
                     'status' => GithubRunnerStatus::Failed,
-                    'error_message' => "Could not start a runner after {$attempt} attempts: {$e->getMessage()}",
+                    'error_message' => remove_iip("Could not start a runner after {$attempt} attempts: {$e->getMessage()}"),
                     'completed_at' => now(),
                 ]);
             CleanupGithubRunnerJob::dispatch($execution->id);
@@ -140,7 +141,7 @@ class ProvisionGithubRunnerJob implements ShouldBeEncrypted, ShouldQueue
                 'runner_name' => null,
                 'runner_id' => null,
                 'ready_at' => null,
-                'error_message' => "Attempt {$attempt} of ".self::MAX_ATTEMPTS." failed: {$e->getMessage()}",
+                'error_message' => remove_iip("Attempt {$attempt} of ".self::MAX_ATTEMPTS." failed: {$e->getMessage()}"),
             ]);
         if (! $retried) {
             return;
@@ -159,11 +160,15 @@ class ProvisionGithubRunnerJob implements ShouldBeEncrypted, ShouldQueue
             return true;
         }
 
+        // Reloads the server too: a transfer to another instance can finish while this job runs.
         $execution->refresh();
-        if ($execution->isActive()) {
+        if ($execution->isActive() && ! $execution->server?->isTransferredAway()) {
             return false;
         }
 
+        if ($execution->isActive()) {
+            $execution->finish(GithubRunnerStatus::Cancelled, 'The server was transferred to another Coolify instance.');
+        }
         CleanupGithubRunnerJob::dispatch($execution->id);
 
         return true;
diff --git a/app/Jobs/PushServerUpdateJob.php b/app/Jobs/PushServerUpdateJob.php
index b4e7929cd6..7405b1346c 100644
--- a/app/Jobs/PushServerUpdateJob.php
+++ b/app/Jobs/PushServerUpdateJob.php
@@ -973,7 +973,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
     private function checkLogDrainContainer()
     {
-        if ($this->server->isLogDrainEnabled() && $this->foundLogDrainContainer === false) {
+        if ($this->server->isFluentBitLogDrainEnabled() && $this->foundLogDrainContainer === false) {
             StartLogDrain::dispatch($this->server);
         }
     }
diff --git a/app/Jobs/ScheduledTaskJob.php b/app/Jobs/ScheduledTaskJob.php
index 35592b6cb9..7f59fcfc3f 100644
--- a/app/Jobs/ScheduledTaskJob.php
+++ b/app/Jobs/ScheduledTaskJob.php
@@ -5,6 +5,7 @@ namespace App\Jobs;
 use App\Events\ScheduledTaskDone;
 use App\Exceptions\NonReportableException;
 use App\Models\Application;
+use App\Models\EnvironmentVariable;
 use App\Models\ScheduledTask;
 use App\Models\ScheduledTaskExecution;
 use App\Models\Server;
@@ -13,6 +14,7 @@ use App\Models\Team;
 use App\Notifications\ScheduledTask\TaskFailed;
 use App\Notifications\ScheduledTask\TaskSuccess;
 use App\Services\ScheduledJobDeliveryService;
+use App\Services\Security\SensitiveDataRedactor;
 use Carbon\Carbon;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
@@ -67,6 +69,9 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
 
     public ?string $task_output = null;
 
+    /** @var array{known: array<int, string>, locked: array<int, string>}|null */
+    private ?array $logRedactionSecrets = null;
+
     public array $containers = [];
 
     public string $server_timezone = 'UTC';
@@ -189,7 +194,7 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
                     $exec = $this->boundedTaskCommand($execCommand);
                     // Disable SSH multiplexing to prevent race conditions when multiple tasks run concurrently
                     // See: https://github.com/coollabsio/coolify/issues/6736
-                    $this->task_output = instant_remote_process([$exec], $this->server, throwError: true, no_sudo: true, timeout: $this->task->timeout ?? 300, disableMultiplexing: true);
+                    $this->task_output = $this->redact(instant_remote_process([$exec], $this->server, throwError: true, no_sudo: true, timeout: $this->task->timeout ?? 300, disableMultiplexing: true) ?? '');
                     $this->task_log->update([
                         'status' => 'success',
                         'message' => $this->task_output,
@@ -205,10 +210,11 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
             throw new NonReportableException('ScheduledTaskJob failed: No valid container was found. Is the container name correct?');
         } catch (\Throwable $e) {
             $failed = true;
+            $safeErrorMessage = $this->redact($e->getMessage());
             if ($this->task_log) {
                 $this->task_log->update([
                     'status' => 'failed',
-                    'message' => $this->task_output ?? $e->getMessage(),
+                    'message' => $this->task_output ?? $safeErrorMessage,
                 ]);
             }
 
@@ -219,13 +225,13 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
                 'task_name' => $this->task->name,
                 'server' => $this->server?->name ?? 'unknown',
                 'attempt' => $this->attempts(),
-                'error' => $e->getMessage(),
+                'error' => $safeErrorMessage,
             ]);
 
             // Only notify and throw on final failure
 
             // Re-throw to trigger Laravel's retry mechanism with backoff
-            throw $e;
+            throw $this->redactedException($e, $safeErrorMessage);
         } finally {
             if (! $failed && $this->occurrenceUuid) {
                 app(ScheduledJobDeliveryService::class)->complete($this->occurrenceUuid, $this->job?->uuid() ?? $this->occurrenceUuid);
@@ -255,6 +261,32 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
         return "output_file=\$(mktemp); trap 'rm -f \"\$output_file\"' EXIT; set +e; set -o pipefail; {$command} 2>&1 | { head -c {$readLimit} > \"\$output_file\"; cat > /dev/null; }; exit_code=\${PIPESTATUS[0]}; if [ \"\$(wc -c < \"\$output_file\")\" -gt {$maxOutputBytes} ]; then truncate -s {$maxOutputBytes} \"\$output_file\"; printf '\n\n[... Output truncated at 5MB limit ...]' >> \"\$output_file\"; fi; if [ \"\$exit_code\" -eq 0 ]; then cat \"\$output_file\"; else cat \"\$output_file\" >&2; fi; exit \$exit_code";
     }
 
+    private function redact(string $value): string
+    {
+        try {
+            $this->logRedactionSecrets ??= EnvironmentVariable::logRedactionSecretsFor($this->resource);
+        } catch (\Throwable) {
+            return REDACTED;
+        }
+
+        return resolve(SensitiveDataRedactor::class)->redactText($value, $this->logRedactionSecrets['known'], $this->logRedactionSecrets['locked']);
+    }
+
+    /**
+     * Keep the original exception when redaction did not change its message.
+     * Otherwise, drop the original (and its trace) so the secret is not stored in failed_jobs.
+     */
+    private function redactedException(\Throwable $exception, string $safeMessage): \Throwable
+    {
+        if ($safeMessage === $exception->getMessage()) {
+            return $exception;
+        }
+
+        return $exception instanceof NonReportableException
+            ? new NonReportableException($safeMessage, (int) $exception->getCode())
+            : new \RuntimeException($safeMessage, (int) $exception->getCode());
+    }
+
     /**
      * Calculate the number of seconds to wait before retrying the job.
      */
@@ -273,6 +305,9 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
         }
 
         $this->team ??= Team::find($this->task->team_id);
+        $this->resource ??= $this->task->application ?? $this->task->service;
+        $safeErrorMessage = $this->redact($exception?->getMessage() ?? 'Unknown error');
+        $safeTrace = $this->redact($exception?->getTraceAsString() ?? '');
 
         Log::channel('scheduled-errors')->error('ScheduledTask permanently failed', [
             'job' => 'ScheduledTaskJob',
@@ -280,8 +315,8 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
             'task_name' => $this->task->name,
             'server' => $this->server?->name ?? 'unknown',
             'total_attempts' => $this->attempts(),
-            'error' => $exception?->getMessage(),
-            'trace' => $exception?->getTraceAsString(),
+            'error' => $safeErrorMessage,
+            'trace' => $safeTrace,
         ]);
 
         // After a worker timeout only the queued uuid identifies this run's execution.
@@ -293,13 +328,13 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
         if ($execution) {
             $errorMessage = 'Job permanently failed after '.$this->attempts().' attempts';
             if ($exception) {
-                $errorMessage .= ': '.$exception->getMessage();
+                $errorMessage .= ': '.$safeErrorMessage;
             }
 
             $execution->update([
                 'status' => 'failed',
                 'message' => $errorMessage,
-                'error_details' => $exception?->getTraceAsString(),
+                'error_details' => $safeTrace,
                 'finished_at' => Carbon::now()->toImmutable(),
             ]);
         } else {
@@ -310,6 +345,6 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
         }
 
         // Notify team about permanent failure
-        $this->team?->notify(new TaskFailed($this->task, $exception?->getMessage() ?? 'Unknown error'));
+        $this->team?->notify(new TaskFailed($this->task, $safeErrorMessage));
     }
 }
diff --git a/app/Jobs/SendMessageToDiscordJob.php b/app/Jobs/SendMessageToDiscordJob.php
index 226e9f4cd7..eeae3bf64a 100644
--- a/app/Jobs/SendMessageToDiscordJob.php
+++ b/app/Jobs/SendMessageToDiscordJob.php
@@ -72,7 +72,7 @@ class SendMessageToDiscordJob implements ShouldBeEncrypted, ShouldQueue
             return;
         }
 
-        $response = Http::withOptions($httpOptions)->post($this->webhookUrl, $this->message->toPayload());
+        $response = $this->sendNotificationRequest('Discord', $this->webhookUrl, fn () => Http::withOptions($httpOptions)->post($this->webhookUrl, $this->message->toPayload()));
 
         // 401: invalid webhook token, 403: missing access, 404: unknown (deleted) webhook.
         $this->handleNotificationResponse($response, 'Discord', in_array($response->status(), [401, 403, 404], true));
diff --git a/app/Jobs/SendMessageToPushoverJob.php b/app/Jobs/SendMessageToPushoverJob.php
index 406a7e5ea4..f7ff676d56 100644
--- a/app/Jobs/SendMessageToPushoverJob.php
+++ b/app/Jobs/SendMessageToPushoverJob.php
@@ -45,7 +45,7 @@ class SendMessageToPushoverJob implements ShouldBeEncrypted, ShouldQueue
      */
     public function handle(): void
     {
-        $response = Http::post('https://api.pushover.net/1/messages.json', $this->message->toPayload($this->token, $this->user));
+        $response = $this->sendNotificationRequest('Pushover', 'https://api.pushover.net/1/messages.json', fn () => Http::post('https://api.pushover.net/1/messages.json', $this->message->toPayload($this->token, $this->user)));
 
         // Pushover marks the invalid field in the error body, for example {"token": "invalid"}.
         $isConfigurationError = $response->clientError()
diff --git a/app/Jobs/SendMessageToSlackJob.php b/app/Jobs/SendMessageToSlackJob.php
index 0b01f7f658..0daafcc42e 100644
--- a/app/Jobs/SendMessageToSlackJob.php
+++ b/app/Jobs/SendMessageToSlackJob.php
@@ -71,9 +71,9 @@ class SendMessageToSlackJob implements ShouldBeEncrypted, ShouldQueue
          *
          * @see https://github.com/coollabsio/coolify/pull/6139#issuecomment-3756777708
          */
-        $response = $this->isSlackWebhook()
+        $response = $this->sendNotificationRequest('Slack', $this->webhookUrl, fn () => $this->isSlackWebhook()
             ? $this->sendToSlack($httpOptions)
-            : $this->sendToMattermost($httpOptions);
+            : $this->sendToMattermost($httpOptions));
 
         // 403: posting is not allowed, 404: the webhook or channel was removed, 410: the channel is archived.
         $this->handleNotificationResponse($response, 'Slack', in_array($response->status(), [403, 404, 410], true));
diff --git a/app/Jobs/SendMessageToTelegramJob.php b/app/Jobs/SendMessageToTelegramJob.php
index babebad956..87d9625eed 100644
--- a/app/Jobs/SendMessageToTelegramJob.php
+++ b/app/Jobs/SendMessageToTelegramJob.php
@@ -93,6 +93,6 @@ class SendMessageToTelegramJob implements ShouldBeEncrypted, ShouldQueue
             $payload['message_thread_id'] = $this->threadId;
         }
 
-        return Http::post($url, $payload);
+        return $this->sendNotificationRequest('Telegram', $url, fn () => Http::post($url, $payload));
     }
 }
diff --git a/app/Jobs/SendWebhookJob.php b/app/Jobs/SendWebhookJob.php
index 29ee58fb2f..11d44eceb2 100644
--- a/app/Jobs/SendWebhookJob.php
+++ b/app/Jobs/SendWebhookJob.php
@@ -71,7 +71,7 @@ class SendWebhookJob implements ShouldBeEncrypted, ShouldQueue
             return;
         }
 
-        $response = Http::withOptions($httpOptions)->post($this->webhookUrl, $this->payload);
+        $response = $this->sendNotificationRequest('Webhook', $this->webhookUrl, fn () => Http::withOptions($httpOptions)->post($this->webhookUrl, $this->payload));
 
         // 401/403: the endpoint rejects us, 404/410: the endpoint does not exist anymore.
         $this->handleNotificationResponse($response, 'Webhook', in_array($response->status(), [401, 403, 404, 410], true));
diff --git a/app/Jobs/ServerCheckJob.php b/app/Jobs/ServerCheckJob.php
index a4fa961345..0ec1ce606f 100644
--- a/app/Jobs/ServerCheckJob.php
+++ b/app/Jobs/ServerCheckJob.php
@@ -73,7 +73,7 @@ class ServerCheckJob implements ShouldBeEncrypted, ShouldQueue
                     CheckAndStartSentinelJob::dispatch($this->server);
                 }
 
-                if ($this->server->isLogDrainEnabled()) {
+                if ($this->server->isFluentBitLogDrainEnabled()) {
                     $this->checkLogDrainContainer();
                 }
 
diff --git a/app/Jobs/ServerCloudProviderStatusCheckJob.php b/app/Jobs/ServerCloudProviderStatusCheckJob.php
index cd2e51df7d..46d0898c93 100644
--- a/app/Jobs/ServerCloudProviderStatusCheckJob.php
+++ b/app/Jobs/ServerCloudProviderStatusCheckJob.php
@@ -47,6 +47,9 @@ class ServerCloudProviderStatusCheckJob implements ShouldBeEncrypted, ShouldQueu
                 'digitalocean' => $this->server->digitalocean_droplet_id
                     ? $this->server->refreshDigitalOceanState()
                     : null,
+                'hostinger' => $this->server->hostinger_virtual_machine_id
+                    ? $this->server->refreshHostingerState()
+                    : null,
                 default => null,
             };
         } catch (\Throwable $e) {
diff --git a/app/Jobs/ServerConnectionCheckJob.php b/app/Jobs/ServerConnectionCheckJob.php
index ab8d56a98a..841e915b78 100644
--- a/app/Jobs/ServerConnectionCheckJob.php
+++ b/app/Jobs/ServerConnectionCheckJob.php
@@ -5,6 +5,7 @@ namespace App\Jobs;
 use App\Events\ServerReachabilityChanged;
 use App\Helpers\SshMultiplexingHelper;
 use App\Models\Server;
+use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -44,6 +45,9 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
 
     private ?string $connectionError = null;
 
+    /** Owner marker that the SSH probe read from the host; empty when the host has none. */
+    private ?string $ownerMarker = null;
+
     public function __construct(
         public Server $server,
         public bool $disableMux = true
@@ -108,6 +112,10 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
                 return;
             }
 
+            if ($this->releasedToAnotherInstance()) {
+                return;
+            }
+
             // Server is reachable, check if Docker is available
             $isUsable = $this->checkDockerAvailability();
 
@@ -218,9 +226,11 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
     {
         try {
             $process = Process::timeout(self::SSH_TIMEOUT_SECONDS)
-                ->run($this->sshCommand('ls -la /', disableMultiplexing: true));
+                ->run($this->sshCommand(self::probeCommand(), disableMultiplexing: true));
             if ($process->exitCode() !== 0) {
                 $this->connectionError = 'ssh exit '.$process->exitCode().': '.Str::limit(trim($process->errorOutput()), 300);
+            } else {
+                $this->ownerMarker = trim($process->output());
             }
 
             return $process->exitCode() === 0;
@@ -235,6 +245,25 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /**
+     * The SSH probe also reads the owner marker, so the marker check needs no extra SSH connection.
+     * The remote shell runs with `set -e` and most servers have no marker, so a missing file must not fail the probe.
+     */
+    public static function probeCommand(): string
+    {
+        return 'cat '.ServerTransferClaimer::OWNER_MARKER_PATH.' 2>/dev/null || true; ls -la / > /dev/null';
+    }
+
+    /**
+     * After a transfer, another instance can claim this server. Its owner marker on the host is the only
+     * record that both instances share, so this instance stops managing the server when the marker names
+     * another claim.
+     */
+    private function releasedToAnotherInstance(): bool
+    {
+        return app(ServerTransferClaimer::class)->releaseIfClaimedElsewhere($this->server, $this->ownerMarker);
+    }
+
     private function checkDockerAvailability(): bool
     {
         try {
diff --git a/app/Jobs/ServerManagerJob.php b/app/Jobs/ServerManagerJob.php
index a8f2a50a31..e1ab5f94ee 100644
--- a/app/Jobs/ServerManagerJob.php
+++ b/app/Jobs/ServerManagerJob.php
@@ -99,7 +99,8 @@ class ServerManagerJob implements ShouldBeEncrypted, ShouldQueue
         $servers->each(function (Server $server) {
             $hasCloudResource = $server->hetzner_server_id
                 || $server->vultr_instance_id
-                || $server->digitalocean_droplet_id;
+                || $server->digitalocean_droplet_id
+                || $server->hostinger_virtual_machine_id;
 
             if ($hasCloudResource && $server->cloudProviderToken) {
                 ServerCloudProviderStatusCheckJob::dispatch($server);
@@ -204,7 +205,7 @@ class ServerManagerJob implements ShouldBeEncrypted, ShouldQueue
             }
         }
 
-        // Dispatch ServerPatchCheckJob if due (weekly, staggered per server on Sunday).
+        // Dispatch ServerPatchCheckJob if due (by default weekly, staggered per server on Sunday).
         // The "-v2" keys start fresh: v4.3.23 stored its old run times under the unversioned keys, which
         // would make every server run these checks at once on the first run after the upgrade.
         $shouldRunPatchCheck = shouldRunCronNow(self::patchCheckCron($server), $serverTimezone, "server-patch-check-v2:{$server->id}", $this->executionTime);
@@ -228,12 +229,16 @@ class ServerManagerJob implements ShouldBeEncrypted, ShouldQueue
     }
 
     /**
-     * Weekly patch check at a stable per-server time on Sunday between 04:00 and 23:59.
-     *
-     * The early hours are skipped because most daylight saving transitions happen there.
+     * The patch check frequency of the server. The default is weekly, at a stable per-server time on Sunday
+     * between 04:00 and 23:59. The early hours are skipped because most daylight saving transitions happen there.
      */
     public static function patchCheckCron(Server $server): string
     {
+        $frequency = data_get($server->settings, 'patch_check_frequency');
+        if (filled($frequency)) {
+            return VALID_CRON_STRINGS[$frequency] ?? $frequency;
+        }
+
         $slot = $server->id % (20 * 60);
 
         return sprintf('%d %d * * 0', $slot % 60, 4 + intdiv($slot, 60));
diff --git a/app/Jobs/ServerPatchCheckJob.php b/app/Jobs/ServerPatchCheckJob.php
index a383a962a3..3e135f721b 100644
--- a/app/Jobs/ServerPatchCheckJob.php
+++ b/app/Jobs/ServerPatchCheckJob.php
@@ -3,6 +3,7 @@
 namespace App\Jobs;
 
 use App\Actions\Server\CheckUpdates;
+use App\Events\ServerPatchCheckFinished;
 use App\Models\Server;
 use App\Notifications\Server\ServerPatchCheck;
 use Illuminate\Bus\Queueable;
@@ -12,6 +13,8 @@ use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\Middleware\WithoutOverlapping;
 use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Log;
 
 class ServerPatchCheckJob implements ShouldBeEncrypted, ShouldQueue
@@ -20,51 +23,93 @@ class ServerPatchCheckJob implements ShouldBeEncrypted, ShouldQueue
 
     public $timeout = 600;
 
+    public $tries = 1;
+
+    /**
+     * @param  bool  $manual  A check that a user started from the patches page. It saves the result also for a
+     *                        server that is not functional, and it sends no "updates available" notification.
+     */
+    public function __construct(public Server $server, public bool $manual = false)
+    {
+        $this->onQueue(maintenance_queue());
+    }
+
+    public static function runningCacheKey(Server $server): string
+    {
+        return "server-patch-check-running:{$server->uuid}";
+    }
+
+    /**
+     * Queues a manual check and marks it as running, so the patches page shows the progress after a reload.
+     */
+    public static function dispatchManual(Server $server): void
+    {
+        Cache::put(self::runningCacheKey($server), true, now()->addMinutes(15));
+        self::dispatch($server, true);
+    }
+
     public function middleware(): array
     {
         return [(new WithoutOverlapping('server-patch-check-'.$this->server->uuid))->expireAfter(600)->dontRelease()];
     }
 
-    public function __construct(public Server $server)
-    {
-        $this->onQueue(maintenance_queue());
-    }
-
     public function handle(): void
     {
         try {
-            if ($this->server->isFunctional() === false) {
-                return;
-            }
-
             $team = data_get($this->server, 'team');
-            if (! $team) {
+            if (! $team || $this->server->isTransferredAway()) {
                 return;
             }
 
-            // Check for updates
+            if ($this->server->isFunctional() === false) {
+                if ($this->manual) {
+                    $this->saveResult(['error' => 'Server is not reachable or not ready.']);
+                }
+
+                return;
+            }
+
+            $previousError = $this->server->settings->patch_check_error;
             $patchData = CheckUpdates::run($this->server);
+            $this->saveResult($patchData);
 
             if (isset($patchData['error'])) {
-                $team->notify(new ServerPatchCheck($this->server, $patchData));
+                // Notify only when the state changes from ok to error, not on every check of a broken server.
+                if (blank($previousError)) {
+                    $team->notify(new ServerPatchCheck($this->server, $patchData));
+                }
 
-                return; // Skip if there's an error checking for updates
+                return;
             }
 
-            $totalUpdates = $patchData['total_updates'] ?? 0;
-
-            // Only send notification if there are updates available
-            if ($totalUpdates > 0) {
+            if (! $this->manual && ($patchData['total_updates'] ?? 0) > 0) {
                 $team->notify(new ServerPatchCheck($this->server, $patchData));
             }
         } catch (\Throwable $e) {
-            // Log error but don't fail the job
             Log::error('ServerPatchCheckJob failed: '.$e->getMessage(), [
                 'server_id' => $this->server->id,
                 'server_name' => $this->server->name,
                 'error' => $e->getMessage(),
                 'trace' => $e->getTraceAsString(),
             ]);
+            $this->saveResult(['error' => $e->getMessage()]);
+        } finally {
+            Cache::forget(self::runningCacheKey($this->server));
+            ServerPatchCheckFinished::dispatch($this->server->team_id, $this->server->uuid);
         }
     }
+
+    /**
+     * @param  array<string, mixed>  $patchData
+     */
+    private function saveResult(array $patchData): void
+    {
+        $error = $patchData['error'] ?? null;
+
+        $this->server->settings->forceFill([
+            'patch_check_result' => $error === null ? $patchData : Arr::only($patchData, ['osId', 'package_manager']),
+            'patch_check_error' => $error === null ? null : (string) $error,
+            'patch_checked_at' => now(),
+        ])->saveQuietly();
+    }
 }
diff --git a/app/Jobs/VolumeBackupJob.php b/app/Jobs/VolumeBackupJob.php
index 157f032118..8fc34ca252 100644
--- a/app/Jobs/VolumeBackupJob.php
+++ b/app/Jobs/VolumeBackupJob.php
@@ -4,19 +4,21 @@ namespace App\Jobs;
 
 use App\Events\BackupCreated;
 use App\Models\LocalPersistentVolume;
+use App\Models\S3Storage;
 use App\Models\ScheduledVolumeBackup;
 use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
+use App\Models\VolumeBackupS3Replica;
 use App\Notifications\VolumeBackup\BackupFailed;
 use App\Notifications\VolumeBackup\BackupSuccess;
 use App\Rules\SafeWebhookUrl;
 use App\Services\ScheduledJobDeliveryService;
+use App\Services\Security\SensitiveDataRedactor;
 use App\Support\BackupCompression;
 use Carbon\Carbon;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
@@ -71,16 +73,21 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             throw new \RuntimeException('The storage backup resource, team, or server no longer exists.');
         }
 
+        $destinations = $this->backup->save_s3 ? $this->backup->selectedS3Storages() : collect();
         $this->execution = $this->backup->executions()->create([
-            's3_storage_id' => $this->backup->save_s3 ? $this->backup->s3_storage_id : null,
+            's3_storage_id' => $destinations->first()?->id,
         ]);
+        foreach ($destinations as $s3) {
+            $this->execution->s3Replicas()->create(['s3_storage_id' => $s3->id]);
+        }
         BackupCreated::dispatch($team->id);
 
         $backupDirectory = backup_dir().'/volumes/'.str($team->name)->slug().'-'.$team->id.'/'.$target->uuid;
         $filename = str($this->backup->targetType())->lower().'-'.str($this->backup->targetName())->slug().'-'.Carbon::now()->timestamp.'.tar.gz';
         $backupLocation = $backupDirectory.'/'.$filename;
         $this->execution->update(['filename' => $backupLocation]);
-        $streamToS3 = $this->backup->save_s3 && $this->backup->disable_local_backup;
+        // Streaming writes no local archive, so it can upload to one destination only.
+        $streamToS3 = $this->backup->disable_local_backup && $destinations->count() === 1;
 
         try {
             $source = $this->backup->sourcePath();
@@ -95,7 +102,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $archiveScript = self::archiveScript($compressionCpuPercentage);
             if ($streamToS3) {
                 $this->execution->update(['local_storage_deleted' => true]);
-                $archiveCommand = $this->streamToS3Command($archiveScript, $backupLocation, $source, $containerName, $image);
+                $archiveCommand = $this->streamToS3Command($destinations->first(), $archiveScript, $backupLocation, $source, $containerName, $image);
                 $this->execution->update(['s3_cleanup_pending' => true]);
             } else {
                 $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
@@ -140,24 +147,27 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             }
 
             $warning = null;
-            $s3Uploaded = null;
+            $s3Uploaded = false;
             $s3CleanupPending = false;
             $localStorageDeleted = $streamToS3;
 
             if ($streamToS3) {
                 $s3Uploaded = true;
+                $this->execution->s3Replicas()->update(['s3_uploaded' => true]);
+                $this->execution->refreshS3Summary();
                 $this->execution->update(['s3_cleanup_pending' => false]);
+            } elseif ($this->backup->save_s3 && $destinations->isEmpty()) {
+                $warning = 'S3 upload failed: The selected S3 storage no longer exists.';
             } elseif ($this->backup->save_s3) {
                 $s3CleanupPending = true;
                 $this->execution->update(['s3_cleanup_pending' => true]);
+                $uploadErrors = $this->uploadToDestinations($backupLocation, $backupDirectory, $server);
+                $s3Uploaded = $uploadErrors === [];
 
-                try {
-                    $this->uploadToS3($backupLocation, $backupDirectory, $server);
-                    $s3Uploaded = true;
+                if ($s3Uploaded) {
                     $s3CleanupPending = false;
-                } catch (Throwable $exception) {
-                    $s3Uploaded = false;
-                    $warning = 'S3 upload failed: '.$exception->getMessage();
+                } else {
+                    $warning = 'S3 upload failed: '.implode(' ', $uploadErrors);
 
                     try {
                         VolumeBackupRecoveryJob::cleanupS3Upload($this->execution);
@@ -178,12 +188,12 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
                 }
             }
 
+            $warning = $warning === null ? null : $this->redact($warning);
             $this->execution->update([
                 'status' => 'success',
                 'message' => $warning,
                 'size' => $size,
                 'filename' => $backupLocation,
-                's3_uploaded' => $s3Uploaded,
                 's3_cleanup_pending' => $s3CleanupPending,
                 'local_storage_deleted' => $localStorageDeleted,
             ]);
@@ -194,7 +204,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
                 Log::channel('scheduled-errors')->warning('Volume backup retention cleanup failed', [
                     'backup_id' => $this->backup->id,
                     'execution_id' => $this->execution->id,
-                    'error' => $exception->getMessage(),
+                    'error' => $this->redact($exception->getMessage()),
                 ]);
             }
         } catch (Throwable $exception) {
@@ -219,18 +229,23 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
                 }
             }
 
+            $this->execution->s3Replicas()->whereNull('s3_uploaded')->update(['s3_uploaded' => false]);
+            $this->execution->refreshS3Summary();
             $s3CleanupPending = $this->execution->fresh()->s3_cleanup_pending;
 
             $this->execution->update([
                 'status' => 'failed',
-                'message' => $exception->getMessage().$recoveryError,
+                'message' => $this->redact($exception->getMessage().$recoveryError),
                 'filename' => $streamToS3
                     ? ($s3CleanupPending ? $backupLocation : null)
                     : ($archiveDeleted && ! $s3CleanupPending ? null : $backupLocation),
                 'local_storage_deleted' => $archiveDeleted,
             ]);
 
-            throw $exception;
+            $safeMessage = $this->redact($exception->getMessage());
+            throw $safeMessage === $exception->getMessage()
+                ? $exception
+                : new \RuntimeException($safeMessage, (int) $exception->getCode());
         } finally {
             if (! $failed && $this->occurrenceUuid) {
                 app(ScheduledJobDeliveryService::class)->complete($this->occurrenceUuid, $this->job?->uuid() ?? $this->occurrenceUuid);
@@ -274,7 +289,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
 
             $execution->update([
                 'status' => 'failed',
-                'message' => ($exception?->getMessage() ?? 'Volume backup timed out or was terminated.').$recoveryError,
+                'message' => $this->redact(($exception?->getMessage() ?? 'Volume backup timed out or was terminated.').$recoveryError),
                 'finished_at' => now(),
                 'filename' => $filename,
                 'local_storage_deleted' => $localStorageDeleted,
@@ -283,7 +298,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
 
         $this->backup->team?->notify(new BackupFailed(
             $this->backup,
-            $exception?->getMessage() ?? 'Volume backup timed out or was terminated.',
+            $this->redact($exception?->getMessage() ?? 'Volume backup timed out or was terminated.'),
         ));
     }
 
@@ -298,6 +313,25 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         return "compressor=\$({$compressorCommand}); { tar -I \"\$compressor\" -cf - -C /volume . || { status=\$?; [ \$status -eq 1 ] || exit \$status; }; }";
     }
 
+    /**
+     * Redact the key and secret of every S3 destination of the backup from text that is stored or sent in notifications.
+     */
+    private function redact(string $text): string
+    {
+        try {
+            $s3 = $this->backup->s3;
+            $lockedSecrets = [$s3?->key, $s3?->secret];
+            foreach ($this->backup->selectedS3Storages() as $storage) {
+                $lockedSecrets[] = $storage->key;
+                $lockedSecrets[] = $storage->secret;
+            }
+        } catch (Throwable) {
+            return SensitiveDataRedactor::FAILURE_MESSAGE;
+        }
+
+        return app(SensitiveDataRedactor::class)->redactText($text, lockedSecrets: array_filter($lockedSecrets, fn ($secret): bool => is_string($secret) && $secret !== ''));
+    }
+
     /**
      * Containers can exit and be removed (e.g. `--rm` backup helpers) between `docker ps` and
      * `docker inspect`. Skip those, but still fail when an existing container cannot be inspected.
@@ -360,16 +394,38 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
-    private function uploadToS3(string $backupLocation, string $backupDirectory, Server $server): void
+    /**
+     * Uploads the local archive to every destination of the execution and records the result on each copy.
+     *
+     * @return array<int, string> One error message per failed destination.
+     */
+    private function uploadToDestinations(string $backupLocation, string $backupDirectory, Server $server): array
     {
-        $s3 = $this->backup->s3;
+        $errors = [];
 
-        if (! $s3) {
-            $this->backup->update(['save_s3' => false, 's3_storage_id' => null]);
+        foreach ($this->execution->s3Replicas()->with('s3')->get() as $replica) {
+            /** @var VolumeBackupS3Replica $replica */
+            try {
+                if (! $replica->s3) {
+                    throw new \RuntimeException('The selected S3 storage no longer exists.');
+                }
 
-            throw new \RuntimeException('The selected S3 storage no longer exists. S3 backup has been disabled.');
+                $this->uploadToS3($replica->s3, $backupLocation, $backupDirectory, $server);
+                $replica->update(['s3_uploaded' => true, 'message' => null]);
+            } catch (Throwable $exception) {
+                $message = $this->redact($exception->getMessage());
+                $replica->update(['s3_uploaded' => false, 'message' => $message]);
+                $errors[] = ($replica->s3?->name ?? 'Deleted storage').': '.$message;
+            }
         }
 
+        $this->execution->refreshS3Summary();
+
+        return $errors;
+    }
+
+    private function uploadToS3(S3Storage $s3, string $backupLocation, string $backupDirectory, Server $server): void
+    {
         $s3->testConnection(shouldSave: true);
         $containerName = 'volume-upload-'.$this->execution->uuid;
         $image = coolifyHelperImage().':'.getHelperVersion();
@@ -398,16 +454,8 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
-    private function streamToS3Command(string $archiveScript, string $backupLocation, string $source, string $containerName, string $image): string
+    private function streamToS3Command(S3Storage $s3, string $archiveScript, string $backupLocation, string $source, string $containerName, string $image): string
     {
-        $s3 = $this->backup->s3;
-
-        if (! $s3) {
-            $this->backup->update(['save_s3' => false, 's3_storage_id' => null]);
-
-            throw new \RuntimeException('The selected S3 storage no longer exists. S3 backup has been disabled.');
-        }
-
         $s3->testConnection(shouldSave: true);
         $resolveOptions = collect(SafeWebhookUrl::minioClientResolveOptions($s3->endpoint, $s3->trustedInternalHosts()))
             ->map(fn (string $option): string => '--resolve '.escapeshellarg($option))
@@ -482,36 +530,45 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             }
         }
 
-        if ($this->backup->save_s3 && $this->backup->s3 && $this->hasRetentionLimits(
+        if ($this->backup->save_s3 && $this->hasRetentionLimits(
             $this->backup->retention_amount_s3,
             $this->backup->retention_days_s3,
             $this->backup->retention_max_storage_s3,
         )) {
+            $liveCopies = fn ($query) => $query->where('s3_uploaded', true)->where('s3_storage_deleted', false);
             $s3Executions = $this->backup->executions()
-                ->with('s3')
+                ->with(['s3Replicas' => fn ($query) => $liveCopies($query)->with('s3')])
                 ->where('status', 'success')
-                ->where('s3_uploaded', true)
-                ->where('s3_storage_deleted', false)
+                ->whereHas('s3Replicas', $liveCopies)
                 ->get();
-            $s3Executions = $this->executionsOutsideRetention(
-                $s3Executions,
-                $this->backup->retention_amount_s3,
-                $this->backup->retention_days_s3,
-                $this->backup->retention_max_storage_s3,
-            );
 
-            foreach ($s3Executions->groupBy('s3_storage_id') as $executions) {
-                $s3 = $executions->first()->s3;
+            // Each destination keeps its own copies within the same retention settings.
+            foreach ($s3Executions->flatMap->s3Replicas->pluck('s3_storage_id')->unique() as $storageId) {
+                $executions = $this->executionsOutsideRetention(
+                    $s3Executions->filter(fn (ScheduledVolumeBackupExecution $execution): bool => $execution->s3Replicas->contains('s3_storage_id', $storageId))->values(),
+                    $this->backup->retention_amount_s3,
+                    $this->backup->retention_days_s3,
+                    $this->backup->retention_max_storage_s3,
+                );
+                if ($executions->isEmpty()) {
+                    continue;
+                }
+
+                $replicas = $executions->map(fn (ScheduledVolumeBackupExecution $execution): VolumeBackupS3Replica => $execution->s3Replicas->firstWhere('s3_storage_id', $storageId));
+                $s3 = $replicas->first()->s3;
                 if (! $s3) {
-                    throw new \RuntimeException('The S3 storage used by an existing backup is unavailable.');
+                    VolumeBackupS3Replica::query()->whereKey($replicas->pluck('id')->all())->update(['s3_storage_deleted' => true]);
+                    $executions->each(fn (ScheduledVolumeBackupExecution $execution) => $execution->refreshS3Summary());
+
+                    continue;
                 }
 
                 $filenames = $executions->pluck('filename')->filter()->all();
                 if ($filenames !== []) {
                     deleteBackupsS3($filenames, $s3);
-                    $this->backup->executions()->whereKey($executions->pluck('id')->all())
-                        ->update(['s3_storage_deleted' => true]);
                 }
+                VolumeBackupS3Replica::query()->whereKey($replicas->pluck('id')->all())->update(['s3_storage_deleted' => true]);
+                $executions->each(fn (ScheduledVolumeBackupExecution $execution) => $execution->refreshS3Summary());
             }
         }
 
@@ -519,9 +576,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             ->where('local_storage_deleted', true)
             ->where('stop_recovery_pending', false)
             ->where('s3_cleanup_pending', false)
-            ->where(function (Builder $query): void {
-                $query->where('s3_storage_deleted', true)->orWhereNull('s3_uploaded');
-            })
+            ->withoutLiveS3Copies()
             ->delete();
     }
 
diff --git a/app/Jobs/VolumeBackupRecoveryJob.php b/app/Jobs/VolumeBackupRecoveryJob.php
index cda0fdd046..4965df1379 100644
--- a/app/Jobs/VolumeBackupRecoveryJob.php
+++ b/app/Jobs/VolumeBackupRecoveryJob.php
@@ -295,12 +295,19 @@ class VolumeBackupRecoveryJob implements ShouldBeEncrypted, ShouldBeUnique, Shou
         ]);
     }
 
+    /**
+     * Deletes the partial upload from every destination whose copy did not finish uploading. Every destination is
+     * tried; the first failure is rethrown afterwards and keeps the cleanup pending.
+     */
     public static function cleanupS3Upload(ScheduledVolumeBackupExecution $execution): void
     {
-        $execution->loadMissing('s3');
-        $s3 = $execution->s3;
+        $replicas = $execution->s3Replicas()
+            ->with('s3')
+            ->where('s3_storage_deleted', false)
+            ->where(fn ($query) => $query->whereNull('s3_uploaded')->orWhere('s3_uploaded', false))
+            ->get();
 
-        if (! $s3 || blank($execution->filename)) {
+        if ($replicas->isEmpty() || blank($execution->filename)) {
             self::skipRecovery(
                 $execution,
                 ['s3_cleanup_pending' => false],
@@ -310,11 +317,25 @@ class VolumeBackupRecoveryJob implements ShouldBeEncrypted, ShouldBeUnique, Shou
             return;
         }
 
-        deleteBackupsS3($execution->filename, $s3);
-        $execution->update([
-            's3_cleanup_pending' => false,
-            's3_storage_deleted' => true,
-        ]);
+        $failure = null;
+        foreach ($replicas as $replica) {
+            try {
+                if ($replica->s3) {
+                    deleteBackupsS3($execution->filename, $replica->s3);
+                }
+                $replica->update(['s3_storage_deleted' => true]);
+            } catch (Throwable $exception) {
+                $failure ??= $exception;
+            }
+        }
+
+        $execution->refreshS3Summary();
+
+        if ($failure) {
+            throw $failure;
+        }
+
+        $execution->update(['s3_cleanup_pending' => false]);
     }
 
     /**
diff --git a/app/Listeners/FinishServerPackagesUpdate.php b/app/Listeners/FinishServerPackagesUpdate.php
new file mode 100644
index 0000000000..142859fafb
--- /dev/null
+++ b/app/Listeners/FinishServerPackagesUpdate.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Listeners;
+
+use App\Enums\ProcessStatus;
+use App\Events\ServerPackagesUpdateFinished;
+use App\Jobs\ServerPatchCheckJob;
+use App\Models\Server;
+use Spatie\Activitylog\Models\Activity;
+
+/**
+ * Records the result of a package update in the audit log and checks the server again.
+ */
+class FinishServerPackagesUpdate
+{
+    public function handle(ServerPackagesUpdateFinished $event): void
+    {
+        $server = Server::query()->where('uuid', $event->data['server_uuid'] ?? null)->first();
+        if ($server === null) {
+            return;
+        }
+
+        $activity = Activity::query()->where('properties->type_uuid', $event->data['update_id'] ?? null)->first();
+        $status = data_get($activity, 'properties.status');
+        $packages = $event->data['packages'] ?? [];
+
+        auditLog('ui.server.packages_update_finished', [
+            'team_id' => $server->team_id,
+            'server_uuid' => $server->uuid,
+            'server_name' => $server->name,
+            'packages' => $packages === [] ? 'all' : $packages,
+            'package_manager' => $event->data['package_manager'] ?? null,
+            'activity_id' => $activity?->id,
+            'result' => $status === ProcessStatus::FINISHED->value ? 'success' : 'failed',
+            'exit_code' => data_get($activity, 'properties.exitCode'),
+            'actor_id' => $event->data['actor_id'] ?? null,
+            'actor_name' => $event->data['actor_name'] ?? null,
+            'actor_email' => $event->data['actor_email'] ?? null,
+        ], $status === ProcessStatus::FINISHED->value ? 'info' : 'error');
+
+        ServerPatchCheckJob::dispatchManual($server);
+    }
+}
diff --git a/app/Listeners/ProxyStatusChangedNotification.php b/app/Listeners/ProxyStatusChangedNotification.php
index 9b117d4e13..74851cee52 100644
--- a/app/Listeners/ProxyStatusChangedNotification.php
+++ b/app/Listeners/ProxyStatusChangedNotification.php
@@ -33,6 +33,7 @@ class ProxyStatusChangedNotification implements ShouldQueueAfterCommit
 
         if ($status === 'running') {
             $server->setupDefaultRedirect();
+            $server->setupMaintenancePages();
             $server->setupDynamicProxyConfiguration();
             $server->proxy->force_stop = false;
             $server->save();
diff --git a/app/Livewire/Analytics.php b/app/Livewire/Analytics.php
index e4400f58ec..007618501c 100644
--- a/app/Livewire/Analytics.php
+++ b/app/Livewire/Analytics.php
@@ -109,7 +109,7 @@ class Analytics extends Component
     private const MAX_LEADERBOARD_APPS = 200;
 
     /** @var array<int, string> */
-    protected array $breakdownDimensions = ['country', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
+    protected array $breakdownDimensions = ['country', 'city', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
 
     /**
      * Per-request cache of Sentinel key => display metadata, so resolving a name/domain/link
diff --git a/app/Livewire/Concerns/BuildsMetricsChartPayload.php b/app/Livewire/Concerns/BuildsMetricsChartPayload.php
new file mode 100644
index 0000000000..12796c81e6
--- /dev/null
+++ b/app/Livewire/Concerns/BuildsMetricsChartPayload.php
@@ -0,0 +1,135 @@
+<?php
+
+namespace App\Livewire\Concerns;
+
+use App\Services\FleetMetricsAggregator;
+
+trait BuildsMetricsChartPayload
+{
+    /**
+     * Sparklines read at a glance, not on close inspection, so they carry far fewer
+     * points than the full trend charts (industry guidance is ~10-50 per spark). All
+     * KPI-tile sparks share one downsampled axis so their shapes stay comparable.
+     */
+    private const SPARK_MAX_POINTS = 40;
+
+    /**
+     * @param  array{cpu: array, memory: array, disk: array, load: array, networkRx: array, networkTx: array}  $seriesByServer
+     * @return array<string, mixed>
+     */
+    protected function buildChartPayload(array $seriesByServer): array
+    {
+        $cpu = FleetMetricsAggregator::sumSeriesByBucket($seriesByServer['cpu'], 'avg');
+        $memory = FleetMetricsAggregator::sumSeriesByBucket($seriesByServer['memory'], 'sum');
+        $disk = FleetMetricsAggregator::sumSeriesByBucket($seriesByServer['disk'], 'avg');
+        $load = FleetMetricsAggregator::sumSeriesByBucket($seriesByServer['load'], 'avg');
+        $networkRx = FleetMetricsAggregator::sumSeriesByBucket($seriesByServer['networkRx'], 'sum');
+        $networkTx = FleetMetricsAggregator::sumSeriesByBucket($seriesByServer['networkTx'], 'sum');
+
+        // Throughput spark = rx + tx per bucket.
+        $network = $this->combineSeries($networkRx, $networkTx);
+        $categories = $this->sparkCategories($cpu, $memory, $disk, $network);
+
+        [$sparkCategories, $sparks] = $this->capSparks($categories, [
+            'cpuSpark' => $this->alignSpark($cpu, $categories),
+            'memSpark' => $this->alignSpark($memory, $categories),
+            'diskSpark' => $this->alignSpark($disk, $categories),
+            'netSpark' => $this->alignSpark($network, $categories),
+        ], self::SPARK_MAX_POINTS);
+
+        return [
+            'range' => $this->range,
+            'cpu' => $cpu,
+            'memory' => $memory,
+            'disk' => $disk,
+            'load' => $load,
+            'networkRx' => $networkRx,
+            'networkTx' => $networkTx,
+            // KPI-tile sparklines: values-only series on one shared, capped time axis.
+            'sparkCategories' => $sparkCategories,
+        ] + $sparks;
+    }
+
+    /**
+     * Thin every spark and the shared axis to at most $max points using the same
+     * evenly-spaced indices (first and last always kept), so the series stay aligned.
+     *
+     * @param  array<int, int>  $categories
+     * @param  array<string, array<int, float|int|null>>  $sparks
+     * @return array{0: array<int, int>, 1: array<string, array<int, float|int|null>>}
+     */
+    private function capSparks(array $categories, array $sparks, int $max): array
+    {
+        $count = count($categories);
+        if ($count <= $max || $max < 2) {
+            return [$categories, $sparks];
+        }
+
+        $indices = [];
+        for ($i = 0; $i < $max; $i++) {
+            $indices[] = (int) round($i * ($count - 1) / ($max - 1));
+        }
+        $indices = array_values(array_unique($indices));
+
+        $pick = fn (array $values): array => array_values(array_map(fn (int $i) => $values[$i], $indices));
+
+        return [$pick($categories), array_map($pick, $sparks)];
+    }
+
+    /**
+     * Sum two [ts, value] series bucket-by-bucket into one sorted [ts, value] series.
+     *
+     * @param  array<int, array{0: int, 1: float}>  $a
+     * @param  array<int, array{0: int, 1: float}>  $b
+     * @return array<int, array{0: int, 1: float}>
+     */
+    private function combineSeries(array $a, array $b): array
+    {
+        $map = [];
+        foreach ([$a, $b] as $series) {
+            foreach ($series as [$ts, $value]) {
+                $map[$ts] = ($map[$ts] ?? 0.0) + (float) $value;
+            }
+        }
+        ksort($map);
+
+        return array_map(fn ($ts, $value) => [(int) $ts, $value], array_keys($map), array_values($map));
+    }
+
+    /**
+     * Sorted union of bucket timestamps across every series (the shared spark x-axis).
+     *
+     * @param  array<int, array{0: int, 1: float}>  ...$seriesList
+     * @return array<int, int>
+     */
+    private function sparkCategories(array ...$seriesList): array
+    {
+        $set = [];
+        foreach ($seriesList as $series) {
+            foreach ($series as [$ts]) {
+                $set[(int) $ts] = true;
+            }
+        }
+        $categories = array_keys($set);
+        sort($categories);
+
+        return $categories;
+    }
+
+    /**
+     * Project a [ts, value] series onto the shared category axis, leaving gaps as null.
+     *
+     * @param  array<int, array{0: int, 1: float}>  $series
+     * @param  array<int, int>  $categories
+     * @return array<int, float|int|null>
+     */
+    private function alignSpark(array $series, array $categories): array
+    {
+        $map = [];
+        foreach ($series as [$ts, $value]) {
+            $map[(int) $ts] = $value;
+        }
+
+        return array_map(fn ($ts) => $map[$ts] ?? null, $categories);
+    }
+}
diff --git a/app/Livewire/Concerns/BuildsTrafficChartPayload.php b/app/Livewire/Concerns/BuildsTrafficChartPayload.php
index eb57c855fb..d1c16672be 100644
--- a/app/Livewire/Concerns/BuildsTrafficChartPayload.php
+++ b/app/Livewire/Concerns/BuildsTrafficChartPayload.php
@@ -4,7 +4,7 @@ namespace App\Livewire\Concerns;
 
 /**
  * Shared derivations for the traffic chart payload: per-bucket sparkline series,
- * the device-donut labels/series, and the globe's per-country marker data. Consumed
+ * the device-donut labels/series, and the globe's marker data. Consumed
  * by both the global and per-application analytics components, which expose
  * `$series` (status buckets) and `$breakdowns` (dimension rows).
  */
@@ -77,22 +77,13 @@ trait BuildsTrafficChartPayload
     }
 
     /**
-     * Per-country marker data for the globe: [{code, requests}] over known ISO-A2 rows.
+     * Marker data for the globe: country markers and city markers, one set for each view.
      *
-     * @return array<int, array{code: string, requests: int}>
+     * @return array{countries: array<int, array{code: string, requests: int}>, cities: array<int, array{lat: float, lon: float, requests: int}>}
      */
     protected function geoMarkers(): array
     {
-        $out = [];
-        foreach (($this->breakdowns['country'] ?? []) as $row) {
-            $code = strtoupper((string) ($row['value'] ?? ''));
-            $requests = (int) ($row['requests'] ?? 0);
-            if (preg_match('/^[A-Z]{2}$/', $code) && $requests > 0) {
-                $out[] = ['code' => $code, 'requests' => $requests];
-            }
-        }
-
-        return $out;
+        return trafficGeoMarkers($this->breakdowns['country'] ?? [], trafficCityRows($this->breakdowns['city'] ?? []));
     }
 
     /**
diff --git a/app/Livewire/Concerns/CreatesEnvironments.php b/app/Livewire/Concerns/CreatesEnvironments.php
new file mode 100644
index 0000000000..1212cb70f0
--- /dev/null
+++ b/app/Livewire/Concerns/CreatesEnvironments.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Livewire\Concerns;
+
+use App\Models\Environment;
+use App\Support\ValidationPatterns;
+
+/**
+ * "New environment" modal of the project page and the project canvas.
+ * The component must have a $project property.
+ */
+trait CreatesEnvironments
+{
+    public string $name;
+
+    public ?string $description = null;
+
+    protected function rules(): array
+    {
+        return [
+            'name' => ValidationPatterns::nameRules(),
+            'description' => ValidationPatterns::descriptionRules(),
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return ValidationPatterns::combinedMessages();
+    }
+
+    public function submit()
+    {
+        try {
+            $this->authorize('update', $this->project);
+            $this->validate();
+            $environment = Environment::create([
+                'name' => $this->name,
+                'project_id' => $this->project->id,
+                'uuid' => new_public_id(),
+            ]);
+
+            return redirectRoute($this, 'project.resource.index', [
+                'project_uuid' => $this->project->uuid,
+                'environment_uuid' => $environment->uuid,
+            ]);
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+}
diff --git a/app/Livewire/Concerns/CreatesTags.php b/app/Livewire/Concerns/CreatesTags.php
new file mode 100644
index 0000000000..0b61825511
--- /dev/null
+++ b/app/Livewire/Concerns/CreatesTags.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Livewire\Concerns;
+
+use App\Models\Tag;
+use Illuminate\Validation\ValidationException;
+
+/**
+ * "New tag" modal of the tags list and the tags canvas.
+ */
+trait CreatesTags
+{
+    public string $newTagName = '';
+
+    public function createTag()
+    {
+        try {
+            $this->authorize('create', Tag::class);
+            $this->validate(
+                ['newTagName' => ['required', 'string', 'min:2', 'max:255', 'regex:/^\S+$/']],
+                ['newTagName.regex' => 'A tag name cannot contain spaces.'],
+            );
+            $name = strtolower(trim(strip_tags($this->newTagName)));
+            if (mb_strlen($name) < 2) {
+                throw ValidationException::withMessages(['newTagName' => 'The tag name must be at least 2 characters after sanitization.']);
+            }
+            if (Tag::ownedByCurrentTeam()->where('name', $name)->exists()) {
+                throw ValidationException::withMessages(['newTagName' => 'A tag with this name already exists.']);
+            }
+            Tag::create(['name' => $name, 'team_id' => currentTeam()->id]);
+
+            return $this->redirectRoute('tags.show', ['tagName' => $name], navigate: true);
+        } catch (ValidationException $e) {
+            throw $e;
+        } catch (\Exception $e) {
+            return handleError($e, $this);
+        }
+    }
+}
diff --git a/app/Livewire/Concerns/ManagesDatabaseBackup.php b/app/Livewire/Concerns/ManagesDatabaseBackup.php
new file mode 100644
index 0000000000..64eaffa1a1
--- /dev/null
+++ b/app/Livewire/Concerns/ManagesDatabaseBackup.php
@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Livewire\Concerns;
+
+use App\Jobs\DatabaseBackupJob;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
+use Illuminate\Http\RedirectResponse;
+use Livewire\Features\SupportRedirects\Redirector;
+
+trait ManagesDatabaseBackup
+{
+    /**
+     * Turn the backup schedule on or off and return the new state.
+     */
+    protected function toggleDatabaseBackup(ScheduledDatabaseBackup $backup): bool
+    {
+        $this->authorize('manageBackups', $backup->database);
+
+        $backup->enabled = ! $backup->enabled;
+        $changedFields = auditChangedFields($backup);
+        $backup->save();
+
+        $database = $backup->database;
+        auditLog('ui.database.backup_schedule_updated', [
+            'team_id' => $database?->team()?->id,
+            'database_uuid' => $database?->uuid,
+            'database_name' => $database?->name,
+            'backup_uuid' => $backup->uuid,
+            'changed_fields' => $changedFields,
+        ]);
+        $this->dispatch('success', $backup->enabled ? 'Backup enabled.' : 'Backup disabled.');
+
+        return $backup->enabled;
+    }
+
+    /**
+     * Queue a backup run now and redirect to the executions page of the backup.
+     */
+    protected function queueDatabaseBackup(ScheduledDatabaseBackup $backup): Redirector|RedirectResponse|null
+    {
+        $this->authorize('manageBackups', $backup->database);
+
+        $database = $backup->database->refresh();
+        if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
+            $this->dispatch('error', 'The database must be running to start a backup.');
+
+            return null;
+        }
+
+        DatabaseBackupJob::dispatch($backup);
+        auditLog('ui.database.backup_started', [
+            'team_id' => $database->team()?->id,
+            'database_uuid' => $database->uuid,
+            'database_name' => $database->name,
+            'backup_uuid' => $backup->uuid,
+        ]);
+        $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+
+        if ($database instanceof ServiceDatabase) {
+            return redirect()->route('project.service.database.backup.executions', [
+                'project_uuid' => $database->service->project()->uuid,
+                'environment_uuid' => $database->service->environment->uuid,
+                'service_uuid' => $database->service->uuid,
+                'stack_service_uuid' => $database->uuid,
+                'backup_uuid' => $backup->uuid,
+            ]);
+        }
+
+        // Instance databases (e.g. coolify-db) have no project/environment.
+        // Stay on the current page (settings.backup) instead of redirecting.
+        $project = $database->project();
+        $environment = $database->environment;
+        if (! $project || ! $environment) {
+            return null;
+        }
+
+        return redirect()->route('project.database.backup.executions', [
+            'project_uuid' => $project->uuid,
+            'environment_uuid' => $environment->uuid,
+            'database_uuid' => $database->uuid,
+            'backup_uuid' => $backup->uuid,
+        ]);
+    }
+}
diff --git a/app/Livewire/Concerns/RemembersCanvasView.php b/app/Livewire/Concerns/RemembersCanvasView.php
new file mode 100644
index 0000000000..4d7e4f29d8
--- /dev/null
+++ b/app/Livewire/Concerns/RemembersCanvasView.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Livewire\Concerns;
+
+use Illuminate\Support\Facades\Cookie;
+use Livewire\Attributes\Renderless;
+
+/**
+ * Remembers the last view (table, grid, list, or canvas) of a list page per user,
+ * so the page opens the canvas again when the user left it on the canvas.
+ * One cookie per user and page holds the choice; the server reads it before
+ * rendering, so the page does not flash the list before it opens the canvas.
+ */
+trait RemembersCanvasView
+{
+    private const array CANVAS_VIEW_PAGES = ['servers', 'server_resources', 'projects', 'project', 'environment', 'tags', 'team_variables', 'project_variables', 'environment_variables', 'server_variables', 'dashboard', 'dashboard_projects', 'dashboard_servers'];
+
+    private const array LIST_VIEWS = ['table', 'grid', 'list'];
+
+    /**
+     * List page switcher: remember table or grid without a re-render.
+     */
+    #[Renderless]
+    public function saveListView(string $page, string $view): void
+    {
+        if (in_array($page, self::CANVAS_VIEW_PAGES, true) && in_array($view, self::LIST_VIEWS, true)) {
+            $this->rememberView($page, $view);
+        }
+    }
+
+    /**
+     * @param  'servers'|'server_resources'|'projects'|'project'|'environment'|'tags'|'team_variables'|'project_variables'|'environment_variables'|'server_variables'  $page
+     * @param  'table'|'grid'|'list'|'canvas'  $view
+     */
+    protected function rememberView(string $page, string $view): void
+    {
+        Cookie::queue(Cookie::forever($this->viewCookieName($page), $view));
+    }
+
+    /**
+     * List page: true when the user last used the canvas. A ?view=table|grid|list link
+     * (the switcher on the canvas page) picks the list again and is remembered.
+     *
+     * @param  'servers'|'server_resources'|'projects'|'project'|'environment'|'tags'|'team_variables'|'project_variables'|'environment_variables'|'server_variables'  $page
+     */
+    protected function prefersCanvasView(string $page): bool
+    {
+        $view = request()->query('view');
+        if (in_array($view, self::LIST_VIEWS, true)) {
+            $this->rememberView($page, $view);
+
+            return false;
+        }
+
+        return request()->cookie($this->viewCookieName($page)) === 'canvas';
+    }
+
+    /**
+     * List page: the remembered list view (table or grid), or $default.
+     */
+    protected function listView(string $page, string $default): string
+    {
+        foreach ([request()->query('view'), request()->cookie($this->viewCookieName($page))] as $view) {
+            if (in_array($view, ['table', 'grid'], true)) {
+                return $view;
+            }
+        }
+
+        return $default;
+    }
+
+    private function viewCookieName(string $page): string
+    {
+        return 'coolify_'.auth()->id().'_'.$page.'_view';
+    }
+}
diff --git a/app/Livewire/Dashboard.php b/app/Livewire/Dashboard.php
index 2fc2553512..aa32fe6770 100644
--- a/app/Livewire/Dashboard.php
+++ b/app/Livewire/Dashboard.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
@@ -11,6 +12,8 @@ use Livewire\Component;
 
 class Dashboard extends Component
 {
+    use RemembersCanvasView;
+
     public Collection $projects;
 
     public Collection $servers;
@@ -19,6 +22,12 @@ class Dashboard extends Component
 
     public function mount()
     {
+        if ($this->prefersCanvasView('dashboard')) {
+            $this->redirectRoute('dashboard.canvas', navigate: true);
+
+            return;
+        }
+
         $this->privateKeys = PrivateKey::ownedByCurrentTeamCached();
         $this->servers = Server::ownedByCurrentTeamCached();
         $this->projects = Project::ownedByCurrentTeam()
diff --git a/app/Livewire/Dashboard/Canvas.php b/app/Livewire/Dashboard/Canvas.php
new file mode 100644
index 0000000000..8aba6c5f54
--- /dev/null
+++ b/app/Livewire/Dashboard/Canvas.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Livewire\Dashboard;
+
+use App\Livewire\Concerns\RemembersCanvasView;
+use Illuminate\Contracts\View\View;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+/**
+ * Dashboard as a canvas: every server of the team with its resources and their running deployments.
+ * The page is a shell: resources/js/environment-canvas.js renders it from
+ * Api\ServerCanvasController::dashboard at /canvas/api with the browser session.
+ */
+class Canvas extends Component
+{
+    use RemembersCanvasView;
+
+    /** The team that owned the page at mount; the canvas API calls use it, not the session team. */
+    #[Locked]
+    public int $teamId;
+
+    public function mount(): void
+    {
+        $this->teamId = currentTeam()->id;
+        $this->rememberView('dashboard', 'canvas');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.dashboard.canvas')->layout('layouts.app', ['fullBleed' => true]);
+    }
+}
diff --git a/app/Livewire/DeployCanvas.php b/app/Livewire/DeployCanvas.php
new file mode 100644
index 0000000000..3f2c6d4164
--- /dev/null
+++ b/app/Livewire/DeployCanvas.php
@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Models\Project;
+use Illuminate\Contracts\View\View;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+/**
+ * Full-screen deploy canvas, opened from an environment's New resource page. The
+ * page is a shell: resources/js/canvas/deploy (Svelte) renders the canvas and calls the
+ * API controllers at /canvas/api with the browser session, so the API enforces
+ * team scope and token permissions.
+ */
+class DeployCanvas extends Component
+{
+    /** The team that owned the page at mount; the canvas API calls use it, not the session team. */
+    #[Locked]
+    public int $teamId;
+
+    public function mount(): void
+    {
+        $this->teamId = currentTeam()->id;
+    }
+
+    public function render(): View
+    {
+        return view('livewire.deploy-canvas', [
+            'serviceTemplates' => $this->serviceTemplates(),
+            'serviceLogos' => $this->serviceLogos(),
+            'resourceLogos' => $this->resourceLogos(),
+            // Only shows the "New project / environment" rows; the API checks again.
+            'canAddProjects' => auth()->user()->can('create', Project::class),
+        ])->layout('layouts.app', ['fullBleed' => true]);
+    }
+
+    /**
+     * The versioned URLs of the logos in public/svgs/resources for the step icons: name => URL.
+     *
+     * @return array<string, string>
+     */
+    private function resourceLogos(): array
+    {
+        return collect(glob(public_path('svgs/resources/*.svg')) ?: [])
+            ->mapWithKeys(fn (string $path): array => [basename($path, '.svg') => resource_logo_url(basename($path, '.svg'))])
+            ->all();
+    }
+
+    /**
+     * Service template logos for the Service step icon, as resource_logo() shows them:
+     * template key => [logo URL, CDN fallback URL]. Templates without a logo are left out.
+     *
+     * @return array<string, array{0: string, 1: string}>
+     */
+    private function serviceLogos(): array
+    {
+        return get_service_templates()
+            ->map(fn ($template): mixed => data_get($template, 'logo'))
+            ->filter(fn (mixed $logo): bool => is_string($logo) && $logo !== '' && basename($logo) !== 'default.webp')
+            ->map(function (string $logo): array {
+                $urls = service_logo_urls($logo);
+
+                return [$urls['logo'], $urls['logo_cdn_url']];
+            })
+            ->all();
+    }
+
+    /**
+     * One-click service templates for the Service step: the keys that the
+     * services API accepts, with the names of the New resource page.
+     *
+     * @return list<array{0: string, 1: string}>
+     */
+    private function serviceTemplates(): array
+    {
+        return get_service_templates()->keys()
+            ->map(fn ($key): array => [(string) $key, str((string) $key)->headline()->value()])
+            ->sortBy(fn (array $template): string => strtolower($template[1]))
+            ->values()
+            ->all();
+    }
+}
diff --git a/app/Livewire/DeploymentsIndicator.php b/app/Livewire/DeploymentsIndicator.php
index a59ccf9142..6f810b9edc 100644
--- a/app/Livewire/DeploymentsIndicator.php
+++ b/app/Livewire/DeploymentsIndicator.php
@@ -4,14 +4,26 @@ namespace App\Livewire;
 
 use App\Models\ApplicationDeploymentQueue;
 use Livewire\Attributes\Computed;
+use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class DeploymentsIndicator extends Component
 {
     /**
-     * Where the indicator is rendered: 'sidebar' (desktop sidebar footer) or 'mobile' (mobile top bar).
+     * Where the indicator is rendered: 'topbar' (desktop top bar) or 'mobile' (mobile top bar).
      */
-    public string $variant = 'sidebar';
+    public string $variant = 'topbar';
+
+    /**
+     * The application on the current page. Its heading has its own "Deploying…" indicator.
+     */
+    #[Locked]
+    public ?string $currentApplicationUuid = null;
+
+    public function mount(): void
+    {
+        $this->currentApplicationUuid = request()->route('application_uuid');
+    }
 
     #[Computed]
     public function deployments()
@@ -38,6 +50,16 @@ class DeploymentsIndicator extends Component
         return $this->deployments->count();
     }
 
+    /**
+     * Hide the counter when it would only repeat the current page's "Deploying…" indicator.
+     */
+    #[Computed]
+    public function isOnlyCurrentApplicationDeploying(): bool
+    {
+        return $this->currentApplicationUuid !== null
+            && $this->deployments->every(fn ($deployment) => $deployment->application?->uuid === $this->currentApplicationUuid);
+    }
+
     public function render()
     {
         return view('livewire.deployments-indicator');
diff --git a/app/Livewire/Fleet/Metrics.php b/app/Livewire/Fleet/Metrics.php
new file mode 100644
index 0000000000..bcf6917499
--- /dev/null
+++ b/app/Livewire/Fleet/Metrics.php
@@ -0,0 +1,377 @@
+<?php
+
+namespace App\Livewire\Fleet;
+
+use App\Livewire\Concerns\BuildsMetricsChartPayload;
+use App\Models\Application;
+use App\Models\Server;
+use App\Services\FleetMetricsAggregator;
+use App\Services\SentinelMetricsClient;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Concurrency;
+use Livewire\Attributes\Lazy;
+use Livewire\Attributes\Url;
+use Livewire\Component;
+
+#[Lazy]
+class Metrics extends Component
+{
+    use AuthorizesRequests;
+    use BuildsMetricsChartPayload;
+
+    public string $chartId = 'fleet-metrics';
+
+    /** Metrics-enabled servers owned by the current team. */
+    public Collection $servers;
+
+    /** @var array<string, string> uuid => name */
+    public array $serverOptions = [];
+
+    /** @var array<int, string> Names of the servers where the user can turn metrics on; filled only when no server has metrics. */
+    public array $enableableServers = [];
+
+    #[Url(as: 'range')]
+    public string $range = '24h';
+
+    #[Url(as: 'server')]
+    public string $serverUuid = '';
+
+    #[Url(as: 'cmetric')]
+    public string $containerMetric = 'cpu';
+
+    private const CONTAINER_METRICS = ['cpu', 'memory', 'disk', 'network'];
+
+    public bool $live = false;
+
+    /** @var array<string, mixed> */
+    public array $kpis = [];
+
+    /** @var array<int, array<string, mixed>> */
+    public array $serverRows = [];
+
+    /** @var array<int, array<string, mixed>> All fetched containers, kept so the metric toggle re-ranks without re-fetching. */
+    public array $containersRaw = [];
+
+    /** @var array<int, array<string, mixed>> */
+    public array $topContainers = [];
+
+    /** @var array<string, mixed> Trend series for the charts, also embedded for first paint. */
+    public array $chartData = [];
+
+    /** @var array<string, array{name: string, link: ?string}> */
+    protected array $containerMetaCache = [];
+
+    public function mount(): void
+    {
+        $this->refreshServers();
+
+        $this->normalizeContainerMetric();
+
+        if ($this->servers->isNotEmpty()) {
+            $this->loadData();
+        }
+    }
+
+    public function hydrate(): void
+    {
+        $previous = array_column($this->serverRows, 'uuid');
+        $this->refreshServers();
+        $current = $this->targetServers()->pluck('uuid')->all();
+        sort($previous);
+        sort($current);
+
+        if ($previous !== $current) {
+            $this->loadData();
+        }
+    }
+
+    private function refreshServers(): void
+    {
+        abort_unless(currentTeam() !== null, 403);
+        $teamServers = Server::ownedByCurrentTeam()->get();
+        $this->servers = $teamServers
+            ->filter(fn (Server $server) => $server->isMetricsEnabled())
+            ->values();
+        $this->enableableServers = $this->servers->isEmpty()
+            ? $this->serversWithoutMetrics($teamServers)->pluck('name')->all()
+            : [];
+
+        foreach ($this->servers as $server) {
+            $this->authorize('view', $server);
+        }
+
+        $this->serverOptions = $this->servers
+            ->mapWithKeys(fn (Server $server) => [$server->uuid => $server->name])
+            ->all();
+
+        if ($this->serverUuid !== '' && ! array_key_exists($this->serverUuid, $this->serverOptions)) {
+            $this->serverUuid = '';
+        }
+    }
+
+    /**
+     * Servers that can report metrics, have them off, are reachable, and that the user can change.
+     * An unreachable server cannot start Sentinel, so it stays out.
+     *
+     * @param  Collection<int, Server>  $teamServers
+     * @return Collection<int, Server>
+     */
+    private function serversWithoutMetrics(Collection $teamServers): Collection
+    {
+        return $teamServers
+            ->filter(fn (Server $server) => ! $server->isMetricsEnabled()
+                && $server->isSentinelEnabled()
+                && auth()->user()->can('update', $server)
+                && $server->isFunctional())
+            ->values();
+    }
+
+    public function enableMetrics(): void
+    {
+        try {
+            abort_unless(currentTeam() !== null, 403);
+            $servers = $this->serversWithoutMetrics(Server::ownedByCurrentTeam()->get());
+            if ($servers->isEmpty()) {
+                return;
+            }
+
+            // One failed server must not stop the others, so each server has its own try.
+            $failed = [];
+            foreach ($servers as $server) {
+                try {
+                    $server->settings->is_metrics_enabled = true;
+                    // Saved quietly: Sentinel is started below, so the settings hook must not start it a second time.
+                    $server->settings->saveQuietly();
+                    auditLog('ui.server.sentinel.updated', [
+                        'team_id' => $server->team_id,
+                        'server_uuid' => $server->uuid,
+                        'server_name' => $server->name,
+                        'changed_fields' => ['is_metrics_enabled'],
+                    ]);
+                    $server->restartSentinel();
+                } catch (\Throwable $e) {
+                    report($e);
+                    $failed[] = $server->name;
+                }
+            }
+
+            $this->loadData();
+            $enabled = $servers->count() - count($failed);
+            if ($enabled > 0) {
+                $this->dispatch('success', 'Metrics enabled on '.$enabled.' '.str('server')->plural($enabled).'. Sentinel is starting, data shows in about one minute.');
+            }
+            if ($failed !== []) {
+                $this->dispatch('error', 'Could not enable metrics on '.implode(', ', $failed).'. Check the server settings and try again.');
+            }
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function updatedServerUuid(): void
+    {
+        $this->loadData();
+    }
+
+    public function updatedContainerMetric(): void
+    {
+        $this->normalizeContainerMetric();
+
+        // Re-rank the already-fetched containers; no need to re-hit Sentinel.
+        $this->topContainers = FleetMetricsAggregator::rankContainers($this->containersRaw, $this->containerMetric);
+    }
+
+    private function normalizeContainerMetric(): void
+    {
+        if (! in_array($this->containerMetric, self::CONTAINER_METRICS, true)) {
+            $this->containerMetric = 'cpu';
+        }
+    }
+
+    public function setRange(string $range): void
+    {
+        $this->range = in_array($range, ['24h', '7d', '30d'], true) ? $range : '24h';
+        $this->loadData();
+    }
+
+    public function isLivePollable(): bool
+    {
+        return $this->live && $this->range === '24h';
+    }
+
+    /**
+     * @return Collection<int, Server>
+     */
+    protected function targetServers(): Collection
+    {
+        if ($this->serverUuid !== '') {
+            return $this->servers->filter(fn (Server $s) => $s->uuid === $this->serverUuid)->values();
+        }
+
+        return $this->servers;
+    }
+
+    public function loadData(): void
+    {
+        $this->refreshServers();
+        $this->normalizeContainerMetric();
+
+        $rows = [];
+        $containers = [];
+        $series = ['cpu' => [], 'memory' => [], 'disk' => [], 'load' => [], 'networkRx' => [], 'networkTx' => []];
+
+        $targets = $this->targetServers();
+        $clients = [];
+        $summaryTasks = [];
+        foreach ($targets as $server) {
+            $client = $clients[$server->uuid] = $this->metricsClient($server);
+            $summaryTasks[$server->uuid] = static fn () => $client->summary();
+        }
+        $summaries = $this->runMetricTasks($summaryTasks);
+        $tasks = [];
+        $range = $this->range;
+        foreach ($clients as $uuid => $client) {
+            $metrics = $summaries[$uuid] === null ? ['cpu', 'memory'] : ['cpu', 'memory', 'disk', 'load'];
+            foreach ($metrics as $metric) {
+                $tasks[$uuid.':'.$metric] = static fn () => $client->history($metric, $range);
+            }
+            if ($summaries[$uuid] !== null) {
+                $tasks[$uuid.':containers'] = static fn () => $client->containersCurrent();
+                $tasks[$uuid.':network'] = static fn () => $client->networkHistory($range);
+            }
+        }
+        $results = $this->runMetricTasks($tasks);
+
+        foreach ($targets as $server) {
+            $summary = $summaries[$server->uuid];
+            foreach (['cpu', 'memory', 'disk', 'load'] as $metric) {
+                $series[$metric][] = $results[$server->uuid.':'.$metric] ?? [];
+            }
+
+            if ($summary === null) {
+                $rows[] = $this->offlineRow($server);
+
+                continue;
+            }
+
+            $current = $results[$server->uuid.':containers'] ?? [];
+            $rows[] = array_merge(
+                ['uuid' => $server->uuid, 'name' => $server->name, 'online' => true, 'containers' => count($current)],
+                $summary
+            );
+
+            foreach ($current as $c) {
+                // Names/images are resolved lazily for the displayed rows only (containerMeta),
+                // so a server with many containers doesn't trigger a resolve storm here.
+                $containers[] = array_merge($c, ['server' => $server->name, 'serverUuid' => $server->uuid]);
+            }
+
+            $net = $results[$server->uuid.':network'] ?? ['rx' => [], 'tx' => []];
+            $series['networkRx'][] = $net['rx'];
+            $series['networkTx'][] = $net['tx'];
+        }
+
+        $this->serverRows = $rows;
+        $this->kpis = FleetMetricsAggregator::fleetKpis($rows);
+        $this->containersRaw = $containers;
+        $this->topContainers = FleetMetricsAggregator::rankContainers($containers, $this->containerMetric);
+        $this->chartData = $this->buildChartPayload($series);
+
+        $this->dispatch("refreshChartData-{$this->chartId}", $this->chartData);
+    }
+
+    /**
+     * Bound the number of PHP workers and SSH connections for large fleets.
+     *
+     * @param  array<string, \Closure>  $tasks
+     * @return array<string, mixed>
+     */
+    protected function runMetricTasks(array $tasks): array
+    {
+        foreach ($tasks as $key => $task) {
+            $tasks[$key] = static function () use ($task) {
+                try {
+                    return $task();
+                } catch (\Throwable) {
+                    return null;
+                }
+            };
+        }
+        $results = [];
+        foreach (array_chunk($tasks, 8, true) as $batch) {
+            $results += Concurrency::run($batch);
+        }
+
+        return $results;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function offlineRow(Server $server): array
+    {
+        return [
+            'uuid' => $server->uuid, 'name' => $server->name, 'online' => false,
+            'cpu' => null, 'memUsed' => null, 'memTotal' => null,
+            'diskUsed' => null, 'diskTotal' => null, 'diskPercent' => null,
+            'load1' => null, 'netRx' => null, 'netTx' => null, 'containers' => null,
+        ];
+    }
+
+    protected function metricsClient(Server $server): SentinelMetricsClient
+    {
+        $server->settings->ensureValidSentinelToken();
+
+        return app(SentinelMetricsClient::class, ['server' => $server]);
+    }
+
+    /**
+     * Resolve a Sentinel container id (the resource uuid Sentinel keys by) to a
+     * team-owned resource name, docker image, and metrics link, memoized. Shows the raw
+     * id and no image when no team-owned resource matches, so a Sentinel id never
+     * discloses another team's resource.
+     *
+     * @return array{name: string, image: ?string, link: ?string}
+     */
+    public function containerMeta(string $id): array
+    {
+        if (isset($this->containerMetaCache[$id])) {
+            return $this->containerMetaCache[$id];
+        }
+
+        $teamId = currentTeam()?->id;
+        $resource = $teamId !== null ? getResourceByUuid($id, $teamId) : null;
+
+        $image = null;
+        $link = null;
+        if ($resource) {
+            $image = data_get($resource, 'docker_registry_image_name') ?: data_get($resource, 'image');
+
+            if ($resource instanceof Application && data_get($resource, 'environment.project.uuid')) {
+                $link = route('project.application.metrics', [
+                    'project_uuid' => $resource->environment->project->uuid,
+                    'environment_uuid' => $resource->environment->uuid,
+                    'application_uuid' => $resource->uuid,
+                ]);
+            }
+        }
+
+        return $this->containerMetaCache[$id] = [
+            'name' => $resource?->name ?? $id,
+            'image' => $image ?: null,
+            'link' => $link,
+        ];
+    }
+
+    public function placeholder(): View
+    {
+        return view('livewire.fleet.metrics-placeholder');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.fleet.metrics');
+    }
+}
diff --git a/app/Livewire/GlobalSearch.php b/app/Livewire/GlobalSearch.php
index 035349b728..772e4af3d1 100644
--- a/app/Livewire/GlobalSearch.php
+++ b/app/Livewire/GlobalSearch.php
@@ -178,6 +178,7 @@ class GlobalSearch extends Component
             'new github app' => 'source',
             'new github' => 'source',
             'new source' => 'source',
+            'new canvas' => 'canvas',
 
             // Applications - Git-based
             'new public' => 'public',
@@ -186,6 +187,8 @@ class GlobalSearch extends Component
             'new public repository' => 'public',
             'new private github' => 'private-gh-app',
             'new private gh' => 'private-gh-app',
+            'new private gitea' => 'private-gitea-app',
+            'new gitea' => 'private-gitea-app',
             'new private deploy' => 'private-deploy-key',
             'new deploy key' => 'private-deploy-key',
 
@@ -239,7 +242,7 @@ class GlobalSearch extends Component
         if (in_array($type, [
             'project', 'source',
             // Applications
-            'public', 'private-gh-app', 'private-deploy-key',
+            'public', 'private-gh-app', 'private-gitea-app', 'private-deploy-key',
             'dockerfile', 'docker-compose-empty', 'docker-image',
             // Databases
             'postgresql', 'mysql', 'mariadb', 'redis', 'keydb',
@@ -1175,6 +1178,18 @@ class GlobalSearch extends Component
             ]);
         }
 
+        // Canvas - deploy resources visually; can be used if user has createAnyResource permission
+        if ($user->can('createAnyResource')) {
+            $items->push([
+                'name' => 'Canvas',
+                'description' => 'Deploy resources visually on the deploy canvas',
+                'quickcommand' => '(type: new canvas)',
+                'type' => 'canvas',
+                'category' => 'Quick Actions',
+                'route' => 'deploy-canvas',
+            ]);
+        }
+
         // === Applications Category ===
 
         if ($user->can('createAnyResource')) {
@@ -1197,6 +1212,15 @@ class GlobalSearch extends Component
                 'resourceType' => 'application',
             ]);
 
+            $items->push([
+                'name' => 'Private Repository (Gitea App)',
+                'description' => 'Deploy private repositories through Gitea Apps',
+                'quickcommand' => '(type: new private gitea)',
+                'type' => 'private-gitea-app',
+                'category' => 'Applications',
+                'resourceType' => 'application',
+            ]);
+
             $items->push([
                 'name' => 'Private Repository (Deploy Key)',
                 'description' => 'Deploy private repositories with a deploy key',
@@ -1354,6 +1378,13 @@ class GlobalSearch extends Component
             return;
         }
 
+        // If it has a route, it's a page-based quick action
+        if (isset($item['route'])) {
+            $this->dispatch('closeSearchModal');
+
+            return redirectRoute($this, $item['route']);
+        }
+
         // If it has a component, it's a modal-based resource
         // Close search modal and open the appropriate creation modal
         if (isset($item['component'])) {
diff --git a/app/Livewire/Notifications/Email.php b/app/Livewire/Notifications/Email.php
index 0a37c75d16..0913e93507 100644
--- a/app/Livewire/Notifications/Email.php
+++ b/app/Livewire/Notifications/Email.php
@@ -76,6 +76,9 @@ class Email extends Component
     #[Validate(['boolean'])]
     public bool $deploymentFailureEmailNotifications = true;
 
+    #[Validate(['boolean'])]
+    public bool $deploymentCommitDetailsEmailNotifications = false;
+
     #[Validate(['boolean'])]
     public bool $statusChangeEmailNotifications = false;
 
@@ -156,6 +159,7 @@ class Email extends Component
 
             $this->settings->deployment_success_email_notifications = $this->deploymentSuccessEmailNotifications;
             $this->settings->deployment_failure_email_notifications = $this->deploymentFailureEmailNotifications;
+            $this->settings->deployment_commit_details_email_notifications = $this->deploymentCommitDetailsEmailNotifications;
             $this->settings->status_change_email_notifications = $this->statusChangeEmailNotifications;
             $this->settings->restart_limit_reached_email_notifications = $this->restartLimitReachedEmailNotifications;
             $this->settings->backup_success_email_notifications = $this->backupSuccessEmailNotifications;
@@ -197,6 +201,7 @@ class Email extends Component
 
             $this->deploymentSuccessEmailNotifications = $this->settings->deployment_success_email_notifications;
             $this->deploymentFailureEmailNotifications = $this->settings->deployment_failure_email_notifications;
+            $this->deploymentCommitDetailsEmailNotifications = $this->settings->deployment_commit_details_email_notifications;
             $this->statusChangeEmailNotifications = $this->settings->status_change_email_notifications;
             $this->restartLimitReachedEmailNotifications = $this->settings->restart_limit_reached_email_notifications;
             $this->backupSuccessEmailNotifications = $this->settings->backup_success_email_notifications;
@@ -231,6 +236,18 @@ class Email extends Component
         $this->dispatch('success', 'Email notifications settings updated.');
     }
 
+    public function instantSaveDeploymentCommitDetails()
+    {
+        try {
+            $this->resetErrorBag();
+            $this->saveModel();
+        } catch (\Throwable $e) {
+            $this->deploymentCommitDetailsEmailNotifications = $this->settings->deployment_commit_details_email_notifications;
+
+            return handleError($e, $this);
+        }
+    }
+
     public function instantSave(?string $type = null)
     {
         try {
diff --git a/app/Livewire/Profile/Passkeys.php b/app/Livewire/Profile/Passkeys.php
new file mode 100644
index 0000000000..2620e92d90
--- /dev/null
+++ b/app/Livewire/Profile/Passkeys.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Livewire\Profile;
+
+use App\Support\PasskeyRelyingParty;
+use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Validator;
+use Laravel\Passkeys\Actions\DeletePasskey;
+use Livewire\Component;
+
+class Passkeys extends Component
+{
+    public bool $show_form = false;
+
+    public function mount(): void
+    {
+        $this->show_form = session('status') === 'passkey-add';
+    }
+
+    public function registered(): void
+    {
+        $this->show_form = false;
+        $this->dispatch('success', 'Passkey added.');
+    }
+
+    public function rename(int $id, string $name): bool
+    {
+        abort_unless(instanceSettings()->is_passkey_enabled, 404);
+
+        $passkey = Auth::user()->passkeys()->findOrFail($id);
+
+        $validated = Validator::make(
+            ['name' => trim($name)],
+            ['name' => ['required', 'string', 'max:255']],
+        )->validate();
+
+        $passkey->update(['name' => $validated['name']]);
+        $this->dispatch('success', 'Passkey renamed.');
+
+        return true;
+    }
+
+    public function delete(int $id, mixed $password = null): mixed
+    {
+        abort_unless(instanceSettings()->is_passkey_enabled, 404);
+
+        $passkey = Auth::user()->passkeys()->findOrFail($id);
+
+        if (! verifyPasswordConfirmation($password, $this)) {
+            return 'The provided password is incorrect.';
+        }
+
+        app(DeletePasskey::class)(Auth::user(), $passkey);
+        $this->dispatch('success', 'Passkey deleted.');
+
+        return true;
+    }
+
+    public function render(): View
+    {
+        $enabled = (bool) instanceSettings()->is_passkey_enabled;
+
+        return view('livewire.profile.passkeys', [
+            'enabled' => $enabled,
+            'available' => $enabled && PasskeyRelyingParty::isAvailable(),
+            'passkeys' => $enabled ? Auth::user()->passkeys()->latest()->get() : collect(),
+        ]);
+    }
+}
diff --git a/app/Livewire/Project/Application/Advanced.php b/app/Livewire/Project/Application/Advanced.php
index 86b406a6b5..0075bdddd4 100644
--- a/app/Livewire/Project/Application/Advanced.php
+++ b/app/Livewire/Project/Application/Advanced.php
@@ -260,11 +260,21 @@ class Advanced extends Component
     {
         try {
             $this->authorize('update', $this->application);
-            if ($this->gpuCount && $this->gpuDeviceIds) {
+            // Check only changed GPU values, so stored legacy values do not block other settings.
+            $settings = $this->application->settings;
+            $gpuSelectionChanged = $this->gpuCount !== $settings->gpu_count || $this->gpuDeviceIds !== $settings->gpu_device_ids;
+            if ($gpuSelectionChanged && filled($this->gpuCount) && filled($this->gpuDeviceIds)) {
                 $this->dispatch('error', 'You cannot set both GPU count and GPU device IDs.');
-                $this->gpuCount = null;
-                $this->gpuDeviceIds = null;
-                $this->syncData(true);
+
+                return;
+            }
+            if ($this->gpuCount !== $settings->gpu_count && filled($this->gpuCount) && ! preg_match(ApplicationSetting::GPU_COUNT_PATTERN, trim($this->gpuCount))) {
+                $this->dispatch('error', 'GPU count must be a number or "all".');
+
+                return;
+            }
+            if ($this->gpuOptions !== $settings->gpu_options && ApplicationSetting::parseGpuOptions($this->gpuOptions) === null) {
+                $this->dispatch('error', 'GPU options must be key=value pairs (one per line) or a YAML mapping.');
 
                 return;
             }
@@ -437,6 +447,33 @@ class Advanced extends Component
         }
     }
 
+    public function refreshGpus(): void
+    {
+        try {
+            $servers = $this->application->maintenanceServers();
+            foreach ($servers as $server) {
+                $this->authorize('update', $server);
+            }
+            $functionalServers = $servers->filter(fn ($server) => $server->isFunctional());
+            if ($functionalServers->isEmpty()) {
+                $this->dispatch('error', 'Validate the server connection before you refresh GPUs.');
+
+                return;
+            }
+
+            $failed = $functionalServers->reject(fn ($server) => $server->gatherServerMetadata())->pluck('name');
+            $this->application->unsetRelation('destination')->unsetRelation('additional_servers');
+            if ($failed->isNotEmpty()) {
+                $this->dispatch('error', 'Could not collect GPUs from '.$failed->implode(', ').'. Check the application logs for the remote command output.');
+
+                return;
+            }
+            $this->dispatch('success', 'GPUs refreshed.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function render()
     {
         $server = data_get($this->application, 'destination.server');
@@ -444,6 +481,7 @@ class Advanced extends Component
         return view('livewire.project.application.advanced', [
             'isTraefikProxy' => $server?->proxyType() === ProxyTypes::TRAEFIK->value,
             'serverCertificateResolver' => $server?->traefikCertificateResolver() ?? ServerSetting::TRAEFIK_CERTIFICATE_RESOLVER_NONE,
+            'gpuServers' => $this->application->maintenanceServers(),
         ]);
     }
 
diff --git a/app/Livewire/Project/Application/Backup/Index.php b/app/Livewire/Project/Application/Backup/Index.php
index fe7e2eac5d..e53a3cdf88 100644
--- a/app/Livewire/Project/Application/Backup/Index.php
+++ b/app/Livewire/Project/Application/Backup/Index.php
@@ -4,6 +4,7 @@ namespace App\Livewire\Project\Application\Backup;
 
 use App\Models\Application;
 use App\Models\ScheduledVolumeBackup;
+use App\Traits\ListensToTeamChannel;
 use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -11,6 +12,7 @@ use Livewire\Component;
 class Index extends Component
 {
     use AuthorizesRequests;
+    use ListensToTeamChannel;
 
     public Application $application;
 
@@ -18,7 +20,13 @@ class Index extends Component
 
     public string $search = '';
 
-    protected $listeners = ['refreshVolumeBackups' => '$refresh'];
+    public function getListeners(): array
+    {
+        return [
+            'refreshVolumeBackups' => '$refresh',
+            ...$this->teamChannelListeners(['BackupCreated' => '$refresh']),
+        ];
+    }
 
     public function mount(): void
     {
@@ -31,7 +39,7 @@ class Index extends Component
     public function render(): View
     {
         $backups = ScheduledVolumeBackup::query()
-            ->with(['backupable', 'latestExecution', 's3'])
+            ->with(['backupable', 'latestExecution', 's3', 's3Storages'])
             ->withCount('executions')
             ->forApplication($this->application)
             ->latest()
diff --git a/app/Livewire/Project/Application/Backup/Show.php b/app/Livewire/Project/Application/Backup/Show.php
index 5e10f0c8ac..c07e49852a 100644
--- a/app/Livewire/Project/Application/Backup/Show.php
+++ b/app/Livewire/Project/Application/Backup/Show.php
@@ -40,8 +40,6 @@ class Show extends Component
             ->firstOrFail();
         $this->parameters = get_route_parameters();
         $this->section = match (request()->route()?->getName()) {
-            'project.application.backup.s3' => 's3',
-            'project.application.backup.retention' => 'retention',
             'project.application.backup.executions' => 'executions',
             'project.application.backup.danger' => 'danger',
             default => 'general',
diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index cf3aa235df..0a1fcdfc3d 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Application;
 
+use App\Enums\HttpBasicAuthHashAlgorithm;
 use App\Enums\StaticImageTypes;
 use App\Jobs\ApplicationDeploymentJob;
 use App\Livewire\Project\Service\Storage;
@@ -118,6 +119,14 @@ class General extends Component
 
     public ?string $httpBasicAuthPassword = null;
 
+    public string $httpBasicAuthHashAlgorithm = HttpBasicAuthHashAlgorithm::BCRYPT->value;
+
+    public int $httpBasicAuthBcryptCost = 10;
+
+    public int $httpBasicAuthArgon2idMemoryCost = 65536;
+
+    public int $httpBasicAuthArgon2idTimeCost = 4;
+
     public ?string $watchPaths = null;
 
     public string $redirect;
@@ -193,7 +202,13 @@ class General extends Component
             'isPreserveRepositoryEnabled' => 'boolean|required',
             'isHttpBasicAuthEnabled' => 'boolean|required',
             'httpBasicAuthUsername' => 'string|nullable',
-            'httpBasicAuthPassword' => 'string|nullable',
+            // bcrypt ignores everything after 72 bytes. Labels for Traefik always use bcrypt and are also generated on
+            // Caddy servers when "Labels for all supported proxies" is selected, so that the proxy can be switched easily.
+            'httpBasicAuthPassword' => 'string|nullable|max:72',
+            'httpBasicAuthHashAlgorithm' => ['required', Rule::enum(HttpBasicAuthHashAlgorithm::class)],
+            'httpBasicAuthBcryptCost' => 'required|integer|min:4|max:14',
+            'httpBasicAuthArgon2idMemoryCost' => 'required|integer|min:8192|max:262144',
+            'httpBasicAuthArgon2idTimeCost' => 'required|integer|min:1|max:12',
             'watchPaths' => 'nullable',
             'redirect' => 'string|required',
         ];
@@ -367,6 +382,9 @@ class General extends Component
         if ($toModel) {
             $this->validate();
             $this->validateChangedDockerComposeRaw();
+            if ($this->httpBasicAuthHashAlgorithm === HttpBasicAuthHashAlgorithm::ARGON2ID->value && ! $this->application->destination->server->caddySupportsArgon2idBasicAuth()) {
+                throw new Exception('Argon2id needs a server that runs the Caddy proxy, version 2.11 or newer.');
+            }
 
             // Application properties
             $this->application->name = $this->name;
@@ -407,6 +425,10 @@ class General extends Component
             $this->application->is_http_basic_auth_enabled = $this->isHttpBasicAuthEnabled;
             $this->application->http_basic_auth_username = $this->httpBasicAuthUsername;
             $this->application->http_basic_auth_password = $this->httpBasicAuthPassword;
+            $this->application->http_basic_auth_hash_algorithm = $this->httpBasicAuthHashAlgorithm;
+            $this->application->http_basic_auth_bcrypt_cost = $this->httpBasicAuthBcryptCost;
+            $this->application->http_basic_auth_argon2id_memory_cost = $this->httpBasicAuthArgon2idMemoryCost;
+            $this->application->http_basic_auth_argon2id_time_cost = $this->httpBasicAuthArgon2idTimeCost;
             $this->application->watch_paths = $this->watchPaths;
             $this->application->redirect = $this->redirect;
 
@@ -438,7 +460,7 @@ class General extends Component
             $this->portsMappings = $this->application->ports_mappings;
             $this->customNetworkAliases = $this->application->custom_network_aliases;
             $this->dockerfile = $this->application->dockerfile;
-            $this->dockerfileLocation = $this->application->dockerfile_location;
+            $this->dockerfileLocation = $this->application->dockerfile_location ?? ($this->buildPack === 'dockerfile' ? '/Dockerfile' : null);
             $this->dockerfileTargetBuild = $this->application->dockerfile_target_build;
             $this->dockerRegistryImageName = $this->application->docker_registry_image_name;
             $this->dockerRegistryImageTag = $this->application->docker_registry_image_tag;
@@ -460,6 +482,10 @@ class General extends Component
             $this->httpBasicAuthPassword = auth()->user()->can('update', $this->application)
                 ? $this->application->http_basic_auth_password
                 : null;
+            $this->httpBasicAuthHashAlgorithm = ($this->application->usesArgon2idBasicAuth() ? HttpBasicAuthHashAlgorithm::ARGON2ID : HttpBasicAuthHashAlgorithm::BCRYPT)->value;
+            $this->httpBasicAuthBcryptCost = $this->application->http_basic_auth_bcrypt_cost;
+            $this->httpBasicAuthArgon2idMemoryCost = $this->application->http_basic_auth_argon2id_memory_cost;
+            $this->httpBasicAuthArgon2idTimeCost = $this->application->http_basic_auth_argon2id_time_cost;
             $this->watchPaths = $this->application->watch_paths;
             $this->redirect = $this->application->redirect;
 
@@ -497,7 +523,7 @@ class General extends Component
             if ($oldIsSpa !== $this->isSpa) {
                 $this->generateNginxConfiguration($this->isSpa ? 'spa' : 'static');
             }
-            if ($oldIsHttpBasicAuthEnabled !== $this->isHttpBasicAuthEnabled) {
+            if ($oldIsHttpBasicAuthEnabled !== $this->isHttpBasicAuthEnabled || $this->application->isDirty(['http_basic_auth_hash_algorithm', 'http_basic_auth_bcrypt_cost', 'http_basic_auth_argon2id_memory_cost', 'http_basic_auth_argon2id_time_cost'])) {
                 $this->application->save();
             }
 
diff --git a/app/Livewire/Project/Application/Rollback.php b/app/Livewire/Project/Application/Rollback.php
index f6a8e386b4..6e54ac3d38 100644
--- a/app/Livewire/Project/Application/Rollback.php
+++ b/app/Livewire/Project/Application/Rollback.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Application;
 
+use App\Actions\Application\GetRollbackImages;
 use App\Models\Application;
 use App\Traits\AuditsApplicationSettings;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -17,7 +18,7 @@ class Rollback extends Component
 
     public $images = [];
 
-    public ?string $current;
+    public ?string $current = null;
 
     public array $parameters;
 
@@ -82,30 +83,7 @@ class Rollback extends Component
         $this->authorize('view', $this->application);
 
         try {
-            $image = $this->application->docker_registry_image_name ?? $this->application->uuid;
-            if ($this->application->destination->server->isFunctional()) {
-                $output = instant_remote_process([
-                    "docker inspect --format='{{.Config.Image}}' {$this->application->uuid}",
-                ], $this->application->destination->server, throwError: false);
-                $current_tag = str($output)->trim()->explode(':');
-                $this->current = data_get($current_tag, 1);
-
-                $output = instant_remote_process([
-                    "docker images --format '{{.Repository}}#{{.Tag}}#{{.CreatedAt}}'",
-                ], $this->application->destination->server);
-                $this->images = str($output)->trim()->explode("\n")->filter(function ($item) use ($image) {
-                    return str($item)->contains($image);
-                })->map(function ($item) {
-                    $item = str($item)->explode('#');
-                    $is_current = $item[1] === $this->current;
-
-                    return [
-                        'tag' => $item[1],
-                        'created_at' => $item[2],
-                        'is_current' => $is_current,
-                    ];
-                })->toArray();
-            }
+            ['current' => $this->current, 'images' => $this->images] = GetRollbackImages::run($this->application);
             $showToast && $this->dispatch('success', 'Images loaded.');
 
             return [];
diff --git a/app/Livewire/Project/Application/Source.php b/app/Livewire/Project/Application/Source.php
index 5b6ad61eae..d2843a6780 100644
--- a/app/Livewire/Project/Application/Source.php
+++ b/app/Livewire/Project/Application/Source.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Application;
 
 use App\Models\Application;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\PrivateKey;
@@ -104,7 +105,7 @@ class Source extends Component
             if ($source instanceof GithubApp) {
                 return ! is_null($source->app_id);
             }
-            if ($source instanceof GitlabApp) {
+            if ($source instanceof GitlabApp || $source instanceof GiteaApp) {
                 return $source->isConnected();
             }
 
@@ -149,7 +150,7 @@ class Source extends Component
     {
         try {
             $this->authorize('update', $this->application);
-            $allowedSourceTypes = [GithubApp::class, GitlabApp::class];
+            $allowedSourceTypes = [GithubApp::class, GitlabApp::class, GiteaApp::class];
             abort_unless(in_array($sourceType, $allowedSourceTypes, true), 404);
             $teamId = $this->application->team()->id;
             $source = $sourceType::query()
@@ -173,6 +174,12 @@ class Source extends Component
                     $project = gitlabApi($source, "/projects/{$encoded}");
                     $repository_project_id = data_get($project, 'data.id');
                 }
+            } elseif ($sourceType === GiteaApp::class) {
+                if ($source->isConnected()) {
+                    $repositoryPath = collect(explode('/', $customRepository, 2))->map(fn ($part) => rawurlencode($part))->implode('/');
+                    $repository = giteaApi($source, "/repos/{$repositoryPath}");
+                    $repository_project_id = data_get($repository, 'data.id');
+                }
             }
 
             if (isset($repository_project_id) && $this->application->repository_project_id !== $repository_project_id) {
diff --git a/app/Livewire/Project/CloneMe.php b/app/Livewire/Project/CloneMe.php
index 8f2ff9af40..b310c248ee 100644
--- a/app/Livewire/Project/CloneMe.php
+++ b/app/Livewire/Project/CloneMe.php
@@ -279,6 +279,7 @@ class CloneMe extends Component
                     'team_id' => $teamId,
                 ]);
                 $newBackup->save();
+                $backup->copyS3StoragesTo($newBackup);
             }
 
             $environmentVaribles = $database->environment_variables()->get();
@@ -469,6 +470,7 @@ class CloneMe extends Component
                         'team_id' => $teamId,
                     ]);
                     $newBackup->save();
+                    $backup->copyS3StoragesTo($newBackup);
                 }
             }
 
diff --git a/app/Livewire/Project/Database/Backup/Execution.php b/app/Livewire/Project/Database/Backup/Execution.php
index 726ee3b698..c96c7e5217 100644
--- a/app/Livewire/Project/Database/Backup/Execution.php
+++ b/app/Livewire/Project/Database/Backup/Execution.php
@@ -2,12 +2,23 @@
 
 namespace App\Livewire\Project\Database\Backup;
 
+use App\Livewire\Concerns\ManagesDatabaseBackup;
+use App\Livewire\Project\Database\BackupEdit;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
+use App\Traits\ListensToTeamChannel;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
+use Livewire\Features\SupportRedirects\Redirector;
 
 class Execution extends Component
 {
+    use AuthorizesRequests;
+    use ListensToTeamChannel;
+    use ManagesDatabaseBackup;
+
     public $database;
 
     public ?ScheduledDatabaseBackup $backup;
@@ -20,6 +31,28 @@ class Execution extends Component
 
     public string $section = 'general';
 
+    public function getListeners(): array
+    {
+        // Keep the header backup actions in sync when the database starts/stops.
+        $listeners = [
+            'databaseUpdated' => '$refresh',
+            'backupEnabledChanged' => 'syncBackupEnabled',
+        ];
+
+        $user = Auth::user();
+        if ($user) {
+            $listeners["echo-private:user.{$user->id},DatabaseStatusChanged"] = '$refresh';
+        }
+
+        return [
+            ...$listeners,
+            ...$this->teamChannelListeners([
+                'ServiceChecked' => '$refresh',
+                'ServiceStatusChanged' => '$refresh',
+            ]),
+        ];
+    }
+
     public function mount()
     {
         $backup_uuid = request()->route('backup_uuid');
@@ -50,14 +83,38 @@ class Execution extends Component
             ->get();
         $this->parameters = get_route_parameters();
         $this->section = match (request()->route()?->getName()) {
-            'project.database.backup.s3' => 's3',
-            'project.database.backup.retention' => 'retention',
             'project.database.backup.executions' => 'executions',
             'project.database.backup.danger' => 'danger',
             default => 'general',
         };
     }
 
+    public function backupNow(): Redirector|RedirectResponse|null
+    {
+        try {
+            return $this->queueDatabaseBackup($this->backup);
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return null;
+        }
+    }
+
+    public function toggleEnabled(): void
+    {
+        try {
+            $this->toggleDatabaseBackup($this->backup);
+            $this->dispatch('backupEnabledChanged')->to(BackupEdit::class);
+        } catch (\Throwable $e) {
+            $this->dispatch('error', $e->getMessage());
+        }
+    }
+
+    public function syncBackupEnabled(): void
+    {
+        $this->backup->refresh();
+    }
+
     public function render()
     {
         return view('livewire.project.database.backup.execution');
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 59dd1a29c0..97da01715e 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -2,13 +2,15 @@
 
 namespace App\Livewire\Project\Database;
 
-use App\Jobs\DatabaseBackupJob;
+use App\Livewire\Concerns\ManagesDatabaseBackup;
+use App\Livewire\Project\Database\Backup\Execution;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use App\Models\StandalonePostgresql;
 use App\Traits\ListensToTeamChannel;
 use Exception;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
@@ -20,11 +22,15 @@ class BackupEdit extends Component
 {
     use AuthorizesRequests;
     use ListensToTeamChannel;
+    use ManagesDatabaseBackup;
 
     public ScheduledDatabaseBackup $backup;
 
     public string $section = 'general';
 
+    /** The page shows the backup actions in the top header bar instead. */
+    public bool $actionsInHeader = false;
+
     #[Locked]
     public $availableS3Storages;
 
@@ -76,8 +82,9 @@ class BackupEdit extends Component
     #[Validate(['required', 'boolean'])]
     public bool $disableLocalBackup = false;
 
-    #[Validate(['nullable', 'integer'])]
-    public ?int $s3StorageId = null;
+    /** @var array<int, int|string> */
+    #[Validate(['array'])]
+    public array $s3StorageIds = [];
 
     #[Validate(['nullable', 'string'])]
     public ?string $databasesToBackup = null;
@@ -94,7 +101,10 @@ class BackupEdit extends Component
     public function getListeners(): array
     {
         // Keep "Backup Now" in sync when the database starts/stops without a full page refresh.
-        $listeners = ['databaseUpdated' => 'refreshStatus'];
+        $listeners = [
+            'databaseUpdated' => 'refreshStatus',
+            'backupEnabledChanged' => 'syncBackupEnabled',
+        ];
 
         $user = Auth::user();
         if (! $user) {
@@ -105,7 +115,10 @@ class BackupEdit extends Component
 
         return [
             ...$listeners,
-            ...$this->teamChannelListeners(['ServiceChecked' => 'refreshStatus']),
+            ...$this->teamChannelListeners([
+                'ServiceChecked' => 'refreshStatus',
+                'ServiceStatusChanged' => 'refreshStatus',
+            ]),
         ];
     }
 
@@ -113,6 +126,10 @@ class BackupEdit extends Component
     {
         try {
             $this->authorize('view', $this->backup->database);
+            $this->availableS3Storages = S3Storage::query()
+                ->whereKey($this->availableS3StorageIds()->all())
+                ->orderBy('name')
+                ->get();
             $this->parameters = get_route_parameters();
             $this->syncData();
             $this->refreshStatus();
@@ -121,6 +138,15 @@ class BackupEdit extends Component
         }
     }
 
+    public function hydrate(): void
+    {
+        // Livewire restores a deleted backup as an empty model. Requests that arrive after the delete
+        // (for example status events before the redirect completes) must not render it.
+        if (! $this->backup->exists) {
+            $this->skipRender();
+        }
+    }
+
     public function refreshStatus(): void
     {
         $database = $this->backup->database;
@@ -148,7 +174,6 @@ class BackupEdit extends Component
             $this->backup->database_backup_retention_max_storage_s3 = $this->databaseBackupRetentionMaxStorageS3;
             $this->backup->save_s3 = $this->saveS3;
             $this->backup->disable_local_backup = $this->disableLocalBackup;
-            $this->backup->s3_storage_id = $this->s3StorageId;
 
             // Validate databases_to_backup to prevent command injection
             // Handles all formats including MongoDB's "db:col1,col2|db2:col3"
@@ -160,10 +185,16 @@ class BackupEdit extends Component
             $this->backup->dump_all = $this->dumpAll;
             $this->backup->timeout = $this->timeout;
             $this->backup->missing_backup_notification_days = $this->missingBackupNotificationDays;
-            $this->customValidate();
+            $storageIds = $this->customValidate();
             $changedFields = auditChangedFields($this->backup);
             $this->backup->save();
 
+            $previousStorageIds = $this->backup->s3Storages()->pluck('s3_storages.id')->sort()->values()->all();
+            $this->backup->syncS3Storages($storageIds->all());
+            if ($previousStorageIds !== $storageIds->sort()->values()->all()) {
+                $changedFields[] = 's3_storages';
+            }
+
             return $changedFields;
         } else {
             $this->backupEnabled = $this->backup->enabled;
@@ -177,7 +208,8 @@ class BackupEdit extends Component
             $this->databaseBackupRetentionMaxStorageS3 = $this->backup->database_backup_retention_max_storage_s3;
             $this->saveS3 = $this->backup->save_s3;
             $this->disableLocalBackup = $this->backup->disable_local_backup ?? false;
-            $this->s3StorageId = $this->backup->s3_storage_id ?? $this->availableS3StorageIds()->first();
+            $selectedIds = $this->backup->selectedS3Storages()->pluck('id');
+            $this->s3StorageIds = ($selectedIds->isNotEmpty() ? $selectedIds : $this->availableS3StorageIds()->take(1))->all();
             $this->databasesToBackup = $this->backup->databases_to_backup;
             $this->dumpAll = $this->backup->dump_all;
             $this->timeout = $this->backup->timeout;
@@ -216,10 +248,10 @@ class BackupEdit extends Component
                 if ($this->delete_associated_backups_locally && $server) {
                     deleteBackupsLocally($filenames, $server);
                 }
+            }
 
-                if ($this->delete_associated_backups_s3 && $this->backup->s3) {
-                    deleteBackupsS3($filenames, $this->backup->s3);
-                }
+            if ($this->delete_associated_backups_s3) {
+                $this->backup->executions()->each(fn ($execution) => $execution->deleteS3Copies());
             }
 
             $backupUuid = $this->backup->uuid;
@@ -256,50 +288,9 @@ class BackupEdit extends Component
     public function backupNow()
     {
         try {
-            $this->authorize('manageBackups', $this->backup->database);
+            $this->status = $this->backup->database->refresh()->status;
 
-            $database = $this->backup->database->refresh();
-            $this->status = $database->status;
-            if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
-                $this->dispatch('error', 'The database must be running to start a backup.');
-
-                return;
-            }
-
-            DatabaseBackupJob::dispatch($this->backup);
-            $database = $this->backup->database;
-            auditLog('ui.database.backup_started', [
-                'team_id' => $database->team()?->id,
-                'database_uuid' => $database->uuid,
-                'database_name' => $database->name,
-                'backup_uuid' => $this->backup->uuid,
-            ]);
-            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
-
-            if ($database instanceof ServiceDatabase) {
-                return redirect()->route('project.service.database.backup.executions', [
-                    'project_uuid' => $database->service->project()->uuid,
-                    'environment_uuid' => $database->service->environment->uuid,
-                    'service_uuid' => $database->service->uuid,
-                    'stack_service_uuid' => $database->uuid,
-                    'backup_uuid' => $this->backup->uuid,
-                ]);
-            }
-
-            // Instance databases (e.g. coolify-db) have no project/environment.
-            // Stay on the current page (settings.backup) instead of redirecting.
-            $project = $database->project();
-            $environment = $database->environment;
-            if (! $project || ! $environment) {
-                return null;
-            }
-
-            return redirect()->route('project.database.backup.executions', [
-                'project_uuid' => $project->uuid,
-                'environment_uuid' => $environment->uuid,
-                'database_uuid' => $database->uuid,
-                'backup_uuid' => $this->backup->uuid,
-            ]);
+            return $this->queueDatabaseBackup($this->backup);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -320,27 +311,26 @@ class BackupEdit extends Component
     public function toggleEnabled(): void
     {
         try {
-            $this->authorize('manageBackups', $this->backup->database);
-
-            $this->backupEnabled = ! $this->backupEnabled;
-            $this->backup->enabled = $this->backupEnabled;
-            $changedFields = auditChangedFields($this->backup);
-            $this->backup->save();
-            $this->auditBackupScheduleUpdated($changedFields);
-            $this->dispatch('success', $this->backupEnabled ? 'Backup enabled.' : 'Backup disabled.');
+            $this->backupEnabled = $this->toggleDatabaseBackup($this->backup);
+            $this->dispatch('backupEnabledChanged')->to(Execution::class);
         } catch (\Throwable $e) {
             $this->dispatch('error', $e->getMessage());
         }
     }
 
-    public function updatedS3StorageId(): void
+    public function syncBackupEnabled(): void
+    {
+        $this->backupEnabled = $this->backup->refresh()->enabled;
+    }
+
+    public function updatedS3StorageIds(): void
     {
         $this->instantSave();
     }
 
     public function toggleS3(): void
     {
-        if (! $this->saveS3 && $this->availableS3StorageIds()->isEmpty()) {
+        if (! $this->saveS3 && $this->selectedAvailableS3StorageIds()->isEmpty()) {
             $this->dispatch('error', 'Select a usable S3 storage before enabling S3 backups.');
 
             return;
@@ -351,21 +341,22 @@ class BackupEdit extends Component
         $this->instantSave();
     }
 
-    private function customValidate()
+    /**
+     * @return Collection<int, int> The usable S3 storage IDs to keep as destinations.
+     */
+    private function customValidate(): Collection
     {
-        if (! is_numeric($this->backup->s3_storage_id)) {
-            $this->backup->s3_storage_id = null;
-        }
+        // Only usable S3 storages of the database's team can be destinations; others are dropped.
+        $storageIds = $this->selectedAvailableS3StorageIds();
+        $this->s3StorageIds = $storageIds->all();
 
-        // S3 backup cannot be enabled without a valid S3 storage owned by the team
-        $availableS3Ids = $this->availableS3StorageIds();
-        if ($availableS3Ids->isEmpty()) {
-            $this->backup->s3_storage_id = $this->s3StorageId = null;
-            if ($this->backup->save_s3) {
-                $this->backup->save_s3 = $this->saveS3 = false;
-            }
-        } elseif (! $availableS3Ids->contains($this->backup->s3_storage_id)) {
-            $this->backup->s3_storage_id = $this->s3StorageId = $availableS3Ids->first();
+        if ($this->availableS3StorageIds()->isEmpty()) {
+            $this->backup->save_s3 = $this->saveS3 = false;
+        } elseif ($this->backup->save_s3 && $storageIds->isEmpty()) {
+            $message = 'Select at least one usable S3 storage.';
+            $this->addError('s3StorageIds', $message);
+
+            throw new Exception($message);
         }
 
         // Validate that disable_local_backup can only be true when S3 backup is enabled
@@ -378,6 +369,8 @@ class BackupEdit extends Component
             throw new Exception('Invalid Cron / Human expression');
         }
         $this->validate();
+
+        return $storageIds;
     }
 
     /**
@@ -399,6 +392,20 @@ class BackupEdit extends Component
         ]);
     }
 
+    /**
+     * @return Collection<int, int>
+     */
+    private function selectedAvailableS3StorageIds(): Collection
+    {
+        $availableIds = $this->availableS3StorageIds();
+
+        return collect($this->s3StorageIds)
+            ->map(fn ($id): int => (int) $id)
+            ->filter(fn (int $id): bool => $availableIds->contains($id))
+            ->unique()
+            ->values();
+    }
+
     private function availableS3StorageIds(): Collection
     {
         $database = $this->backup->database;
@@ -409,9 +416,12 @@ class BackupEdit extends Component
             return collect();
         }
 
+        // Current destinations stay selectable while unusable, so saving other settings does not remove them.
+        $selectedIds = $this->backup->selectedS3Storages()->pluck('id')->all();
+
         return S3Storage::query()
             ->where('team_id', $teamId)
-            ->where('is_usable', true)
+            ->where(fn (Builder $query) => $query->where('is_usable', true)->orWhereIn('id', $selectedIds))
             ->pluck('id');
     }
 
@@ -432,7 +442,7 @@ class BackupEdit extends Component
         return view('livewire.project.database.backup-edit', [
             'checkboxes' => [
                 ['id' => 'delete_associated_backups_locally', 'label' => __('database.delete_backups_locally')],
-                ['id' => 'delete_associated_backups_s3', 'label' => 'All backups will be permanently deleted (associated with this backup job) from the selected S3 Storage.'],
+                ['id' => 'delete_associated_backups_s3', 'label' => 'All backups will be permanently deleted (associated with this backup job) from every S3 storage of this schedule.'],
                 // ['id' => 'delete_associated_backups_sftp', 'label' => 'All backups associated with this backup job from this database will be permanently deleted from the selected SFTP Storage.']
             ],
         ]);
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index 6f17e2fcf5..168076238f 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Project\Database;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use App\Traits\ListensToTeamChannel;
+use App\Traits\PreparesBackupDownloads;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
@@ -13,6 +14,7 @@ class BackupExecutions extends Component
 {
     use AuthorizesRequests;
     use ListensToTeamChannel;
+    use PreparesBackupDownloads;
 
     public ?ScheduledDatabaseBackup $backup = null;
 
@@ -109,12 +111,8 @@ class BackupExecutions extends Component
                 deleteBackupsLocally($execution->filename, $server, throwError: true);
             }
 
-            if ($deleteFromS3 && $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
-                if (! $execution->scheduledDatabaseBackup->s3) {
-                    throw new \RuntimeException('The S3 storage is unavailable.');
-                }
-
-                deleteBackupsS3($execution->filename, $execution->scheduledDatabaseBackup->s3);
+            if ($deleteFromS3) {
+                $execution->deleteS3Copies();
             }
 
             $execution->delete();
@@ -130,9 +128,25 @@ class BackupExecutions extends Component
         return true;
     }
 
-    public function download_file($exeuctionId)
+    public function download_file($executionId): void
     {
-        return redirect()->route('download.backup', $exeuctionId);
+        try {
+            $this->authorize('manageBackups', $this->database);
+            $execution = $this->backup->executions()->whereKey($executionId)->first();
+            if (! $execution) {
+                $this->dispatch('error', 'Backup execution not found.');
+
+                return;
+            }
+
+            $this->prepareBackupDownload(
+                $execution->local_storage_deleted ? null : $this->server(),
+                $execution->filename,
+                route('download.backup', $execution->id),
+            );
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function refreshBackupExecutions(): void
@@ -227,6 +241,8 @@ class BackupExecutions extends Component
 
     public function render()
     {
-        return view('livewire.project.database.backup-executions');
+        return view('livewire.project.database.backup-executions', [
+            's3Downloads' => $this->s3BackupDownloadsEnabled(),
+        ]);
     }
 }
diff --git a/app/Livewire/Project/Database/ScheduledBackups.php b/app/Livewire/Project/Database/ScheduledBackups.php
index ece99b45f4..b9da614ea3 100644
--- a/app/Livewire/Project/Database/ScheduledBackups.php
+++ b/app/Livewire/Project/Database/ScheduledBackups.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ServiceDatabase;
+use App\Traits\ListensToTeamChannel;
 use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -10,6 +11,7 @@ use Livewire\Component;
 class ScheduledBackups extends Component
 {
     use AuthorizesRequests;
+    use ListensToTeamChannel;
 
     public $database;
 
@@ -19,7 +21,13 @@ class ScheduledBackups extends Component
 
     public string $custom_type = 'mysql';
 
-    protected $listeners = ['refreshScheduledBackups'];
+    public function getListeners(): array
+    {
+        return [
+            'refreshScheduledBackups',
+            ...$this->teamChannelListeners(['BackupCreated' => '$refresh']),
+        ];
+    }
 
     public function mount(): void
     {
@@ -73,7 +81,7 @@ class ScheduledBackups extends Component
 
     public function render(): View
     {
-        $this->database->loadMissing('scheduledBackups.s3');
+        $this->database->loadMissing(['scheduledBackups.s3', 'scheduledBackups.s3Storages']);
 
         return view('livewire.project.database.scheduled-backups');
     }
diff --git a/app/Livewire/Project/EnvironmentCanvas.php b/app/Livewire/Project/EnvironmentCanvas.php
new file mode 100644
index 0000000000..22309d2e32
--- /dev/null
+++ b/app/Livewire/Project/EnvironmentCanvas.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Livewire\Project;
+
+use App\Livewire\Concerns\RemembersCanvasView;
+use App\Models\Environment;
+use App\Models\Project;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+/**
+ * Full-screen canvas of one environment's deployed resources. The page is a shell:
+ * resources/js/environment-canvas.js renders the canvas and calls
+ * Api\EnvironmentCanvasController at /canvas/api with the browser session.
+ */
+class EnvironmentCanvas extends Component
+{
+    use AuthorizesRequests;
+    use RemembersCanvasView;
+
+    #[Locked]
+    public Project $project;
+
+    #[Locked]
+    public Environment $environment;
+
+    public function mount(string $project_uuid, string $environment_uuid): void
+    {
+        $this->project = Project::ownedByCurrentTeam()->whereUuid($project_uuid)->firstOrFail();
+        $this->environment = $this->project->environments()->whereUuid($environment_uuid)->firstOrFail();
+        $this->authorize('view', $this->environment);
+        $this->rememberView('environment', 'canvas');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.environment-canvas')->layout('layouts.app', ['fullBleed' => true]);
+    }
+}
diff --git a/app/Livewire/Project/Index.php b/app/Livewire/Project/Index.php
index 038d8dea33..e3ba5f4f3c 100644
--- a/app/Livewire/Project/Index.php
+++ b/app/Livewire/Project/Index.php
@@ -2,16 +2,25 @@
 
 namespace App\Livewire\Project;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Project;
 use Illuminate\Contracts\View\View;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use RemembersCanvasView;
+
     public $projects;
 
     public function mount(): void
     {
+        if ($this->prefersCanvasView('projects')) {
+            $this->redirectRoute('project.canvas.index', navigate: true);
+
+            return;
+        }
+
         // Only load what the page renders. Servers/private keys were previously
         // hydrated into public Livewire state but never used by the view.
         $this->projects = Project::ownedByCurrentTeam()
diff --git a/app/Livewire/Project/New/GiteaPrivateRepository.php b/app/Livewire/Project/New/GiteaPrivateRepository.php
new file mode 100644
index 0000000000..83247821a9
--- /dev/null
+++ b/app/Livewire/Project/New/GiteaPrivateRepository.php
@@ -0,0 +1,245 @@
+<?php
+
+namespace App\Livewire\Project\New;
+
+use App\Models\Application;
+use App\Models\GiteaApp;
+use App\Models\Project;
+use App\Rules\ValidGitBranch;
+use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Route;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+class GiteaPrivateRepository extends Component
+{
+    use AuthorizesRequests;
+
+    public $current_step = 'gitea_apps';
+
+    public $gitea_apps;
+
+    #[Locked]
+    public ?int $gitea_app_id = null;
+
+    public $parameters;
+
+    public $currentRoute;
+
+    public $query;
+
+    public $type;
+
+    public int $selected_project_id;
+
+    #[Locked]
+    public int $selected_gitea_app_id;
+
+    public string $selected_repository_path = '';
+
+    public string $selected_branch_name = 'main';
+
+    public $repositories;
+
+    public int $total_repositories_count = 0;
+
+    public $branches;
+
+    public int $total_branches_count = 0;
+
+    public int $port = 3000;
+
+    public bool $is_static = false;
+
+    public ?string $publish_directory = null;
+
+    public ?string $base_directory = '/';
+
+    public ?string $docker_compose_location = '/docker-compose.yaml';
+
+    protected int $page = 1;
+
+    public $build_pack = 'railpack';
+
+    public bool $show_is_static = true;
+
+    private function getGiteaApp(): GiteaApp
+    {
+        return GiteaApp::private()->where('id', $this->gitea_app_id)->firstOrFail();
+    }
+
+    public function mount()
+    {
+        $this->currentRoute = Route::currentRouteName();
+        $this->parameters = get_route_parameters();
+        $this->query = request()->query();
+        $this->repositories = $this->branches = collect();
+        $this->gitea_apps = GiteaApp::private()->select(['id', 'name', 'html_url', 'team_id', 'is_system_wide', 'is_public'])->get();
+    }
+
+    public function updatedSelectedProjectId(): void
+    {
+        $this->loadBranches();
+    }
+
+    public function updatedBuildPack()
+    {
+        if ($this->build_pack === 'nixpacks' || $this->build_pack === 'railpack') {
+            $this->show_is_static = true;
+            if (! $this->is_static) {
+                $this->port = 3000;
+            }
+        } elseif ($this->build_pack === 'static') {
+            $this->show_is_static = false;
+            $this->is_static = false;
+            $this->port = 80;
+        } else {
+            $this->show_is_static = false;
+            $this->is_static = false;
+        }
+    }
+
+    public function loadRepositories($gitea_app_id)
+    {
+        $this->repositories = collect();
+        $this->branches = collect();
+        $this->total_branches_count = 0;
+        $this->page = 1;
+        $this->selected_gitea_app_id = $gitea_app_id;
+        $this->gitea_app_id = $gitea_app_id;
+        $gitea_app = $this->getGiteaApp();
+
+        try {
+            $result = loadGiteaRepositories($gitea_app, $this->page);
+            $this->repositories = $this->repositories->concat(collect($result['repositories']));
+
+            while ($result['has_more'] && $this->page < 50) {
+                $this->page++;
+                $result = loadGiteaRepositories($gitea_app, $this->page);
+                $this->repositories = $this->repositories->concat(collect($result['repositories']));
+            }
+            $this->total_repositories_count = $this->repositories->count();
+
+            $this->repositories = $this->repositories->sortBy('name');
+            if ($this->repositories->count() > 0) {
+                $first = $this->repositories->first();
+                $this->selected_project_id = data_get($first, 'id');
+                $this->selected_repository_path = data_get($first, 'full_name');
+            }
+            $this->current_step = 'repository';
+        } catch (\Throwable $e) {
+            return $this->dispatch('error', $e->getMessage());
+        }
+    }
+
+    public function loadBranches()
+    {
+        $repo = $this->repositories->where('id', $this->selected_project_id)->first();
+        $this->selected_repository_path = data_get($repo, 'full_name', $this->selected_repository_path);
+        $this->branches = collect();
+        $this->page = 1;
+        $gitea_app = $this->getGiteaApp();
+
+        try {
+            $branches = loadGiteaBranches($gitea_app, $this->selected_repository_path, $this->page);
+            $this->total_branches_count = count($branches);
+            $this->branches = $this->branches->concat(collect($branches));
+
+            while ($this->total_branches_count === GITEA_PAGE_SIZE && $this->page < 50) {
+                $this->page++;
+                $branches = loadGiteaBranches($gitea_app, $this->selected_repository_path, $this->page);
+                $this->total_branches_count = count($branches);
+                $this->branches = $this->branches->concat(collect($branches));
+            }
+
+            $this->branches = sortBranchesByPriority($this->branches);
+            $defaultBranch = data_get($repo, 'default_branch', 'main');
+            $this->selected_branch_name = $this->branches->contains('name', $defaultBranch) ? $defaultBranch : data_get($this->branches, '0.name', 'main');
+        } catch (\Throwable $e) {
+            return $this->dispatch('error', $e->getMessage());
+        }
+    }
+
+    public function submit()
+    {
+        try {
+            $this->authorize('create', Application::class);
+
+            $validator = validator([
+                'selected_repository_path' => $this->selected_repository_path,
+                'selected_branch_name' => $this->selected_branch_name,
+                'docker_compose_location' => $this->docker_compose_location,
+            ], [
+                'selected_repository_path' => 'required|string',
+                'selected_branch_name' => ['required', 'string', new ValidGitBranch],
+                'docker_compose_location' => ValidationPatterns::filePathRules(),
+            ]);
+
+            if ($validator->fails()) {
+                throw new \RuntimeException('Invalid repository data: '.$validator->errors()->first());
+            }
+
+            $destination_uuid = $this->query['destination'] ?? null;
+            $destination = find_destination_for_current_team($destination_uuid);
+            if (! $destination) {
+                throw new \Exception('Destination not found.');
+            }
+            $destination_class = $destination->getMorphClass();
+
+            $project = Project::ownedByCurrentTeam()->where('uuid', $this->parameters['project_uuid'])->firstOrFail();
+            $environment = $project->environments()->where('uuid', $this->parameters['environment_uuid'])->firstOrFail();
+
+            $gitea_app = $this->getGiteaApp();
+
+            $application = Application::create([
+                'name' => generate_application_name($this->selected_repository_path, $this->selected_branch_name),
+                'repository_project_id' => $this->selected_project_id,
+                'git_repository' => $this->selected_repository_path,
+                'git_branch' => str($this->selected_branch_name)->trim()->toString(),
+                'build_pack' => $this->build_pack,
+                'ports_exposes' => $this->port,
+                'publish_directory' => $this->publish_directory,
+                'base_directory' => $this->base_directory,
+                'environment_id' => $environment->id,
+                'destination_id' => $destination->id,
+                'destination_type' => $destination_class,
+                'source_id' => $gitea_app->id,
+                'source_type' => $gitea_app->getMorphClass(),
+            ]);
+            $application->settings->is_static = $this->is_static;
+            $application->settings->save();
+
+            if ($this->build_pack === 'dockerfile' || $this->build_pack === 'dockerimage') {
+                $application->health_check_enabled = false;
+            }
+            if ($this->build_pack === 'dockercompose') {
+                $application['docker_compose_location'] = $this->docker_compose_location;
+            }
+            $fqdn = generateUrl(server: $destination->server, random: $application->uuid);
+            $application->fqdn = $fqdn;
+            $application->name = generate_application_name($this->selected_repository_path, $this->selected_branch_name, $application->uuid);
+            $application->save();
+
+            return redirect()->route('project.application.configuration', [
+                'application_uuid' => $application->uuid,
+                'environment_uuid' => $environment->uuid,
+                'project_uuid' => $project->uuid,
+            ]);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function instantSave()
+    {
+        if ($this->is_static) {
+            $this->port = 80;
+            $this->publish_directory = '/dist';
+        } else {
+            $this->port = 3000;
+            $this->publish_directory = null;
+        }
+        $this->dispatch('success', 'Application settings updated!');
+    }
+}
diff --git a/app/Livewire/Project/New/GithubPrivateRepository.php b/app/Livewire/Project/New/GithubPrivateRepository.php
index cef0cf6ac7..59dce3cf59 100644
--- a/app/Livewire/Project/New/GithubPrivateRepository.php
+++ b/app/Livewire/Project/New/GithubPrivateRepository.php
@@ -7,6 +7,7 @@ use App\Models\GithubApp;
 use App\Models\Project;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
+use App\Traits\HasRepositoryDetection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Route;
@@ -16,6 +17,7 @@ use Livewire\Component;
 class GithubPrivateRepository extends Component
 {
     use AuthorizesRequests;
+    use HasRepositoryDetection;
 
     public $current_step = 'github_apps';
 
@@ -151,6 +153,8 @@ class GithubPrivateRepository extends Component
         $this->selected_branch_name = $this->branches->contains('name', $defaultBranch)
             ? $defaultBranch
             : data_get($this->branches, '0.name', 'main');
+
+        $this->detectRepository();
     }
 
     protected function loadBranchByPage()
@@ -173,6 +177,15 @@ class GithubPrivateRepository extends Component
         $this->branches = $this->branches->concat(collect($json));
     }
 
+    protected function applicationForDetection(): Application
+    {
+        return $this->unsavedApplicationForDetection(
+            str($this->selected_repository_owner)->trim()->toString().'/'.str($this->selected_repository_repo)->trim()->toString(),
+            $this->selected_branch_name,
+            $this->github_app,
+        );
+    }
+
     public function submit()
     {
         try {
@@ -205,7 +218,7 @@ class GithubPrivateRepository extends Component
             $project = Project::ownedByCurrentTeam()->where('uuid', $this->parameters['project_uuid'])->firstOrFail();
             $environment = $project->environments()->where('uuid', $this->parameters['environment_uuid'])->firstOrFail();
 
-            $application = new Application([
+            $application_init = [
                 'name' => generate_application_name($this->selected_repository_owner.'/'.$this->selected_repository_repo, $this->selected_branch_name),
                 'repository_project_id' => $this->selected_repository_id,
                 'git_repository' => str($this->selected_repository_owner)->trim()->toString().'/'.str($this->selected_repository_repo)->trim()->toString(),
@@ -219,23 +232,31 @@ class GithubPrivateRepository extends Component
                 'destination_type' => $destination_class,
                 'source_id' => $this->github_app->id,
                 'source_type' => $this->github_app->getMorphClass(),
-            ]);
+            ];
+
+            if ($this->build_pack === 'dockerfile' || $this->build_pack === 'dockerimage') {
+                $application_init['health_check_enabled'] = false;
+            }
+            if ($this->build_pack === 'dockerfile' && $dockerfileLocation = $this->selectedDockerfileLocation()) {
+                $application_init['dockerfile_location'] = $dockerfileLocation;
+            }
+            if ($this->build_pack === 'dockercompose') {
+                $application_init['docker_compose_location'] = $this->docker_compose_location;
+            }
+
+            $application = new Application($application_init);
             $application->save();
             $application->settings->is_static = $this->is_static;
             $application->settings->save();
 
-            if ($this->build_pack === 'dockerfile' || $this->build_pack === 'dockerimage') {
-                $application->health_check_enabled = false;
-            }
-            if ($this->build_pack === 'dockercompose') {
-                $application['docker_compose_location'] = $this->docker_compose_location;
-            }
             $fqdn = generateUrl(server: $destination->server, random: $application->uuid);
             $application->fqdn = $fqdn;
 
             $application->name = generate_application_name($this->selected_repository_owner.'/'.$this->selected_repository_repo, $this->selected_branch_name, $application->uuid);
             $application->save();
 
+            $this->importDetectedEnvironmentVariables($application);
+
             return redirect()->route('project.application.configuration', [
                 'application_uuid' => $application->uuid,
                 'environment_uuid' => $environment->uuid,
diff --git a/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php b/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
index 70834564a2..2a68a7770d 100644
--- a/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
+++ b/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\New;
 
 use App\Models\Application;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\PrivateKey;
@@ -10,6 +11,7 @@ use App\Models\Project;
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Support\ValidationPatterns;
+use App\Traits\HasRepositoryDetection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Str;
 use Livewire\Component;
@@ -18,6 +20,7 @@ use Spatie\Url\Url;
 class GithubPrivateRepositoryDeployKey extends Component
 {
     use AuthorizesRequests;
+    use HasRepositoryDetection;
 
     public $current_step = 'private_keys';
 
@@ -53,7 +56,7 @@ class GithubPrivateRepositoryDeployKey extends Component
 
     private object $repository_url_parsed;
 
-    private GithubApp|GitlabApp|string $git_source = 'other';
+    private GithubApp|GitlabApp|GiteaApp|string $git_source = 'other';
 
     private ?string $git_host = null;
 
@@ -132,6 +135,18 @@ class GithubPrivateRepositoryDeployKey extends Component
         $this->current_step = 'repository';
     }
 
+    protected function applicationForDetection(): Application
+    {
+        $this->get_git_source();
+
+        return $this->unsavedApplicationForDetection(
+            $this->git_repository,
+            $this->branch ?? 'main',
+            $this->git_source instanceof GithubApp || $this->git_source instanceof GitlabApp || $this->git_source instanceof GiteaApp ? $this->git_source : null,
+            PrivateKey::ownedByCurrentTeam()->findOrFail($this->private_key_id),
+        );
+    }
+
     public function submit()
     {
         $this->authorize('create', Application::class);
@@ -186,6 +201,9 @@ class GithubPrivateRepositoryDeployKey extends Component
             if ($this->build_pack === 'dockerfile' || $this->build_pack === 'dockerimage') {
                 $application_init['health_check_enabled'] = false;
             }
+            if ($this->build_pack === 'dockerfile' && $dockerfileLocation = $this->selectedDockerfileLocation()) {
+                $application_init['dockerfile_location'] = $dockerfileLocation;
+            }
             if ($this->build_pack === 'dockercompose') {
                 $application_init['docker_compose_location'] = $this->docker_compose_location;
                 $application_init['base_directory'] = $this->base_directory;
@@ -200,6 +218,8 @@ class GithubPrivateRepositoryDeployKey extends Component
             $application->name = generate_random_name($application->uuid);
             $application->save();
 
+            $this->importDetectedEnvironmentVariables($application);
+
             return redirect()->route('project.application.configuration', [
                 'application_uuid' => $application->uuid,
                 'environment_uuid' => $environment->uuid,
diff --git a/app/Livewire/Project/New/PublicGitRepository.php b/app/Livewire/Project/New/PublicGitRepository.php
index 747bbaa9cd..6c17b2810a 100644
--- a/app/Livewire/Project/New/PublicGitRepository.php
+++ b/app/Livewire/Project/New/PublicGitRepository.php
@@ -3,12 +3,14 @@
 namespace App\Livewire\Project\New;
 
 use App\Models\Application;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\Project;
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Support\ValidationPatterns;
+use App\Traits\HasRepositoryDetection;
 use Carbon\Carbon;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -17,6 +19,7 @@ use Spatie\Url\Url;
 class PublicGitRepository extends Component
 {
     use AuthorizesRequests;
+    use HasRepositoryDetection;
 
     public string $repository_url;
 
@@ -50,7 +53,7 @@ class PublicGitRepository extends Component
 
     private object $repository_url_parsed;
 
-    public GithubApp|GitlabApp|string $git_source = 'other';
+    public GithubApp|GitlabApp|GiteaApp|string $git_source = 'other';
 
     public string $git_host;
 
@@ -167,17 +170,17 @@ class PublicGitRepository extends Component
                 $this->git_branch = 'master';
             }
             $this->selectedBranch = $this->git_branch;
+
         } catch (\Throwable $e) {
             if ($this->rate_limit_remaining == 0) {
                 $this->selectedBranch = $this->git_branch;
                 $this->branchFound = true;
 
-                return;
-            }
-            if (! $this->branchFound && $this->git_branch === 'main') {
+            } elseif (! $this->branchFound && $this->git_branch === 'main') {
                 try {
                     $this->git_branch = 'master';
                     $this->getBranch();
+
                 } catch (\Throwable $e) {
                     return handleError($e, $this);
                 }
@@ -185,6 +188,19 @@ class PublicGitRepository extends Component
                 return handleError($e, $this);
             }
         }
+        if ($this->branchFound) {
+            $this->selectedBranch = $this->git_branch;
+            $this->detectRepository();
+        }
+    }
+
+    protected function applicationForDetection(): Application
+    {
+        return $this->unsavedApplicationForDetection(
+            $this->git_repository,
+            $this->git_branch,
+            $this->git_source instanceof GithubApp || $this->git_source instanceof GitlabApp || $this->git_source instanceof GiteaApp ? $this->git_source : null,
+        );
     }
 
     private function getGitSource()
@@ -331,6 +347,9 @@ class PublicGitRepository extends Component
             if ($this->build_pack === 'dockerfile' || $this->build_pack === 'dockerimage') {
                 $application_init['health_check_enabled'] = false;
             }
+            if ($this->build_pack === 'dockerfile' && $dockerfileLocation = $this->selectedDockerfileLocation()) {
+                $application_init['dockerfile_location'] = $dockerfileLocation;
+            }
             if ($this->build_pack === 'dockercompose') {
                 $application_init['docker_compose_location'] = $this->docker_compose_location;
                 $application_init['base_directory'] = $this->base_directory;
@@ -344,6 +363,8 @@ class PublicGitRepository extends Component
             $application->fqdn = $fqdn;
             $application->save();
 
+            $this->importDetectedEnvironmentVariables($application);
+
             return redirect()->route('project.application.configuration', [
                 'application_uuid' => $application->uuid,
                 'environment_uuid' => $environment->uuid,
diff --git a/app/Livewire/Project/New/Select.php b/app/Livewire/Project/New/Select.php
index 656a5710ca..9ada4fd0fb 100644
--- a/app/Livewire/Project/New/Select.php
+++ b/app/Livewire/Project/New/Select.php
@@ -157,28 +157,34 @@ class Select extends Component
                 'name' => 'Public Git Repository',
                 'description' => 'Deploy any public Git repository. Coolify builds it from source, no credentials required.',
                 'documentation' => 'https://coolify.io/docs/applications/ci-cd',
-                'logo' => asset('svgs/resources/public-repo.svg'),
+                'logo' => resource_logo_url('public-repo'),
             ],
             [
                 'id' => 'private-deploy-key',
                 'name' => 'Private Git Repository (with Deploy Key)',
                 'description' => 'Deploy a private repository over SSH with a repository-scoped deploy key. Set the URL and branch manually, no automatic deploys.',
                 'documentation' => 'https://coolify.io/docs/applications/ci-cd/github/deploy-key',
-                'logo' => asset('svgs/resources/deploy-key.svg'),
+                'logo' => resource_logo_url('deploy-key'),
             ],
             [
                 'id' => 'private-gh-app',
                 'name' => 'Git Repository (with GitHub App)',
                 'description' => 'Deploy public or private GitHub repositories through a GitHub App, with automatic webhooks and pull request previews.',
                 'documentation' => 'https://coolify.io/docs/applications/ci-cd/github/setup-app',
-                'logo' => asset('svgs/resources/github-app.svg'),
-                'logoDark' => asset('svgs/resources/github-app-dark.svg'),
+                'logo' => resource_logo_url('github-app'),
+                'logoDark' => resource_logo_url('github-app-dark'),
             ],
             [
                 'id' => 'private-gitlab-app',
                 'name' => 'Git Repository (with GitLab App)',
                 'description' => 'Deploy public or private GitLab projects through a GitLab App, with automatic webhooks and merge request previews.',
-                'logo' => asset('svgs/resources/gitlab-app.svg'),
+                'logo' => resource_logo_url('gitlab-app'),
+            ],
+            [
+                'id' => 'private-gitea-app',
+                'name' => 'Git Repository (with Gitea App)',
+                'description' => 'Deploy public or private Gitea repositories through a Gitea App, with automatic webhooks and pull request previews.',
+                'logo' => asset('svgs/gitea.svg'),
             ],
         ];
         $dockerBasedApplications = [
@@ -187,21 +193,21 @@ class Select extends Component
                 'name' => 'Dockerfile',
                 'description' => 'Deploy an application using a Dockerfile, without a Git repository.',
                 'documentation' => 'https://coolify.io/docs/applications/build-packs/dockerfile',
-                'logo' => asset('svgs/resources/dockerfile.svg'),
+                'logo' => resource_logo_url('dockerfile'),
             ],
             [
                 'id' => 'docker-compose-empty',
                 'name' => 'Docker Compose',
                 'description' => 'Deploy a multi-container application using a Docker Compose file, without a Git repository.',
                 'documentation' => 'https://coolify.io/docs/applications/build-packs/docker-compose',
-                'logo' => asset('svgs/resources/docker-compose.svg'),
+                'logo' => resource_logo_url('docker-compose'),
             ],
             [
                 'id' => 'docker-image',
                 'name' => 'Docker Image',
                 'description' => 'Deploy an application using a prebuilt image from any Docker registry, without a Git repository.',
                 'documentation' => 'https://coolify.io/docs/applications',
-                'logo' => asset('svgs/resources/docker-image.svg'),
+                'logo' => resource_logo_url('docker-image'),
             ],
         ];
         $databases = [
@@ -209,58 +215,58 @@ class Select extends Component
                 'id' => 'postgresql',
                 'name' => 'PostgreSQL',
                 'description' => 'A relational database with strong SQL standards support and extensibility.',
-                'logo' => asset('svgs/resources/postgres.svg'),
+                'logo' => resource_logo_url('postgres'),
             ],
             [
                 'id' => 'mysql',
                 'name' => 'MySQL',
                 'description' => 'A relational database for web and general-purpose applications.',
-                'logo' => asset('svgs/resources/mysql.svg'),
+                'logo' => resource_logo_url('mysql'),
 
             ],
             [
                 'id' => 'mariadb',
                 'name' => 'MariaDB',
                 'description' => 'A relational database and drop-in replacement for MySQL.',
-                'logo' => asset('svgs/resources/mariadb.svg'),
+                'logo' => resource_logo_url('mariadb'),
             ],
             [
                 'id' => 'redis',
                 'name' => 'Redis',
                 'description' => 'An in-memory key-value store used as a database, cache, and message broker.',
-                'logo' => asset('svgs/resources/redis.svg'),
+                'logo' => resource_logo_url('redis'),
             ],
             [
                 'id' => 'keydb',
                 'name' => 'KeyDB',
                 'description' => 'A multithreaded, Redis-compatible in-memory store.',
-                'logo' => asset('svgs/resources/keydb.svg'),
-                'logoDark' => asset('svgs/resources/keydb-dark.svg'),
+                'logo' => resource_logo_url('keydb'),
+                'logoDark' => resource_logo_url('keydb-dark'),
             ],
             [
                 'id' => 'dragonfly',
                 'name' => 'Dragonfly',
                 'description' => 'An in-memory datastore compatible with Redis and Memcached.',
-                'logo' => asset('svgs/resources/dragonfly.svg'),
-                'logoDark' => asset('svgs/resources/dragonfly-dark.svg'),
+                'logo' => resource_logo_url('dragonfly'),
+                'logoDark' => resource_logo_url('dragonfly-dark'),
             ],
             [
                 'id' => 'mongodb',
                 'name' => 'MongoDB',
                 'description' => 'A document-oriented NoSQL database that stores JSON-like documents.',
-                'logo' => asset('svgs/resources/mongodb.svg'),
+                'logo' => resource_logo_url('mongodb'),
             ],
             [
                 'id' => 'clickhouse',
                 'name' => 'ClickHouse',
                 'description' => 'A column-oriented database for real-time analytics over large datasets.',
-                'logo' => asset('svgs/resources/clickhouse.svg'),
+                'logo' => resource_logo_url('clickhouse'),
             ],
             [
                 'id' => 'sqlite',
                 'name' => 'SQLite',
                 'description' => 'A lightweight relational database stored in a single file.',
-                'logo' => asset('svgs/resources/sqlite.svg'),
+                'logo' => resource_logo_url('sqlite'),
                 'experimental' => true,
             ],
 
diff --git a/app/Livewire/Project/ProjectCanvas.php b/app/Livewire/Project/ProjectCanvas.php
new file mode 100644
index 0000000000..d0e3e26c5c
--- /dev/null
+++ b/app/Livewire/Project/ProjectCanvas.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Livewire\Project;
+
+use App\Livewire\Concerns\CreatesEnvironments;
+use App\Livewire\Concerns\RemembersCanvasView;
+use App\Models\Project;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+/**
+ * Read-only canvas of every environment of a project. The page is a shell:
+ * resources/js/environment-canvas.js renders it from Api\ProjectCanvasController
+ * at /canvas/api with the browser session.
+ */
+class ProjectCanvas extends Component
+{
+    use AuthorizesRequests;
+    use CreatesEnvironments;
+    use RemembersCanvasView;
+
+    #[Locked]
+    public Project $project;
+
+    public function mount(string $project_uuid): void
+    {
+        $this->project = Project::ownedByCurrentTeam()->whereUuid($project_uuid)->firstOrFail();
+        $this->authorize('view', $this->project);
+        $this->rememberView('project', 'canvas');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.project-canvas')->layout('layouts.app', ['fullBleed' => true]);
+    }
+}
diff --git a/app/Livewire/Project/ProjectsCanvas.php b/app/Livewire/Project/ProjectsCanvas.php
new file mode 100644
index 0000000000..93cf54dce7
--- /dev/null
+++ b/app/Livewire/Project/ProjectsCanvas.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Livewire\Project;
+
+use App\Livewire\Concerns\RemembersCanvasView;
+use App\Models\Project;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+/**
+ * Read-only canvas of every project of the team. The page is a shell:
+ * resources/js/environment-canvas.js renders it from Api\ProjectCanvasController
+ * at /canvas/api with the browser session.
+ */
+class ProjectsCanvas extends Component
+{
+    use AuthorizesRequests;
+    use RemembersCanvasView;
+
+    /** The team that owned the page at mount; the canvas API calls use it, not the session team. */
+    #[Locked]
+    public int $teamId;
+
+    public function mount(): void
+    {
+        $this->authorize('viewAny', Project::class);
+        $this->teamId = currentTeam()->id;
+        $this->rememberView('projects', 'canvas');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.projects-canvas')->layout('layouts.app', ['fullBleed' => true]);
+    }
+}
diff --git a/app/Livewire/Project/Resource/Index.php b/app/Livewire/Project/Resource/Index.php
index dca586fc0c..90c42c581d 100644
--- a/app/Livewire/Project/Resource/Index.php
+++ b/app/Livewire/Project/Resource/Index.php
@@ -2,13 +2,17 @@
 
 namespace App\Livewire\Project\Resource;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Environment;
 use App\Models\Project;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Blade;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use RemembersCanvasView;
+
     public Project $project;
 
     public Environment $environment;
@@ -55,6 +59,12 @@ class Index extends Component
             ->where('uuid', request()->route('environment_uuid'))
             ->firstOrFail();
 
+        if ($this->prefersCanvasView('environment')) {
+            $this->redirectRoute('project.environment.canvas', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid], navigate: true);
+
+            return;
+        }
+
         $this->project = $project;
 
         // Load projects and environments for breadcrumb navigation
@@ -201,6 +211,7 @@ class Index extends Component
             'maxRestartCount' => $item->max_restart_count ?? 0,
             'server_status' => $item->server_status ?? null,
             'hrefLink' => $item->hrefLink ?? '',
+            'logoHtml' => Blade::render('<x-resource-logo :resource="$resource" />', ['resource' => $item]),
             'destination' => [
                 'server' => [
                     'name' => $item->destination?->server?->name ?? 'Unknown',
diff --git a/app/Livewire/Project/Service/BackupExecutions.php b/app/Livewire/Project/Service/BackupExecutions.php
index 81be0ff8ad..d4b63e4766 100644
--- a/app/Livewire/Project/Service/BackupExecutions.php
+++ b/app/Livewire/Project/Service/BackupExecutions.php
@@ -9,6 +9,7 @@ use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use App\Traits\ListensToTeamChannel;
+use App\Traits\PreparesBackupDownloads;
 use Illuminate\Contracts\View\View;
 use Illuminate\Database\Query\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -20,6 +21,7 @@ class BackupExecutions extends Component
 {
     use AuthorizesRequests;
     use ListensToTeamChannel;
+    use PreparesBackupDownloads;
     use WithPagination;
 
     public Service $service;
@@ -62,6 +64,29 @@ class BackupExecutions extends Component
         $this->executionModalOpen = true;
     }
 
+    public function downloadExecution(string $executionUuid): void
+    {
+        $this->authorize('update', $this->service);
+        $row = $this->executionQuery($executionUuid)->first();
+        abort_unless($row, 404);
+
+        try {
+            if ($row->type === 'database') {
+                $execution = ScheduledDatabaseBackupExecution::query()->with('scheduledDatabaseBackup')->findOrFail($row->id);
+                $server = $execution->scheduledDatabaseBackup->server();
+                $streamUrl = route('download.backup', $execution->id);
+            } else {
+                $execution = ScheduledVolumeBackupExecution::query()->with('scheduledVolumeBackup')->findOrFail($row->id);
+                $server = $execution->scheduledVolumeBackup->server();
+                $streamUrl = route('download.volume-backup', $execution->id);
+            }
+
+            $this->prepareBackupDownload($execution->local_storage_deleted ? null : $server, $execution->filename, $streamUrl);
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function closeExecutionModal(): void
     {
         $this->executionModalOpen = false;
@@ -80,6 +105,7 @@ class BackupExecutions extends Component
 
         return view('livewire.project.service.backup-executions', [
             'executions' => $executions,
+            's3Downloads' => $this->s3BackupDownloadsEnabled(),
         ]);
     }
 
@@ -114,11 +140,11 @@ class BackupExecutions extends Component
     private function formatExecutions(Collection $rows): Collection
     {
         $databaseExecutions = ScheduledDatabaseBackupExecution::query()
-            ->with(['scheduledDatabaseBackup.database', 'scheduledDatabaseBackup.s3'])
+            ->with(['scheduledDatabaseBackup.database', 'scheduledDatabaseBackup.s3', 'scheduledDatabaseBackup.s3Storages', 's3Replicas'])
             ->whereIn('id', $rows->where('type', 'database')->pluck('id'))
             ->get()->keyBy('id');
         $volumeExecutions = ScheduledVolumeBackupExecution::query()
-            ->with(['scheduledVolumeBackup.backupable.resource', 's3'])
+            ->with(['scheduledVolumeBackup.backupable.resource', 's3', 's3Replicas'])
             ->whereIn('id', $rows->where('type', 'storage')->pluck('id'))
             ->get()->keyBy('id');
 
@@ -128,11 +154,16 @@ class BackupExecutions extends Component
             $isDatabase = $row->type === 'database';
             $execution = $isDatabase ? $databaseExecutions->get($row->id) : $volumeExecutions->get($row->id);
             $schedule = $isDatabase ? $execution->scheduledDatabaseBackup : $execution->scheduledVolumeBackup;
-            $storage = $isDatabase ? ($schedule->save_s3 ? $schedule->s3 : null) : $execution->s3;
-            if ($storage?->team_id !== $serviceTeamId) {
-                $storage = null;
-            }
-            $storageLabel = $storage ? $storage->name.' (bucket: '.$storage->bucket.')' : 'Unavailable';
+            $storages = match (true) {
+                ! $isDatabase => collect([$execution->s3]),
+                ! $schedule->save_s3 => collect(),
+                $schedule->s3Storages->isNotEmpty() => $schedule->s3Storages,
+                default => collect([$schedule->s3]),
+            };
+            $storageLabel = $storages
+                ->filter(fn ($storage) => $storage?->team_id === $serviceTeamId)
+                ->map(fn ($storage) => $storage->name.' (bucket: '.$storage->bucket.')')
+                ->implode(', ') ?: 'Unavailable';
             if ($isDatabase && ! $schedule->save_s3) {
                 $storageLabel = 'Not configured';
             } elseif (! $isDatabase && ! $execution->s3_storage_id && ! $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
@@ -151,7 +182,7 @@ class BackupExecutions extends Component
                 'size' => $execution->size,
                 'message' => $execution->message,
                 'filename' => $execution->filename,
-                'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
+                'download_url' => $execution->status === 'success' && $execution->isDownloadable()
                     ? route($isDatabase ? 'download.backup' : 'download.volume-backup', $execution->id)
                     : null,
             ];
diff --git a/app/Livewire/Project/Service/DatabaseBackups.php b/app/Livewire/Project/Service/DatabaseBackups.php
index 71885094aa..c778572f94 100644
--- a/app/Livewire/Project/Service/DatabaseBackups.php
+++ b/app/Livewire/Project/Service/DatabaseBackups.php
@@ -84,8 +84,6 @@ class DatabaseBackups extends Component
                     ->get();
                 $this->backupParameters = [...$this->parameters, 'backup_uuid' => $this->backup->uuid];
                 $this->section = match (request()->route()?->getName()) {
-                    'project.service.database.backup.s3' => 's3',
-                    'project.service.database.backup.retention' => 'retention',
                     'project.service.database.backup.executions' => 'executions',
                     'project.service.database.backup.danger' => 'danger',
                     default => 'general',
diff --git a/app/Livewire/Project/Service/ResourceCard.php b/app/Livewire/Project/Service/ResourceCard.php
index 22ed772a80..5b67baab01 100644
--- a/app/Livewire/Project/Service/ResourceCard.php
+++ b/app/Livewire/Project/Service/ResourceCard.php
@@ -24,6 +24,7 @@ class ResourceCard extends Component
     public function getListeners(): array
     {
         return $this->teamChannelListeners([
+            'ServiceStatusChanged' => 'refreshResource',
             'ServiceChecked' => 'refreshResource',
         ]);
     }
diff --git a/app/Livewire/Project/Service/VolumeBackup/Index.php b/app/Livewire/Project/Service/VolumeBackup/Index.php
index 60a78e5c15..e73bc12216 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Index.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Index.php
@@ -45,6 +45,7 @@ class Index extends Component
             'modalClosed' => 'closeScheduleModal',
             ...$this->teamChannelListeners([
                 'ServiceChecked' => '$refresh',
+                'ServiceStatusChanged' => '$refresh',
                 'BackupCreated' => '$refresh',
             ]),
         ];
@@ -118,7 +119,7 @@ class Index extends Component
         );
 
         $databaseBackups = ScheduledDatabaseBackup::query()
-            ->with(['database', 'latest_log', 's3'])
+            ->with(['database', 'latest_log', 's3', 's3Storages'])
             ->withCount('executions')
             ->where('database_type', (new ServiceDatabase)->getMorphClass())
             ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
@@ -126,7 +127,7 @@ class Index extends Component
             ->get();
 
         $backups = ScheduledVolumeBackup::query()
-            ->with(['backupable.resource', 'latestExecution', 's3'])
+            ->with(['backupable.resource', 'latestExecution', 's3', 's3Storages'])
             ->withCount('executions')
             ->forService($this->service)
             ->latest()
diff --git a/app/Livewire/Project/Service/VolumeBackup/Show.php b/app/Livewire/Project/Service/VolumeBackup/Show.php
index 10abeb3bf4..8ca50d458a 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Show.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Show.php
@@ -37,8 +37,6 @@ class Show extends Component
             ->firstOrFail();
         $this->parameters = get_route_parameters();
         $this->section = match (request()->route()?->getName()) {
-            'project.service.volume-backups.s3' => 's3',
-            'project.service.volume-backups.retention' => 'retention',
             'project.service.volume-backups.executions' => 'executions',
             'project.service.volume-backups.danger' => 'danger',
             default => 'general',
diff --git a/app/Livewire/Project/Shared/Danger.php b/app/Livewire/Project/Shared/Danger.php
index 4de58e145e..0865974828 100644
--- a/app/Livewire/Project/Shared/Danger.php
+++ b/app/Livewire/Project/Shared/Danger.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Shared;
 
+use App\Actions\Database\FlushDatabase;
 use App\Jobs\DeleteResourceJob;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -157,6 +158,31 @@ class Danger extends Component
         }
     }
 
+    public function flush($password)
+    {
+        try {
+            $this->authorize('manage', $this->resource);
+
+            if (! verifyPasswordConfirmation($password, $this)) {
+                return 'The provided password is incorrect.';
+            }
+
+            FlushDatabase::run($this->resource);
+            auditLog('ui.database.flushed', [
+                'team_id' => $this->resource->team()?->id,
+                'database_uuid' => $this->resource->uuid,
+                'database_name' => $this->resource->name,
+            ]);
+            $this->dispatch('success', 'Database flushed.');
+
+            return true;
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return false;
+        }
+    }
+
     public function render()
     {
         return view('livewire.project.shared.danger', [
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/All.php b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
index 10d5977ad3..736075dc7c 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/All.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
@@ -59,6 +59,8 @@ class All extends Component
 
     public bool $include_coolify_default_variables = true;
 
+    public bool $redact_all_env_values_in_logs = true;
+
     /**
      * Environment variable rows are loaded after first paint via wire:init
      * so the surrounding configuration page can render immediately.
@@ -113,6 +115,9 @@ class All extends Component
         $this->use_build_secrets = data_get($this->resource, 'settings.use_build_secrets', false);
         $coolifyDefaultVariablesOwner = $this->resource instanceof Application ? $this->resource->settings : $this->resource;
         $this->include_coolify_default_variables = data_get($coolifyDefaultVariablesOwner, 'include_coolify_default_variables') !== false;
+        if ($this->hasLogRedactionSetting()) {
+            $this->redact_all_env_values_in_logs = $this->resource->redactsAllEnvValuesInLogs();
+        }
         $this->resourceClass = get_class($this->resource);
         $resourceWithPreviews = [Application::class];
         $simpleDockerfile = filled(data_get($this->resource, 'dockerfile'));
@@ -141,6 +146,41 @@ class All extends Component
         }
     }
 
+    /**
+     * Applications, services, and standalone databases have the "Environment values in logs" setting.
+     */
+    public function hasLogRedactionSetting(): bool
+    {
+        return method_exists($this->resource, 'redactsAllEnvValuesInLogs');
+    }
+
+    public function saveLogRedactionSetting()
+    {
+        try {
+            $this->authorize('manageEnvironment', $this->resource);
+
+            if ($this->resource instanceof Application) {
+                $this->resource->settings->redact_all_env_values_in_logs = $this->redact_all_env_values_in_logs;
+                $this->saveApplicationSettingsWithAudit($this->resource);
+            } elseif ($this->hasLogRedactionSetting()) {
+                // Services and databases use the Auditable trait, so saving records the changed field.
+                $this->resource->redact_all_env_values_in_logs = $this->redact_all_env_values_in_logs;
+                $this->resource->save();
+            } else {
+                return;
+            }
+
+            $this->dispatch('success', 'Log redaction setting updated.');
+        } catch (\Throwable $e) {
+            if ($this->hasLogRedactionSetting()) {
+                $this->resource->refresh();
+                $this->redact_all_env_values_in_logs = $this->resource->redactsAllEnvValuesInLogs();
+            }
+
+            return handleError($e, $this);
+        }
+    }
+
     public function instantSave()
     {
         try {
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index 2e8be77ddf..6dc835fa95 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -10,6 +10,7 @@ use App\Models\Project;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\SharedEnvironmentVariable;
+use App\Services\SharedVariableCanvas;
 use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
 use App\Traits\EnvironmentVariableProtection;
@@ -404,6 +405,15 @@ class Show extends Component
         );
     }
 
+    /**
+     * Shared variables only: the connect envs canvas with this variable selected.
+     */
+    #[Computed]
+    public function connectLink(): ?string
+    {
+        return $this->isSharedVariable ? app(SharedVariableCanvas::class)->connectLink($this->env) : null;
+    }
+
     #[Computed]
     public function availableSharedVariables(): array
     {
diff --git a/app/Livewire/Project/Shared/FileBrowser.php b/app/Livewire/Project/Shared/FileBrowser.php
new file mode 100644
index 0000000000..09f8f0c6b9
--- /dev/null
+++ b/app/Livewire/Project/Shared/FileBrowser.php
@@ -0,0 +1,545 @@
+<?php
+
+namespace App\Livewire\Project\Shared;
+
+use App\Http\Controllers\FileBrowserDownloadController;
+use App\Jobs\PrepareFileDownloadJob;
+use App\Models\Application;
+use App\Models\Server;
+use App\Models\Service;
+use App\Services\ContainerFilesystemService;
+use App\Services\FileDownloadStorageService;
+use App\Support\ValidationPatterns;
+use Illuminate\Contracts\View\View;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+use Livewire\Features\SupportFileUploads\TemporaryUploadedFile;
+use Livewire\WithFileUploads;
+
+class FileBrowser extends Component
+{
+    use AuthorizesRequests;
+    use WithFileUploads;
+
+    #[Locked]
+    public Model $resource;
+
+    /** Uploads to S3 hold a queue worker, so each user may only start a few. */
+    private const MAX_PENDING_S3_DOWNLOADS = 3;
+
+    #[Locked]
+    public string $type = '';
+
+    #[Locked]
+    public bool $containerRunning = false;
+
+    #[Locked]
+    public bool $filesLoaded = false;
+
+    #[Locked]
+    public bool $loadFailed = false;
+
+    #[Locked]
+    public ?string $container = null;
+
+    /** @var array<int, string> */
+    #[Locked]
+    public array $availableContainers = [];
+
+    public string $currentPath = '';
+
+    /** @var array<int, array{name:string,type:string,size:int,mtime:int}> */
+    public array $entries = [];
+
+    #[Locked]
+    public ?string $editingPath = null;
+
+    public bool $editorOpen = false;
+
+    public string $editorContent = '';
+
+    public string $editorLanguage = '';
+
+    public ?TemporaryUploadedFile $upload = null;
+
+    /** @var array<int, string> */
+    #[Locked]
+    public array $pendingDownloads = [];
+
+    /** @var array<string, mixed> */
+    public array $parameters = [];
+
+    public function mount(?Model $resource = null): void
+    {
+        $this->parameters = get_route_parameters();
+        $resource = $resource ?? $this->resolveResourceFromRoute();
+
+        // Security gate first, before any server or container resolution.
+        $this->authorize('canAccessTerminal');
+        $this->authorize('view', $resource);
+        abort_unless((int) $resource->environment->project->team_id === (int) auth()->user()->currentTeam()->id, 403);
+
+        $this->resource = $resource;
+        $this->type = $this->resolveType($resource);
+        $this->containerRunning = (bool) $resource->isRunning();
+
+        $this->filesLoaded = ! $this->containerRunning;
+    }
+
+    public function loadFiles(): void
+    {
+        $this->authorizeFileAccess();
+        if ($this->filesLoaded) {
+            return;
+        }
+        $this->loadFailed = false;
+        $this->containerRunning = (bool) $this->resource->isRunning();
+
+        try {
+            $this->availableContainers = $this->containerRunning ? $this->resolveContainers() : [];
+            $this->container = $this->availableContainers[0] ?? null;
+            if (is_null($this->container)) {
+                $this->containerRunning = false;
+            } else {
+                $this->currentPath = $this->service()->defaultRoot();
+                $this->loadEntries();
+            }
+            $this->filesLoaded = true;
+        } catch (\Throwable $e) {
+            $this->container = null;
+            $this->loadFailed = true;
+            handleError($e, $this);
+        }
+    }
+
+    public function selectContainer(string $name): void
+    {
+        $this->guard();
+        if (! in_array($name, $this->availableContainers, true)) {
+            return;
+        }
+        $this->closeEditor();
+        $this->container = $name;
+        $this->currentPath = $this->service()->defaultRoot();
+        $this->loadEntries();
+    }
+
+    public function open(string $name): void
+    {
+        $this->guard();
+        $this->currentPath = $this->childPath($name);
+        $this->loadEntries();
+    }
+
+    public function goTo(string $path): void
+    {
+        $this->guard();
+        if (! str_starts_with($path, '/')) {
+            return;
+        }
+        $this->currentPath = $path === '/' ? '/' : rtrim($path, '/');
+        $this->loadEntries();
+    }
+
+    public function refresh(): void
+    {
+        $this->guard();
+        $this->loadEntries();
+    }
+
+    public function createDirectory(string $name): void
+    {
+        $this->guard();
+        try {
+            $this->service()->makeDirectory($this->childPath($name));
+            $this->loadEntries();
+            $this->dispatch('success', 'Folder created.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function createFile(string $name): void
+    {
+        $this->guard();
+        try {
+            $this->service()->createFile($this->childPath($name));
+            $this->loadEntries();
+            $this->dispatch('success', 'File created.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function chmodEntry(string $name, string $mode): void
+    {
+        $this->guard();
+        try {
+            $this->service()->chmod($this->childPath($name), $mode);
+            $this->loadEntries();
+            $this->dispatch('success', 'Permissions updated.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function renameEntry(string $from, string $newName): void
+    {
+        $this->guard();
+        try {
+            $this->service()->rename($this->childPath($from), $this->childPath($newName));
+            $this->loadEntries();
+            $this->dispatch('success', 'Renamed.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function deleteEntry(string $name): void
+    {
+        $this->guard();
+        try {
+            $this->service()->delete($this->childPath($name));
+            $this->loadEntries();
+            $this->dispatch('success', 'Deleted.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function openEditor(string $name): void
+    {
+        $this->guard();
+        $path = $this->childPath($name);
+        try {
+            // read() guards binary/oversized files internally and throws.
+            $this->editorContent = $this->service()->read($path);
+            $this->editorLanguage = $this->guessLanguage($name);
+            $this->editingPath = $path;
+            $this->editorOpen = true;
+            // Push content + language into the mounted Monaco editor. It lives
+            // behind wire:ignore, so a dispatched event is how it receives them.
+            $this->dispatch('load-file-editor', content: $this->editorContent, language: $this->editorLanguage);
+        } catch (\RuntimeException $e) {
+            $this->dispatch('error', "Can't edit this file - it's binary or larger than 5 MB. Download it instead.");
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function saveEditor(): void
+    {
+        $this->guard();
+        if (is_null($this->editingPath)) {
+            return;
+        }
+        try {
+            $this->service()->write($this->editingPath, $this->editorContent);
+            $this->editingPath = null;
+            $this->editorOpen = false;
+            $this->editorContent = '';
+            $this->loadEntries();
+            $this->dispatch('success', 'Saved.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function closeEditor(): void
+    {
+        $this->editingPath = null;
+        $this->editorOpen = false;
+        $this->editorContent = '';
+    }
+
+    public function uploadFile(): void
+    {
+        $this->guard();
+        $this->validate(['upload' => 'required|file|max:1048576']); // 1 GB (KB units)
+        try {
+            $localTmp = $this->upload->getRealPath();
+            $filename = $this->sanitizeUploadName($this->upload->getClientOriginalName());
+            $this->service()->upload($localTmp, $this->childPath($filename));
+            $this->upload = null;
+            $this->loadEntries();
+            $this->dispatch('success', 'Uploaded.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function download(string $name): void
+    {
+        $this->guard();
+        try {
+            $path = $this->childPath($name);
+            $target = $this->service()->downloadInfo($path);
+            $downloadName = $target['isDir'] ? $name.'.tar.gz' : $name;
+            $s3Storage = FileDownloadStorageService::configuredStorage();
+            $maxSize = $s3Storage ? FileDownloadStorageService::MAX_SIZE : ContainerFilesystemService::MAX_DOWNLOAD_SIZE;
+            if ($target['size'] > $maxSize) {
+                $this->dispatch('error', ($target['isDir'] ? 'This folder' : 'This file').' is larger than '.formatBytes($maxSize).' and cannot be downloaded here. Use the terminal or a volume backup instead.');
+
+                return;
+            }
+
+            if ($s3Storage) {
+                if (count($this->pendingDownloads) >= self::MAX_PENDING_S3_DOWNLOADS
+                    || ! RateLimiter::attempt('file-browser-s3-download:'.auth()->id(), 10, fn () => true, 3600)) {
+                    $this->dispatch('error', 'Too many downloads are in progress. Wait for them to finish, then try again.');
+
+                    return;
+                }
+                $downloadId = (string) Str::uuid();
+                $this->pendingDownloads[] = $downloadId;
+                PrepareFileDownloadJob::dispatch($downloadId, auth()->id(), $this->server()->id, $this->container, $path, $target['isDir'], $downloadName, $s3Storage->id);
+                $this->dispatch('info', 'Preparing '.$downloadName.'. The download starts when it is ready.');
+
+                return;
+            }
+
+            $token = Str::random(64);
+            Cache::put(FileBrowserDownloadController::cacheKey($token), [
+                'user_id' => auth()->id(),
+                'resource_type' => $this->resource::class,
+                'resource_id' => $this->resource->getKey(),
+                'server_id' => $this->server()->id,
+                'container' => $this->container,
+                'path' => $path,
+                'name' => $downloadName,
+                'is_dir' => $target['isDir'],
+            ], FileBrowserDownloadController::TOKEN_TTL_SECONDS);
+
+            $this->redirect(route('project.files.download', $token));
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    /**
+     * Polled while S3 downloads are prepared. Opens each finished link once.
+     */
+    public function checkDownloads(): void
+    {
+        $this->authorizeFileAccess();
+        foreach ($this->pendingDownloads as $index => $downloadId) {
+            $result = Cache::get(PrepareFileDownloadJob::cacheKey($downloadId));
+            if (! is_array($result) || ($result['user_id'] ?? null) !== auth()->id()) {
+                continue;
+            }
+
+            unset($this->pendingDownloads[$index]);
+            Cache::forget(PrepareFileDownloadJob::cacheKey($downloadId));
+            if ($result['status'] === 'ready') {
+                $this->dispatch('open-file-download', url: $result['url']);
+            } else {
+                $this->dispatch('error', $result['message']);
+            }
+        }
+        $this->pendingDownloads = array_values($this->pendingDownloads);
+    }
+
+    /**
+     * Reduce a client-supplied upload name to a single safe basename,
+     * stripping any directory traversal before it reaches the container.
+     */
+    protected function sanitizeUploadName(string $name): string
+    {
+        $name = basename(str_replace('\\', '/', $name));
+        if ($name === '' || preg_match('/^\.+$/', $name) === 1) {
+            throw new \RuntimeException('Invalid file name.');
+        }
+
+        return $name;
+    }
+
+    /**
+     * Map a filename to a Monaco language id for the editor. Falls back to
+     * well-known whole-file names so extension-less files still highlight.
+     */
+    protected function guessLanguage(string $name): string
+    {
+        $extMap = [
+            'js' => 'javascript', 'mjs' => 'javascript', 'cjs' => 'javascript', 'ts' => 'typescript',
+            'json' => 'json', 'php' => 'php', 'py' => 'python', 'rb' => 'ruby', 'go' => 'go',
+            'rs' => 'rust', 'java' => 'java', 'sh' => 'shell', 'bash' => 'shell', 'zsh' => 'shell',
+            'yml' => 'yaml', 'yaml' => 'yaml', 'toml' => 'ini', 'ini' => 'ini', 'env' => 'ini',
+            'conf' => 'ini', 'cnf' => 'ini', 'md' => 'markdown', 'markdown' => 'markdown', 'html' => 'html',
+            'htm' => 'html', 'xml' => 'xml', 'svg' => 'xml', 'css' => 'css', 'scss' => 'scss',
+            'sql' => 'sql', 'dockerfile' => 'dockerfile',
+        ];
+
+        $base = strtolower(basename($name));
+
+        // Whole-name matches for common extension-less/dotfiles.
+        $nameMap = [
+            'dockerfile' => 'dockerfile', 'containerfile' => 'dockerfile',
+            '.gitignore' => 'ini', '.dockerignore' => 'ini', '.editorconfig' => 'ini',
+            '.npmrc' => 'ini', '.gitconfig' => 'ini',
+            '.bashrc' => 'shell', '.bash_profile' => 'shell', '.bash_aliases' => 'shell',
+            '.profile' => 'shell', '.zshrc' => 'shell', '.zprofile' => 'shell',
+        ];
+        if (isset($nameMap[$base])) {
+            return $nameMap[$base];
+        }
+        if ($base === '.env' || str_starts_with($base, '.env.')) {
+            return 'ini';
+        }
+
+        $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
+
+        return $extMap[$ext] ?? '';
+    }
+
+    protected function childPath(string $name): string
+    {
+        if ($name === '' || $name === '.' || $name === '..' || str_contains($name, '/') || str_contains($name, '\\') || str_contains($name, "\0")) {
+            throw new \InvalidArgumentException('Invalid file name.');
+        }
+        validateShellSafePath($name, 'file name');
+
+        return rtrim($this->currentPath, '/').'/'.$name;
+    }
+
+    protected function authorizeFileAccess(): void
+    {
+        $this->authorize('canAccessTerminal');
+        $this->resource->refresh();
+        $this->authorize('view', $this->resource);
+        abort_unless((int) $this->resource->environment->project->team_id === (int) auth()->user()->currentTeam()->id, 403);
+    }
+
+    protected function guard(): void
+    {
+        $this->authorizeFileAccess();
+        $this->type = $this->resolveType($this->resource);
+        $this->containerRunning = (bool) $this->resource->isRunning();
+        $this->availableContainers = $this->containerRunning ? $this->resolveContainers() : [];
+        if (! $this->containerRunning || is_null($this->container) || ! in_array($this->container, $this->availableContainers, true)) {
+            throw new \RuntimeException('Container is not running.');
+        }
+    }
+
+    /**
+     * @return array<int, array{label:string,path:string}>
+     */
+    public function breadcrumbs(): array
+    {
+        $crumbs = [['label' => '/', 'path' => '/']];
+        $accumulated = '';
+        foreach (array_filter(explode('/', $this->currentPath)) as $segment) {
+            $accumulated .= '/'.$segment;
+            $crumbs[] = ['label' => $segment, 'path' => $accumulated];
+        }
+
+        return $crumbs;
+    }
+
+    protected function loadEntries(): void
+    {
+        $entries = $this->service()->list($this->currentPath);
+        $this->entries = array_map(fn ($e) => [
+            'name' => $e->name,
+            'type' => $e->type,
+            'size' => $e->size,
+            'mtime' => $e->mtime,
+            'perms' => $e->perms,
+            'owner' => $e->owner,
+            'group' => $e->group,
+        ], $entries);
+    }
+
+    protected function service(): ContainerFilesystemService
+    {
+        return new ContainerFilesystemService($this->server(), $this->container);
+    }
+
+    protected function server(): Server
+    {
+        return match ($this->type) {
+            'service' => $this->resource->server,
+            default => $this->resource->destination->server,
+        };
+    }
+
+    protected function resolveResourceFromRoute(): Model
+    {
+        $parameters = get_route_parameters();
+        $teamId = data_get(auth()->user()->currentTeam(), 'id');
+
+        if ($uuid = data_get($parameters, 'application_uuid')) {
+            return Application::ownedByCurrentTeam()->where('uuid', $uuid)->firstOrFail();
+        }
+        if ($uuid = data_get($parameters, 'service_uuid')) {
+            return Service::ownedByCurrentTeam()->where('uuid', $uuid)->firstOrFail();
+        }
+        if ($uuid = data_get($parameters, 'database_uuid')) {
+            $resource = getResourceByUuid($uuid, $teamId);
+            if (is_null($resource)) {
+                abort(404);
+            }
+
+            return $resource;
+        }
+
+        abort(404);
+    }
+
+    protected function resolveType(Model $resource): string
+    {
+        return match (true) {
+            $resource instanceof Application => 'application',
+            $resource instanceof Service => 'service',
+            default => 'database',
+        };
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    protected function resolveContainers(): array
+    {
+        if ($this->type === 'service') {
+            $names = [];
+            $this->resource->applications()->get()->each(function ($application) use (&$names) {
+                if ($application->isRunning()) {
+                    $names[] = $application->name.'-'.$this->resource->uuid;
+                }
+            });
+            $this->resource->databases()->get()->each(function ($database) use (&$names) {
+                if ($database->isRunning()) {
+                    $names[] = $database->name.'-'.$this->resource->uuid;
+                }
+            });
+
+            return array_values(array_filter($names, [ValidationPatterns::class, 'isValidContainerName']));
+        }
+
+        if ($this->type === 'application') {
+            $server = $this->server();
+            $names = getCurrentApplicationContainerStatus($server, $this->resource, includePullrequests: false)
+                ->filter(fn ($c) => data_get($c, 'State') === 'running')
+                ->map(fn ($c) => data_get($c, 'Names'))
+                ->filter()
+                ->values()
+                ->all();
+
+            return array_values(array_filter($names, [ValidationPatterns::class, 'isValidContainerName']));
+        }
+
+        // Standalone database: the container name is the resource uuid.
+        $name = $this->resource->uuid;
+
+        return ValidationPatterns::isValidContainerName($name) ? [$name] : [];
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.shared.file-browser');
+    }
+}
diff --git a/app/Livewire/Project/Shared/GetLogs.php b/app/Livewire/Project/Shared/GetLogs.php
index e809c1aae5..f9b15afac4 100644
--- a/app/Livewire/Project/Shared/GetLogs.php
+++ b/app/Livewire/Project/Shared/GetLogs.php
@@ -4,6 +4,7 @@ namespace App\Livewire\Project\Shared;
 
 use App\Helpers\SshMultiplexingHelper;
 use App\Models\Application;
+use App\Models\EnvironmentVariable;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -192,7 +193,7 @@ class GetLogs extends Component
 
         $options = "-n {$this->resolveLogTail()}".($this->showTimeStamps ? ' -t' : '');
 
-        return sanitizeLogsForExport($this->runLogCommand($this->logCommand($options), self::MAX_DISPLAY_SIZE_BYTES, '5MB', $this->showTimeStamps));
+        return sanitizeLogsForExport($this->runLogCommand($this->logCommand($options), self::MAX_DISPLAY_SIZE_BYTES, '5MB', $this->showTimeStamps), $this->logRedactionSecrets());
     }
 
     public function downloadAllLogs(): string
@@ -212,7 +213,19 @@ class GetLogs extends Component
 
         $command = $this->logCommand($this->showTimeStamps ? '-t' : '');
 
-        return sanitizeLogsForExport($this->runLogCommand($command, self::MAX_DOWNLOAD_SIZE_BYTES, '50MB', $this->showTimeStamps));
+        return sanitizeLogsForExport($this->runLogCommand($command, self::MAX_DOWNLOAD_SIZE_BYTES, '50MB', $this->showTimeStamps), $this->logRedactionSecrets());
+    }
+
+    /**
+     * Environment values and database credentials of the resource whose logs are exported.
+     *
+     * @return array{known: array<int, string>, locked: array<int, string>}
+     */
+    private function logRedactionSecrets(): array
+    {
+        $resource = $this->resource ?? $this->servicesubtype?->service;
+
+        return EnvironmentVariable::logRedactionSecretsFor($resource, includePreview: $resource instanceof Application && filled($this->pull_request));
     }
 
     private function resolveLogTail(): int|string
diff --git a/app/Livewire/Project/Shared/Maintenance.php b/app/Livewire/Project/Shared/Maintenance.php
new file mode 100644
index 0000000000..29c2263e5a
--- /dev/null
+++ b/app/Livewire/Project/Shared/Maintenance.php
@@ -0,0 +1,93 @@
+<?php
+
+namespace App\Livewire\Project\Shared;
+
+use App\Enums\ProxyTypes;
+use App\Models\Application;
+use App\Models\Server;
+use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+/**
+ * Maintenance mode of an application or service: the proxy shows a maintenance page with
+ * status 503 instead of the resource, and the containers keep running.
+ */
+class Maintenance extends Component
+{
+    use AuthorizesRequests;
+
+    public Application|Service $resource;
+
+    public bool $isMaintenanceEnabled = false;
+
+    public ?string $maintenancePage = null;
+
+    public function mount(): void
+    {
+        $this->isMaintenanceEnabled = (bool) $this->resource->is_maintenance_enabled;
+        $this->maintenancePage = $this->resource->maintenance_page;
+    }
+
+    /**
+     * Servers that run the resource with a supported proxy (Traefik or Caddy, not Swarm).
+     */
+    public function getIsSupportedProperty(): bool
+    {
+        return $this->resource->maintenanceServers()->contains(fn (Server $server) => ! $server->isSwarm()
+            && in_array($server->proxyType(), [ProxyTypes::TRAEFIK->value, ProxyTypes::CADDY->value], true));
+    }
+
+    public function instantSaveMaintenance(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+            $this->resource->is_maintenance_enabled = $this->isMaintenanceEnabled;
+            $this->resource->save();
+            $this->resource->syncMaintenancePage();
+            $this->dispatch('success', $this->isMaintenanceEnabled ? 'Maintenance mode enabled.' : 'Maintenance mode disabled.');
+        } catch (\Throwable $e) {
+            $this->isMaintenanceEnabled = (bool) $this->resource->fresh()?->is_maintenance_enabled;
+            handleError($e, $this);
+        }
+    }
+
+    public function submit(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+            $this->validate([
+                'maintenancePage' => ['nullable', 'string', proxyPageSizeRule('maintenance page')],
+            ]);
+            $this->resource->maintenance_page = filled($this->maintenancePage) ? $this->maintenancePage : null;
+            $this->resource->save();
+            if ($this->resource->is_maintenance_enabled) {
+                $this->resource->syncMaintenancePage();
+            }
+            $this->dispatch('success', 'Maintenance page saved.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function resetMaintenancePage(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+            $this->resource->maintenance_page = null;
+            $this->resource->save();
+            $this->maintenancePage = null;
+            if ($this->resource->is_maintenance_enabled) {
+                $this->resource->syncMaintenancePage();
+            }
+            $this->dispatch('success', 'Default maintenance page restored.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.project.shared.maintenance');
+    }
+}
diff --git a/app/Livewire/Project/Shared/ResourceOperations.php b/app/Livewire/Project/Shared/ResourceOperations.php
index 2b6f5b4587..a459b988e0 100644
--- a/app/Livewire/Project/Shared/ResourceOperations.php
+++ b/app/Livewire/Project/Shared/ResourceOperations.php
@@ -232,6 +232,7 @@ class ResourceOperations extends Component
                         'team_id' => $this->resourceTeamId(),
                     ]);
                     $newBackup->save();
+                    $backup->copyS3StoragesTo($newBackup);
                 }
 
                 $environmentVaribles = $this->resource->environment_variables()->get();
diff --git a/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php b/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php
index d936333a92..02f1718ede 100644
--- a/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php
+++ b/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php
@@ -65,7 +65,7 @@ abstract class ResourceTrafficAnalytics extends Component
     public array $series = [];
 
     /** @var array<int, string> */
-    protected array $breakdownDimensions = ['country', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
+    protected array $breakdownDimensions = ['country', 'city', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
 
     /**
      * Name of the public model property and lazy-load parameter ('application' / 'service').
diff --git a/app/Livewire/Project/Shared/ScheduledTask/All.php b/app/Livewire/Project/Shared/ScheduledTask/All.php
index b58e4f97a9..124c907210 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/All.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/All.php
@@ -2,13 +2,18 @@
 
 namespace App\Livewire\Project\Shared\ScheduledTask;
 
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\On;
+use Livewire\Attributes\Url;
 use Livewire\Component;
 
 class All extends Component
 {
+    use AuthorizesRequests;
+
     #[Locked]
     public $resource;
 
@@ -19,6 +24,18 @@ class All extends Component
 
     public ?string $variables = null;
 
+    #[Url(as: 'task_uuid', except: '')]
+    public string $taskUuid = '';
+
+    public bool $taskModalOpen = false;
+
+    public function getListeners(): array
+    {
+        return [
+            'modalClosed' => 'closeTask',
+        ];
+    }
+
     public function mount()
     {
         $this->parameters = get_route_parameters();
@@ -34,6 +51,30 @@ class All extends Component
                 $this->containerNames = collect([]);
             }
         }
+
+        if ($this->taskUuid !== '') {
+            $this->openTask($this->taskUuid);
+        }
+    }
+
+    public function openTask(string $taskUuid): void
+    {
+        $this->authorize('view', $this->resource);
+        $this->taskUuid = $this->resource->scheduled_tasks()->where('uuid', $taskUuid)->firstOrFail()->uuid;
+        $this->taskModalOpen = true;
+    }
+
+    public function closeTask(): void
+    {
+        $this->taskUuid = '';
+        $this->taskModalOpen = false;
+        $this->resource->refresh();
+    }
+
+    #[On('scheduledTaskDeleted')]
+    public function taskDeleted(): void
+    {
+        $this->closeTask();
     }
 
     #[On('refreshTasks')]
@@ -41,4 +82,13 @@ class All extends Component
     {
         $this->resource->refresh();
     }
+
+    public function render(): View
+    {
+        return view('livewire.project.shared.scheduled-task.all', [
+            'selectedTask' => $this->taskUuid === ''
+                ? null
+                : $this->resource->scheduled_tasks()->where('uuid', $this->taskUuid)->first(),
+        ]);
+    }
 }
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 35a0f12410..5f5689b5de 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -45,46 +45,13 @@ class Show extends Component
     #[Validate(['integer', 'required', 'min:60', 'max:36000'])]
     public $timeout = 300;
 
-    #[Locked]
-    public ?string $application_uuid;
-
-    #[Locked]
-    public ?string $service_uuid;
-
-    #[Locked]
-    public string $task_uuid;
-
-    public function mount()
+    public function mount(Application|Service $resource, ScheduledTask $task): void
     {
-        try {
-            $task_uuid = request()->route('task_uuid');
-            $project_uuid = request()->route('project_uuid');
-            $environment_uuid = request()->route('environment_uuid');
-            $application_uuid = request()->route('application_uuid');
-            $service_uuid = request()->route('service_uuid');
-
-            $this->task_uuid = $task_uuid;
-            if ($application_uuid) {
-                $this->type = 'application';
-                $this->application_uuid = $application_uuid;
-                $this->resource = Application::ownedByCurrentTeam()->where('uuid', $application_uuid)->firstOrFail();
-            } elseif ($service_uuid) {
-                $this->type = 'service';
-                $this->service_uuid = $service_uuid;
-                $this->resource = Service::ownedByCurrentTeamCached()->where('uuid', $service_uuid)->firstOrFail();
-            }
-            $this->parameters = [
-                'environment_uuid' => $environment_uuid,
-                'project_uuid' => $project_uuid,
-                'application_uuid' => $application_uuid,
-                'service_uuid' => $service_uuid,
-            ];
-
-            $this->task = $this->resource->scheduled_tasks()->where('uuid', $task_uuid)->firstOrFail();
-            $this->syncData();
-        } catch (\Exception $e) {
-            return handleError($e);
-        }
+        $this->resource = $resource;
+        $this->type = $resource->type();
+        $this->parameters = get_route_parameters();
+        $this->task = $resource->scheduled_tasks()->whereKey($task->id)->firstOrFail();
+        $this->syncData();
     }
 
     /**
@@ -178,10 +145,10 @@ class Show extends Component
             $this->authorize('delete', $this->task);
             $this->task->delete();
             auditLog('ui.scheduled_task.deleted', $this->taskAuditContext());
+            $this->dispatch('success', 'Scheduled task deleted.');
+            $this->dispatch('scheduledTaskDeleted')->to(All::class);
 
-            redirectRoute($this, "project.{$this->type}.scheduled-tasks.show", $this->parameters);
-
-            // Without true, the confirmation modal refreshes this deleted task while wire:navigate loads the list.
+            // Without true, the confirmation modal refreshes this deleted task.
             return true;
         } catch (\Exception $e) {
             return handleError($e);
diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index d741bcc0e4..bfa122d0e2 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -11,6 +11,9 @@ use App\Models\LocalPersistentVolume;
 use App\Models\S3Storage;
 use App\Models\ScheduledVolumeBackup;
 use App\Models\Service;
+use App\Traits\ListensToTeamChannel;
+use App\Traits\PreparesBackupDownloads;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Routing\Redirector;
@@ -23,6 +26,8 @@ use Throwable;
 class VolumeBackups extends Component
 {
     use AuthorizesRequests;
+    use ListensToTeamChannel;
+    use PreparesBackupDownloads;
     use WithPagination;
 
     public LocalPersistentVolume|LocalFileVolume $storage;
@@ -33,6 +38,9 @@ class VolumeBackups extends Component
 
     public string $section = 'general';
 
+    /** The page shows the backup actions in the top header bar instead. */
+    public bool $actionsInHeader = false;
+
     public string $frequency = 'daily';
 
     public bool $enabled = false;
@@ -43,7 +51,8 @@ class VolumeBackups extends Component
 
     public bool $stopDuringBackup = false;
 
-    public ?int $s3StorageId = null;
+    /** @var array<int, int|string> */
+    public array $s3StorageIds = [];
 
     public int $retentionAmountLocally = 7;
 
@@ -65,6 +74,15 @@ class VolumeBackups extends Component
 
     public int $perPage = 10;
 
+    public function getListeners(): array
+    {
+        if ($this->section !== 'executions') {
+            return [];
+        }
+
+        return $this->teamChannelListeners(['BackupCreated' => '$refresh']);
+    }
+
     public function updatedPerPage(): void
     {
         $this->perPage = max(1, min(100, $this->perPage));
@@ -88,7 +106,7 @@ class VolumeBackups extends Component
             'saveToS3' => ['required', 'boolean'],
             'disableLocalBackup' => ['required', 'boolean'],
             'stopDuringBackup' => ['required', 'boolean'],
-            's3StorageId' => ['nullable', 'integer'],
+            's3StorageIds' => ['array'],
             'retentionAmountLocally' => ['required', 'integer', 'min:0', 'max:10000'],
             'retentionDaysLocally' => ['required', 'integer', 'min:0'],
             'retentionMaxStorageLocally' => ['required', 'numeric', 'min:0'],
@@ -103,12 +121,8 @@ class VolumeBackups extends Component
     public function mount(): void
     {
         $this->authorize('view', $this->resource);
-        $this->availableS3Storages = S3Storage::query()
-            ->where('team_id', $this->resourceTeamId())
-            ->where('is_usable', true)
-            ->orderBy('name')
-            ->get();
         $this->backup = $this->storage->scheduledBackups()->first();
+        $this->availableS3Storages = $this->selectableS3Storages()->orderBy('name')->get();
         $server = $this->backup?->server() ?? data_get($this->resource, 'destination.server');
         $this->timezone = data_get($server, 'settings.server_timezone', 'Instance timezone');
 
@@ -118,7 +132,8 @@ class VolumeBackups extends Component
             $this->saveToS3 = $this->backup->save_s3;
             $this->disableLocalBackup = $this->backup->disable_local_backup;
             $this->stopDuringBackup = $this->backup->stop_during_backup;
-            $this->s3StorageId = $this->backup->s3_storage_id ?? $this->availableS3Storages->first()?->id;
+            $selectedIds = $this->backup->selectedS3Storages()->pluck('id');
+            $this->s3StorageIds = ($selectedIds->isNotEmpty() ? $selectedIds : $this->availableS3Storages->take(1)->pluck('id'))->all();
             $this->retentionAmountLocally = $this->backup->retention_amount_locally;
             $this->retentionDaysLocally = $this->backup->retention_days_locally;
             $this->retentionMaxStorageLocally = $this->backup->retention_max_storage_locally;
@@ -128,7 +143,7 @@ class VolumeBackups extends Component
             $this->timeout = $this->backup->timeout;
             $this->missingBackupNotificationDays = $this->backup->missing_backup_notification_days;
         } else {
-            $this->s3StorageId = $this->availableS3Storages->first()?->id;
+            $this->s3StorageIds = $this->availableS3Storages->take(1)->pluck('id')->all();
         }
     }
 
@@ -149,30 +164,24 @@ class VolumeBackups extends Component
         $this->save();
     }
 
-    public function updatedS3StorageId(): void
+    public function updatedS3StorageIds(): void
     {
         $this->authorize('update', $this->resource);
 
-        if (! $this->hasValidS3Storage()) {
-            $this->addError('s3StorageId', 'Select a usable S3 storage owned by your team.');
-
-            return;
-        }
-
-        $this->resetErrorBag('s3StorageId');
         if (! $this->validateSettings()) {
             return;
         }
 
+        $this->resetErrorBag('s3StorageIds');
         $this->backup = $this->persistBackup($this->enabled);
-        $this->dispatch('success', 'S3 storage updated.');
+        $this->dispatch('success', 'S3 storages updated.');
     }
 
     public function toggleS3(): void
     {
         $this->authorize('update', $this->resource);
 
-        if (! $this->saveToS3 && ! $this->hasValidS3Storage()) {
+        if (! $this->saveToS3 && $this->selectedS3StorageIds()->isEmpty()) {
             $this->dispatch('error', 'Select a usable S3 storage before enabling S3 backups.');
 
             return;
@@ -302,6 +311,7 @@ class VolumeBackups extends Component
                 ->where('s3_storage_deleted', true)
                 ->orWhereNull('s3_uploaded')
                 ->orWhere('s3_uploaded', false))
+            ->withoutLiveS3Copies()
             ->delete() ?? 0;
 
         $this->dispatch(
@@ -335,6 +345,28 @@ class VolumeBackups extends Component
         $this->dispatch('success', 'Backup recovery queued.');
     }
 
+    public function downloadBackup(int $executionId): void
+    {
+        $this->authorize('update', $this->resource);
+
+        $execution = $this->backup?->executions()->whereKey($executionId)->first();
+        if (! $execution) {
+            $this->dispatch('error', 'Backup execution not found.');
+
+            return;
+        }
+
+        try {
+            $this->prepareBackupDownload(
+                $execution->local_storage_deleted ? null : $this->backup->server(),
+                $execution->filename,
+                route('download.volume-backup', $execution->id),
+            );
+        } catch (Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function deleteBackup(int $executionId, string $password, array $selectedActions = []): bool|string
     {
         $this->authorize('update', $this->resource);
@@ -366,12 +398,8 @@ class VolumeBackups extends Component
                 deleteBackupsLocally($execution->filename, $server, throwError: true);
             }
 
-            if ($this->delete_backup_s3 && $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
-                if (! $execution->s3) {
-                    throw new \RuntimeException('The S3 storage is unavailable.');
-                }
-
-                deleteBackupsS3($execution->filename, $execution->s3);
+            if ($this->delete_backup_s3) {
+                $execution->deleteS3Copies();
             }
 
             $execution->delete();
@@ -388,11 +416,12 @@ class VolumeBackups extends Component
 
     public function render()
     {
-        $executions = $this->backup?->executions()->paginate($this->perPage);
+        $executions = $this->backup?->executions()->with('s3Replicas.s3')->paginate($this->perPage);
 
         return view('livewire.project.shared.storages.volume-backups', [
             'executions' => $executions ?? collect(),
             'latestExecution' => $this->backup?->executions()->first(),
+            's3Downloads' => $this->s3BackupDownloadsEnabled(),
             'deleteScheduleCheckboxes' => [
                 ['id' => 'delete_associated_backups_locally', 'label' => 'Delete all local archives created by this schedule.'],
                 ['id' => 'delete_associated_backups_s3', 'label' => 'Delete all S3 archives created by this schedule.'],
@@ -410,8 +439,8 @@ class VolumeBackups extends Component
             return false;
         }
 
-        if ($this->saveToS3 && ! $this->hasValidS3Storage()) {
-            $this->addError('s3StorageId', 'Select a usable S3 storage owned by your team.');
+        if ($this->saveToS3 && $this->selectedS3StorageIds()->isEmpty()) {
+            $this->addError('s3StorageIds', 'Select at least one usable S3 storage owned by your team.');
 
             return false;
         }
@@ -431,7 +460,6 @@ class VolumeBackups extends Component
             'save_s3' => $this->saveToS3,
             'disable_local_backup' => $this->disableLocalBackup,
             'stop_during_backup' => $this->stopDuringBackup,
-            's3_storage_id' => $this->hasValidS3Storage() ? $this->s3StorageId : $this->backup?->s3_storage_id,
             'retention_amount_locally' => $this->retentionAmountLocally,
             'retention_days_locally' => $this->retentionDaysLocally,
             'retention_max_storage_locally' => $this->retentionMaxStorageLocally,
@@ -443,6 +471,15 @@ class VolumeBackups extends Component
         ]);
         $changedFields = auditChangedFields($backup);
         $backup->save();
+
+        $storageIds = $this->selectedS3StorageIds();
+        $previousStorageIds = $backup->s3Storages()->pluck('s3_storages.id')->sort()->values()->all();
+        $backup->syncS3Storages($storageIds->all());
+        $this->s3StorageIds = $storageIds->all();
+        if (! $backup->wasRecentlyCreated && $previousStorageIds !== $storageIds->sort()->values()->all()) {
+            $changedFields[] = 's3_storages';
+        }
+
         $this->auditScheduleSet($backup, $changedFields);
 
         return $backup;
@@ -485,14 +522,33 @@ class VolumeBackups extends Component
         ];
     }
 
-    private function hasValidS3Storage(): bool
+    /**
+     * The submitted destinations that are selectable S3 storages of the resource's team. Others are dropped.
+     *
+     * @return Collection<int, int>
+     */
+    private function selectedS3StorageIds(): Collection
     {
-        return $this->s3StorageId !== null
-            && S3Storage::query()
-                ->whereKey($this->s3StorageId)
-                ->where('team_id', $this->resourceTeamId())
-                ->where('is_usable', true)
-                ->exists();
+        $submittedIds = collect($this->s3StorageIds)->map(fn ($id): int => (int) $id)->filter()->unique();
+
+        return $this->selectableS3Storages()
+            ->whereKey($submittedIds->all())
+            ->pluck('id')
+            ->sortBy(fn (int $id): int|false => $submittedIds->search($id))
+            ->values();
+    }
+
+    /**
+     * Usable storages of the resource's team, plus the current destinations. A destination that is unusable for a
+     * while stays selected, so saving other settings does not remove it.
+     */
+    private function selectableS3Storages(): Builder
+    {
+        $selectedIds = $this->backup?->selectedS3Storages()->pluck('id')->all() ?? [];
+
+        return S3Storage::query()
+            ->where('team_id', $this->resourceTeamId())
+            ->where(fn (Builder $query) => $query->where('is_usable', true)->orWhereIn('id', $selectedIds));
     }
 
     private function resourceTeamId(): int
diff --git a/app/Livewire/Project/Shared/Tags.php b/app/Livewire/Project/Shared/Tags.php
index 9305d20a63..99daee1b7f 100644
--- a/app/Livewire/Project/Shared/Tags.php
+++ b/app/Livewire/Project/Shared/Tags.php
@@ -88,11 +88,10 @@ class Tags extends Component
     {
         try {
             $this->authorize('update', $this->resource);
+            // The tag stays, also without resources. Delete it on the Tags page.
             $this->resource->tags()->detach($id);
-            $found_more_tags = $this->resourceTags()->find($id);
-            $found_more_tags?->deleteIfOrphaned();
             $this->refresh();
-            $this->dispatch('success', 'Tag deleted.');
+            $this->dispatch('success', 'Tag removed.');
         } catch (\Exception $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Shared/Terminal.php b/app/Livewire/Project/Shared/Terminal.php
index 01a89b721a..daa6754480 100644
--- a/app/Livewire/Project/Shared/Terminal.php
+++ b/app/Livewire/Project/Shared/Terminal.php
@@ -34,14 +34,33 @@ class Terminal extends Component
 
     public string $variant = 'default';
 
+    /**
+     * Whether the selected container can be attached to (its main process keeps stdin open).
+     */
+    public bool $attachAvailable = false;
+
+    /**
+     * Active terminal mode: 'shell' (docker exec) or 'attach' (docker attach).
+     */
+    public string $terminalMode = 'shell';
+
+    // Remembered target so the mode switch can reconnect without re-selecting a container.
+    public bool $currentIsContainer = false;
+
+    public ?string $currentIdentifier = null;
+
+    public ?string $currentServerUuid = null;
+
     private function checkShellAvailability(Server $server, string $container): bool
     {
         $escapedContainer = escapeshellarg($container);
+        // Non-root SSH users need sudo to reach the Docker socket.
+        $sudo = $server->isNonRoot() ? 'sudo ' : '';
         try {
             instant_remote_process([
-                "docker exec {$escapedContainer} bash -c 'exit 0' 2>/dev/null || ".
-                "docker exec {$escapedContainer} sh -c 'exit 0' 2>/dev/null",
-            ], $server);
+                "{$sudo}docker exec {$escapedContainer} bash -c 'exit 0' 2>/dev/null || ".
+                "{$sudo}docker exec {$escapedContainer} sh -c 'exit 0' 2>/dev/null",
+            ], $server, no_sudo: true);
 
             return true;
         } catch (Throwable) {
@@ -49,8 +68,40 @@ class Terminal extends Component
         }
     }
 
+    private function containerKeepsStdinOpen(Server $server, string $container): bool
+    {
+        $escapedContainer = escapeshellarg($container);
+        // Non-root SSH users need sudo to reach the Docker socket.
+        $sudo = $server->isNonRoot() ? 'sudo ' : '';
+        try {
+            $output = instant_remote_process([
+                "{$sudo}docker inspect --format '{{.Config.OpenStdin}}' {$escapedContainer} 2>/dev/null",
+            ], $server, false, no_sudo: true);
+
+            return is_string($output) && str_starts_with(trim($output), 'true');
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * Resolve the effective terminal mode. Falls back to shell whenever attach is not available.
+     */
+    public function resolveMode(?string $requestedMode): string
+    {
+        if ($requestedMode === 'attach') {
+            return $this->attachAvailable ? 'attach' : 'shell';
+        }
+
+        if ($requestedMode === 'shell') {
+            return 'shell';
+        }
+
+        return $this->attachAvailable ? 'attach' : 'shell';
+    }
+
     #[On('send-terminal-command')]
-    public function sendTerminalCommand($isContainer, $identifier, $serverUuid, TerminalSessionService $terminalSessionService): void
+    public function sendTerminalCommand($isContainer, $identifier, $serverUuid, ?string $requestedMode = null): void
     {
         try {
             $this->authorize('canAccessTerminal');
@@ -69,6 +120,11 @@ class Terminal extends Component
             return;
         }
 
+        // Remember the target so the mode switch can reconnect without re-selecting.
+        $this->currentIsContainer = (bool) $isContainer;
+        $this->currentIdentifier = $identifier;
+        $this->currentServerUuid = $serverUuid;
+
         if ($isContainer) {
             // Validate container identifier format (alphanumeric, dashes, and underscores only)
             if (! is_string($identifier) || ! ValidationPatterns::isValidContainerName($identifier)) {
@@ -77,7 +133,7 @@ class Terminal extends Component
                 return;
             }
 
-            // Verify container exists and belongs to the user's team
+            // Verify the container is running on the authorized server
             $status = getContainerStatus($server, $identifier);
             if ($status !== 'running') {
                 $this->failTerminalSession('The container is not running.');
@@ -85,16 +141,25 @@ class Terminal extends Component
                 return;
             }
 
-            // Check shell availability
+            // Check shell availability and whether the container can be attached to.
             $this->hasShell = $this->checkShellAvailability($server, $identifier);
-            if (! $this->hasShell) {
+            $this->attachAvailable = $this->containerKeepsStdinOpen($server, $identifier);
+
+            $mode = $this->resolveMode($requestedMode);
+            $this->terminalMode = $mode;
+
+            // Shell mode needs a shell; console (attach) mode does not.
+            if ($mode === 'shell' && ! $this->hasShell) {
                 $this->failTerminalSession('No shell is available in this container.');
 
                 return;
             }
+        } else {
+            $this->attachAvailable = false;
+            $mode = $this->terminalMode = 'shell';
         }
 
-        $token = $terminalSessionService->issue(auth()->user(), $server, $isContainer ? $identifier : null);
+        $token = app(TerminalSessionService::class)->issue(auth()->user(), $server, $isContainer ? $identifier : null, $mode);
         $this->dispatch('send-terminal-token', $token);
     }
 
@@ -120,6 +185,23 @@ class Terminal extends Component
         $this->dispatch(self::SESSION_FAILED_EVENT, message: $message)->self();
     }
 
+    /**
+     * Switch between shell and console (attach) mode and reconnect to the current container.
+     */
+    #[On('set-terminal-mode')]
+    public function setMode(string $mode): void
+    {
+        if (! in_array($mode, ['shell', 'attach'], true)) {
+            return;
+        }
+
+        if (! $this->currentIsContainer || $this->currentIdentifier === null || $this->currentServerUuid === null) {
+            return;
+        }
+
+        $this->sendTerminalCommand(true, $this->currentIdentifier, $this->currentServerUuid, $mode);
+    }
+
     #[On('terminalConnected')]
     public function markTerminalConnected(): void
     {
diff --git a/app/Livewire/Project/Show.php b/app/Livewire/Project/Show.php
index ee73e72f93..a055904d51 100644
--- a/app/Livewire/Project/Show.php
+++ b/app/Livewire/Project/Show.php
@@ -2,9 +2,10 @@
 
 namespace App\Livewire\Project;
 
+use App\Livewire\Concerns\CreatesEnvironments;
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Environment;
 use App\Models\Project;
-use App\Support\ValidationPatterns;
 use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -12,26 +13,11 @@ use Livewire\Component;
 class Show extends Component
 {
     use AuthorizesRequests;
+    use CreatesEnvironments;
+    use RemembersCanvasView;
 
     public Project $project;
 
-    public string $name;
-
-    public ?string $description = null;
-
-    protected function rules(): array
-    {
-        return [
-            'name' => ValidationPatterns::nameRules(),
-            'description' => ValidationPatterns::descriptionRules(),
-        ];
-    }
-
-    protected function messages(): array
-    {
-        return ValidationPatterns::combinedMessages();
-    }
-
     public function mount(string $project_uuid)
     {
         try {
@@ -55,31 +41,15 @@ class Show extends Component
                         ->orderBy('created_at'),
                 ])
                 ->firstOrFail();
+
+            if ($this->prefersCanvasView('project')) {
+                return $this->redirectRoute('project.canvas', ['project_uuid' => $this->project->uuid], navigate: true);
+            }
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
     }
 
-    public function submit()
-    {
-        try {
-            $this->authorize('update', $this->project);
-            $this->validate();
-            $environment = Environment::create([
-                'name' => $this->name,
-                'project_id' => $this->project->id,
-                'uuid' => new_public_id(),
-            ]);
-
-            return redirectRoute($this, 'project.resource.index', [
-                'project_uuid' => $this->project->uuid,
-                'environment_uuid' => $environment->uuid,
-            ]);
-        } catch (\Throwable $e) {
-            handleError($e, $this);
-        }
-    }
-
     public function navigateToEnvironment($projectUuid, $environmentUuid)
     {
         return redirectRoute($this, 'project.resource.index', [
diff --git a/app/Livewire/Security/CloudProviderToken/Show.php b/app/Livewire/Security/CloudProviderToken/Show.php
index d8006f7740..f2389628bd 100644
--- a/app/Livewire/Security/CloudProviderToken/Show.php
+++ b/app/Livewire/Security/CloudProviderToken/Show.php
@@ -85,6 +85,7 @@ class Show extends Component
             'hetzner' => $this->validateHetznerToken($this->cloudProviderToken->token),
             'digitalocean' => $this->validateDigitalOceanToken($this->cloudProviderToken->token),
             'vultr' => $this->validateVultrToken($this->cloudProviderToken->token),
+            'hostinger' => $this->validateHostingerToken($this->cloudProviderToken->token),
             default => false,
         };
 
@@ -141,6 +142,7 @@ class Show extends Component
         return match ($this->cloudProviderToken->provider) {
             'digitalocean' => 'DigitalOcean',
             'vultr' => 'Vultr',
+            'hostinger' => 'Hostinger',
             default => 'Hetzner',
         };
     }
@@ -181,6 +183,19 @@ class Show extends Component
         }
     }
 
+    private function validateHostingerToken(string $token): bool
+    {
+        try {
+            return Http::withToken($token)
+                ->acceptJson()
+                ->timeout(10)
+                ->get('https://developers.hostinger.com/api/vps/v1/virtual-machines')
+                ->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
     public function render()
     {
         return view('livewire.security.cloud-provider-token.show');
diff --git a/app/Livewire/Security/CloudProviderTokenForm.php b/app/Livewire/Security/CloudProviderTokenForm.php
index 2c31d22035..4bdf3f5f3a 100644
--- a/app/Livewire/Security/CloudProviderTokenForm.php
+++ b/app/Livewire/Security/CloudProviderTokenForm.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Security;
 use App\Livewire\Server\CloudProviderToken\Show as ServerCloudProviderTokenShow;
 use App\Livewire\Server\New\ByDigitalOcean;
 use App\Livewire\Server\New\ByHetzner;
+use App\Livewire\Server\New\ByHostinger;
 use App\Models\CloudProviderToken;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Http;
@@ -41,7 +42,7 @@ class CloudProviderTokenForm extends Component
     protected function rules(): array
     {
         return [
-            'provider' => 'required|string|in:hetzner,digitalocean,vultr',
+            'provider' => 'required|string|in:hetzner,digitalocean,vultr,hostinger',
             'token' => 'required|string',
             'name' => 'required|string|max:255',
             'description' => 'nullable|string|max:1000',
@@ -86,6 +87,15 @@ class CloudProviderTokenForm extends Component
                 return $response->successful();
             }
 
+            if ($provider === 'hostinger') {
+                $response = Http::withToken($token)
+                    ->acceptJson()
+                    ->timeout(10)
+                    ->get('https://developers.hostinger.com/api/vps/v1/virtual-machines');
+
+                return $response->successful();
+            }
+
             return false;
         } catch (\Throwable $e) {
             return false;
@@ -128,6 +138,7 @@ class CloudProviderTokenForm extends Component
 
             if ($savedToken->provider === 'digitalocean') {
                 $this->dispatch('tokenAdded.digitalocean', tokenId: $savedToken->id)->to(ByDigitalOcean::class);
+                $this->dispatch('tokenAdded.digitalocean', tokenId: $savedToken->id)->to(ServerCloudProviderTokenShow::class);
             }
 
             if ($savedToken->provider === 'hetzner') {
@@ -135,6 +146,11 @@ class CloudProviderTokenForm extends Component
                 $this->dispatch('tokenAdded.hetzner', tokenId: $savedToken->id)->to(ServerCloudProviderTokenShow::class);
             }
 
+            if ($savedToken->provider === 'hostinger') {
+                $this->dispatch('tokenAdded.hostinger', tokenId: $savedToken->id)->to(ByHostinger::class);
+                $this->dispatch('tokenAdded.hostinger', tokenId: $savedToken->id)->to(ServerCloudProviderTokenShow::class);
+            }
+
             if ($this->modal_mode) {
                 $this->dispatch('close-modal');
             }
diff --git a/app/Livewire/Security/CloudProviderTokens.php b/app/Livewire/Security/CloudProviderTokens.php
index d16c729fca..549576ff6f 100644
--- a/app/Livewire/Security/CloudProviderTokens.php
+++ b/app/Livewire/Security/CloudProviderTokens.php
@@ -59,6 +59,13 @@ class CloudProviderTokens extends Component
                 } else {
                     $this->dispatch('error', 'Vultr token validation failed. Please check the token.');
                 }
+            } elseif ($token->provider === 'hostinger') {
+                $isValid = $this->validateHostingerToken($token->token);
+                if ($isValid) {
+                    $this->dispatch('success', 'Hostinger token is valid.');
+                } else {
+                    $this->dispatch('error', 'Hostinger token validation failed. Please check the token.');
+                }
             } else {
                 $this->dispatch('error', 'Unknown provider.');
             }
@@ -114,6 +121,19 @@ class CloudProviderTokens extends Component
         }
     }
 
+    private function validateHostingerToken(string $token): bool
+    {
+        try {
+            return Http::withToken($token)
+                ->acceptJson()
+                ->timeout(10)
+                ->get('https://developers.hostinger.com/api/vps/v1/virtual-machines')
+                ->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
     public function deleteToken(int $tokenId)
     {
         try {
diff --git a/app/Livewire/Security/IntegrationTokenEditor.php b/app/Livewire/Security/IntegrationTokenEditor.php
index 16a7f0ad9b..6a4c7ce2e6 100644
--- a/app/Livewire/Security/IntegrationTokenEditor.php
+++ b/app/Livewire/Security/IntegrationTokenEditor.php
@@ -48,15 +48,27 @@ class IntegrationTokenEditor extends Component
         $this->proxiedDns = $this->integrationToken->proxiedDnsEnabled();
     }
 
+    /**
+     * Cloudflare Tunnel setup also writes DNS records, so selecting `tunnel` also selects `dns`.
+     */
+    public function updatedCapabilities(): void
+    {
+        if (in_array('tunnel', $this->capabilities, true) && ! in_array('dns', $this->capabilities, true)) {
+            $this->capabilities[] = 'dns';
+        }
+    }
+
     protected function rules(): array
     {
-        $allowedCapability = $this->integrationToken->provider === 'cloudflare' ? 'dns' : 'secrets';
-
         $rules = [
             'name' => ['required', 'string', 'max:255'],
             'newToken' => ['nullable', 'string'],
-            'capabilities' => ['required', 'array', 'min:1'],
-            'capabilities.*' => ['required', 'in:'.$allowedCapability],
+            'capabilities' => ['required', 'array', 'min:1', function (string $attribute, mixed $value, \Closure $fail): void {
+                if (is_array($value) && in_array('tunnel', $value, true) && ! in_array('dns', $value, true)) {
+                    $fail('Cloudflare Tunnel also needs the DNS capability.');
+                }
+            }],
+            'capabilities.*' => ['required', 'in:'.implode(',', IntegrationToken::allowedCapabilities($this->integrationToken->provider))],
             'automaticDns' => ['boolean'],
             'proxiedDns' => ['boolean'],
         ];
diff --git a/app/Livewire/Security/IntegrationTokenForm.php b/app/Livewire/Security/IntegrationTokenForm.php
index 3cfbc75aa7..54ce0b704e 100644
--- a/app/Livewire/Security/IntegrationTokenForm.php
+++ b/app/Livewire/Security/IntegrationTokenForm.php
@@ -49,16 +49,28 @@ class IntegrationTokenForm extends Component
         }
     }
 
+    /**
+     * Cloudflare Tunnel setup also writes DNS records, so selecting `tunnel` also selects `dns`.
+     */
+    public function updatedCapabilities(): void
+    {
+        if (in_array('tunnel', $this->capabilities, true) && ! in_array('dns', $this->capabilities, true)) {
+            $this->capabilities[] = 'dns';
+        }
+    }
+
     protected function rules(): array
     {
-        $allowedCapability = $this->provider === 'cloudflare' ? 'dns' : 'secrets';
-
         $rules = [
             'provider' => ['required', 'in:'.implode(',', array_keys(IntegrationToken::PROVIDER_NAMES))],
             'name' => ['required', 'string', 'max:255'],
             'token' => ['required', 'string'],
-            'capabilities' => ['required', 'array', 'min:1'],
-            'capabilities.*' => ['required', 'in:'.$allowedCapability],
+            'capabilities' => ['required', 'array', 'min:1', function (string $attribute, mixed $value, \Closure $fail): void {
+                if (is_array($value) && in_array('tunnel', $value, true) && ! in_array('dns', $value, true)) {
+                    $fail('Cloudflare Tunnel also needs the DNS capability.');
+                }
+            }],
+            'capabilities.*' => ['required', 'in:'.implode(',', IntegrationToken::allowedCapabilities($this->provider))],
             'automaticDns' => ['boolean'],
             'proxiedDns' => ['boolean'],
         ];
@@ -129,7 +141,7 @@ class IntegrationTokenForm extends Component
             ]);
 
             $this->reset(['name', 'token']);
-            $this->dispatch('integrationTokenAdded')->to(IntegrationTokens::class);
+            $this->dispatch('integrationTokenAdded');
 
             if ($this->modal_mode) {
                 $this->dispatch('close-modal');
diff --git a/app/Livewire/Security/IntegrationTokens.php b/app/Livewire/Security/IntegrationTokens.php
index 34b2b38a07..0b02593726 100644
--- a/app/Livewire/Security/IntegrationTokens.php
+++ b/app/Livewire/Security/IntegrationTokens.php
@@ -20,6 +20,7 @@ class IntegrationTokens extends Component
     }
 
     #[On('integrationTokenAdded')]
+    #[On('integration-token-deleted')]
     public function loadTokens(): void
     {
         $this->tokens = IntegrationToken::ownedByCurrentTeam()->withCount('dnsZones')->latest()->get();
diff --git a/app/Livewire/Server/Canvas.php b/app/Livewire/Server/Canvas.php
new file mode 100644
index 0000000000..dd5c64fb46
--- /dev/null
+++ b/app/Livewire/Server/Canvas.php
@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Livewire\Server;
+
+use App\Livewire\Concerns\RemembersCanvasView;
+use App\Models\Server;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+/**
+ * Read-only canvas of all servers (or one server) with their resources.
+ * The page is a shell: resources/js/environment-canvas.js renders it from
+ * Api\ServerCanvasController at /canvas/api with the browser session.
+ */
+class Canvas extends Component
+{
+    use AuthorizesRequests;
+    use RemembersCanvasView;
+
+    #[Locked]
+    public ?Server $server = null;
+
+    /** The team that owned the page at mount; the canvas API calls use it, not the session team. */
+    #[Locked]
+    public int $teamId;
+
+    public function mount(?string $server_uuid = null): void
+    {
+        if ($server_uuid !== null) {
+            $this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
+            $this->authorize('view', $this->server);
+            $this->teamId = $this->server->team_id;
+            $this->rememberView('server_resources', 'canvas');
+        } else {
+            $this->teamId = currentTeam()->id;
+            $this->rememberView('servers', 'canvas');
+        }
+    }
+
+    public function render(): View
+    {
+        return view('livewire.server.canvas')->layout('layouts.app', ['fullBleed' => true]);
+    }
+}
diff --git a/app/Livewire/Server/Charts.php b/app/Livewire/Server/Charts.php
index c77662315a..6ff1f682fa 100644
--- a/app/Livewire/Server/Charts.php
+++ b/app/Livewire/Server/Charts.php
@@ -104,15 +104,37 @@ class Charts extends Component
         try {
             $cpuMetrics = $this->server->getCpuMetrics($this->interval);
             $memoryMetrics = $this->server->getMemoryMetrics($this->interval);
+            // Disk/network/load arrived in a later Sentinel; fetch each optionally so an
+            // older Sentinel (which 404s them) still shows CPU and memory.
+            $diskMetrics = $this->optionalMetric(fn () => $this->server->getDiskMetrics($this->interval));
+            $loadMetrics = $this->optionalMetric(fn () => $this->server->getLoadMetrics($this->interval));
+            $networkMetrics = $this->optionalMetric(fn () => $this->server->getNetworkMetrics($this->interval)) ?? [];
             $this->dispatch("refreshChartData-{$this->chartId}-metrics", [
                 'cpuSeries' => $cpuMetrics,
                 'memorySeries' => $memoryMetrics,
+                'diskSeries' => $diskMetrics,
+                'loadSeries' => $loadMetrics,
+                'networkRxSeries' => $networkMetrics['rx'] ?? [],
+                'networkTxSeries' => $networkMetrics['tx'] ?? [],
             ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
     }
 
+    /**
+     * Fetch a metric that may not exist on an older Sentinel; a failure yields null
+     * rather than breaking the whole chart refresh.
+     */
+    private function optionalMetric(callable $fetch): mixed
+    {
+        try {
+            return $fetch();
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+
     /**
      * Metrics settings belong to Sentinel, so they use the same event as the Sentinel page and API.
      *
diff --git a/app/Livewire/Server/CloudProviderToken/Show.php b/app/Livewire/Server/CloudProviderToken/Show.php
index e8216d0549..9d27340013 100644
--- a/app/Livewire/Server/CloudProviderToken/Show.php
+++ b/app/Livewire/Server/CloudProviderToken/Show.php
@@ -36,13 +36,25 @@ class Show extends Component
     {
         return [
             'tokenAdded.hetzner' => 'handleTokenAdded',
+            'tokenAdded.digitalocean' => 'handleTokenAdded',
+            'tokenAdded.hostinger' => 'handleTokenAdded',
         ];
     }
 
     public function loadTokens()
     {
-        $this->provider = $this->server->vultr_instance_id ? 'vultr' : 'hetzner';
-        $this->providerName = $this->provider === 'vultr' ? 'Vultr' : 'Hetzner';
+        $this->provider = match (true) {
+            filled($this->server->vultr_instance_id) => 'vultr',
+            filled($this->server->digitalocean_droplet_id) => 'digitalocean',
+            filled($this->server->hostinger_virtual_machine_id) => 'hostinger',
+            default => 'hetzner',
+        };
+        $this->providerName = match ($this->provider) {
+            'vultr' => 'Vultr',
+            'digitalocean' => 'DigitalOcean',
+            'hostinger' => 'Hostinger',
+            default => 'Hetzner',
+        };
 
         $this->cloudProviderTokens = CloudProviderToken::where('team_id', $this->server->team_id)
             ->where('provider', $this->provider)
@@ -96,9 +108,7 @@ class Show extends Component
     private function validateTokenForServer(CloudProviderToken $token): array
     {
         try {
-            $endpoint = $token->provider === 'vultr'
-                ? 'https://api.vultr.com/v2/account'
-                : 'https://api.hetzner.cloud/v1/servers';
+            $endpoint = $this->validationEndpoint($token->provider);
 
             $response = Http::withHeaders([
                 'Authorization' => 'Bearer '.$token->token,
@@ -137,6 +147,33 @@ class Show extends Component
                 }
             }
 
+            if ($this->server->digitalocean_droplet_id) {
+                $serverResponse = Http::withToken($token->token)
+                    ->timeout(10)
+                    ->get("https://api.digitalocean.com/v2/droplets/{$this->server->digitalocean_droplet_id}");
+
+                if (! $serverResponse->successful()) {
+                    return [
+                        'valid' => false,
+                        'error' => 'This token cannot access this droplet. It may belong to a different DigitalOcean account.',
+                    ];
+                }
+            }
+
+            if ($this->server->hostinger_virtual_machine_id) {
+                $serverResponse = Http::withToken($token->token)
+                    ->acceptJson()
+                    ->timeout(10)
+                    ->get("https://developers.hostinger.com/api/vps/v1/virtual-machines/{$this->server->hostinger_virtual_machine_id}");
+
+                if (! $serverResponse->successful()) {
+                    return [
+                        'valid' => false,
+                        'error' => 'This token cannot access this VPS. It may belong to a different Hostinger account.',
+                    ];
+                }
+            }
+
             return ['valid' => true];
         } catch (\Throwable $e) {
             return [
@@ -156,9 +193,7 @@ class Show extends Component
                 return;
             }
 
-            $endpoint = $token->provider === 'vultr'
-                ? 'https://api.vultr.com/v2/account'
-                : 'https://api.hetzner.cloud/v1/servers';
+            $endpoint = $this->validationEndpoint($token->provider);
 
             $response = Http::withHeaders([
                 'Authorization' => 'Bearer '.$token->token,
@@ -184,6 +219,16 @@ class Show extends Component
         }
     }
 
+    private function validationEndpoint(string $provider): string
+    {
+        return match ($provider) {
+            'vultr' => 'https://api.vultr.com/v2/account',
+            'digitalocean' => 'https://api.digitalocean.com/v2/account',
+            'hostinger' => 'https://developers.hostinger.com/api/vps/v1/virtual-machines',
+            default => 'https://api.hetzner.cloud/v1/servers',
+        };
+    }
+
     public function render()
     {
         return view('livewire.server.cloud-provider-token.show');
diff --git a/app/Livewire/Server/CloudflareTunnel.php b/app/Livewire/Server/CloudflareTunnel.php
index bf0172a6d9..31bca417f6 100644
--- a/app/Livewire/Server/CloudflareTunnel.php
+++ b/app/Livewire/Server/CloudflareTunnel.php
@@ -4,9 +4,17 @@ namespace App\Livewire\Server;
 
 use App\Actions\Server\ConfigureCloudflared;
 use App\Actions\Server\UpdateCloudflared;
+use App\Exceptions\DnsRecordConflictException;
+use App\Models\IntegrationToken;
 use App\Models\Server;
+use App\Rules\ValidHostname;
+use App\Services\CloudflareTunnelService;
 use App\Traits\ListensToTeamChannel;
+use Illuminate\Contracts\Cache\LockTimeoutException;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
+use Livewire\Attributes\On;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
@@ -26,6 +34,18 @@ class CloudflareTunnel extends Component
     #[Validate(['required', 'boolean'])]
     public bool $isCloudflareTunnelsEnabled;
 
+    public ?int $cloudflare_integration_token_id = null;
+
+    public string $api_ssh_domain = '';
+
+    /**
+     * An existing DNS record on the hostname that blocks the tunnel CNAME, waiting for the user to confirm its replacement.
+     *
+     * @var array{record_id: string, current: string, hostname: string, token_id: int}|null
+     */
+    #[Locked]
+    public ?array $dnsConflict = null;
+
     public function getListeners()
     {
         return $this->teamChannelListeners([
@@ -33,6 +53,18 @@ class CloudflareTunnel extends Component
         ]);
     }
 
+    /**
+     * Selects the token that the user just added from this page, when it is the only one that can manage tunnels.
+     */
+    #[On('integrationTokenAdded')]
+    public function selectAddedToken(): void
+    {
+        $tunnelTokens = $this->tunnelTokens();
+        if ($this->cloudflare_integration_token_id === null && $tunnelTokens->count() === 1) {
+            $this->cloudflare_integration_token_id = $tunnelTokens->first()->id;
+        }
+    }
+
     public function refresh()
     {
         $this->server->refresh();
@@ -52,11 +84,17 @@ class CloudflareTunnel extends Component
         }
     }
 
-    public function toggleCloudflareTunnels()
+    public function toggleCloudflareTunnels(CloudflareTunnelService $tunnels)
     {
         try {
             $this->authorize('update', $this->server);
-            remote_process(['docker rm -f coolify-cloudflared'], $this->server, false, 10);
+            if (filled($this->server->settings->cloudflare_tunnel_id)) {
+                foreach ($tunnels->tearDown($this->server) as $warning) {
+                    $this->dispatch('warning', $warning);
+                }
+            } else {
+                remote_process(['docker rm -f coolify-cloudflared'], $this->server, false, 10);
+            }
             $this->isCloudflareTunnelsEnabled = false;
             $this->server->settings->is_cloudflare_tunnel = false;
             $this->server->settings->save();
@@ -91,10 +129,7 @@ class CloudflareTunnel extends Component
     {
         try {
             $this->authorize('update', $this->server);
-            if (str($this->ssh_domain)->contains('https://')) {
-                $this->ssh_domain = str($this->ssh_domain)->replace('https://', '')->replace('http://', '')->trim();
-                $this->ssh_domain = str($this->ssh_domain)->replace('/', '');
-            }
+            $this->ssh_domain = $this->normalizeSshDomain($this->ssh_domain);
             $activity = ConfigureCloudflared::run($this->server, $this->cloudflare_token, $this->ssh_domain);
             auditLog('ui.server.cloudflare_tunnel.configuration_started', $this->auditContext([
                 'ssh_domain' => (string) $this->ssh_domain,
@@ -118,9 +153,101 @@ class CloudflareTunnel extends Component
         }
     }
 
+    public function apiCloudflareConfig(CloudflareTunnelService $tunnels): void
+    {
+        $this->authorize('update', $this->server);
+        $this->api_ssh_domain = $this->normalizeSshDomain($this->api_ssh_domain);
+        $this->validate([
+            'cloudflare_integration_token_id' => ['required', 'integer'],
+            'api_ssh_domain' => ['required', 'string', new ValidHostname],
+        ], [], ['cloudflare_integration_token_id' => 'Cloudflare token', 'api_ssh_domain' => 'SSH hostname']);
+
+        $token = $this->tunnelTokens()->firstWhere('id', $this->cloudflare_integration_token_id);
+        if ($token === null) {
+            $this->addError('cloudflare_integration_token_id', 'Select a Cloudflare token of this server team with the Cloudflare Tunnel capability.');
+
+            return;
+        }
+
+        $this->dnsConflict = null;
+        $this->startApiSetup($tunnels, $token, $this->api_ssh_domain);
+    }
+
+    public function replaceDnsAndConfigure(CloudflareTunnelService $tunnels): void
+    {
+        $this->authorize('update', $this->server);
+        $conflict = $this->dnsConflict;
+        $token = $conflict === null ? null : $this->tunnelTokens()->firstWhere('id', $conflict['token_id']);
+        if ($conflict === null || $token === null) {
+            $this->dnsConflict = null;
+            $this->dispatch('error', 'The DNS conflict is no longer available. Set up the tunnel again.');
+
+            return;
+        }
+
+        $this->dnsConflict = null;
+        $this->startApiSetup($tunnels, $token, $conflict['hostname'], $conflict);
+    }
+
     public function render()
     {
-        return view('livewire.server.cloudflare-tunnel');
+        $cloudflareTokens = IntegrationToken::query()
+            ->where('team_id', $this->server->team_id)
+            ->where('provider', 'cloudflare')
+            ->count();
+
+        return view('livewire.server.cloudflare-tunnel', [
+            'tunnelTokens' => $this->tunnelTokens(),
+            'hasCloudflareTokens' => $cloudflareTokens > 0,
+        ]);
+    }
+
+    /**
+     * Cloudflare tokens of the server's team (not the session team) that can manage tunnels.
+     *
+     * @return Collection<int, IntegrationToken>
+     */
+    private function tunnelTokens(): Collection
+    {
+        return IntegrationToken::query()
+            ->where('team_id', $this->server->team_id)
+            ->where('provider', 'cloudflare')
+            ->orderBy('name')
+            ->get()
+            ->filter(fn (IntegrationToken $token): bool => $token->hasCapability('tunnel'))
+            ->values();
+    }
+
+    /**
+     * @param  array{record_id: string, current: string}|null  $confirmedConflict
+     */
+    private function startApiSetup(CloudflareTunnelService $tunnels, IntegrationToken $token, string $hostname, ?array $confirmedConflict = null): void
+    {
+        try {
+            $activity = $tunnels->setUp($this->server, $token, $hostname, $confirmedConflict);
+            auditLog('ui.server.cloudflare_tunnel.api_configuration_started', $this->auditContext([
+                'ssh_domain' => $hostname,
+                'integration_token_uuid' => $token->uuid,
+            ]));
+            $this->dispatch('automated');
+            $this->dispatch('activityMonitor', $activity->id);
+        } catch (DnsRecordConflictException $e) {
+            $this->dnsConflict = [
+                'record_id' => $e->providerRecordId,
+                'current' => $e->currentValue,
+                'hostname' => $hostname,
+                'token_id' => $token->id,
+            ];
+        } catch (LockTimeoutException) {
+            $this->dispatch('error', "Another DNS change for {$hostname} is in progress. Try again in a few seconds.");
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    private function normalizeSshDomain(string $domain): string
+    {
+        return str($domain)->replace(['https://', 'http://'], '')->replace('/', '')->trim()->lower()->value();
     }
 
     /**
diff --git a/app/Livewire/Server/Create.php b/app/Livewire/Server/Create.php
index 7edfcaf72b..1f1aae51ea 100644
--- a/app/Livewire/Server/Create.php
+++ b/app/Livewire/Server/Create.php
@@ -21,7 +21,7 @@ class Create extends Component
 
     public function mount(?string $selectedType = null, ?string $selectedTokenUuid = null): void
     {
-        $this->selectedType = in_array($selectedType, ['hetzner', 'vultr', 'digital-ocean', 'manual'], true)
+        $this->selectedType = in_array($selectedType, ['hetzner', 'vultr', 'digital-ocean', 'hostinger', 'manual'], true)
             ? $selectedType
             : null;
         $this->selectedTokenUuid = $this->selectedType && $this->selectedType !== 'manual' ? $selectedTokenUuid : null;
diff --git a/app/Livewire/Server/CreatePage.php b/app/Livewire/Server/CreatePage.php
index 158f28351b..be901b9db6 100644
--- a/app/Livewire/Server/CreatePage.php
+++ b/app/Livewire/Server/CreatePage.php
@@ -28,12 +28,14 @@ class CreatePage extends Component
             'hetzner' => 'hetzner',
             'vultr' => 'vultr',
             'digital-ocean' => 'digitalocean',
+            'hostinger' => 'hostinger',
             default => null,
         };
         $this->tokenProviderName = match ($type) {
             'hetzner' => 'Hetzner',
             'vultr' => 'Vultr',
             'digital-ocean' => 'DigitalOcean',
+            'hostinger' => 'Hostinger',
             default => null,
         };
         $this->hasProviderTokens = $this->tokenProvider
@@ -43,6 +45,7 @@ class CreatePage extends Component
             'hetzner' => 'Hetzner',
             'vultr' => 'Vultr',
             'digital-ocean' => 'DigitalOcean',
+            'hostinger' => 'Hostinger',
             'manual' => 'Manual',
             default => 'New Server',
         };
diff --git a/app/Livewire/Server/Delete.php b/app/Livewire/Server/Delete.php
index 359f94e0fb..2b5051c65e 100644
--- a/app/Livewire/Server/Delete.php
+++ b/app/Livewire/Server/Delete.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Server;
 use App\Actions\Server\DeleteServer;
 use App\Jobs\DeleteResourceJob;
 use App\Models\Server;
+use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -20,6 +21,8 @@ class Delete extends Component
 
     public bool $delete_from_digitalocean = false;
 
+    public bool $delete_from_hostinger = false;
+
     public bool $force_delete_resources = false;
 
     public function mount(string $server_uuid)
@@ -41,8 +44,19 @@ class Delete extends Component
             $this->delete_from_hetzner = in_array('delete_from_hetzner', $selectedActions);
             $this->delete_from_vultr = in_array('delete_from_vultr', $selectedActions);
             $this->delete_from_digitalocean = in_array('delete_from_digitalocean', $selectedActions);
+            $this->delete_from_hostinger = in_array('delete_from_hostinger', $selectedActions);
             $this->force_delete_resources = in_array('force_delete_resources', $selectedActions);
         }
+        // Another Coolify instance manages a transferred server. This instance deletes only its own records:
+        // never the VM, and never the containers that the other instance runs.
+        $isArchive = $this->server->isTransferredAway();
+        if ($isArchive) {
+            $this->delete_from_hetzner = false;
+            $this->delete_from_vultr = false;
+            $this->delete_from_digitalocean = false;
+            $this->delete_from_hostinger = false;
+            $this->force_delete_resources = true;
+        }
         try {
             $this->authorize('delete', $this->server);
             if ($this->server->is_coolify_host) {
@@ -56,9 +70,12 @@ class Delete extends Component
                 return;
             }
 
+            if ($isArchive) {
+                app(ServerTransferClaimer::class)->forgetDnsRecords($this->server);
+            }
             if ($this->force_delete_resources) {
                 foreach ($this->server->definedResources() as $resource) {
-                    DeleteResourceJob::dispatch($resource);
+                    DeleteResourceJob::dispatch($resource, deleteFromCoolifyOnly: $isArchive);
                 }
             }
 
@@ -72,7 +89,9 @@ class Delete extends Component
                 $this->delete_from_vultr,
                 $this->server->vultr_instance_id,
                 $this->delete_from_digitalocean,
-                $this->server->digitalocean_droplet_id
+                $this->server->digitalocean_droplet_id,
+                $this->delete_from_hostinger,
+                $this->server->hostinger_virtual_machine_id
             );
 
             return redirectRoute($this, 'server.index');
@@ -85,7 +104,7 @@ class Delete extends Component
     {
         $checkboxes = [];
 
-        if ($this->server->hasDefinedResources()) {
+        if ($this->server->hasDefinedResources() && ! $this->server->isTransferredAway()) {
             $resourceCount = $this->server->definedResources()->count();
             $checkboxes[] = [
                 'id' => 'force_delete_resources',
@@ -94,7 +113,9 @@ class Delete extends Component
             ];
         }
 
-        if ($this->server->hetzner_server_id) {
+        $canDeleteFromProvider = ! $this->server->isTransferredAway();
+
+        if ($canDeleteFromProvider && $this->server->hetzner_server_id) {
             $checkboxes[] = [
                 'id' => 'delete_from_hetzner',
                 'label' => 'Also delete server from Hetzner Cloud',
@@ -102,7 +123,7 @@ class Delete extends Component
             ];
         }
 
-        if ($this->server->vultr_instance_id) {
+        if ($canDeleteFromProvider && $this->server->vultr_instance_id) {
             $checkboxes[] = [
                 'id' => 'delete_from_vultr',
                 'label' => 'Also delete server from Vultr',
@@ -110,7 +131,7 @@ class Delete extends Component
             ];
         }
 
-        if ($this->server->digitalocean_droplet_id) {
+        if ($canDeleteFromProvider && $this->server->digitalocean_droplet_id) {
             $checkboxes[] = [
                 'id' => 'delete_from_digitalocean',
                 'label' => 'Also delete droplet from DigitalOcean',
@@ -118,6 +139,14 @@ class Delete extends Component
             ];
         }
 
+        if ($canDeleteFromProvider && $this->server->hostinger_virtual_machine_id) {
+            $checkboxes[] = [
+                'id' => 'delete_from_hostinger',
+                'label' => 'Also delete VPS from Hostinger (at the end of the paid period)',
+                'default_warning' => 'The VPS on Hostinger will NOT be deleted, and Hostinger will keep billing for it.',
+            ];
+        }
+
         return view('livewire.server.delete', [
             'checkboxes' => $checkboxes,
         ]);
diff --git a/app/Livewire/Server/DockerCleanupExecutions.php b/app/Livewire/Server/DockerCleanupExecutions.php
index 6cb76fc9f3..763115aa20 100644
--- a/app/Livewire/Server/DockerCleanupExecutions.php
+++ b/app/Livewire/Server/DockerCleanupExecutions.php
@@ -4,12 +4,13 @@ namespace App\Livewire\Server;
 
 use App\Models\Server;
 use App\Traits\ListensToTeamChannel;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
 
 class DockerCleanupExecutions extends Component
 {
-    use ListensToTeamChannel;
+    use AuthorizesRequests, ListensToTeamChannel;
 
     public Server $server;
 
@@ -34,12 +35,15 @@ class DockerCleanupExecutions extends Component
 
     public function mount(Server $server)
     {
+        $this->authorize('view', $server);
         $this->server = $server;
         $this->refreshExecutions();
     }
 
     public function refreshExecutions(): void
     {
+        $this->authorize('view', $this->server);
+
         $this->executions = $this->server->dockerCleanupExecutions()
             ->orderBy('created_at', 'desc')
             ->take(20)
@@ -55,6 +59,8 @@ class DockerCleanupExecutions extends Component
 
     public function selectExecution($key): void
     {
+        $this->authorize('view', $this->server);
+
         if ($key == $this->selectedKey) {
             $this->selectedKey = null;
             $this->selectedExecution = null;
@@ -74,6 +80,8 @@ class DockerCleanupExecutions extends Component
 
     public function polling()
     {
+        $this->authorize('view', $this->server);
+
         if ($this->selectedExecution && $this->isPollingActive) {
             $this->selectedExecution->refresh();
             if ($this->selectedExecution->status !== 'running') {
@@ -85,6 +93,8 @@ class DockerCleanupExecutions extends Component
 
     public function loadMoreLogs()
     {
+        $this->authorize('view', $this->server);
+
         $this->currentPage++;
     }
 
@@ -105,6 +115,8 @@ class DockerCleanupExecutions extends Component
 
     public function downloadLogs(int $executionId)
     {
+        $this->authorize('view', $this->server);
+
         $execution = $this->executions->firstWhere('id', $executionId);
         if (! $execution) {
             return;
diff --git a/app/Livewire/Server/DockerRegistries/ServerRegistries.php b/app/Livewire/Server/DockerRegistries/ServerRegistries.php
index 7f6e169662..b3d2acc152 100644
--- a/app/Livewire/Server/DockerRegistries/ServerRegistries.php
+++ b/app/Livewire/Server/DockerRegistries/ServerRegistries.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Server\DockerRegistries;
 use App\Models\Server;
 use App\Services\DockerRegistryLogins;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\View\View;
 use Livewire\Attributes\Lazy;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\On;
@@ -104,13 +105,9 @@ class ServerRegistries extends Component
         $this->loadRegistries();
     }
 
-    public function placeholder(): string
+    public function placeholder(): View
     {
-        return <<<'HTML'
-        <div class="rounded-xl border border-neutral-200 bg-white p-4 text-[12px] text-neutral-500 shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
-            Loading registries...
-        </div>
-        HTML;
+        return view('livewire.server.docker-registries.server-registries-placeholder');
     }
 
     public function render()
diff --git a/app/Livewire/Server/Index.php b/app/Livewire/Server/Index.php
index eb832d72f7..a7d30f89ad 100644
--- a/app/Livewire/Server/Index.php
+++ b/app/Livewire/Server/Index.php
@@ -2,16 +2,25 @@
 
 namespace App\Livewire\Server;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Server;
 use Illuminate\Database\Eloquent\Collection;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use RemembersCanvasView;
+
     public ?Collection $servers = null;
 
-    public function mount()
+    public function mount(): void
     {
+        if ($this->prefersCanvasView('servers')) {
+            $this->redirectRoute('server.canvas.index', navigate: true);
+
+            return;
+        }
+
         $this->servers = Server::ownedByCurrentTeamCached();
     }
 
diff --git a/app/Livewire/Server/LogDrains.php b/app/Livewire/Server/LogDrains.php
index ef9addf231..c48816aa40 100644
--- a/app/Livewire/Server/LogDrains.php
+++ b/app/Livewire/Server/LogDrains.php
@@ -7,6 +7,7 @@ use App\Actions\Server\StopLogDrain;
 use App\Models\Server;
 use App\Rules\ValidFluentBitConfig;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Validation\ValidationException;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
@@ -43,6 +44,18 @@ class LogDrains extends Component
     #[Validate(['string', 'nullable'])]
     public ?string $logDrainCustomConfigParser = null;
 
+    #[Validate(['boolean'])]
+    public bool $isLogDrainCloudwatchEnabled = false;
+
+    #[Validate(['string', 'nullable', 'max:64', 'regex:/^[a-z]{2}(-[a-z]+)+-\d+$/'])]
+    public ?string $logDrainCloudwatchRegion = null;
+
+    #[Validate(['string', 'nullable', 'regex:/^[\.\-_\/#A-Za-z0-9]{1,512}$/'])]
+    public ?string $logDrainCloudwatchGroup = null;
+
+    #[Validate(['string', 'nullable', 'max:256', 'regex:/^[A-Za-z0-9_\-\.\/#]*$/'])]
+    public ?string $logDrainCloudwatchStreamPrefix = null;
+
     public function mount(string $server_uuid)
     {
         try {
@@ -100,6 +113,21 @@ class LogDrains extends Component
         }
     }
 
+    private function syncDataCloudwatch(bool $toModel = false): void
+    {
+        if ($toModel) {
+            $this->server->settings->is_logdrain_cloudwatch_enabled = $this->isLogDrainCloudwatchEnabled;
+            $this->server->settings->logdrain_cloudwatch_region = $this->logDrainCloudwatchRegion;
+            $this->server->settings->logdrain_cloudwatch_group = $this->logDrainCloudwatchGroup;
+            $this->server->settings->logdrain_cloudwatch_stream_prefix = $this->logDrainCloudwatchStreamPrefix;
+        } else {
+            $this->isLogDrainCloudwatchEnabled = $this->server->settings->is_logdrain_cloudwatch_enabled;
+            $this->logDrainCloudwatchRegion = $this->server->settings->logdrain_cloudwatch_region;
+            $this->logDrainCloudwatchGroup = $this->server->settings->logdrain_cloudwatch_group;
+            $this->logDrainCloudwatchStreamPrefix = $this->server->settings->logdrain_cloudwatch_stream_prefix;
+        }
+    }
+
     private function syncData(bool $toModel = false, ?string $type = null): void
     {
         if ($toModel) {
@@ -110,10 +138,16 @@ class LogDrains extends Component
                 $this->syncDataAxiom($toModel);
             } elseif ($type === 'custom') {
                 $this->syncDataCustom($toModel);
+            } elseif ($type === 'cloudwatch') {
+                $this->syncDataCloudwatch($toModel);
             } else {
                 $this->syncDataNewRelic($toModel);
                 $this->syncDataAxiom($toModel);
                 $this->syncDataCustom($toModel);
+                $this->syncDataCloudwatch($toModel);
+            }
+            if ($this->enabledLogDrainCount() > 0) {
+                $this->server->settings->is_logdrain_highlight_enabled = false;
             }
             $this->auditLogDrain('updated');
             $this->server->settings->save();
@@ -124,16 +158,27 @@ class LogDrains extends Component
                 $this->syncDataAxiom($toModel);
             } elseif ($type === 'custom') {
                 $this->syncDataCustom($toModel);
+            } elseif ($type === 'cloudwatch') {
+                $this->syncDataCloudwatch($toModel);
             } else {
                 $this->syncDataNewRelic($toModel);
                 $this->syncDataAxiom($toModel);
                 $this->syncDataCustom($toModel);
+                $this->syncDataCloudwatch($toModel);
             }
         }
     }
 
     public function customValidation()
     {
+        if ($this->enabledLogDrainCount() > 1) {
+            $this->syncData();
+
+            throw ValidationException::withMessages([
+                'logDrain' => 'Only one log drain can be enabled at a time. Disable the current log drain first.',
+            ]);
+        }
+
         if ($this->isLogDrainNewRelicEnabled) {
             try {
                 $this->validate([
@@ -165,6 +210,18 @@ class LogDrains extends Component
             } catch (\Throwable $e) {
                 $this->isLogDrainCustomEnabled = false;
 
+                throw $e;
+            }
+        } elseif ($this->isLogDrainCloudwatchEnabled) {
+            try {
+                $this->validate([
+                    'logDrainCloudwatchRegion' => ['required', 'max:64', 'regex:/^[a-z]{2}(-[a-z]+)+-\d+$/'],
+                    'logDrainCloudwatchGroup' => ['required', 'regex:/^[\.\-_\/#A-Za-z0-9]{1,512}$/'],
+                    'logDrainCloudwatchStreamPrefix' => ['string', 'nullable', 'max:256', 'regex:/^[A-Za-z0-9_\-\.\/#]*$/'],
+                ]);
+            } catch (\Throwable $e) {
+                $this->isLogDrainCloudwatchEnabled = false;
+
                 throw $e;
             }
         }
@@ -193,6 +250,8 @@ class LogDrains extends Component
         $previousNewRelicEnabled = $this->server->settings->is_logdrain_newrelic_enabled;
         $previousAxiomEnabled = $this->server->settings->is_logdrain_axiom_enabled;
         $previousCustomEnabled = $this->server->settings->is_logdrain_custom_enabled;
+        $previousCloudwatchEnabled = $this->server->settings->is_logdrain_cloudwatch_enabled;
+        $previousHighlightEnabled = $this->server->settings->is_logdrain_highlight_enabled;
 
         try {
             $this->authorize('update', $this->server);
@@ -207,6 +266,7 @@ class LogDrains extends Component
                 $this->isLogDrainNewRelicEnabled = $type === 'newrelic';
                 $this->isLogDrainAxiomEnabled = $type === 'axiom';
                 $this->isLogDrainCustomEnabled = $type === 'custom';
+                $this->isLogDrainCloudwatchEnabled = $type === 'cloudwatch';
             }
 
             $this->syncData(true);
@@ -225,6 +285,8 @@ class LogDrains extends Component
             $this->server->settings->is_logdrain_newrelic_enabled = $previousNewRelicEnabled;
             $this->server->settings->is_logdrain_axiom_enabled = $previousAxiomEnabled;
             $this->server->settings->is_logdrain_custom_enabled = $previousCustomEnabled;
+            $this->server->settings->is_logdrain_cloudwatch_enabled = $previousCloudwatchEnabled;
+            $this->server->settings->is_logdrain_highlight_enabled = $previousHighlightEnabled;
             $this->server->settings->save();
             $this->syncData();
 
@@ -248,12 +310,23 @@ class LogDrains extends Component
         return view('livewire.server.log-drains');
     }
 
+    private function enabledLogDrainCount(): int
+    {
+        return count(array_filter([
+            $this->isLogDrainNewRelicEnabled,
+            $this->isLogDrainAxiomEnabled,
+            $this->isLogDrainCustomEnabled,
+            $this->isLogDrainCloudwatchEnabled,
+        ]));
+    }
+
     private function enabledProperty(string $type): string
     {
         return match ($type) {
             'newrelic' => 'isLogDrainNewRelicEnabled',
             'axiom' => 'isLogDrainAxiomEnabled',
             'custom' => 'isLogDrainCustomEnabled',
+            'cloudwatch' => 'isLogDrainCloudwatchEnabled',
             default => throw new \InvalidArgumentException('Unknown log drain type.'),
         };
     }
@@ -283,6 +356,11 @@ class LogDrains extends Component
                 'logDrainCustomConfig' => ['required', new ValidFluentBitConfig],
                 'logDrainCustomConfigParser' => ['string', 'nullable', new ValidFluentBitConfig(parsersOnly: true)],
             ]),
+            'cloudwatch' => $this->validate([
+                'logDrainCloudwatchRegion' => ['required', 'max:64', 'regex:/^[a-z]{2}(-[a-z]+)+-\d+$/'],
+                'logDrainCloudwatchGroup' => ['required', 'regex:/^[\.\-_\/#A-Za-z0-9]{1,512}$/'],
+                'logDrainCloudwatchStreamPrefix' => ['string', 'nullable', 'max:256', 'regex:/^[A-Za-z0-9_\-\.\/#]*$/'],
+            ]),
             default => throw new \InvalidArgumentException('Unknown log drain type.'),
         };
     }
diff --git a/app/Livewire/Server/New/ByHostinger.php b/app/Livewire/Server/New/ByHostinger.php
new file mode 100644
index 0000000000..c05fcf7d5d
--- /dev/null
+++ b/app/Livewire/Server/New/ByHostinger.php
@@ -0,0 +1,514 @@
+<?php
+
+namespace App\Livewire\Server\New;
+
+use App\Enums\ProxyTypes;
+use App\Models\CloudProviderToken;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Rules\ValidHostname;
+use App\Services\HostingerService;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+class ByHostinger extends Component
+{
+    use AuthorizesRequests;
+
+    public int $current_step = 1;
+
+    #[Locked]
+    public Collection $available_tokens;
+
+    #[Locked]
+    public $private_keys;
+
+    #[Locked]
+    public $limit_reached;
+
+    public ?int $selected_token_id = null;
+
+    public ?string $selectedTokenUuid = null;
+
+    public array $data_centers = [];
+
+    public array $templates = [];
+
+    public array $catalog_items = [];
+
+    public array $hostinger_public_keys = [];
+
+    public array $post_install_scripts = [];
+
+    public ?int $selected_data_center_id = null;
+
+    public ?int $selected_template_id = null;
+
+    public ?int $selected_os_template_id = null;
+
+    public ?int $selected_app_template_id = null;
+
+    public ?string $selected_price_id = null;
+
+    public array $selected_public_key_ids = [];
+
+    public ?int $selected_post_install_script_id = null;
+
+    public string $server_name = '';
+
+    public ?int $private_key_id = null;
+
+    public bool $enable_backups = false;
+
+    public bool $loading_data = false;
+
+    public ?string $provider_data_error = null;
+
+    public bool $from_onboarding = false;
+
+    public function mount(?string $selectedTokenUuid = null): mixed
+    {
+        try {
+            $this->authorize('viewAny', CloudProviderToken::class);
+            $this->loadTokens();
+            $this->selectTokenFromUrl($selectedTokenUuid);
+            $this->server_name = generate_random_name();
+            $this->private_keys = PrivateKey::ownedAndOnlySShKeys()->where('id', '!=', 0)->get();
+
+            if ($this->private_keys->isNotEmpty()) {
+                $this->private_key_id = $this->private_keys->first()->id;
+            }
+
+            if ($this->selectedTokenUuid) {
+                $this->current_step = 2;
+                $this->loading_data = true;
+            }
+
+            return null;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function getListeners(): array
+    {
+        return [
+            'tokenAdded.hostinger' => 'handleTokenAdded',
+            'privateKeyCreated' => 'handlePrivateKeyCreated',
+            'modalClosed' => 'resetSelection',
+        ];
+    }
+
+    protected function rules(): array
+    {
+        $rules = [
+            'selected_token_id' => 'required|integer|exists:cloud_provider_tokens,id',
+        ];
+
+        if ($this->current_step === 2) {
+            $rules = array_merge($rules, [
+                'server_name' => ['required', 'string', 'max:253', new ValidHostname],
+                'selected_data_center_id' => 'required|integer',
+                'selected_template_id' => 'required|integer',
+                'selected_price_id' => 'required|string',
+                'private_key_id' => 'required|integer|exists:private_keys,id,team_id,'.currentTeam()->id,
+                'enable_backups' => 'required|boolean',
+                'selected_public_key_ids' => 'array',
+                'selected_public_key_ids.*' => 'integer',
+                'selected_post_install_script_id' => 'nullable|integer',
+            ]);
+        }
+
+        return $rules;
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'selected_token_id.required' => 'Please select a Hostinger token.',
+            'selected_token_id.exists' => 'Selected token not found.',
+        ];
+    }
+
+    public function loadTokens(): void
+    {
+        $this->available_tokens = CloudProviderToken::ownedByCurrentTeam()
+            ->where('provider', 'hostinger')
+            ->get();
+    }
+
+    public function handleTokenAdded(int $tokenId): mixed
+    {
+        $this->loadTokens();
+        $this->selected_token_id = $tokenId;
+
+        return $this->nextStep();
+    }
+
+    public function handlePrivateKeyCreated(int $keyId): void
+    {
+        $this->private_keys = PrivateKey::ownedAndOnlySShKeys()->where('id', '!=', 0)->get();
+        $this->private_key_id = $keyId;
+        $this->resetErrorBag('private_key_id');
+    }
+
+    public function resetSelection(): void
+    {
+        $this->selected_token_id = null;
+        $this->current_step = 1;
+    }
+
+    public function nextStep(): mixed
+    {
+        $this->validate([
+            'selected_token_id' => 'required|integer|exists:cloud_provider_tokens,id',
+        ]);
+
+        try {
+            if (! $this->selectedTokenUuid) {
+                $token = $this->available_tokens->firstWhere('id', $this->selected_token_id);
+
+                if ($token) {
+                    return $this->redirectRoute('server.create.token', [
+                        'type' => 'hostinger',
+                        'token_uuid' => $token->uuid,
+                    ], navigate: true);
+                }
+            }
+
+            $this->current_step = 2;
+            $this->loading_data = true;
+
+            return null;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function loadHostingerData(): void
+    {
+        $token = $this->getHostingerToken();
+
+        if (! $token) {
+            $this->loading_data = false;
+            $this->dispatch('error', 'Please select a valid Hostinger token.');
+
+            return;
+        }
+
+        $this->loading_data = true;
+        $this->provider_data_error = null;
+
+        try {
+            $hostingerService = new HostingerService($token);
+            $this->data_centers = $hostingerService->getDataCenters();
+            $this->templates = collect($hostingerService->getTemplates())
+                ->sortBy('name')
+                ->values()
+                ->toArray();
+            $this->catalog_items = $hostingerService->getCatalogItems();
+            $this->hostinger_public_keys = $this->optionalProviderData(fn () => $hostingerService->getPublicKeys());
+            $this->post_install_scripts = $this->optionalProviderData(fn () => $hostingerService->getPostInstallScripts());
+            $this->selectDefaultTemplate();
+        } catch (\Throwable $e) {
+            $this->provider_data_error = $e->getMessage();
+            $this->dispatch('error', $this->provider_data_error);
+        } finally {
+            $this->loading_data = false;
+        }
+    }
+
+    public function updatedSelectedOsTemplateId(): void
+    {
+        if ($this->selected_os_template_id !== null) {
+            $this->selected_app_template_id = null;
+        }
+
+        $this->selected_template_id = $this->selected_os_template_id ?? $this->selected_app_template_id;
+    }
+
+    public function updatedSelectedAppTemplateId(): void
+    {
+        if ($this->selected_app_template_id !== null) {
+            $this->selected_os_template_id = null;
+        }
+
+        $this->selected_template_id = $this->selected_app_template_id ?? $this->selected_os_template_id;
+    }
+
+    /**
+     * Plain operating system templates.
+     */
+    public function getOsTemplatesProperty(): array
+    {
+        return collect($this->templates)
+            ->reject(fn (array $template): bool => $this->templateIncludesApplication($template))
+            ->values()
+            ->all();
+    }
+
+    /**
+     * Operating system templates that also install an application or control panel.
+     */
+    public function getAppTemplatesProperty(): array
+    {
+        return collect($this->templates)
+            ->filter(fn (array $template): bool => $this->templateIncludesApplication($template))
+            ->values()
+            ->all();
+    }
+
+    public function getPriceOptionsProperty(): array
+    {
+        return collect($this->catalog_items)
+            ->flatMap(function (array $item): array {
+                $planSize = $this->planSize($item);
+
+                return collect($item['prices'] ?? [])
+                    ->map(fn (array $price): array => array_merge($price, [
+                        'plan_name' => $item['name'] ?? $item['id'] ?? 'VPS',
+                        'plan_size' => $planSize,
+                    ]))
+                    ->all();
+            })
+            ->sort(fn (array $a, array $b): int => [$a['plan_size'], $this->periodInMonths($a)] <=> [$b['plan_size'], $this->periodInMonths($b)])
+            ->values()
+            ->toArray();
+    }
+
+    public function getSelectedPriceProperty(): ?array
+    {
+        return collect($this->priceOptions)->firstWhere('id', $this->selected_price_id);
+    }
+
+    public function priceLabel(array $price): string
+    {
+        $currency = strtoupper($price['currency'] ?? 'USD');
+        $firstPeriodPrice = (int) ($price['first_period_price'] ?? $price['price'] ?? 0);
+        $renewalPrice = (int) ($price['price'] ?? $firstPeriodPrice);
+        $period = (int) ($price['period'] ?? 1);
+        $periodUnit = $price['period_unit'] ?? 'month';
+        $periodLabel = $period.' '.str($periodUnit)->plural($period);
+
+        return sprintf(
+            '%s — %s %.2f for %s, then %s %.2f',
+            $price['plan_name'] ?? 'VPS',
+            $currency,
+            $firstPeriodPrice / 100,
+            $periodLabel,
+            $currency,
+            $renewalPrice / 100
+        );
+    }
+
+    public function submit(): mixed
+    {
+        $this->validate();
+
+        $virtualMachineId = null;
+
+        try {
+            $this->authorize('create', Server::class);
+
+            if (Team::serverLimitReached()) {
+                return $this->dispatch('error', 'You have reached the server limit for your subscription.');
+            }
+
+            $privateKey = PrivateKey::ownedByCurrentTeam()->findOrFail($this->private_key_id);
+            $hostingerService = new HostingerService($this->getHostingerToken());
+
+            if (! $this->providerSelectionsAreValid($hostingerService)) {
+                return null;
+            }
+
+            $normalizedServerName = strtolower(trim($this->server_name));
+            $setup = [
+                'data_center_id' => $this->selected_data_center_id,
+                'template_id' => $this->selected_template_id,
+                'hostname' => $normalizedServerName,
+                'enable_backups' => $this->enable_backups,
+                'public_key' => [
+                    'name' => $privateKey->name,
+                    'key' => $privateKey->getPublicKey(),
+                ],
+            ];
+            if ($this->selected_post_install_script_id) {
+                $setup['post_install_script_id'] = $this->selected_post_install_script_id;
+            }
+
+            $virtualMachine = $hostingerService->purchaseVirtualMachine([
+                'item_id' => $this->selected_price_id,
+                'setup' => $setup,
+            ]);
+            $virtualMachineId = (int) $virtualMachine['id'];
+
+            $server = Server::create([
+                'name' => $normalizedServerName,
+                'ip' => Server::PLACEHOLDER_IP,
+                'user' => 'root',
+                'port' => 22,
+                'team_id' => currentTeam()->id,
+                'private_key_id' => $privateKey->id,
+                'cloud_provider_token_id' => $this->selected_token_id,
+                'hostinger_virtual_machine_id' => $virtualMachine['id'],
+                'hostinger_virtual_machine_status' => $virtualMachine['state'] ?? null,
+            ]);
+
+            $server->proxy->set('status', 'exited');
+            $server->proxy->set('type', ProxyTypes::TRAEFIK->value);
+            $server->save();
+
+            try {
+                if ($this->selected_public_key_ids) {
+                    $hostingerService->attachPublicKeys((int) $virtualMachine['id'], $this->selected_public_key_ids);
+                }
+                $virtualMachine = $hostingerService->waitForPublicIp($virtualMachine);
+                $ipAddress = $hostingerService->getPublicIpAddress($virtualMachine);
+                if ($ipAddress) {
+                    $server->update([
+                        'ip' => $ipAddress,
+                        'hostinger_virtual_machine_status' => $virtualMachine['state'] ?? $server->hostinger_virtual_machine_status,
+                    ]);
+                }
+            } catch (\Throwable $e) {
+                report($e);
+            }
+
+            if ($this->from_onboarding) {
+                currentTeam()->update(['show_boarding' => false]);
+                refreshSession();
+            }
+
+            return redirectRoute($this, 'server.show', [$server->uuid]);
+        } catch (\Throwable $e) {
+            if ($virtualMachineId) {
+                logger()->warning('Hostinger VPS was purchased but could not be saved in Coolify', [
+                    'team_id' => currentTeam()->id,
+                    'hostinger_virtual_machine_id' => $virtualMachineId,
+                ]);
+                $this->dispatch('error', "Hostinger VPS {$virtualMachineId} was purchased but could not be saved in Coolify. Manage it in hPanel.");
+            }
+
+            return handleError($e, $this);
+        }
+    }
+
+    private function selectTokenFromUrl(?string $selectedTokenUuid): void
+    {
+        if (! $selectedTokenUuid) {
+            return;
+        }
+
+        $token = $this->available_tokens->firstWhere('uuid', $selectedTokenUuid);
+
+        if ($token) {
+            $this->selectedTokenUuid = $selectedTokenUuid;
+            $this->selected_token_id = $token->id;
+        }
+    }
+
+    private function getHostingerToken(): string
+    {
+        $token = $this->available_tokens->firstWhere('id', $this->selected_token_id);
+
+        return $token?->token ?? '';
+    }
+
+    private function selectDefaultTemplate(): void
+    {
+        if ($this->selected_template_id !== null) {
+            return;
+        }
+
+        $defaultTemplate = collect($this->osTemplates)->firstWhere('name', 'Ubuntu 24.04 LTS');
+
+        if ($defaultTemplate) {
+            $this->selected_os_template_id = (int) $defaultTemplate['id'];
+            $this->selected_template_id = $this->selected_os_template_id;
+        }
+    }
+
+    private function templateIncludesApplication(array $template): bool
+    {
+        return str_contains((string) ($template['name'] ?? ''), ' with ');
+    }
+
+    /**
+     * The plan size from the KVM plan id (hostingercom-vps-kvm4 is 4), falling back to its CPU count.
+     */
+    private function planSize(array $item): int
+    {
+        if (preg_match('/-vps-kvm(\d+)$/', (string) ($item['id'] ?? ''), $matches) === 1) {
+            return (int) $matches[1];
+        }
+
+        return (int) ($item['metadata']['cpus'] ?? 0);
+    }
+
+    private function periodInMonths(array $price): float
+    {
+        $period = (int) ($price['period'] ?? 0);
+
+        return match ($price['period_unit'] ?? 'month') {
+            'day' => $period / 30,
+            'week' => $period * 7 / 30,
+            'year' => $period * 12,
+            'none' => PHP_INT_MAX,
+            default => $period,
+        };
+    }
+
+    /**
+     * Load an optional Hostinger list. Some tokens cannot read these lists, so a failure must not block the form.
+     */
+    private function optionalProviderData(callable $callback): array
+    {
+        try {
+            return $callback();
+        } catch (\Throwable $e) {
+            report($e);
+
+            return [];
+        }
+    }
+
+    private function providerSelectionsAreValid(HostingerService $hostingerService): bool
+    {
+        $priceIds = collect($hostingerService->getCatalogItems())
+            ->flatMap(fn (array $item) => collect($item['prices'] ?? [])->pluck('id'));
+        $dataCenterIds = collect($hostingerService->getDataCenters())->pluck('id')->map(fn ($id) => (int) $id);
+        $templateIds = collect($hostingerService->getTemplates())->pluck('id')->map(fn ($id) => (int) $id);
+        $publicKeyIds = collect($this->selected_public_key_ids ? $hostingerService->getPublicKeys() : [])->pluck('id')->map(fn ($id) => (int) $id);
+        $postInstallScriptIds = collect($this->selected_post_install_script_id ? $hostingerService->getPostInstallScripts() : [])->pluck('id')->map(fn ($id) => (int) $id);
+
+        if (! $priceIds->contains($this->selected_price_id)) {
+            $this->addError('selected_price_id', 'The selected Hostinger plan or billing period is no longer available.');
+        }
+
+        if (! $dataCenterIds->contains($this->selected_data_center_id)) {
+            $this->addError('selected_data_center_id', 'The selected Hostinger data center is no longer available.');
+        }
+
+        if (! $templateIds->contains($this->selected_template_id)) {
+            $this->addError('selected_template_id', 'The selected Hostinger operating system is no longer available.');
+        }
+
+        if (collect($this->selected_public_key_ids)->contains(fn ($id) => ! $publicKeyIds->contains((int) $id))) {
+            $this->addError('selected_public_key_ids', 'One or more selected Hostinger SSH keys are no longer available.');
+        }
+
+        if ($this->selected_post_install_script_id && ! $postInstallScriptIds->contains($this->selected_post_install_script_id)) {
+            $this->addError('selected_post_install_script_id', 'The selected Hostinger post-install script is no longer available.');
+        }
+
+        return ! $this->getErrorBag()->isNotEmpty();
+    }
+
+    public function render()
+    {
+        return view('livewire.server.new.by-hostinger');
+    }
+}
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 13a3f21381..42b802ba5a 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -27,6 +27,8 @@ class Proxy extends Component
 
     public ?string $redirectUrl = null;
 
+    public ?string $customErrorPage = null;
+
     public bool $generateExactLabels = false;
 
     public ?string $certificateResolver = null;
@@ -53,6 +55,7 @@ class Proxy extends Component
             'generateExactLabels' => 'required|boolean',
             'redirectUrl' => ['nullable', new SafeExternalUrl],
             'certificateResolver' => ['nullable', 'string', 'max:255', 'regex:'.ServerSetting::TRAEFIK_CERTIFICATE_RESOLVER_PATTERN],
+            'customErrorPage' => ['nullable', 'string', proxyPageSizeRule('custom error page')],
         ];
     }
 
@@ -61,6 +64,7 @@ class Proxy extends Component
         $this->selectedProxy = $this->server->proxyType();
         $this->redirectEnabled = data_get($this->server, 'proxy.redirect_enabled', true);
         $this->redirectUrl = data_get($this->server, 'proxy.redirect_url');
+        $this->customErrorPage = $this->server->proxy_error_page;
         $this->syncData(false);
         $this->clearAppliedTraefikBranchWarning();
     }
@@ -204,6 +208,20 @@ class Proxy extends Component
         }
     }
 
+    public function resetCustomErrorPage(): void
+    {
+        try {
+            $this->authorize('update', $this->server);
+            $this->server->proxy_error_page = null;
+            $this->server->save();
+            $this->customErrorPage = null;
+            $this->server->setupDefaultRedirect();
+            $this->dispatch('success', 'Default error page restored.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function submit()
     {
         try {
@@ -211,6 +229,7 @@ class Proxy extends Component
             $this->validate();
             SaveProxyConfiguration::run($this->server, $this->proxySettings);
             $this->server->proxy->redirect_url = $this->redirectUrl;
+            $this->server->proxy_error_page = filled($this->customErrorPage) ? $this->customErrorPage : null;
             $this->server->save();
             $this->saveSettings();
             auditLog('ui.server.proxy.configuration_saved', $this->proxyAuditContext());
diff --git a/app/Livewire/Server/Resources.php b/app/Livewire/Server/Resources.php
index dd62a9e776..86f87cc13f 100644
--- a/app/Livewire/Server/Resources.php
+++ b/app/Livewire/Server/Resources.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Server;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Server;
 use App\Support\ValidationPatterns;
 use App\Traits\ListensToTeamChannel;
@@ -14,6 +15,7 @@ class Resources extends Component
 {
     use AuthorizesRequests;
     use ListensToTeamChannel;
+    use RemembersCanvasView;
     use WithPagination;
 
     public int $perPage = 10;
@@ -144,6 +146,9 @@ class Resources extends Component
             if (is_null($this->server)) {
                 return redirect()->route('server.index');
             }
+            if ($this->prefersCanvasView('server_resources')) {
+                return $this->redirectRoute('server.canvas', ['server_uuid' => $this->server->uuid], navigate: true);
+            }
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Server/Security/Patches.php b/app/Livewire/Server/Security/Patches.php
index 4dd97519aa..bcb7cf882c 100644
--- a/app/Livewire/Server/Security/Patches.php
+++ b/app/Livewire/Server/Security/Patches.php
@@ -2,13 +2,17 @@
 
 namespace App\Livewire\Server\Security;
 
-use App\Actions\Server\CheckUpdates;
+use App\Actions\Server\ConfigureAutomaticSecurityUpdates;
+use App\Actions\Server\RebootServer;
 use App\Actions\Server\UpdatePackage;
-use App\Events\ServerPackageUpdated;
+use App\Jobs\ServerPatchCheckJob;
 use App\Models\Server;
 use App\Notifications\Server\ServerPatchCheck;
 use App\Traits\ListensToTeamChannel;
+use Cron\CronExpression;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Cache;
+use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class Patches extends Component
@@ -16,58 +20,75 @@ class Patches extends Component
     use AuthorizesRequests;
     use ListensToTeamChannel;
 
-    public array $parameters;
-
     public Server $server;
 
-    public ?int $totalUpdates = null;
-
-    public ?array $updates = null;
+    /**
+     * The saved result of the last check (see ServerPatchCheckJob).
+     */
+    #[Locked]
+    public ?array $result = null;
 
+    #[Locked]
     public ?string $error = null;
 
-    public ?string $osId = null;
+    #[Locked]
+    public bool $checking = false;
 
-    public ?string $packageManager = null;
+    public string $patchCheckFrequency = '';
+
+    #[Locked]
+    public bool $autoSecurityUpdates = false;
+
+    public string $autoSecurityUpdatesTime = '03:00';
 
     public function getListeners()
     {
         return $this->teamChannelListeners([
-            'ServerPackageUpdated' => 'checkForUpdatesDispatch',
+            'ServerPatchCheckFinished' => 'patchCheckFinished',
         ]);
     }
 
-    public function mount()
+    public function mount(string $server_uuid)
     {
-        $this->parameters = get_route_parameters();
-        $this->server = Server::ownedByCurrentTeam()->whereUuid($this->parameters['server_uuid'])->firstOrFail();
-        try {
-            $this->authorize('viewSecurity', $this->server);
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
+        $this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
+        $this->authorize('viewSecurity', $this->server);
+        $this->loadResult();
+        $this->syncSettings();
     }
 
-    public function checkForUpdatesDispatch()
+    private function syncSettings(): void
     {
-        $this->totalUpdates = null;
-        $this->updates = null;
-        $this->error = null;
-        $this->osId = null;
-        $this->packageManager = null;
-        $this->dispatch('checkForUpdatesDispatch');
+        $this->patchCheckFrequency = (string) $this->server->settings->patch_check_frequency;
+        $this->autoSecurityUpdates = (bool) $this->server->settings->is_auto_security_updates_enabled;
+        $this->autoSecurityUpdatesTime = (string) ($this->server->settings->auto_security_updates_time ?? '03:00');
+    }
+
+    public function loadResult(): void
+    {
+        $this->server->settings->refresh();
+        $this->result = $this->server->settings->patch_check_result;
+        $this->error = $this->server->settings->patch_check_error;
+        $this->checking = Cache::has(ServerPatchCheckJob::runningCacheKey($this->server));
+    }
+
+    public function patchCheckFinished(array $event = []): void
+    {
+        $serverUuid = data_get($event, 'serverUuid');
+        if ($serverUuid !== null && $serverUuid !== $this->server->uuid) {
+            return;
+        }
+        $this->loadResult();
     }
 
     public function checkForUpdates()
     {
-        $job = CheckUpdates::run($this->server);
-        if (isset($job['error'])) {
-            $this->error = data_get($job, 'error', 'Something went wrong.');
-        } else {
-            $this->totalUpdates = data_get($job, 'total_updates', 0);
-            $this->updates = data_get($job, 'updates', []);
-            $this->osId = data_get($job, 'osId', null);
-            $this->packageManager = data_get($job, 'package_manager', null);
+        try {
+            $this->authorize('update', $this->server);
+            $this->ensureManagedHere();
+            ServerPatchCheckJob::dispatchManual($this->server);
+            $this->checking = true;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
@@ -75,35 +96,197 @@ class Patches extends Component
     {
         try {
             $this->authorize('update', $this->server);
-            if (! $this->packageManager || ! $this->osId) {
-                $this->dispatch('error', message: 'Run "Check for updates" first.');
-
-                return;
-            }
-
-            $activity = UpdatePackage::run(
-                server: $this->server,
-                packageManager: $this->packageManager,
-                osId: $this->osId,
-                all: true
-            );
-            $this->dispatch('activityMonitor', $activity->id, ServerPackageUpdated::class);
+            $this->runUpdate(all: true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
     }
 
-    public function updatePackage($package)
+    public function updatePackage(string $package)
     {
         try {
             $this->authorize('update', $this->server);
-            $activity = UpdatePackage::run(server: $this->server, packageManager: $this->packageManager, osId: $this->osId, package: $package);
-            $this->dispatch('activityMonitor', $activity->id, ServerPackageUpdated::class);
-        } catch (\Exception $e) {
-            $this->dispatch('error', message: $e->getMessage());
+            $savedPackages = collect(data_get($this->server->settings->patch_check_result, 'updates', []))->pluck('package');
+            if (! $savedPackages->contains($package)) {
+                $this->dispatch('error', message: 'This package has no update in the last check.');
+
+                return;
+            }
+            $this->runUpdate(package: $package);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
+    public function rebootServer()
+    {
+        try {
+            $this->authorize('update', $this->server);
+            try {
+                RebootServer::run($this->server);
+            } catch (\Throwable $e) {
+                $this->auditPatchAction('reboot_requested', ['result' => 'failed', 'error' => $e->getMessage()], 'error');
+
+                throw $e;
+            }
+            $this->auditPatchAction('reboot_requested', ['result' => 'started']);
+            $this->dispatch('success', 'Reboot started. The server is back in a few minutes, and Coolify then checks it again.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function submit()
+    {
+        try {
+            $this->authorize('update', $this->server);
+            $settings = $this->server->settings;
+
+            $frequency = trim($this->patchCheckFrequency);
+            if ($frequency !== '' && ! self::isValidPatchCheckFrequency($frequency)) {
+                throw new \Exception('Invalid check frequency. Use a cron expression or a preset (daily, weekly, monthly) that runs at most once per hour.');
+            }
+            $time = trim($this->autoSecurityUpdatesTime);
+            if (preg_match(ConfigureAutomaticSecurityUpdates::TIME_PATTERN, $time) !== 1) {
+                throw new \Exception('Invalid time. Use the 24-hour format HH:MM, for example 03:00.');
+            }
+
+            if ($settings->is_auto_security_updates_enabled && $time !== $settings->auto_security_updates_time) {
+                $this->applyAutomaticSecurityUpdates(true, $time);
+            }
+
+            $settings->patch_check_frequency = $frequency === '' ? null : $frequency;
+            $settings->auto_security_updates_time = $time;
+            $changedFields = auditChangedFields($settings);
+            $settings->save();
+            if ($changedFields !== []) {
+                $this->auditPatchAction('patch_settings_updated', ['changed_fields' => $changedFields]);
+            }
+            $this->syncSettings();
+            $this->dispatch('success', 'Patch settings saved.');
+        } catch (\Throwable $e) {
+            $this->server->settings->refresh();
+            $this->syncSettings();
+
+            return handleError($e, $this);
+        }
+    }
+
+    /**
+     * Turns automatic security updates on or off after the user confirmed it.
+     */
+    public function toggleAutomaticSecurityUpdates()
+    {
+        try {
+            $this->authorize('update', $this->server);
+            $settings = $this->server->settings;
+            $enabled = ! $settings->is_auto_security_updates_enabled;
+            $time = trim($this->autoSecurityUpdatesTime);
+            if (preg_match(ConfigureAutomaticSecurityUpdates::TIME_PATTERN, $time) !== 1) {
+                throw new \Exception('Invalid time. Use the 24-hour format HH:MM, for example 03:00.');
+            }
+
+            $this->applyAutomaticSecurityUpdates($enabled, $time);
+            $settings->is_auto_security_updates_enabled = $enabled;
+            $settings->auto_security_updates_time = $time;
+            $settings->save();
+            $this->syncSettings();
+            $this->dispatch('success', $enabled ? 'Automatic security updates turned on.' : 'Automatic security updates turned off.');
+        } catch (\Throwable $e) {
+            $this->server->settings->refresh();
+            $this->syncSettings();
+
+            return handleError($e, $this);
+        }
+    }
+
+    private function applyAutomaticSecurityUpdates(bool $enabled, string $time): void
+    {
+        $this->ensureManagedHere();
+        $packageManager = data_get($this->server->settings->patch_check_result, 'package_manager');
+        if (! ConfigureAutomaticSecurityUpdates::supportFor($packageManager)) {
+            throw new \Exception('Automatic security updates are supported only on Debian, Ubuntu, and RHEL-family servers. Run "Check for updates" first, so Coolify knows the package manager.');
+        }
+
+        $auditContext = ['enabled' => $enabled, 'time' => $time, 'package_manager' => $packageManager];
+        try {
+            ConfigureAutomaticSecurityUpdates::run($this->server, $packageManager, $enabled, $time);
+        } catch (\Throwable $e) {
+            $this->auditPatchAction('auto_security_updates_updated', [...$auditContext, 'result' => 'failed', 'error' => $e->getMessage()], 'error');
+
+            throw $e;
+        }
+        $this->auditPatchAction('auto_security_updates_updated', [...$auditContext, 'result' => 'success']);
+    }
+
+    /**
+     * A valid cron expression or preset that runs at most once per hour, because every check runs the package manager.
+     */
+    public static function isValidPatchCheckFrequency(string $frequency): bool
+    {
+        if (! validate_cron_expression($frequency)) {
+            return false;
+        }
+        $runs = (new CronExpression(VALID_CRON_STRINGS[$frequency] ?? $frequency))->getMultipleRunDates(5);
+        for ($i = 1; $i < count($runs); $i++) {
+            if ($runs[$i]->getTimestamp() - $runs[$i - 1]->getTimestamp() < 3600) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    private function auditPatchAction(string $action, array $context, string $level = 'info'): void
+    {
+        auditLog("ui.server.{$action}", [
+            'team_id' => $this->server->team_id,
+            'server_uuid' => $this->server->uuid,
+            'server_name' => $this->server->name,
+            ...$context,
+        ], $level);
+    }
+
+    /**
+     * A transferred server is an archive: another instance manages the host.
+     */
+    private function ensureManagedHere(): void
+    {
+        if ($this->server->isTransferredAway()) {
+            throw new \RuntimeException('This server is managed by another Coolify instance.');
+        }
+    }
+
+    private function runUpdate(bool $all = false, ?string $package = null): void
+    {
+        $this->ensureManagedHere();
+        $savedResult = $this->server->settings->patch_check_result;
+        $packageManager = data_get($savedResult, 'package_manager');
+        $osId = data_get($savedResult, 'osId');
+        if (! $packageManager || ! $osId) {
+            $this->dispatch('error', message: 'Run "Check for updates" first.');
+
+            return;
+        }
+
+        $activity = UpdatePackage::run(server: $this->server, osId: $osId, package: $package, packageManager: $packageManager, all: $all);
+        if (is_array($activity)) {
+            $this->dispatch('error', message: $activity['error'] ?? 'Something went wrong.');
+
+            return;
+        }
+        $this->auditPatchAction('packages_update_requested', [
+            'packages' => $all ? 'all' : [$package],
+            'package_manager' => $packageManager,
+            'activity_id' => $activity->id,
+        ]);
+        $this->dispatch('startupdate');
+        $this->dispatch('activityMonitor', $activity->id);
+    }
+
     public function sendTestEmail()
     {
         if (! isDev()) {
@@ -113,11 +296,7 @@ class Patches extends Component
         }
 
         try {
-            // Get current patch data or create test data if none exists
-            $testPatchData = $this->createTestPatchData();
-
-            // Send test notification
-            $this->server->team->notify(new ServerPatchCheck($this->server, $testPatchData));
+            $this->server->team->notify(new ServerPatchCheck($this->server, $this->createTestPatchData()));
 
             $this->dispatch('success', 'Test email sent successfully! Check your email inbox.');
         } catch (\Exception $e) {
@@ -127,63 +306,19 @@ class Patches extends Component
 
     private function createTestPatchData(): array
     {
-        // If we have real patch data, use it
-        if (isset($this->updates) && is_array($this->updates) && count($this->updates) > 0) {
-            return [
-                'total_updates' => $this->totalUpdates,
-                'updates' => $this->updates,
-                'osId' => $this->osId,
-                'package_manager' => $this->packageManager,
-            ];
+        if (count(data_get($this->result, 'updates', [])) > 0) {
+            return $this->result;
         }
 
-        // Otherwise create realistic test data
         return [
-            'total_updates' => 8,
+            'total_updates' => 3,
             'updates' => [
-                [
-                    'package' => 'docker-ce',
-                    'current_version' => '24.0.7-1',
-                    'new_version' => '25.0.1-1',
-                ],
-                [
-                    'package' => 'nginx',
-                    'current_version' => '1.20.2-1',
-                    'new_version' => '1.22.1-1',
-                ],
-                [
-                    'package' => 'kernel-generic',
-                    'current_version' => '5.15.0-89',
-                    'new_version' => '5.15.0-91',
-                ],
-                [
-                    'package' => 'openssh-server',
-                    'current_version' => '8.9p1-3',
-                    'new_version' => '9.0p1-1',
-                ],
-                [
-                    'package' => 'curl',
-                    'current_version' => '7.81.0-1',
-                    'new_version' => '7.85.0-1',
-                ],
-                [
-                    'package' => 'git',
-                    'current_version' => '2.34.1-1',
-                    'new_version' => '2.39.1-1',
-                ],
-                [
-                    'package' => 'python3',
-                    'current_version' => '3.10.6-1',
-                    'new_version' => '3.11.0-1',
-                ],
-                [
-                    'package' => 'htop',
-                    'current_version' => '3.2.1-1',
-                    'new_version' => '3.2.2-1',
-                ],
+                ['package' => 'docker-ce', 'current_version' => '24.0.7-1', 'new_version' => '25.0.1-1', 'architecture' => 'amd64', 'repository' => 'stable'],
+                ['package' => 'openssh-server', 'current_version' => '8.9p1-3', 'new_version' => '9.0p1-1', 'architecture' => 'amd64', 'repository' => 'noble-security'],
+                ['package' => 'curl', 'current_version' => '7.81.0-1', 'new_version' => '7.85.0-1', 'architecture' => 'amd64', 'repository' => 'noble-updates'],
             ],
-            'osId' => $this->osId ?? 'ubuntu',
-            'package_manager' => $this->packageManager ?? 'apt',
+            'osId' => 'ubuntu',
+            'package_manager' => 'apt',
         ];
     }
 
diff --git a/app/Livewire/Server/Show.php b/app/Livewire/Server/Show.php
index 95be378cfa..ff5751ed2a 100644
--- a/app/Livewire/Server/Show.php
+++ b/app/Livewire/Server/Show.php
@@ -10,6 +10,7 @@ use App\Models\Server;
 use App\Rules\ValidServerIp;
 use App\Services\DigitalOceanService;
 use App\Services\HetznerService;
+use App\Services\HostingerService;
 use App\Services\ServerTransfer\ServerTransferClaimer;
 use App\Services\VultrService;
 use App\Support\ValidationPatterns;
@@ -82,12 +83,16 @@ class Show extends Component
 
     public ?string $digitalOceanDropletStatus = null;
 
+    public ?string $hostingerVirtualMachineStatus = null;
+
     public bool $hetznerServerManuallyStarted = false;
 
     public bool $vultrInstanceManuallyStarted = false;
 
     public bool $digitalOceanDropletManuallyStarted = false;
 
+    public bool $hostingerVirtualMachineManuallyStarted = false;
+
     public bool $isValidating = false;
 
     // Hetzner linking properties
@@ -127,6 +132,18 @@ class Show extends Component
 
     public bool $digitalOceanNoMatchFound = false;
 
+    public Collection $availableHostingerTokens;
+
+    public ?int $selectedHostingerTokenId = null;
+
+    public ?string $manualHostingerVirtualMachineId = null;
+
+    public ?array $matchedHostingerVirtualMachine = null;
+
+    public ?string $hostingerSearchError = null;
+
+    public bool $hostingerNoMatchFound = false;
+
     public function getListeners()
     {
         $teamId = $this->server->team_id ?? auth()->user()->currentTeam()->id;
@@ -206,12 +223,14 @@ class Show extends Component
             $this->hetznerServerStatus = $this->server->hetzner_server_status;
             $this->vultrInstanceStatus = $this->server->vultr_instance_status;
             $this->digitalOceanDropletStatus = $this->server->digitalocean_droplet_status;
+            $this->hostingerVirtualMachineStatus = $this->server->hostinger_virtual_machine_status;
             $this->isValidating = $this->server->is_validating ?? false;
 
             // Load cloud provider tokens for linking
             $this->loadHetznerTokens();
             $this->loadVultrTokens();
             $this->loadDigitalOceanTokens();
+            $this->loadHostingerTokens();
 
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -376,43 +395,46 @@ class Show extends Component
         }
     }
 
-    public function toggleManagement(ServerTransferClaimer $claimer): void
+    /**
+     * Take back a server that was transferred to another instance.
+     */
+    public function enableManagement(ServerTransferClaimer $claimer): void
     {
-        abort_unless(isDev(), 404);
         $this->authorize('update', $this->server);
 
-        if ($this->server->isLocalhost()) {
-            $this->dispatch('error', 'The Coolify host cannot be transferred.');
-
+        if ($this->server->isLocalhost() || ! $this->server->isTransferredAway()) {
             return;
         }
 
-        if ($this->server->isTransferredAway() && $this->server->team->serverOverflow()) {
+        if ($this->server->team->serverOverflow()) {
             $this->dispatch('error', 'Your team is over its server limit. Upgrade your subscription or remove a server first.');
 
             return;
         }
 
-        if ($this->server->isTransferredAway()) {
+        try {
             $claimer->claim($this->server);
-            $event = 'ui.server.management_enabled';
-            $message = 'This Coolify instance now manages the server.';
-        } else {
-            $claimer->markTransferred($this->server, managementDisabled: true);
-            $event = 'ui.server.management_disabled';
-            $message = 'Server automations are disabled on this Coolify instance.';
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return;
         }
 
+        $claimer->restoreAfterTakeBack($this->server->refresh());
         $this->server->refresh();
+        // Sentinel must report here. While it reports to the other instance, that instance does not run
+        // the connection check that reads the owner marker and makes it stop managing the server.
+        $this->server->restartSentinel();
         $this->syncData();
+        $this->dispatch('transferFinishStarted')->to(TransferFinish::class);
 
-        auditLog($event, [
+        auditLog('ui.server.management_enabled', [
             'team_id' => $this->server->team_id,
             'server_uuid' => $this->server->uuid,
             'server_name' => $this->server->name,
         ]);
 
-        $this->dispatch('success', $message);
+        $this->dispatch('success', 'This Coolify instance now manages the server.');
     }
 
     public function checkLocalhostConnection()
@@ -661,6 +683,30 @@ class Show extends Component
         }
     }
 
+    public function checkHostingerVirtualMachineStatus(bool $manual = false): mixed
+    {
+        try {
+            $this->authorize('view', $this->server);
+            if (! $this->server->hostinger_virtual_machine_id || ! $this->server->cloudProviderToken) {
+                $this->dispatch('error', 'This server is not associated with a Hostinger VPS or token.');
+
+                return null;
+            }
+
+            $this->hostingerVirtualMachineStatus = $this->server->refreshHostingerState();
+            $this->server->refresh();
+            $this->ip = $this->server->ip;
+
+            if ($manual) {
+                $this->dispatch('success', 'VPS status refreshed: '.ucfirst($this->hostingerVirtualMachineStatus ?? 'unknown'));
+            }
+
+            return null;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function handleServerValidated($event = null)
     {
         // Check if event is for this server
@@ -682,6 +728,7 @@ class Show extends Component
         $this->loadHetznerTokens();
         $this->loadVultrTokens();
         $this->loadDigitalOceanTokens();
+        $this->loadHostingerTokens();
 
         $this->dispatch('refreshServerShow');
         $this->dispatch('refreshServer');
@@ -753,6 +800,30 @@ class Show extends Component
         }
     }
 
+    public function startHostingerVirtualMachine(): mixed
+    {
+        try {
+            $this->authorize('update', $this->server);
+            if (! $this->server->hostinger_virtual_machine_id || ! $this->server->cloudProviderToken) {
+                $this->dispatch('error', 'This server is not associated with a Hostinger VPS or token.');
+
+                return null;
+            }
+
+            $hostingerService = new HostingerService($this->server->cloudProviderToken->token);
+            $hostingerService->startVirtualMachine((int) $this->server->hostinger_virtual_machine_id);
+
+            $this->hostingerVirtualMachineStatus = 'starting';
+            $this->server->update(['hostinger_virtual_machine_status' => 'starting']);
+            $this->hostingerVirtualMachineManuallyStarted = true;
+            $this->dispatch('success', 'Hostinger VPS is starting...');
+
+            return null;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function refreshServerMetadata(): void
     {
         try {
@@ -807,6 +878,13 @@ class Show extends Component
             ->get();
     }
 
+    public function loadHostingerTokens(): void
+    {
+        $this->availableHostingerTokens = CloudProviderToken::ownedByCurrentTeam()
+            ->where('provider', 'hostinger')
+            ->get();
+    }
+
     #[Computed]
     public function limaStartCommand(): ?string
     {
@@ -1080,6 +1158,136 @@ class Show extends Component
         }
     }
 
+    public function searchHostingerVirtualMachine(): void
+    {
+        $this->hostingerSearchError = null;
+        $this->hostingerNoMatchFound = false;
+        $this->matchedHostingerVirtualMachine = null;
+
+        if (! $this->selectedHostingerTokenId) {
+            $this->hostingerSearchError = 'Please select a Hostinger token.';
+
+            return;
+        }
+
+        try {
+            $this->authorize('update', $this->server);
+            $token = $this->availableHostingerTokens->firstWhere('id', $this->selectedHostingerTokenId);
+
+            if (! $token) {
+                $this->hostingerSearchError = 'Invalid token selected.';
+
+                return;
+            }
+
+            $matched = (new HostingerService($token->token))->findVirtualMachineByIp($this->server->ip);
+
+            if ($matched) {
+                $this->matchedHostingerVirtualMachine = $matched;
+            } else {
+                $this->hostingerNoMatchFound = true;
+            }
+        } catch (\Throwable $e) {
+            $this->hostingerSearchError = 'Failed to search Hostinger virtual machines: '.$e->getMessage();
+        }
+    }
+
+    public function searchHostingerVirtualMachineById(): void
+    {
+        $this->hostingerSearchError = null;
+        $this->hostingerNoMatchFound = false;
+        $this->matchedHostingerVirtualMachine = null;
+
+        if (! $this->selectedHostingerTokenId) {
+            $this->hostingerSearchError = 'Please select a Hostinger token first.';
+
+            return;
+        }
+
+        if (! $this->manualHostingerVirtualMachineId) {
+            $this->hostingerSearchError = 'Please enter a Hostinger Virtual Machine ID.';
+
+            return;
+        }
+
+        try {
+            $this->authorize('update', $this->server);
+            $token = $this->availableHostingerTokens->firstWhere('id', $this->selectedHostingerTokenId);
+
+            if (! $token) {
+                $this->hostingerSearchError = 'Invalid token selected.';
+
+                return;
+            }
+
+            $virtualMachine = (new HostingerService($token->token))
+                ->getVirtualMachine((int) $this->manualHostingerVirtualMachineId);
+
+            if ($virtualMachine) {
+                $this->matchedHostingerVirtualMachine = $virtualMachine;
+            } else {
+                $this->hostingerNoMatchFound = true;
+            }
+        } catch (\Throwable $e) {
+            $this->hostingerSearchError = 'Failed to fetch Hostinger virtual machine: '.$e->getMessage();
+        }
+    }
+
+    public function linkToHostinger(): mixed
+    {
+        if (! $this->matchedHostingerVirtualMachine) {
+            $this->dispatch('error', 'No Hostinger virtual machine selected.');
+
+            return null;
+        }
+
+        try {
+            $this->authorize('update', $this->server);
+            $token = $this->availableHostingerTokens->firstWhere('id', $this->selectedHostingerTokenId);
+
+            if (! $token) {
+                $this->dispatch('error', 'Invalid token selected.');
+
+                return null;
+            }
+
+            $hostingerService = new HostingerService($token->token);
+            $virtualMachine = $hostingerService->getVirtualMachine((int) $this->matchedHostingerVirtualMachine['id']);
+
+            if (! $virtualMachine) {
+                $this->dispatch('error', 'Could not find Hostinger virtual machine with ID: '.$this->matchedHostingerVirtualMachine['id']);
+
+                return null;
+            }
+
+            $updates = [
+                'cloud_provider_token_id' => $this->selectedHostingerTokenId,
+                'hostinger_virtual_machine_id' => $virtualMachine['id'],
+                'hostinger_virtual_machine_status' => $virtualMachine['state'] ?? null,
+            ];
+            $ip = $hostingerService->getPublicIpAddress($virtualMachine);
+            if ($ip) {
+                $updates['ip'] = $ip;
+            }
+
+            $this->server->update($updates);
+            $this->hostingerVirtualMachineStatus = $virtualMachine['state'] ?? null;
+            $this->matchedHostingerVirtualMachine = null;
+            $this->selectedHostingerTokenId = null;
+            $this->manualHostingerVirtualMachineId = null;
+            $this->hostingerNoMatchFound = false;
+            $this->hostingerSearchError = null;
+
+            $this->dispatch('success', 'Server successfully linked to Hostinger!');
+            $this->dispatch('close-modal');
+            $this->dispatch('refreshServerShow');
+
+            return null;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function searchVultrInstance(): void
     {
         $this->vultrSearchError = null;
diff --git a/app/Livewire/Server/Transfer.php b/app/Livewire/Server/Transfer.php
index 8a4cdcd1d9..22bb6d0685 100644
--- a/app/Livewire/Server/Transfer.php
+++ b/app/Livewire/Server/Transfer.php
@@ -3,8 +3,6 @@
 namespace App\Livewire\Server;
 
 use App\Models\Server;
-use App\Services\ServerTransfer\ServerTransferBundle;
-use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferMigrator;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -21,25 +19,27 @@ class Transfer extends Component
 
     public string $targetToken = '';
 
-    /** Manual transfer */
-    /** Encrypts the downloaded file when filled; empty or whitespace means no encryption. */
-    public ?string $passphrase = null;
-
     public ?string $exportId = null;
 
+    /** Transfer back fields, shown for an archive */
+    public string $managerUrl = '';
+
+    public string $managerToken = '';
+
+    public string $thisInstanceUrl = '';
+
     /** @var list<string> */
     public array $lastWarnings = [];
 
-    public ?string $lastResultJson = null;
-
     public function mount(string $server_uuid): void
     {
-        $this->ensureDevelopmentAvailability();
-
         try {
             $this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
-            $this->authorize('view', $this->server);
+            // The transfer exports every credential of the server, so only admins and owners may open it.
+            $this->authorize('update', $this->server);
             $this->exportId = data_get($this->server->server_metadata, 'transfer.export_id');
+            $this->managerUrl = (string) data_get($this->server->server_metadata, 'transfer.target_instance_url', '');
+            $this->thisInstanceUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
         } catch (Throwable $e) {
             handleError($e, $this);
             $this->redirect(route('server.index'), navigate: true);
@@ -51,72 +51,86 @@ class Transfer extends Component
         return (int) $this->server->id === 0;
     }
 
+    /**
+     * State of the queued transfer to another instance, read by the page poll.
+     *
+     * @return array<string, mixed>|null
+     */
+    public function getMigrationProperty(): ?array
+    {
+        $migration = data_get($this->server->server_metadata, 'migration');
+
+        return is_array($migration) ? $migration : null;
+    }
+
+    /**
+     * Manual steps of a finished transfer that the target instance cannot do.
+     *
+     * @return list<string>
+     */
+    public function getPostTransferChecklistProperty(): array
+    {
+        if (data_get($this->migration, 'status') !== 'succeeded') {
+            return [];
+        }
+
+        return array_values(array_filter((array) data_get($this->migration, 'checklist', []), 'is_string'));
+    }
+
+    public function refreshMigration(): void
+    {
+        $this->server->refresh();
+        $this->lastWarnings = array_values((array) data_get($this->migration, 'warnings', $this->lastWarnings));
+    }
+
     public function migrateServer(ServerTransferMigrator $migrator): void
     {
-        $this->ensureDevelopmentAvailability();
-
         try {
             $this->authorize('update', $this->server);
             if ($this->isLocalhost) {
                 throw new \RuntimeException('The Coolify host (localhost) cannot be transferred.');
             }
 
-            $result = $migrator->migrate(
+            $migrator->start(
                 server: $this->server,
                 targetUrl: $this->targetUrl,
                 targetToken: $this->targetToken,
             );
 
+            auditLog('ui.server.migrate', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'target_url' => $this->targetUrl,
+            ]);
+
             $this->server->refresh();
-            $this->exportId = $result['export_id'] ?? $this->exportId;
-            $this->lastWarnings = array_values((array) data_get($result, 'warnings', []));
-            // Never echo the target token in the result dump.
-            $safe = $result;
-            unset($safe['target_token']);
-            $this->lastResultJson = json_encode($safe, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+            $this->lastWarnings = [];
             $this->targetToken = '';
-            $this->dispatch('success', $result['message'] ?? 'Server transferred.');
+            $this->dispatch('success', 'All checks passed. The transfer started.');
         } catch (Throwable $e) {
+            // A failed check is saved in the transfer log, so show it.
+            $this->server->refresh();
             handleError($e, $this);
         }
     }
 
-    public function exportBundle(ServerTransferExporter $exporter)
+    public function transferBack(ServerTransferMigrator $migrator): void
     {
-        $this->ensureDevelopmentAvailability();
-
         try {
             $this->authorize('update', $this->server);
-            if ($this->isLocalhost) {
-                throw new \RuntimeException('The Coolify host (localhost) cannot be transferred.');
-            }
+            $migrator->requestTransferBack($this->server, auth()->user(), $this->managerUrl, $this->managerToken, $this->thisInstanceUrl);
 
-            $bundle = $exporter->export($this->server, includeSensitive: true);
-            $this->exportId = data_get($bundle, 'export_id');
-            $this->lastWarnings = array_values((array) data_get($bundle, 'warnings', []));
-            $this->lastResultJson = null;
-
-            $payload = $bundle;
-            $fileName = 'server-transfer-'.$this->server->uuid.'.json';
-            if (filled($this->passphrase)) {
-                $payload = ServerTransferBundle::encryptWithPassphrase($bundle, $this->passphrase);
-                $fileName = 'server-transfer-'.$this->server->uuid.'.encrypted.json';
-            }
-
-            $json = json_encode($payload, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
-            if ($json === false) {
-                throw new \RuntimeException('Failed to encode transfer bundle.');
-            }
-
-            $this->dispatch('success', 'Transfer bundle ready for download.');
-
-            return response()->streamDownload(function () use ($json) {
-                echo $json;
-            }, $fileName, [
-                'Content-Type' => 'application/json',
+            auditLog('ui.server.transfer_back', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'from' => $this->managerUrl,
             ]);
+
+            $this->server->refresh();
+            $this->managerToken = '';
+            $this->dispatch('success', 'The other instance started the transfer back.');
         } catch (Throwable $e) {
-            return handleError($e, $this);
+            handleError($e, $this);
         }
     }
 
@@ -124,9 +138,4 @@ class Transfer extends Component
     {
         return view('livewire.server.transfer');
     }
-
-    private function ensureDevelopmentAvailability(): void
-    {
-        abort_unless(isDev(), 404);
-    }
 }
diff --git a/app/Livewire/Server/TransferFinish.php b/app/Livewire/Server/TransferFinish.php
new file mode 100644
index 0000000000..e60664ed0c
--- /dev/null
+++ b/app/Livewire/Server/TransferFinish.php
@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Livewire\Server;
+
+use App\Jobs\CheckTransferFinishStepsJob;
+use App\Models\Server;
+use App\Services\ServerTransfer\TransferFinishChecklist;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+/**
+ * The "Finish the transfer" list on the server page. A separate component, so its refresh does not re-render the
+ * server form.
+ */
+class TransferFinish extends Component
+{
+    use AuthorizesRequests;
+
+    public Server $server;
+
+    public function getListeners(): array
+    {
+        return [
+            "echo-private:team.{$this->server->team_id},TransferFinishChanged" => 'handleTransferFinishChanged',
+        ];
+    }
+
+    /**
+     * The server page sends this after a take back, which starts a new list.
+     */
+    #[On('transferFinishStarted')]
+    public function reloadServer(): void
+    {
+        $this->server->refresh();
+    }
+
+    /**
+     * A background check, or a user in another tab, changed a step of this list.
+     */
+    public function handleTransferFinishChanged(array $event): void
+    {
+        if (($event['serverUuid'] ?? null) === $this->server->uuid) {
+            $this->server->refresh();
+        }
+    }
+
+    /**
+     * Start the background checks when they are stale. Called when the panel loads and by its poll.
+     */
+    public function refreshSteps(TransferFinishChecklist $checklist): void
+    {
+        $this->server->refresh();
+        if (auth()->user()?->can('update', $this->server)) {
+            $checklist->checkWhenStale($this->server);
+        }
+    }
+
+    public function checkAllNow(): void
+    {
+        $this->authorize('update', $this->server);
+        CheckTransferFinishStepsJob::dispatch($this->server);
+    }
+
+    public function checkStep(TransferFinishChecklist $checklist, string $key): void
+    {
+        $this->authorize('update', $this->server);
+        $checklist->check($this->server, $key);
+    }
+
+    public function fixStep(TransferFinishChecklist $checklist, string $key): void
+    {
+        $this->authorize('update', $this->server);
+        $item = $checklist->fix($this->server, $key);
+        $toast = match ($item['status']) {
+            'ok' => 'success',
+            'pending' => 'info',
+            default => 'error',
+        };
+        $this->dispatch($toast, $item['message'] ?? 'Done.');
+    }
+
+    public function markStepDone(TransferFinishChecklist $checklist, string $key): void
+    {
+        $this->authorize('update', $this->server);
+        $checklist->markDone($this->server, $key);
+    }
+
+    public function finishTransfer(TransferFinishChecklist $checklist): void
+    {
+        $this->authorize('update', $this->server);
+        $skipped = count($checklist->openItems($this->server));
+        $checklist->finish($this->server, auth()->user());
+
+        auditLog('ui.server.transfer_finished', [
+            'team_id' => $this->server->team_id,
+            'server_uuid' => $this->server->uuid,
+            'skipped_steps' => $skipped,
+        ]);
+
+        $this->dispatch('success', 'The transfer is finished.');
+    }
+
+    public function render()
+    {
+        $checklist = app(TransferFinishChecklist::class);
+        $finish = $checklist->isOpen($this->server) ? $checklist->of($this->server) : null;
+        $items = collect($finish['items'] ?? []);
+        $openItems = $items->filter(fn (array $item) => in_array($item['status'], TransferFinishChecklist::OPEN_STATUSES, true));
+
+        return view('livewire.server.transfer-finish', [
+            'checklist' => $checklist,
+            'finish' => $finish,
+            'openGroups' => collect(TransferFinishChecklist::GROUPS)
+                ->map(fn (string $label, string $group) => ['label' => $label, 'items' => $openItems->filter(fn (array $item) => $checklist->groupOf($item) === $group)->values()])
+                ->filter(fn (array $group) => $group['items']->isNotEmpty()),
+            'doneItems' => $items->reject(fn (array $item) => in_array($item['status'], TransferFinishChecklist::OPEN_STATUSES, true))->values(),
+            'openCount' => $openItems->count(),
+            'totalCount' => $items->count(),
+        ]);
+    }
+}
diff --git a/app/Livewire/Server/TransferImport.php b/app/Livewire/Server/TransferImport.php
deleted file mode 100644
index 97bb6c5c7d..0000000000
--- a/app/Livewire/Server/TransferImport.php
+++ /dev/null
@@ -1,150 +0,0 @@
-<?php
-
-namespace App\Livewire\Server;
-
-use App\Models\Server;
-use App\Services\ServerTransfer\ServerTransferBundle;
-use App\Services\ServerTransfer\ServerTransferImporter;
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Livewire\Component;
-use Livewire\Features\SupportFileUploads\TemporaryUploadedFile;
-use Livewire\WithFileUploads;
-use Throwable;
-
-class TransferImport extends Component
-{
-    use AuthorizesRequests;
-    use WithFileUploads;
-
-    public string $bundleJson = '';
-
-    public string $passphrase = '';
-
-    public bool $preserveUuids = true;
-
-    public bool $adoptMode = true;
-
-    /** @var TemporaryUploadedFile|null */
-    public $bundleFile = null;
-
-    /** @var array<string, mixed>|null */
-    public ?array $lastResult = null;
-
-    /** @var list<string> */
-    public array $lastWarnings = [];
-
-    public ?string $importedServerUuid = null;
-
-    public function mount(): void
-    {
-        $this->ensureDevelopmentAvailability();
-        $this->authorize('create', Server::class);
-    }
-
-    public function updatedBundleFile(): void
-    {
-        $this->ensureDevelopmentAvailability();
-
-        if (! $this->bundleFile) {
-            return;
-        }
-        try {
-            $contents = $this->bundleFile->get();
-            if (! is_string($contents) || blank($contents)) {
-                throw new \RuntimeException('Uploaded file is empty.');
-            }
-            $this->bundleJson = $contents;
-            $this->dispatch('success', 'Bundle file loaded into the form.');
-        } catch (Throwable $e) {
-            handleError($e, $this);
-        }
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    private function resolveBundle(): array
-    {
-        $raw = trim($this->bundleJson);
-        if ($raw === '') {
-            throw new \RuntimeException('Paste a transfer bundle JSON or upload a file.');
-        }
-
-        $decoded = json_decode($raw, true);
-        if (! is_array($decoded)) {
-            throw new \RuntimeException('Bundle is not valid JSON.');
-        }
-
-        if (data_get($decoded, 'encrypted')) {
-            if (blank($this->passphrase)) {
-                throw new \RuntimeException('Passphrase is required for encrypted bundles.');
-            }
-
-            return ServerTransferBundle::decryptWithPassphrase($decoded, $this->passphrase);
-        }
-
-        return $decoded;
-    }
-
-    public function dryRun(ServerTransferImporter $importer): void
-    {
-        $this->ensureDevelopmentAvailability();
-        $this->runImport($importer, dryRun: true);
-    }
-
-    public function importBundle(ServerTransferImporter $importer): void
-    {
-        $this->ensureDevelopmentAvailability();
-        $this->runImport($importer, dryRun: false);
-    }
-
-    private function runImport(ServerTransferImporter $importer, bool $dryRun): void
-    {
-        try {
-            $this->authorize('create', Server::class);
-            $teamId = currentTeam()->id;
-            $bundle = $this->resolveBundle();
-
-            $result = $importer->import(
-                bundle: $bundle,
-                teamId: $teamId,
-                dryRun: $dryRun,
-                preserveUuids: $this->preserveUuids,
-                adoptMode: $this->adoptMode,
-            );
-
-            $this->lastResult = $result;
-            $this->lastWarnings = array_values((array) data_get($result, 'warnings', []));
-            $this->importedServerUuid = $dryRun ? null : data_get($result, 'server_uuid');
-
-            if (! $dryRun) {
-                auditLog('ui.server.imported', [
-                    'team_id' => $teamId,
-                    'server_uuid' => $this->importedServerUuid,
-                    'claimed' => (bool) data_get($result, 'claimed'),
-                    'adopt_mode' => $this->adoptMode,
-                ]);
-            }
-
-            if ($dryRun) {
-                $this->dispatch('success', 'Dry run completed — nothing was written.');
-            } elseif (data_get($result, 'claimed')) {
-                $this->dispatch('success', 'Server imported. This instance now manages it.');
-            } else {
-                $this->dispatch('success', 'Server imported, but management could not be enabled. Check the warnings, then click Enable management on the server page.');
-            }
-        } catch (Throwable $e) {
-            handleError($e, $this);
-        }
-    }
-
-    public function render()
-    {
-        return view('livewire.server.transfer-import');
-    }
-
-    private function ensureDevelopmentAvailability(): void
-    {
-        abort_unless(isDev(), 404);
-    }
-}
diff --git a/app/Livewire/Server/ValidateAndInstall.php b/app/Livewire/Server/ValidateAndInstall.php
index 33b77418d6..407f5f31d2 100644
--- a/app/Livewire/Server/ValidateAndInstall.php
+++ b/app/Livewire/Server/ValidateAndInstall.php
@@ -145,6 +145,18 @@ class ValidateAndInstall extends Component
                 }
             }
 
+            if ($this->server->hostinger_virtual_machine_id) {
+                $status = $this->server->refreshHostingerState();
+                $this->server->refresh();
+
+                if (in_array($status, ['stopping', 'stopped', 'suspending', 'suspended', 'destroying', 'destroyed', 'error'], true)) {
+                    $this->error = 'Hostinger VPS is '.($status ?? 'not running').'. Power it on before validating.';
+                    $this->server->update(['validation_logs' => $this->error]);
+
+                    return;
+                }
+            }
+
             ['uptime' => $this->uptime, 'error' => $error] = $this->server->validateConnection();
             if (! $this->uptime) {
                 $sanitizedError = htmlspecialchars($error ?? '', ENT_QUOTES, 'UTF-8');
diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php
index a3855eac3b..86060ddd3f 100644
--- a/app/Livewire/Settings/Advanced.php
+++ b/app/Livewire/Settings/Advanced.php
@@ -6,6 +6,7 @@ use App\Models\InstanceSettings;
 use App\Models\S3Storage;
 use App\Rules\ValidDnsServers;
 use App\Rules\ValidIpOrCidr;
+use App\Services\FileDownloadStorageService;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -41,6 +42,9 @@ class Advanced extends Component
     #[Validate('boolean')]
     public bool $disable_two_step_confirmation;
 
+    #[Validate('boolean')]
+    public bool $is_passkey_enabled;
+
     #[Validate('boolean')]
     public bool $is_wire_navigate_enabled;
 
@@ -60,6 +64,8 @@ class Advanced extends Component
 
     public array $avatar_storage_options = [];
 
+    public string $file_download_storage = 'stream';
+
     public function rules()
     {
         return [
@@ -72,6 +78,7 @@ class Advanced extends Component
             'allowed_ips' => ['nullable', 'string', new ValidIpOrCidr],
             'is_sponsorship_popup_enabled' => 'boolean',
             'disable_two_step_confirmation' => 'boolean',
+            'is_passkey_enabled' => 'boolean',
             'is_wire_navigate_enabled' => 'boolean',
             'is_mcp_server_enabled' => 'boolean',
             'webhook_allowed_internal_hosts' => 'nullable|string',
@@ -95,6 +102,7 @@ class Advanced extends Component
         $this->is_dns_validation_enabled = $this->settings->is_dns_validation_enabled;
         $this->is_api_enabled = $this->settings->is_api_enabled;
         $this->disable_two_step_confirmation = $this->settings->disable_two_step_confirmation;
+        $this->is_passkey_enabled = $this->settings->is_passkey_enabled ?? true;
         $this->is_sponsorship_popup_enabled = $this->settings->is_sponsorship_popup_enabled;
         $this->is_wire_navigate_enabled = $this->settings->is_wire_navigate_enabled ?? true;
         $this->is_mcp_server_enabled = $this->settings->is_mcp_server_enabled ?? false;
@@ -118,6 +126,9 @@ class Advanced extends Component
                     'label' => $storage->name.' (S3)',
                 ])->all(),
         ];
+        $this->file_download_storage = $this->settings->file_download_s3_storage_id
+            ? 's3:'.$this->settings->file_download_s3_storage_id
+            : 'stream';
     }
 
     public function submit()
@@ -216,12 +227,14 @@ class Advanced extends Component
             $this->settings->allowed_ips = $this->allowed_ips;
             $this->settings->is_sponsorship_popup_enabled = $this->is_sponsorship_popup_enabled;
             $this->settings->disable_two_step_confirmation = $this->disable_two_step_confirmation;
+            $this->settings->is_passkey_enabled = $this->is_passkey_enabled;
             $this->settings->is_wire_navigate_enabled = $this->is_wire_navigate_enabled;
             $this->settings->is_mcp_server_enabled = $this->is_mcp_server_enabled;
             $this->settings->webhook_allowed_internal_hosts = $webhookAllowedInternalHosts ?? $this->settings->webhook_allowed_internal_hosts ?? [];
             $this->settings->webhook_allow_localhost = $this->webhook_allow_localhost;
             $this->settings->image_cdn_url = filled($this->image_cdn_url) ? rtrim($this->image_cdn_url, '/') : null;
             $this->saveAvatarStorageSetting();
+            $this->saveFileDownloadStorageSetting();
             $this->saveAndAudit();
             $this->dispatch('success', 'Settings updated!');
         } catch (\Exception $e) {
@@ -252,6 +265,48 @@ class Advanced extends Component
         $this->settings->avatar_s3_storage_id = $storage->id;
     }
 
+    /**
+     * Selecting a storage adds the auto-delete lifecycle rule to its bucket.
+     * The setting is refused when the bucket is listable by anonymous users
+     * or does not accept the rule.
+     */
+    private function saveFileDownloadStorageSetting(): void
+    {
+        if ($this->file_download_storage === 'stream') {
+            $this->settings->file_download_s3_storage_id = null;
+
+            return;
+        }
+
+        $storageId = (int) str($this->file_download_storage)->after('s3:')->value();
+        if ($storageId === $this->settings->file_download_s3_storage_id) {
+            return;
+        }
+
+        $storage = S3Storage::query()
+            ->whereTeamId(0)
+            ->where('is_usable', true)
+            ->find($storageId);
+
+        if (! $storage || $this->file_download_storage !== 's3:'.$storage->id) {
+            $this->file_download_storage = 'stream';
+            throw new \InvalidArgumentException('The selected file download storage is not available.');
+        }
+
+        try {
+            $downloads = app(FileDownloadStorageService::class);
+            $downloads->ensureBucketIsPrivate($storage);
+            $downloads->ensureLifecycleRule($storage);
+        } catch (\RuntimeException $e) {
+            $this->file_download_storage = $this->settings->file_download_s3_storage_id
+                ? 's3:'.$this->settings->file_download_s3_storage_id
+                : 'stream';
+            throw $e;
+        }
+
+        $this->settings->file_download_s3_storage_id = $storage->id;
+    }
+
     public function clearDomainConnectPrivateKey(): void
     {
         try {
diff --git a/app/Livewire/Settings/Updates.php b/app/Livewire/Settings/Updates.php
index aba7521dd9..27fe705423 100644
--- a/app/Livewire/Settings/Updates.php
+++ b/app/Livewire/Settings/Updates.php
@@ -159,7 +159,7 @@ class Updates extends Component
     public function checkManually()
     {
         $this->authorize('update', $this->settings);
-        CheckForUpdatesJob::dispatchSync();
+        CheckForUpdatesJob::dispatchSync(cdnTries: 1);
         $this->dispatch('updateAvailable');
         $settings = instanceSettings();
         if ($settings->new_version_available) {
diff --git a/app/Livewire/SettingsBackup.php b/app/Livewire/SettingsBackup.php
index fb4cda6d97..d7eaf7d596 100644
--- a/app/Livewire/SettingsBackup.php
+++ b/app/Livewire/SettingsBackup.php
@@ -34,6 +34,8 @@ class SettingsBackup extends Component
     #[Validate(['nullable'])]
     public ?string $description = null;
 
+    public bool $is_backup_before_update_enabled;
+
     public function mount()
     {
         if (! isInstanceAdmin()) {
@@ -59,6 +61,7 @@ class SettingsBackup extends Component
             $this->executions = $this->backup?->executions ?? [];
         }
         $this->settings = $settings;
+        $this->is_backup_before_update_enabled = $settings->is_backup_before_update_enabled;
         $this->s3s = $s3s;
     }
 
@@ -116,6 +119,27 @@ class SettingsBackup extends Component
         }
     }
 
+    public function instantSave()
+    {
+        try {
+            $this->authorize('update', $this->settings);
+            $this->settings->is_backup_before_update_enabled = $this->is_backup_before_update_enabled;
+            $changedFields = auditChangedFields($this->settings);
+            $this->settings->save();
+            if ($changedFields !== []) {
+                auditLog('ui.instance.settings.updated', [
+                    'team_id' => null,
+                    'resource' => 'instance',
+                    'section' => 'backup',
+                    'changed_fields' => $changedFields,
+                ]);
+            }
+            $this->dispatch('success', 'Backup updated.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function submit()
     {
         try {
diff --git a/app/Livewire/SharedVariables/Canvas.php b/app/Livewire/SharedVariables/Canvas.php
new file mode 100644
index 0000000000..44304cafce
--- /dev/null
+++ b/app/Livewire/SharedVariables/Canvas.php
@@ -0,0 +1,147 @@
+<?php
+
+namespace App\Livewire\SharedVariables;
+
+use App\Livewire\Concerns\RemembersCanvasView;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Services\SharedVariableCanvas;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+/**
+ * Canvas of the shared variables of one scope and the resources that use them.
+ * The page is a shell: resources/js/environment-canvas.js renders it from
+ * Api\SharedVariableCanvasController at /canvas/api with the browser session.
+ */
+class Canvas extends Component
+{
+    use AuthorizesRequests;
+    use RemembersCanvasView;
+
+    #[Locked]
+    public string $scope = 'team';
+
+    #[Locked]
+    public string $endpoint = '';
+
+    #[Locked]
+    public string $listUrl = '';
+
+    /** The team that owned the page at mount; later requests use it, not the session team. */
+    #[Locked]
+    public int $teamId;
+
+    #[Locked]
+    public ?string $projectUuid = null;
+
+    #[Locked]
+    public ?string $environmentUuid = null;
+
+    #[Locked]
+    public ?string $serverUuid = null;
+
+    public function mount(SharedVariableCanvas $canvas, ?string $project_uuid = null, ?string $environment_uuid = null, ?string $server_uuid = null): void
+    {
+        $this->teamId = currentTeam()->id;
+        $this->projectUuid = $project_uuid;
+        $this->environmentUuid = $environment_uuid;
+        $this->serverUuid = $server_uuid;
+        $this->scope = match (true) {
+            $server_uuid !== null => 'server',
+            $environment_uuid !== null => 'environment',
+            $project_uuid !== null => 'project',
+            default => 'team',
+        };
+        $owner = $this->owner();
+        $this->authorize('view', $owner);
+
+        $this->endpoint = $this->scope === 'team'
+            ? '/shared-variables/team/canvas'
+            : "/shared-variables/{$this->scope}/{$owner->uuid}/canvas";
+        $this->listUrl = $canvas->pageLink($this->scope, $owner);
+        $this->rememberView("{$this->scope}_variables", 'canvas');
+    }
+
+    /**
+     * Saves a variable from the "Add variable" modal (the Add component dispatches saveKey),
+     * then reloads the canvas so it shows the new card.
+     *
+     * @param  array{key: string, value: string, is_multiline: bool, is_literal: bool, comment?: ?string}  $data
+     */
+    #[On('saveKey')]
+    public function saveKey(array $data)
+    {
+        try {
+            $owner = $this->owner();
+            $this->authorize('update', $owner);
+
+            if ($this->scope === 'server' && in_array($data['key'], ['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME'])) {
+                throw new \Exception('Cannot create predefined variable.');
+            }
+            if ($owner->environment_variables()->where('key', $data['key'])->exists()) {
+                throw new \Exception('Variable already exists.');
+            }
+            $owner->environment_variables()->create([
+                'key' => $data['key'],
+                'value' => $data['value'],
+                'is_multiline' => $data['is_multiline'],
+                'is_literal' => $data['is_literal'],
+                'comment' => $data['comment'] ?? null,
+                'type' => $this->scope,
+                'team_id' => $this->ownerTeamId($owner),
+            ]);
+
+            return $this->redirect($this->canvasUrl(), navigate: true);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    /**
+     * The team, project, environment, or server whose variables the canvas shows, scoped to the page's team.
+     */
+    private function owner(): Team|Project|Environment|Server
+    {
+        $teamId = $this->teamId;
+
+        return match ($this->scope) {
+            'server' => Server::query()->where('team_id', $teamId)->where('uuid', $this->serverUuid)->firstOrFail(),
+            'environment' => Environment::query()->where('uuid', $this->environmentUuid)
+                ->whereHas('project', fn ($query) => $query->where('team_id', $teamId)->where('uuid', $this->projectUuid))->with('project')->firstOrFail(),
+            'project' => Project::query()->where('team_id', $teamId)->where('uuid', $this->projectUuid)->firstOrFail(),
+            default => Team::query()->findOrFail($teamId),
+        };
+    }
+
+    private function ownerTeamId(Team|Project|Environment|Server $owner): int
+    {
+        return match (true) {
+            $owner instanceof Team => $owner->id,
+            $owner instanceof Environment => $owner->project->team_id,
+            default => $owner->team_id,
+        };
+    }
+
+    private function canvasUrl(): string
+    {
+        return match ($this->scope) {
+            'server' => route('shared-variables.server.canvas', ['server_uuid' => $this->serverUuid]),
+            'environment' => route('shared-variables.environment.canvas', ['project_uuid' => $this->projectUuid, 'environment_uuid' => $this->environmentUuid]),
+            'project' => route('shared-variables.project.canvas', ['project_uuid' => $this->projectUuid]),
+            default => route('shared-variables.team.canvas'),
+        };
+    }
+
+    public function render(): View
+    {
+        return view('livewire.shared-variables.canvas', [
+            'canAddVariables' => auth()->user()->can('update', $this->owner()),
+        ])->layout('layouts.app', ['fullBleed' => true]);
+    }
+}
diff --git a/app/Livewire/SharedVariables/Environment/Show.php b/app/Livewire/SharedVariables/Environment/Show.php
index 5e07fc4f72..73c023f321 100644
--- a/app/Livewire/SharedVariables/Environment/Show.php
+++ b/app/Livewire/SharedVariables/Environment/Show.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\SharedVariables\Environment;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Application;
 use App\Models\Project;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -11,6 +12,7 @@ use Livewire\Component;
 class Show extends Component
 {
     use AuthorizesRequests;
+    use RemembersCanvasView;
 
     public Project $project;
 
@@ -59,6 +61,9 @@ class Show extends Component
 
         $this->project = Project::ownedByCurrentTeam()->where('uuid', $projectUuid)->firstOrFail();
         $this->environment = $this->project->environments()->where('uuid', $environmentUuid)->firstOrFail();
+        if ($this->prefersCanvasView('environment_variables')) {
+            return $this->redirectRoute('shared-variables.environment.canvas', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid], navigate: true);
+        }
         $this->getDevView();
     }
 
diff --git a/app/Livewire/SharedVariables/Index.php b/app/Livewire/SharedVariables/Index.php
index 61c31e9f83..fe8ccc1802 100644
--- a/app/Livewire/SharedVariables/Index.php
+++ b/app/Livewire/SharedVariables/Index.php
@@ -2,12 +2,17 @@
 
 namespace App\Livewire\SharedVariables;
 
+use App\Services\SharedVariableCanvas;
+use Illuminate\View\View;
 use Livewire\Component;
 
 class Index extends Component
 {
-    public function render()
+    public function render(): View
     {
-        return view('livewire.shared-variables.index');
+        // A "my team" page: the overview of the session team's shared variables (keys and counts only).
+        return view('livewire.shared-variables.index', [
+            'overview' => app(SharedVariableCanvas::class)->overview(currentTeam()),
+        ]);
     }
 }
diff --git a/app/Livewire/SharedVariables/Project/Show.php b/app/Livewire/SharedVariables/Project/Show.php
index af06ce7d7f..73590db941 100644
--- a/app/Livewire/SharedVariables/Project/Show.php
+++ b/app/Livewire/SharedVariables/Project/Show.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\SharedVariables\Project;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Project;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
@@ -10,6 +11,7 @@ use Livewire\Component;
 class Show extends Component
 {
     use AuthorizesRequests;
+    use RemembersCanvasView;
 
     public Project $project;
 
@@ -53,6 +55,9 @@ class Show extends Component
             return redirect()->route('dashboard');
         }
         $this->project = $project;
+        if ($this->prefersCanvasView('project_variables')) {
+            return $this->redirectRoute('shared-variables.project.canvas', ['project_uuid' => $project->uuid], navigate: true);
+        }
         $this->getDevView();
     }
 
diff --git a/app/Livewire/SharedVariables/Server/Show.php b/app/Livewire/SharedVariables/Server/Show.php
index ee89b2dcd3..e775c50257 100644
--- a/app/Livewire/SharedVariables/Server/Show.php
+++ b/app/Livewire/SharedVariables/Server/Show.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\SharedVariables\Server;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
@@ -10,6 +11,7 @@ use Livewire\Component;
 class Show extends Component
 {
     use AuthorizesRequests;
+    use RemembersCanvasView;
 
     public Server $server;
 
@@ -58,6 +60,9 @@ class Show extends Component
         }
         $this->authorize('view', $server);
         $this->server = $server;
+        if ($this->prefersCanvasView('server_variables')) {
+            return $this->redirectRoute('shared-variables.server.canvas', ['server_uuid' => $server->uuid], navigate: true);
+        }
         $this->getDevView();
     }
 
diff --git a/app/Livewire/SharedVariables/Team/Index.php b/app/Livewire/SharedVariables/Team/Index.php
index b7052590b2..034e71c223 100644
--- a/app/Livewire/SharedVariables/Team/Index.php
+++ b/app/Livewire/SharedVariables/Team/Index.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\SharedVariables\Team;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\Team;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
@@ -10,6 +11,7 @@ use Livewire\Component;
 class Index extends Component
 {
     use AuthorizesRequests;
+    use RemembersCanvasView;
 
     public Team $team;
 
@@ -46,6 +48,9 @@ class Index extends Component
 
     public function mount()
     {
+        if ($this->prefersCanvasView('team_variables')) {
+            return $this->redirectRoute('shared-variables.team.canvas', navigate: true);
+        }
         $this->team = currentTeam();
         $this->getDevView();
     }
diff --git a/app/Livewire/Source/Gitea/Change.php b/app/Livewire/Source/Gitea/Change.php
new file mode 100644
index 0000000000..e66cc355cb
--- /dev/null
+++ b/app/Livewire/Source/Gitea/Change.php
@@ -0,0 +1,363 @@
+<?php
+
+namespace App\Livewire\Source\Gitea;
+
+use App\Models\GiteaApp;
+use App\Models\PrivateKey;
+use App\Rules\SafeExternalUrl;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+use Livewire\Component;
+
+class Change extends Component
+{
+    use AuthorizesRequests;
+
+    public string $webhook_endpoint = '';
+
+    public string $custom_webhook_endpoint = '';
+
+    public bool $use_custom_webhook_endpoint = false;
+
+    public ?string $ipv4 = null;
+
+    public ?string $ipv6 = null;
+
+    public ?string $fqdn = null;
+
+    public $parameters;
+
+    public ?GiteaApp $gitea_app = null;
+
+    public string $name;
+
+    public string $apiUrl;
+
+    public string $htmlUrl;
+
+    public string $customUser;
+
+    public int $customPort;
+
+    public ?string $clientId = null;
+
+    public ?string $clientSecretInput = null;
+
+    public ?string $webhookSecret = null;
+
+    public ?string $organization = null;
+
+    public bool $isSystemWide;
+
+    public ?int $privateKeyId = null;
+
+    public $applications;
+
+    public $privateKeys;
+
+    public bool $isConnected = false;
+
+    public ?string $redirectUri = null;
+
+    public ?string $oauthState = null;
+
+    private bool $shouldDeriveApiUrlAfterHtmlUrlUpdate = false;
+
+    protected function rules(): array
+    {
+        return [
+            'name' => 'required|string',
+            'apiUrl' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
+            'htmlUrl' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
+            'customUser' => 'required|string',
+            'customPort' => 'required|int',
+            'clientId' => 'nullable|string',
+            'clientSecretInput' => 'nullable|string',
+            'webhookSecret' => 'nullable|string',
+            'organization' => 'nullable|string',
+            'isSystemWide' => 'required|bool',
+            'privateKeyId' => ['nullable', 'integer', Rule::exists('private_keys', 'id')->where('team_id', $this->gitea_app->team_id)],
+            'webhook_endpoint' => ['required', 'string', 'url'],
+            'custom_webhook_endpoint' => ['nullable', 'string', 'url'],
+            'use_custom_webhook_endpoint' => ['required', 'bool'],
+        ];
+    }
+
+    public function updatingHtmlUrl(): void
+    {
+        $this->shouldDeriveApiUrlAfterHtmlUrlUpdate = blank($this->apiUrl)
+            || $this->apiUrl === rtrim($this->htmlUrl, '/').'/api/v1';
+    }
+
+    public function updatedHtmlUrl(): void
+    {
+        if ($this->shouldDeriveApiUrlAfterHtmlUrlUpdate) {
+            $this->apiUrl = rtrim($this->htmlUrl, '/').'/api/v1';
+        }
+    }
+
+    public function updatedWebhookEndpoint(): void
+    {
+        $this->persistRedirectUriFromEndpoint();
+    }
+
+    public function updatedUseCustomWebhookEndpoint(): void
+    {
+        $this->persistRedirectUriFromEndpoint();
+    }
+
+    public function updatedCustomWebhookEndpoint(): void
+    {
+        $this->persistRedirectUriFromEndpoint();
+    }
+
+    private function persistRedirectUriFromEndpoint(): void
+    {
+        $this->refreshRedirectUri();
+
+        if (! $this->gitea_app || blank($this->redirectUri)) {
+            return;
+        }
+
+        try {
+            $this->authorize('update', $this->gitea_app);
+            if ($this->gitea_app->redirect_uri !== $this->redirectUri) {
+                $this->gitea_app->redirect_uri = $this->redirectUri;
+                $this->gitea_app->save();
+            }
+        } catch (\Throwable) {
+            // Keep the live redirect URI even if the user cannot persist yet.
+        }
+    }
+
+    public function mount()
+    {
+        try {
+            $gitea_app_uuid = request()->gitea_app_uuid;
+            $this->gitea_app = GiteaApp::where(function ($query) {
+                $query->where('team_id', currentTeam()->id)->orWhere('is_system_wide', true);
+            })->whereUuid($gitea_app_uuid)->firstOrFail();
+
+            $this->privateKeys = PrivateKey::ownedByCurrentTeamCached();
+            $this->applications = $this->gitea_app->applications;
+
+            $settings = instanceSettings();
+
+            $this->syncData(false);
+
+            $this->isConnected = $this->gitea_app->isConnected();
+            $this->fqdn = $settings->fqdn;
+
+            if ($settings->public_ipv4) {
+                $this->ipv4 = 'http://'.$settings->public_ipv4.':'.config('app.port');
+            }
+            if ($settings->public_ipv6) {
+                $this->ipv6 = 'http://'.$settings->public_ipv6.':'.config('app.port');
+            }
+
+            $this->parameters = get_route_parameters();
+
+            if (isCloud() && ! isDev()) {
+                $this->webhook_endpoint = config('app.url');
+            } else {
+                $this->webhook_endpoint = $this->fqdn ?? $this->ipv4 ?? $this->ipv6 ?? config('app.url') ?? '';
+            }
+
+            // Prefer a previously saved redirect base when it matches one of the selectable endpoints
+            // or when it differs (restore custom mode for self-hosted / tunnel setups).
+            $savedRedirect = $this->gitea_app->redirect_uri;
+            if (filled($savedRedirect)) {
+                $savedBase = rtrim(str($savedRedirect)->before('/webhooks/source/gitea/redirect')->toString(), '/');
+                $known = collect([$this->fqdn, $this->ipv4, $this->ipv6, config('app.url')])
+                    ->filter()
+                    ->map(fn ($url) => rtrim((string) $url, '/'));
+
+                if ($known->contains($savedBase)) {
+                    $this->webhook_endpoint = $savedBase;
+                    $this->use_custom_webhook_endpoint = false;
+                } elseif (! (isCloud() && ! isDev()) && filled($savedBase)) {
+                    $this->use_custom_webhook_endpoint = true;
+                    $this->custom_webhook_endpoint = $savedBase;
+                }
+            }
+
+            $this->refreshRedirectUri();
+
+            $this->oauthState = $this->createOAuthState();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function refreshRedirectUri(): void
+    {
+        $base = $this->resolvePublicBaseUrl();
+        $this->redirectUri = $base === ''
+            ? ''
+            : $base.'/webhooks/source/gitea/redirect';
+    }
+
+    public function resolvePublicBaseUrl(): string
+    {
+        if ($this->use_custom_webhook_endpoint && filled($this->custom_webhook_endpoint)) {
+            return rtrim($this->custom_webhook_endpoint, '/');
+        }
+
+        return rtrim($this->webhook_endpoint ?: (config('app.url') ?? ''), '/');
+    }
+
+    public static function oauthStateCacheKey(string $state): string
+    {
+        return 'gitea-app-oauth-state:'.hash('sha256', $state);
+    }
+
+    private function createOAuthState(): string
+    {
+        $state = Str::random(64);
+
+        Cache::put(self::oauthStateCacheKey($state), [
+            'gitea_app_id' => $this->gitea_app->id,
+            'team_id' => currentTeam()->id,
+        ], now()->addMinutes(60));
+
+        return $state;
+    }
+
+    private function syncData(bool $toModel = false): void
+    {
+        if ($toModel) {
+            $this->gitea_app->name = $this->name;
+            $this->gitea_app->api_url = $this->apiUrl;
+            $this->gitea_app->html_url = rtrim($this->htmlUrl, '/');
+            $this->gitea_app->custom_user = $this->customUser;
+            $this->gitea_app->custom_port = $this->customPort;
+            $this->gitea_app->client_id = $this->clientId;
+            if (! empty($this->clientSecretInput)) {
+                $this->gitea_app->client_secret = $this->clientSecretInput;
+            }
+            if (! empty($this->webhookSecret)) {
+                $this->gitea_app->webhook_secret = $this->webhookSecret;
+            }
+            $this->gitea_app->organization = $this->organization;
+            $this->gitea_app->is_system_wide = $this->isSystemWide;
+            $this->gitea_app->private_key_id = $this->privateKeyId;
+            $this->refreshRedirectUri();
+            $this->gitea_app->redirect_uri = $this->redirectUri;
+        } else {
+            $this->name = $this->gitea_app->name;
+            $this->apiUrl = $this->gitea_app->api_url;
+            $this->htmlUrl = $this->gitea_app->html_url;
+            $this->customUser = $this->gitea_app->custom_user;
+            $this->customPort = $this->gitea_app->custom_port;
+            $this->clientId = $this->gitea_app->client_id;
+            if (Gate::allows('update', $this->gitea_app)) {
+                $this->clientSecretInput = $this->gitea_app->client_secret;
+                $this->webhookSecret = $this->gitea_app->webhook_secret;
+            }
+            $this->organization = $this->gitea_app->organization;
+            $this->isSystemWide = $this->gitea_app->is_system_wide;
+            $this->privateKeyId = $this->gitea_app->private_key_id;
+        }
+    }
+
+    public function submit()
+    {
+        try {
+            $this->authorize('update', $this->gitea_app);
+
+            $this->validate();
+
+            $this->syncData(true);
+            $this->gitea_app->save();
+            $this->dispatch('success', 'Gitea App updated.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function instantSave()
+    {
+        try {
+            $this->authorize('update', $this->gitea_app);
+
+            $this->validateOnly('isSystemWide');
+
+            $this->gitea_app->is_system_wide = $this->isSystemWide;
+            $this->gitea_app->save();
+            $this->dispatch('success', 'Gitea App updated.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function testConnection()
+    {
+        try {
+            $this->authorize('view', $this->gitea_app);
+
+            if (! $this->gitea_app->isConnected()) {
+                $this->dispatch('error', 'Gitea App is not connected. Please complete the OAuth flow first.');
+
+                return;
+            }
+
+            refreshGiteaToken($this->gitea_app);
+
+            $apiUrl = $this->gitea_app->apiUrlBase();
+            $response = Http::Gitea($apiUrl, $this->gitea_app->access_token)
+                ->timeout(10)
+                ->get('/user');
+
+            if ($response->successful()) {
+                $login = data_get($response->json(), 'login', 'unknown');
+                $this->dispatch('success', "Connection successful! Authenticated as: {$login}");
+            } else {
+                $error = data_get($response->json(), 'message', 'Unknown error');
+                $this->dispatch('error', "Connection failed: {$error}");
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function delete()
+    {
+        try {
+            $this->authorize('delete', $this->gitea_app);
+
+            if ($this->gitea_app->applications->isNotEmpty()) {
+                $this->dispatch('error', 'This source is being used by an application. Please delete all applications first.');
+
+                return;
+            }
+            $this->gitea_app->delete();
+            // Clear so post-delete Livewire re-render / modal $refresh does not re-run
+            // @can and canGate checks against a deleted model (null team_id TypeError).
+            $this->gitea_app = null;
+
+            return redirectRoute($this, 'source.all');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function getOAuthUrl(): string
+    {
+        $this->refreshRedirectUri();
+        $baseUrl = rtrim($this->htmlUrl, '/');
+
+        $query = http_build_query([
+            'client_id' => $this->clientId,
+            'redirect_uri' => $this->redirectUri,
+            'response_type' => 'code',
+            'scope' => 'read:user read:repository read:organization',
+            'state' => $this->oauthState ??= $this->createOAuthState(),
+        ]);
+
+        return "{$baseUrl}/login/oauth/authorize?{$query}";
+    }
+}
diff --git a/app/Livewire/Source/Gitea/Create.php b/app/Livewire/Source/Gitea/Create.php
new file mode 100644
index 0000000000..5b7e2a7719
--- /dev/null
+++ b/app/Livewire/Source/Gitea/Create.php
@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Livewire\Source\Gitea;
+
+use App\Models\GiteaApp;
+use App\Rules\SafeExternalUrl;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+use Livewire\Component;
+
+class Create extends Component
+{
+    use AuthorizesRequests;
+
+    public string $name;
+
+    public string $html_url = 'https://gitea.com';
+
+    public string $api_url = 'https://gitea.com/api/v1';
+
+    public string $custom_user = 'git';
+
+    public int $custom_port = 22;
+
+    public bool $is_system_wide = false;
+
+    public ?string $organization = null;
+
+    private bool $shouldDeriveApiUrlAfterHtmlUrlUpdate = false;
+
+    public function mount()
+    {
+        $this->name = substr(generate_random_name(), 0, 30);
+    }
+
+    public function updatingHtmlUrl(): void
+    {
+        $this->shouldDeriveApiUrlAfterHtmlUrlUpdate = blank($this->api_url)
+            || $this->api_url === $this->giteaApiUrlFromHtmlUrl($this->html_url);
+    }
+
+    public function updatedHtmlUrl(): void
+    {
+        if ($this->shouldDeriveApiUrlAfterHtmlUrlUpdate) {
+            $this->api_url = $this->giteaApiUrlFromHtmlUrl($this->html_url);
+        }
+    }
+
+    public function createGiteaApp()
+    {
+        try {
+            $this->authorize('createAnyResource');
+
+            $this->html_url = rtrim($this->html_url, '/');
+            $this->api_url = filled($this->api_url)
+                ? rtrim($this->api_url, '/')
+                : $this->giteaApiUrlFromHtmlUrl($this->html_url);
+
+            $this->validate([
+                'name' => 'required|string',
+                'html_url' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
+                'api_url' => ['required', 'string', 'url', SafeExternalUrl::forGitSource()],
+                'custom_user' => 'required|string',
+                'custom_port' => 'required|int',
+                'is_system_wide' => 'required|bool',
+                'organization' => 'nullable|string',
+            ]);
+
+            $gitea_app = GiteaApp::create([
+                'name' => $this->name,
+                'api_url' => $this->api_url,
+                'html_url' => $this->html_url,
+                'custom_user' => $this->custom_user,
+                'custom_port' => $this->custom_port,
+                'is_system_wide' => $this->is_system_wide,
+                'organization' => $this->organization,
+                'webhook_secret' => Str::random(32),
+                'team_id' => currentTeam()->id,
+            ]);
+
+            if (session('from')) {
+                session(['from' => session('from') + ['source_id' => $gitea_app->id]]);
+            }
+
+            return redirectRoute($this, 'source.gitea.show', ['gitea_app_uuid' => $gitea_app->uuid]);
+        } catch (ValidationException $e) {
+            throw $e;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    private function giteaApiUrlFromHtmlUrl(string $htmlUrl): string
+    {
+        return rtrim($htmlUrl, '/').'/api/v1';
+    }
+}
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index 7e0753ad69..ca59577ccb 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -372,14 +372,7 @@ class Change extends Component
 
     public function getGithubAppNameUpdatePath()
     {
-        $name = encodeGithubPathSegment($this->github_app->name);
-        $organization = normalizeGithubOrganization($this->github_app->organization);
-
-        if (filled($organization)) {
-            return rtrim($this->github_app->html_url, '/').'/organizations/'.encodeGithubPathSegment($organization)."/settings/apps/{$name}";
-        }
-
-        return rtrim($this->github_app->html_url, '/')."/settings/apps/{$name}";
+        return $this->github_app->settingsUrl();
     }
 
     public function updateGithubAppName()
diff --git a/app/Livewire/Storage/Resources.php b/app/Livewire/Storage/Resources.php
index 95e7917515..306a6a4a5f 100644
--- a/app/Livewire/Storage/Resources.php
+++ b/app/Livewire/Storage/Resources.php
@@ -9,6 +9,7 @@ use App\Models\ScheduledVolumeBackup;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -26,7 +27,7 @@ class Resources extends Component
     {
         $this->authorize('view', $this->storage);
 
-        $backups = ScheduledDatabaseBackup::where('s3_storage_id', $this->storage->id)
+        $backups = $this->backupsUsingStorage(ScheduledDatabaseBackup::query())
             ->where('save_s3', true)
             ->get();
 
@@ -34,8 +35,7 @@ class Resources extends Component
             $this->selectedStorages[$backup->id] = $this->storage->id;
         }
 
-        ScheduledVolumeBackup::query()
-            ->where('s3_storage_id', $this->storage->id)
+        $this->backupsUsingStorage(ScheduledVolumeBackup::query())
             ->where('save_s3', true)
             ->each(function (ScheduledVolumeBackup $backup): void {
                 $this->selectedVolumeStorages[$backup->id] = $this->storage->id;
@@ -46,29 +46,26 @@ class Resources extends Component
     {
         $this->authorize('update', $this->storage);
 
-        $backup = ScheduledDatabaseBackup::where('id', $backupId)
-            ->where('s3_storage_id', $this->storage->id)
+        $backup = $this->backupsUsingStorage(ScheduledDatabaseBackup::query())
+            ->whereKey($backupId)
             ->firstOrFail();
 
-        $backup->fill([
-            'save_s3' => false,
-            's3_storage_id' => null,
-        ]);
-        $changedFields = auditChangedFields($backup);
-        $backup->save();
+        $changedFields = $this->replaceStorage($backup, null);
 
         $this->auditDatabaseBackupUpdated($backup, $changedFields);
         unset($this->selectedStorages[$backupId]);
 
-        $this->dispatch('success', 'S3 disabled.', 'S3 backup has been disabled for this schedule.');
+        $this->dispatch('success', 'Storage removed.', $backup->save_s3
+            ? 'This storage was removed from the schedule destinations.'
+            : 'S3 backup has been disabled for this schedule.');
     }
 
     public function moveBackup(int $backupId): void
     {
         $this->authorize('update', $this->storage);
 
-        $backup = ScheduledDatabaseBackup::where('id', $backupId)
-            ->where('s3_storage_id', $this->storage->id)
+        $backup = $this->backupsUsingStorage(ScheduledDatabaseBackup::query())
+            ->whereKey($backupId)
             ->firstOrFail();
         $newStorageId = $this->selectedStorages[$backupId] ?? null;
 
@@ -90,9 +87,7 @@ class Resources extends Component
 
         $this->authorize('update', $newStorage);
 
-        $backup->s3_storage_id = $newStorage->id;
-        $changedFields = auditChangedFields($backup);
-        $backup->save();
+        $changedFields = $this->replaceStorage($backup, $newStorage->id);
 
         $this->auditDatabaseBackupUpdated($backup, $changedFields);
         unset($this->selectedStorages[$backupId]);
@@ -104,31 +99,26 @@ class Resources extends Component
     {
         $this->authorize('update', $this->storage);
 
-        $backup = ScheduledVolumeBackup::query()
-            ->where('id', $backupId)
-            ->where('s3_storage_id', $this->storage->id)
+        $backup = $this->backupsUsingStorage(ScheduledVolumeBackup::query())
+            ->whereKey($backupId)
             ->firstOrFail();
 
-        $backup->fill([
-            'save_s3' => false,
-            's3_storage_id' => null,
-        ]);
-        $changedFields = auditChangedFields($backup);
-        $backup->save();
+        $changedFields = $this->replaceStorage($backup, null);
 
         $this->auditVolumeBackupUpdated($backup, $changedFields);
         unset($this->selectedVolumeStorages[$backupId]);
 
-        $this->dispatch('success', 'S3 disabled.', 'S3 backup has been disabled for this schedule.');
+        $this->dispatch('success', 'Storage removed.', $backup->save_s3
+            ? 'This storage was removed from the schedule destinations.'
+            : 'S3 backup has been disabled for this schedule.');
     }
 
     public function moveVolumeBackup(int $backupId): void
     {
         $this->authorize('update', $this->storage);
 
-        $backup = ScheduledVolumeBackup::query()
-            ->where('id', $backupId)
-            ->where('s3_storage_id', $this->storage->id)
+        $backup = $this->backupsUsingStorage(ScheduledVolumeBackup::query())
+            ->whereKey($backupId)
             ->firstOrFail();
         $newStorageId = $this->selectedVolumeStorages[$backupId] ?? null;
 
@@ -151,9 +141,7 @@ class Resources extends Component
 
         $this->authorize('update', $newStorage);
 
-        $backup->s3_storage_id = $newStorage->id;
-        $changedFields = auditChangedFields($backup);
-        $backup->save();
+        $changedFields = $this->replaceStorage($backup, $newStorage->id);
 
         $this->auditVolumeBackupUpdated($backup, $changedFields);
         unset($this->selectedVolumeStorages[$backupId]);
@@ -161,6 +149,49 @@ class Resources extends Component
         $this->dispatch('success', 'Backup moved.', "Moved to {$newStorage->name}.");
     }
 
+    /**
+     * Schedules that have this storage among their destinations.
+     *
+     * @template TModel of ScheduledDatabaseBackup|ScheduledVolumeBackup
+     *
+     * @param  Builder<TModel>  $query
+     * @return Builder<TModel>
+     */
+    private function backupsUsingStorage(Builder $query): Builder
+    {
+        return $query->usingS3Storage($this->storage->id);
+    }
+
+    /**
+     * Replaces this storage in the destinations of a schedule, or removes it when no replacement is given. S3 backups
+     * turn off when no destination remains.
+     *
+     * @return array<int, string> Names of the changed backup fields.
+     */
+    private function replaceStorage(ScheduledDatabaseBackup|ScheduledVolumeBackup $backup, ?int $newStorageId): array
+    {
+        $storageIds = $backup->selectedS3Storages()
+            ->pluck('id')
+            ->map(fn (int $id): ?int => $id === $this->storage->id ? $newStorageId : $id)
+            ->filter()
+            ->unique()
+            ->values();
+        $previousPrimaryId = $backup->s3_storage_id;
+
+        $backup->syncS3Storages($storageIds->all());
+
+        $changedFields = ['s3_storages'];
+        if ($backup->s3_storage_id !== $previousPrimaryId) {
+            $changedFields[] = 's3_storage_id';
+        }
+        if ($storageIds->isEmpty() && $backup->save_s3) {
+            $backup->update(['save_s3' => false]);
+            $changedFields[] = 'save_s3';
+        }
+
+        return $changedFields;
+    }
+
     /**
      * @param  array<int, string>  $changedFields
      */
@@ -211,7 +242,7 @@ class Resources extends Component
 
     public function render()
     {
-        $backups = ScheduledDatabaseBackup::where('s3_storage_id', $this->storage->id)
+        $backups = $this->backupsUsingStorage(ScheduledDatabaseBackup::query())
             ->where('save_s3', true)
             ->with('database')
             ->get()
@@ -221,8 +252,7 @@ class Resources extends Component
             ->orderBy('name')
             ->get(['id', 'name', 'is_usable']);
 
-        $volumeBackups = ScheduledVolumeBackup::query()
-            ->where('s3_storage_id', $this->storage->id)
+        $volumeBackups = $this->backupsUsingStorage(ScheduledVolumeBackup::query())
             ->where('save_s3', true)
             ->with('backupable.resource')
             ->get();
diff --git a/app/Livewire/Storage/Show.php b/app/Livewire/Storage/Show.php
index 17abd19e51..b7ddfcf5e2 100644
--- a/app/Livewire/Storage/Show.php
+++ b/app/Livewire/Storage/Show.php
@@ -32,8 +32,10 @@ class Show extends Component
             return $this->redirectRoute('storage.index', navigate: true);
         }
         $this->currentRoute = request()->route()->getName();
-        $this->backupCount = ScheduledDatabaseBackup::where('s3_storage_id', $this->storage->id)->count()
-            + ScheduledVolumeBackup::where('s3_storage_id', $this->storage->id)->count();
+        $this->backupCount = collect([ScheduledDatabaseBackup::class, ScheduledVolumeBackup::class])
+            ->sum(fn (string $backupModel): int => $backupModel::query()
+                ->usingS3Storage($this->storage->id)
+                ->count());
     }
 
     public function delete()
diff --git a/app/Livewire/SwitchTeam.php b/app/Livewire/SwitchTeam.php
index 3df399b100..11d7141537 100644
--- a/app/Livewire/SwitchTeam.php
+++ b/app/Livewire/SwitchTeam.php
@@ -9,6 +9,8 @@ class SwitchTeam extends Component
 {
     public string $selectedTeamId = 'default';
 
+    protected $listeners = ['team-avatar-updated' => '$refresh'];
+
     public function mount()
     {
         $this->selectedTeamId = auth()->user()->currentTeam()->id;
diff --git a/app/Livewire/Tags/Canvas.php b/app/Livewire/Tags/Canvas.php
new file mode 100644
index 0000000000..d8474e5d2c
--- /dev/null
+++ b/app/Livewire/Tags/Canvas.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Livewire\Tags;
+
+use App\Livewire\Concerns\CreatesTags;
+use App\Livewire\Concerns\RemembersCanvasView;
+use App\Models\Tag;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+/**
+ * Full-screen canvas of the team's tags and the resources that have them.
+ * The page is a shell: resources/js/environment-canvas.js renders it from
+ * Api\TagCanvasController at /canvas/api with the browser session.
+ */
+class Canvas extends Component
+{
+    use AuthorizesRequests;
+    use CreatesTags;
+    use RemembersCanvasView;
+
+    /** The team that owned the page at mount; the canvas API calls use it, not the session team. */
+    #[Locked]
+    public int $teamId;
+
+    public function mount(): void
+    {
+        $this->authorize('viewAny', Tag::class);
+        $this->teamId = currentTeam()->id;
+        $this->rememberView('tags', 'canvas');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.tags.canvas')->layout('layouts.app', ['fullBleed' => true]);
+    }
+}
diff --git a/app/Livewire/Tags/Show.php b/app/Livewire/Tags/Show.php
index 381fb0462c..01450abe9a 100644
--- a/app/Livewire/Tags/Show.php
+++ b/app/Livewire/Tags/Show.php
@@ -3,8 +3,11 @@
 namespace App\Livewire\Tags;
 
 use App\Http\Controllers\Api\DeployController;
+use App\Livewire\Concerns\CreatesTags;
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Tag;
+use App\Services\TagCanvas;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
@@ -15,6 +18,8 @@ use Livewire\Component;
 class Show extends Component
 {
     use AuthorizesRequests;
+    use CreatesTags;
+    use RemembersCanvasView;
 
     #[Locked]
     public ?string $tagName = null;
@@ -37,8 +42,15 @@ class Show extends Component
     #[Locked]
     public ?array $deploymentsPerTagPerServer = null;
 
+    /** The "Connect to resources" modal on small screens, where the tags canvas is not shown. */
+    public bool $connectResourcesOpen = false;
+
     public function mount()
     {
+        if (str($this->tagName)->isEmpty() && $this->prefersCanvasView('tags')) {
+            return $this->redirectRoute('tags.canvas', navigate: true);
+        }
+
         try {
             $this->tags = Tag::ownedByCurrentTeam()
                 ->withCount(['applications', 'services'])
@@ -115,6 +127,55 @@ class Show extends Component
         }
     }
 
+    public function openConnectResources(): void
+    {
+        $this->connectResourcesOpen = true;
+    }
+
+    /**
+     * Adds the tag to a resource of the tag's team, or removes it when the resource already has it.
+     */
+    public function toggleResource(string $uuid): void
+    {
+        try {
+            $resource = app(TagCanvas::class)->resources($this->tag->team_id)->get($uuid);
+            if (! $resource) {
+                $this->dispatch('error', 'Resource not found.');
+
+                return;
+            }
+            $this->authorize('update', $resource);
+
+            if ($resource->tags->contains('id', $this->tag->id)) {
+                $resource->tags()->detach($this->tag->id);
+            } else {
+                $resource->tags()->attach($this->tag->id);
+            }
+
+            $this->applications = $this->tag->applications()->get();
+            $this->services = $this->tag->services()->get();
+            $this->getDeployments();
+        } catch (\Exception $e) {
+            handleError($e, $this);
+        }
+    }
+
+    /**
+     * Deletes the tag and removes it from every resource.
+     */
+    public function deleteTag()
+    {
+        try {
+            $this->authorize('delete', $this->tag);
+            // taggables rows cascade-delete via FK on tag_id
+            $this->tag->delete();
+
+            return $this->redirectRoute('tags.show', navigate: true);
+        } catch (\Exception $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function render()
     {
         return view('livewire.tags.show', [
@@ -131,6 +192,30 @@ class Show extends Component
                     'resourceCount' => $applicationsCount + $servicesCount,
                 ];
             })->values()->toArray(),
+            'connectableResources' => $this->connectableResources(),
         ]);
     }
+
+    /**
+     * Resources of the tag's team for the "Connect to resources" modal, by "Project / Environment".
+     * Loaded only while the modal is open.
+     *
+     * @return Collection<string, Collection<int, array{uuid: string, name: string, tagged: bool, can_update: bool}>>
+     */
+    private function connectableResources(): Collection
+    {
+        if (! $this->connectResourcesOpen || ! $this->tag) {
+            return collect();
+        }
+
+        return app(TagCanvas::class)->resources($this->tag->team_id)
+            ->groupBy(fn ($resource) => $resource->environment->project->name.' / '.$resource->environment->name)
+            ->sortKeys(SORT_NATURAL | SORT_FLAG_CASE)
+            ->map(fn (Collection $resources) => $resources->map(fn ($resource) => [
+                'uuid' => $resource->uuid,
+                'name' => $resource->name,
+                'tagged' => $resource->tags->contains('id', $this->tag->id),
+                'can_update' => auth()->user()->can('update', $resource),
+            ])->values());
+    }
 }
diff --git a/app/Livewire/Team/Index.php b/app/Livewire/Team/Index.php
index 9ae34b5610..58b940f932 100644
--- a/app/Livewire/Team/Index.php
+++ b/app/Livewire/Team/Index.php
@@ -4,13 +4,16 @@ namespace App\Livewire\Team;
 
 use App\Models\Team;
 use App\Models\TeamInvitation;
+use App\Services\TeamAvatarStorageService;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
+use Livewire\WithFileUploads;
 
 class Index extends Component
 {
     use AuthorizesRequests;
+    use WithFileUploads;
 
     public $invitations = [];
 
@@ -25,6 +28,8 @@ class Index extends Component
 
     public bool $is_build_server_fallback_enabled = true;
 
+    public $avatar;
+
     protected function rules(): array
     {
         return [
@@ -84,6 +89,40 @@ class Index extends Component
         }
     }
 
+    public function uploadAvatar(TeamAvatarStorageService $avatarStorage): bool
+    {
+        try {
+            $this->authorize('update', $this->team);
+            $this->validate([
+                'avatar' => ['required', 'image', 'mimes:jpg,jpeg,png,webp', 'max:5120', 'dimensions:max_width=6000,max_height=6000'],
+            ]);
+            $avatarStorage->storeTeam($this->team, $this->avatar);
+            $this->reset('avatar');
+            refreshSession();
+            $this->dispatch('team-avatar-updated');
+            $this->dispatch('success', 'Team avatar updated.');
+
+            return true;
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return false;
+        }
+    }
+
+    public function removeAvatar(TeamAvatarStorageService $avatarStorage): void
+    {
+        try {
+            $this->authorize('update', $this->team);
+            $avatarStorage->deleteTeam($this->team);
+            refreshSession();
+            $this->dispatch('team-avatar-updated');
+            $this->dispatch('success', 'Team avatar removed.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function render()
     {
         return view('livewire.team.index');
diff --git a/app/Logging/RedactSensitiveAuditData.php b/app/Logging/RedactSensitiveAuditData.php
new file mode 100644
index 0000000000..901325c0cf
--- /dev/null
+++ b/app/Logging/RedactSensitiveAuditData.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Logging;
+
+use App\Services\Security\SensitiveDataRedactor;
+use Illuminate\Log\Logger;
+
+/**
+ * Redacts the audit log like every other channel, but keeps email addresses so the log still records who acted.
+ */
+final class RedactSensitiveAuditData
+{
+    public function __construct(private readonly SensitiveDataRedactor $redactor) {}
+
+    public function __invoke(Logger $logger): void
+    {
+        (new RedactSensitiveData($this->redactor->withoutEmailRedaction()))($logger);
+    }
+}
diff --git a/app/Logging/RedactSensitiveData.php b/app/Logging/RedactSensitiveData.php
new file mode 100644
index 0000000000..4b58280f33
--- /dev/null
+++ b/app/Logging/RedactSensitiveData.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Logging;
+
+use App\Services\Security\SensitiveDataRedactor;
+use Illuminate\Log\Logger;
+use Monolog\LogRecord;
+use Throwable;
+
+final class RedactSensitiveData
+{
+    public function __construct(private readonly SensitiveDataRedactor $redactor) {}
+
+    public function __invoke(Logger $logger): void
+    {
+        if (! self::enabled()) {
+            return;
+        }
+
+        $logger->getLogger()->pushProcessor(fn (LogRecord $record): LogRecord => $this->redact($record));
+    }
+
+    /**
+     * Self-hosted instances may turn off framework log redaction. Cloud always redacts.
+     */
+    public static function enabled(): bool
+    {
+        if (! app()->bound('config')) {
+            return true;
+        }
+
+        return isCloud() || config('logging.redaction_enabled', true) !== false;
+    }
+
+    private function redact(LogRecord $record): LogRecord
+    {
+        try {
+            $message = $this->redactor->redactText($record->message);
+            $recordContext = $this->redactor->redactValue($this->normalizeThrowables($record->context));
+            $extra = $this->redactor->redactValue($this->normalizeThrowables($record->extra));
+
+            return $record->with(
+                message: $message,
+                context: is_array($recordContext) ? $recordContext : [],
+                extra: is_array($extra) ? $extra : [],
+            );
+        } catch (Throwable) {
+            return $record->with(
+                message: SensitiveDataRedactor::FAILURE_MESSAGE,
+                context: [],
+                extra: [],
+            );
+        }
+    }
+
+    private function normalizeThrowables(mixed $value): mixed
+    {
+        if ($value instanceof Throwable) {
+            return [
+                'class' => $value::class,
+                'message' => $value->getMessage(),
+                'code' => $value->getCode(),
+                'file' => $value->getFile(),
+                'line' => $value->getLine(),
+                'trace' => $value->getTraceAsString(),
+                'previous' => $this->normalizeThrowables($value->getPrevious()),
+            ];
+        }
+
+        if (! is_array($value)) {
+            return $value;
+        }
+
+        return array_map($this->normalizeThrowables(...), $value);
+    }
+}
diff --git a/app/Mcp/Concerns/BuildsResponse.php b/app/Mcp/Concerns/BuildsResponse.php
index 280e26b9e7..ae3899d60f 100644
--- a/app/Mcp/Concerns/BuildsResponse.php
+++ b/app/Mcp/Concerns/BuildsResponse.php
@@ -2,6 +2,7 @@
 
 namespace App\Mcp\Concerns;
 
+use App\Services\Security\SensitiveDataRedactor;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 
@@ -24,7 +25,7 @@ trait BuildsResponse
         // raw IDs / morph types (uuid is the public identifier)
         'id', 'team_id', 'tokenable_id', 'tokenable_type',
         'server_id', 'private_key_id', 'cloud_provider_token_id',
-        'hetzner_server_id', 'digitalocean_droplet_id', 'environment_id', 'destination_id',
+        'hetzner_server_id', 'digitalocean_droplet_id', 'hostinger_virtual_machine_id', 'environment_id', 'destination_id',
         'source_id', 'repository_project_id', 'application_id',
         'service_id', 'project_id', 'parent_id',
         'resourceable', 'resourceable_id', 'resourceable_type',
@@ -81,11 +82,12 @@ trait BuildsResponse
      * Recursively remove sensitive keys from any nested array structure.
      *
      * @param  array<array-key, mixed>  $data
+     * @param  array<int, string>  $publicKeys  Identifiers required by management actions.
      * @return array<array-key, mixed>
      */
-    protected function scrubSensitive(array $data): array
+    protected function scrubSensitive(array $data, array $publicKeys = []): array
     {
-        $deny = array_flip($this->sensitiveKeys);
+        $deny = array_flip(array_diff($this->sensitiveKeys, $publicKeys));
 
         $walk = function ($value) use (&$walk, $deny) {
             if (! is_array($value)) {
@@ -108,27 +110,13 @@ trait BuildsResponse
 
     /**
      * Best-effort redaction for free-form log text shown to MCP clients.
-     * Uses remove_iip plus common KEY=value / JSON secret patterns; not a guarantee.
+     * Uses SensitiveDataRedactor patterns plus the given resource values; not a guarantee.
+     *
+     * @param  array{known?: array<int, string>, locked?: array<int, string>}  $secrets  Values from EnvironmentVariable::logRedactionSecretsFor().
      */
-    protected function redactLogText(string $text): string
+    protected function redactLogText(string $text, array $secrets = []): string
     {
-        $text = remove_iip($text);
-
-        // password= / secret= / token= / "token":"..." style (shell or JSON; quoted or bare)
-        $text = preg_replace(
-            '/(?<![\w])["\']?(password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token)["\']?\s*[=:]\s*["\']?[^\s"\']{3,}["\']?/i',
-            '$1='.REDACTED,
-            $text
-        ) ?? $text;
-
-        // export FOO=bar / "API_KEY":"..." style for sensitive-looking names
-        $text = preg_replace(
-            '/(?<![\w])(export\s+)?["\']?([A-Z][A-Z0-9_]*(?:SECRET|PASSWORD|TOKEN|PASSWD|API_KEY|PRIVATE_KEY)[A-Z0-9_]*)["\']?\s*[=:]\s*["\']?[^\s"\']{3,}["\']?/i',
-            '$1$2='.REDACTED,
-            $text
-        ) ?? $text;
-
-        return $text;
+        return app(SensitiveDataRedactor::class)->redactText($text, $secrets['known'] ?? [], $secrets['locked'] ?? []);
     }
 
     /**
diff --git a/app/Mcp/Concerns/CallsRestApi.php b/app/Mcp/Concerns/CallsRestApi.php
new file mode 100644
index 0000000000..32a7286233
--- /dev/null
+++ b/app/Mcp/Concerns/CallsRestApi.php
@@ -0,0 +1,170 @@
+<?php
+
+namespace App\Mcp\Concerns;
+
+use Illuminate\Http\Request as HttpRequest;
+use Illuminate\Routing\Pipeline;
+use Illuminate\Routing\Router;
+use Illuminate\Support\Facades\Facade;
+use Symfony\Component\HttpFoundation\InputBag;
+use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
+use Throwable;
+
+/**
+ * Runs a fixed Coolify REST API route inside the current MCP request.
+ *
+ * The REST route runs with its own middleware (Sanctum, token team, role, ability,
+ * IP allow-list, sensitive-data masking) and its own controller validation and
+ * policies, so MCP write tools always have the same security checks as the REST API.
+ */
+trait CallsRestApi
+{
+    /**
+     * Route prefixes that MCP must never reach, even by mistake.
+     *
+     * @var array<int, string>
+     */
+    private array $blockedRestPaths = [
+        'api/v1/enable',
+        'api/v1/disable',
+        'api/v1/mcp/',
+        'api/v1/feedback',
+        'api/v1/sentinel/',
+        'api/v1/settings/',
+        'api/v1/teams',
+        'api/v1/security/integration-tokens',
+    ];
+
+    /**
+     * Response keys that are never returned to MCP clients, whatever the token abilities are.
+     */
+    private string $neverReturnKeyPattern = '/(private_key|secret|api_key|license_key|user_key|webhook_url|password|^(internal|external)_db_url$|(^|_)token$)/i';
+
+    private const MAX_BODY_BYTES = 1_048_576;
+
+    /**
+     * @param  array<string, string|int>  $pathParams  Values for {placeholders} in $path.
+     * @param  array<string, mixed>  $body
+     * @return array{status: int, body: mixed}
+     */
+    protected function callRestApi(string $method, string $path, array $pathParams = [], array $body = []): array
+    {
+        $resolvedPath = preg_replace_callback('/\{(\w+)\}/', function (array $match) use ($pathParams): string {
+            $value = $pathParams[$match[1]] ?? null;
+            if (! $this->isSafePathSegment($value)) {
+                throw new \InvalidArgumentException("{$match[1]} is missing or has invalid characters.");
+            }
+
+            return rawurlencode((string) $value);
+        }, $path);
+
+        $uri = '/api/v1/'.ltrim($resolvedPath, '/');
+        foreach ($this->blockedRestPaths as $blocked) {
+            if (str_starts_with(ltrim($uri, '/'), $blocked)) {
+                throw new \InvalidArgumentException('This API route is not available through MCP.');
+            }
+        }
+
+        $json = json_encode((object) $body, JSON_THROW_ON_ERROR);
+        if (strlen($json) > self::MAX_BODY_BYTES) {
+            throw new \InvalidArgumentException('Request data is too large.');
+        }
+
+        // REST controllers read GET filters and DELETE flags (?force=...) from the query string.
+        $usesQueryString = in_array($method, ['GET', 'DELETE'], true);
+
+        /** @var HttpRequest $original */
+        $original = app('request');
+        if ($usesQueryString && $body !== []) {
+            $uri .= '?'.http_build_query($body);
+        }
+
+        $subRequest = HttpRequest::create(
+            $uri,
+            $method,
+            $usesQueryString ? [] : $body,
+            [],
+            [],
+            $original->server->all(),
+            $usesQueryString ? null : $json,
+        );
+        if (! $usesQueryString) {
+            // Same input as a real JSON request: $request->get()/all() read the JSON body.
+            $subRequest->setJson(new InputBag($body));
+            $subRequest->request = $subRequest->json();
+        }
+        $subRequest->headers->set('Accept', 'application/json');
+        $subRequest->headers->set('Content-Type', 'application/json');
+        // Server-side marker only: request attributes cannot be set by the client.
+        $subRequest->attributes->set('mcp_rest_bridge', true);
+        $subRequest->setUserResolver($original->getUserResolver());
+
+        /** @var Router $router */
+        $router = app('router');
+
+        app()->instance('request', $subRequest);
+        Facade::clearResolvedInstance('request');
+
+        try {
+            $route = $router->getRoutes()->match($subRequest);
+            $subRequest->setRouteResolver(fn () => $route);
+
+            $response = (new Pipeline(app()))
+                ->send($subRequest)
+                ->through($router->gatherRouteMiddleware($route))
+                ->then(fn ($request) => $router->prepareResponse($request, $route->run()));
+        } catch (HttpExceptionInterface $e) {
+            return ['status' => $e->getStatusCode(), 'body' => ['message' => $e->getMessage() ?: 'Not found.']];
+        } catch (Throwable $e) {
+            report($e);
+
+            return ['status' => 500, 'body' => ['message' => 'Something went wrong while processing the request.']];
+        } finally {
+            app()->instance('request', $original);
+            Facade::clearResolvedInstance('request');
+        }
+
+        $decoded = json_decode((string) $response->getContent(), true);
+
+        if (is_array($decoded)) {
+            $decoded = $this->removeNeverReturnedKeys($decoded);
+            // Some REST write responses include credentials (for example database URLs) for write-only tokens.
+            if ($subRequest->attributes->get('can_read_sensitive') !== true) {
+                // REST management actions use the record id for follow-up updates and deletes.
+                // Keep foreign IDs and credentials filtered; read tools still omit record IDs.
+                $decoded = $this->scrubSensitive($decoded, ['id']);
+            }
+        }
+
+        return [
+            'status' => $response->getStatusCode(),
+            'body' => is_array($decoded) ? $decoded : ['message' => (string) $response->getContent()],
+        ];
+    }
+
+    private function isSafePathSegment(mixed $value): bool
+    {
+        if (is_int($value)) {
+            return $value >= 0;
+        }
+
+        return is_string($value) && preg_match('/^[A-Za-z0-9][A-Za-z0-9_.:\-]{0,254}$/', $value) === 1 && ! str_contains($value, '..');
+    }
+
+    /**
+     * @param  array<array-key, mixed>  $data
+     * @return array<array-key, mixed>
+     */
+    private function removeNeverReturnedKeys(array $data): array
+    {
+        $out = [];
+        foreach ($data as $key => $value) {
+            if (is_string($key) && preg_match($this->neverReturnKeyPattern, $key) === 1) {
+                continue;
+            }
+            $out[$key] = is_array($value) ? $this->removeNeverReturnedKeys($value) : $value;
+        }
+
+        return $out;
+    }
+}
diff --git a/app/Mcp/Concerns/ChecksTokenAbilities.php b/app/Mcp/Concerns/ChecksTokenAbilities.php
new file mode 100644
index 0000000000..a46d425024
--- /dev/null
+++ b/app/Mcp/Concerns/ChecksTokenAbilities.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Mcp\Concerns;
+
+/**
+ * Hides tools and actions that the current token cannot use, so read-only
+ * connections never see write tools and agents do not try calls that must fail.
+ */
+trait ChecksTokenAbilities
+{
+    protected function currentTokenCan(string $ability): bool
+    {
+        $token = request()->user()?->currentAccessToken();
+
+        return $token !== null && ($token->can('root') || $token->can($ability));
+    }
+}
diff --git a/app/Mcp/Concerns/ResolvesTeam.php b/app/Mcp/Concerns/ResolvesTeam.php
index fc15f78867..d77455b170 100644
--- a/app/Mcp/Concerns/ResolvesTeam.php
+++ b/app/Mcp/Concerns/ResolvesTeam.php
@@ -68,6 +68,18 @@ trait ResolvesTeam
         return Response::error("Missing required permissions: {$ability}");
     }
 
+    /**
+     * Destructive tools must call this so agents cannot cause damage or downtime without an explicit confirm=true.
+     */
+    protected function ensureConfirmed(Request $request, string $action): ?Response
+    {
+        if (filter_var($request->get('confirm'), FILTER_VALIDATE_BOOLEAN)) {
+            return null;
+        }
+
+        return $this->mcpError($request, "{$action} requires confirm=true.");
+    }
+
     protected function resolveTeamId(Request $request): ?int
     {
         $user = $request->user();
diff --git a/app/Mcp/Servers/CoolifyServer.php b/app/Mcp/Servers/CoolifyServer.php
index 957109590a..115b36c0fc 100644
--- a/app/Mcp/Servers/CoolifyServer.php
+++ b/app/Mcp/Servers/CoolifyServer.php
@@ -7,26 +7,36 @@ use App\Mcp\Prompts\TroubleshootApplication;
 use App\Mcp\Resources\ApplicationResource;
 use App\Mcp\Resources\InfrastructureOverviewResource;
 use App\Mcp\Tools\CancelDeployment;
+use App\Mcp\Tools\CloudProvider;
 use App\Mcp\Tools\Control;
 use App\Mcp\Tools\CoolifyHelp;
+use App\Mcp\Tools\CreateApplication;
+use App\Mcp\Tools\CreateDatabase;
+use App\Mcp\Tools\CreateService;
 use App\Mcp\Tools\Deploy;
+use App\Mcp\Tools\DockerCleanup;
 use App\Mcp\Tools\GetApplication;
+use App\Mcp\Tools\GetApplicationPreview;
 use App\Mcp\Tools\GetCurrentTeam;
 use App\Mcp\Tools\GetDatabase;
+use App\Mcp\Tools\GetDatabaseImport;
 use App\Mcp\Tools\GetDeployment;
 use App\Mcp\Tools\GetDestination;
 use App\Mcp\Tools\GetEnvironment;
+use App\Mcp\Tools\GetEnvValues;
 use App\Mcp\Tools\GetInfrastructureOverview;
 use App\Mcp\Tools\GetLogs;
 use App\Mcp\Tools\GetProject;
 use App\Mcp\Tools\GetServer;
 use App\Mcp\Tools\GetServerDomains;
+use App\Mcp\Tools\GetServerMetrics;
 use App\Mcp\Tools\GetServerResources;
 use App\Mcp\Tools\GetService;
 use App\Mcp\Tools\GetServiceApplication;
 use App\Mcp\Tools\GetServiceDatabase;
 use App\Mcp\Tools\ListApplicationPreviews;
 use App\Mcp\Tools\ListApplications;
+use App\Mcp\Tools\ListAuditEvents;
 use App\Mcp\Tools\ListBackupExecutions;
 use App\Mcp\Tools\ListDatabaseBackups;
 use App\Mcp\Tools\ListDatabases;
@@ -39,25 +49,48 @@ use App\Mcp\Tools\ListGithubRepositories;
 use App\Mcp\Tools\ListProjects;
 use App\Mcp\Tools\ListResources;
 use App\Mcp\Tools\ListResourceTags;
+use App\Mcp\Tools\ListRollbackImages;
 use App\Mcp\Tools\ListScheduledTaskExecutions;
 use App\Mcp\Tools\ListScheduledTasks;
 use App\Mcp\Tools\ListServers;
 use App\Mcp\Tools\ListServiceApplications;
 use App\Mcp\Tools\ListServiceDatabases;
 use App\Mcp\Tools\ListServices;
+use App\Mcp\Tools\ListServiceTemplates;
 use App\Mcp\Tools\ListSharedEnvKeys;
 use App\Mcp\Tools\ListStorages;
 use App\Mcp\Tools\ListTags;
 use App\Mcp\Tools\ListTeamMembers;
 use App\Mcp\Tools\ListUnhealthyResources;
+use App\Mcp\Tools\ManageApplication;
+use App\Mcp\Tools\ManageBackup;
+use App\Mcp\Tools\ManageDatabase;
+use App\Mcp\Tools\ManageDestination;
+use App\Mcp\Tools\ManageEnv;
+use App\Mcp\Tools\ManageGitSource;
+use App\Mcp\Tools\ManageNotifications;
+use App\Mcp\Tools\ManagePreview;
+use App\Mcp\Tools\ManagePrivateKey;
+use App\Mcp\Tools\ManageProject;
+use App\Mcp\Tools\ManageProxy;
+use App\Mcp\Tools\ManageRegistry;
+use App\Mcp\Tools\ManageS3Storage;
+use App\Mcp\Tools\ManageScheduledTask;
+use App\Mcp\Tools\ManageServer;
+use App\Mcp\Tools\ManageService;
+use App\Mcp\Tools\ManageSharedEnv;
+use App\Mcp\Tools\ManageStorage;
+use App\Mcp\Tools\ManageTags;
+use App\Mcp\Tools\RollbackApplication;
 use App\Mcp\Tools\SearchResources;
 use Laravel\Mcp\Server;
+use Laravel\Mcp\Server\Tool;
 
 class CoolifyServer extends Server
 {
     protected string $name = 'Coolify';
 
-    protected string $version = '0.2.0';
+    protected string $version = '0.3.0';
 
     /**
      * Return all registered tools in a single tools/list page (default package limit is 15).
@@ -70,7 +103,7 @@ class CoolifyServer extends Server
 Coolify MCP for the authenticated team token. Every tool enforces team ownership.
 
 Start here (prefer these before deep get_*):
-1. coolify_help — tool catalog by intent (overview|search|debug|deploy|essentials).
+1. coolify_help — tools this token can use, plus step-by-step recipes (topic=deploy_app_from_git, add_database_to_app, ...).
 2. get_infrastructure_overview — counts + health_hints.
 3. search_resources — fuzzy name/UUID/domain when type is unknown.
 4. list_unhealthy_resources sample_only=true — cheap "what's broken?" sample + counts.
@@ -82,15 +115,22 @@ Then: list_*/get_* for details. Debug is DB-first:
 
 Lifecycle (requires token ability **deploy**):
 - control (start|stop|restart; stop needs confirm=true)
-- deploy, cancel_deployment
+- deploy, cancel_deployment, rollback_application
+
+Changes (requires token ability **write**): manage_* and create_* tools. They run the same REST API routes, with the same validation and permissions. Destructive actions need confirm=true: ask the user first.
 
 Prompts: troubleshoot_application, explain_failed_deploy.
 Resources: coolify://overview, coolify://application/{uuid}.
 
-Responses: `{ data, _actions?, _pagination? }`. Env values, configuration snapshots, and full deploy logs are never returned. Optional deploy log summaries are best-effort redacted only.
+Responses: `{ data, _actions?, _pagination? }`. Private keys, S3 secrets, tokens, passwords, and webhook URLs are never returned. Env values only with get_env_values (read:sensitive). Full deploy logs are never returned; optional log summaries are best-effort redacted only.
 MD;
 
-    protected array $tools = [
+    /**
+     * Every tool class. Tools hide themselves when the token cannot use them (shouldRegister).
+     *
+     * @var array<int, class-string<Tool>>
+     */
+    public const TOOLS = [
         CoolifyHelp::class,
         GetInfrastructureOverview::class,
         SearchResources::class,
@@ -136,8 +176,42 @@ MD;
         Control::class,
         Deploy::class,
         CancelDeployment::class,
+        ManageProject::class,
+        CreateDatabase::class,
+        ManageDatabase::class,
+        GetDatabaseImport::class,
+        ListServiceTemplates::class,
+        CreateService::class,
+        ManageService::class,
+        ManageEnv::class,
+        ManageSharedEnv::class,
+        GetEnvValues::class,
+        CreateApplication::class,
+        ManageApplication::class,
+        ManagePreview::class,
+        GetApplicationPreview::class,
+        RollbackApplication::class,
+        ListRollbackImages::class,
+        ManageScheduledTask::class,
+        ManageBackup::class,
+        ManageStorage::class,
+        ManageTags::class,
+        ManageServer::class,
+        ManageProxy::class,
+        DockerCleanup::class,
+        ManageDestination::class,
+        ManageRegistry::class,
+        ManagePrivateKey::class,
+        ManageS3Storage::class,
+        ManageGitSource::class,
+        CloudProvider::class,
+        ManageNotifications::class,
+        ListAuditEvents::class,
+        GetServerMetrics::class,
     ];
 
+    protected array $tools = self::TOOLS;
+
     protected array $resources = [
         InfrastructureOverviewResource::class,
         ApplicationResource::class,
diff --git a/app/Mcp/Tools/CancelDeployment.php b/app/Mcp/Tools/CancelDeployment.php
index c9913c4e5f..a7cb96ef84 100644
--- a/app/Mcp/Tools/CancelDeployment.php
+++ b/app/Mcp/Tools/CancelDeployment.php
@@ -5,6 +5,7 @@ namespace App\Mcp\Tools;
 use App\Actions\Application\CleanupCancelledDeployment;
 use App\Enums\ApplicationDeploymentStatus;
 use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ChecksTokenAbilities;
 use App\Mcp\Concerns\ResolvesTeam;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Server;
@@ -12,7 +13,13 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsIdempotent;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly(false)]
+#[IsDestructive]
+#[IsIdempotent]
 class CancelDeployment extends Tool
 {
     protected string $name = 'cancel_deployment';
@@ -20,8 +27,14 @@ class CancelDeployment extends Tool
     protected string $description = 'Cancel a queued or in-progress deployment by deployment UUID for the authenticated team. Requires deploy ability.';
 
     use BuildsResponse;
+    use ChecksTokenAbilities;
     use ResolvesTeam;
 
+    public function shouldRegister(): bool
+    {
+        return $this->currentTokenCan('deploy');
+    }
+
     public function handle(Request $request): Response
     {
         if ($error = $this->ensureAbility($request, 'deploy', $this->name)) {
diff --git a/app/Mcp/Tools/CloudProvider.php b/app/Mcp/Tools/CloudProvider.php
new file mode 100644
index 0000000000..99b750ab70
--- /dev/null
+++ b/app/Mcp/Tools/CloudProvider.php
@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsOpenWorld;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+#[IsOpenWorld]
+class CloudProvider extends RestActionTool
+{
+    protected string $name = 'cloud_provider';
+
+    protected string $description = 'Manage cloud provider API tokens of the authenticated team (Hetzner, DigitalOcean, Vultr, Hostinger), read provider catalogs, and provision new paid servers. Provider tokens are never returned. Requires read ability for list_tokens/get_token/catalog, write ability for the rest (provision_server with a cloud-init or post-install script or extra SSH keys also needs deploy). Same validation and permissions as the REST API.';
+
+    private const CATALOG_PATHS = [
+        'hetzner_locations' => 'hetzner/locations',
+        'hetzner_server_types' => 'hetzner/server-types',
+        'hetzner_images' => 'hetzner/images',
+        'hetzner_ssh_keys' => 'hetzner/ssh-keys',
+        'hetzner_firewalls' => 'hetzner/firewalls',
+        'hetzner_networks' => 'hetzner/networks',
+        'digitalocean_regions' => 'digitalocean/regions',
+        'digitalocean_sizes' => 'digitalocean/sizes',
+        'digitalocean_images' => 'digitalocean/images',
+        'digitalocean_ssh_keys' => 'digitalocean/ssh-keys',
+        'vultr_regions' => 'vultr/regions',
+        'vultr_plans' => 'vultr/plans',
+        'vultr_os' => 'vultr/os',
+        'vultr_ssh_keys' => 'vultr/ssh-keys',
+        'hostinger_data_centers' => 'hostinger/data-centers',
+        'hostinger_catalog' => 'hostinger/catalog',
+        'hostinger_templates' => 'hostinger/templates',
+        'hostinger_ssh_keys' => 'hostinger/ssh-keys',
+        'hostinger_post_install_scripts' => 'hostinger/post-install-scripts',
+    ];
+
+    private const PROVISION_PATHS = [
+        'hetzner' => 'servers/hetzner',
+        'digitalocean' => 'servers/digitalocean',
+        'vultr' => 'servers/vultr',
+        'hostinger' => 'servers/hostinger',
+    ];
+
+    protected function actions(): array
+    {
+        return [
+            'list_tokens' => ['method' => 'GET', 'path' => 'cloud-tokens', 'ability' => 'read', 'description' => 'cloud provider tokens of the team (no token values)'],
+            'get_token' => ['method' => 'GET', 'path' => 'cloud-tokens/{uuid}', 'ability' => 'read', 'description' => 'one cloud provider token (no token value)'],
+            'create_token' => ['method' => 'POST', 'path' => 'cloud-tokens', 'ability' => 'write', 'description' => 'add a provider token; it is checked with the provider first (data: provider hetzner|digitalocean|vultr|hostinger, token, name)'],
+            'update_token' => ['method' => 'PATCH', 'path' => 'cloud-tokens/{uuid}', 'ability' => 'write', 'description' => 'rename a provider token (data: name)'],
+            'delete_token' => ['method' => 'DELETE', 'path' => 'cloud-tokens/{uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete a provider token that no server uses'],
+            'validate_token' => ['method' => 'POST', 'path' => 'cloud-tokens/{uuid}/validate', 'ability' => 'write', 'description' => 'check a stored provider token with the provider'],
+            'catalog' => ['method' => 'GET', 'paths' => self::CATALOG_PATHS, 'ability' => 'read', 'description' => 'read a provider catalog; resource is <provider>_<catalog>, for example hetzner_locations (data: cloud_provider_token_uuid)'],
+            'provision_server' => ['method' => 'POST', 'paths' => self::PROVISION_PATHS, 'ability' => 'write', 'confirm' => true, 'description' => 'create a new paid server at the provider and add it to Coolify; resource is the provider (data: cloud_provider_token_uuid, private_key_uuid, name, and the provider fields, for example location, server_type, image for hetzner; a cloud-init or post-install script or extra SSH keys need deploy ability)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Cloud provider token UUID (get_token, update_token, delete_token, validate_token).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body or catalog query, same fields as the REST API. Catalogs and provision_server need cloud_provider_token_uuid.';
+    }
+}
diff --git a/app/Mcp/Tools/Control.php b/app/Mcp/Tools/Control.php
index 65ec7ca4c1..3abd1fd744 100644
--- a/app/Mcp/Tools/Control.php
+++ b/app/Mcp/Tools/Control.php
@@ -10,25 +10,39 @@ use App\Actions\Service\RestartService;
 use App\Actions\Service\StartService;
 use App\Actions\Service\StopService;
 use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\CallsRestApi;
+use App\Mcp\Concerns\ChecksTokenAbilities;
 use App\Mcp\Concerns\ResolvesResource;
 use App\Mcp\Concerns\ResolvesTeam;
 use App\Models\Application;
+use App\Models\EnvironmentVariable;
 use App\Support\ResourceStartActivity;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly(false)]
+#[IsDestructive]
 class Control extends Tool
 {
     protected string $name = 'control';
 
-    protected string $description = 'Start, stop, or restart an application, database, or service owned by the authenticated team. Requires deploy ability. Stop requires confirm=true.';
+    protected string $description = 'Start, stop, or restart an application, database, service, or a single service application or service database (service_uuid + uuid) owned by the authenticated team. Requires deploy ability. Stop requires confirm=true.';
 
     use BuildsResponse;
+    use CallsRestApi;
+    use ChecksTokenAbilities;
     use ResolvesResource;
     use ResolvesTeam;
 
+    public function shouldRegister(): bool
+    {
+        return $this->currentTokenCan('deploy');
+    }
+
     public function handle(Request $request): Response
     {
         if ($error = $this->ensureAbility($request, 'deploy', $this->name)) {
@@ -43,10 +57,9 @@ class Control extends Tool
         $resourceType = $request->get('resource');
         $action = $request->get('action');
         $uuid = $request->get('uuid');
-        $confirm = filter_var($request->get('confirm'), FILTER_VALIDATE_BOOLEAN);
 
-        if (! is_string($resourceType) || ! in_array($resourceType, ['application', 'database', 'service'], true)) {
-            return $this->mcpError($request, 'resource must be application, database, or service.');
+        if (! is_string($resourceType) || ! in_array($resourceType, ['application', 'database', 'service', 'service_application', 'service_database'], true)) {
+            return $this->mcpError($request, 'resource must be application, database, service, service_application, or service_database.');
         }
         if (! is_string($action) || ! in_array($action, ['start', 'stop', 'restart'], true)) {
             return $this->mcpError($request, 'action must be start, stop, or restart.');
@@ -54,8 +67,12 @@ class Control extends Tool
         if (! is_string($uuid) || $uuid === '') {
             return $this->mcpError($request, 'uuid argument is required.');
         }
-        if ($action === 'stop' && ! $confirm) {
-            return $this->mcpError($request, 'stop requires confirm=true to prevent accidental downtime.');
+        if ($action === 'stop' && $error = $this->ensureConfirmed($request, 'stop')) {
+            return $error;
+        }
+
+        if ($resourceType === 'service_application' || $resourceType === 'service_database') {
+            return $this->controlServiceChild($request, $teamId, $resourceType, $action, $uuid);
         }
 
         $resource = $this->resolveTeamResource($teamId, $resourceType, $uuid);
@@ -70,7 +87,9 @@ class Control extends Tool
                 'service' => $this->controlService($resource, $action),
             };
         } catch (\Throwable $e) {
-            return $this->mcpError($request, $e->getMessage(), ['resource_uuid' => $uuid]);
+            $secrets = EnvironmentVariable::logRedactionSecretsFor($resource);
+
+            return $this->mcpError($request, $this->redactLogText($e->getMessage(), $secrets), ['resource_uuid' => $uuid]);
         }
 
         auditLog('mcp.control', [
@@ -188,12 +207,57 @@ class Control extends Tool
         return ['message' => 'Service starting request queued.'];
     }
 
+    /**
+     * Runs the REST route for a single service application or service database, with its own team scoping and policies.
+     */
+    private function controlServiceChild(Request $request, int $teamId, string $resourceType, string $action, string $uuid): Response
+    {
+        $serviceUuid = $request->get('service_uuid');
+        if (! is_string($serviceUuid) || $serviceUuid === '') {
+            return $this->mcpError($request, "service_uuid argument is required for {$resourceType}.");
+        }
+
+        $path = $resourceType === 'service_application'
+            ? "services/{service_uuid}/applications/{uuid}/{$action}"
+            : "services/{service_uuid}/databases/{uuid}/{$action}";
+
+        try {
+            $result = $this->callRestApi('POST', $path, ['service_uuid' => $serviceUuid, 'uuid' => $uuid]);
+        } catch (\InvalidArgumentException $e) {
+            return $this->mcpError($request, $e->getMessage(), ['resource_uuid' => $uuid]);
+        }
+
+        $body = is_array($result['body']) ? $result['body'] : [];
+        $context = ['resource_uuid' => $uuid, 'service_uuid' => $serviceUuid, 'action' => $action, 'status' => $result['status']];
+        if ($result['status'] >= 400) {
+            return $this->mcpError($request, (string) ($body['message'] ?? 'Request failed.'), $context);
+        }
+
+        auditLog('mcp.control', [
+            'team_id' => $teamId,
+            'resource' => $resourceType,
+            'action' => $action,
+            'resource_uuid' => $uuid,
+            'service_uuid' => $serviceUuid,
+        ]);
+
+        return $this->mcpSuccess($request, $this->respond([
+            'ok' => true,
+            'resource' => $resourceType,
+            'uuid' => $uuid,
+            'service_uuid' => $serviceUuid,
+            'action' => $action,
+            'message' => $body['message'] ?? null,
+        ]), $context);
+    }
+
     public function schema(JsonSchema $schema): array
     {
         return [
-            'resource' => $schema->string()->description('application | database | service')->required(),
+            'resource' => $schema->string()->description('application | database | service | service_application | service_database')->required(),
             'action' => $schema->string()->description('start | stop | restart')->required(),
-            'uuid' => $schema->string()->description('Resource UUID.')->required(),
+            'uuid' => $schema->string()->description('Resource UUID. For service_application / service_database: the UUID of the service application or service database.')->required(),
+            'service_uuid' => $schema->string()->description('Parent service UUID. Required when resource is service_application or service_database.'),
             'confirm' => $schema->boolean()->description('Required true when action=stop.'),
         ];
     }
diff --git a/app/Mcp/Tools/CoolifyHelp.php b/app/Mcp/Tools/CoolifyHelp.php
index 784b106d48..a3e4e09c36 100644
--- a/app/Mcp/Tools/CoolifyHelp.php
+++ b/app/Mcp/Tools/CoolifyHelp.php
@@ -4,177 +4,183 @@ namespace App\Mcp\Tools;
 
 use App\Mcp\Concerns\BuildsResponse;
 use App\Mcp\Concerns\ResolvesTeam;
+use App\Mcp\Servers\CoolifyServer;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\Support\Str;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class CoolifyHelp extends Tool
 {
     protected string $name = 'coolify_help';
 
-    protected string $description = 'Tool catalog by intent. Call first when unsure which Coolify MCP tool to use. Optional intent: overview | search | inventory | debug | deploy | github | team | essentials.';
+    protected string $description = 'Start here. Lists the Coolify MCP tools this token can use and step-by-step recipes for multi-step tasks. Optional: topic (recipe name) or search (filter tools).';
 
     use BuildsResponse;
     use ResolvesTeam;
 
+    /**
+     * Multi-step workflows. Each step names a registered tool (and action for grouped tools).
+     *
+     * @var array<string, array{description: string, steps: array<int, array{tool: string, action?: string, note: string}>}>
+     */
+    public const RECIPES = [
+        'deploy_app_from_git' => [
+            'description' => 'Create and deploy an application from a Git repository',
+            'steps' => [
+                ['tool' => 'list_projects', 'note' => 'Find the project, or create one with manage_project action=create.'],
+                ['tool' => 'get_project', 'note' => 'Pick the environment (name or UUID).'],
+                ['tool' => 'list_servers', 'note' => 'Pick a reachable server_uuid.'],
+                ['tool' => 'list_destinations', 'note' => 'Needed only when the server has more than one destination.'],
+                ['tool' => 'list_github_apps', 'note' => 'Private repo: use a GitHub app, or a deploy key (manage_private_key).'],
+                ['tool' => 'create_application', 'action' => 'public', 'note' => 'Or action=github_app / deploy_key. Set git_repository, git_branch, build_pack, ports_exposes.'],
+                ['tool' => 'manage_env', 'action' => 'bulk_update', 'note' => 'Set environment variables (resource=application).'],
+                ['tool' => 'deploy', 'note' => 'Queue the first deployment.'],
+                ['tool' => 'get_deployment', 'note' => 'Follow the status; include_log_summary=true on failure.'],
+            ],
+        ],
+        'add_database_to_app' => [
+            'description' => 'Create a database and connect an application to it',
+            'steps' => [
+                ['tool' => 'get_application', 'note' => 'Note the project, environment, and server of the app.'],
+                ['tool' => 'create_database', 'action' => 'postgresql', 'note' => 'Use the same environment and server_uuid as the app.'],
+                ['tool' => 'control', 'note' => 'Start the database (resource=database, action=start).'],
+                ['tool' => 'get_env_values', 'note' => 'Read the internal connection URL (needs read:sensitive).'],
+                ['tool' => 'manage_env', 'action' => 'create', 'note' => 'Add DATABASE_URL to the application.'],
+                ['tool' => 'deploy', 'note' => 'Redeploy the app so it gets the new variable.'],
+            ],
+        ],
+        'deploy_service_from_template' => [
+            'description' => 'Deploy a one-click service',
+            'steps' => [
+                ['tool' => 'list_service_templates', 'note' => 'Find the template type (search=...).'],
+                ['tool' => 'create_service', 'action' => 'template', 'note' => 'Set type, project, environment, server_uuid.'],
+                ['tool' => 'manage_service', 'action' => 'update_application', 'note' => 'Set domains on the service application.'],
+                ['tool' => 'control', 'note' => 'Start it (resource=service, action=start).'],
+            ],
+        ],
+        'add_server' => [
+            'description' => 'Connect a new server over SSH',
+            'steps' => [
+                ['tool' => 'manage_private_key', 'action' => 'create', 'note' => 'Add the SSH private key (never returned again).'],
+                ['tool' => 'manage_server', 'action' => 'create', 'note' => 'Set name, ip, port, user, private_key_uuid.'],
+                ['tool' => 'manage_server', 'action' => 'validate', 'note' => 'Check the connection and install Docker if needed.'],
+                ['tool' => 'get_server', 'note' => 'Check that the server is reachable and usable.'],
+                ['tool' => 'manage_proxy', 'action' => 'get', 'note' => 'Check the proxy.'],
+            ],
+        ],
+        'debug_failed_deploy' => [
+            'description' => 'Find why a deployment failed',
+            'steps' => [
+                ['tool' => 'list_deployments', 'note' => 'application_uuid=... for the history.'],
+                ['tool' => 'get_deployment', 'note' => 'include_log_summary=true (needs read:sensitive).'],
+                ['tool' => 'list_env_keys', 'note' => 'Check for missing variables (names only).'],
+                ['tool' => 'get_logs', 'note' => 'Only if the container runs (needs read:sensitive).'],
+                ['tool' => 'deploy', 'note' => 'Redeploy after the fix; force=true to rebuild.'],
+            ],
+        ],
+        'backup_database' => [
+            'description' => 'Back up a database to S3',
+            'steps' => [
+                ['tool' => 'manage_s3_storage', 'action' => 'create', 'note' => 'Add the S3 storage (the secret is never returned).'],
+                ['tool' => 'manage_s3_storage', 'action' => 'validate', 'note' => 'Check the credentials.'],
+                ['tool' => 'manage_backup', 'action' => 'create', 'note' => 'Set frequency, s3_storage_uuid, save_s3=true; backup_now=true runs it at once.'],
+                ['tool' => 'list_backup_executions', 'note' => 'Check the result.'],
+            ],
+        ],
+    ];
+
+    /**
+     * @var array<int, string>
+     */
+    private const START_HERE = ['get_infrastructure_overview', 'search_resources', 'list_unhealthy_resources'];
+
     public function handle(Request $request): Response
     {
         if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
-        $teamId = $this->resolveTeamId($request);
-        if (is_null($teamId)) {
+        if (is_null($this->resolveTeamId($request))) {
             return $this->mcpError($request, 'Invalid token.');
         }
 
-        $intent = $request->get('intent');
-        if ($intent !== null && (! is_string($intent) || trim($intent) === '')) {
-            return $this->mcpError($request, 'intent must be a non-empty string when provided.');
-        }
-        $intent = is_string($intent) ? strtolower(trim($intent)) : null;
+        $tools = $this->visibleTools();
 
-        $catalog = [
-            'overview' => [
-                'description' => 'Bird\'s-eye view and "what is broken?"',
-                'tools' => [
-                    'get_infrastructure_overview',
-                    'list_unhealthy_resources',
-                    'search_resources',
-                    'get_current_team',
-                ],
-            ],
-            'search' => [
-                'description' => 'Find a resource by name/UUID/domain without knowing the type',
-                'tools' => [
-                    'search_resources',
-                    'list_resources',
-                    'list_tags',
-                ],
-            ],
-            'inventory' => [
-                'description' => 'Browse servers, projects, apps, DBs, services',
-                'tools' => [
-                    'list_servers',
-                    'get_server',
-                    'list_projects',
-                    'get_project',
-                    'get_environment',
-                    'list_applications',
-                    'get_application',
-                    'list_databases',
-                    'get_database',
-                    'list_services',
-                    'get_service',
-                    'list_destinations',
-                    'get_destination',
-                ],
-            ],
-            'debug' => [
-                'description' => 'Diagnose failures (prefer DB-backed tools before live logs)',
-                'tools' => [
-                    'get_application',
-                    'list_deployments',
-                    'get_deployment',
-                    'list_env_keys',
-                    'list_shared_env_keys',
-                    'list_application_previews',
-                    'list_storages',
-                    'list_scheduled_tasks',
-                    'get_logs',
-                ],
-                'notes' => [
-                    'get_logs needs a running container on a reachable server; on failure it returns reason + next_tools.',
-                    'Use get_deployment with include_log_summary=true for build failures.',
-                    'Prompts: troubleshoot_application, explain_failed_deploy.',
-                ],
-            ],
-            'deploy' => [
-                'description' => 'Lifecycle actions (requires token ability: deploy)',
-                'tools' => [
-                    'control',
-                    'deploy',
-                    'cancel_deployment',
-                    'list_deployments',
-                    'get_deployment',
-                ],
-                'notes' => [
-                    'stop requires confirm=true.',
-                    'Read-only tokens receive a clear missing_ability error.',
-                ],
-            ],
-            'github' => [
-                'description' => 'GitHub apps / repos / branches (list_github_apps is DB-only; repos/branches call GitHub)',
-                'tools' => [
-                    'list_github_apps',
-                    'list_github_repositories',
-                    'list_github_branches',
-                ],
-            ],
-            'team' => [
-                'description' => 'Team identity',
-                'tools' => [
-                    'get_current_team',
-                    'list_team_members',
-                ],
-            ],
-            'essentials' => [
-                'description' => 'Minimal set for most questions',
-                'tools' => [
-                    'coolify_help',
-                    'get_infrastructure_overview',
-                    'search_resources',
-                    'list_unhealthy_resources',
-                    'list_applications',
-                    'get_application',
-                    'list_deployments',
-                    'get_deployment',
-                    'list_env_keys',
-                    'get_logs',
-                    'control',
-                    'deploy',
-                ],
-            ],
-        ];
-
-        if ($intent !== null) {
-            if (! isset($catalog[$intent])) {
-                return $this->mcpError($request, 'Unknown intent. Use: '.implode(', ', array_keys($catalog)));
+        $topic = $request->get('topic');
+        if ($topic !== null) {
+            if (! is_string($topic) || ! isset(self::RECIPES[$topic])) {
+                return $this->mcpError($request, 'Unknown topic. Use: '.implode(', ', array_keys(self::RECIPES)).'.');
             }
 
             return $this->mcpSuccess($request, $this->respond([
-                'intent' => $intent,
-                'catalog' => [$intent => $catalog[$intent]],
-                'workflow' => $this->workflowHints(),
+                'topic' => $topic,
+                'description' => self::RECIPES[$topic]['description'],
+                'steps' => collect(self::RECIPES[$topic]['steps'])
+                    ->map(fn (array $step): array => $step + ['available' => isset($tools[$step['tool']])])
+                    ->all(),
+                'notes' => ['Steps with available=false need more token abilities.', 'Ask the user before every action that needs confirm=true.'],
             ]));
         }
 
+        $search = $request->get('search');
+        if ($search !== null && (! is_string($search) || trim($search) === '')) {
+            return $this->mcpError($request, 'search must be a non-empty string when provided.');
+        }
+        if (is_string($search)) {
+            $needle = Str::lower(trim($search));
+            $tools = array_filter($tools, fn (array $tool, string $name): bool => str_contains($name, $needle) || str_contains(Str::lower($tool['summary']), $needle), ARRAY_FILTER_USE_BOTH);
+        }
+
         return $this->mcpSuccess($request, $this->respond([
-            'intents' => array_keys($catalog),
-            'catalog' => $catalog,
-            'workflow' => $this->workflowHints(),
+            'start_here' => array_values(array_filter(self::START_HERE, fn (string $name): bool => isset($tools[$name]))),
+            'read_tools' => $this->summaries(array_filter($tools, fn (array $tool): bool => $tool['read_only'])),
+            'change_tools' => $this->summaries(array_filter($tools, fn (array $tool): bool => ! $tool['read_only'])),
+            'recipes' => collect(self::RECIPES)->map(fn (array $recipe): string => $recipe['description'])->all(),
+            'workflow' => [
+                'Resolve a UUID with search_resources or list_*, then get_* for details.',
+                'Debug with list_deployments / get_deployment before get_logs.',
+                'Change tools use the same validation and permissions as the REST API.',
+                'Ask the user before every action that needs confirm=true.',
+                'Call coolify_help with topic=<recipe> for step-by-step guides.',
+            ],
         ]));
     }
 
     /**
-     * @return array<int, string>
+     * Registered tools that this token can see, keyed by name.
+     *
+     * @return array<string, array{summary: string, read_only: bool}>
      */
-    private function workflowHints(): array
+    private function visibleTools(): array
     {
-        return [
-            'Start with coolify_help, get_infrastructure_overview, search_resources, or list_unhealthy_resources (sample_only=true).',
-            'Resolve a UUID, then get_* for details.',
-            'Debug with list_deployments / get_deployment(include_log_summary) before get_logs.',
-            'get_logs is optional and fails structured when not running or server unreachable.',
-            'Never request env values or secrets over MCP.',
-        ];
+        return collect(CoolifyServer::TOOLS)
+            ->map(fn (string $class): Tool => app($class))
+            ->filter(fn (Tool $tool): bool => $tool->eligibleForRegistration())
+            ->mapWithKeys(fn (Tool $tool): array => [$tool->name() => [
+                'summary' => Str::before($tool->description(), '. ').'.',
+                'read_only' => ($tool->annotations()['readOnlyHint'] ?? false) === true,
+            ]])
+            ->all();
+    }
+
+    /**
+     * @param  array<string, array{summary: string, read_only: bool}>  $tools
+     * @return array<string, string>
+     */
+    private function summaries(array $tools): array
+    {
+        return array_map(fn (array $tool): string => Str::limit(rtrim($tool['summary'], '.').'.', 140), $tools);
     }
 
     public function schema(JsonSchema $schema): array
     {
         return [
-            'intent' => $schema->string()->description('Optional: overview | search | inventory | debug | deploy | github | team | essentials.'),
+            'topic' => $schema->string()->enum(array_keys(self::RECIPES))->description('Optional recipe: step-by-step guide for a multi-step task.'),
+            'search' => $schema->string()->description('Optional: only list tools whose name or summary contains this text.'),
         ];
     }
 }
diff --git a/app/Mcp/Tools/CreateApplication.php b/app/Mcp/Tools/CreateApplication.php
new file mode 100644
index 0000000000..82c6413f8a
--- /dev/null
+++ b/app/Mcp/Tools/CreateApplication.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class CreateApplication extends RestActionTool
+{
+    protected string $name = 'create_application';
+
+    protected string $description = 'Create an application in a project of the authenticated team, from a public Git repository, a private repository (GitHub App or deploy key), a Dockerfile, or a Docker image. Requires write ability (instant_deploy and manual webhook secrets also need deploy). Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'public' => ['method' => 'POST', 'path' => 'applications/public', 'ability' => 'write', 'description' => 'create from a public Git repository (data: git_repository, git_branch, build_pack, ports_exposes)'],
+            'github_app' => ['method' => 'POST', 'path' => 'applications/private-github-app', 'ability' => 'write', 'description' => 'create from a private repository through a GitHub App (data: github_app_uuid, git_repository, git_branch, build_pack, ports_exposes)'],
+            'deploy_key' => ['method' => 'POST', 'path' => 'applications/private-deploy-key', 'ability' => 'write', 'description' => 'create from a private repository with a deploy key (data: private_key_uuid, git_repository, git_branch, build_pack, ports_exposes)'],
+            'dockerfile' => ['method' => 'POST', 'path' => 'applications/dockerfile', 'ability' => 'write', 'description' => 'create from a base64 encoded Dockerfile (data: dockerfile, ports_exposes)'],
+            'docker_image' => ['method' => 'POST', 'path' => 'applications/dockerimage', 'ability' => 'write', 'description' => 'create from a Docker image (data: docker_registry_image_name, docker_registry_image_tag, ports_exposes)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API. Always: project_uuid, environment_name or environment_uuid, server_uuid, destination_uuid (required when the server has several destinations). '
+            .'public / github_app / deploy_key: git_repository, git_branch, build_pack (nixpacks | railpack | static | dockerfile | dockercompose), ports_exposes (not for dockercompose); github_app also needs github_app_uuid, deploy_key needs private_key_uuid. '
+            .'dockerfile: dockerfile (base64). docker_image: docker_registry_image_name, docker_registry_image_tag, ports_exposes. '
+            .'Optional: name, description, domains, autogenerate_domain, git_commit_sha, base_directory, publish_directory, install_command, build_command, start_command, docker_compose_location, docker_compose_domains, is_static, is_spa, health_check_*, limits_*, tags, instant_deploy (needs deploy ability).';
+    }
+}
diff --git a/app/Mcp/Tools/CreateDatabase.php b/app/Mcp/Tools/CreateDatabase.php
new file mode 100644
index 0000000000..39985acded
--- /dev/null
+++ b/app/Mcp/Tools/CreateDatabase.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class CreateDatabase extends RestActionTool
+{
+    protected string $name = 'create_database';
+
+    protected string $description = 'Create a standalone database (postgresql, mysql, mariadb, mongodb, redis, keydb, dragonfly, clickhouse, sqlite) in a project of the authenticated team. Requires write ability (instant_deploy also needs deploy). Connection URLs are not returned. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        $actions = [];
+        foreach (['postgresql', 'mysql', 'mariadb', 'mongodb', 'redis', 'keydb', 'dragonfly', 'clickhouse', 'sqlite'] as $type) {
+            $actions[$type] = ['method' => 'POST', 'path' => "databases/{$type}", 'ability' => 'write', 'description' => "create a {$type} database"];
+        }
+
+        return $actions;
+    }
+
+    protected function pathParams(): array
+    {
+        return [];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API. Required: project_uuid, environment_name or environment_uuid, server_uuid; destination_uuid when the server has several destinations. '
+            .'Optional: name, description, image, is_public, public_port (1024-65535), public_port_timeout, limits_memory, limits_memory_swap, limits_memory_swappiness, limits_memory_reservation, limits_cpus, limits_cpuset, limits_cpu_shares, tags, instant_deploy (needs deploy ability). '
+            .'Type fields: postgresql: postgres_user, postgres_password, postgres_db, postgres_initdb_args, postgres_host_auth_method, postgres_conf (base64). mysql: mysql_root_password, mysql_user, mysql_password, mysql_database, mysql_conf (base64). '
+            .'mariadb: mariadb_root_password, mariadb_user, mariadb_password, mariadb_database, mariadb_conf (base64). mongodb: mongo_initdb_root_username, mongo_initdb_root_password, mongo_initdb_database, mongo_conf (base64). '
+            .'redis: redis_password, redis_conf (base64). keydb: keydb_password, keydb_conf (base64). dragonfly: dragonfly_password. clickhouse: clickhouse_admin_user, clickhouse_admin_password. sqlite: sqlite_databases.';
+    }
+}
diff --git a/app/Mcp/Tools/CreateService.php b/app/Mcp/Tools/CreateService.php
new file mode 100644
index 0000000000..debc76282f
--- /dev/null
+++ b/app/Mcp/Tools/CreateService.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class CreateService extends RestActionTool
+{
+    protected string $name = 'create_service';
+
+    protected string $description = 'Create a service in a project of the authenticated team, from a one-click template (see list_service_templates) or a base64 encoded Docker Compose file. Requires write ability (instant_deploy also needs deploy). Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'template' => ['method' => 'POST', 'path' => 'services', 'ability' => 'write', 'description' => 'create from a one-click template (data: type)'],
+            'compose' => ['method' => 'POST', 'path' => 'services', 'ability' => 'write', 'description' => 'create from a Docker Compose file (data: docker_compose_raw base64, connect_to_docker_network)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API. Required: project_uuid, environment_name or environment_uuid, server_uuid; destination_uuid when the server has several destinations; type (template) or docker_compose_raw (compose, base64). '
+            .'Optional: name, description, urls (list of {name, url}), force_domain_override, is_container_label_escape_enabled, redact_all_env_values_in_logs, tags, instant_deploy (needs deploy ability).';
+    }
+}
diff --git a/app/Mcp/Tools/Deploy.php b/app/Mcp/Tools/Deploy.php
index 980e9e051d..061e29a985 100644
--- a/app/Mcp/Tools/Deploy.php
+++ b/app/Mcp/Tools/Deploy.php
@@ -3,22 +3,35 @@
 namespace App\Mcp\Tools;
 
 use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\CallsRestApi;
+use App\Mcp\Concerns\ChecksTokenAbilities;
 use App\Mcp\Concerns\ResolvesTeam;
 use App\Models\Application;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly(false)]
+#[IsDestructive]
 class Deploy extends Tool
 {
     protected string $name = 'deploy';
 
-    protected string $description = 'Queue a deployment for a team-owned application by UUID. Requires deploy ability. Optional force rebuild and pull_request_id for previews.';
+    protected string $description = 'Queue a deployment for a team-owned application by UUID, or deploy every resource of the authenticated team that has a tag (tag + confirm=true). Give exactly one of uuid or tag. Requires deploy ability. Optional force rebuild and pull_request_id for previews (uuid only).';
 
     use BuildsResponse;
+    use CallsRestApi;
+    use ChecksTokenAbilities;
     use ResolvesTeam;
 
+    public function shouldRegister(): bool
+    {
+        return $this->currentTokenCan('deploy');
+    }
+
     public function handle(Request $request): Response
     {
         if ($error = $this->ensureAbility($request, 'deploy', $this->name)) {
@@ -31,7 +44,16 @@ class Deploy extends Tool
         }
 
         $uuid = $request->get('uuid');
-        if (! is_string($uuid) || $uuid === '') {
+        $tag = $request->get('tag');
+        $hasUuid = $uuid !== null && $uuid !== '';
+        $hasTag = $tag !== null && $tag !== '';
+        if ($hasUuid === $hasTag) {
+            return $this->mcpError($request, 'Give exactly one of uuid or tag.');
+        }
+        if ($hasTag) {
+            return $this->deployByTag($request, $teamId, $tag);
+        }
+        if (! is_string($uuid)) {
             return $this->mcpError($request, 'uuid argument is required.');
         }
 
@@ -85,12 +107,58 @@ class Deploy extends Tool
         ]), ['resource_uuid' => $uuid, 'deployment_uuid' => $deploymentUuid]);
     }
 
+    /**
+     * Deploys every resource of the token team with the tag through the REST deploy route.
+     */
+    private function deployByTag(Request $request, int $teamId, mixed $tag): Response
+    {
+        if (! is_string($tag)) {
+            return $this->mcpError($request, 'tag must be a string.');
+        }
+        if ($request->get('pull_request_id') !== null) {
+            return $this->mcpError($request, 'pull_request_id cannot be used with tag.');
+        }
+        if ($error = $this->ensureConfirmed($request, 'deploy by tag')) {
+            return $error;
+        }
+
+        $force = filter_var($request->get('force'), FILTER_VALIDATE_BOOLEAN);
+
+        try {
+            $result = $this->callRestApi('POST', 'deploy', [], ['tag' => $tag, 'force' => $force]);
+        } catch (\InvalidArgumentException $e) {
+            return $this->mcpError($request, $e->getMessage(), ['tag' => $tag]);
+        }
+
+        $body = is_array($result['body']) ? $result['body'] : [];
+        $context = ['tag' => $tag, 'status' => $result['status']];
+        if ($result['status'] >= 400) {
+            return $this->mcpError($request, (string) ($body['message'] ?? 'Request failed.'), $context);
+        }
+
+        auditLog('mcp.deploy', [
+            'team_id' => $teamId,
+            'tag' => $tag,
+            'force_rebuild' => $force,
+        ]);
+
+        return $this->mcpSuccess($request, $this->respond([
+            'ok' => true,
+            'tag' => $tag,
+            'force' => $force,
+            'messages' => $body['message'] ?? [],
+            'deployments' => $body['details'] ?? [],
+        ]), $context);
+    }
+
     public function schema(JsonSchema $schema): array
     {
         return [
-            'uuid' => $schema->string()->description('Application UUID.')->required(),
+            'uuid' => $schema->string()->description('Application UUID. Give either uuid or tag.'),
+            'tag' => $schema->string()->description('Tag name: deploys every application and service of the authenticated team with this tag. Needs confirm=true.'),
             'force' => $schema->boolean()->description('Force rebuild (default false).'),
-            'pull_request_id' => $schema->integer()->description('Optional PR id for preview deploy.'),
+            'pull_request_id' => $schema->integer()->description('Optional PR id for preview deploy (uuid only).'),
+            'confirm' => $schema->boolean()->description('Required true when deploying by tag.'),
         ];
     }
 }
diff --git a/app/Mcp/Tools/DockerCleanup.php b/app/Mcp/Tools/DockerCleanup.php
new file mode 100644
index 0000000000..22f5c498ba
--- /dev/null
+++ b/app/Mcp/Tools/DockerCleanup.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class DockerCleanup extends RestActionTool
+{
+    protected string $name = 'docker_cleanup';
+
+    protected string $description = 'Read or change the Docker cleanup settings of a server of the authenticated team, list recent cleanup runs, or start a cleanup now. Requires read ability for get/executions, write ability for update (turning on delete_unused_volumes also needs deploy), deploy ability for run. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'get' => ['method' => 'GET', 'path' => 'servers/{uuid}/docker-cleanup', 'ability' => 'read', 'description' => 'cleanup settings'],
+            'update' => ['method' => 'PATCH', 'path' => 'servers/{uuid}/docker-cleanup', 'ability' => 'write', 'description' => 'change cleanup settings (data: docker_cleanup_frequency, docker_cleanup_threshold, force_docker_cleanup, delete_unused_volumes, delete_unused_networks, disable_application_image_retention; turning on delete_unused_volumes needs deploy ability)'],
+            'executions' => ['method' => 'GET', 'path' => 'servers/{uuid}/docker-cleanup/executions', 'ability' => 'read', 'description' => 'last 20 cleanup runs'],
+            'run' => ['method' => 'POST', 'path' => 'servers/{uuid}/docker-cleanup/run', 'ability' => 'deploy', 'confirm' => true, 'description' => 'start a cleanup now; removes unused images, and volumes/networks when enabled (data: delete_unused_volumes, delete_unused_networks)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Server UUID.',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: docker_cleanup_frequency, docker_cleanup_threshold, force_docker_cleanup, delete_unused_volumes, delete_unused_networks, disable_application_image_retention.';
+    }
+}
diff --git a/app/Mcp/Tools/GetApplication.php b/app/Mcp/Tools/GetApplication.php
index 1d2f9f0144..2e45eec30a 100644
--- a/app/Mcp/Tools/GetApplication.php
+++ b/app/Mcp/Tools/GetApplication.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetApplication extends Tool
 {
     protected string $name = 'get_application';
diff --git a/app/Mcp/Tools/GetApplicationPreview.php b/app/Mcp/Tools/GetApplicationPreview.php
new file mode 100644
index 0000000000..2059bf78c1
--- /dev/null
+++ b/app/Mcp/Tools/GetApplicationPreview.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly]
+class GetApplicationPreview extends RestActionTool
+{
+    protected string $name = 'get_application_preview';
+
+    protected string $description = 'Get a pull request preview deployment of an application of the authenticated team, or its container logs. get requires read ability, logs require read:sensitive. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'get' => ['method' => 'GET', 'path' => 'applications/{uuid}/previews/{pull_request_id}', 'ability' => 'read', 'description' => 'preview details'],
+            'logs' => ['method' => 'GET', 'path' => 'applications/{uuid}/previews/{pull_request_id}/logs', 'ability' => 'read:sensitive', 'description' => 'preview container logs (data: lines, show_timestamps, service_name)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application UUID.',
+            'pull_request_id' => 'Pull request ID of the preview.',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Query fields for logs, same as the REST API: lines, show_timestamps, service_name.';
+    }
+}
diff --git a/app/Mcp/Tools/GetCurrentTeam.php b/app/Mcp/Tools/GetCurrentTeam.php
index 43f622646a..80c571f482 100644
--- a/app/Mcp/Tools/GetCurrentTeam.php
+++ b/app/Mcp/Tools/GetCurrentTeam.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetCurrentTeam extends Tool
 {
     protected string $name = 'get_current_team';
diff --git a/app/Mcp/Tools/GetDatabase.php b/app/Mcp/Tools/GetDatabase.php
index cafe8c2659..63b1f0e85d 100644
--- a/app/Mcp/Tools/GetDatabase.php
+++ b/app/Mcp/Tools/GetDatabase.php
@@ -8,7 +8,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetDatabase extends Tool
 {
     protected string $name = 'get_database';
diff --git a/app/Mcp/Tools/GetDatabaseImport.php b/app/Mcp/Tools/GetDatabaseImport.php
new file mode 100644
index 0000000000..924974e339
--- /dev/null
+++ b/app/Mcp/Tools/GetDatabaseImport.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly]
+class GetDatabaseImport extends RestActionTool
+{
+    protected string $name = 'get_database_import';
+
+    protected string $description = 'Get the status of a backup import into a standalone database or a service database of the authenticated team. Requires read ability; the import output is only shown with read:sensitive. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'get' => ['method' => 'GET', 'paths' => [
+                'database' => 'databases/{uuid}/imports/{activity_id}',
+                'service_database' => 'services/{uuid}/databases/{database_uuid}/imports/{activity_id}',
+            ], 'ability' => 'read', 'description' => 'import status'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Database UUID (resource=database) or service UUID (resource=service_database).',
+            'database_uuid' => 'Service database UUID (resource=service_database).',
+            'activity_id' => 'Import ID returned by the import action.',
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/GetDeployment.php b/app/Mcp/Tools/GetDeployment.php
index b07894462e..b056cb760b 100644
--- a/app/Mcp/Tools/GetDeployment.php
+++ b/app/Mcp/Tools/GetDeployment.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetDeployment extends Tool
 {
     protected string $name = 'get_deployment';
diff --git a/app/Mcp/Tools/GetDestination.php b/app/Mcp/Tools/GetDestination.php
index 5065f799a3..91f3973f80 100644
--- a/app/Mcp/Tools/GetDestination.php
+++ b/app/Mcp/Tools/GetDestination.php
@@ -10,7 +10,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetDestination extends Tool
 {
     protected string $name = 'get_destination';
diff --git a/app/Mcp/Tools/GetEnvValues.php b/app/Mcp/Tools/GetEnvValues.php
new file mode 100644
index 0000000000..ba4271bf9d
--- /dev/null
+++ b/app/Mcp/Tools/GetEnvValues.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly]
+class GetEnvValues extends RestActionTool
+{
+    protected string $name = 'get_env_values';
+
+    protected string $description = 'List environment variables with their values for an application, database, or service, or the shared variables of the team, a project, an environment, or a server of the authenticated team. Requires read and read:sensitive abilities and an admin or owner role. Values marked is_shown_once are never returned. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'list' => ['method' => 'GET', 'paths' => [
+                'application' => 'applications/{uuid}/envs',
+                'database' => 'databases/{uuid}/envs',
+                'service' => 'services/{uuid}/envs',
+                'team' => 'team/envs',
+                'project' => 'projects/{uuid}/envs',
+                'environment' => 'projects/{uuid}/environments/{environment_name_or_uuid}/envs',
+                'server' => 'servers/{uuid}/envs',
+            ], 'ability' => 'read:sensitive', 'description' => 'variables with values'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application, database, service, project, or server UUID. Not used for team.',
+            'environment_name_or_uuid' => 'Environment name or UUID (resource environment).',
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/GetEnvironment.php b/app/Mcp/Tools/GetEnvironment.php
index 4ae9073e84..d1110a2a95 100644
--- a/app/Mcp/Tools/GetEnvironment.php
+++ b/app/Mcp/Tools/GetEnvironment.php
@@ -10,7 +10,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetEnvironment extends Tool
 {
     protected string $name = 'get_environment';
diff --git a/app/Mcp/Tools/GetInfrastructureOverview.php b/app/Mcp/Tools/GetInfrastructureOverview.php
index b897c57005..dea213425f 100644
--- a/app/Mcp/Tools/GetInfrastructureOverview.php
+++ b/app/Mcp/Tools/GetInfrastructureOverview.php
@@ -16,7 +16,9 @@ use Illuminate\Support\Collection;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetInfrastructureOverview extends Tool
 {
     protected string $name = 'get_infrastructure_overview';
diff --git a/app/Mcp/Tools/GetLogs.php b/app/Mcp/Tools/GetLogs.php
index b90df64caf..8bc84fb22a 100644
--- a/app/Mcp/Tools/GetLogs.php
+++ b/app/Mcp/Tools/GetLogs.php
@@ -3,9 +3,11 @@
 namespace App\Mcp\Tools;
 
 use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ChecksTokenAbilities;
 use App\Mcp\Concerns\ResolvesResource;
 use App\Mcp\Concerns\ResolvesTeam;
 use App\Models\Application;
+use App\Models\EnvironmentVariable;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
@@ -13,7 +15,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetLogs extends Tool
 {
     protected string $name = 'get_logs';
@@ -21,9 +25,15 @@ class GetLogs extends Tool
     protected string $description = 'Fetch recent container logs for an application, database, service, or service child. Requires read:sensitive ability. Output is best-effort redacted (not a guarantee). Multi-container services require resource=service_application|service_database. Requires a running container on a reachable server. On failure returns structured reason + next_tools (DB-only follow-ups). Default 100 lines, max 500.';
 
     use BuildsResponse;
+    use ChecksTokenAbilities;
     use ResolvesResource;
     use ResolvesTeam;
 
+    public function shouldRegister(): bool
+    {
+        return $this->currentTokenCan('read:sensitive');
+    }
+
     public function handle(Request $request): Response
     {
         if ($error = $this->ensureAbility($request, 'read:sensitive', $this->name)) {
@@ -65,14 +75,17 @@ class GetLogs extends Tool
             return $this->mcpSuccess($request, $this->respond($failure), ['resource_uuid' => $uuid, 'outcome' => 'unavailable']);
         }
 
+        $secrets = $this->logRedactionSecrets($resource);
+
         try {
             $logs = $this->redactLogText(
-                $this->fetchLogs($resource, $resourceType, $lines, $showTimestamps)
+                $this->fetchLogs($resource, $resourceType, $lines, $showTimestamps),
+                $secrets,
             );
         } catch (MultipleContainersException $e) {
             $payload = $this->failurePayload(
                 reason: 'multiple_containers',
-                message: $e->getMessage(),
+                message: $this->redactLogText($e->getMessage(), $secrets),
                 resourceType: $resourceType,
                 uuid: $uuid,
                 status: $resource->status ?? null,
@@ -85,7 +98,7 @@ class GetLogs extends Tool
             return $this->mcpSuccess($request, $this->respond(
                 $this->failurePayload(
                     reason: 'log_fetch_failed',
-                    message: $e->getMessage(),
+                    message: $this->redactLogText($e->getMessage(), $secrets),
                     resourceType: $resourceType,
                     uuid: $uuid,
                     status: $resource->status ?? null,
@@ -104,6 +117,20 @@ class GetLogs extends Tool
         ]), ['resource_uuid' => $uuid]);
     }
 
+    /**
+     * Environment values and database credentials of the resource that owns the log output.
+     *
+     * @return array{known: array<int, string>, locked: array<int, string>}
+     */
+    private function logRedactionSecrets(mixed $resource): array
+    {
+        if ($resource instanceof ServiceApplication || $resource instanceof ServiceDatabase) {
+            $resource = $resource->service;
+        }
+
+        return EnvironmentVariable::logRedactionSecretsFor($resource);
+    }
+
     /**
      * @return array<string, mixed>|null
      */
diff --git a/app/Mcp/Tools/GetProject.php b/app/Mcp/Tools/GetProject.php
index 8c967f8144..e875019348 100644
--- a/app/Mcp/Tools/GetProject.php
+++ b/app/Mcp/Tools/GetProject.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetProject extends Tool
 {
     protected string $name = 'get_project';
diff --git a/app/Mcp/Tools/GetServer.php b/app/Mcp/Tools/GetServer.php
index 771aa7d36e..9466f27d62 100644
--- a/app/Mcp/Tools/GetServer.php
+++ b/app/Mcp/Tools/GetServer.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetServer extends Tool
 {
     protected string $name = 'get_server';
diff --git a/app/Mcp/Tools/GetServerDomains.php b/app/Mcp/Tools/GetServerDomains.php
index 9378549220..b103be84e6 100644
--- a/app/Mcp/Tools/GetServerDomains.php
+++ b/app/Mcp/Tools/GetServerDomains.php
@@ -13,7 +13,9 @@ use Illuminate\Support\Stringable;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetServerDomains extends Tool
 {
     protected string $name = 'get_server_domains';
diff --git a/app/Mcp/Tools/GetServerMetrics.php b/app/Mcp/Tools/GetServerMetrics.php
new file mode 100644
index 0000000000..3b34a40bb7
--- /dev/null
+++ b/app/Mcp/Tools/GetServerMetrics.php
@@ -0,0 +1,136 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use App\Models\Server;
+use App\Services\SentinelMetricsClient;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly]
+class GetServerMetrics extends Tool
+{
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    private const DEFAULT_MINUTES = 60;
+
+    private const MAX_MINUTES = 43200;
+
+    protected string $name = 'get_server_metrics';
+
+    protected string $description = 'Get current and recent Sentinel metrics (CPU %, memory bytes, root disk %, load, network bytes/s) for one server of the authenticated team. Metrics must be enabled on the server. Requires read ability.';
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
+            return $error;
+        }
+
+        $teamId = $this->resolveTeamId($request);
+        if (is_null($teamId)) {
+            return $this->mcpError($request, 'Invalid token.');
+        }
+
+        $uuid = $request->get('server_uuid');
+        if (! is_string($uuid) || $uuid === '') {
+            return $this->mcpError($request, 'server_uuid argument is required.');
+        }
+
+        $minutes = filter_var($request->get('minutes', self::DEFAULT_MINUTES), FILTER_VALIDATE_INT);
+        if ($minutes === false || $minutes < 1) {
+            return $this->mcpError($request, 'minutes must be a positive integer.');
+        }
+        $minutes = min($minutes, self::MAX_MINUTES);
+
+        $server = Server::whereTeamId($teamId)->where('uuid', $uuid)->with('settings')->first();
+        if (! $server) {
+            return $this->mcpError($request, "Server [{$uuid}] not found.", ['resource_uuid' => $uuid]);
+        }
+
+        if (! $server->isMetricsEnabled()) {
+            return $this->mcpError($request, 'Metrics are not enabled for this server. Enable Sentinel metrics in the server settings first.', ['resource_uuid' => $uuid]);
+        }
+
+        /** @var SentinelMetricsClient $client */
+        $client = app(SentinelMetricsClient::class, ['server' => $server]);
+        $range = match (true) {
+            $minutes <= 1440 => '24h',
+            $minutes <= 10080 => '7d',
+            default => '30d',
+        };
+        $sinceMs = now()->subMinutes($minutes)->getTimestampMs();
+
+        $summary = $this->safely(fn () => $client->summary());
+        $network = $this->safely(fn () => $client->networkHistory($range)) ?? ['rx' => [], 'tx' => []];
+
+        $series = [
+            'cpu_percent' => $this->recent($this->safely(fn () => $client->history('cpu', $range)), $sinceMs),
+            'memory_used_bytes' => $this->recent($this->safely(fn () => $client->history('memory', $range)), $sinceMs),
+            'disk_used_percent' => $this->recent($this->safely(fn () => $client->history('disk', $range)), $sinceMs),
+            'load1' => $this->recent($this->safely(fn () => $client->history('load', $range)), $sinceMs),
+            'network_rx_bytes_per_sec' => $this->recent($network['rx'] ?? [], $sinceMs),
+            'network_tx_bytes_per_sec' => $this->recent($network['tx'] ?? [], $sinceMs),
+        ];
+
+        $data = [
+            'server_uuid' => $server->uuid,
+            'server_name' => $server->name,
+            'online' => $summary !== null,
+            'minutes' => $minutes,
+            'bucket_seconds' => intdiv(SentinelMetricsClient::bucketMs($range), 1000),
+            'current' => $summary === null ? null : [
+                'cpu_percent' => $summary['cpu'] ?? null,
+                'memory_used_bytes' => $summary['memUsed'] ?? null,
+                'memory_total_bytes' => $summary['memTotal'] ?? null,
+                'disk_used_bytes' => $summary['diskUsed'] ?? null,
+                'disk_total_bytes' => $summary['diskTotal'] ?? null,
+                'disk_used_percent' => $summary['diskPercent'] ?? null,
+                'load1' => $summary['load1'] ?? null,
+                'network_rx_bytes_per_sec' => $summary['netRx'] ?? null,
+                'network_tx_bytes_per_sec' => $summary['netTx'] ?? null,
+            ],
+            'series' => $series,
+            'series_format' => '[timestamp_ms, value] pairs, averaged per bucket',
+        ];
+
+        return $this->mcpSuccess($request, $this->respond($data), ['resource_uuid' => $uuid, 'minutes' => $minutes]);
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'server_uuid' => $schema->string()->description('Server UUID.')->required(),
+            'minutes' => $schema->integer()->description('How many minutes of history to return (default 60, max 43200 = 30 days).'),
+        ];
+    }
+
+    /**
+     * @template T
+     *
+     * @param  callable(): T  $callback
+     * @return T|null
+     */
+    private function safely(callable $callback): mixed
+    {
+        try {
+            return $callback();
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+
+    /**
+     * @param  array<int, array{0: int, 1: float}>|null  $points
+     * @return array<int, array{0: int, 1: float}>
+     */
+    private function recent(?array $points, int $sinceMs): array
+    {
+        return array_values(array_filter($points ?? [], fn ($point): bool => is_array($point) && (int) ($point[0] ?? 0) >= $sinceMs));
+    }
+}
diff --git a/app/Mcp/Tools/GetServerResources.php b/app/Mcp/Tools/GetServerResources.php
index d796e9315a..ee614938fb 100644
--- a/app/Mcp/Tools/GetServerResources.php
+++ b/app/Mcp/Tools/GetServerResources.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetServerResources extends Tool
 {
     protected string $name = 'get_server_resources';
diff --git a/app/Mcp/Tools/GetService.php b/app/Mcp/Tools/GetService.php
index ad14ddb497..ba5725e902 100644
--- a/app/Mcp/Tools/GetService.php
+++ b/app/Mcp/Tools/GetService.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetService extends Tool
 {
     protected string $name = 'get_service';
diff --git a/app/Mcp/Tools/GetServiceApplication.php b/app/Mcp/Tools/GetServiceApplication.php
index 0d86d03159..b357170dbc 100644
--- a/app/Mcp/Tools/GetServiceApplication.php
+++ b/app/Mcp/Tools/GetServiceApplication.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetServiceApplication extends Tool
 {
     protected string $name = 'get_service_application';
diff --git a/app/Mcp/Tools/GetServiceDatabase.php b/app/Mcp/Tools/GetServiceDatabase.php
index fa3da38634..4eed5c7763 100644
--- a/app/Mcp/Tools/GetServiceDatabase.php
+++ b/app/Mcp/Tools/GetServiceDatabase.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class GetServiceDatabase extends Tool
 {
     protected string $name = 'get_service_database';
diff --git a/app/Mcp/Tools/ListApplicationPreviews.php b/app/Mcp/Tools/ListApplicationPreviews.php
index 8a4e7fc21b..af8bbc064c 100644
--- a/app/Mcp/Tools/ListApplicationPreviews.php
+++ b/app/Mcp/Tools/ListApplicationPreviews.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListApplicationPreviews extends Tool
 {
     protected string $name = 'list_application_previews';
diff --git a/app/Mcp/Tools/ListApplications.php b/app/Mcp/Tools/ListApplications.php
index 3bab877ebc..2191f289e3 100644
--- a/app/Mcp/Tools/ListApplications.php
+++ b/app/Mcp/Tools/ListApplications.php
@@ -14,7 +14,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListApplications extends Tool
 {
     protected string $name = 'list_applications';
diff --git a/app/Mcp/Tools/ListAuditEvents.php b/app/Mcp/Tools/ListAuditEvents.php
new file mode 100644
index 0000000000..9fad17d30c
--- /dev/null
+++ b/app/Mcp/Tools/ListAuditEvents.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly]
+class ListAuditEvents extends RestActionTool
+{
+    protected string $name = 'list_audit_events';
+
+    protected string $description = 'List audit events of the authenticated team, newest first. Only team admins and owners. Actor emails, IPs, and metadata need read:sensitive. Requires read ability. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'list' => ['method' => 'GET', 'path' => 'audit-events', 'ability' => 'read', 'description' => 'audit events (data: per_page max 100, page, search, action, source all|ui|api|mcp|webhook|system|scheduler)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Query filters, same as the REST API: per_page, page, search, action, source.';
+    }
+}
diff --git a/app/Mcp/Tools/ListBackupExecutions.php b/app/Mcp/Tools/ListBackupExecutions.php
index b1880babad..5673966b32 100644
--- a/app/Mcp/Tools/ListBackupExecutions.php
+++ b/app/Mcp/Tools/ListBackupExecutions.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListBackupExecutions extends Tool
 {
     protected string $name = 'list_backup_executions';
diff --git a/app/Mcp/Tools/ListDatabaseBackups.php b/app/Mcp/Tools/ListDatabaseBackups.php
index 7c65130935..8e36faf9d6 100644
--- a/app/Mcp/Tools/ListDatabaseBackups.php
+++ b/app/Mcp/Tools/ListDatabaseBackups.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListDatabaseBackups extends Tool
 {
     protected string $name = 'list_database_backups';
@@ -43,6 +45,7 @@ class ListDatabaseBackups extends Tool
         $backups = ScheduledDatabaseBackup::ownedByCurrentTeamAPI($teamId)
             ->where('database_id', $database->id)
             ->where('database_type', $database->getMorphClass())
+            ->with(['s3', 's3Storages'])
             ->get()
             ->map(fn ($backup) => $this->scrubSensitive([
                 'uuid' => $backup->uuid,
@@ -51,6 +54,7 @@ class ListDatabaseBackups extends Tool
                 'database_backup_retention_amount_locally' => $backup->database_backup_retention_amount_locally ?? null,
                 'save_s3' => $backup->save_s3 ?? null,
                 's3_storage_uuid' => $backup->s3?->uuid ?? null,
+                's3_storage_uuids' => $backup->selectedS3Storages()->pluck('uuid')->all(),
                 'created_at' => $backup->created_at,
                 'updated_at' => $backup->updated_at,
             ]))
diff --git a/app/Mcp/Tools/ListDatabases.php b/app/Mcp/Tools/ListDatabases.php
index c05efd81eb..e24af38fc9 100644
--- a/app/Mcp/Tools/ListDatabases.php
+++ b/app/Mcp/Tools/ListDatabases.php
@@ -16,7 +16,9 @@ use Illuminate\Support\Facades\DB;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListDatabases extends Tool
 {
     protected string $name = 'list_databases';
diff --git a/app/Mcp/Tools/ListDeployments.php b/app/Mcp/Tools/ListDeployments.php
index 8af839a58b..e958cc0c32 100644
--- a/app/Mcp/Tools/ListDeployments.php
+++ b/app/Mcp/Tools/ListDeployments.php
@@ -10,7 +10,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListDeployments extends Tool
 {
     protected string $name = 'list_deployments';
diff --git a/app/Mcp/Tools/ListDestinations.php b/app/Mcp/Tools/ListDestinations.php
index dc98020de7..5ccf959d14 100644
--- a/app/Mcp/Tools/ListDestinations.php
+++ b/app/Mcp/Tools/ListDestinations.php
@@ -11,7 +11,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListDestinations extends Tool
 {
     protected string $name = 'list_destinations';
diff --git a/app/Mcp/Tools/ListEnvKeys.php b/app/Mcp/Tools/ListEnvKeys.php
index 98fe4281dc..331060c555 100644
--- a/app/Mcp/Tools/ListEnvKeys.php
+++ b/app/Mcp/Tools/ListEnvKeys.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListEnvKeys extends Tool
 {
     protected string $name = 'list_env_keys';
diff --git a/app/Mcp/Tools/ListGithubApps.php b/app/Mcp/Tools/ListGithubApps.php
index 0283bbc0dc..f3048f0140 100644
--- a/app/Mcp/Tools/ListGithubApps.php
+++ b/app/Mcp/Tools/ListGithubApps.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListGithubApps extends Tool
 {
     protected string $name = 'list_github_apps';
diff --git a/app/Mcp/Tools/ListGithubBranches.php b/app/Mcp/Tools/ListGithubBranches.php
index 7954cecfa9..849c401051 100644
--- a/app/Mcp/Tools/ListGithubBranches.php
+++ b/app/Mcp/Tools/ListGithubBranches.php
@@ -10,7 +10,11 @@ use Illuminate\Support\Facades\Http;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsOpenWorld;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
+#[IsOpenWorld]
 class ListGithubBranches extends Tool
 {
     protected string $name = 'list_github_branches';
diff --git a/app/Mcp/Tools/ListGithubRepositories.php b/app/Mcp/Tools/ListGithubRepositories.php
index 7c639f509f..59c5ef273e 100644
--- a/app/Mcp/Tools/ListGithubRepositories.php
+++ b/app/Mcp/Tools/ListGithubRepositories.php
@@ -10,7 +10,11 @@ use Illuminate\Support\Facades\Http;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsOpenWorld;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
+#[IsOpenWorld]
 class ListGithubRepositories extends Tool
 {
     protected string $name = 'list_github_repositories';
diff --git a/app/Mcp/Tools/ListProjects.php b/app/Mcp/Tools/ListProjects.php
index 0a6de7f608..e9b363c709 100644
--- a/app/Mcp/Tools/ListProjects.php
+++ b/app/Mcp/Tools/ListProjects.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListProjects extends Tool
 {
     protected string $name = 'list_projects';
diff --git a/app/Mcp/Tools/ListResourceTags.php b/app/Mcp/Tools/ListResourceTags.php
index 523a524177..481a373e4c 100644
--- a/app/Mcp/Tools/ListResourceTags.php
+++ b/app/Mcp/Tools/ListResourceTags.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListResourceTags extends Tool
 {
     protected string $name = 'list_resource_tags';
diff --git a/app/Mcp/Tools/ListResources.php b/app/Mcp/Tools/ListResources.php
index f6cde3e125..c3f23e3ab1 100644
--- a/app/Mcp/Tools/ListResources.php
+++ b/app/Mcp/Tools/ListResources.php
@@ -15,7 +15,9 @@ use Illuminate\Support\Facades\DB;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListResources extends Tool
 {
     protected string $name = 'list_resources';
diff --git a/app/Mcp/Tools/ListRollbackImages.php b/app/Mcp/Tools/ListRollbackImages.php
new file mode 100644
index 0000000000..a77890344d
--- /dev/null
+++ b/app/Mcp/Tools/ListRollbackImages.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly]
+class ListRollbackImages extends RestActionTool
+{
+    protected string $name = 'list_rollback_images';
+
+    protected string $description = 'List the Docker images on the server that an application of the authenticated team can be rolled back to. Requires read ability. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'list' => ['method' => 'GET', 'path' => 'applications/{uuid}/rollback-images', 'ability' => 'read', 'description' => 'list rollback images and the current tag'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application UUID.',
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/ListScheduledTaskExecutions.php b/app/Mcp/Tools/ListScheduledTaskExecutions.php
index d88636f8fb..8f4ad75b93 100644
--- a/app/Mcp/Tools/ListScheduledTaskExecutions.php
+++ b/app/Mcp/Tools/ListScheduledTaskExecutions.php
@@ -10,7 +10,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListScheduledTaskExecutions extends Tool
 {
     protected string $name = 'list_scheduled_task_executions';
diff --git a/app/Mcp/Tools/ListScheduledTasks.php b/app/Mcp/Tools/ListScheduledTasks.php
index cdefe73137..4062d47d21 100644
--- a/app/Mcp/Tools/ListScheduledTasks.php
+++ b/app/Mcp/Tools/ListScheduledTasks.php
@@ -10,7 +10,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListScheduledTasks extends Tool
 {
     protected string $name = 'list_scheduled_tasks';
diff --git a/app/Mcp/Tools/ListServers.php b/app/Mcp/Tools/ListServers.php
index 98846b33f6..6fc38962e8 100644
--- a/app/Mcp/Tools/ListServers.php
+++ b/app/Mcp/Tools/ListServers.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListServers extends Tool
 {
     protected string $name = 'list_servers';
diff --git a/app/Mcp/Tools/ListServiceApplications.php b/app/Mcp/Tools/ListServiceApplications.php
index bfe16cdea6..15c1d8b4da 100644
--- a/app/Mcp/Tools/ListServiceApplications.php
+++ b/app/Mcp/Tools/ListServiceApplications.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListServiceApplications extends Tool
 {
     protected string $name = 'list_service_applications';
diff --git a/app/Mcp/Tools/ListServiceDatabases.php b/app/Mcp/Tools/ListServiceDatabases.php
index 1a90ca866e..1d6dd165f7 100644
--- a/app/Mcp/Tools/ListServiceDatabases.php
+++ b/app/Mcp/Tools/ListServiceDatabases.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListServiceDatabases extends Tool
 {
     protected string $name = 'list_service_databases';
diff --git a/app/Mcp/Tools/ListServiceTemplates.php b/app/Mcp/Tools/ListServiceTemplates.php
new file mode 100644
index 0000000000..f52623f70d
--- /dev/null
+++ b/app/Mcp/Tools/ListServiceTemplates.php
@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\ResolvesTeam;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly]
+class ListServiceTemplates extends Tool
+{
+    protected string $name = 'list_service_templates';
+
+    protected string $description = 'List the one-click service templates that create_service accepts as type (name, slogan, category, tags, documentation, port). Never returns the Compose content. Optional search over name, slogan, category and tags. Requires read ability.';
+
+    use BuildsResponse;
+    use ResolvesTeam;
+
+    public function handle(Request $request): Response
+    {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
+            return $error;
+        }
+
+        if (is_null($this->resolveTeamId($request))) {
+            return $this->mcpError($request, 'Invalid token.');
+        }
+
+        $search = $request->get('search');
+        $search = is_string($search) ? mb_strtolower(trim($search)) : '';
+
+        $templates = get_service_templates()
+            ->map(fn ($template, $type): array => [
+                'type' => (string) $type,
+                'slogan' => is_string(data_get($template, 'slogan')) ? data_get($template, 'slogan') : null,
+                'category' => is_string(data_get($template, 'category')) ? data_get($template, 'category') : null,
+                'tags' => collect(data_get($template, 'tags', []))->filter(fn ($tag): bool => is_string($tag))->values()->all(),
+                'documentation' => is_string(data_get($template, 'documentation')) ? data_get($template, 'documentation') : null,
+                'port' => is_scalar(data_get($template, 'port')) ? (string) data_get($template, 'port') : null,
+            ])
+            ->when($search !== '', fn ($collection) => $collection->filter(function (array $template) use ($search): bool {
+                $haystack = mb_strtolower(implode(' ', [$template['type'], $template['slogan'] ?? '', $template['category'] ?? '', implode(' ', $template['tags'])]));
+
+                return str_contains($haystack, $search);
+            }))
+            ->sortKeys()
+            ->values();
+
+        $args = $this->paginationArgs($request);
+        $total = $templates->count();
+        $extraArgs = $search !== '' ? ['search' => $search] : [];
+
+        return $this->mcpSuccess($request, $this->respond(
+            $templates->slice($args['offset'], $args['per_page'])->values()->all(),
+            [],
+            $this->paginationMeta($this->name, $args, $total, $extraArgs),
+        ));
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'search' => $schema->string()->description('Case-insensitive text to match in the template name, slogan, category, or tags.'),
+            'page' => $schema->integer()->description('Page number (default 1).'),
+            'per_page' => $schema->integer()->description('Items per page (default 50, max 100).'),
+        ];
+    }
+}
diff --git a/app/Mcp/Tools/ListServices.php b/app/Mcp/Tools/ListServices.php
index e3a268cd29..2e9bb4d1b7 100644
--- a/app/Mcp/Tools/ListServices.php
+++ b/app/Mcp/Tools/ListServices.php
@@ -16,7 +16,9 @@ use Illuminate\Support\Collection;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListServices extends Tool
 {
     protected string $name = 'list_services';
diff --git a/app/Mcp/Tools/ListSharedEnvKeys.php b/app/Mcp/Tools/ListSharedEnvKeys.php
index cfd64435f5..beb8f7abc4 100644
--- a/app/Mcp/Tools/ListSharedEnvKeys.php
+++ b/app/Mcp/Tools/ListSharedEnvKeys.php
@@ -11,7 +11,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListSharedEnvKeys extends Tool
 {
     protected string $name = 'list_shared_env_keys';
diff --git a/app/Mcp/Tools/ListStorages.php b/app/Mcp/Tools/ListStorages.php
index e788f3c8c6..1ba32eb552 100644
--- a/app/Mcp/Tools/ListStorages.php
+++ b/app/Mcp/Tools/ListStorages.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListStorages extends Tool
 {
     protected string $name = 'list_storages';
diff --git a/app/Mcp/Tools/ListTags.php b/app/Mcp/Tools/ListTags.php
index c3ba212116..66fb991e72 100644
--- a/app/Mcp/Tools/ListTags.php
+++ b/app/Mcp/Tools/ListTags.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListTags extends Tool
 {
     protected string $name = 'list_tags';
diff --git a/app/Mcp/Tools/ListTeamMembers.php b/app/Mcp/Tools/ListTeamMembers.php
index c4bc3f5ed9..d1d44e64d5 100644
--- a/app/Mcp/Tools/ListTeamMembers.php
+++ b/app/Mcp/Tools/ListTeamMembers.php
@@ -9,7 +9,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListTeamMembers extends Tool
 {
     protected string $name = 'list_team_members';
diff --git a/app/Mcp/Tools/ListUnhealthyResources.php b/app/Mcp/Tools/ListUnhealthyResources.php
index a394d8ce05..3fd3ad56ed 100644
--- a/app/Mcp/Tools/ListUnhealthyResources.php
+++ b/app/Mcp/Tools/ListUnhealthyResources.php
@@ -16,7 +16,9 @@ use Illuminate\Support\Collection;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class ListUnhealthyResources extends Tool
 {
     protected string $name = 'list_unhealthy_resources';
diff --git a/app/Mcp/Tools/ManageApplication.php b/app/Mcp/Tools/ManageApplication.php
new file mode 100644
index 0000000000..bf857b4fda
--- /dev/null
+++ b/app/Mcp/Tools/ManageApplication.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageApplication extends RestActionTool
+{
+    protected string $name = 'manage_application';
+
+    protected string $description = 'Update, delete, clone, or move an application of the authenticated team, or add or remove an additional server destination. Requires write ability; delete, instant_deploy, manual webhook secrets, and clone_volumes also need deploy. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'update' => ['method' => 'PATCH', 'path' => 'applications/{uuid}', 'ability' => 'write', 'description' => 'update application settings (data: same fields as the REST update, e.g. name, domains, git_branch, ports_exposes, build_command; instant_deploy and manual_webhook_secret_* need deploy ability)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'applications/{uuid}', 'ability' => 'deploy', 'confirm' => true, 'description' => 'delete the application and its containers (data: delete_volumes, delete_connected_networks, delete_configurations, docker_cleanup)'],
+            'clone' => ['method' => 'POST', 'path' => 'applications/{uuid}/clone', 'ability' => 'write', 'description' => 'clone the application to a destination of the team (data: destination_uuid, name, clone_volumes; clone_volumes needs deploy ability)'],
+            'move' => ['method' => 'POST', 'path' => 'applications/{uuid}/move', 'ability' => 'write', 'confirm' => true, 'description' => 'move the application to another environment of the team (data: environment_uuid)'],
+            'add_server' => ['method' => 'POST', 'path' => 'applications/{uuid}/destinations', 'ability' => 'write', 'description' => 'attach an additional destination on another server (data: destination_uuid)'],
+            'remove_server' => ['method' => 'DELETE', 'path' => 'applications/{uuid}/destinations/{destination_uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'detach an additional destination'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application UUID.',
+            'destination_uuid' => 'Destination UUID to detach (remove_server only).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API. update: application fields; delete: delete_volumes, delete_connected_networks, delete_configurations, docker_cleanup; clone: destination_uuid, name, clone_volumes; move: environment_uuid; add_server: destination_uuid.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageBackup.php b/app/Mcp/Tools/ManageBackup.php
new file mode 100644
index 0000000000..1a9441f693
--- /dev/null
+++ b/app/Mcp/Tools/ManageBackup.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageBackup extends RestActionTool
+{
+    protected string $name = 'manage_backup';
+
+    protected string $description = 'Create, update, or delete a backup schedule of a database of the authenticated team, or delete one backup execution. Set data.backup_now=true on create or update to run a backup now (requires deploy ability). Requires write ability. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'path' => 'databases/{uuid}/backups', 'ability' => 'write', 'description' => 'create a backup schedule (data: frequency, enabled, save_s3, s3_storage_uuid(s), retention fields, backup_now ...; backup_now needs deploy ability)'],
+            'update' => ['method' => 'PATCH', 'path' => 'databases/{uuid}/backups/{scheduled_backup_uuid}', 'ability' => 'write', 'description' => 'update a backup schedule; data.backup_now=true runs a backup now and needs deploy ability'],
+            'delete' => ['method' => 'DELETE', 'path' => 'databases/{uuid}/backups/{scheduled_backup_uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete a backup schedule and all its backup files (data.delete_s3=true also deletes S3 copies)'],
+            'delete_execution' => ['method' => 'DELETE', 'path' => 'databases/{uuid}/backups/{scheduled_backup_uuid}/executions/{execution_uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete one backup execution and its file (data.delete_s3=true also deletes the S3 copy)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Database UUID.',
+            'scheduled_backup_uuid' => 'Backup schedule UUID (not needed for create).',
+            'execution_uuid' => 'Backup execution UUID (delete_execution only).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: frequency, enabled, save_s3, dump_all, backup_now, s3_storage_uuid, s3_storage_uuids, databases_to_backup, database_backup_retention_amount_locally, database_backup_retention_days_locally, database_backup_retention_max_storage_locally, database_backup_retention_amount_s3, database_backup_retention_days_s3, database_backup_retention_max_storage_s3, timeout, missing_backup_notification_days; delete_s3 for deletes.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageDatabase.php b/app/Mcp/Tools/ManageDatabase.php
new file mode 100644
index 0000000000..5e4c11308d
--- /dev/null
+++ b/app/Mcp/Tools/ManageDatabase.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageDatabase extends RestActionTool
+{
+    protected string $name = 'manage_database';
+
+    protected string $description = 'Update, delete, clone, move, or import a backup into a standalone database of the authenticated team. Requires write ability; delete and import also need deploy, and so do instant_deploy, changing is_public, and clone_volumes. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'update' => ['method' => 'PATCH', 'path' => 'databases/{uuid}', 'ability' => 'write', 'description' => 'update database settings (data: name, description, image, is_public, public_port, public_port_timeout, limits_*, type credentials and *_conf fields, redact_all_env_values_in_logs, instant_deploy; instant_deploy and changing is_public need deploy ability)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'databases/{uuid}', 'ability' => 'deploy', 'confirm' => true, 'description' => 'delete the database (data: delete_volumes, delete_connected_networks, delete_configurations, docker_cleanup; all default true)'],
+            'clone' => ['method' => 'POST', 'path' => 'databases/{uuid}/clone', 'ability' => 'write', 'confirm' => true, 'description' => 'clone the database to a destination of the team (data: destination_uuid, name, clone_volumes; clone_volumes stops the source database while volumes are copied and needs deploy ability)'],
+            'move' => ['method' => 'POST', 'path' => 'databases/{uuid}/move', 'ability' => 'write', 'confirm' => true, 'description' => 'move the database to another environment of the team (data: environment_uuid)'],
+            'import' => ['method' => 'POST', 'path' => 'databases/{uuid}/imports', 'ability' => 'deploy', 'confirm' => true, 'description' => 'import a backup into the database, can overwrite data (data: source s3 | server, s3_storage_uuid, path, dump_all, replace_existing, keep_owners, restore_mysql_users, sqlite_database); check progress with get_database_import'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Database UUID.',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API (see the action descriptions). File uploads are not supported: import only from an S3 storage of the team (source=s3, s3_storage_uuid, path) or a server path (source=server, path).';
+    }
+}
diff --git a/app/Mcp/Tools/ManageDestination.php b/app/Mcp/Tools/ManageDestination.php
new file mode 100644
index 0000000000..fa3f65f107
--- /dev/null
+++ b/app/Mcp/Tools/ManageDestination.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageDestination extends RestActionTool
+{
+    protected string $name = 'manage_destination';
+
+    protected string $description = 'Create a Docker network destination on a server of the authenticated team, rename one, or delete one without resources. Requires write ability. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'path' => 'servers/{server_uuid}/destinations', 'ability' => 'write', 'description' => 'create a destination on a server (data: network, name, type standalone|swarm)'],
+            'update' => ['method' => 'PATCH', 'path' => 'destinations/{uuid}', 'ability' => 'write', 'description' => 'rename a destination (data: name)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'destinations/{uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete a destination without resources and remove its Docker network'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'server_uuid' => 'Server UUID (create only).',
+            'uuid' => 'Destination UUID (update and delete).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: network, name, type (create); name (update).';
+    }
+}
diff --git a/app/Mcp/Tools/ManageEnv.php b/app/Mcp/Tools/ManageEnv.php
new file mode 100644
index 0000000000..676afb81c2
--- /dev/null
+++ b/app/Mcp/Tools/ManageEnv.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageEnv extends RestActionTool
+{
+    protected string $name = 'manage_env';
+
+    protected string $description = 'Create, update, bulk update, or delete environment variables of an application, database, or service of the authenticated team. Requires write ability. Values are only returned when the token also has read:sensitive. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'paths' => [
+                'application' => 'applications/{uuid}/envs',
+                'database' => 'databases/{uuid}/envs',
+                'service' => 'services/{uuid}/envs',
+            ], 'ability' => 'write', 'description' => 'create a variable (data: key, value, is_literal, is_multiline, is_shown_once, comment; applications also is_preview, is_runtime, is_buildtime)'],
+            'update' => ['method' => 'PATCH', 'paths' => [
+                'application' => 'applications/{uuid}/envs',
+                'database' => 'databases/{uuid}/envs',
+                'service' => 'services/{uuid}/envs',
+            ], 'ability' => 'write', 'description' => 'update the variable with this key (data: key, value and the create flags)'],
+            'bulk_update' => ['method' => 'PATCH', 'paths' => [
+                'application' => 'applications/{uuid}/envs/bulk',
+                'database' => 'databases/{uuid}/envs/bulk',
+                'service' => 'services/{uuid}/envs/bulk',
+            ], 'ability' => 'write', 'description' => 'create or update several variables (data: {"data": [{key, value, ...}]})'],
+            'delete' => ['method' => 'DELETE', 'paths' => [
+                'application' => 'applications/{uuid}/envs/{env_uuid}',
+                'database' => 'databases/{uuid}/envs/{env_uuid}',
+                'service' => 'services/{uuid}/envs/{env_uuid}',
+            ], 'ability' => 'write', 'confirm' => true, 'description' => 'delete a variable by UUID'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application, database, or service UUID.',
+            'env_uuid' => 'Environment variable UUID (delete). See list_env_keys.',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: key, value, is_literal, is_multiline, is_shown_once, comment; applications also is_preview, is_runtime, is_buildtime. bulk_update: {"data": [ ...variables ]}.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageGitSource.php b/app/Mcp/Tools/ManageGitSource.php
new file mode 100644
index 0000000000..435d8950ff
--- /dev/null
+++ b/app/Mcp/Tools/ManageGitSource.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageGitSource extends RestActionTool
+{
+    protected string $name = 'manage_git_source';
+
+    protected string $description = 'List, add, update, or delete GitHub apps (resource=github) and GitLab apps (resource=gitlab) of the authenticated team. Secrets and keys are never returned. Requires read ability for list, write ability for changes. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'list' => ['method' => 'GET', 'paths' => ['github' => 'github-apps', 'gitlab' => 'gitlab-apps'], 'ability' => 'read', 'description' => 'git apps of the team and system-wide apps'],
+            'create' => ['method' => 'POST', 'paths' => ['github' => 'github-apps', 'gitlab' => 'gitlab-apps'], 'ability' => 'write', 'description' => 'add a git app (github data: name, html_url, api_url, app_id, installation_id, client_id, client_secret, webhook_secret, private_key_uuid, organization, custom_user, custom_port; gitlab data: name, html_url, api_url, group_name, client_id, client_secret, webhook_token, redirect_uri, custom_user, custom_port)'],
+            'update' => ['method' => 'PATCH', 'paths' => ['github' => 'github-apps/{source_id}', 'gitlab' => 'gitlab-apps/{source_id}'], 'ability' => 'write', 'description' => 'update a git app of the team (data: same fields as create, all optional)'],
+            'delete' => ['method' => 'DELETE', 'paths' => ['github' => 'github-apps/{source_id}', 'gitlab' => 'gitlab-apps/{source_id}'], 'ability' => 'write', 'confirm' => true, 'description' => 'delete a git app of the team that no application uses'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'source_id' => 'Numeric id of the git app, from the list action (update and delete).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API for GitHub or GitLab apps.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageNotifications.php b/app/Mcp/Tools/ManageNotifications.php
new file mode 100644
index 0000000000..9a879930e5
--- /dev/null
+++ b/app/Mcp/Tools/ManageNotifications.php
@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsIdempotent;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+#[IsIdempotent]
+class ManageNotifications extends RestActionTool
+{
+    protected string $name = 'manage_notifications';
+
+    protected string $description = 'Read or change the notification settings of the authenticated team per channel (resource: email, discord, slack, telegram, pushover, webhook). Webhook URLs, tokens, and passwords are never returned. Requires read ability for get, write ability for update. Same validation and permissions as the REST API.';
+
+    private const CHANNEL_PATHS = [
+        'email' => 'notifications/email',
+        'discord' => 'notifications/discord',
+        'slack' => 'notifications/slack',
+        'telegram' => 'notifications/telegram',
+        'pushover' => 'notifications/pushover',
+        'webhook' => 'notifications/webhook',
+    ];
+
+    protected function actions(): array
+    {
+        return [
+            'get' => ['method' => 'GET', 'paths' => self::CHANNEL_PATHS, 'ability' => 'read', 'description' => 'settings of one channel'],
+            'update' => ['method' => 'PATCH', 'paths' => self::CHANNEL_PATHS, 'ability' => 'write', 'description' => 'change settings of one channel (data: fields of that channel, for example discord_enabled, discord_webhook_url, deployment_failure_discord_notifications)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API for the channel (for example smtp_*, resend_*, *_enabled, *_webhook_url, telegram_token, telegram_chat_id, pushover_user_key, pushover_api_token, and the per-event *_notifications flags).';
+    }
+}
diff --git a/app/Mcp/Tools/ManagePreview.php b/app/Mcp/Tools/ManagePreview.php
new file mode 100644
index 0000000000..e1f6700e61
--- /dev/null
+++ b/app/Mcp/Tools/ManagePreview.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManagePreview extends RestActionTool
+{
+    protected string $name = 'manage_preview';
+
+    protected string $description = 'Create (and deploy), update the domains of, or delete a pull request preview deployment of an application of the authenticated team. create and delete require deploy ability, update requires write. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'path' => 'applications/{uuid}/previews', 'ability' => 'deploy', 'description' => 'open or redeploy a preview (data: pull_request_id, pull_request_html_url, git_type, commit, docker_tag, force, instant_deploy)'],
+            'update' => ['method' => 'PATCH', 'path' => 'applications/{uuid}/previews/{pull_request_id}', 'ability' => 'write', 'description' => 'replace preview domains (data: domains, or docker_compose_domains for compose apps, force_domain_override)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'applications/{uuid}/previews/{pull_request_id}', 'ability' => 'deploy', 'confirm' => true, 'description' => 'delete the preview and its containers'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application UUID.',
+            'pull_request_id' => 'Pull request ID of the preview (update and delete).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API. create: pull_request_id (required), pull_request_html_url, git_type (github | gitlab | gitea | bitbucket), commit, docker_tag (Docker image apps), force, instant_deploy; update: domains or docker_compose_domains, force_domain_override.';
+    }
+}
diff --git a/app/Mcp/Tools/ManagePrivateKey.php b/app/Mcp/Tools/ManagePrivateKey.php
new file mode 100644
index 0000000000..36a9ced91b
--- /dev/null
+++ b/app/Mcp/Tools/ManagePrivateKey.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManagePrivateKey extends RestActionTool
+{
+    protected string $name = 'manage_private_key';
+
+    protected string $description = 'List, get, add, update, or delete SSH private keys of the authenticated team. The key material is never returned. Requires read ability for list/get, write ability for changes. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'list' => ['method' => 'GET', 'path' => 'security/keys', 'ability' => 'read', 'description' => 'private keys of the team (no key material)'],
+            'get' => ['method' => 'GET', 'path' => 'security/keys/{uuid}', 'ability' => 'read', 'description' => 'one private key (no key material)'],
+            'create' => ['method' => 'POST', 'path' => 'security/keys', 'ability' => 'write', 'description' => 'add a private key (data: private_key PEM or base64, name, description)'],
+            'update' => ['method' => 'PATCH', 'path' => 'security/keys/{uuid}', 'ability' => 'write', 'description' => 'update a private key (data: name, description; private_key only to replace the key)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'security/keys/{uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete a private key that is not in use'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Private key UUID (get, update, delete).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: private_key, name, description.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageProject.php b/app/Mcp/Tools/ManageProject.php
new file mode 100644
index 0000000000..6d84a61c5d
--- /dev/null
+++ b/app/Mcp/Tools/ManageProject.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageProject extends RestActionTool
+{
+    protected string $name = 'manage_project';
+
+    protected string $description = 'Create, update, or delete a project, or create, update, or delete an environment in a project of the authenticated team. Requires write ability. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'path' => 'projects', 'ability' => 'write', 'description' => 'create a project (data: name, description)'],
+            'update' => ['method' => 'PATCH', 'path' => 'projects/{uuid}', 'ability' => 'write', 'description' => 'update a project (data: name, description)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'projects/{uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete an empty project'],
+            'create_environment' => ['method' => 'POST', 'path' => 'projects/{uuid}/environments', 'ability' => 'write', 'description' => 'create an environment (data: name)'],
+            'update_environment' => ['method' => 'PATCH', 'path' => 'projects/{uuid}/environments/{environment_name_or_uuid}', 'ability' => 'write', 'description' => 'rename an environment (data: name)'],
+            'delete_environment' => ['method' => 'DELETE', 'path' => 'projects/{uuid}/environments/{environment_name_or_uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete an empty environment'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Project UUID (not needed for create).',
+            'environment_name_or_uuid' => 'Environment name or UUID (environment actions except create_environment).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: name, description.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageProxy.php b/app/Mcp/Tools/ManageProxy.php
new file mode 100644
index 0000000000..336ed495ed
--- /dev/null
+++ b/app/Mcp/Tools/ManageProxy.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageProxy extends RestActionTool
+{
+    protected string $name = 'manage_proxy';
+
+    protected string $description = 'Read or change the proxy of a server of the authenticated team: settings, configuration file, restart. Requires read ability for get, write ability for update (changing proxy_type also needs deploy), deploy ability for set_configuration and restart. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'get' => ['method' => 'GET', 'path' => 'servers/{uuid}/proxy', 'ability' => 'read', 'description' => 'proxy type, status, and settings (the configuration file only with read:sensitive)'],
+            'update' => ['method' => 'PATCH', 'path' => 'servers/{uuid}/proxy', 'ability' => 'write', 'confirm' => true, 'description' => 'change proxy settings (data: proxy_type, redirect_enabled, redirect_url, generate_exact_labels, traefik_certificate_resolver; changing proxy_type needs deploy ability)'],
+            'set_configuration' => ['method' => 'PUT', 'path' => 'servers/{uuid}/proxy/configuration', 'ability' => 'deploy', 'confirm' => true, 'description' => 'replace the proxy configuration file (data: configuration, plain or base64)'],
+            'restart' => ['method' => 'POST', 'path' => 'servers/{uuid}/proxy/restart', 'ability' => 'deploy', 'confirm' => true, 'description' => 'restart the proxy; routed apps are briefly unreachable'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Server UUID.',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: proxy_type, redirect_enabled, redirect_url, generate_exact_labels, traefik_certificate_resolver (update); configuration (set_configuration).';
+    }
+}
diff --git a/app/Mcp/Tools/ManageRegistry.php b/app/Mcp/Tools/ManageRegistry.php
new file mode 100644
index 0000000000..77b5457954
--- /dev/null
+++ b/app/Mcp/Tools/ManageRegistry.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageRegistry extends RestActionTool
+{
+    protected string $name = 'manage_registry';
+
+    protected string $description = 'List, add, check, or remove Docker registry logins on a server of the authenticated team. Passwords are never returned. Requires read:sensitive ability for list, deploy ability for create, write ability for check and delete. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'list' => ['method' => 'GET', 'path' => 'servers/{uuid}/registries', 'ability' => 'read:sensitive', 'description' => 'registry logins on the server (registry and username only)'],
+            'create' => ['method' => 'POST', 'path' => 'servers/{uuid}/registries', 'ability' => 'deploy', 'description' => 'log in to a registry on the server (data: registry, username, password)'],
+            'check' => ['method' => 'POST', 'path' => 'servers/{uuid}/registries/{registry}/check', 'ability' => 'write', 'description' => 'check that a registry login works'],
+            'delete' => ['method' => 'DELETE', 'path' => 'servers/{uuid}/registries/{registry}', 'ability' => 'write', 'confirm' => true, 'description' => 'log out of a registry; private image pulls can fail afterwards'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Server UUID.',
+            'registry' => 'Registry host, for example ghcr.io (check and delete). Hosts with a port are not supported here.',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: registry, username, password (create).';
+    }
+}
diff --git a/app/Mcp/Tools/ManageS3Storage.php b/app/Mcp/Tools/ManageS3Storage.php
new file mode 100644
index 0000000000..2f5a92970d
--- /dev/null
+++ b/app/Mcp/Tools/ManageS3Storage.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageS3Storage extends RestActionTool
+{
+    protected string $name = 'manage_s3_storage';
+
+    protected string $description = 'List, get, add, update, delete, or test S3 storages of the authenticated team. The secret key is never returned. Requires read ability for list/get, write ability for changes. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'list' => ['method' => 'GET', 'path' => 's3-storages', 'ability' => 'read', 'description' => 'S3 storages of the team'],
+            'get' => ['method' => 'GET', 'path' => 's3-storages/{uuid}', 'ability' => 'read', 'description' => 'one S3 storage'],
+            'create' => ['method' => 'POST', 'path' => 's3-storages', 'ability' => 'write', 'description' => 'add an S3 storage (data: name, endpoint, bucket, region, key, secret, description, is_usable)'],
+            'update' => ['method' => 'PATCH', 'path' => 's3-storages/{uuid}', 'ability' => 'write', 'description' => 'update an S3 storage (data: same fields as create, all optional)'],
+            'delete' => ['method' => 'DELETE', 'path' => 's3-storages/{uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete an S3 storage'],
+            'validate' => ['method' => 'POST', 'path' => 's3-storages/{uuid}/validate', 'ability' => 'write', 'description' => 'test the connection and save the result'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'S3 storage UUID (not needed for list and create).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: name, description, endpoint, bucket, region, key, secret, is_usable.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageScheduledTask.php b/app/Mcp/Tools/ManageScheduledTask.php
new file mode 100644
index 0000000000..e476b3f12a
--- /dev/null
+++ b/app/Mcp/Tools/ManageScheduledTask.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageScheduledTask extends RestActionTool
+{
+    protected string $name = 'manage_scheduled_task';
+
+    protected string $description = 'Create, update, delete, or run now a scheduled task of an application or service of the authenticated team. Requires write ability; run now and an enabled task also require deploy. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'paths' => [
+                'application' => 'applications/{uuid}/scheduled-tasks',
+                'service' => 'services/{uuid}/scheduled-tasks',
+            ], 'ability' => 'write', 'description' => 'create a scheduled task (data: name, command, frequency, container, timeout, enabled; an enabled task needs deploy ability)'],
+            'update' => ['method' => 'PATCH', 'paths' => [
+                'application' => 'applications/{uuid}/scheduled-tasks/{task_uuid}',
+                'service' => 'services/{uuid}/scheduled-tasks/{task_uuid}',
+            ], 'ability' => 'write', 'description' => 'update a scheduled task (data: any of name, command, frequency, container, timeout, enabled; an enabled task needs deploy ability)'],
+            'delete' => ['method' => 'DELETE', 'paths' => [
+                'application' => 'applications/{uuid}/scheduled-tasks/{task_uuid}',
+                'service' => 'services/{uuid}/scheduled-tasks/{task_uuid}',
+            ], 'ability' => 'write', 'confirm' => true, 'description' => 'delete a scheduled task'],
+            'execute' => ['method' => 'POST', 'paths' => [
+                'application' => 'applications/{uuid}/scheduled-tasks/{task_uuid}/execute',
+                'service' => 'services/{uuid}/scheduled-tasks/{task_uuid}/execute',
+            ], 'ability' => 'deploy', 'confirm' => true, 'description' => 'run the task command now'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application or service UUID.',
+            'task_uuid' => 'Scheduled task UUID (not needed for create).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: name, command, frequency (cron or every_minute, hourly, daily, weekly, monthly, yearly), container, timeout (seconds), enabled.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageServer.php b/app/Mcp/Tools/ManageServer.php
new file mode 100644
index 0000000000..7680d1c41b
--- /dev/null
+++ b/app/Mcp/Tools/ManageServer.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageServer extends RestActionTool
+{
+    protected string $name = 'manage_server';
+
+    protected string $description = 'Add, update, delete, or validate a server of the authenticated team. Requires write ability; changing proxy_type, deleting with force or delete_from_provider, and validating with install also need deploy. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'path' => 'servers', 'ability' => 'write', 'description' => 'add a server (data: ip, private_key_uuid, name, description, port, user, server_role, proxy_type, instant_validate)'],
+            'update' => ['method' => 'PATCH', 'path' => 'servers/{uuid}', 'ability' => 'write', 'description' => 'update a server (data: name, description, ip, port, user, private_key_uuid, server_role, proxy_type, concurrent_builds, dynamic_timeout, deployment_queue_limit, connection_timeout, is_terminal_enabled, server_disk_usage_*; changing proxy_type needs deploy ability)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'servers/{uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete a server without resources (the Coolify host cannot be deleted)'],
+            'validate' => ['method' => 'POST', 'path' => 'servers/{uuid}/validate', 'ability' => 'write', 'description' => 'start a server validation (data: install=true also installs Docker and needs deploy ability)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Server UUID (not needed for create).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: name, description, ip, port, user, private_key_uuid, server_role (deployment|build|both), proxy_type, instant_validate, install (validate only).';
+    }
+}
diff --git a/app/Mcp/Tools/ManageService.php b/app/Mcp/Tools/ManageService.php
new file mode 100644
index 0000000000..efa6d99fdd
--- /dev/null
+++ b/app/Mcp/Tools/ManageService.php
@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageService extends RestActionTool
+{
+    protected string $name = 'manage_service';
+
+    protected string $description = 'Update, delete, clone, or move a service of the authenticated team, update one of its applications or databases, or import a backup into a service database. Requires write ability; delete and import_database also need deploy, and so do instant_deploy, changing is_public of a service database, and clone_volumes. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'update' => ['method' => 'PATCH', 'path' => 'services/{uuid}', 'ability' => 'write', 'description' => 'update the service (data: name, description, docker_compose_raw base64, connect_to_docker_network, urls, force_domain_override, is_container_label_escape_enabled, redact_all_env_values_in_logs, instant_deploy; instant_deploy needs deploy ability)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'services/{uuid}', 'ability' => 'deploy', 'confirm' => true, 'description' => 'delete the service (data: delete_volumes, delete_connected_networks, delete_configurations, docker_cleanup, delete_from_coolify_only)'],
+            'clone' => ['method' => 'POST', 'path' => 'services/{uuid}/clone', 'ability' => 'write', 'confirm' => true, 'description' => 'clone the service to a destination of the team (data: destination_uuid, name, clone_volumes; clone_volumes stops the source service while volumes are copied and needs deploy ability)'],
+            'move' => ['method' => 'POST', 'path' => 'services/{uuid}/move', 'ability' => 'write', 'confirm' => true, 'description' => 'move the service to another environment of the team (data: environment_uuid)'],
+            'update_application' => ['method' => 'PATCH', 'path' => 'services/{uuid}/applications/{app_uuid}', 'ability' => 'write', 'description' => 'update a service application (data: url, noindex_domains, human_name, description, image, exclude_from_status, is_log_drain_enabled, is_gzip_enabled, traefik_certificate_resolver, is_stripprefix_enabled, is_force_https_enabled, max_restart_count)'],
+            'update_database' => ['method' => 'PATCH', 'path' => 'services/{uuid}/databases/{database_uuid}', 'ability' => 'write', 'description' => 'update a service database (data: human_name, description, image, exclude_from_status, is_log_drain_enabled, is_public, public_port, public_port_timeout; changing is_public needs deploy ability)'],
+            'import_database' => ['method' => 'POST', 'path' => 'services/{uuid}/databases/{database_uuid}/imports', 'ability' => 'deploy', 'confirm' => true, 'description' => 'import a backup into a service database, can overwrite data (data: source s3 | server, s3_storage_uuid, path, dump_all, replace_existing, keep_owners, restore_mysql_users); check progress with get_database_import'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Service UUID.',
+            'app_uuid' => 'Service application UUID (update_application).',
+            'database_uuid' => 'Service database UUID (update_database, import_database).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API (see the action descriptions). File uploads are not supported: import only from an S3 storage of the team (source=s3, s3_storage_uuid, path) or a server path (source=server, path).';
+    }
+}
diff --git a/app/Mcp/Tools/ManageSharedEnv.php b/app/Mcp/Tools/ManageSharedEnv.php
new file mode 100644
index 0000000000..d21acd18d5
--- /dev/null
+++ b/app/Mcp/Tools/ManageSharedEnv.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageSharedEnv extends RestActionTool
+{
+    protected string $name = 'manage_shared_env';
+
+    protected string $description = 'Create, update, or delete shared environment variables of the authenticated team, or of one of its projects, environments, or servers. Requires write ability. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'paths' => [
+                'team' => 'team/envs',
+                'project' => 'projects/{uuid}/envs',
+                'environment' => 'projects/{uuid}/environments/{environment_name_or_uuid}/envs',
+                'server' => 'servers/{uuid}/envs',
+            ], 'ability' => 'write', 'description' => 'create a shared variable (data: key, value, is_literal, is_multiline, is_shown_once, comment); returns its id'],
+            'update' => ['method' => 'PATCH', 'paths' => [
+                'team' => 'team/envs/{env_id}',
+                'project' => 'projects/{uuid}/envs/{env_id}',
+                'environment' => 'projects/{uuid}/environments/{environment_name_or_uuid}/envs/{env_id}',
+                'server' => 'servers/{uuid}/envs/{env_id}',
+            ], 'ability' => 'write', 'description' => 'update a shared variable (data: key, value, is_literal, is_multiline, is_shown_once, comment)'],
+            'delete' => ['method' => 'DELETE', 'paths' => [
+                'team' => 'team/envs/{env_id}',
+                'project' => 'projects/{uuid}/envs/{env_id}',
+                'environment' => 'projects/{uuid}/environments/{environment_name_or_uuid}/envs/{env_id}',
+                'server' => 'servers/{uuid}/envs/{env_id}',
+            ], 'ability' => 'write', 'confirm' => true, 'description' => 'delete a shared variable'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Project UUID (resource project or environment) or server UUID (resource server). Not used for team.',
+            'environment_name_or_uuid' => 'Environment name or UUID (resource environment).',
+            'env_id' => 'Shared variable id (update, delete).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: key, value, is_literal, is_multiline, is_shown_once, comment.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageStorage.php b/app/Mcp/Tools/ManageStorage.php
new file mode 100644
index 0000000000..5fdf754964
--- /dev/null
+++ b/app/Mcp/Tools/ManageStorage.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageStorage extends RestActionTool
+{
+    protected string $name = 'manage_storage';
+
+    protected string $description = 'Create, update, or delete a persistent volume or file storage of an application, database, or service of the authenticated team, and set, remove, or run its volume backup schedule. Requires write ability; run_backup also requires deploy, and so do file content, mounts outside the resource directory, and stop_during_backup. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'paths' => $this->paths('storages'), 'ability' => 'write', 'description' => 'create a storage (data: type persistent|file, name, mount_path, content, is_directory, is_host_file, fs_path; services also resource_uuid; file content and an fs_path outside the resource directory need deploy ability)'],
+            'update' => ['method' => 'PATCH', 'paths' => $this->paths('storages'), 'ability' => 'write', 'description' => 'update a storage (data: uuid of the storage, type, name, mount_path, content, is_preview_suffix_enabled; content of a file outside the resource directory needs deploy ability)'],
+            'delete' => ['method' => 'DELETE', 'paths' => $this->paths('storages/{storage_uuid}'), 'ability' => 'write', 'confirm' => true, 'description' => 'delete a storage'],
+            'set_backup' => ['method' => 'PUT', 'paths' => $this->paths('storages/{storage_uuid}/backups'), 'ability' => 'write', 'description' => 'create or replace the volume backup schedule (data: frequency, enabled, save_s3, s3_storage_uuid(s), stop_during_backup, retention fields ...; stop_during_backup needs deploy ability)'],
+            'remove_backup' => ['method' => 'DELETE', 'paths' => $this->paths('storages/{storage_uuid}/backups'), 'ability' => 'write', 'confirm' => true, 'description' => 'delete the volume backup schedule and its local and S3 archives'],
+            'run_backup' => ['method' => 'POST', 'paths' => $this->paths('storages/{storage_uuid}/backups/run'), 'ability' => 'deploy', 'confirm' => true, 'description' => 'run the volume backup now (can stop the resource when stop_during_backup is set)'],
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function paths(string $suffix): array
+    {
+        return [
+            'application' => "applications/{uuid}/{$suffix}",
+            'database' => "databases/{uuid}/{$suffix}",
+            'service' => "services/{uuid}/{$suffix}",
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application, database, or service UUID.',
+            'storage_uuid' => 'Storage UUID (delete and backup actions).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API. Storage: type, name, mount_path, content, is_directory, is_host_file, fs_path, resource_uuid (service), uuid (update). Backup: frequency, enabled, save_s3, disable_local_backup, stop_during_backup, s3_storage_uuid, s3_storage_uuids, retention_amount_locally, retention_days_locally, retention_max_storage_locally, retention_amount_s3, retention_days_s3, retention_max_storage_s3, timeout, missing_backup_notification_days.';
+    }
+}
diff --git a/app/Mcp/Tools/ManageTags.php b/app/Mcp/Tools/ManageTags.php
new file mode 100644
index 0000000000..37059bfe58
--- /dev/null
+++ b/app/Mcp/Tools/ManageTags.php
@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class ManageTags extends RestActionTool
+{
+    protected string $name = 'manage_tags';
+
+    protected string $description = 'Create, rename, or delete a tag of the authenticated team, or attach tags to and detach a tag from an application, database, or service. Requires write ability. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'create' => ['method' => 'POST', 'path' => 'tags', 'ability' => 'write', 'description' => 'create a team tag (data: name)'],
+            'update' => ['method' => 'PATCH', 'path' => 'tags/{tag_uuid}', 'ability' => 'write', 'description' => 'rename a team tag (data: name)'],
+            'delete' => ['method' => 'DELETE', 'path' => 'tags/{tag_uuid}', 'ability' => 'write', 'confirm' => true, 'description' => 'delete a team tag and detach it from all resources'],
+            'attach' => ['method' => 'POST', 'paths' => [
+                'application' => 'applications/{uuid}/tags',
+                'database' => 'databases/{uuid}/tags',
+                'service' => 'services/{uuid}/tags',
+            ], 'ability' => 'write', 'description' => 'attach tags by name, missing team tags are created (data: tag_name or tag_names)'],
+            'detach' => ['method' => 'DELETE', 'paths' => [
+                'application' => 'applications/{uuid}/tags/{tag_uuid}',
+                'database' => 'databases/{uuid}/tags/{tag_uuid}',
+                'service' => 'services/{uuid}/tags/{tag_uuid}',
+            ], 'ability' => 'write', 'description' => 'detach a tag from the resource'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application, database, or service UUID (attach and detach).',
+            'tag_uuid' => 'Tag UUID (update, delete, detach).',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: name (create, update), tag_name or tag_names (attach).';
+    }
+}
diff --git a/app/Mcp/Tools/RestActionTool.php b/app/Mcp/Tools/RestActionTool.php
new file mode 100644
index 0000000000..feccc6a864
--- /dev/null
+++ b/app/Mcp/Tools/RestActionTool.php
@@ -0,0 +1,164 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\CallsRestApi;
+use App\Mcp\Concerns\ChecksTokenAbilities;
+use App\Mcp\Concerns\ResolvesTeam;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\Server\Tool;
+
+/**
+ * Base for MCP tools that group several REST API routes under one `action` argument.
+ *
+ * Subclasses only declare fixed routes. Agents cannot choose a route, only an action
+ * from the list, path IDs, and a JSON body. Security checks run in the REST route.
+ */
+abstract class RestActionTool extends Tool
+{
+    use BuildsResponse;
+    use CallsRestApi;
+    use ChecksTokenAbilities;
+    use ResolvesTeam;
+
+    /**
+     * An action has either one `path`, or `paths` keyed by the `resource` argument
+     * (for example ['application' => 'applications/{uuid}/envs']).
+     *
+     * @return array<string, array{method: string, path?: string, paths?: array<string, string>, ability: string, confirm?: bool, description: string}>
+     */
+    abstract protected function actions(): array;
+
+    /**
+     * Path parameters this tool accepts, with descriptions.
+     *
+     * @return array<string, string>
+     */
+    abstract protected function pathParams(): array;
+
+    /**
+     * Description of the fields accepted in `data`. Empty when the tool takes no body.
+     */
+    protected function dataDescription(): string
+    {
+        return '';
+    }
+
+    /**
+     * Actions that the current token has the ability for.
+     *
+     * @return array<string, array{method: string, path?: string, paths?: array<string, string>, ability: string, confirm?: bool, description: string}>
+     */
+    protected function availableActions(): array
+    {
+        return array_filter($this->actions(), fn (array $action): bool => $this->currentTokenCan($action['ability']));
+    }
+
+    public function shouldRegister(): bool
+    {
+        return $this->availableActions() !== [];
+    }
+
+    public function handle(Request $request): Response
+    {
+        $actions = $this->availableActions();
+        $actionName = $request->get('action');
+
+        $allActions = $this->actions();
+        if (! is_string($actionName) || ! isset($allActions[$actionName])) {
+            return $this->mcpError($request, 'action must be one of: '.implode(', ', array_keys($actions)).'.');
+        }
+        $action = $allActions[$actionName];
+
+        // Hidden actions still reach this check, so the agent gets the missing ability, not "unknown action".
+        if ($error = $this->ensureAbility($request, $action['ability'], $this->name)) {
+            return $error;
+        }
+
+        if (is_null($this->resolveTeamId($request))) {
+            return $this->mcpError($request, 'Invalid token.');
+        }
+
+        if (($action['confirm'] ?? false) && $error = $this->ensureConfirmed($request, "{$this->name} {$actionName}")) {
+            return $error;
+        }
+
+        $path = $action['path'] ?? null;
+        if (isset($action['paths'])) {
+            $resource = $request->get('resource');
+            if (! is_string($resource) || ! isset($action['paths'][$resource])) {
+                return $this->mcpError($request, 'resource must be one of: '.implode(', ', array_keys($action['paths'])).'.');
+            }
+            $path = $action['paths'][$resource];
+        }
+
+        $data = $request->get('data') ?? [];
+        if (! is_array($data) || ($data !== [] && array_is_list($data))) {
+            return $this->mcpError($request, 'data must be a JSON object.');
+        }
+
+        $pathParams = [];
+        foreach (array_keys($this->pathParams()) as $param) {
+            $value = $request->get($param);
+            if ($value !== null) {
+                if (! is_scalar($value)) {
+                    return $this->mcpError($request, "{$param} must be a string.");
+                }
+                $pathParams[$param] = $value;
+            }
+        }
+
+        try {
+            $result = $this->callRestApi($action['method'], $path, $pathParams, $data);
+        } catch (\InvalidArgumentException $e) {
+            return $this->mcpError($request, $e->getMessage());
+        }
+
+        $context = ['action' => $actionName, 'resource' => $request->get('resource'), 'status' => $result['status']] + array_map('strval', $pathParams);
+
+        if ($result['status'] >= 400) {
+            $body = is_array($result['body']) ? $result['body'] : [];
+            $message = (string) ($body['message'] ?? 'Request failed.');
+            if (isset($body['errors']) && is_array($body['errors'])) {
+                $message .= ' '.json_encode($body['errors']);
+            }
+
+            return $this->mcpError($request, $message, $context);
+        }
+
+        return $this->mcpSuccess($request, $this->respond(is_array($result['body']) ? $result['body'] : []), $context);
+    }
+
+    public function schema(JsonSchema $schema): array
+    {
+        $actionLines = collect($this->availableActions())
+            ->map(fn (array $action, string $name): string => "{$name}: {$action['description']}".(($action['confirm'] ?? false) ? ' (needs confirm=true)' : ''))
+            ->implode('; ');
+
+        $fields = [
+            'action' => $schema->string()->enum(array_keys($this->availableActions()))->description($actionLines)->required(),
+        ];
+
+        $resources = collect($this->availableActions())->pluck('paths')->filter()->flatMap(fn (array $paths): array => array_keys($paths))->unique()->values()->all();
+        if ($resources !== []) {
+            $fields['resource'] = $schema->string()->enum($resources)->description('Resource type for actions that support several ('.implode(' | ', $resources).').');
+        }
+
+        foreach ($this->pathParams() as $param => $description) {
+            $fields[$param] = $schema->string()->description($description);
+        }
+
+        if ($this->dataDescription() !== '') {
+            $fields['data'] = $schema->object()->description($this->dataDescription());
+        }
+
+        if (collect($this->availableActions())->contains(fn (array $action): bool => $action['confirm'] ?? false)) {
+            $fields['confirm'] = $schema->boolean()->description('Must be true for destructive actions.');
+        }
+
+        return $fields;
+    }
+}
diff --git a/app/Mcp/Tools/RollbackApplication.php b/app/Mcp/Tools/RollbackApplication.php
new file mode 100644
index 0000000000..e4fb644594
--- /dev/null
+++ b/app/Mcp/Tools/RollbackApplication.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[IsReadOnly(false)]
+#[IsDestructive]
+class RollbackApplication extends RestActionTool
+{
+    protected string $name = 'rollback_application';
+
+    protected string $description = 'Queue a rollback deployment of an application of the authenticated team to a previous image tag (see list_rollback_images). Requires deploy ability. Same validation and permissions as the REST API.';
+
+    protected function actions(): array
+    {
+        return [
+            'rollback' => ['method' => 'POST', 'path' => 'applications/{uuid}/rollback', 'ability' => 'deploy', 'confirm' => true, 'description' => 'roll back to an image tag (data: commit)'],
+        ];
+    }
+
+    protected function pathParams(): array
+    {
+        return [
+            'uuid' => 'Application UUID.',
+        ];
+    }
+
+    protected function dataDescription(): string
+    {
+        return 'Request body, same fields as the REST API: commit (image tag / commit SHA from list_rollback_images).';
+    }
+}
diff --git a/app/Mcp/Tools/SearchResources.php b/app/Mcp/Tools/SearchResources.php
index 4db76bfd28..28ea617e38 100644
--- a/app/Mcp/Tools/SearchResources.php
+++ b/app/Mcp/Tools/SearchResources.php
@@ -13,7 +13,9 @@ use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
 use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
+#[IsReadOnly]
 class SearchResources extends Tool
 {
     protected string $name = 'search_resources';
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 7a33b1d1eb..910617f7c7 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Enums\ApplicationDeploymentStatus;
 use App\Enums\BuildPackTypes;
+use App\Enums\HttpBasicAuthHashAlgorithm;
 use App\Enums\ProxyTypes;
 use App\Exceptions\DeploymentException;
 use App\Services\ConfigurationGenerator;
@@ -16,6 +17,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasComposeVolumeWarnings;
 use App\Traits\HasConfiguration;
+use App\Traits\HasMaintenancePage;
 use App\Traits\HasMetrics;
 use App\Traits\HasNoindexDomains;
 use App\Traits\HasSafeStringAttribute;
@@ -125,6 +127,10 @@ use Symfony\Component\Yaml\Yaml;
         'is_http_basic_auth_enabled' => ['type' => 'boolean', 'description' => 'HTTP Basic Authentication enabled.'],
         'http_basic_auth_username' => ['type' => 'string', 'nullable' => true, 'description' => 'Username for HTTP Basic Authentication'],
         'http_basic_auth_password' => ['type' => 'string', 'nullable' => true, 'description' => 'Password for HTTP Basic Authentication'],
+        'http_basic_auth_hash_algorithm' => ['type' => 'string', 'enum' => ['bcrypt', 'argon2id'], 'description' => 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'],
+        'http_basic_auth_bcrypt_cost' => ['type' => 'integer', 'minimum' => 4, 'maximum' => 14, 'description' => 'Bcrypt cost for the HTTP Basic Authentication password.'],
+        'http_basic_auth_argon2id_memory_cost' => ['type' => 'integer', 'minimum' => 8192, 'maximum' => 262144, 'description' => 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'],
+        'http_basic_auth_argon2id_time_cost' => ['type' => 'integer', 'minimum' => 1, 'maximum' => 12, 'description' => 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'],
         new OA\Property(property: 'settings', ref: '#/components/schemas/ApplicationSetting'),
     ]
 )]
@@ -132,7 +138,7 @@ use Symfony\Component\Yaml\Yaml;
 class Application extends BaseModel
 {
     /** @use HasFactory<ApplicationFactory> */
-    use Auditable, ClearsGlobalSearchCache, HasComposeVolumeWarnings, HasConfiguration, HasFactory, HasMetrics, HasNoindexDomains, HasSafeStringAttribute, HasSecretManager, ReleasesManagedDnsRecords, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasComposeVolumeWarnings, HasConfiguration, HasFactory, HasMaintenancePage, HasMetrics, HasNoindexDomains, HasSafeStringAttribute, HasSecretManager, ReleasesManagedDnsRecords, SoftDeletes;
 
     public const MAX_DOCKER_COMPOSE_SIZE_BYTES = 5 * 1024 * 1024;
 
@@ -220,6 +226,10 @@ class Application extends BaseModel
         'is_http_basic_auth_enabled',
         'http_basic_auth_username',
         'http_basic_auth_password',
+        'http_basic_auth_hash_algorithm',
+        'http_basic_auth_bcrypt_cost',
+        'http_basic_auth_argon2id_memory_cost',
+        'http_basic_auth_argon2id_time_cost',
         'connect_to_docker_network',
         'force_domain_override',
         'is_container_label_escape_enabled',
@@ -268,6 +278,7 @@ class Application extends BaseModel
     {
         return [
             'http_basic_auth_password' => 'encrypted',
+            'http_basic_auth_hash_algorithm' => HttpBasicAuthHashAlgorithm::class,
             'manual_webhook_secret_github' => 'encrypted',
             'manual_webhook_secret_gitlab' => 'encrypted',
             'manual_webhook_secret_bitbucket' => 'encrypted',
@@ -280,6 +291,7 @@ class Application extends BaseModel
             'restart_limit_reached' => 'boolean',
             'container_present' => 'boolean',
             'last_restart_at' => 'datetime',
+            'is_maintenance_enabled' => 'boolean',
         ];
     }
 
@@ -572,6 +584,39 @@ class Application extends BaseModel
         instant_remote_process(["docker network rm {$uuid}"], $server, false);
     }
 
+    /**
+     * Domains of the application, or of every service of a Docker Compose application.
+     *
+     * @return Collection<int, array{url: string, force_https: bool}>
+     */
+    public function maintenanceDomains(): Collection
+    {
+        if ($this->build_pack === 'dockercompose') {
+            $urls = collect(json_decode($this->docker_compose_domains ?: '[]', true) ?: [])
+                ->flatMap(fn ($service) => explode(',', (string) data_get($service, 'domain', '')));
+        } else {
+            $urls = collect($this->fqdns);
+        }
+        $forceHttps = (bool) $this->isForceHttpsEnabled();
+
+        return $urls->map(fn ($url) => trim((string) $url))
+            ->filter()
+            ->map(fn (string $url) => ['url' => $url, 'force_https' => $forceHttps])
+            ->values();
+    }
+
+    /**
+     * @return Collection<int, Server>
+     */
+    public function maintenanceServers(): Collection
+    {
+        return collect([$this->destination?->server])
+            ->concat($this->additional_servers)
+            ->filter()
+            ->unique('id')
+            ->values();
+    }
+
     public function additional_servers()
     {
         return $this->belongsToMany(Server::class, 'additional_destinations')
@@ -654,6 +699,12 @@ class Application extends BaseModel
         return $this->source instanceof GithubApp;
     }
 
+    public function usesArgon2idBasicAuth(): bool
+    {
+        return $this->http_basic_auth_hash_algorithm === HttpBasicAuthHashAlgorithm::ARGON2ID
+            && $this->destination->server->caddySupportsArgon2idBasicAuth();
+    }
+
     public function isForceHttpsEnabled()
     {
         return data_get($this, 'settings.is_force_https_enabled', false);
@@ -699,6 +750,14 @@ class Application extends BaseModel
         return $this->hasOne(ApplicationSetting::class);
     }
 
+    /**
+     * Whether logs hide every environment value, or only locked values.
+     */
+    public function redactsAllEnvValuesInLogs(): bool
+    {
+        return $this->settings?->redact_all_env_values_in_logs ?? true;
+    }
+
     public function persistentStorages()
     {
         return $this->morphMany(LocalPersistentVolume::class, 'resource');
@@ -727,6 +786,9 @@ class Application extends BaseModel
             get: function () {
                 $base_dir = $this->base_directory ?? '/';
                 if (! is_null($this->source?->html_url) && ! is_null($this->git_repository) && ! is_null($this->git_branch)) {
+                    if ($this->source instanceof GiteaApp) {
+                        return "{$this->source->html_url}/{$this->git_repository}/src/branch/{$this->git_branch}{$base_dir}";
+                    }
                     if (str($this->git_repository)->contains('bitbucket')) {
                         return "{$this->source->html_url}/{$this->git_repository}/src/{$this->git_branch}{$base_dir}";
                     }
@@ -769,6 +831,10 @@ class Application extends BaseModel
         return Attribute::make(
             get: function () {
                 if (! is_null($this->source?->html_url) && ! is_null($this->git_repository) && ! is_null($this->git_branch)) {
+                    if ($this->source instanceof GiteaApp) {
+                        return "{$this->source->html_url}/{$this->git_repository}/commits/branch/{$this->git_branch}";
+                    }
+
                     return "{$this->source->html_url}/{$this->git_repository}/commits/{$this->git_branch}";
                 }
                 $httpsRepository = $this->httpsUrlFromSshGitRepository();
@@ -1634,14 +1700,15 @@ class Application extends BaseModel
                 ];
             }
 
-            if ($this->source->getMorphClass() === GitlabApp::class) {
-                $gitlabSource = $this->source;
+            if (in_array($this->source->getMorphClass(), [GitlabApp::class, GiteaApp::class], true)) {
+                $oauthSource = $this->source;
+                $isGiteaSource = $oauthSource instanceof GiteaApp;
 
-                if ($gitlabSource->isConnected()) {
+                if ($oauthSource->isConnected()) {
                     $url = parse_url(filter_var($source_html_url, FILTER_SANITIZE_URL)) ?: [];
                     $source_html_url_host = $this->urlHostWithPort($url);
                     $source_html_url_scheme = $url['scheme'] ?? '';
-                    $token = generateGitlabCloneToken($gitlabSource);
+                    $token = $isGiteaSource ? generateGiteaCloneToken($oauthSource) : generateGitlabCloneToken($oauthSource);
                     $encodedToken = rawurlencode($token);
                     $pathPrefix = rtrim($url['path'] ?? '', '/');
                     $repoUrl = "{$source_html_url_scheme}://oauth2:{$encodedToken}@{$source_html_url_host}{$pathPrefix}/{$customRepository}.git";
@@ -1662,12 +1729,12 @@ class Application extends BaseModel
                     ];
                 }
 
-                $private_key = gitlabAppPrivateKey($gitlabSource)?->private_key;
+                $private_key = ($isGiteaSource ? giteaAppPrivateKey($oauthSource) : gitlabAppPrivateKey($oauthSource))?->private_key;
 
                 if ($private_key) {
                     $fullRepoUrl = $customRepository;
                     $private_key = base64_encode($private_key);
-                    $gitlabPort = $gitlabSource->custom_port ?? 22;
+                    $gitlabPort = $oauthSource->custom_port ?? 22;
                     $escapedCustomRepository = str_replace("'", "'\\''", $customRepository);
                     $base_command = "GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p {$gitlabPort} -o Port={$gitlabPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$customSshKeyLocation} -o IdentitiesOnly=yes\" {$base_command} '{$escapedCustomRepository}'";
 
@@ -1889,11 +1956,13 @@ class Application extends BaseModel
                 ];
             }
 
-            if ($this->source->getMorphClass() === GitlabApp::class) {
-                $gitlabSource = $this->source;
+            if (in_array($this->source->getMorphClass(), [GitlabApp::class, GiteaApp::class], true)) {
+                $oauthSource = $this->source;
+                $isGiteaSource = $oauthSource instanceof GiteaApp;
+                $pullRequestRef = $isGiteaSource ? "pull/{$pull_request_id}/head" : "merge-requests/{$pull_request_id}/head";
 
-                if ($gitlabSource->isConnected()) {
-                    $token = generateGitlabCloneToken($gitlabSource);
+                if ($oauthSource->isConnected()) {
+                    $token = $isGiteaSource ? generateGiteaCloneToken($oauthSource) : generateGitlabCloneToken($oauthSource);
                     $encodedToken = rawurlencode($token);
                     $pathPrefix = rtrim($url['path'] ?? '', '/');
                     $source_html_url_host = $this->urlHostWithPort($url ?: []);
@@ -1913,7 +1982,7 @@ class Application extends BaseModel
                     }
 
                     if ($pull_request_id !== 0) {
-                        $branch = "merge-requests/{$pull_request_id}/head:{$pr_branch_name}";
+                        $branch = "{$pullRequestRef}:{$pr_branch_name}";
                         if ($exec_in_docker) {
                             $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out {$branch}'"));
                         } else {
@@ -1937,12 +2006,12 @@ class Application extends BaseModel
                     ];
                 }
 
-                $private_key = gitlabAppPrivateKey($gitlabSource)?->private_key;
+                $private_key = ($isGiteaSource ? giteaAppPrivateKey($oauthSource) : gitlabAppPrivateKey($oauthSource))?->private_key;
 
                 if ($private_key) {
                     $fullRepoUrl = $customRepository;
                     $private_key = base64_encode($private_key);
-                    $gitlabPort = $gitlabSource->custom_port ?? 22;
+                    $gitlabPort = $oauthSource->custom_port ?? 22;
                     $escapedCustomRepository = escapeshellarg($customRepository);
                     $gitlabSshCommand = "ssh -o ConnectTimeout=30 -p {$gitlabPort} -o Port={$gitlabPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$customSshKeyLocation} -o IdentitiesOnly=yes";
                     $gitlabGitSshCommand = "GIT_SSH_COMMAND=\"{$gitlabSshCommand}\"";
@@ -1955,7 +2024,7 @@ class Application extends BaseModel
                     $commands = $this->gitSshKeySetupCommands($deployment_uuid, $private_key, $exec_in_docker);
 
                     if ($pull_request_id !== 0) {
-                        $branch = "merge-requests/{$pull_request_id}/head:$pr_branch_name";
+                        $branch = "{$pullRequestRef}:$pr_branch_name";
                         if ($exec_in_docker) {
                             $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "echo 'Checking out $branch'")));
                         } else {
@@ -2193,6 +2262,17 @@ class Application extends BaseModel
         return $reason ? '<br><br>Reason: '.e(str($reason)->limit(300)->value()) : '';
     }
 
+    /**
+     * One shell command that clones the repository without a checkout into $checkoutDir on the server,
+     * with the same credentials (GitHub App token, GitLab token, or deploy key) as a deployment.
+     */
+    public function serverCheckoutCommand(string $uuid, string $checkoutDir): string
+    {
+        ['commands' => $cloneCommand] = $this->generateGitImportCommands(deployment_uuid: $uuid, only_checkout: true, exec_in_docker: false, custom_base_dir: $checkoutDir);
+
+        return str_replace(' clone ', ' clone --quiet ', $this->gitCommandsAsShellCommand($cloneCommand));
+    }
+
     /**
      * Commands that check out only the Compose file on the server and print it. They run on the
      * server itself, not in a helper container, so the checkout uses an absolute folder in /tmp.
@@ -2202,8 +2282,7 @@ class Application extends BaseModel
     private function composeFileReadCommands(string $uuid, string $gitVersion): Collection
     {
         $checkoutDir = "/tmp/{$uuid}/checkout";
-        ['commands' => $cloneCommand] = $this->generateGitImportCommands(deployment_uuid: $uuid, only_checkout: true, exec_in_docker: false, custom_base_dir: $checkoutDir);
-        $cloneCommand = str_replace(' clone ', ' clone --quiet ', $this->gitCommandsAsShellCommand($cloneCommand));
+        $cloneCommand = $this->serverCheckoutCommand($uuid, $checkoutDir);
         $workdir = rtrim($this->base_directory, '/');
         $fileList = collect([".{$workdir}{$this->docker_compose_location}"]);
         $composeFilePath = escapeshellarg(".{$workdir}{$this->docker_compose_location}");
diff --git a/app/Models/ApplicationDeploymentQueue.php b/app/Models/ApplicationDeploymentQueue.php
index e25b032630..3af70a5610 100644
--- a/app/Models/ApplicationDeploymentQueue.php
+++ b/app/Models/ApplicationDeploymentQueue.php
@@ -4,11 +4,13 @@ namespace App\Models;
 
 use App\Casts\EncryptedArrayCast;
 use App\Enums\ApplicationDeploymentStatus;
+use App\Services\Security\SensitiveDataRedactor;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
 use OpenApi\Attributes as OA;
 
 #[OA\Schema(
@@ -48,12 +50,21 @@ use OpenApi\Attributes as OA;
 class ApplicationDeploymentQueue extends Model
 {
     /**
-     * Kept in memory only, never saved.
+     * Log redaction variants of remote secrets. Kept in memory only, never saved.
      *
-     * @var array<array-key, mixed>
+     * @var array<int, string>
      */
     private array $remoteSecretsForRedaction = [];
 
+    public const HIDDEN_ENV_VALUES_HINT = 'Some environment variable values are hidden in this log. To show values that are not locked, go to Environment Variables > Environment values in logs and select "Hide locked values only".';
+
+    /** @var array{known: array<int, string>, locked: array<int, string>}|null */
+    private ?array $logRedactionSecrets = null;
+
+    private bool $hiddenEnvValuesHintAdded = false;
+
+    private bool $corruptedLogsWarned = false;
+
     protected static function booted(): void
     {
         static::created(function (ApplicationDeploymentQueue $deployment): void {
@@ -219,58 +230,49 @@ class ApplicationDeploymentQueue extends Model
      */
     public function redactRemoteSecrets(array $secrets): void
     {
-        $this->remoteSecretsForRedaction = $secrets;
+        $this->remoteSecretsForRedaction = EnvironmentVariable::remoteSecretLogRedactionValues($secrets);
     }
 
-    private function redactSensitiveInfo($text)
+    /**
+     * Redact a deployment log text. The application secrets are collected once per deployment.
+     */
+    public function redactLogText(string $text): string
     {
         try {
-            $text = remove_iip($text);
-
-            $app = $this->application;
-            if (! $app) {
-                return $text;
-            }
-
-            $lockedVars = collect([]);
-
-            if ($app->environment_variables) {
-                $lockedVars = $lockedVars->merge(
-                    $app->environment_variables
-                        ->where('is_shown_once', true)
-                        ->flatMap(fn (EnvironmentVariable $variable): array => $variable->logRedactionValues())
-                        ->filter()
-                );
-            }
-
-            if ($this->pull_request_id !== 0 && $app->environment_variables_preview) {
-                $lockedVars = $lockedVars->merge(
-                    $app->environment_variables_preview
-                        ->where('is_shown_once', true)
-                        ->flatMap(fn (EnvironmentVariable $variable): array => $variable->logRedactionValues())
-                        ->filter()
-                );
-            }
-
-            $lockedVars = $lockedVars->merge(EnvironmentVariable::remoteSecretLogRedactionValues($this->remoteSecretsForRedaction));
-
-            foreach ($lockedVars as $key => $value) {
-                $escapedValue = preg_quote($value, '/');
-                $text = preg_replace(
-                    '/'.$escapedValue.'/',
-                    REDACTED,
-                    $text
-                );
-            }
-
-            return is_string($text) ? $text : REDACTED;
+            // The deployment job registers its remote secrets with redactRemoteSecrets(), so they are not fetched again.
+            $this->logRedactionSecrets ??= EnvironmentVariable::logRedactionSecretsFor($this->application, $this->pull_request_id !== 0, resolveRemoteSecrets: false);
         } catch (\Throwable) {
             return REDACTED;
         }
+
+        return app(SensitiveDataRedactor::class)->redactText(
+            $text,
+            $this->logRedactionSecrets['known'],
+            array_merge($this->logRedactionSecrets['locked'], $this->remoteSecretsForRedaction),
+        );
     }
 
-    public function addLogEntry(string $message, string $type = 'stdout', bool $hidden = false)
+    /**
+     * Tell if the "redact all values" setting hides an environment value that is not locked in this text.
+     */
+    private function hidesUnlockedEnvValues(string $text): bool
     {
+        if ($this->logRedactionSecrets === null) {
+            return false;
+        }
+
+        $unlockedValues = array_diff($this->logRedactionSecrets['known'], $this->logRedactionSecrets['locked'], $this->remoteSecretsForRedaction);
+
+        return app(SensitiveDataRedactor::class)->containsKnownSecret($text, $unlockedValues);
+    }
+
+    public function addLogEntry(
+        string $message,
+        string $type = 'stdout',
+        bool $hidden = false,
+        ?string $command = null,
+        int $batch = 1,
+    ): void {
         if ($type === 'error') {
             $type = 'stderr';
         }
@@ -279,30 +281,62 @@ class ApplicationDeploymentQueue extends Model
             $message = "\n".$message;
         }
         $newLogEntry = [
-            'command' => null,
-            'output' => $this->redactSensitiveInfo($message),
+            'command' => $command === null ? null : $this->redactLogText($command),
+            'output' => $this->redactLogText($message),
             'type' => $type,
             'timestamp' => Carbon::now('UTC'),
             'hidden' => $hidden,
-            'batch' => 1,
+            'batch' => $batch,
         ];
 
-        // Use a transaction to ensure atomicity
-        DB::transaction(function () use ($newLogEntry) {
-            // Reload the model to get the latest logs
-            $this->refresh();
+        $addHiddenEnvValuesHint = ! $this->hiddenEnvValuesHintAdded && $this->hidesUnlockedEnvValues($message.' '.$command);
 
-            if ($this->logs) {
-                $previousLogs = json_decode($this->logs, associative: true, flags: JSON_THROW_ON_ERROR);
-                $newLogEntry['order'] = count($previousLogs) + 1;
-                $previousLogs[] = $newLogEntry;
-                $this->logs = json_encode($previousLogs, flags: JSON_THROW_ON_ERROR);
-            } else {
-                $this->logs = json_encode([$newLogEntry], flags: JSON_THROW_ON_ERROR);
+        DB::transaction(function () use ($newLogEntry, $addHiddenEnvValuesHint): void {
+            $storedLogs = static::query()->whereKey($this->getKey())->lockForUpdate()->value('logs');
+            $previousLogs = $this->decodeLogs($storedLogs);
+            if ($previousLogs === null) {
+                // Keep the stored log history instead of overwriting it with a new list.
+                if (! $this->corruptedLogsWarned) {
+                    $this->corruptedLogsWarned = true;
+                    Log::warning('Skipped a deployment log entry because the stored deployment logs cannot be decoded.', [
+                        'deployment_uuid' => $this->deployment_uuid,
+                    ]);
+                }
+
+                return;
             }
+            $newLogEntry['order'] = count($previousLogs) + 1;
+            $previousLogs[] = $newLogEntry;
+            if ($addHiddenEnvValuesHint) {
+                $this->hiddenEnvValuesHintAdded = true;
+                if (! collect($previousLogs)->contains('output', self::HIDDEN_ENV_VALUES_HINT)) {
+                    $previousLogs[] = [...$newLogEntry, 'command' => null, 'output' => self::HIDDEN_ENV_VALUES_HINT, 'type' => 'stdout', 'hidden' => false, 'order' => $newLogEntry['order'] + 1];
+                }
+            }
+            $logs = json_encode($previousLogs, flags: JSON_THROW_ON_ERROR | JSON_INVALID_UTF8_SUBSTITUTE);
 
-            // Save without triggering events to prevent potential race conditions
-            $this->saveQuietly();
+            // Update only the logs column without model events to prevent race conditions.
+            static::query()->whereKey($this->getKey())->update(['logs' => $logs]);
+            $this->logs = $logs;
+            $this->syncOriginalAttribute('logs');
         });
     }
+
+    /**
+     * @return array<int, mixed>|null Null when the stored logs are not blank and cannot be decoded.
+     */
+    private function decodeLogs(?string $logs): ?array
+    {
+        if (blank($logs)) {
+            return [];
+        }
+
+        try {
+            $decoded = json_decode($logs, associative: true, flags: JSON_THROW_ON_ERROR);
+        } catch (\JsonException) {
+            return null;
+        }
+
+        return is_array($decoded) ? array_values($decoded) : null;
+    }
 }
diff --git a/app/Models/ApplicationSetting.php b/app/Models/ApplicationSetting.php
index c024ea6c8c..abaf67312e 100644
--- a/app/Models/ApplicationSetting.php
+++ b/app/Models/ApplicationSetting.php
@@ -5,6 +5,8 @@ namespace App\Models;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 use OpenApi\Attributes as OA;
+use Symfony\Component\Yaml\Exception\ParseException;
+use Symfony\Component\Yaml\Yaml;
 
 #[OA\Schema(
     description: 'Application settings.',
@@ -45,6 +47,7 @@ use OpenApi\Attributes as OA;
         'is_git_shallow_clone_enabled' => ['type' => 'boolean'],
         'is_pr_deployments_public_enabled' => ['type' => 'boolean'],
         'use_build_secrets' => ['type' => 'boolean'],
+        'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Hide every environment variable value in logs. When false, only locked values are hidden.'],
         'inject_build_args_to_dockerfile' => ['type' => 'boolean'],
         'include_source_commit_in_build' => ['type' => 'boolean'],
         'docker_images_to_keep' => ['type' => 'integer'],
@@ -59,6 +62,8 @@ class ApplicationSetting extends Model
      */
     public const MAX_CONTAINER_NAME_PREFIX_LENGTH = 30;
 
+    public const GPU_COUNT_PATTERN = '/^(all|\d+)$/';
+
     protected $casts = [
         'is_static' => 'boolean',
         'is_spa' => 'boolean',
@@ -91,6 +96,7 @@ class ApplicationSetting extends Model
         'connect_to_docker_network' => 'boolean',
         'is_env_sorting_enabled' => 'boolean',
         'include_coolify_default_variables' => 'boolean',
+        'redact_all_env_values_in_logs' => 'boolean',
         'disable_build_cache' => 'boolean',
     ];
 
@@ -131,6 +137,7 @@ class ApplicationSetting extends Model
         'is_git_shallow_clone_enabled',
         'is_pr_deployments_public_enabled',
         'use_build_secrets',
+        'redact_all_env_values_in_logs',
         'inject_build_args_to_dockerfile',
         'include_source_commit_in_build',
         'docker_images_to_keep',
@@ -170,6 +177,81 @@ class ApplicationSetting extends Model
         return $this->stopGracePeriodSeconds();
     }
 
+    /**
+     * The compose device request (deploy.resources.reservations.devices item) for the GPU settings.
+     * A count wins over device IDs. Options that cannot be parsed are left out.
+     *
+     * @return array{capabilities: list<string>, driver?: string, count?: int|string, device_ids?: list<string>, options?: array<string, string>}
+     */
+    public function gpuDeviceReservation(): array
+    {
+        $device = ['capabilities' => ['gpu']];
+        $driver = trim((string) $this->gpu_driver);
+        if ($driver !== '') {
+            $device['driver'] = $driver;
+        }
+
+        $count = trim((string) $this->gpu_count);
+        $deviceIds = str((string) $this->gpu_device_ids)->explode(',')->map(fn (string $id) => trim($id))->filter(fn (string $id) => $id !== '')->values()->all();
+        if ($count !== '') {
+            $device['count'] = $count === 'all' ? 'all' : (int) $count;
+        } elseif ($deviceIds !== []) {
+            $device['device_ids'] = $deviceIds;
+        }
+
+        $options = self::parseGpuOptions($this->gpu_options);
+        if ($options) {
+            $device['options'] = $options;
+        }
+
+        return $device;
+    }
+
+    /**
+     * Parse GPU driver options written as a YAML/JSON mapping or as key=value pairs, one per line.
+     *
+     * @return array<string, string>|null null when the value is not a flat mapping
+     */
+    public static function parseGpuOptions(?string $options): ?array
+    {
+        $options = trim((string) $options);
+        if ($options === '') {
+            return [];
+        }
+
+        try {
+            $parsed = Yaml::parse($options);
+        } catch (ParseException) {
+            $parsed = null;
+        }
+        if (is_array($parsed) && $parsed !== [] && ! array_is_list($parsed)) {
+            $mapping = [];
+            foreach ($parsed as $key => $value) {
+                if (! is_scalar($value)) {
+                    return null;
+                }
+                $mapping[(string) $key] = is_bool($value) ? ($value ? 'true' : 'false') : (string) $value;
+            }
+
+            return $mapping;
+        }
+
+        $mapping = [];
+        foreach (preg_split('/\R/', $options) as $pair) {
+            $pair = trim($pair);
+            if ($pair === '') {
+                continue;
+            }
+            [$key, $value] = array_pad(explode('=', $pair, 2), 2, null);
+            if ($value === null || trim($key) === '') {
+                return null;
+            }
+            $mapping[trim($key)] = trim($value);
+        }
+
+        return $mapping;
+    }
+
     public function isStatic(): Attribute
     {
         return Attribute::make(
diff --git a/app/Models/DatabaseBackupS3Replica.php b/app/Models/DatabaseBackupS3Replica.php
new file mode 100644
index 0000000000..1dee319c2b
--- /dev/null
+++ b/app/Models/DatabaseBackupS3Replica.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * The copy of one database backup execution in one S3 destination.
+ */
+class DatabaseBackupS3Replica extends Model
+{
+    protected $fillable = [
+        'execution_id',
+        's3_storage_id',
+        's3_uploaded',
+        's3_storage_deleted',
+        'message',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            's3_uploaded' => 'boolean',
+            's3_storage_deleted' => 'boolean',
+        ];
+    }
+
+    public function execution(): BelongsTo
+    {
+        return $this->belongsTo(ScheduledDatabaseBackupExecution::class, 'execution_id');
+    }
+
+    public function s3(): BelongsTo
+    {
+        return $this->belongsTo(S3Storage::class, 's3_storage_id');
+    }
+}
diff --git a/app/Models/EmailNotificationSettings.php b/app/Models/EmailNotificationSettings.php
index 94d0802d96..98e530ce84 100644
--- a/app/Models/EmailNotificationSettings.php
+++ b/app/Models/EmailNotificationSettings.php
@@ -33,6 +33,7 @@ class EmailNotificationSettings extends Model
 
         'deployment_success_email_notifications',
         'deployment_failure_email_notifications',
+        'deployment_commit_details_email_notifications',
         'status_change_email_notifications',
         'restart_limit_reached_email_notifications',
         'backup_success_email_notifications',
@@ -76,6 +77,7 @@ class EmailNotificationSettings extends Model
 
         'deployment_success_email_notifications' => 'boolean',
         'deployment_failure_email_notifications' => 'boolean',
+        'deployment_commit_details_email_notifications' => 'boolean',
         'status_change_email_notifications' => 'boolean',
         'restart_limit_reached_email_notifications' => 'boolean',
         'backup_success_email_notifications' => 'boolean',
diff --git a/app/Models/Environment.php b/app/Models/Environment.php
index 0120461040..5521bd31c5 100644
--- a/app/Models/Environment.php
+++ b/app/Models/Environment.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 use OpenApi\Attributes as OA;
 
 #[OA\Schema(
@@ -33,6 +34,18 @@ class Environment extends BaseModel
         'uuid',
     ];
 
+    /**
+     * Moving cards on the environment canvas is layout, not a change worth an audit event.
+     */
+    protected array $auditExclude = ['canvas_positions'];
+
+    protected function casts(): array
+    {
+        return [
+            'canvas_positions' => 'array',
+        ];
+    }
+
     protected static function booted()
     {
         static::deleting(function ($environment) {
@@ -148,6 +161,11 @@ class Environment extends BaseModel
         return $this->hasMany(Service::class);
     }
 
+    public function resourceLinks(): HasMany
+    {
+        return $this->hasMany(ResourceLink::class);
+    }
+
     protected function customizeName($value)
     {
         return str($value)->lower()->trim()->replace('/', '-')->toString();
diff --git a/app/Models/EnvironmentVariable.php b/app/Models/EnvironmentVariable.php
index b5065b3faf..81ac70023c 100644
--- a/app/Models/EnvironmentVariable.php
+++ b/app/Models/EnvironmentVariable.php
@@ -2,12 +2,16 @@
 
 namespace App\Models;
 
+use App\Exceptions\RemoteSecretException;
 use App\Models\EnvironmentVariable as ModelsEnvironmentVariable;
+use App\Support\RemoteSecretReferences;
 use App\Support\RemoteSecretValueFormatter;
 use App\Support\ValidationPatterns;
 use App\Traits\Auditable;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Casts\Attribute;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Log;
 use OpenApi\Attributes as OA;
 
 #[OA\Schema(
@@ -234,7 +238,10 @@ class EnvironmentVariable extends BaseModel
         return $this->resolveRealValue(revealLockedSharedVariables: false);
     }
 
-    private function resolveRealValue(bool $revealLockedSharedVariables = true, bool $escapeLegacyValue = true): ?string
+    /**
+     * @param  Collection<int, SharedEnvironmentVariable>|null  $sharedVariables
+     */
+    private function resolveRealValue(bool $revealLockedSharedVariables = true, bool $escapeLegacyValue = true, ?Collection $sharedVariables = null): ?string
     {
         if (! $this->relationLoaded('resourceable')) {
             $this->load('resourceable');
@@ -255,7 +262,7 @@ class EnvironmentVariable extends BaseModel
             $resource->load('destination.server');
         }
 
-        $value = $this->get_real_environment_variables_internal($this->value, $resource, null, $revealLockedSharedVariables);
+        $value = $this->get_real_environment_variables_internal($this->value, $resource, null, $revealLockedSharedVariables, $sharedVariables);
 
         return $value === null || ! $escapeLegacyValue || ! $this->uses_legacy_escaping ? $value : $this->legacyEscapedValue($value);
     }
@@ -363,9 +370,12 @@ class EnvironmentVariable extends BaseModel
     }
 
     /** @return array<int, string> */
-    public function logRedactionValues(): array
+    /**
+     * @param  Collection<int, SharedEnvironmentVariable>|null  $sharedVariables  Preloaded shared variables, to avoid one query per reference.
+     */
+    public function logRedactionValues(?Collection $sharedVariables = null): array
     {
-        $resolvedValue = $this->resolveRealValue(escapeLegacyValue: false);
+        $resolvedValue = $this->resolveRealValue(escapeLegacyValue: false, sharedVariables: $sharedVariables);
         if (! is_string($resolvedValue) || $resolvedValue === '') {
             return [];
         }
@@ -421,6 +431,177 @@ class EnvironmentVariable extends BaseModel
         return $values;
     }
 
+    /**
+     * Collect the values to hide in a resource's logs.
+     *
+     * Locked values, database passwords, and resolved remote secrets are always hidden,
+     * whatever their length. Other values are hidden unless the resource limits log redaction
+     * to locked values only.
+     *
+     * Remote secrets are fetched at most once per call, and only when a variable references one.
+     * Callers that already hold the fetched values, such as deployments, pass $resolveRemoteSecrets = false.
+     *
+     * @return array{known: array<int, string>, locked: array<int, string>}
+     */
+    public static function logRedactionSecretsFor(Application|Service|StandalonePostgresql|StandaloneRedis|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse|StandaloneSqlite|null $resource, bool $includePreview = false, bool $resolveRemoteSecrets = true): array
+    {
+        if ($resource === null) {
+            return ['known' => [], 'locked' => []];
+        }
+
+        $isDatabase = ! $resource instanceof Application && ! $resource instanceof Service;
+        $secrets = ['known' => [], 'locked' => []];
+        if ($isDatabase) {
+            foreach (array_keys($resource->getAttributes()) as $attribute) {
+                if (str_contains($attribute, 'password')) {
+                    $value = $resource->getAttribute($attribute);
+                    if (is_string($value) && $value !== '') {
+                        $secrets['locked'][] = $value;
+                    }
+                }
+            }
+        }
+
+        $variables = collect($isDatabase ? $resource->runtime_environment_variables : $resource->environment_variables);
+        if ($includePreview && $resource instanceof Application) {
+            $variables = $variables->merge($resource->environment_variables_preview ?? []);
+        }
+        if ($variables->isEmpty()) {
+            return $secrets;
+        }
+
+        // Load the resource relations once and share them, so each variable does not load its own copy.
+        $resource->loadMissing('environment.project.team');
+        if (method_exists($resource, 'server')) {
+            $resource->loadMissing('server');
+        }
+        if (method_exists($resource, 'destination')) {
+            $resource->loadMissing('destination.server');
+        }
+        // Use copies so the resource's own loaded variables do not get a reference back to the resource.
+        $variables = $variables->map(fn (self $variable): self => (clone $variable)->setRelation('resourceable', $resource));
+        $sharedVariables = self::sharedVariablesReferencedBy($variables, $resource->team()?->id);
+
+        $redactAllValues = $resource->redactsAllEnvValuesInLogs();
+        $unresolvedKeys = [];
+        $remoteSecretFailure = null;
+        foreach ($variables as $variable) {
+            if ($resolveRemoteSecrets) {
+                $secrets['locked'] = array_merge(
+                    $secrets['locked'],
+                    self::remoteSecretLogRedactionValuesFor($resource, $variable, $sharedVariables, $remoteSecretFailure, $unresolvedKeys),
+                );
+            }
+            if ($variable->isLockedForLogs($sharedVariables)) {
+                $secrets['locked'] = array_merge($secrets['locked'], $variable->logRedactionValues($sharedVariables));
+            } elseif ($redactAllValues) {
+                $secrets['known'] = array_merge($secrets['known'], $variable->logRedactionValues($sharedVariables));
+            }
+        }
+
+        if ($remoteSecretFailure !== null) {
+            Log::warning('Could not resolve remote secrets for log redaction; their resolved values are not hidden.', [
+                'resource_type' => $resource->getMorphClass(),
+                'resource_uuid' => $resource->uuid,
+                'variables' => array_values(array_unique($unresolvedKeys)),
+                'exception' => $remoteSecretFailure::class,
+            ]);
+        }
+
+        return $secrets;
+    }
+
+    /**
+     * Resolved remote secret values of a variable; these are always hidden.
+     *
+     * When the references cannot be resolved, export still works: the reference text and any keys
+     * that did resolve are hidden, and the variable is reported. After a failed or empty fetch the
+     * source is not asked again.
+     *
+     * @param  Collection<int, SharedEnvironmentVariable>|null  $sharedVariables
+     * @param  array<int, string>  $unresolvedKeys
+     * @return array<int, string>
+     */
+    private static function remoteSecretLogRedactionValuesFor(Application|Service|StandalonePostgresql|StandaloneRedis|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse|StandaloneSqlite $resource, self $variable, ?Collection $sharedVariables, ?RemoteSecretException &$failure, array &$unresolvedKeys): array
+    {
+        // Cheap check first, so variables without references never query or contact a source.
+        $value = $variable->resolveRealValue(escapeLegacyValue: false, sharedVariables: $sharedVariables);
+        if (! RemoteSecretReferences::containsReference($value) || ! $resource->environmentVariableUsesSecretManager($variable)) {
+            return [];
+        }
+
+        if ($failure === null || $resource->resolvedSecretManagerValuesForRedaction() !== []) {
+            try {
+                return self::remoteSecretLogRedactionValues([$resource->resolveSecretManagerEnvironmentVariableValue($variable)]);
+            } catch (RemoteSecretException $e) {
+                $failure = $e;
+            }
+        }
+
+        $unresolvedKeys[] = $variable->key;
+        $available = array_intersect_key($resource->resolvedSecretManagerValuesForRedaction(), array_flip(RemoteSecretReferences::referencedKeys($value)));
+
+        return [...self::remoteSecretLogRedactionValues(array_values($available)), ...$variable->logRedactionValues($sharedVariables)];
+    }
+
+    /**
+     * A variable is locked when it is locked itself or references a locked shared variable.
+     *
+     * @param  Collection<int, SharedEnvironmentVariable>|null  $sharedVariables  Preloaded shared variables of the resource's team.
+     */
+    public function isLockedForLogs(?Collection $sharedVariables = null): bool
+    {
+        if ($this->is_shown_once) {
+            return true;
+        }
+
+        $references = self::sharedVariableReferences($this->value);
+        if ($references === []) {
+            return false;
+        }
+
+        $sharedVariables ??= self::sharedVariablesReferencedBy(collect([$this]), $this->resourceable?->team()?->id);
+        if ($sharedVariables === null) {
+            return true;
+        }
+
+        return $sharedVariables->contains(fn (SharedEnvironmentVariable $shared): bool => $shared->is_shown_once
+            && in_array(['type' => $shared->type, 'key' => $shared->key], $references, true));
+    }
+
+    /**
+     * Load every shared variable that the given variables reference, with one query.
+     *
+     * @param  Collection<int, self>  $variables
+     * @return Collection<int, SharedEnvironmentVariable>|null Null when the team is unknown.
+     */
+    private static function sharedVariablesReferencedBy(Collection $variables, ?int $teamId): ?Collection
+    {
+        if ($teamId === null) {
+            return null;
+        }
+
+        $keys = $variables
+            ->flatMap(fn (self $variable): array => self::sharedVariableReferences($variable->value))
+            ->pluck('key')
+            ->unique()
+            ->values();
+
+        return $keys->isEmpty()
+            ? collect()
+            : SharedEnvironmentVariable::query()->where('team_id', $teamId)->whereIn('key', $keys)->get();
+    }
+
+    /**
+     * @return array<int, array{type: string, key: string}>
+     */
+    private static function sharedVariableReferences(?string $value): array
+    {
+        preg_match_all('/{{\s*(\w+)\.([^}\s]+)\s*}}/', (string) $value, $matches, PREG_SET_ORDER);
+
+        return array_map(fn (array $match): array => ['type' => $match[1], 'key' => $match[2]], $matches);
+    }
+
     public function resolveReferencedValue(): ?string
     {
         $value = $this->value;
@@ -439,7 +620,10 @@ class EnvironmentVariable extends BaseModel
             ->first()?->value ?? $value;
     }
 
-    private function get_real_environment_variables_internal(?string $environment_variable = null, $resource = null, $serverOverride = null, bool $revealLockedSharedVariables = true)
+    /**
+     * @param  Collection<int, SharedEnvironmentVariable>|null  $sharedVariables
+     */
+    private function get_real_environment_variables_internal(?string $environment_variable = null, $resource = null, $serverOverride = null, bool $revealLockedSharedVariables = true, ?Collection $sharedVariables = null)
     {
         if (is_null($environment_variable) || $environment_variable === '' || is_null($resource)) {
             return $environment_variable;
@@ -474,11 +658,15 @@ class EnvironmentVariable extends BaseModel
             if (is_null($id)) {
                 continue;
             }
-            $found = SharedEnvironmentVariable::where('type', $type)
-                ->where('key', $variable)
-                ->where('team_id', $resource->team()->id)
-                ->where("{$type}_id", $id)
-                ->first();
+            $found = $sharedVariables !== null
+                ? $sharedVariables->first(fn (SharedEnvironmentVariable $shared): bool => $shared->type === $type->value()
+                    && $shared->key === $variable->value()
+                    && (int) $shared->{"{$type}_id"} === (int) $id)
+                : SharedEnvironmentVariable::where('type', $type)
+                    ->where('key', $variable)
+                    ->where('team_id', $resource->team()->id)
+                    ->where("{$type}_id", $id)
+                    ->first();
             if ($found && ($revealLockedSharedVariables || ! $found->is_shown_once)) {
                 $environment_variable = str($environment_variable)->replace("{{{$sharedEnv}}}", $found->value);
             }
diff --git a/app/Models/GiteaApp.php b/app/Models/GiteaApp.php
new file mode 100644
index 0000000000..cee2c41a58
--- /dev/null
+++ b/app/Models/GiteaApp.php
@@ -0,0 +1,120 @@
+<?php
+
+namespace App\Models;
+
+use App\Traits\Auditable;
+
+class GiteaApp extends BaseModel
+{
+    use Auditable;
+
+    protected $fillable = [
+        'name',
+        'organization',
+        'api_url',
+        'html_url',
+        'custom_port',
+        'custom_user',
+        'is_system_wide',
+        'is_public',
+        'client_id',
+        'client_secret',
+        'access_token',
+        'refresh_token',
+        'expires_at',
+        'redirect_uri',
+        'webhook_secret',
+        'private_key_id',
+        'team_id',
+    ];
+
+    protected $hidden = [
+        'client_secret',
+        'access_token',
+        'refresh_token',
+        'webhook_secret',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'access_token' => 'encrypted',
+            'refresh_token' => 'encrypted',
+            'client_secret' => 'encrypted',
+            'webhook_secret' => 'encrypted',
+            'is_system_wide' => 'boolean',
+            'is_public' => 'boolean',
+        ];
+    }
+
+    /**
+     * Find the source whose webhook secret signed the payload.
+     * Encrypted secrets cannot be matched with SQL; sources are few per instance.
+     */
+    public static function findBySignature(string $payload, string $signature): ?self
+    {
+        if ($signature === '') {
+            return null;
+        }
+
+        return static::query()->whereNotNull('webhook_secret')->get()->first(
+            fn (self $app): bool => filled($app->webhook_secret)
+                && hash_equals(hash_hmac('sha256', $payload, (string) $app->webhook_secret), $signature)
+        );
+    }
+
+    protected static function booted(): void
+    {
+        static::deleting(function (GiteaApp $giteaApp) {
+            if ($giteaApp->applications()->count() > 0) {
+                throw new \RuntimeException('This source is being used by an application. Please delete all applications first.');
+            }
+        });
+    }
+
+    public static function ownedByCurrentTeam()
+    {
+        return GiteaApp::where(function ($query) {
+            $query->where('team_id', currentTeam()->id)
+                ->orWhere('is_system_wide', true);
+        });
+    }
+
+    public static function private()
+    {
+        return GiteaApp::where(function ($query) {
+            $query->where('team_id', currentTeam()->id)->orWhere('is_system_wide', true);
+        })->where('is_public', false)->whereNotNull('access_token');
+    }
+
+    public function applications()
+    {
+        return $this->morphMany(Application::class, 'source');
+    }
+
+    public function privateKey()
+    {
+        return $this->belongsTo(PrivateKey::class);
+    }
+
+    public function team()
+    {
+        return $this->belongsTo(Team::class);
+    }
+
+    public function isConnected(): bool
+    {
+        return ! empty($this->access_token) && ! empty($this->refresh_token);
+    }
+
+    public function apiUrlBase(): string
+    {
+        $apiUrl = rtrim($this->api_url, '/');
+
+        if (! str_contains($apiUrl, '/api/v1')) {
+            $apiUrl .= '/api/v1';
+        }
+
+        return $apiUrl;
+    }
+}
diff --git a/app/Models/GithubApp.php b/app/Models/GithubApp.php
index 493d51ce0a..6de5989747 100644
--- a/app/Models/GithubApp.php
+++ b/app/Models/GithubApp.php
@@ -90,7 +90,7 @@ class GithubApp extends BaseModel
     protected static function booted(): void
     {
         static::deleting(function (GithubApp $github_app) {
-            $applications_count = Application::where('source_id', $github_app->id)->count();
+            $applications_count = $github_app->applications()->count();
             if ($applications_count > 0) {
                 throw new \Exception('You cannot delete this GitHub App because it is in use by '.$applications_count.' application(s). Delete them first.');
             }
@@ -110,7 +110,8 @@ class GithubApp extends BaseModel
                 $isUsedElsewhere = $privateKey->servers()->exists()
                     || $privateKey->applications()->exists()
                     || $privateKey->githubApps()->where('id', '!=', $github_app->id)->exists()
-                    || $privateKey->gitlabApps()->exists();
+                    || $privateKey->gitlabApps()->exists()
+                    || $privateKey->giteaApps()->exists();
 
                 if (! $isUsedElsewhere) {
                     $privateKey->delete();
@@ -195,4 +196,19 @@ class GithubApp extends BaseModel
 
         return filled($this->app_id) && filled($this->installation_id);
     }
+
+    /**
+     * The settings page of this App at GitHub.
+     */
+    public function settingsUrl(): string
+    {
+        $name = encodeGithubPathSegment($this->name);
+        $organization = normalizeGithubOrganization($this->organization);
+
+        if (filled($organization)) {
+            return rtrim($this->html_url, '/').'/organizations/'.encodeGithubPathSegment($organization)."/settings/apps/{$name}";
+        }
+
+        return rtrim($this->html_url, '/')."/settings/apps/{$name}";
+    }
 }
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index 79d921fcf8..8726a9f0f6 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -21,6 +21,7 @@ class InstanceSettings extends Model
         'public_port_max',
         'do_not_track',
         'is_auto_update_enabled',
+        'is_backup_before_update_enabled',
         'is_registration_enabled',
         'disable_registration_when_oauth_enabled',
         'next_channel',
@@ -58,7 +59,9 @@ class InstanceSettings extends Model
         'avatar_storage_type',
         'avatar_s3_storage_id',
         'image_cdn_url',
+        'file_download_s3_storage_id',
         'is_dashboard_force_https_enabled',
+        'is_passkey_enabled',
     ];
 
     protected $hidden = [
@@ -90,6 +93,7 @@ class InstanceSettings extends Model
 
         'allowed_ip_ranges' => 'array',
         'is_auto_update_enabled' => 'boolean',
+        'is_backup_before_update_enabled' => 'boolean',
         'is_registration_enabled' => 'boolean',
         'disable_registration_when_oauth_enabled' => 'boolean',
         'auto_update_frequency' => 'string',
@@ -100,6 +104,7 @@ class InstanceSettings extends Model
         'webhook_allowed_internal_hosts' => 'array',
         'webhook_allow_localhost' => 'boolean',
         'is_dashboard_force_https_enabled' => 'boolean',
+        'is_passkey_enabled' => 'boolean',
     ];
 
     protected static function booted(): void
diff --git a/app/Models/IntegrationToken.php b/app/Models/IntegrationToken.php
index 119c8d95df..05f8174c70 100644
--- a/app/Models/IntegrationToken.php
+++ b/app/Models/IntegrationToken.php
@@ -71,6 +71,45 @@ class IntegrationToken extends BaseModel
         return self::PROVIDER_NAMES[$this->provider] ?? ucfirst($this->provider);
     }
 
+    /**
+     * Capabilities a token of the provider can have. Cloudflare Tunnel setup also writes DNS records, so `tunnel` needs `dns`.
+     *
+     * @return array<int, string>
+     */
+    public static function allowedCapabilities(string $provider): array
+    {
+        return $provider === 'cloudflare' ? ['dns', 'tunnel'] : ['secrets'];
+    }
+
+    /**
+     * Cloudflare dashboard link that pre-fills a user API token with the permissions the capabilities need.
+     *
+     * @param  array<int, string>  $capabilities
+     */
+    public static function cloudflareTokenTemplateUrl(array $capabilities): string
+    {
+        $permissions = [
+            ['key' => 'dns', 'type' => 'edit'],
+            ['key' => 'zone', 'type' => 'read'],
+        ];
+        if (in_array('tunnel', $capabilities, true)) {
+            // `argotunnel` is Cloudflare's internal key for the "Cloudflare Tunnel" permission group.
+            $permissions[] = ['key' => 'argotunnel', 'type' => 'edit'];
+        }
+
+        return 'https://dash.cloudflare.com/profile/api-tokens?'.http_build_query([
+            'permissionGroupKeys' => json_encode($permissions),
+            'accountId' => '*',
+            'zoneId' => 'all',
+            'name' => in_array('tunnel', $capabilities, true) ? 'Coolify DNS and Tunnel Management' : 'Coolify DNS Management',
+        ], '', '&', PHP_QUERY_RFC3986);
+    }
+
+    public function hasCapability(string $capability): bool
+    {
+        return in_array($capability, $this->capabilities ?? [], true);
+    }
+
     public function automaticDnsEnabled(): bool
     {
         return $this->provider === 'cloudflare' && data_get($this->metadata, 'automatic_dns', true) !== false;
diff --git a/app/Models/PrivateKey.php b/app/Models/PrivateKey.php
index 22689dc055..6b25353038 100644
--- a/app/Models/PrivateKey.php
+++ b/app/Models/PrivateKey.php
@@ -324,12 +324,18 @@ class PrivateKey extends BaseModel
         return $this->hasMany(GitlabApp::class);
     }
 
+    public function giteaApps()
+    {
+        return $this->hasMany(GiteaApp::class);
+    }
+
     public function isInUse()
     {
         return $this->servers()->exists()
             || $this->applications()->exists()
             || $this->githubApps()->exists()
-            || $this->gitlabApps()->exists();
+            || $this->gitlabApps()->exists()
+            || $this->giteaApps()->exists();
     }
 
     public function safeDelete()
diff --git a/app/Models/ResourceLink.php b/app/Models/ResourceLink.php
new file mode 100644
index 0000000000..a8f0e823e2
--- /dev/null
+++ b/app/Models/ResourceLink.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+
+/**
+ * A visual-only link between two resources of one environment on the environment canvas.
+ */
+class ResourceLink extends BaseModel
+{
+    protected $fillable = [
+        'environment_id',
+        'source_type',
+        'source_id',
+        'target_type',
+        'target_id',
+        'label',
+        'created_by',
+    ];
+
+    public function environment(): BelongsTo
+    {
+        return $this->belongsTo(Environment::class);
+    }
+
+    public function source(): MorphTo
+    {
+        return $this->morphTo();
+    }
+
+    public function target(): MorphTo
+    {
+        return $this->morphTo();
+    }
+}
diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index 3c0d9e7e95..3ee7d5f269 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -6,10 +6,12 @@ use App\Rules\SafeWebhookUrl;
 use App\Rules\ValidS3BucketName;
 use App\Traits\Auditable;
 use App\Traits\HasSafeStringAttribute;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Filesystem\FilesystemAdapter;
 use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Facades\Validator;
 
@@ -67,19 +69,48 @@ class S3Storage extends BaseModel
         });
 
         static::deleting(function (S3Storage $storage) {
-            ScheduledDatabaseBackup::where('s3_storage_id', $storage->id)->update([
-                'save_s3' => false,
-                's3_storage_id' => null,
-            ]);
-            ScheduledVolumeBackupExecution::where('s3_storage_id', $storage->id)
-                ->update([
-                    's3_storage_deleted' => true,
-                    's3_cleanup_pending' => false,
-                ]);
-            ScheduledVolumeBackup::where('s3_storage_id', $storage->id)->update([
-                'save_s3' => false,
-                's3_storage_id' => null,
-            ]);
+            $storage->detachFromBackups();
+        });
+    }
+
+    /**
+     * Removes this storage from every backup schedule and marks the copies in it as deleted. A schedule moves its
+     * primary destination to a remaining storage, or stops S3 backups when none remains.
+     */
+    public function detachFromBackups(): void
+    {
+        DB::transaction(function (): void {
+            foreach ([ScheduledDatabaseBackup::class, ScheduledVolumeBackup::class] as $backupModel) {
+                $backupModel::query()
+                    ->usingS3Storage($this->id)
+                    ->lazyById()
+                    ->each(function (ScheduledDatabaseBackup|ScheduledVolumeBackup $backup): void {
+                        $backup->syncS3Storages($backup->s3Storages()->whereKeyNot($this->id)->pluck('s3_storages.id')->all());
+                        if ($backup->s3_storage_id === null && $backup->save_s3) {
+                            $backup->update(['save_s3' => false]);
+                        }
+                    });
+            }
+
+            foreach ([DatabaseBackupS3Replica::class, VolumeBackupS3Replica::class] as $replicaModel) {
+                $replicaModel::query()
+                    ->with('execution')
+                    ->where('s3_storage_id', $this->id)
+                    ->where('s3_storage_deleted', false)
+                    ->lazyById()
+                    ->each(function (DatabaseBackupS3Replica|VolumeBackupS3Replica $replica): void {
+                        $replica->update(['s3_storage_deleted' => true]);
+                        $replica->execution?->refreshS3Summary();
+                    });
+            }
+
+            ScheduledVolumeBackupExecution::query()
+                ->where('s3_cleanup_pending', true)
+                ->whereHas('s3Replicas', fn (Builder $query) => $query->where('s3_storage_id', $this->id))
+                ->whereDoesntHave('s3Replicas', fn (Builder $query) => $query
+                    ->where('s3_storage_deleted', false)
+                    ->where(fn (Builder $query) => $query->whereNull('s3_uploaded')->orWhere('s3_uploaded', false)))
+                ->update(['s3_cleanup_pending' => false]);
         });
     }
 
diff --git a/app/Models/ScheduledDatabaseBackup.php b/app/Models/ScheduledDatabaseBackup.php
index 53ae084349..3c31c0fbc7 100644
--- a/app/Models/ScheduledDatabaseBackup.php
+++ b/app/Models/ScheduledDatabaseBackup.php
@@ -2,12 +2,16 @@
 
 namespace App\Models;
 
+use App\Traits\HasS3Destinations;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 class ScheduledDatabaseBackup extends BaseModel
 {
+    use HasS3Destinations;
+
     protected function casts(): array
     {
         return [
@@ -78,6 +82,11 @@ class ScheduledDatabaseBackup extends BaseModel
         return $this->belongsTo(S3Storage::class, 's3_storage_id');
     }
 
+    public function s3Storages(): BelongsToMany
+    {
+        return $this->belongsToMany(S3Storage::class, 'scheduled_database_backup_s3_storage')->withTimestamps();
+    }
+
     public function get_last_days_backup_status($days = 7)
     {
         return $this->hasMany(ScheduledDatabaseBackupExecution::class)->where('created_at', '>=', now()->subDays($days))->get();
@@ -85,7 +94,7 @@ class ScheduledDatabaseBackup extends BaseModel
 
     public function executionsPaginated(int $skip = 0, int $take = 10)
     {
-        $executions = $this->hasMany(ScheduledDatabaseBackupExecution::class)->orderBy('created_at', 'desc');
+        $executions = $this->hasMany(ScheduledDatabaseBackupExecution::class)->with('s3Replicas.s3')->orderBy('created_at', 'desc');
         $count = $executions->count();
         $executions = $executions->skip($skip)->take($take)->get();
 
diff --git a/app/Models/ScheduledDatabaseBackupExecution.php b/app/Models/ScheduledDatabaseBackupExecution.php
index 1a479772cf..eb43a1a2e3 100644
--- a/app/Models/ScheduledDatabaseBackupExecution.php
+++ b/app/Models/ScheduledDatabaseBackupExecution.php
@@ -2,10 +2,14 @@
 
 namespace App\Models;
 
+use App\Traits\HasS3Replicas;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 class ScheduledDatabaseBackupExecution extends BaseModel
 {
+    use HasS3Replicas;
+
     protected static function booted(): void
     {
         static::created(function (ScheduledDatabaseBackupExecution $execution): void {
@@ -42,4 +46,9 @@ class ScheduledDatabaseBackupExecution extends BaseModel
     {
         return $this->belongsTo(ScheduledDatabaseBackup::class);
     }
+
+    public function s3Replicas(): HasMany
+    {
+        return $this->hasMany(DatabaseBackupS3Replica::class, 'execution_id');
+    }
 }
diff --git a/app/Models/ScheduledVolumeBackup.php b/app/Models/ScheduledVolumeBackup.php
index 9ad676d953..0c4443b2e3 100644
--- a/app/Models/ScheduledVolumeBackup.php
+++ b/app/Models/ScheduledVolumeBackup.php
@@ -2,15 +2,19 @@
 
 namespace App\Models;
 
+use App\Traits\HasS3Destinations;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 class ScheduledVolumeBackup extends BaseModel
 {
+    use HasS3Destinations;
+
     public const int DEFAULT_TIMEOUT = 36000;
 
     protected $fillable = [
@@ -123,6 +127,11 @@ class ScheduledVolumeBackup extends BaseModel
         return $this->belongsTo(S3Storage::class, 's3_storage_id');
     }
 
+    public function s3Storages(): BelongsToMany
+    {
+        return $this->belongsToMany(S3Storage::class, 'scheduled_volume_backup_s3_storage')->withTimestamps();
+    }
+
     public function executions(): HasMany
     {
         return $this->hasMany(ScheduledVolumeBackupExecution::class)->latest();
diff --git a/app/Models/ScheduledVolumeBackupExecution.php b/app/Models/ScheduledVolumeBackupExecution.php
index 664efa11c1..82dfe0ee3b 100644
--- a/app/Models/ScheduledVolumeBackupExecution.php
+++ b/app/Models/ScheduledVolumeBackupExecution.php
@@ -2,10 +2,14 @@
 
 namespace App\Models;
 
+use App\Traits\HasS3Replicas;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 class ScheduledVolumeBackupExecution extends BaseModel
 {
+    use HasS3Replicas;
+
     protected $fillable = [
         'uuid',
         'scheduled_volume_backup_id',
@@ -56,4 +60,9 @@ class ScheduledVolumeBackupExecution extends BaseModel
     {
         return $this->belongsTo(S3Storage::class, 's3_storage_id');
     }
+
+    public function s3Replicas(): HasMany
+    {
+        return $this->hasMany(VolumeBackupS3Replica::class, 'execution_id');
+    }
 }
diff --git a/app/Models/Server.php b/app/Models/Server.php
index 560dc601b6..178b180d22 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -22,6 +22,7 @@ use App\Notifications\Server\Reachable;
 use App\Notifications\Server\Unreachable;
 use App\Services\DigitalOceanService;
 use App\Services\HetznerService;
+use App\Services\HostingerService;
 use App\Services\VultrService;
 use App\Support\ValidationPatterns;
 use App\Traits\Auditable;
@@ -130,6 +131,19 @@ class Server extends BaseModel
 
     public const PLACEHOLDER_IPS = [self::PLACEHOLDER_IP, '0.0.0.0', '::'];
 
+    /**
+     * Serves the proxy error pages (503.html) for the Traefik and Caddy catch-all.
+     */
+    public const PROXY_ERROR_PAGE_CONTAINER = 'coolify-proxy-error-pages';
+
+    public const PROXY_ERROR_PAGE_IMAGE = 'busybox:musl';
+
+    /**
+     * Maximum size of a custom error or maintenance page. The page goes to the server with scp
+     * (see uploadProxyFile()), so this limit only keeps the Livewire payload reasonable.
+     */
+    public const PROXY_ERROR_PAGE_MAX_BYTES = 1048576;
+
     /**
      * Default Caddy proxy image. caddy-docker-proxy 2.13 ships Caddy 2.11.
      */
@@ -242,7 +256,13 @@ class Server extends BaseModel
                 $destination->delete();
             });
             // Leftover active runner rows would block deleting the GitHub App.
-            GithubRunnerExecution::deleteAndDeregister(GithubRunnerExecution::query()->where('server_id', $server->id));
+            // The runners of a transferred server now belong to the other instance, so keep them registered at GitHub.
+            $executions = GithubRunnerExecution::query()->where('server_id', $server->id);
+            if ($server->isTransferredAway()) {
+                $executions->delete();
+            } else {
+                GithubRunnerExecution::deleteAndDeregister($executions);
+            }
             $server->githubRunnerConfig()->delete();
             $server->settings()->delete();
             $server->sslCertificates()->delete();
@@ -328,6 +348,7 @@ class Server extends BaseModel
     protected $hidden = [
         'logdrain_axiom_api_key',
         'logdrain_newrelic_license_key',
+        'proxy_error_page',
     ];
 
     protected $schemalessAttributes = [
@@ -349,6 +370,8 @@ class Server extends BaseModel
         'vultr_instance_status',
         'digitalocean_droplet_id',
         'digitalocean_droplet_status',
+        'hostinger_virtual_machine_id',
+        'hostinger_virtual_machine_status',
         'is_validating',
         'validation_logs',
         'detected_traefik_version',
@@ -362,7 +385,7 @@ class Server extends BaseModel
     public function setValidationLogsAttribute($value): void
     {
         $this->attributes['validation_logs'] = $value !== null
-            ? Purify::config('validation_logs')->clean($value)
+            ? Purify::config('validation_logs')->clean(remove_iip($value))
             : null;
     }
 
@@ -528,6 +551,27 @@ class Server extends BaseModel
         return $status;
     }
 
+    public function refreshHostingerState(): ?string
+    {
+        if (! $this->hostinger_virtual_machine_id || ! $this->cloudProviderToken || $this->cloudProviderToken->provider !== 'hostinger') {
+            return $this->hostinger_virtual_machine_status;
+        }
+
+        $hostingerService = new HostingerService($this->cloudProviderToken->token);
+        $virtualMachine = $hostingerService->getVirtualMachine((int) $this->hostinger_virtual_machine_id);
+
+        if (empty($virtualMachine)) {
+            return $this->hostinger_virtual_machine_status;
+        }
+
+        $status = $virtualMachine['state'] ?? null;
+        $ip = $hostingerService->getPublicIpAddress($virtualMachine);
+        $this->persistProviderState(['hostinger_virtual_machine_status' => $status]);
+        $this->backfillPlaceholderIp($ip);
+
+        return $status;
+    }
+
     protected function isCoolifyHost(): Attribute
     {
         return Attribute::make(
@@ -626,6 +670,10 @@ class Server extends BaseModel
         return $this->proxyType() && $this->proxyType() !== 'NONE' && $this->isFunctional() && ! $this->isSwarmWorker() && $this->canHostResources();
     }
 
+    /**
+     * Writes the catch-all proxy configuration for requests that no resource handles.
+     * Priority: redirect URL > custom error page > Coolify default error page.
+     */
     public function setupDefaultRedirect()
     {
         $banner =
@@ -634,7 +682,6 @@ class Server extends BaseModel
         $dynamic_conf_path = $this->proxyPath().'/dynamic';
         $proxy_type = $this->proxyType();
         $redirect_enabled = $this->proxy->redirect_enabled ?? true;
-        $redirect_url = $this->proxy->redirect_url;
         if ($proxy_type === ProxyTypes::TRAEFIK->value) {
             $default_redirect_file = "$dynamic_conf_path/default_redirect_503.yaml";
         } elseif ($proxy_type === ProxyTypes::CADDY->value) {
@@ -646,65 +693,13 @@ class Server extends BaseModel
             "rm -f $dynamic_conf_path/default_redirect_404.yaml",
             "rm -f $dynamic_conf_path/default_redirect_404.caddy",
         ], $this);
+        // The error page container must run before the catch-all points to it.
+        $this->setupProxyErrorPageContainer();
 
         if ($redirect_enabled === false) {
             instant_remote_process(["rm -f $default_redirect_file"], $this);
         } else {
-            if ($proxy_type === ProxyTypes::CADDY->value) {
-                if (filled($redirect_url)) {
-                    $conf = ":80, :443 {
-   redir $redirect_url
-}";
-                } else {
-                    $conf = ':80, :443 {
-    respond 503
-}';
-                }
-            } elseif ($proxy_type === ProxyTypes::TRAEFIK->value) {
-                $dynamic_conf = [
-                    'http' => [
-                        'routers' => [
-                            'catchall' => [
-                                'entryPoints' => [
-                                    0 => 'http',
-                                    1 => 'https',
-                                ],
-                                'service' => 'noop',
-                                'rule' => 'PathPrefix(`/`)',
-                                'tls' => $this->traefikCertificateResolver() ? ['certResolver' => $this->traefikCertificateResolver()] : [],
-                                'priority' => -1000,
-                            ],
-                        ],
-                        'services' => [
-                            'noop' => [
-                                'loadBalancer' => [
-                                    'servers' => [],
-                                ],
-                            ],
-                        ],
-                    ],
-                ];
-                if (filled($redirect_url)) {
-                    $dynamic_conf['http']['routers']['catchall']['middlewares'] = [
-                        0 => 'redirect-regexp',
-                    ];
-
-                    $dynamic_conf['http']['services']['noop']['loadBalancer']['servers'][0] = [
-                        'url' => '',
-                    ];
-                    $dynamic_conf['http']['middlewares'] = [
-                        'redirect-regexp' => [
-                            'redirectRegex' => [
-                                'regex' => '(.*)',
-                                'replacement' => $redirect_url,
-                                'permanent' => false,
-                            ],
-                        ],
-                    ];
-                }
-                $conf = Yaml::dump($dynamic_conf, 12, 2);
-            }
-            $conf = $banner.$conf;
+            $conf = $banner.$this->defaultRedirectConfiguration();
             $base64 = base64_encode($conf);
             instant_remote_process([
                 "echo '$base64' | base64 -d | tee $default_redirect_file > /dev/null",
@@ -716,6 +711,346 @@ class Server extends BaseModel
         }
     }
 
+    /**
+     * Catch-all proxy configuration (without the banner) for an enabled default redirect.
+     */
+    public function defaultRedirectConfiguration(): string
+    {
+        $redirect_url = $this->proxy->redirect_url;
+        $usesErrorPage = $this->usesProxyErrorPage();
+
+        if ($this->proxyType() === ProxyTypes::CADDY->value) {
+            if (filled($redirect_url)) {
+                return ":80, :443 {
+   redir $redirect_url
+}";
+            }
+            if ($usesErrorPage) {
+                // busybox httpd answers 200, so copy_response sets the 503 status.
+                return ':80, :443 {
+    reverse_proxy '.self::PROXY_ERROR_PAGE_CONTAINER.':80 {
+        rewrite /503.html
+        handle_response {
+            copy_response 503
+        }
+    }
+}';
+            }
+
+            return ':80, :443 {
+    respond 503
+}';
+        }
+
+        $dynamic_conf = [
+            'http' => [
+                'routers' => [
+                    'catchall' => [
+                        'entryPoints' => [
+                            0 => 'http',
+                            1 => 'https',
+                        ],
+                        'service' => 'noop',
+                        'rule' => 'PathPrefix(`/`)',
+                        'tls' => $this->traefikCertificateResolver() ? ['certResolver' => $this->traefikCertificateResolver()] : [],
+                        'priority' => -1000,
+                    ],
+                ],
+                'services' => [
+                    'noop' => [
+                        'loadBalancer' => [
+                            'servers' => [],
+                        ],
+                    ],
+                ],
+            ],
+        ];
+        if (filled($redirect_url)) {
+            $dynamic_conf['http']['routers']['catchall']['middlewares'] = [
+                0 => 'redirect-regexp',
+            ];
+
+            $dynamic_conf['http']['services']['noop']['loadBalancer']['servers'][0] = [
+                'url' => '',
+            ];
+            $dynamic_conf['http']['middlewares'] = [
+                'redirect-regexp' => [
+                    'redirectRegex' => [
+                        'regex' => '(.*)',
+                        'replacement' => $redirect_url,
+                        'permanent' => false,
+                    ],
+                ],
+            ];
+        } elseif ($usesErrorPage) {
+            // The noop service (no servers) keeps the 503; the errors middleware only replaces the body.
+            $dynamic_conf['http']['routers']['catchall']['middlewares'] = [
+                0 => 'error-pages',
+            ];
+            $dynamic_conf['http']['middlewares'] = [
+                'error-pages' => [
+                    'errors' => [
+                        'status' => ['503'],
+                        'service' => 'error-pages',
+                        'query' => '/503.html',
+                    ],
+                ],
+            ];
+            $dynamic_conf['http']['services']['error-pages'] = [
+                'loadBalancer' => [
+                    'servers' => [
+                        ['url' => 'http://'.self::PROXY_ERROR_PAGE_CONTAINER.':80'],
+                    ],
+                ],
+            ];
+        }
+
+        // A router with `tls` matches only HTTPS, so plain HTTP needs its own catch-all router.
+        if (! $this->isSwarm()) {
+            $catchall = $dynamic_conf['http']['routers']['catchall'];
+            $dynamic_conf['http']['routers']['catchall']['entryPoints'] = ['https'];
+            unset($catchall['tls']);
+            $dynamic_conf['http']['routers']['catchall-http'] = array_merge($catchall, ['entryPoints' => ['http']]);
+        }
+
+        return Yaml::dump($dynamic_conf, 12, 2);
+    }
+
+    /**
+     * True when the catch-all shows the error page: a standalone Traefik or Caddy proxy with
+     * the default redirect enabled and no redirect URL. Swarm servers keep the plain 503.
+     */
+    public function usesProxyErrorPage(): bool
+    {
+        return ! $this->isSwarm()
+            && in_array($this->proxyType(), [ProxyTypes::TRAEFIK->value, ProxyTypes::CADDY->value], true)
+            && ($this->proxy->redirect_enabled ?? true) !== false
+            && blank($this->proxy->redirect_url);
+    }
+
+    public function proxyErrorPagesPath(): string
+    {
+        return base_configuration_dir().'/proxy/error-pages';
+    }
+
+    /**
+     * The custom error page HTML, or the Coolify default page.
+     */
+    public function proxyErrorPageHtml(): string
+    {
+        return filled($this->proxy_error_page) ? $this->proxy_error_page : view('proxy.error-page')->render();
+    }
+
+    /**
+     * Applications and services on this server that are in maintenance mode.
+     *
+     * @return Collection<int, Application|Service>
+     */
+    public function maintenanceResources(): Collection
+    {
+        if ($this->isSwarm() || ! in_array($this->proxyType(), [ProxyTypes::TRAEFIK->value, ProxyTypes::CADDY->value], true)) {
+            return collect();
+        }
+
+        return $this->applications()->where('is_maintenance_enabled', true)->values()
+            ->concat($this->services()->where('is_maintenance_enabled', true)->get());
+    }
+
+    /**
+     * Writes 503.html and starts the error page container, or removes the container when
+     * neither the catch-all nor a maintenance page uses it. Swarm servers are not supported.
+     */
+    public function setupProxyErrorPageContainer(): void
+    {
+        if ($this->isSwarm()) {
+            return;
+        }
+
+        $container = self::PROXY_ERROR_PAGE_CONTAINER;
+        if (! $this->usesProxyErrorPage() && $this->maintenanceResources()->isEmpty()) {
+            instant_remote_process(["docker rm -f $container >/dev/null 2>&1 || true"], $this);
+
+            return;
+        }
+
+        $path = $this->proxyErrorPagesPath();
+        $mount = devHostDockerPath($this, $path);
+        $restart = RESTART_MODE;
+
+        instant_remote_process(["mkdir -p $path"], $this);
+        $this->uploadProxyFile("$path/503.html", $this->proxyErrorPageHtml());
+        instant_remote_process([
+            dockerNetworkEnsureCommand('coolify'),
+            "docker start $container >/dev/null 2>&1 || docker run -d --name $container --network coolify --restart $restart --label coolify.managed=true -v $mount:/www:ro ".self::PROXY_ERROR_PAGE_IMAGE.' httpd -f -p 80 -h /www',
+            // A proxy on custom networks only must still reach the error page container.
+            'docker network connect coolify coolify-proxy >/dev/null 2>&1 || true',
+        ], $this);
+    }
+
+    /**
+     * Writes $contents to $path on this server with scp. A shell command is limited to 128 KiB,
+     * so large pages and proxy files cannot go inside one command.
+     */
+    public function uploadProxyFile(string $path, string $contents): void
+    {
+        $uploadPath = '/tmp/coolify-upload-'.bin2hex(random_bytes(8));
+        $localPath = tempnam(sys_get_temp_dir(), 'coolify-proxy-file-');
+        try {
+            file_put_contents($localPath, $contents);
+            instant_scp($localPath, $uploadPath, $this);
+        } finally {
+            @unlink($localPath);
+        }
+
+        // The proxy and the page container read the file as root, other users do not need it.
+        instant_remote_process(["mv -f $uploadPath $path", "chmod 644 $path"], $this);
+    }
+
+    /**
+     * Writes the maintenance pages and the proxy configuration that shows them instead of the
+     * applications and services in maintenance mode. Swarm servers are not supported.
+     */
+    public function setupMaintenancePages(): void
+    {
+        $proxyType = $this->proxyType();
+        if ($this->isSwarm() || ! in_array($proxyType, [ProxyTypes::TRAEFIK->value, ProxyTypes::CADDY->value], true)) {
+            return;
+        }
+
+        $resources = $this->maintenanceResources();
+        $path = $this->proxyErrorPagesPath();
+        $keep = $resources->map(fn ($resource) => "! -name '{$resource->maintenancePageFile()}' ")->implode('');
+
+        instant_remote_process([
+            "mkdir -p $path",
+            "find $path -maxdepth 1 -name 'maintenance-*.html' {$keep}-delete",
+        ], $this);
+        $this->setupProxyErrorPageContainer();
+
+        foreach ($resources as $resource) {
+            $this->uploadProxyFile("$path/{$resource->maintenancePageFile()}", $resource->maintenancePageHtml());
+        }
+
+        $dynamicPath = $this->proxyPath().'/dynamic';
+        instant_remote_process(["mkdir -p $dynamicPath"], $this);
+        if ($proxyType === ProxyTypes::TRAEFIK->value) {
+            $file = "$dynamicPath/coolify-maintenance.yaml";
+            $configuration = $this->maintenanceTraefikConfiguration($resources);
+            if ($configuration === null) {
+                instant_remote_process(["rm -f $file"], $this);
+            } else {
+                $this->uploadProxyFile($file, $configuration);
+            }
+        } else {
+            // caddy-docker-proxy reads the base Caddyfile again on its next poll.
+            $this->uploadProxyFile("$dynamicPath/Caddyfile", $this->caddyBaseCaddyfile($resources));
+        }
+    }
+
+    /**
+     * Traefik routers that use the same rule as the resource routers, with a priority one
+     * higher. Traefik uses the rule length as the default priority, so a resource on a longer
+     * path of the same host keeps its own router.
+     *
+     * @param  Collection<int, Application|Service>  $resources
+     */
+    public function maintenanceTraefikConfiguration(Collection $resources): ?string
+    {
+        $routers = [];
+        $middlewares = [];
+        foreach ($resources as $resource) {
+            $routes = $resource->maintenanceRoutes();
+            if ($routes->isEmpty()) {
+                continue;
+            }
+            $middleware = "coolify-maintenance-{$resource->uuid}";
+            $middlewares[$middleware] = [
+                'errors' => [
+                    'status' => ['503'],
+                    'service' => 'coolify-maintenance-pages',
+                    'query' => '/'.$resource->maintenancePageFile(),
+                ],
+            ];
+            foreach ($routes as $index => $route) {
+                $rule = "Host(`{$route['host']}`) && PathPrefix(`{$route['path']}`)";
+                $router = [
+                    'entryPoints' => ['http'],
+                    'rule' => $rule,
+                    'service' => 'coolify-maintenance-noop',
+                    'middlewares' => ['coolify-maintenance-headers', $middleware],
+                    'priority' => strlen($rule) + 1,
+                ];
+                $routers["coolify-maintenance-{$resource->uuid}-{$index}-http"] = $router;
+                if ($route['scheme'] === 'https') {
+                    $routers["coolify-maintenance-{$resource->uuid}-{$index}-https"] = array_merge($router, [
+                        'entryPoints' => ['https'],
+                        'tls' => ['certResolver' => 'letsencrypt'],
+                    ]);
+                }
+            }
+        }
+
+        if ($routers === []) {
+            return null;
+        }
+
+        $middlewares['coolify-maintenance-headers'] = [
+            'headers' => ['customResponseHeaders' => ['Retry-After' => '300']],
+        ];
+
+        return "# This file is generated by Coolify, do not edit it manually.\n\n".Yaml::dump([
+            'http' => [
+                'routers' => $routers,
+                'middlewares' => $middlewares,
+                'services' => [
+                    // No servers: Traefik answers 503 and the errors middleware adds the page.
+                    'coolify-maintenance-noop' => ['loadBalancer' => ['servers' => []]],
+                    'coolify-maintenance-pages' => [
+                        'loadBalancer' => ['servers' => [['url' => 'http://'.self::PROXY_ERROR_PAGE_CONTAINER.':80']]],
+                    ],
+                ],
+            ],
+        ], 12, 2);
+    }
+
+    /**
+     * The base Caddyfile of caddy-docker-proxy. A maintenance block uses the same site address
+     * as the resource labels, so caddy-docker-proxy merges both into one site block. Its named
+     * matcher has the same path as the resource handle, so Caddy runs it first.
+     *
+     * @param  Collection<int, Application|Service>|null  $resources
+     */
+    public function caddyBaseCaddyfile(?Collection $resources = null): string
+    {
+        $resources ??= $this->maintenanceResources();
+        $sites = [];
+        foreach ($resources as $resource) {
+            foreach ($resource->maintenanceRoutes() as $index => $route) {
+                $address = caddySiteAddress($route['scheme'], $route['host'], $route['force_https']);
+                $matcher = "@coolify-maintenance-{$resource->uuid}-{$index}";
+                $sites[$address][] = implode("\n", [
+                    "\t{$matcher} path {$route['path']}*",
+                    "\thandle {$matcher} {",
+                    "\t\treverse_proxy ".self::PROXY_ERROR_PAGE_CONTAINER.':80 {',
+                    "\t\t\trewrite /{$resource->maintenancePageFile()}",
+                    "\t\t\theader_down Retry-After 300",
+                    "\t\t\thandle_response {",
+                    "\t\t\t\tcopy_response 503",
+                    "\t\t\t}",
+                    "\t\t}",
+                    "\t}",
+                ]);
+            }
+        }
+
+        $caddyfile = 'import /dynamic/*.caddy';
+        foreach ($sites as $address => $blocks) {
+            $caddyfile .= "\n\n{$address} {\n".implode("\n", $blocks)."\n}";
+        }
+
+        return $caddyfile."\n";
+    }
+
     public function setupDynamicProxyConfiguration()
     {
         $settings = instanceSettings();
@@ -1051,15 +1386,6 @@ $siteAddress {
         return data_get($this->server_metadata, 'transfer.status') === 'transferred';
     }
 
-    /**
-     * Management was disabled manually on this instance; the server is ready to be transferred.
-     */
-    public function isManagementDisabled(): bool
-    {
-        return $this->isTransferredAway()
-            && (bool) data_get($this->server_metadata, 'transfer.management_disabled', false);
-    }
-
     /**
      * Whether this server may be validated / installed against from this instance.
      */
@@ -1288,6 +1614,12 @@ $siteAddress {
         return $this->caddyRunsCurrentVersion();
     }
 
+    public function caddySupportsArgon2idBasicAuth(): bool
+    {
+        return $this->caddyRunsCurrentVersion()
+            && self::caddyDockerProxyImageVersion($this->configuredCaddyProxyImage()) >= [2, 11];
+    }
+
     public function isServerApiEnabled(): bool
     {
         return $this->settings->is_sentinel_enabled;
@@ -1725,6 +2057,14 @@ $siteAddress {
     }
 
     public function isLogDrainEnabled()
+    {
+        return $this->isFluentBitLogDrainEnabled() || $this->settings->is_logdrain_cloudwatch_enabled;
+    }
+
+    /**
+     * Whether the active log drain relies on the coolify-log-drain Fluent Bit container.
+     */
+    public function isFluentBitLogDrainEnabled(): bool
     {
         return $this->settings->is_logdrain_newrelic_enabled || $this->settings->is_logdrain_highlight_enabled || $this->settings->is_logdrain_axiom_enabled || $this->settings->is_logdrain_custom_enabled;
     }
@@ -1770,7 +2110,7 @@ $siteAddress {
 
         try {
             $output = instant_remote_process([
-                'echo "---PRETTY_NAME---" && grep PRETTY_NAME /etc/os-release | cut -d= -f2 | tr -d \'"\' && echo "---ARCH---" && uname -m && echo "---KERNEL---" && uname -r && echo "---CPUS---" && nproc && echo "---MEMORY---" && free -b | awk \'/Mem:/{print $2}\' && echo "---UPTIME_SINCE---" && uptime -s && echo "---DOCKER---" && (docker version --format \'{{.Server.Version}}\' 2>/dev/null || true) && echo "---COMPOSE---" && (docker compose version --short 2>/dev/null || true)',
+                'echo "---PRETTY_NAME---" && grep PRETTY_NAME /etc/os-release | cut -d= -f2 | tr -d \'"\' && echo "---ARCH---" && uname -m && echo "---KERNEL---" && uname -r && echo "---CPUS---" && nproc && echo "---MEMORY---" && free -b | awk \'/Mem:/{print $2}\' && echo "---UPTIME_SINCE---" && uptime -s && echo "---DOCKER---" && (docker version --format \'{{.Server.Version}}\' 2>/dev/null || true) && echo "---COMPOSE---" && (docker compose version --short 2>/dev/null || true) && echo "---GPUS---" && (nvidia-smi --query-gpu=index,uuid,memory.total,name --format=csv,noheader,nounits 2>/dev/null || true) && echo "---NVIDIA_TOOLKIT---" && (command -v nvidia-container-runtime-hook nvidia-ctk 2>/dev/null || true)',
             ], $this, false);
 
             if (! $output) {
@@ -1778,6 +2118,7 @@ $siteAddress {
             }
 
             $sections = [];
+            $sectionLines = [];
             $currentKey = null;
             foreach (explode("\n", trim($output)) as $line) {
                 $line = trim($line);
@@ -1785,6 +2126,9 @@ $siteAddress {
                     $currentKey = $m[1];
                 } elseif ($currentKey) {
                     $sections[$currentKey] = $line;
+                    if ($line !== '') {
+                        $sectionLines[$currentKey][] = $line;
+                    }
                 }
             }
 
@@ -1795,10 +2139,18 @@ $siteAddress {
                 'cpus' => (int) ($sections['CPUS'] ?? 0),
                 'memory_bytes' => (int) ($sections['MEMORY'] ?? 0),
                 'uptime_since' => $sections['UPTIME_SINCE'] ?? null,
+                'gpus' => self::parseNvidiaSmiGpus($sectionLines['GPUS'] ?? []),
+                'nvidia_container_toolkit' => ($sectionLines['NVIDIA_TOOLKIT'] ?? []) !== [],
                 'collected_at' => now()->toIso8601String(),
             ];
 
-            $this->update(['server_metadata' => $metadata]);
+            // Merge into the saved row: server_metadata also holds the transfer and migration state.
+            DB::transaction(function () use ($metadata) {
+                $locked = self::query()->lockForUpdate()->findOrFail($this->id);
+                $locked->update(['server_metadata' => array_merge($locked->server_metadata ?? [], $metadata)]);
+                $this->server_metadata = $locked->server_metadata;
+                $this->syncOriginalAttribute('server_metadata');
+            });
 
             try {
                 $detectedDockerVersion = parseDockerEngineVersion($sections['DOCKER'] ?? null);
@@ -1828,6 +2180,38 @@ $siteAddress {
         }
     }
 
+    /**
+     * Parse `nvidia-smi --query-gpu=index,uuid,memory.total,name --format=csv,noheader,nounits` lines.
+     * The name is the last column because it can contain commas.
+     *
+     * @param  list<string>  $lines
+     * @return list<array{index: string, uuid: string, memory_mb: int, name: string}>
+     */
+    public static function parseNvidiaSmiGpus(array $lines): array
+    {
+        $gpus = [];
+        foreach ($lines as $line) {
+            $columns = array_map('trim', explode(',', $line, 4));
+            if (count($columns) !== 4 || ! ctype_digit($columns[0])) {
+                continue;
+            }
+            [$index, $uuid, $memory, $name] = $columns;
+            $gpus[] = ['index' => $index, 'uuid' => $uuid, 'memory_mb' => (int) $memory, 'name' => $name];
+        }
+
+        return $gpus;
+    }
+
+    /**
+     * GPUs found when the server details were last collected, or null when they were never checked.
+     *
+     * @return list<array{index: string, uuid: string, memory_mb: int, name: string}>|null
+     */
+    public function detectedGpus(): ?array
+    {
+        return data_get($this->server_metadata, 'gpus');
+    }
+
     public function isTerminalEnabled()
     {
         return $this->settings->is_terminal_enabled ?? false;
diff --git a/app/Models/ServerSetting.php b/app/Models/ServerSetting.php
index d7eaffea62..8a9c599331 100644
--- a/app/Models/ServerSetting.php
+++ b/app/Models/ServerSetting.php
@@ -7,6 +7,7 @@ use App\Enums\TrafficIpMode;
 use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Log;
 use OpenApi\Attributes as OA;
 
@@ -26,6 +27,7 @@ use OpenApi\Attributes as OA;
         'is_cloudflare_tunnel' => ['type' => 'boolean'],
         'is_jump_server' => ['type' => 'boolean'],
         'is_logdrain_axiom_enabled' => ['type' => 'boolean'],
+        'is_logdrain_cloudwatch_enabled' => ['type' => 'boolean'],
         'is_logdrain_custom_enabled' => ['type' => 'boolean'],
         'is_logdrain_highlight_enabled' => ['type' => 'boolean'],
         'is_logdrain_newrelic_enabled' => ['type' => 'boolean'],
@@ -47,6 +49,9 @@ use OpenApi\Attributes as OA;
         'is_usable' => ['type' => 'boolean'],
         'logdrain_axiom_api_key' => ['type' => 'string'],
         'logdrain_axiom_dataset_name' => ['type' => 'string'],
+        'logdrain_cloudwatch_region' => ['type' => 'string'],
+        'logdrain_cloudwatch_group' => ['type' => 'string'],
+        'logdrain_cloudwatch_stream_prefix' => ['type' => 'string'],
         'logdrain_custom_config' => ['type' => 'string'],
         'logdrain_custom_config_parser' => ['type' => 'string'],
         'logdrain_highlight_project_id' => ['type' => 'string'],
@@ -98,6 +103,9 @@ class ServerSetting extends Model
         'is_usable',
         'wildcard_domain',
         'is_cloudflare_tunnel',
+        'cloudflare_tunnel_id',
+        'cloudflare_tunnel_account_id',
+        'cloudflare_tunnel_integration_token_id',
         'is_logdrain_newrelic_enabled',
         'logdrain_newrelic_license_key',
         'logdrain_newrelic_base_uri',
@@ -110,6 +118,10 @@ class ServerSetting extends Model
         'is_logdrain_custom_enabled',
         'logdrain_custom_config',
         'logdrain_custom_config_parser',
+        'is_logdrain_cloudwatch_enabled',
+        'logdrain_cloudwatch_region',
+        'logdrain_cloudwatch_group',
+        'logdrain_cloudwatch_stream_prefix',
         'concurrent_builds',
         'dynamic_timeout',
         'force_disabled',
@@ -150,6 +162,12 @@ class ServerSetting extends Model
         'docker_version_checked_at',
         'compose_version',
         'compose_version_checked_at',
+        'patch_check_frequency',
+        'patch_check_result',
+        'patch_check_error',
+        'patch_checked_at',
+        'is_auto_security_updates_enabled',
+        'auto_security_updates_time',
     ];
 
     /**
@@ -188,6 +206,10 @@ class ServerSetting extends Model
         'compose_version_checked_at' => 'datetime',
         'backup_compression_cpu_percentage' => 'integer',
         'server_disk_usage_notification_interval_hours' => 'integer',
+        'patch_check_result' => 'array',
+        'patch_checked_at' => 'datetime',
+        'is_auto_security_updates_enabled' => 'boolean',
+        'is_logdrain_cloudwatch_enabled' => 'boolean',
     ];
 
     /**
@@ -439,4 +461,27 @@ class ServerSetting extends Model
             }
         );
     }
+
+    /**
+     * Summary of the saved patch check, or null when the server was never checked.
+     * Results saved before security and reboot detection count as 0 and false.
+     *
+     * @return array{updates: int, security: int, reboot_required: bool, error: ?string, checked_at: Carbon}|null
+     */
+    public function patchStatus(): ?array
+    {
+        if ($this->patch_checked_at === null) {
+            return null;
+        }
+
+        $result = $this->patch_check_result ?? [];
+
+        return [
+            'updates' => (int) ($result['total_updates'] ?? 0),
+            'security' => (int) ($result['security_updates'] ?? 0),
+            'reboot_required' => ($result['reboot_required'] ?? null) === true,
+            'error' => filled($this->patch_check_error) ? $this->patch_check_error : null,
+            'checked_at' => $this->patch_checked_at,
+        ];
+    }
 }
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 161364eae3..2ebff2ad9c 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -9,6 +9,7 @@ use App\Support\ResourceStartActivity;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasComposeVolumeWarnings;
+use App\Traits\HasMaintenancePage;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -34,6 +35,7 @@ use OpenApi\Attributes as OA;
         'destination_id' => ['type' => 'integer', 'description' => 'The unique identifier of the destination where the service is running.'],
         'connect_to_docker_network' => ['type' => 'boolean', 'description' => 'The flag to connect the service to the predefined Docker network.'],
         'is_container_label_escape_enabled' => ['type' => 'boolean', 'description' => 'The flag to enable the container label escape.'],
+        'redact_all_env_values_in_logs' => ['type' => 'boolean', 'description' => 'Hide every environment variable value in logs. When false, only locked values are hidden.'],
         'is_container_label_readonly_enabled' => ['type' => 'boolean', 'description' => 'The flag to enable the container label readonly.'],
         'config_hash' => ['type' => 'string', 'description' => 'The hash of the service configuration.'],
         'service_type' => ['type' => 'string', 'description' => 'The type of the service.'],
@@ -44,7 +46,7 @@ use OpenApi\Attributes as OA;
 )]
 class Service extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasComposeVolumeWarnings, HasFactory, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasComposeVolumeWarnings, HasFactory, HasMaintenancePage, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     private static $parserVersion = '5';
 
@@ -59,6 +61,7 @@ class Service extends BaseModel
         'config_hash',
         'compose_parsing_version',
         'is_container_label_escape_enabled',
+        'redact_all_env_values_in_logs',
         'environment_id',
         'server_id',
         'destination_id',
@@ -69,6 +72,7 @@ class Service extends BaseModel
 
     protected $casts = [
         'include_coolify_default_variables' => 'boolean',
+        'redact_all_env_values_in_logs' => 'boolean',
     ];
 
     /**
@@ -82,6 +86,13 @@ class Service extends BaseModel
         'docker_compose_raw',
     ];
 
+    protected function casts(): array
+    {
+        return [
+            'is_maintenance_enabled' => 'boolean',
+        ];
+    }
+
     protected static function booted()
     {
         static::creating(function ($service) {
@@ -245,6 +256,15 @@ class Service extends BaseModel
             return 'starting:unhealthy';
         }
 
+        return $this->containerStatus();
+    }
+
+    /**
+     * The aggregate status of the stored container statuses, without the running start check.
+     * Callers that check starting services in bulk use it to avoid a query per service.
+     */
+    public function containerStatus(): ?string
+    {
         $applications = $this->applications;
         $databases = $this->databases;
 
@@ -1519,6 +1539,29 @@ class Service extends BaseModel
         return $this->hasMany(ServiceApplication::class);
     }
 
+    /**
+     * Domains of every application in the service stack.
+     *
+     * @return Collection<int, array{url: string, force_https: bool}>
+     */
+    public function maintenanceDomains(): Collection
+    {
+        return $this->applications()->get()
+            ->flatMap(fn (ServiceApplication $application) => collect($application->fqdns)
+                ->map(fn ($url) => trim((string) $url))
+                ->filter()
+                ->map(fn (string $url) => ['url' => $url, 'force_https' => $application->isForceHttpsEnabled()]))
+            ->values();
+    }
+
+    /**
+     * @return Collection<int, Server>
+     */
+    public function maintenanceServers(): Collection
+    {
+        return collect([$this->server])->filter()->values();
+    }
+
     public function databases()
     {
         return $this->hasMany(ServiceDatabase::class);
@@ -1572,6 +1615,14 @@ class Service extends BaseModel
         return $this->hasMany(ScheduledTask::class)->orderBy('name', 'asc');
     }
 
+    /**
+     * Whether logs hide every environment value, or only locked values.
+     */
+    public function redactsAllEnvValuesInLogs(): bool
+    {
+        return $this->redact_all_env_values_in_logs ?? true;
+    }
+
     public function environment_variables()
     {
         return $this->morphMany(EnvironmentVariable::class, 'resourceable');
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index 4563d9be2d..eeaa59c97c 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -15,7 +16,7 @@ use Throwable;
 
 class StandaloneClickhouse extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected array $auditExclude = ['last_online_at'];
 
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index 90f0d7d363..23d7131244 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -14,7 +15,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneDragonfly extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index da60f85a33..d2aa105bd3 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -14,7 +15,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneKeydb extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index dad5cbd630..90d39c4f8e 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -15,7 +16,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMariadb extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index 3771291cff..a018bae7c2 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -14,7 +15,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMongodb extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index acf2a00a40..68a73ae573 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -14,7 +15,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMysql extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index 0f53b5a8e0..7829ab0d0e 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -14,7 +15,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandalonePostgresql extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index cea9428d1a..d3c8004ae3 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -14,7 +15,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneRedis extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected array $auditExclude = ['last_online_at'];
 
diff --git a/app/Models/StandaloneSqlite.php b/app/Models/StandaloneSqlite.php
index 425a91a0ca..2f6993865c 100644
--- a/app/Models/StandaloneSqlite.php
+++ b/app/Models/StandaloneSqlite.php
@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
+use App\Traits\HasLogRedactionSetting;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -16,7 +17,7 @@ use InvalidArgumentException;
 
 class StandaloneSqlite extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasLogRedactionSetting, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     public const DATA_DIRECTORY = '/var/lib/sqlite';
 
diff --git a/app/Models/Tag.php b/app/Models/Tag.php
index 30844b2bb6..f6745e04d3 100644
--- a/app/Models/Tag.php
+++ b/app/Models/Tag.php
@@ -4,7 +4,6 @@ namespace App\Models;
 
 use App\Traits\Auditable;
 use App\Traits\HasSafeStringAttribute;
-use Illuminate\Support\Facades\DB;
 use OpenApi\Attributes as OA;
 
 #[OA\Schema(
@@ -36,13 +35,6 @@ class Tag extends BaseModel
         return Tag::whereTeamId(currentTeam()->id)->orderBy('name');
     }
 
-    public function deleteIfOrphaned(): void
-    {
-        if (DB::table('taggables')->where('tag_id', $this->id)->doesntExist()) {
-            $this->delete();
-        }
-    }
-
     public function applications()
     {
         return $this->morphedByMany(Application::class, 'taggable');
diff --git a/app/Models/Team.php b/app/Models/Team.php
index 864c47be2f..05c9287491 100644
--- a/app/Models/Team.php
+++ b/app/Models/Team.php
@@ -10,6 +10,7 @@ use App\Notifications\Channels\SendsEmail;
 use App\Notifications\Channels\SendsPushover;
 use App\Notifications\Channels\SendsSlack;
 use App\Notifications\Server\Unreachable;
+use App\Services\TeamAvatarStorageService;
 use App\Traits\Auditable;
 use App\Traits\HasNotificationSettings;
 use App\Traits\HasSafeStringAttribute;
@@ -87,6 +88,10 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
         static::deleting(function (Team $team) {
             $team->deleteOwnedRecords();
         });
+
+        static::deleted(function (Team $team) {
+            app(TeamAvatarStorageService::class)->deleteTeamFile($team);
+        });
     }
 
     /**
@@ -118,14 +123,16 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
 
         // Transfer instance-wide sources to root team so they remain available
         $systemWideSources = GithubApp::where('team_id', $this->id)->where('is_system_wide', true)->get()
-            ->concat(GitlabApp::where('team_id', $this->id)->where('is_system_wide', true)->get());
+            ->concat(GitlabApp::where('team_id', $this->id)->where('is_system_wide', true)->get())
+            ->concat(GiteaApp::where('team_id', $this->id)->where('is_system_wide', true)->get());
         foreach ($systemWideSources as $source) {
             $source->update(['team_id' => 0]);
         }
 
         // Delete non-instance-wide sources owned by this team
         $teamSources = GithubApp::where('team_id', $this->id)->get()
-            ->concat(GitlabApp::where('team_id', $this->id)->get());
+            ->concat(GitlabApp::where('team_id', $this->id)->get())
+            ->concat(GiteaApp::where('team_id', $this->id)->get());
         foreach ($teamSources as $source) {
             $source->delete();
         }
@@ -365,7 +372,8 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
             'projects' => $this->projects()->count(),
             'servers' => $this->servers()->count(),
             'sources' => GithubApp::query()->where('team_id', $this->id)->where('is_system_wide', false)->count()
-                + GitlabApp::query()->where('team_id', $this->id)->where('is_system_wide', false)->count(),
+                + GitlabApp::query()->where('team_id', $this->id)->where('is_system_wide', false)->count()
+                + GiteaApp::query()->where('team_id', $this->id)->where('is_system_wide', false)->count(),
         ]);
     }
 
@@ -428,7 +436,14 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
             })->where('is_public', false);
         })->get();
 
-        return $sources->merge($github_apps)->merge($gitlab_apps);
+        $gitea_apps = GiteaApp::where(function ($query) {
+            $query->where(function ($q) {
+                $q->where('team_id', $this->id)
+                    ->orWhere('is_system_wide', true);
+            })->where('is_public', false);
+        })->get();
+
+        return $sources->merge($github_apps)->merge($gitlab_apps)->merge($gitea_apps);
     }
 
     public function s3s()
diff --git a/app/Models/User.php b/app/Models/User.php
index c5e9f592c3..1257f3c857 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -21,6 +21,8 @@ use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\URL;
 use Illuminate\Support\Str;
+use Laravel\Fortify\Contracts\PasskeyUser;
+use Laravel\Fortify\PasskeyAuthenticatable;
 use Laravel\Fortify\TwoFactorAuthenticatable;
 use Laravel\Sanctum\HasApiTokens;
 use Laravel\Sanctum\NewAccessToken;
@@ -41,9 +43,9 @@ use OpenApi\Attributes as OA;
         'marketing_emails' => ['type' => 'boolean', 'description' => 'The flag to receive marketing emails.'],
     ],
 )]
-class User extends Authenticatable implements SendsEmail
+class User extends Authenticatable implements PasskeyUser, SendsEmail
 {
-    use DeletesUserSessions, HasApiTokens, HasFactory, Notifiable, TwoFactorAuthenticatable;
+    use DeletesUserSessions, HasApiTokens, HasFactory, Notifiable, PasskeyAuthenticatable, TwoFactorAuthenticatable;
 
     protected $fillable = [
         'name',
@@ -261,7 +263,7 @@ class User extends Authenticatable implements SendsEmail
         return $new_team;
     }
 
-    public function createToken(string $name, array $abilities = ['read'], ?DateTimeInterface $expiresAt = null)
+    public function createToken(string $name, array $abilities = ['read'], ?DateTimeInterface $expiresAt = null, ?int $teamId = null)
     {
         $plainTextToken = sprintf(
             '%s%s%s',
@@ -275,7 +277,7 @@ class User extends Authenticatable implements SendsEmail
             'token' => hash('sha256', $plainTextToken),
             'abilities' => $abilities,
             'expires_at' => $expiresAt,
-            'team_id' => session('currentTeam')->id,
+            'team_id' => $teamId ?? session('currentTeam')->id,
         ]);
 
         return new NewAccessToken($token, $token->getKey().'|'.$plainTextToken);
@@ -599,6 +601,18 @@ class User extends Authenticatable implements SendsEmail
         return $this->oauthIdentities()->exists();
     }
 
+    /**
+     * Hex handle: iOS Safari corrupts raw binary handles (laravel/passkeys-server#41).
+     */
+    public function getPasskeyUserHandle(): string
+    {
+        return hash_hmac(
+            'sha256',
+            $this->getTable().'|'.$this->getKey(),
+            Config::string('passkeys.user_handle_secret'),
+        );
+    }
+
     /**
      * Check if the user has a password set.
      */
diff --git a/app/Models/VolumeBackupS3Replica.php b/app/Models/VolumeBackupS3Replica.php
new file mode 100644
index 0000000000..779ee7571c
--- /dev/null
+++ b/app/Models/VolumeBackupS3Replica.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * The copy of one volume or directory backup execution in one S3 destination.
+ */
+class VolumeBackupS3Replica extends Model
+{
+    protected $fillable = [
+        'execution_id',
+        's3_storage_id',
+        's3_uploaded',
+        's3_storage_deleted',
+        'message',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            's3_uploaded' => 'boolean',
+            's3_storage_deleted' => 'boolean',
+        ];
+    }
+
+    public function execution(): BelongsTo
+    {
+        return $this->belongsTo(ScheduledVolumeBackupExecution::class, 'execution_id');
+    }
+
+    public function s3(): BelongsTo
+    {
+        return $this->belongsTo(S3Storage::class, 's3_storage_id');
+    }
+}
diff --git a/app/Notifications/Application/DeploymentFailed.php b/app/Notifications/Application/DeploymentFailed.php
index 8fff7f03bb..376f120c88 100644
--- a/app/Notifications/Application/DeploymentFailed.php
+++ b/app/Notifications/Application/DeploymentFailed.php
@@ -3,15 +3,19 @@
 namespace App\Notifications\Application;
 
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\ApplicationPreview;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
 use App\Notifications\Dto\SlackMessage;
+use App\Traits\IncludesDeploymentCommitDetails;
 use Illuminate\Notifications\Messages\MailMessage;
 
 class DeploymentFailed extends CustomEmailNotification
 {
+    use IncludesDeploymentCommitDetails;
+
     public Application $application;
 
     public ?ApplicationPreview $preview = null;
@@ -30,7 +34,7 @@ class DeploymentFailed extends CustomEmailNotification
 
     public ?string $fqdn = null;
 
-    public function __construct(Application $application, string $deployment_uuid, ?ApplicationPreview $preview = null)
+    public function __construct(Application $application, string $deployment_uuid, ?ApplicationPreview $preview = null, ?ApplicationDeploymentQueue $deployment = null)
     {
         $this->onQueue('high');
         $this->application = $application;
@@ -45,6 +49,7 @@ class DeploymentFailed extends CustomEmailNotification
             $this->fqdn = str($this->fqdn)->explode(',')->first();
         }
         $this->deployment_url = base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/application/{$this->application->uuid}/deployment/{$this->deployment_uuid}";
+        $this->resolveDeploymentCommitDetails($application, $deployment, $preview);
     }
 
     public function via(object $notifiable): array
@@ -52,7 +57,7 @@ class DeploymentFailed extends CustomEmailNotification
         return $notifiable->getEnabledChannels('deployment_failure');
     }
 
-    public function toMail(): MailMessage
+    public function toMail(?object $notifiable = null): MailMessage
     {
         $mail = new MailMessage;
         $pull_request_id = data_get($this->preview, 'pull_request_id', 0);
@@ -64,6 +69,7 @@ class DeploymentFailed extends CustomEmailNotification
             $mail->subject('Coolify: Deployment failed of pull request #'.$this->preview->pull_request_id.' of '.$this->application_name.'.');
         }
         $mail->view('emails.application-deployment-failed', [
+            'commit' => $this->deploymentCommitDetailsForMail($notifiable),
             'name' => $this->application_name,
             'fqdn' => $fqdn,
             'deployment_url' => $this->deployment_url,
diff --git a/app/Notifications/Application/DeploymentSuccess.php b/app/Notifications/Application/DeploymentSuccess.php
index 415df5831d..07c3000fb5 100644
--- a/app/Notifications/Application/DeploymentSuccess.php
+++ b/app/Notifications/Application/DeploymentSuccess.php
@@ -3,15 +3,19 @@
 namespace App\Notifications\Application;
 
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\ApplicationPreview;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
 use App\Notifications\Dto\SlackMessage;
+use App\Traits\IncludesDeploymentCommitDetails;
 use Illuminate\Notifications\Messages\MailMessage;
 
 class DeploymentSuccess extends CustomEmailNotification
 {
+    use IncludesDeploymentCommitDetails;
+
     public Application $application;
 
     public ?ApplicationPreview $preview = null;
@@ -30,7 +34,7 @@ class DeploymentSuccess extends CustomEmailNotification
 
     public ?string $fqdn;
 
-    public function __construct(Application $application, string $deployment_uuid, ?ApplicationPreview $preview = null)
+    public function __construct(Application $application, string $deployment_uuid, ?ApplicationPreview $preview = null, ?ApplicationDeploymentQueue $deployment = null)
     {
         $this->onQueue('high');
         $this->application = $application;
@@ -45,6 +49,7 @@ class DeploymentSuccess extends CustomEmailNotification
             $this->fqdn = str($this->fqdn)->explode(',')->first();
         }
         $this->deployment_url = base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/application/{$this->application->uuid}/deployment/{$this->deployment_uuid}";
+        $this->resolveDeploymentCommitDetails($application, $deployment, $preview);
     }
 
     public function via(object $notifiable): array
@@ -52,7 +57,7 @@ class DeploymentSuccess extends CustomEmailNotification
         return $notifiable->getEnabledChannels('deployment_success');
     }
 
-    public function toMail(): MailMessage
+    public function toMail(?object $notifiable = null): MailMessage
     {
         $mail = new MailMessage;
         $pull_request_id = data_get($this->preview, 'pull_request_id', 0);
@@ -64,6 +69,7 @@ class DeploymentSuccess extends CustomEmailNotification
             $mail->subject("Coolify: Pull request #{$pull_request_id} of {$this->application_name} deployed successfully");
         }
         $mail->view('emails.application-deployment-success', [
+            'commit' => $this->deploymentCommitDetailsForMail($notifiable),
             'name' => $this->application_name,
             'fqdn' => $fqdn,
             'deployment_url' => $this->deployment_url,
diff --git a/app/Notifications/Channels/EmailChannel.php b/app/Notifications/Channels/EmailChannel.php
index 85a02ddbaa..b4c70f2f79 100644
--- a/app/Notifications/Channels/EmailChannel.php
+++ b/app/Notifications/Channels/EmailChannel.php
@@ -5,6 +5,7 @@ namespace App\Notifications\Channels;
 use App\Exceptions\NonReportableException;
 use App\Models\EmailNotificationSettings;
 use App\Models\Team;
+use App\Services\Security\SensitiveDataRedactor;
 use App\Support\SmtpTransportFactory;
 use Exception;
 use Illuminate\Notifications\Notification;
@@ -151,9 +152,9 @@ class EmailChannel
             send_internal_notification(sprintf(
                 "Resend Error\nStatus Code: %s\nMessage: %s\nNotification: %s\nEmail Settings:\n%s",
                 $statusCode,
-                $e->getErrorMessage(),
+                remove_iip($e->getErrorMessage()),
                 get_class($notification),
-                json_encode($emailSettings, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES)
+                json_encode(app(SensitiveDataRedactor::class)->redactValue($emailSettings), JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES)
             ));
 
             // Don't report expected errors (invalid keys, validation) to error tracking
@@ -172,7 +173,7 @@ class EmailChannel
 
             throw $e;
         } catch (TransporterException $e) {
-            send_internal_notification("Resend Transport Error: {$e->getMessage()}");
+            send_internal_notification('Resend Transport Error: '.remove_iip($e->getMessage()));
             throw new Exception('Unable to connect to Resend API. Please check your internet connection and try again.');
         } catch (\Throwable $e) {
             // Check if this is a Resend domain verification error on cloud instances
diff --git a/app/Notifications/Server/ServerPatchCheck.php b/app/Notifications/Server/ServerPatchCheck.php
index ba6cd49829..84b3028502 100644
--- a/app/Notifications/Server/ServerPatchCheck.php
+++ b/app/Notifications/Server/ServerPatchCheck.php
@@ -8,6 +8,7 @@ use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
 use App\Notifications\Dto\SlackMessage;
 use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Collection;
 
 class ServerPatchCheck extends CustomEmailNotification
 {
@@ -48,6 +49,8 @@ class ServerPatchCheck extends CustomEmailNotification
             'name' => $this->server->name,
             'total_updates' => $totalUpdates,
             'updates' => $this->patchData['updates'] ?? [],
+            'security_updates' => $this->patchData['security_updates'] ?? null,
+            'reboot_required' => $this->patchData['reboot_required'] ?? null,
             'osId' => $this->patchData['osId'] ?? 'unknown',
             'package_manager' => $this->patchData['package_manager'] ?? 'unknown',
             'server_url' => $this->serverUrl,
@@ -101,12 +104,7 @@ class ServerPatchCheck extends CustomEmailNotification
             }
 
             // Check for critical packages
-            $criticalPackages = collect($updates)->filter(function ($update) {
-                return str_contains(strtolower($update['package']), 'docker') ||
-                    str_contains(strtolower($update['package']), 'kernel') ||
-                    str_contains(strtolower($update['package']), 'openssh') ||
-                    str_contains(strtolower($update['package']), 'ssl');
-            });
+            $criticalPackages = $this->criticalPackages();
 
             if ($criticalPackages->count() > 0) {
                 $description .= "\n **Critical packages detected** ({$criticalPackages->count()} packages may require restarts)";
@@ -169,12 +167,7 @@ class ServerPatchCheck extends CustomEmailNotification
             }
 
             // Check for critical packages
-            $criticalPackages = collect($updates)->filter(function ($update) {
-                return str_contains(strtolower($update['package']), 'docker') ||
-                    str_contains(strtolower($update['package']), 'kernel') ||
-                    str_contains(strtolower($update['package']), 'openssh') ||
-                    str_contains(strtolower($update['package']), 'ssl');
-            });
+            $criticalPackages = $this->criticalPackages();
 
             if ($criticalPackages->count() > 0) {
                 $message .= "\n⚠️ Critical packages detected: {$criticalPackages->count()} packages may require restarts\n";
@@ -247,12 +240,7 @@ class ServerPatchCheck extends CustomEmailNotification
             }
 
             // Check for critical packages
-            $criticalPackages = collect($updates)->filter(function ($update) {
-                return str_contains(strtolower($update['package']), 'docker') ||
-                    str_contains(strtolower($update['package']), 'kernel') ||
-                    str_contains(strtolower($update['package']), 'openssh') ||
-                    str_contains(strtolower($update['package']), 'ssl');
-            });
+            $criticalPackages = $this->criticalPackages();
 
             if ($criticalPackages->count() > 0) {
                 $message .= "\nCritical packages detected: {$criticalPackages->count()} may require restarts";
@@ -316,12 +304,7 @@ class ServerPatchCheck extends CustomEmailNotification
             }
 
             // Check for critical packages
-            $criticalPackages = collect($updates)->filter(function ($update) {
-                return str_contains(strtolower($update['package']), 'docker') ||
-                    str_contains(strtolower($update['package']), 'kernel') ||
-                    str_contains(strtolower($update['package']), 'openssh') ||
-                    str_contains(strtolower($update['package']), 'ssl');
-            });
+            $criticalPackages = $this->criticalPackages();
 
             if ($criticalPackages->count() > 0) {
                 $description .= "\n:warning: *Critical packages detected:* {$criticalPackages->count()} packages may require restarts\n";
@@ -364,12 +347,7 @@ class ServerPatchCheck extends CustomEmailNotification
         $updates = $this->patchData['updates'] ?? [];
 
         // Check for critical packages
-        $criticalPackages = collect($updates)->filter(function ($update) {
-            return str_contains(strtolower($update['package']), 'docker') ||
-                str_contains(strtolower($update['package']), 'kernel') ||
-                str_contains(strtolower($update['package']), 'openssh') ||
-                str_contains(strtolower($update['package']), 'ssl');
-        });
+        $criticalPackages = $this->criticalPackages();
 
         return [
             'success' => false,
@@ -382,7 +360,17 @@ class ServerPatchCheck extends CustomEmailNotification
             'package_manager' => $this->patchData['package_manager'] ?? 'unknown',
             'updates' => $updates,
             'critical_packages_count' => $criticalPackages->count(),
+            'security_updates' => $this->patchData['security_updates'] ?? null,
+            'reboot_required' => $this->patchData['reboot_required'] ?? null,
             'url' => $this->serverUrl,
         ];
     }
+
+    /**
+     * Updates that can restart Docker or core services, or need a reboot (see CheckUpdates::RISKY_PACKAGES).
+     */
+    private function criticalPackages(): Collection
+    {
+        return collect($this->patchData['updates'] ?? [])->filter(fn (array $update) => filled($update['risk'] ?? null))->values();
+    }
 }
diff --git a/app/Policies/GiteaAppPolicy.php b/app/Policies/GiteaAppPolicy.php
new file mode 100644
index 0000000000..a269ead557
--- /dev/null
+++ b/app/Policies/GiteaAppPolicy.php
@@ -0,0 +1,87 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\GiteaApp;
+use App\Models\User;
+
+class GiteaAppPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, GiteaApp $giteaApp): bool
+    {
+        if ($giteaApp->is_system_wide) {
+            return true;
+        }
+
+        return $user->teams->contains('id', $giteaApp->team_id);
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, GiteaApp $giteaApp): bool
+    {
+        if ($giteaApp->is_system_wide) {
+            return $user->canAccessSystemResources();
+        }
+
+        // Guard null team_id (e.g. post-delete Livewire re-render of @can checks).
+        if ($giteaApp->team_id === null) {
+            return false;
+        }
+
+        return $user->isAdminOfTeam($giteaApp->team_id);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, GiteaApp $giteaApp): bool
+    {
+        if ($giteaApp->is_system_wide) {
+            return $user->canAccessSystemResources();
+        }
+
+        // Guard null team_id (e.g. post-delete Livewire re-render of @can checks).
+        if ($giteaApp->team_id === null) {
+            return false;
+        }
+
+        return $user->isAdminOfTeam($giteaApp->team_id);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, GiteaApp $giteaApp): bool
+    {
+        return false;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, GiteaApp $giteaApp): bool
+    {
+        return false;
+    }
+}
diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index 1c36b36298..fb6d3ed150 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -145,5 +145,13 @@ class AppServiceProvider extends ServiceProvider
 
             return $access_token ? $client->withToken($access_token) : $client;
         });
+
+        Http::macro('Gitea', function (string $api_url, ?string $access_token = null) {
+            $client = Http::GitSource($api_url)->withHeaders([
+                'Accept' => 'application/json',
+            ])->baseUrl($api_url);
+
+            return $access_token ? $client->withToken($access_token) : $client;
+        });
     }
 }
diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index bab3d87c3b..c0a774daf2 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -12,6 +12,7 @@ use App\Models\DiscordNotificationSettings;
 use App\Models\EmailNotificationSettings;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\InstanceSettings;
@@ -51,6 +52,7 @@ use App\Policies\CloudProviderTokenPolicy;
 use App\Policies\DatabasePolicy;
 use App\Policies\EnvironmentPolicy;
 use App\Policies\EnvironmentVariablePolicy;
+use App\Policies\GiteaAppPolicy;
 use App\Policies\GithubAppPolicy;
 use App\Policies\GitlabAppPolicy;
 use App\Policies\InstanceSettingsPolicy;
@@ -133,6 +135,7 @@ class AuthServiceProvider extends ServiceProvider
         // Git source policies
         GithubApp::class => GithubAppPolicy::class,
         GitlabApp::class => GitlabAppPolicy::class,
+        GiteaApp::class => GiteaAppPolicy::class,
 
         // Cloud provider policies
         CloudProviderToken::class => CloudProviderTokenPolicy::class,
diff --git a/app/Providers/EventServiceProvider.php b/app/Providers/EventServiceProvider.php
index e9da72d442..a894b7f3d9 100644
--- a/app/Providers/EventServiceProvider.php
+++ b/app/Providers/EventServiceProvider.php
@@ -14,6 +14,9 @@ use Laravel\Fortify\Events\RecoveryCodesGenerated;
 use Laravel\Fortify\Events\TwoFactorAuthenticationConfirmed;
 use Laravel\Fortify\Events\TwoFactorAuthenticationDisabled;
 use Laravel\Fortify\Events\TwoFactorAuthenticationEnabled;
+use Laravel\Passkeys\Events\PasskeyDeleted;
+use Laravel\Passkeys\Events\PasskeyRegistered;
+use Laravel\Passkeys\Events\PasskeyVerified;
 use SocialiteProviders\Authentik\AuthentikExtendSocialite;
 use SocialiteProviders\Azure\AzureExtendSocialite;
 use SocialiteProviders\Clerk\ClerkExtendSocialite;
@@ -72,6 +75,15 @@ class EventServiceProvider extends ServiceProvider
         Event::listen(RecoveryCodesGenerated::class, function (RecoveryCodesGenerated $event): void {
             auditLog('auth.user.recovery_codes_regenerated', $this->authContext($event->user));
         });
+        Event::listen(PasskeyRegistered::class, function (PasskeyRegistered $event): void {
+            auditLog('auth.user.passkey_registered', $this->authContext($event->user));
+        });
+        Event::listen(PasskeyVerified::class, function (PasskeyVerified $event): void {
+            auditLog('auth.user.passkey_verified', $this->authContext($event->user));
+        });
+        Event::listen(PasskeyDeleted::class, function (PasskeyDeleted $event): void {
+            auditLog('auth.user.passkey_deleted', $this->authContext($event->user));
+        });
     }
 
     /**
diff --git a/app/Providers/FortifyServiceProvider.php b/app/Providers/FortifyServiceProvider.php
index 9bdc5d7371..d6519aac0e 100644
--- a/app/Providers/FortifyServiceProvider.php
+++ b/app/Providers/FortifyServiceProvider.php
@@ -7,6 +7,7 @@ use App\Actions\Fortify\ResetUserPassword;
 use App\Actions\Fortify\UpdateUserPassword;
 use App\Models\OauthSetting;
 use App\Models\User;
+use App\Support\PasskeyRelyingParty;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\ServiceProvider;
@@ -68,6 +69,7 @@ class FortifyServiceProvider extends ServiceProvider
                     fn (OauthSetting $oauthSetting) => $oauthSetting->couldBeEnabled() && $oauthSetting->allowsUserCreation()
                 ),
                 'enabled_oauth_providers' => $enabled_oauth_providers,
+                'passkeys_available' => PasskeyRelyingParty::isAvailable(),
             ]);
         });
 
@@ -108,7 +110,10 @@ class FortifyServiceProvider extends ServiceProvider
         Fortify::updateUserPasswordsUsing(UpdateUserPassword::class);
 
         Fortify::confirmPasswordView(function () {
-            return view('auth.confirm-password');
+            return view('auth.confirm-password', [
+                'can_confirm_with_passkey' => PasskeyRelyingParty::isAvailable()
+                    && auth()->user()->hasPasskeysEnabled(),
+            ]);
         });
 
         Fortify::twoFactorChallengeView(function () {
diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 24cec00b4c..dedac3a095 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -74,6 +74,10 @@ class RouteServiceProvider extends ServiceProvider
             return Limit::perMinute(5)->by($request->session()->get('login.id'));
         });
 
+        RateLimiter::for('passkeys', function (Request $request) {
+            return Limit::perMinute(30)->by('passkeys:'.auth_rate_limit_ip($request));
+        });
+
         RateLimiter::for('forgot-password', function (Request $request) {
             $limits = [
                 Limit::perMinutes(10, 3)->by('forgot-password:ip:'.sha1(auth_rate_limit_ip($request))),
diff --git a/app/Services/CloudflareTokenValidator.php b/app/Services/CloudflareTokenValidator.php
index 2a4a761027..a48efda741 100644
--- a/app/Services/CloudflareTokenValidator.php
+++ b/app/Services/CloudflareTokenValidator.php
@@ -16,17 +16,28 @@ class CloudflareTokenValidator
             return false;
         }
 
-        if (in_array('dns', $capabilities, true)) {
-            $zones = $client->get('https://api.cloudflare.com/client/v4/zones', ['per_page' => 1]);
-            $zoneId = $zones->json('result.0.id');
+        if (! in_array('dns', $capabilities, true)) {
+            return true;
+        }
 
-            if (! $zones->successful() || ! is_string($zoneId)) {
-                return false;
-            }
+        $zones = $client->get('https://api.cloudflare.com/client/v4/zones', ['per_page' => 1]);
+        $zoneId = $zones->json('result.0.id');
 
-            return $client->get("https://api.cloudflare.com/client/v4/zones/{$zoneId}/dns_records", [
-                'per_page' => 1,
-            ])->successful();
+        if (! $zones->successful() || ! is_string($zoneId)) {
+            return false;
+        }
+
+        if (! $client->get("https://api.cloudflare.com/client/v4/zones/{$zoneId}/dns_records", ['per_page' => 1])->successful()) {
+            return false;
+        }
+
+        if (in_array('tunnel', $capabilities, true)) {
+            $accountId = $zones->json('result.0.account.id');
+
+            return is_string($accountId) && $client->get(
+                "https://api.cloudflare.com/client/v4/accounts/{$accountId}/cfd_tunnel",
+                ['per_page' => 1, 'is_deleted' => 'false'],
+            )->successful();
         }
 
         return true;
diff --git a/app/Services/CloudflareTunnelService.php b/app/Services/CloudflareTunnelService.php
new file mode 100644
index 0000000000..358b4075d4
--- /dev/null
+++ b/app/Services/CloudflareTunnelService.php
@@ -0,0 +1,283 @@
+<?php
+
+namespace App\Services;
+
+use App\Actions\Server\ConfigureCloudflared;
+use App\Enums\ManagedDnsDeletionResult;
+use App\Exceptions\DnsRecordConflictException;
+use App\Models\DnsProviderZone;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\Server;
+use App\Services\Dns\CloudflareDnsProvider;
+use App\Services\Dns\ManagedDnsRecordCleanup;
+use Illuminate\Contracts\Cache\LockTimeoutException;
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Sleep;
+use RuntimeException;
+use Spatie\Activitylog\Models\Activity;
+use Throwable;
+
+/**
+ * Sets up and removes a remotely managed Cloudflare Tunnel for server SSH with a stored Cloudflare API token.
+ * The tunnel token is never stored: Cloudflare returns it on every setup run.
+ */
+class CloudflareTunnelService
+{
+    private const API_URL = 'https://api.cloudflare.com/client/v4';
+
+    private const TUNNEL_PERMISSION = 'Account → Cloudflare Tunnel → Edit';
+
+    /** Cloudflare does not delete a tunnel while the stopping connector is still connected; wait at most this often. */
+    private const DELETE_ATTEMPTS = 5;
+
+    public function __construct(
+        private CloudflareDnsProvider $dns,
+        private ManagedDnsRecordCleanup $cleanup,
+    ) {}
+
+    public static function tunnelName(Server $server): string
+    {
+        return "coolify-{$server->uuid}";
+    }
+
+    /**
+     * Creates (or reuses) the tunnel, routes the hostname to the server SSH port, points a proxied CNAME at the tunnel,
+     * and starts cloudflared. The CloudflareTunnelChanged listener enables the tunnel when cloudflared is healthy.
+     *
+     * @param  array{record_id: string, current: string}|null  $confirmedConflict  An existing DNS record the user agreed to replace.
+     *
+     * @throws DnsRecordConflictException when another DNS record already uses the hostname
+     * @throws LockTimeoutException when another DNS change for the hostname does not finish in time
+     * @throws RuntimeException when a Cloudflare call fails
+     */
+    public function setUp(Server $server, IntegrationToken $token, string $hostname, ?array $confirmedConflict = null): Activity
+    {
+        $zone = $this->zoneFor($server, $token, $hostname);
+        $accountId = $zone->account_id;
+        if (blank($accountId)) {
+            throw new RuntimeException("Cloudflare returned no account for the zone {$zone->name}.");
+        }
+
+        [$tunnelId, $tunnelToken, $created] = $this->findOrCreateTunnel($token, $accountId, self::tunnelName($server));
+
+        try {
+            $this->request($token, 'put', "/accounts/{$accountId}/cfd_tunnel/{$tunnelId}/configurations", [
+                'config' => ['ingress' => [
+                    ['hostname' => $hostname, 'service' => "ssh://localhost:{$server->port}"],
+                    ['service' => 'http_status:404'],
+                ]],
+            ]);
+
+            $target = "{$tunnelId}.cfargotunnel.com";
+            if ($confirmedConflict !== null) {
+                $this->dns->replaceRecord($zone, $confirmedConflict['record_id'], $hostname, $target, $server, $confirmedConflict['current'], proxied: true);
+            } else {
+                $this->dns->createRecord($zone, $hostname, $target, $server, proxied: true);
+            }
+        } catch (Throwable $e) {
+            // Coolify does not track the tunnel yet, so a tunnel created by this run would stay in Cloudflare.
+            if ($created) {
+                $this->deleteUntrackedTunnel($token, $accountId, $tunnelId);
+            }
+
+            throw $e;
+        }
+        $this->releaseDnsRecords($server, except: $hostname);
+
+        // Saved before cloudflared starts, so disabling the tunnel can clean up even when cloudflared does not become healthy.
+        $server->settings->update([
+            'cloudflare_tunnel_id' => $tunnelId,
+            'cloudflare_tunnel_account_id' => $accountId,
+            'cloudflare_tunnel_integration_token_id' => $token->id,
+        ]);
+
+        return ConfigureCloudflared::run($server, $tunnelToken, $hostname);
+    }
+
+    /**
+     * Stops cloudflared and deletes the tunnel and the DNS record that setUp() created.
+     * Never throws; returns warnings for the user and always forgets the tunnel.
+     *
+     * @return array<int, string>
+     */
+    public function tearDown(Server $server): array
+    {
+        $settings = $server->settings;
+        if (blank($settings->cloudflare_tunnel_id)) {
+            return [];
+        }
+
+        $warnings = [];
+        $name = self::tunnelName($server);
+        $token = IntegrationToken::query()
+            ->where('team_id', $server->team_id)
+            ->whereKey($settings->cloudflare_tunnel_integration_token_id)
+            ->first();
+
+        // Coolify usually reaches the server through this tunnel. Stopping cloudflared in the SSH session would cut
+        // that session and make SSH retry, so the stop runs detached and the session ends first.
+        instant_remote_process([
+            "nohup setsid sh -c 'sleep 2; docker rm -f coolify-cloudflared' > /dev/null 2>&1 < /dev/null &",
+        ], $server, false);
+
+        // The DNS record does not depend on the connector, so it goes first while cloudflared stops.
+        array_push($warnings, ...$this->releaseDnsRecords($server));
+
+        if ($token === null) {
+            $warnings[] = "The Cloudflare token of the tunnel no longer exists. Delete the tunnel {$name} in Cloudflare.";
+        } elseif (($warning = $this->deleteStoppedTunnel($token, $settings->cloudflare_tunnel_account_id, $settings->cloudflare_tunnel_id, $name)) !== null) {
+            $warnings[] = $warning;
+        }
+
+        $settings->update([
+            'cloudflare_tunnel_id' => null,
+            'cloudflare_tunnel_account_id' => null,
+            'cloudflare_tunnel_integration_token_id' => null,
+        ]);
+
+        return $warnings;
+    }
+
+    /**
+     * Deletes the tunnel once its connector is gone. Removing the connections first lets Cloudflare forget a connector
+     * that already stopped; a connector that is still stopping keeps the delete failing until it disconnects.
+     */
+    private function deleteStoppedTunnel(IntegrationToken $token, string $accountId, string $tunnelId, string $name): ?string
+    {
+        $path = self::API_URL."/accounts/{$accountId}/cfd_tunnel/{$tunnelId}";
+
+        try {
+            for ($attempt = 1; $attempt <= self::DELETE_ATTEMPTS; $attempt++) {
+                $this->client($token)->delete("{$path}/connections");
+                $response = $this->client($token)->delete($path);
+                if ($response->successful() || $response->status() === 404) {
+                    return null;
+                }
+                if ($response->status() === 403) {
+                    return CloudflareDnsProvider::missingPermissionMessage(self::TUNNEL_PERMISSION)." Delete the tunnel {$name} in Cloudflare.";
+                }
+                if ($attempt < self::DELETE_ATTEMPTS) {
+                    Sleep::for(2)->seconds();
+                }
+            }
+        } catch (Throwable) {
+            return "Cloudflare did not respond. Delete the tunnel {$name} in Cloudflare.";
+        }
+
+        return "Cloudflare could not delete the tunnel {$name}. Delete it in Cloudflare.";
+    }
+
+    private function zoneFor(Server $server, IntegrationToken $token, string $hostname): DnsProviderZone
+    {
+        $find = fn (): ?DnsProviderZone => $this->dns->findZones($server->team_id, $hostname)
+            ->firstWhere('integration_token_id', $token->id);
+
+        $zone = $find();
+        if ($zone === null) {
+            $this->dns->syncZones($token);
+            $zone = $find();
+        }
+
+        return $zone ?? throw new RuntimeException("No Cloudflare zone of the token {$token->name} manages {$hostname}.");
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: bool} tunnel ID, tunnel token, and whether this call created the tunnel
+     */
+    private function findOrCreateTunnel(IntegrationToken $token, string $accountId, string $name): array
+    {
+        $existing = collect($this->request($token, 'get', "/accounts/{$accountId}/cfd_tunnel", [
+            'name' => $name,
+            'is_deleted' => 'false',
+        ])->json('result', []))->first(fn ($tunnel): bool => is_array($tunnel) && ($tunnel['name'] ?? null) === $name);
+
+        if (is_string($existing['id'] ?? null)) {
+            $tunnelId = $existing['id'];
+            $tunnelToken = $this->request($token, 'get', "/accounts/{$accountId}/cfd_tunnel/{$tunnelId}/token")->json('result');
+            $created = false;
+        } else {
+            $response = $this->request($token, 'post', "/accounts/{$accountId}/cfd_tunnel", [
+                'name' => $name,
+                'config_src' => 'cloudflare',
+            ]);
+            $tunnelId = $response->json('result.id');
+            $tunnelToken = $response->json('result.token');
+            $created = true;
+        }
+
+        if (! is_string($tunnelId) || ! is_string($tunnelToken) || $tunnelToken === '') {
+            throw new RuntimeException('Cloudflare returned no tunnel token.');
+        }
+
+        return [$tunnelId, $tunnelToken, $created];
+    }
+
+    /**
+     * Best effort: the tunnel has no connector yet, so Cloudflare deletes it directly.
+     */
+    private function deleteUntrackedTunnel(IntegrationToken $token, string $accountId, string $tunnelId): void
+    {
+        try {
+            $this->client($token)->delete(self::API_URL."/accounts/{$accountId}/cfd_tunnel/{$tunnelId}");
+        } catch (Throwable) {
+            // The original error matters more; a re-run reuses the tunnel by name anyway.
+        }
+    }
+
+    /**
+     * Releases the server's managed DNS records (except the given hostname). Records are deleted only when
+     * Coolify created them and nothing else uses the hostname.
+     *
+     * @return array<int, string>
+     */
+    private function releaseDnsRecords(Server $server, ?string $except = null): array
+    {
+        $key = [$server->getMorphClass(), $server->getKey()];
+        $records = ManagedDnsRecord::query()
+            ->where('team_id', $server->team_id)
+            ->when($except !== null, fn ($query) => $query->where('name', '!=', $except))
+            ->whereHas('references', fn ($query) => $query->where('resource_type', $key[0])->where('resource_id', $key[1]))
+            ->get();
+
+        return $records->map(function (ManagedDnsRecord $record) use ($key): ?string {
+            try {
+                $result = $this->cleanup->release($record, [$key], true);
+            } catch (Throwable) {
+                $result = ManagedDnsDeletionResult::Failed;
+            }
+
+            return match ($result) {
+                ManagedDnsDeletionResult::ChangedExternally => "The DNS record {$record->name} changed outside Coolify and was left untouched.",
+                ManagedDnsDeletionResult::Failed, ManagedDnsDeletionResult::Busy => "The DNS record {$record->name} could not be deleted. Delete it in Cloudflare.",
+                default => null,
+            };
+        })->filter()->values()->all();
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    private function request(IntegrationToken $token, string $method, string $path, array $data = []): Response
+    {
+        $response = $this->client($token)->{$method}(self::API_URL.$path, $data);
+
+        if ($response->status() === 403) {
+            throw new RuntimeException(CloudflareDnsProvider::missingPermissionMessage(self::TUNNEL_PERMISSION));
+        }
+        if (! $response->successful() || $response->json('success') === false) {
+            $message = $response->json('errors.0.message');
+
+            throw new RuntimeException('Cloudflare Tunnel request failed'.(is_string($message) ? ": {$message}" : '.'));
+        }
+
+        return $response;
+    }
+
+    private function client(IntegrationToken $token): PendingRequest
+    {
+        return Http::withToken($token->token)->acceptJson()->connectTimeout(5)->timeout(15);
+    }
+}
diff --git a/app/Services/ContainerFilesystemService.php b/app/Services/ContainerFilesystemService.php
new file mode 100644
index 0000000000..e7178ed765
--- /dev/null
+++ b/app/Services/ContainerFilesystemService.php
@@ -0,0 +1,426 @@
+<?php
+
+namespace App\Services;
+
+use App\Data\FileEntry;
+use App\Helpers\SshMultiplexingHelper;
+use App\Models\LocalFileVolume;
+use App\Models\Server;
+use Illuminate\Support\Str;
+
+class ContainerFilesystemService
+{
+    /**
+     * Inline `echo <base64> | base64 -d` writes travel as a single execve
+     * argument, capped at ~128 KiB by MAX_ARG_STRLEN. base64 inflates by 4/3,
+     * so keep inline content below that limit with room for command quoting.
+     */
+    private const MAX_INLINE_WRITE_SIZE = 64 * 1024;
+
+    /** Largest file, or uncompressed folder, the file browser may download. */
+    public const MAX_DOWNLOAD_SIZE = 1024 * 1024 * 1024;
+
+    public function __construct(
+        private Server $server,
+        private string $container,
+    ) {}
+
+    public function buildListCommand(string $path): string
+    {
+        $escapedPath = $this->escapePath($path, 'list path');
+
+        // Emit the whole directory through batched stat calls (one for most folders)
+        // instead of a per-entry loop. %F is the human file type ("directory",
+        // "symbolic link", "regular file"), mapped to a token by parseListing.
+        // Fields: type<TAB>size<TAB>mtime<TAB>perms<TAB>owner<TAB>group<TAB>name.
+        // A real tab is embedded in the format because stat's -c does NOT expand
+        // a backslash \t escape (unlike printf) - it would emit the literal text.
+        // POSIX `find ... -prune -exec {} +` lists hidden files without recursing
+        // and batches names, so a huge directory cannot overflow the argument
+        // limit like a `* .*` glob would. Names arrive as ./name; parseListing
+        // strips that prefix. Names containing a tab/newline are skipped (v1 scope).
+        $tab = "\t";
+        $format = '%F'.$tab.'%s'.$tab.'%Y'.$tab.'%a'.$tab.'%U'.$tab.'%G'.$tab.'%n';
+        $inner = 'cd '.$escapedPath.' 2>/dev/null || exit 0; '
+            .'find . ! -name . -prune -exec stat -c "'.$format.'" -- {} + 2>/dev/null';
+
+        return $this->dockerExecShell($inner);
+    }
+
+    /**
+     * @return array<int, FileEntry>
+     */
+    public function list(string $path): array
+    {
+        $raw = instant_remote_process([$this->buildListCommand($path)], $this->server, throwError: false);
+
+        return $this->parseListing($raw);
+    }
+
+    /**
+     * Read an editable text file in a single SSH round trip.
+     *
+     * The remote command folds the size cap, binary probe and base64 read into
+     * one docker exec: it prints TOOBIG or BINARY for a rejected file, otherwise
+     * an "OK\n" header followed by the base64 payload (empty for a 0-byte file,
+     * which is valid editable text). base64 keeps exact bytes safe from the
+     * trailing-whitespace trim in instant_remote_process.
+     *
+     * @throws \RuntimeException when the file is binary or larger than the cap
+     */
+    public function read(string $path): string
+    {
+        $escaped = $this->escapePath($path, 'read path');
+        $max = LocalFileVolume::MAX_CONTENT_SIZE;
+
+        $cmd = '[ -f '.$escaped.' ] && [ -r '.$escaped.' ] || exit 1; '
+            .'sz=$(stat -Lc %s -- '.$escaped.') || exit 1; '
+            .'if [ "$sz" -gt '.$max.' ]; then echo TOOBIG; exit 0; fi; '
+            .'if [ -s '.$escaped.' ] && ! grep -qI \'\' -- '.$escaped.'; then echo BINARY; exit 0; fi; '
+            .'echo OK; base64 -- '.$escaped.' || exit 1';
+
+        $raw = (string) instant_remote_process(
+            [$this->dockerExecShell($cmd)],
+            $this->server,
+        );
+
+        $newline = strpos($raw, "\n");
+        $status = $newline === false ? trim($raw) : substr($raw, 0, $newline);
+        if ($status === 'TOOBIG' || $status === 'BINARY') {
+            throw new \RuntimeException('File is not editable (binary or too large).');
+        }
+
+        $payload = $newline === false ? '' : substr($raw, $newline + 1);
+
+        $content = base64_decode(trim($payload), true);
+        if ($status !== 'OK' || $content === false || strlen($content) > $max) {
+            throw new \RuntimeException('Could not read file.');
+        }
+
+        return $content;
+    }
+
+    public function buildWriteCommand(string $path, string $content): string
+    {
+        $escaped = $this->escapePath($path, 'write path');
+        $b64 = base64_encode($content);
+
+        return $this->dockerExecShell("echo {$b64} | base64 -d > {$escaped}");
+    }
+
+    public function buildMkdirCommand(string $path): string
+    {
+        $escaped = $this->escapePath($path, 'mkdir path');
+
+        return $this->dockerExecShell("mkdir -p -- {$escaped}");
+    }
+
+    public function buildCreateFileCommand(string $path): string
+    {
+        $escaped = $this->escapePath($path, 'create file path');
+
+        // Create only if absent so an existing file is never truncated.
+        return $this->dockerExecShell("[ -e {$escaped} ] || : > {$escaped}");
+    }
+
+    public function buildChmodCommand(string $path, string $mode): string
+    {
+        $mode = $this->normalizeMode($mode);
+        $escaped = $this->escapePath($path, 'chmod path');
+
+        return $this->dockerExecShell("chmod {$mode} -- {$escaped}");
+    }
+
+    public function buildRenameCommand(string $from, string $to): string
+    {
+        $escapedFrom = $this->escapePath($from, 'rename source');
+        $escapedTo = $this->escapePath($to, 'rename target');
+
+        return $this->dockerExecShell("mv -- {$escapedFrom} {$escapedTo}");
+    }
+
+    public function buildDeleteCommand(string $path): string
+    {
+        $escaped = $this->escapePath($path, 'delete path');
+
+        return $this->dockerExecShell("rm -rf -- {$escaped}");
+    }
+
+    public function write(string $path, string $content): void
+    {
+        if (strlen($content) > self::MAX_INLINE_WRITE_SIZE) {
+            $this->writeViaUpload($path, $content);
+
+            return;
+        }
+        instant_remote_process([$this->buildWriteCommand($path, $content)], $this->server);
+    }
+
+    /**
+     * Write content too large for a single shell argument by staging it to a
+     * local temp file and reusing the docker cp upload path.
+     */
+    protected function writeViaUpload(string $path, string $content): void
+    {
+        validateShellSafePath($path, 'write path');
+        $localTmp = storage_path('app/tmp/'.Str::random(16));
+        @mkdir(dirname($localTmp), 0755, true);
+        file_put_contents($localTmp, $content);
+        try {
+            $this->upload($localTmp, $path);
+        } finally {
+            @unlink($localTmp);
+        }
+    }
+
+    public function makeDirectory(string $path): void
+    {
+        instant_remote_process([$this->buildMkdirCommand($path)], $this->server);
+    }
+
+    public function createFile(string $path): void
+    {
+        instant_remote_process([$this->buildCreateFileCommand($path)], $this->server);
+    }
+
+    public function chmod(string $path, string $mode): void
+    {
+        instant_remote_process([$this->buildChmodCommand($path, $mode)], $this->server);
+    }
+
+    protected function normalizeMode(string $mode): string
+    {
+        $mode = trim($mode);
+        if (! preg_match('/^[0-7]{3,4}$/', $mode)) {
+            throw new \InvalidArgumentException('Invalid permission mode. Use octal like 644 or 0755.');
+        }
+
+        return $mode;
+    }
+
+    public function rename(string $from, string $to): void
+    {
+        instant_remote_process([$this->buildRenameCommand($from, $to)], $this->server);
+    }
+
+    public function delete(string $path): void
+    {
+        instant_remote_process([$this->buildDeleteCommand($path)], $this->server);
+    }
+
+    public function defaultRoot(): string
+    {
+        $escapedContainer = escapeshellarg($this->container);
+        $workingDir = instant_remote_process(
+            ["docker inspect --format '{{.Config.WorkingDir}}' {$escapedContainer}"],
+            $this->server,
+            throwError: false,
+        );
+
+        $workingDir = trim((string) $workingDir);
+
+        return $workingDir !== '' ? $workingDir : '/';
+    }
+
+    /**
+     * @return array<int, FileEntry>
+     */
+    public function parseListing(?string $raw): array
+    {
+        if (blank($raw)) {
+            return [];
+        }
+
+        $entries = [];
+        foreach (explode("\n", trim($raw)) as $line) {
+            if ($line === '') {
+                continue;
+            }
+            $parts = explode("\t", $line, 7);
+            $owner = '';
+            $group = '';
+            // Accept the current 7-field format (with owner/group) and the
+            // legacy 5-field (perms) and 4-field formats.
+            if (count($parts) === 7) {
+                [$type, $size, $mtime, $perms, $owner, $group, $name] = $parts;
+            } elseif (count($parts) === 5) {
+                [$type, $size, $mtime, $perms, $name] = $parts;
+            } elseif (count($parts) === 4) {
+                [$type, $size, $mtime, $name] = $parts;
+                $perms = '';
+            } else {
+                continue;
+            }
+            // find prefixes names with ./; a name itself can never contain a slash.
+            if (str_starts_with($name, './')) {
+                $name = substr($name, 2);
+            }
+            if ($name === '' || $name === '.' || $name === '..') {
+                continue;
+            }
+            $entries[] = new FileEntry(
+                $name,
+                $this->normalizeType($type),
+                (int) $size,
+                (int) $mtime,
+                trim($perms),
+                trim($owner),
+                trim($group),
+            );
+        }
+
+        return FileEntry::sort($entries);
+    }
+
+    /**
+     * Map a raw type field to a file/dir/symlink token. Accepts both the
+     * already-tokenized legacy value and stat's human %F string.
+     */
+    protected function normalizeType(string $raw): string
+    {
+        $t = strtolower(trim($raw));
+        if ($t === 'dir' || str_contains($t, 'directory')) {
+            return 'dir';
+        }
+        if ($t === 'symlink' || str_contains($t, 'symbolic link')) {
+            return 'symlink';
+        }
+
+        return 'file';
+    }
+
+    public function upload(string $localTmpPath, string $destPath): void
+    {
+        validateShellSafePath($destPath, 'upload path');
+        $serverTmp = '/tmp/coolify-upload-'.Str::random(16);
+        $escapedServerTmp = escapeshellarg($serverTmp);
+        $escapedContainer = escapeshellarg($this->container);
+        $escapedDest = escapeshellarg($destPath);
+
+        try {
+            instant_scp($localTmpPath, $serverTmp, $this->server);
+            instant_remote_process(
+                ["docker cp {$escapedServerTmp} {$escapedContainer}:{$escapedDest}"],
+                $this->server,
+            );
+        } finally {
+            instant_remote_process(["rm -f {$escapedServerTmp}"], $this->server, throwError: false);
+        }
+    }
+
+    /**
+     * Inspect a download target in one round trip. Folder size is the
+     * uncompressed disk usage, so the archive is never larger than reported.
+     *
+     * @return array{isDir: bool, size: int}
+     *
+     * @throws \RuntimeException when the path does not exist
+     */
+    public function downloadInfo(string $path): array
+    {
+        $escaped = $this->escapePath($path, 'download path');
+        $cmd = 'if [ -d '.$escaped.' ]; then echo "dir $(du -sk '.$escaped.' | cut -f1)"; '
+            .'elif [ -e '.$escaped.' ]; then echo "file $(stat -L -c %s '.$escaped.')"; fi';
+
+        $raw = trim((string) instant_remote_process([$this->dockerExecShell($cmd)], $this->server));
+        [$kind, $size] = array_pad(explode(' ', $raw, 2), 2, '');
+        if (! in_array($kind, ['dir', 'file'], true) || ! ctype_digit($size)) {
+            throw new \RuntimeException('File not found.');
+        }
+
+        return [
+            'isDir' => $kind === 'dir',
+            'size' => $kind === 'dir' ? (int) $size * 1024 : (int) $size,
+        ];
+    }
+
+    public function buildDownloadCommand(string $path, bool $isDir): string
+    {
+        $escaped = $this->escapePath($path, 'download path');
+        $escapedContainer = escapeshellarg($this->container);
+
+        return $isDir
+            ? "docker exec {$escapedContainer} tar czf - -C {$escaped} ."
+            : "docker exec {$escapedContainer} cat -- {$escaped}";
+    }
+
+    /**
+     * Pipe a file, or a folder as .tar.gz, from the container to $write in
+     * chunks. Nothing is stored on the Coolify host or the managed server.
+     *
+     * @param  callable(string): void  $write
+     */
+    public function streamDownload(string $path, bool $isDir, callable $write): void
+    {
+        $command = $this->buildDownloadCommand($path, $isDir);
+        if ($this->server->isNonRoot()) {
+            $command = parseCommandsByLineForSudo(collect([$command]), $this->server)[0];
+        }
+
+        $process = proc_open($this->sshCommand($command), [1 => ['pipe', 'w'], 2 => ['file', '/dev/null', 'w']], $pipes);
+        if (! is_resource($process)) {
+            throw new \RuntimeException('Could not start the download.');
+        }
+
+        try {
+            while (! feof($pipes[1])) {
+                $chunk = fread($pipes[1], 64 * 1024);
+                if ($chunk === false || connection_aborted()) {
+                    break;
+                }
+                if ($chunk !== '') {
+                    $write($chunk);
+                }
+            }
+        } finally {
+            fclose($pipes[1]);
+            proc_terminate($process);
+            proc_close($process);
+        }
+    }
+
+    /**
+     * Stage the file, or the folder as .tar.gz, on the managed server and PUT
+     * it to a presigned S3 URL. S3 needs a Content-Length, so a pipe without a
+     * known size cannot be uploaded directly. The temp file is always removed.
+     *
+     * @param  array<string, string>  $headers
+     */
+    public function buildS3UploadCommand(string $path, bool $isDir, string $url, array $headers): string
+    {
+        $headerArgs = FileDownloadStorageService::curlHeaderArgs($headers);
+        $script = 'tmp=$(mktemp /tmp/coolify-download-XXXXXXXXXX) || exit 1; '
+            .'trap \'rm -f "$tmp"\' EXIT; '
+            .$this->buildDownloadCommand($path, $isDir).' > "$tmp" && '
+            .'curl -fsS --retry 2 '.$headerArgs.' -T "$tmp" '.escapeshellarg($url);
+
+        return 'sh -c '.escapeshellarg($script);
+    }
+
+    /**
+     * @param  array<string, string>  $headers
+     */
+    public function uploadToS3(string $path, bool $isDir, string $url, array $headers): void
+    {
+        instant_remote_process([$this->buildS3UploadCommand($path, $isDir, $url, $headers)], $this->server, timeout: 3600);
+    }
+
+    protected function sshCommand(string $command): string
+    {
+        return SshMultiplexingHelper::generateSshCommand($this->server, $command);
+    }
+
+    protected function escapePath(string $path, string $label): string
+    {
+        validateShellSafePath($path, $label);
+
+        return escapeshellarg($path);
+    }
+
+    protected function dockerExecShell(string $innerShell): string
+    {
+        $escapedContainer = escapeshellarg($this->container);
+
+        return "docker exec {$escapedContainer} sh -c ".escapeshellarg($innerShell);
+    }
+}
diff --git a/app/Services/CoolifyUpgradeStatus.php b/app/Services/CoolifyUpgradeStatus.php
index 3f274bb616..9027d5bcd9 100644
--- a/app/Services/CoolifyUpgradeStatus.php
+++ b/app/Services/CoolifyUpgradeStatus.php
@@ -93,7 +93,7 @@ class CoolifyUpgradeStatus
         }
 
         [$step, , $timestamp] = $parts;
-        if (! in_array($step, ['1', '2', '3', '4', '5'], true)) {
+        if (! in_array($step, ['1', '2', '3', '4', '5'], true) || trim($timestamp) === '') {
             return false;
         }
 
diff --git a/app/Services/DatabaseStartCommandExecutor.php b/app/Services/DatabaseStartCommandExecutor.php
index 96e2f500bd..4fc38a9539 100644
--- a/app/Services/DatabaseStartCommandExecutor.php
+++ b/app/Services/DatabaseStartCommandExecutor.php
@@ -4,9 +4,12 @@ namespace App\Services;
 
 use App\Enums\ProcessStatus;
 use App\Helpers\SshMultiplexingHelper;
+use App\Services\Security\SensitiveDataRedactor;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Process\Exceptions\ProcessTimedOutException;
 use Illuminate\Support\Facades\Process;
 use Spatie\Activitylog\Models\Activity;
+use Symfony\Component\Process\Exception\ProcessTimedOutException as SymfonyProcessTimedOutException;
 
 class DatabaseStartCommandExecutor
 {
@@ -25,13 +28,31 @@ class DatabaseStartCommandExecutor
         $activity->properties = $activity->properties->merge(['status' => ProcessStatus::IN_PROGRESS->value]);
         $activity->save();
 
-        $process = Process::timeout(config('constants.ssh.command_timeout'))
-            ->idleTimeout(3600)
-            ->start($remoteCommand, function (string $type, string $output) use ($activity, $secrets): void {
-                $this->appendOutput($activity, $type, $this->redact($output, $secrets));
-            });
+        $timeout = config('constants.ssh.command_timeout');
+        // Output is redacted per complete line, so a secret split across two output chunks is still found.
+        $pending = ['stdout' => '', 'stderr' => ''];
+        try {
+            $process = Process::timeout($timeout)
+                ->idleTimeout(3600)
+                ->start($remoteCommand, function (string $type, string $output) use ($activity, $secrets, &$pending): void {
+                    $pending[$type] = ($pending[$type] ?? '').$output;
+                    $end = max(strrpos($pending[$type], "\n"), strrpos($pending[$type], "\r"));
+                    if ($end === false) {
+                        return;
+                    }
+                    $this->appendOutput($activity, $type, $this->redact(substr($pending[$type], 0, $end + 1), $secrets));
+                    $pending[$type] = substr($pending[$type], $end + 1);
+                });
 
-        $result = $process->wait();
+            $result = $process->wait();
+        } catch (ProcessTimedOutException|SymfonyProcessTimedOutException) {
+            // The timeout message contains the full SSH command, which can contain secrets.
+            throw new \RuntimeException("The command on the server timed out after {$timeout} seconds.", 124);
+        } finally {
+            foreach ($pending as $type => $output) {
+                $this->appendOutput($activity, $type, $this->redact($output, $secrets));
+            }
+        }
         $status = $result->successful() ? ProcessStatus::FINISHED : ProcessStatus::ERROR;
         $activity->properties = $activity->properties->merge([
             'status' => $status->value,
@@ -46,15 +67,12 @@ class DatabaseStartCommandExecutor
         return $activity;
     }
 
+    /**
+     * @param  array<array-key, mixed>  $secrets
+     */
     private function redact(string $value, array $secrets): string
     {
-        foreach ($secrets as $secret) {
-            if (is_string($secret) && $secret !== '') {
-                $value = str_replace($secret, REDACTED, $value);
-            }
-        }
-
-        return sanitize_utf8_text(remove_iip($value));
+        return sanitize_utf8_text(resolve(SensitiveDataRedactor::class)->redactText($value, lockedSecrets: $secrets));
     }
 
     private function appendOutput(Activity $activity, string $type, string $output): void
diff --git a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
index ab057c2219..b632a1cedc 100644
--- a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
+++ b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
@@ -209,6 +209,10 @@ class ApplicationConfigurationSnapshot
             $this->item('is_http_basic_auth_enabled', 'HTTP basic auth', $this->application->is_http_basic_auth_enabled, 'redeploy'),
             $this->item('http_basic_auth_username', 'HTTP basic auth username', $this->application->http_basic_auth_username, 'redeploy'),
             $this->item('http_basic_auth_password', 'HTTP basic auth password', $this->application->http_basic_auth_password, 'redeploy', sensitive: true),
+            $this->item('http_basic_auth_hash_algorithm', 'HTTP basic auth hash algorithm', $this->application->http_basic_auth_hash_algorithm?->value, 'redeploy'),
+            $this->item('http_basic_auth_bcrypt_cost', 'HTTP basic auth bcrypt cost factor', $this->application->http_basic_auth_bcrypt_cost, 'redeploy'),
+            $this->item('http_basic_auth_argon2id_memory_cost', 'HTTP basic auth Argon2id memory (KiB)', $this->application->http_basic_auth_argon2id_memory_cost, 'redeploy'),
+            $this->item('http_basic_auth_argon2id_time_cost', 'HTTP basic auth Argon2id iterations', $this->application->http_basic_auth_argon2id_time_cost, 'redeploy'),
         ];
     }
 
diff --git a/app/Services/Dns/CloudflareDnsProvider.php b/app/Services/Dns/CloudflareDnsProvider.php
index 995a632f8a..9cd21a4fbf 100644
--- a/app/Services/Dns/CloudflareDnsProvider.php
+++ b/app/Services/Dns/CloudflareDnsProvider.php
@@ -31,6 +31,9 @@ class CloudflareDnsProvider
         $page = 1;
         do {
             $response = $this->client($token)->get('https://api.cloudflare.com/client/v4/zones', ['page' => $page, 'per_page' => 50]);
+            if ($response->status() === 403) {
+                throw new RuntimeException(self::missingPermissionMessage('Zone → Zone → Read'));
+            }
             if (! $response->successful() || $response->json('success') !== true) {
                 throw new RuntimeException('Cloudflare zones could not be synchronized.');
             }
@@ -78,29 +81,54 @@ class CloudflareDnsProvider
             ->get();
     }
 
+    public static function missingPermissionMessage(string $permission): string
+    {
+        return "The Cloudflare token needs the {$permission} permission.";
+    }
+
     /**
-     * All records of the given type for a hostname (several records form a round-robin set).
+     * All records of the given type (all types when null) for a hostname (several records form a round-robin set).
      *
      * @return array<int, array{id: string, type: string, name: string, content: string, proxied: bool|null, ttl: int|null, comment: string|null}>
      */
-    public function findRecords(DnsProviderZone $zone, string $hostname, string $type): array
+    public function findRecords(DnsProviderZone $zone, string $hostname, ?string $type): array
     {
         $hostname = strtolower(rtrim($hostname, '.'));
         $response = $this->client($zone->integrationToken)->get(
             "https://api.cloudflare.com/client/v4/zones/{$zone->provider_zone_id}/dns_records",
-            ['type' => $type, 'name' => $hostname, 'per_page' => 100],
+            array_filter(['type' => $type, 'name' => $hostname, 'per_page' => 100]),
         );
+        if ($response->status() === 403) {
+            throw new RuntimeException(self::missingPermissionMessage('Zone → DNS → Edit'));
+        }
         if (! $response->successful()) {
             throw new RuntimeException('Cloudflare DNS records could not be checked.');
         }
 
         return collect($response->json('result', []))
             ->filter(fn ($remote): bool => is_array($remote))
-            ->map(fn (array $remote): array => $this->normalizeRemoteRecord($remote, $hostname, $type))
+            ->map(fn (array $remote): array => $this->normalizeRemoteRecord($remote, $hostname, $type ?? ''))
             ->values()
             ->all();
     }
 
+    /**
+     * Records that block a new record of the type. A CNAME cannot share its name with A, AAAA, or other CNAME records.
+     *
+     * @return array<int, array{id: string, type: string, name: string, content: string, proxied: bool|null, ttl: int|null, comment: string|null}>
+     */
+    private function conflictingRecords(DnsProviderZone $zone, string $hostname, string $type): array
+    {
+        if ($type !== 'CNAME') {
+            return $this->findRecords($zone, $hostname, $type);
+        }
+
+        return array_values(array_filter(
+            $this->findRecords($zone, $hostname, null),
+            fn (array $remote): bool => in_array($remote['type'], ['A', 'AAAA', 'CNAME'], true),
+        ));
+    }
+
     /**
      * Creates the record with Coolify's ownership comment, or references an existing record that already has the wanted content.
      * Existing records that Coolify did not create are only referenced and never marked as owned.
@@ -111,15 +139,15 @@ class CloudflareDnsProvider
      *
      * @throws LockTimeoutException when another change for the hostname does not finish in time
      */
-    public function createRecord(DnsProviderZone $zone, string $hostname, string $content, ?Model $resource = null, array $additionalResources = []): ManagedDnsRecord
+    public function createRecord(DnsProviderZone $zone, string $hostname, string $content, ?Model $resource = null, array $additionalResources = [], ?bool $proxied = null): ManagedDnsRecord
     {
         $hostname = strtolower(rtrim($hostname, '.'));
 
         return $this->hostnameLock->run(
             (int) $zone->integrationToken->team_id,
             $hostname,
-            function () use ($zone, $hostname, $content, $resource, $additionalResources): ManagedDnsRecord {
-                $record = $this->createRecordLocked($zone, $hostname, $content, $resource);
+            function () use ($zone, $hostname, $content, $resource, $additionalResources, $proxied): ManagedDnsRecord {
+                $record = $this->createRecordLocked($zone, $hostname, $content, $resource, $proxied);
                 foreach ($additionalResources as $additionalResource) {
                     $record->addReference($additionalResource);
                 }
@@ -129,11 +157,11 @@ class CloudflareDnsProvider
         );
     }
 
-    private function createRecordLocked(DnsProviderZone $zone, string $hostname, string $content, ?Model $resource): ManagedDnsRecord
+    private function createRecordLocked(DnsProviderZone $zone, string $hostname, string $content, ?Model $resource, ?bool $proxied): ManagedDnsRecord
     {
         $type = $this->recordType($content);
-        $remoteRecords = $this->findRecords($zone, $hostname, $type);
-        $matching = collect($remoteRecords)->first(fn (array $remote): bool => DnsRecordHints::sameAddress($remote['content'], $content));
+        $remoteRecords = $this->conflictingRecords($zone, $hostname, $type);
+        $matching = collect($remoteRecords)->first(fn (array $remote): bool => $remote['type'] === $type && DnsRecordHints::sameAddress($remote['content'], $content));
         if ($matching !== null) {
             if ($matching['id'] === '') {
                 throw new RuntimeException('Cloudflare DNS records could not be checked.');
@@ -154,9 +182,12 @@ class CloudflareDnsProvider
         $uuid = new_public_id();
         $response = $this->client($zone->integrationToken)->post("https://api.cloudflare.com/client/v4/zones/{$zone->provider_zone_id}/dns_records", [
             'type' => $type, 'name' => $hostname, 'content' => $content, 'ttl' => 1,
-            'proxied' => $zone->integrationToken->proxiedDnsEnabled(),
+            'proxied' => $proxied ?? $zone->integrationToken->proxiedDnsEnabled(),
             'comment' => ManagedDnsRecord::ownershipCommentFor($uuid),
         ]);
+        if ($response->status() === 403) {
+            throw new RuntimeException(self::missingPermissionMessage('Zone → DNS → Edit'));
+        }
         if (! $response->successful() || ! is_string($response->json('result.id'))) {
             throw new RuntimeException('Cloudflare could not create the DNS record.');
         }
@@ -176,7 +207,8 @@ class CloudflareDnsProvider
 
     /**
      * Points an existing (conflicting) record at the new content after explicit user confirmation.
-     * Only the content changes: proxy status, TTL, comment and other settings stay as they are.
+     * Only the content (and the type, when it differs) changes: TTL, comment and other settings stay as they are.
+     * The proxy status changes only when $proxied is set.
      *
      * @param  array<int, Model>  $additionalResources  Other resources that use the hostname and also reference the record.
      *
@@ -190,14 +222,15 @@ class CloudflareDnsProvider
         ?Model $resource = null,
         ?string $expectedCurrent = null,
         array $additionalResources = [],
+        bool $proxied = false,
     ): ManagedDnsRecord {
         $hostname = strtolower(rtrim($hostname, '.'));
 
         return $this->hostnameLock->run(
             (int) $zone->integrationToken->team_id,
             $hostname,
-            function () use ($zone, $recordId, $hostname, $content, $resource, $expectedCurrent, $additionalResources): ManagedDnsRecord {
-                $record = $this->replaceRecordLocked($zone, $recordId, $hostname, $content, $resource, $expectedCurrent);
+            function () use ($zone, $recordId, $hostname, $content, $resource, $expectedCurrent, $additionalResources, $proxied): ManagedDnsRecord {
+                $record = $this->replaceRecordLocked($zone, $recordId, $hostname, $content, $resource, $expectedCurrent, $proxied);
                 foreach ($additionalResources as $additionalResource) {
                     $record->addReference($additionalResource);
                 }
@@ -214,9 +247,10 @@ class CloudflareDnsProvider
         string $content,
         ?Model $resource,
         ?string $expectedCurrent,
+        bool $proxied,
     ): ManagedDnsRecord {
         $type = $this->recordType($content);
-        $remoteRecords = $this->findRecords($zone, $hostname, $type);
+        $remoteRecords = $this->conflictingRecords($zone, $hostname, $type);
         if (count($remoteRecords) > 1) {
             throw new RuntimeException("Several DNS records already exist for {$hostname}. Update them in Cloudflare.");
         }
@@ -229,10 +263,20 @@ class CloudflareDnsProvider
             throw new RuntimeException('The DNS conflict is no longer available. Check the record again.');
         }
 
+        $changes = ['content' => $content];
+        if ($remote['type'] !== $type) {
+            $changes['type'] = $type;
+        }
+        if ($proxied) {
+            $changes['proxied'] = true;
+        }
         $response = $this->client($zone->integrationToken)->patch(
             "https://api.cloudflare.com/client/v4/zones/{$zone->provider_zone_id}/dns_records/{$remote['id']}",
-            ['content' => $content],
+            $changes,
         );
+        if ($response->status() === 403) {
+            throw new RuntimeException(self::missingPermissionMessage('Zone → DNS → Edit'));
+        }
         if (! $response->successful()) {
             throw new RuntimeException('Cloudflare could not replace the conflicting DNS record.');
         }
@@ -286,6 +330,85 @@ class CloudflareDnsProvider
         return $this->forgetDeletedRecord($record, ManagedDnsDeletionResult::Deleted, $resource);
     }
 
+    /**
+     * Takes ownership of a record that another Coolify instance created, after a server transfer. The provider
+     * comment changes from $previousComment to the ownership comment of this instance only when the record still
+     * has the expected type, name, value and comment. Never throws; returns false when the record was not adopted.
+     */
+    public function adoptRecord(ManagedDnsRecord $record, string $previousComment): bool
+    {
+        try {
+            $record->loadMissing(['zone', 'integrationToken']);
+            if ($record->zone === null || $record->integrationToken?->provider !== 'cloudflare') {
+                return false;
+            }
+
+            return $this->hostnameLock->run(
+                (int) $record->integrationToken->team_id,
+                $record->name,
+                fn (): bool => $this->adoptRecordLocked($record, $previousComment),
+            );
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * Takes a record back after a take back, when another Coolify instance may have adopted it meanwhile. The
+     * provider comment must be an ownership comment for this record uuid, from this or any other instance.
+     * Never throws; returns false when the record was not taken back.
+     */
+    public function reclaimRecord(ManagedDnsRecord $record): bool
+    {
+        try {
+            $record->loadMissing(['zone', 'integrationToken']);
+            if ($record->zone === null || $record->integrationToken?->provider !== 'cloudflare') {
+                return false;
+            }
+
+            return $this->hostnameLock->run(
+                (int) $record->integrationToken->team_id,
+                $record->name,
+                function () use ($record): bool {
+                    $url = "https://api.cloudflare.com/client/v4/zones/{$record->zone->provider_zone_id}/dns_records/{$record->provider_record_id}";
+                    $comment = $this->client($record->integrationToken)->get($url)->json('result.comment');
+                    $pattern = '/^'.preg_quote(ManagedDnsRecord::OWNERSHIP_COMMENT_PREFIX, '/').' \\S+\\/'.preg_quote($record->uuid, '/').'$/';
+                    if (! is_string($comment) || preg_match($pattern, $comment) !== 1) {
+                        return false;
+                    }
+
+                    return $comment === $record->ownershipComment() || $this->adoptRecordLocked($record, $comment);
+                },
+            );
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
+    private function adoptRecordLocked(ManagedDnsRecord $record, string $previousComment): bool
+    {
+        $url = "https://api.cloudflare.com/client/v4/zones/{$record->zone->provider_zone_id}/dns_records/{$record->provider_record_id}";
+        $response = $this->client($record->integrationToken)->get($url);
+        $remote = $response->json('result');
+        if (! $response->successful() || ! is_array($remote)) {
+            return false;
+        }
+        if (($remote['type'] ?? null) !== $record->type
+            || strtolower((string) ($remote['name'] ?? '')) !== $record->name
+            || ! DnsRecordHints::sameAddress(is_string($remote['content'] ?? null) ? $remote['content'] : null, $record->content)
+            || ($remote['comment'] ?? null) !== $previousComment) {
+            return false;
+        }
+
+        $patchResponse = $this->client($record->integrationToken)->patch($url, ['comment' => $record->ownershipComment()]);
+        if (! $patchResponse->successful()) {
+            return false;
+        }
+        $this->auditDnsRecord('ownership_adopted', $record->zone, $record->name, null);
+
+        return true;
+    }
+
     private function forgetDeletedRecord(ManagedDnsRecord $record, ManagedDnsDeletionResult $result, ?Model $resource): ManagedDnsDeletionResult
     {
         $record->delete();
@@ -337,7 +460,11 @@ class CloudflareDnsProvider
 
     private function recordType(string $content): string
     {
-        return filter_var($content, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) ? 'AAAA' : 'A';
+        return match (true) {
+            filter_var($content, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false => 'AAAA',
+            filter_var($content, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false => 'A',
+            default => 'CNAME',
+        };
     }
 
     private function auditDnsRecord(string $action, DnsProviderZone $zone, string $hostname, ?Model $resource): void
diff --git a/app/Services/Dns/ManagedDnsRecordCleanup.php b/app/Services/Dns/ManagedDnsRecordCleanup.php
index d8d02dfd73..59b75a55a6 100644
--- a/app/Services/Dns/ManagedDnsRecordCleanup.php
+++ b/app/Services/Dns/ManagedDnsRecordCleanup.php
@@ -149,6 +149,71 @@ class ManagedDnsRecordCleanup
         return $successful;
     }
 
+    /**
+     * Stops tracking the records of these resources without touching the provider. Used when another Coolify
+     * instance takes over the resources: their records still serve live traffic there. A record that another
+     * resource of this instance still uses keeps that resource's references.
+     *
+     * @param  iterable<int, Model>  $resources
+     */
+    public function forgetResources(iterable $resources): void
+    {
+        $keys = collect($resources)
+            ->flatMap(fn (Model $resource) => $this->resourceKeys($resource->getMorphClass(), $resource->getKey()))
+            ->all();
+        if ($keys === []) {
+            return;
+        }
+
+        $records = ManagedDnsRecord::query()
+            ->whereHas('references', fn (Builder $query) => $this->whereResourceKeys($query, $keys))
+            ->get();
+
+        foreach ($records as $record) {
+            $this->deleteReferences($record, $keys);
+            if (! $record->references()->exists()) {
+                $this->forget($record, 'The resource was transferred to another Coolify instance, which uses the record now.', 'info');
+            }
+        }
+    }
+
+    /**
+     * Keeps the records of resources that another Coolify instance manages now, for a later take back, but marks
+     * them not owned, so this instance never changes or deletes them at the provider. A record that another
+     * resource of this instance also uses only loses the references of these resources.
+     *
+     * @param  iterable<int, Model>  $resources
+     * @return list<int> ids of the records that were owned before
+     */
+    public function parkResources(iterable $resources): array
+    {
+        $keys = collect($resources)
+            ->flatMap(fn (Model $resource) => $this->resourceKeys($resource->getMorphClass(), $resource->getKey()))
+            ->all();
+        if ($keys === []) {
+            return [];
+        }
+
+        $parked = [];
+        $records = ManagedDnsRecord::query()
+            ->whereHas('references', fn (Builder $query) => $this->whereResourceKeys($query, $keys))
+            ->get();
+        foreach ($records as $record) {
+            $sharedWithOthers = $record->references()->whereNot(fn (Builder $query) => $this->whereResourceKeys($query, $keys))->exists();
+            if ($sharedWithOthers) {
+                $this->deleteReferences($record, $keys);
+
+                continue;
+            }
+            if ($record->owned) {
+                $record->update(['owned' => false]);
+                $parked[] = $record->id;
+            }
+        }
+
+        return $parked;
+    }
+
     /**
      * Releases orphaned records: records whose references all point to deleted (or soft-deleted) resources, and
      * records without references that are older than the grace period. Records with a live reference are not touched.
diff --git a/app/Services/DockerRegistryLogins.php b/app/Services/DockerRegistryLogins.php
index a165df7e7b..8406fa9ec4 100644
--- a/app/Services/DockerRegistryLogins.php
+++ b/app/Services/DockerRegistryLogins.php
@@ -6,10 +6,12 @@ use App\Helpers\SshMultiplexingHelper;
 use App\Models\Application;
 use App\Models\Server;
 use App\Models\Service;
+use Illuminate\Process\Exceptions\ProcessTimedOutException;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Process;
 use RuntimeException;
+use Symfony\Component\Process\Exception\ProcessTimedOutException as SymfonyProcessTimedOutException;
 
 class DockerRegistryLogins
 {
@@ -274,7 +276,12 @@ class DockerRegistryLogins
     private static function run(Server $server, string $command, array $secrets = [], ?string $emptyErrorMessage = null): void
     {
         $commands = $server->isNonRoot() ? parseCommandsByLineForSudo(collect([$command]), $server) : [$command];
-        $process = Process::timeout(60)->run(SshMultiplexingHelper::generateSshCommand($server, implode("\n", $commands)));
+        try {
+            $process = Process::timeout(60)->run(SshMultiplexingHelper::generateSshCommand($server, implode("\n", $commands)));
+        } catch (ProcessTimedOutException|SymfonyProcessTimedOutException) {
+            // The timeout message contains the full SSH command, including the registry password.
+            throw new RuntimeException('The command on the server timed out after 60 seconds.', 124);
+        }
 
         if ($process->exitCode() === 0) {
             return;
diff --git a/app/Services/EnvironmentCanvas.php b/app/Services/EnvironmentCanvas.php
new file mode 100644
index 0000000000..8372af3371
--- /dev/null
+++ b/app/Services/EnvironmentCanvas.php
@@ -0,0 +1,437 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Models\Server;
+use App\Models\Service;
+use App\Support\ResourceStartActivity;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+use Spatie\Activitylog\Models\Activity;
+
+/**
+ * Builds the environment canvas graph: server zones, resource cards, manual links and saved positions.
+ *
+ * Cards hold summary fields only. Never add environment variables, passwords, keys or connection URLs.
+ */
+class EnvironmentCanvas
+{
+    public const MAX_COORDINATE = 100000;
+
+    /** Zone id of the placeholder cards of environments without resources. */
+    public const EMPTY_ZONE = 'empty';
+
+    /**
+     * Environment relations that hold standalone databases, keyed by relation name.
+     */
+    public const DATABASE_RELATIONS = [
+        'postgresqls',
+        'redis',
+        'mongodbs',
+        'mysqls',
+        'mariadbs',
+        'keydbs',
+        'dragonflies',
+        'clickhouses',
+        'sqlites',
+    ];
+
+    private const DATABASE_ENGINE_NAMES = [
+        'postgresql' => 'PostgreSQL',
+        'redis' => 'Redis',
+        'mongodb' => 'MongoDB',
+        'mysql' => 'MySQL',
+        'mariadb' => 'MariaDB',
+        'keydb' => 'KeyDB',
+        'dragonfly' => 'Dragonfly',
+        'clickhouse' => 'ClickHouse',
+        'sqlite' => 'SQLite',
+    ];
+
+    private const BUILD_PACK_NAMES = [
+        'nixpacks' => 'Nixpacks',
+        'railpack' => 'Railpack',
+        'static' => 'Static',
+        'dockerfile' => 'Dockerfile',
+        'dockercompose' => 'Docker Compose',
+        'dockerimage' => 'Docker Image',
+    ];
+
+    /**
+     * The canvas payload of an environment.
+     *
+     * @return array{project: array{uuid: string, name: string, link: string}, environment: array{uuid: string, name: string, link: string}, can_edit: bool, zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array{id: string, source: string, target: string, label: ?string}>, positions: array<string, array{x: int, y: int}>}
+     */
+    public function payload(Environment $environment, bool $canReadSensitive, bool $canEdit): array
+    {
+        $environment->loadMissing('project');
+        $resources = $this->loadResources($environment);
+        $graph = $this->graph($resources, $environment->resourceLinks()->orderBy('id')->get(), $canReadSensitive);
+
+        return [
+            'project' => [
+                'uuid' => $environment->project->uuid,
+                'name' => $environment->project->name,
+                'link' => route('project.show', ['project_uuid' => $environment->project->uuid]),
+            ],
+            'environment' => [
+                'uuid' => $environment->uuid,
+                'name' => $environment->name,
+                'link' => route('project.resource.index', ['project_uuid' => $environment->project->uuid, 'environment_uuid' => $environment->uuid]),
+            ],
+            'can_edit' => $canEdit,
+            ...$graph,
+            'positions' => $this->filterPositions($environment->canvas_positions ?? [], $resources->keys()->all()),
+        ];
+    }
+
+    /**
+     * Zones (servers), cards and links of the given resources. Links with an end outside the resources are left out.
+     *
+     * @param  Collection<string, Model>  $resources  keyed by uuid
+     * @param  Collection<int, ResourceLink>  $links
+     * @return array{zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array{id: string, source: string, target: string, label: ?string}>}
+     */
+    public function graph(Collection $resources, Collection $links, bool $canReadSensitive): array
+    {
+        $startingServiceUuids = $this->startingServiceUuids($resources->filter(fn (Model $resource) => $resource instanceof Service));
+
+        $servers = collect();
+        $nodes = $resources->map(function (Model $resource) use (&$servers, $startingServiceUuids) {
+            $node = match (true) {
+                $resource instanceof Application => $this->applicationNode($resource),
+                $resource instanceof Service => $this->serviceNode($resource, in_array($resource->uuid, $startingServiceUuids, true)),
+                default => $this->databaseNode($resource),
+            };
+            foreach ($node['servers'] as $server) {
+                $servers->put($server->id, $server);
+            }
+            unset($node['servers']);
+            // Other canvases keep the arrangement saved on the environment canvas inside each environment group.
+            $node['saved'] = $this->filterPositions($resource->environment?->canvas_positions ?? [], [$resource->uuid])[$resource->uuid] ?? null;
+
+            return $node;
+        })->values();
+
+        $uuidByMorphKey = $resources->mapWithKeys(fn (Model $resource) => [$this->morphKey($resource->getMorphClass(), $resource->getKey()) => $resource->uuid]);
+
+        $links = $links
+            ->map(fn (ResourceLink $link) => [
+                'link' => $link,
+                'source' => $uuidByMorphKey->get($this->morphKey($link->source_type, $link->source_id)),
+                'target' => $uuidByMorphKey->get($this->morphKey($link->target_type, $link->target_id)),
+            ])
+            ->filter(fn (array $link) => $link['source'] !== null && $link['target'] !== null)
+            ->map(fn (array $link) => $this->linkPayload($link['link'], $link['source'], $link['target']))
+            ->values();
+
+        return [
+            'zones' => $servers->values()->map(fn (Server $server) => $this->zone($server, $canReadSensitive))->all(),
+            'nodes' => $nodes->all(),
+            'links' => $links->all(),
+        ];
+    }
+
+    /**
+     * @return array{id: string, name: string, ip: ?string, is_reachable: bool, is_usable: bool, link: string}
+     */
+    public function zone(Server $server, bool $canReadSensitive): array
+    {
+        return [
+            'id' => $server->uuid,
+            'name' => $server->name,
+            'ip' => $canReadSensitive ? $server->ip : null,
+            'is_reachable' => (bool) $server->settings?->is_reachable,
+            'is_usable' => (bool) $server->settings?->is_usable,
+            'link' => route('server.show', ['server_uuid' => $server->uuid]),
+        ];
+    }
+
+    /**
+     * Zone of the server, project and dashboard canvases for environments without resources (they have no server).
+     *
+     * @return array{id: string, name: string, icon: string}
+     */
+    public function emptyZone(): array
+    {
+        return ['id' => self::EMPTY_ZONE, 'name' => 'Empty environments', 'icon' => 'service'];
+    }
+
+    /**
+     * Zone for the placeholder cards of a project: the zone with most of the project's cards, or `$fallback`
+     * when the project has no cards.
+     *
+     * @param  Collection<int, array<string, mixed>>  $nodes  cards of the canvas
+     * @return callable(Project): string
+     */
+    public function projectZones(Collection $nodes, string $fallback): callable
+    {
+        $zones = $nodes
+            ->filter(fn (array $node) => filled($node['zone']))
+            ->groupBy(fn (array $node) => data_get($node, 'project.uuid'))
+            ->map(fn (Collection $cards) => $cards->countBy('zone')->sortDesc()->keys()->first());
+
+        return fn (Project $project) => $zones->get($project->uuid, $fallback);
+    }
+
+    /**
+     * Placeholder card of an environment without resources, so the grouped canvases still show it.
+     * Without an environment, it stands for a project without environments.
+     * `$canAdd`: the card opens the deploy canvas for the environment instead of the environment page.
+     *
+     * @return array<string, mixed>
+     */
+    public function emptyNode(Project $project, ?Environment $environment, string $zone, string $context, bool $canAdd = false): array
+    {
+        $page = $environment
+            ? route('project.resource.index', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid])
+            : route('project.show', ['project_uuid' => $project->uuid]);
+        $add = $canAdd && $environment;
+
+        return [
+            'id' => 'empty:'.($environment?->uuid ?? $project->uuid),
+            'type' => 'empty',
+            'name' => $environment ? 'No resources yet' : 'No environments yet',
+            'subtitle' => $add ? 'Click to add a resource' : 'Open to see this '.($environment ? 'environment' : 'project'),
+            'status' => null,
+            'zone' => $zone,
+            'extra_zones' => [],
+            'urls' => [],
+            'children' => [],
+            'link' => $add ? route('deploy-canvas', ['project' => $project->uuid, 'environment' => $environment->uuid]) : $page,
+            'context' => $context,
+            'context_link' => $page,
+            'project' => ['uuid' => $project->uuid, 'name' => $project->name],
+            'environment' => $environment ? ['uuid' => $environment->uuid, 'name' => $environment->name] : null,
+        ];
+    }
+
+    /**
+     * Top-level resources of the environment (applications, services, standalone databases), keyed by uuid,
+     * with the relations the canvas reads.
+     *
+     * @return Collection<string, Model>
+     */
+    public function loadResources(Environment $environment): Collection
+    {
+        $project = $environment->project;
+        $environment->setRelation('project', $project);
+        $applications = $environment->applications()
+            ->with(['destination.server.settings', 'additional_servers.settings'])
+            ->get();
+        $services = $environment->services()
+            ->with([
+                'server.settings',
+                'destination.server.settings',
+                'applications',
+                'databases',
+            ])
+            ->get();
+        $databases = collect(self::DATABASE_RELATIONS)
+            ->flatMap(fn (string $relation) => $environment->{$relation}()
+                ->with(['destination.server.settings'])
+                ->get());
+
+        return collect()
+            ->concat($applications)
+            ->concat($services)
+            ->concat($databases)
+            ->each(fn (Model $resource) => $resource->setRelation('environment', $environment))
+            ->keyBy('uuid');
+    }
+
+    /**
+     * Morph type and id of every top-level resource of the environment, keyed by uuid. Reads ids only.
+     *
+     * @return Collection<string, array{type: string, id: int}>
+     */
+    public function resourceIndex(Environment $environment): Collection
+    {
+        return collect(['applications', 'services', ...self::DATABASE_RELATIONS])
+            ->flatMap(function (string $relation) use ($environment) {
+                $query = $environment->{$relation}();
+                $type = $query->getRelated()->getMorphClass();
+
+                return $query->toBase()->get(['id', 'uuid'])
+                    ->map(fn (object $row) => ['uuid' => $row->uuid, 'type' => $type, 'id' => (int) $row->id]);
+            })
+            ->keyBy('uuid')
+            ->map(fn (array $row) => ['type' => $row['type'], 'id' => $row['id']]);
+    }
+
+    /**
+     * Keep only positions of the given node uuids, as integer coordinates.
+     *
+     * @param  array<string, mixed>  $positions
+     * @param  array<int, string>  $nodeUuids
+     * @return array<string, array{x: int, y: int}>
+     */
+    public function filterPositions(array $positions, array $nodeUuids): array
+    {
+        return collect($positions)
+            ->only($nodeUuids)
+            ->filter(fn ($position) => is_array($position) && is_numeric($position['x'] ?? null) && is_numeric($position['y'] ?? null))
+            ->map(fn (array $position) => ['x' => (int) $position['x'], 'y' => (int) $position['y']])
+            ->all();
+    }
+
+    /**
+     * @return array{id: string, source: string, target: string, label: ?string}
+     */
+    public function linkPayload(ResourceLink $link, string $sourceUuid, string $targetUuid): array
+    {
+        return [
+            'id' => $link->uuid,
+            'source' => $sourceUuid,
+            'target' => $targetUuid,
+            'label' => $link->label,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function applicationNode(Application $application): array
+    {
+        $server = $application->destination?->server;
+        $extraServers = $application->additional_servers->filter()->values();
+        $buildPack = $application->build_pack;
+        $detail = $buildPack === 'dockerimage'
+            ? collect([$application->docker_registry_image_name, $application->docker_registry_image_tag])->filter()->implode(':')
+            : $application->git_branch;
+
+        return [
+            'id' => $application->uuid,
+            'type' => 'application',
+            'name' => $application->name,
+            'status' => (string) $application->status,
+            'zone' => $server?->uuid,
+            'extra_zones' => $extraServers->pluck('uuid')->reject(fn ($uuid) => $uuid === $server?->uuid)->unique()->values()->all(),
+            'urls' => $this->splitUrls($application->fqdn),
+            'kind' => $buildPack,
+            'subtitle' => $this->subtitle([self::BUILD_PACK_NAMES[$buildPack] ?? str($buildPack)->headline()->value(), $detail]),
+            'children' => [],
+            'link' => $application->link(),
+            'logo' => resource_logo($application),
+            'servers' => collect([$server])->concat($extraServers)->filter()->all(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function serviceNode(Service $service, bool $isStarting): array
+    {
+        $server = $service->server ?? $service->destination?->server;
+        $children = $service->applications
+            ->map(fn ($child) => ['name' => $child->name, 'type' => 'application', 'status' => (string) $child->status])
+            ->concat($service->databases->map(fn ($child) => ['name' => $child->name, 'type' => 'database', 'status' => (string) $child->status]))
+            ->values();
+        $containerCount = $children->count();
+
+        return [
+            'id' => $service->uuid,
+            'type' => 'service',
+            'name' => $service->name,
+            'status' => $isStarting ? 'starting:unhealthy' : (string) $service->containerStatus(),
+            'zone' => $server?->uuid,
+            'extra_zones' => [],
+            'urls' => $service->applications
+                ->flatMap(fn ($child) => $this->splitUrls($child->fqdn))
+                ->unique()
+                ->values()
+                ->all(),
+            'kind' => null,
+            'subtitle' => $this->subtitle(['Service', $containerCount.' '.str('container')->plural($containerCount)]),
+            'children' => $children->all(),
+            'link' => $service->link(),
+            'logo' => resource_logo($service),
+            'servers' => collect([$server])->filter()->all(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function databaseNode(Model $database): array
+    {
+        $server = $database->destination?->server;
+        $engine = str($database->type())->after('standalone-')->value();
+
+        return [
+            'id' => $database->uuid,
+            'type' => 'database',
+            'name' => $database->name,
+            'status' => (string) $database->status,
+            'zone' => $server?->uuid,
+            'extra_zones' => [],
+            'urls' => [],
+            'kind' => $engine,
+            'subtitle' => $this->subtitle([self::DATABASE_ENGINE_NAMES[$engine] ?? str($engine)->headline()->value(), $database->image]),
+            'children' => [],
+            'link' => $database->link(),
+            'logo' => resource_logo($database),
+            'servers' => collect([$server])->filter()->all(),
+        ];
+    }
+
+    /**
+     * Uuids of services with a queued or running start, read with one query instead of one per service.
+     *
+     * @param  Collection<string, Service>  $services
+     * @return array<int, string>
+     */
+    private function startingServiceUuids(Collection $services): array
+    {
+        if ($services->isEmpty()) {
+            return [];
+        }
+
+        $staleAfterSeconds = max(ResourceStartActivity::QUEUED_STALE_AFTER_SECONDS, ResourceStartActivity::IN_PROGRESS_STALE_AFTER_SECONDS);
+
+        /** @var EloquentCollection<int, Activity> $activities */
+        $activities = Activity::query()
+            ->whereIn('properties->type_uuid', $services->pluck('uuid')->all())
+            ->where('updated_at', '>=', now()->subSeconds($staleAfterSeconds))
+            ->latest()
+            ->orderByDesc('id')
+            ->get();
+
+        return $activities
+            ->groupBy(fn (Activity $activity) => (string) data_get($activity, 'properties.type_uuid'))
+            ->filter(fn (EloquentCollection $group) => ResourceStartActivity::isRunning($group->first()))
+            ->keys()
+            ->all();
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function splitUrls(?string $fqdn): array
+    {
+        return str((string) $fqdn)->explode(',')
+            ->map(fn (string $url) => trim($url))
+            ->filter()
+            ->unique()
+            ->values()
+            ->all();
+    }
+
+    /**
+     * @param  array<int, ?string>  $parts
+     */
+    private function subtitle(array $parts): string
+    {
+        return collect($parts)->map(fn ($part) => trim((string) $part))->filter()->implode(' · ');
+    }
+
+    private function morphKey(string $type, int|string $id): string
+    {
+        return $type.'|'.$id;
+    }
+}
diff --git a/app/Services/FileDownloadStorageService.php b/app/Services/FileDownloadStorageService.php
new file mode 100644
index 0000000000..f342873c9c
--- /dev/null
+++ b/app/Services/FileDownloadStorageService.php
@@ -0,0 +1,207 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Rules\SafeWebhookUrl;
+use Aws\S3\Exception\S3Exception;
+use Aws\S3\S3Client;
+use Illuminate\Support\Str;
+use RuntimeException;
+
+/**
+ * Optional S3 path for file browser downloads. The managed server uploads
+ * straight to S3 with a presigned URL and the browser downloads from S3, so
+ * the file never passes through the Coolify host.
+ */
+class FileDownloadStorageService
+{
+    public const PREFIX = 'coolify-file-downloads/';
+
+    public const LIFECYCLE_RULE_ID = 'coolify-file-downloads';
+
+    /**
+     * S3 checks the link time when a download starts, so a download that has
+     * started finishes after the link expires. Nobody can start a new one.
+     */
+    public const LINK_TTL_MINUTES = 15;
+
+    /** An expired object cannot be downloaded, so it can stay until the delete job runs. */
+    public const OBJECT_TTL_HOURS = 6;
+
+    /** A single S3 PUT accepts at most 5 GiB. */
+    public const MAX_SIZE = 5 * 1024 * 1024 * 1024;
+
+    public static function configuredStorage(): ?S3Storage
+    {
+        $storageId = instanceSettings()->file_download_s3_storage_id;
+        if (! $storageId) {
+            return null;
+        }
+
+        return S3Storage::query()->whereTeamId(0)->where('is_usable', true)->find($storageId);
+    }
+
+    public static function newObjectKey(): string
+    {
+        return self::PREFIX.Str::random(48);
+    }
+
+    /**
+     * Add or replace the rule that deletes download objects after one day.
+     * S3 lifecycle rules have a one-day minimum, so this is only a safety net
+     * for the six-hour delete job. Other rules on the bucket are kept.
+     *
+     * @throws RuntimeException when the bucket does not accept the rule
+     */
+    public function ensureLifecycleRule(S3Storage $storage): void
+    {
+        try {
+            $client = $storage->filesystem()->getClient();
+            try {
+                $rules = $client->getBucketLifecycleConfiguration(['Bucket' => $storage->bucket])['Rules'] ?? [];
+            } catch (S3Exception $e) {
+                if ($e->getAwsErrorCode() !== 'NoSuchLifecycleConfiguration') {
+                    throw $e;
+                }
+                $rules = [];
+            }
+
+            $rules = array_values(array_filter($rules, fn (array $rule) => ($rule['ID'] ?? null) !== self::LIFECYCLE_RULE_ID));
+            $rules[] = [
+                'ID' => self::LIFECYCLE_RULE_ID,
+                'Filter' => ['Prefix' => self::PREFIX],
+                'Status' => 'Enabled',
+                'Expiration' => ['Days' => 1],
+            ];
+
+            $client->putBucketLifecycleConfiguration([
+                'Bucket' => $storage->bucket,
+                'LifecycleConfiguration' => ['Rules' => $rules],
+            ]);
+        } catch (\Throwable $e) {
+            throw new RuntimeException('Could not add the auto-delete lifecycle rule to bucket "'.$storage->bucket.'". The S3 provider must support lifecycle rules, and the key must be allowed to change them. Error: '.$e->getMessage(), previous: $e);
+        }
+    }
+
+    /**
+     * Download links are only safe while object keys stay secret. Refuse a
+     * bucket that lets anonymous users list its objects, and an endpoint that
+     * only Coolify can reach (servers upload to it, browsers download from it).
+     *
+     * @throws RuntimeException when the endpoint is internal, unreachable or listable
+     */
+    public function ensureBucketIsPrivate(S3Storage $storage): void
+    {
+        if ($storage->trustedInternalHosts() !== []) {
+            throw new RuntimeException('"'.$storage->name.'" uses an internal Docker host name. Your servers and browsers cannot reach it. Use an S3 endpoint with a public or LAN address.');
+        }
+
+        try {
+            $this->anonymousClient($storage)->listObjectsV2(['Bucket' => $storage->bucket, 'Prefix' => self::PREFIX, 'MaxKeys' => 1]);
+        } catch (S3Exception $e) {
+            if ($e->getResponse() === null && $e->getAwsErrorCode() === null) {
+                throw new RuntimeException('Could not connect to "'.$storage->name.'". Check the endpoint. Your servers and browsers must reach it too. Error: '.$e->getMessage(), previous: $e);
+            }
+
+            return;
+        } catch (\Throwable $e) {
+            throw new RuntimeException('Could not connect to "'.$storage->name.'". Check the endpoint. Your servers and browsers must reach it too. Error: '.$e->getMessage(), previous: $e);
+        }
+
+        throw new RuntimeException('Bucket "'.$storage->bucket.'" allows anonymous listing. Make the bucket private before you use it for file downloads.');
+    }
+
+    protected function anonymousClient(S3Storage $storage): S3Client
+    {
+        return new S3Client([
+            'version' => 'latest',
+            'region' => $storage->region,
+            'endpoint' => $storage->endpoint,
+            'use_path_style_endpoint' => true,
+            'credentials' => false,
+            'retries' => 0,
+            'http' => array_merge(SafeWebhookUrl::httpClientOptions($storage->endpoint, $storage->trustedInternalHosts()), [
+                'connect_timeout' => 15,
+                'timeout' => 15,
+            ]),
+        ]);
+    }
+
+    /**
+     * @return array{url: string, headers: array<string, string>}
+     */
+    public function uploadUrl(S3Storage $storage, string $key, string $downloadName): array
+    {
+        $upload = $storage->filesystem()->temporaryUploadUrl($key, now()->addHour(), [
+            'ContentDisposition' => self::contentDisposition($downloadName),
+        ]);
+
+        return [
+            'url' => $upload['url'],
+            'headers' => collect($upload['headers'])
+                ->map(fn ($value) => is_array($value) ? implode(', ', $value) : (string) $value)
+                ->except(['Host', 'host'])
+                ->all(),
+        ];
+    }
+
+    public function downloadUrl(S3Storage $storage, string $key): string
+    {
+        return $storage->filesystem()->temporaryUrl($key, now()->addMinutes(self::LINK_TTL_MINUTES));
+    }
+
+    public function delete(S3Storage $storage, string $key): void
+    {
+        $storage->filesystem()->delete($key);
+    }
+
+    /**
+     * Size in bytes of a file on the server host (for example a backup), or
+     * null when the file does not exist.
+     */
+    public static function hostFileSize(Server $server, string $path): ?int
+    {
+        $size = trim((string) instant_remote_process([self::buildHostFileSizeCommand($path)], $server));
+
+        return ctype_digit($size) ? (int) $size : null;
+    }
+
+    public static function buildHostFileSizeCommand(string $path): string
+    {
+        validateShellSafePath($path, 'download path');
+        $escaped = escapeshellarg($path);
+
+        return 'sh -c '.escapeshellarg('if [ -f '.$escaped.' ]; then stat -L -c %s '.$escaped.'; fi');
+    }
+
+    /**
+     * PUT a file on the server host to a presigned S3 URL.
+     *
+     * @param  array<string, string>  $headers
+     */
+    public static function buildHostFileUploadCommand(string $path, string $url, array $headers): string
+    {
+        validateShellSafePath($path, 'download path');
+
+        return 'sh -c '.escapeshellarg('curl -fsS --retry 2 '.self::curlHeaderArgs($headers).' -T '.escapeshellarg($path).' '.escapeshellarg($url));
+    }
+
+    /**
+     * @param  array<string, string>  $headers
+     */
+    public static function curlHeaderArgs(array $headers): string
+    {
+        return collect($headers)
+            ->map(fn (string $value, string $name) => '-H '.escapeshellarg("{$name}: {$value}"))
+            ->implode(' ');
+    }
+
+    public static function contentDisposition(string $name): string
+    {
+        $fallback = preg_replace('/[^A-Za-z0-9._-]/', '_', $name) ?: 'download';
+
+        return 'attachment; filename="'.$fallback.'"; filename*=UTF-8\'\''.rawurlencode($name);
+    }
+}
diff --git a/app/Services/FleetMetricsAggregator.php b/app/Services/FleetMetricsAggregator.php
new file mode 100644
index 0000000000..29e0459d3b
--- /dev/null
+++ b/app/Services/FleetMetricsAggregator.php
@@ -0,0 +1,136 @@
+<?php
+
+namespace App\Services;
+
+use App\Support\Metrics\PressureLevel;
+
+class FleetMetricsAggregator
+{
+    /**
+     * @param  array<int, array<string, mixed>>  $rows
+     * @return array<string, mixed>
+     */
+    public static function fleetKpis(array $rows): array
+    {
+        $online = array_values(array_filter($rows, fn ($r) => $r['online'] === true));
+
+        $cpuValues = self::present($online, 'cpu');
+        $cpuAvg = $cpuValues === [] ? 0.0 : round(array_sum($cpuValues) / count($cpuValues), 1);
+
+        $busiest = null;
+        foreach ($online as $r) {
+            if ($r['cpu'] !== null && ($busiest === null || $r['cpu'] > $busiest['percent'])) {
+                $busiest = ['name' => $r['name'], 'percent' => (float) $r['cpu']];
+            }
+        }
+
+        $memUsed = (int) self::sum($online, 'memUsed');
+        $memTotal = (int) self::sum($online, 'memTotal');
+        $diskUsed = (int) self::sum($online, 'diskUsed');
+        $diskTotal = (int) self::sum($online, 'diskTotal');
+        $load1 = self::present($online, 'load1');
+
+        $needsAttention = 0;
+        foreach ($online as $r) {
+            $hot = PressureLevel::for($r['cpu'], 'cpu') !== 'ok'
+                || PressureLevel::for(self::percent($r['memUsed'], $r['memTotal']), 'memory') !== 'ok'
+                || PressureLevel::for($r['diskPercent'], 'disk') !== 'ok';
+            if ($hot) {
+                $needsAttention++;
+            }
+        }
+
+        return [
+            'serversOnline' => count($online),
+            'serversTotal' => count($rows),
+            'needsAttention' => $needsAttention,
+            'cpuAvg' => $cpuAvg,
+            'cpuApproximate' => count($cpuValues) > 1,
+            'cpuBusiest' => $busiest,
+            'memUsed' => $memUsed,
+            'memTotal' => $memTotal,
+            'memPercent' => self::percent($memUsed, $memTotal),
+            'diskUsed' => $diskUsed,
+            'diskTotal' => $diskTotal,
+            'diskPercent' => self::percent($diskUsed, $diskTotal),
+            'netRx' => (float) self::sum($online, 'netRx'),
+            'netTx' => (float) self::sum($online, 'netTx'),
+            'loadBusiest' => $load1 === [] ? 0.0 : max($load1),
+            'loadAvg' => $load1 === [] ? 0.0 : round(array_sum($load1) / count($load1), 2),
+            'containers' => (int) self::sum($online, 'containers'),
+        ];
+    }
+
+    /**
+     * @param  array<int, array<int, array{0: int, 1: float}>>  $seriesPerServer
+     * @return array<int, array{0: int, 1: float}>
+     */
+    public static function sumSeriesByBucket(array $seriesPerServer, string $mode): array
+    {
+        $totals = [];
+        $counts = [];
+
+        foreach ($seriesPerServer as $series) {
+            foreach ($series as [$ts, $value]) {
+                $totals[$ts] = ($totals[$ts] ?? 0.0) + (float) $value;
+                $counts[$ts] = ($counts[$ts] ?? 0) + 1;
+            }
+        }
+
+        ksort($totals);
+
+        $out = [];
+        foreach ($totals as $ts => $sum) {
+            $out[] = [(int) $ts, $mode === 'avg' ? round($sum / $counts[$ts], 2) : round($sum, 2)];
+        }
+
+        return $out;
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $containers
+     * @return array<int, array<string, mixed>>
+     */
+    public static function rankContainers(array $containers, string $metric, int $limit = 20): array
+    {
+        $key = match ($metric) {
+            'memory' => 'memUsed',
+            'disk' => 'diskBytes',
+            'network' => 'net',
+            default => 'cpu',
+        };
+
+        usort($containers, fn ($a, $b) => ($b[$key] ?? 0) <=> ($a[$key] ?? 0));
+
+        return array_slice($containers, 0, $limit);
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $rows
+     * @return array<int, float>
+     */
+    private static function present(array $rows, string $key): array
+    {
+        return array_values(array_map(
+            fn ($r) => (float) $r[$key],
+            array_filter($rows, fn ($r) => $r[$key] !== null)
+        ));
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $rows
+     */
+    private static function sum(array $rows, string $key): float
+    {
+        return array_sum(array_map(fn ($r) => $r[$key] ?? 0, $rows));
+    }
+
+    private static function percent(int|float|null $used, int|float|null $total): float
+    {
+        if (! $total) {
+            return 0.0;
+        }
+
+        return round(($used / $total) * 100, 1);
+    }
+}
diff --git a/app/Services/HostingerService.php b/app/Services/HostingerService.php
new file mode 100644
index 0000000000..d90f28ef27
--- /dev/null
+++ b/app/Services/HostingerService.php
@@ -0,0 +1,224 @@
+<?php
+
+namespace App\Services;
+
+use App\Exceptions\RateLimitException;
+use Illuminate\Http\Client\RequestException;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Http;
+
+class HostingerService
+{
+    private string $baseUrl = 'https://developers.hostinger.com';
+
+    public function __construct(private string $token) {}
+
+    private function request(string $method, string $endpoint, array $data = []): array
+    {
+        $response = Http::withToken($this->token)
+            ->acceptJson()
+            ->asJson()
+            ->timeout(30)
+            ->connectTimeout(10)
+            ->retry(
+                $method === 'get' ? 3 : 1,
+                fn (int $attempt) => $attempt * 100,
+                fn (\Exception $exception) => ! $exception instanceof RequestException || $exception->response->serverError(),
+                throw: false
+            )
+            ->{$method}($this->baseUrl.$endpoint, $data);
+
+        if (! $response->successful()) {
+            if ($response->status() === 429) {
+                throw new RateLimitException(
+                    'Rate limit exceeded. Please try again later.',
+                    $response->header('Retry-After') !== null ? (int) $response->header('Retry-After') : null
+                );
+            }
+
+            $message = $response->json('message')
+                ?? $response->json('error')
+                ?? 'Unknown error';
+
+            throw new \Exception('Hostinger API error: '.$message, $response->status());
+        }
+
+        return $response->json() ?? [];
+    }
+
+    public function getDataCenters(): array
+    {
+        return $this->request('get', '/api/vps/v1/data-centers');
+    }
+
+    public function getTemplates(): array
+    {
+        return $this->request('get', '/api/vps/v1/templates');
+    }
+
+    /**
+     * Get the KVM VPS plans. Game Panel plans share the VPS category but are not offered for Coolify servers.
+     */
+    public function getCatalogItems(): array
+    {
+        return collect($this->request('get', '/api/billing/v1/catalog', ['category' => 'VPS']))
+            ->filter(fn ($item) => is_array($item) && preg_match('/-vps-kvm\d+$/', (string) ($item['id'] ?? '')) === 1)
+            ->values()
+            ->all();
+    }
+
+    public function getPublicKeys(): array
+    {
+        return $this->request('get', '/api/vps/v1/public-keys')['data'] ?? [];
+    }
+
+    public function getPostInstallScripts(): array
+    {
+        return $this->request('get', '/api/vps/v1/post-install-scripts')['data'] ?? [];
+    }
+
+    public function attachPublicKeys(int $virtualMachineId, array $publicKeyIds): array
+    {
+        return $this->request('post', "/api/vps/v1/public-keys/attach/{$virtualMachineId}", [
+            'ids' => array_map('intval', array_values($publicKeyIds)),
+        ]);
+    }
+
+    public function purchaseVirtualMachine(array $params): array
+    {
+        // Hostinger accepts only a fully qualified hostname and uses its own default otherwise.
+        if (! str_contains($params['setup']['hostname'] ?? '', '.')) {
+            unset($params['setup']['hostname']);
+        }
+
+        $existingVirtualMachineIds = collect($this->getVirtualMachines())->pluck('id')->all();
+
+        try {
+            $response = $this->request('post', '/api/vps/v1/virtual-machines', $params);
+        } catch (\Throwable $e) {
+            // Hostinger can charge for the VPS before its setup fails, so keep the VPS if one was created.
+            $virtualMachine = $this->findPurchasedVirtualMachine($existingVirtualMachineIds);
+            if (! $virtualMachine) {
+                throw $e;
+            }
+
+            logger()->warning('Hostinger charged for a VPS but its setup failed', [
+                'hostinger_virtual_machine_id' => $virtualMachine['id'],
+                'error' => $e->getMessage(),
+            ]);
+
+            return $this->setupPurchasedVirtualMachine($virtualMachine, $params['setup']);
+        }
+
+        if (empty($response['virtual_machine']['id'])) {
+            logger()->warning('Hostinger VPS order did not return a virtual machine', Arr::only($response, ['id', 'subscription_id', 'status', 'message']));
+
+            throw new \Exception('Hostinger order '.($response['id'] ?? 'unknown').' is waiting for payment. Finish the VPS setup in hPanel.', 202);
+        }
+
+        return $response['virtual_machine'];
+    }
+
+    private function findPurchasedVirtualMachine(array $existingVirtualMachineIds): ?array
+    {
+        try {
+            return collect($this->getVirtualMachines())
+                ->first(fn (array $virtualMachine) => ! in_array($virtualMachine['id'] ?? null, $existingVirtualMachineIds, true));
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+
+    private function setupPurchasedVirtualMachine(array $virtualMachine, array $setup): array
+    {
+        if (($virtualMachine['state'] ?? null) !== 'initial') {
+            return $virtualMachine;
+        }
+
+        try {
+            return $this->request('post', $this->virtualMachineEndpoint((int) $virtualMachine['id']).'/setup', $setup);
+        } catch (\Throwable $e) {
+            logger()->warning('Hostinger VPS setup retry failed', [
+                'hostinger_virtual_machine_id' => $virtualMachine['id'],
+                'error' => $e->getMessage(),
+            ]);
+
+            return $virtualMachine;
+        }
+    }
+
+    public function getVirtualMachine(int $virtualMachineId): array
+    {
+        return $this->request('get', $this->virtualMachineEndpoint($virtualMachineId));
+    }
+
+    public function getVirtualMachines(): array
+    {
+        return $this->request('get', '/api/vps/v1/virtual-machines');
+    }
+
+    /**
+     * Briefly wait for a public IP. VPS setup usually takes longer, so the server status check fills in the IP later.
+     */
+    public function waitForPublicIp(array $virtualMachine, int $attempts = 10, int $sleepMilliseconds = 1000): array
+    {
+        if ($this->getPublicIpAddress($virtualMachine) || empty($virtualMachine['id'])) {
+            return $virtualMachine;
+        }
+
+        for ($attempt = 0; $attempt < $attempts; $attempt++) {
+            usleep($sleepMilliseconds * 1000);
+
+            $virtualMachine = $this->getVirtualMachine((int) $virtualMachine['id']);
+
+            if ($this->getPublicIpAddress($virtualMachine)) {
+                return $virtualMachine;
+            }
+        }
+
+        return $virtualMachine;
+    }
+
+    public function getPublicIpAddress(array $virtualMachine): ?string
+    {
+        foreach (['ipv4', 'ipv6'] as $version) {
+            foreach ($virtualMachine[$version] ?? [] as $ipAddress) {
+                if (filled($ipAddress['address'] ?? null)) {
+                    return $ipAddress['address'];
+                }
+            }
+        }
+
+        return null;
+    }
+
+    public function disableAutoRenewal(string $subscriptionId): array
+    {
+        return $this->request('delete', "/api/billing/v1/subscriptions/{$subscriptionId}/auto-renewal/disable");
+    }
+
+    public function startVirtualMachine(int $virtualMachineId): array
+    {
+        return $this->request('post', $this->virtualMachineEndpoint($virtualMachineId).'/start');
+    }
+
+    public function findVirtualMachineByIp(string $ip): ?array
+    {
+        foreach ($this->getVirtualMachines() as $virtualMachine) {
+            foreach (['ipv4', 'ipv6'] as $version) {
+                foreach ($virtualMachine[$version] ?? [] as $ipAddress) {
+                    if (($ipAddress['address'] ?? null) === $ip) {
+                        return $virtualMachine;
+                    }
+                }
+            }
+        }
+
+        return null;
+    }
+
+    private function virtualMachineEndpoint(int $virtualMachineId): string
+    {
+        return '/api/vps/v1/virtual-machines/'.$virtualMachineId;
+    }
+}
diff --git a/app/Services/ProjectCanvas.php b/app/Services/ProjectCanvas.php
new file mode 100644
index 0000000000..57619b2e30
--- /dev/null
+++ b/app/Services/ProjectCanvas.php
@@ -0,0 +1,136 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\ResourceLink;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+
+/**
+ * Builds the project canvas: every resource of the project's environments, one zone per server,
+ * grouped by environment. Cards keep the positions and links saved on their environment canvas;
+ * admins change them through the environment canvas endpoints of each card.
+ */
+class ProjectCanvas
+{
+    public function __construct(private EnvironmentCanvas $canvas, private ServerCanvas $servers) {}
+
+    /**
+     * The canvas of every project of a team: one zone per project, cards grouped by environment.
+     *
+     * @return array{title: string, title_link: string, can_edit: bool, can_move: false, can_move_groups: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array{}}
+     */
+    public function teamPayload(int $teamId, bool $canReadSensitive, bool $canEdit = false): array
+    {
+        $projects = Project::query()->where('team_id', $teamId)->orderBy('name')->get(['id', 'uuid', 'name', 'team_id']);
+        $environments = Environment::query()->whereIn('project_id', $projects->pluck('id'))
+            ->orderBy('id')
+            ->get(['id', 'uuid', 'name', 'project_id']);
+        $resources = $this->servers->loadResources($environments->pluck('id'));
+        $links = ResourceLink::query()->whereIn('environment_id', $environments->pluck('id'))->orderBy('id')->get();
+        $graph = $this->canvas->graph($resources, $links, $canReadSensitive);
+
+        $grouping = $resources->map(fn (Model $resource) => [
+            'zone' => $resource->environment->project->uuid,
+            'extra_zones' => [],
+            'context' => $resource->environment->name,
+            'context_link' => route('project.resource.index', ['project_uuid' => $resource->environment->project->uuid, 'environment_uuid' => $resource->environment->uuid]),
+            ...$this->owner($resource),
+        ]);
+
+        return [
+            'title' => 'Projects',
+            'title_link' => route('project.index'),
+            'can_edit' => $canEdit,
+            // Environment groups and cards keep their environment canvas arrangement.
+            'can_move' => false,
+            // Admins move groups and cards here; the canvas saves them on their environment canvas.
+            'can_move_groups' => $canEdit,
+            // Same grouped layout as the server canvas, with projects as the zones.
+            'layout' => 'server',
+            'zones' => $projects->map(fn (Project $project) => [
+                'id' => $project->uuid,
+                'name' => $project->name,
+                'icon' => 'projects',
+                'link' => route('project.show', ['project_uuid' => $project->uuid]),
+            ])->values()->all(),
+            'nodes' => collect($graph['nodes'])->map(fn (array $node) => [...$node, ...$grouping->get($node['id'])])
+                ->concat($projects->flatMap(fn (Project $project) => $this->emptyNodes($project, $environments->where('project_id', $project->id), $resources, $project->uuid, $canEdit)))
+                ->values()->all(),
+            'links' => $graph['links'],
+            'positions' => [],
+        ];
+    }
+
+    /**
+     * @return array{title: string, title_link: string, can_edit: bool, can_move: false, can_move_groups: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array{}}
+     */
+    public function payload(Project $project, bool $canReadSensitive, bool $canEdit = false): array
+    {
+        $environments = $project->environments()->orderBy('id')->get(['id', 'uuid', 'name', 'project_id']);
+        $resources = $this->servers->loadResources($environments->pluck('id'));
+        $links = ResourceLink::query()->whereIn('environment_id', $environments->pluck('id'))->orderBy('id')->get();
+        $graph = $this->canvas->graph($resources, $links, $canReadSensitive);
+
+        $context = $resources->map(fn (Model $resource) => [
+            'context' => $resource->environment->name,
+            'context_link' => route('project.resource.index', ['project_uuid' => $project->uuid, 'environment_uuid' => $resource->environment->uuid]),
+            ...$this->owner($resource),
+        ]);
+        $nodes = collect($graph['nodes'])->map(fn (array $node) => [...$node, ...$context->get($node['id'])]);
+        // Placeholder cards sit on the server of the project's other environments.
+        $zone = $this->canvas->projectZones($nodes, $graph['zones'][0]['id'] ?? EnvironmentCanvas::EMPTY_ZONE)($project);
+        $empty = $this->emptyNodes($project, $environments, $resources, $zone, $canEdit);
+
+        return [
+            'title' => $project->name,
+            'title_link' => route('project.show', ['project_uuid' => $project->uuid]),
+            'can_edit' => $canEdit,
+            'can_move' => false,
+            // Admins move groups and cards here; the canvas saves them on their environment canvas.
+            'can_move_groups' => $canEdit,
+            // Groups cards by environment inside each server zone, like the server canvas.
+            'layout' => 'server',
+            'zones' => $empty->isNotEmpty() && $zone === EnvironmentCanvas::EMPTY_ZONE ? [...$graph['zones'], $this->canvas->emptyZone()] : $graph['zones'],
+            'nodes' => $nodes->concat($empty)->values()->all(),
+            'links' => $graph['links'],
+            'positions' => [],
+        ];
+    }
+
+    /**
+     * Placeholder cards of the project's environments without resources, or one for the project when it has no environments.
+     *
+     * @param  Collection<int, Environment>  $environments  environments of the project
+     * @param  Collection<string, Model>  $resources
+     * @return Collection<int, array<string, mixed>>
+     */
+    private function emptyNodes(Project $project, Collection $environments, Collection $resources, string $zone, bool $canAdd): Collection
+    {
+        if ($environments->isEmpty()) {
+            return collect([$this->canvas->emptyNode($project, null, $zone, 'No environments')]);
+        }
+
+        $used = $resources->pluck('environment_id')->flip();
+
+        return $environments
+            ->reject(fn (Environment $environment) => $used->has($environment->id))
+            ->map(fn (Environment $environment) => $this->canvas->emptyNode($project, $environment, $zone, $environment->name, $canAdd))
+            ->values();
+    }
+
+    /**
+     * Project and environment of a card: the canvas saves links on that environment canvas.
+     *
+     * @return array{project: array{uuid: string, name: string}, environment: array{uuid: string, name: string}}
+     */
+    private function owner(Model $resource): array
+    {
+        return [
+            'project' => ['uuid' => $resource->environment->project->uuid, 'name' => $resource->environment->project->name],
+            'environment' => ['uuid' => $resource->environment->uuid, 'name' => $resource->environment->name],
+        ];
+    }
+}
diff --git a/app/Services/ProjectIconStorageService.php b/app/Services/ProjectIconStorageService.php
index b7a381e109..0c6d314816 100644
--- a/app/Services/ProjectIconStorageService.php
+++ b/app/Services/ProjectIconStorageService.php
@@ -9,6 +9,14 @@ use RuntimeException;
 class ProjectIconStorageService extends AvatarStorageService
 {
     public function storeProject(Project $project, UploadedFile $upload): void
+    {
+        $this->storeProjectContents($project, $this->compress($upload));
+    }
+
+    /**
+     * Stores an icon that is already a compressed JPEG, for example one from a server transfer bundle.
+     */
+    public function storeProjectContents(Project $project, string $contents): void
     {
         $settings = instanceSettings();
         $storageType = $settings->avatar_storage_type === 's3' && $settings->avatar_s3_storage_id ? 's3' : 'local';
@@ -16,7 +24,7 @@ class ProjectIconStorageService extends AvatarStorageService
         $disk = $this->disk($storageType, $s3StorageId);
         $path = "project-icons/{$project->uuid}/icon.jpg";
 
-        if (! $disk->put($path, $this->compress($upload))) {
+        if (! $disk->put($path, $contents)) {
             throw new RuntimeException('Unable to store the project icon.');
         }
 
diff --git a/app/Services/RepositoryDetector.php b/app/Services/RepositoryDetector.php
new file mode 100644
index 0000000000..371f15908e
--- /dev/null
+++ b/app/Services/RepositoryDetector.php
@@ -0,0 +1,129 @@
+<?php
+
+namespace App\Services;
+
+use App\Data\RepositoryDetectionResult;
+use App\Models\Application;
+use App\Models\Server;
+use Illuminate\Support\Collection;
+use RuntimeException;
+
+class RepositoryDetector
+{
+    /**
+     * Largest env template that is read from the repository, in bytes.
+     */
+    private const MAX_ENV_FILE_BYTES = 65536;
+
+    /**
+     * @param  Application  $application  Unsaved application with the repository, branch, and Git source or deploy key.
+     */
+    public function __construct(
+        private Application $application,
+        private string $baseDirectory,
+        private Server $server,
+    ) {}
+
+    /**
+     * @throws RuntimeException When the repository cannot be read.
+     */
+    public function detect(): RepositoryDetectionResult
+    {
+        $uuid = new_public_id();
+
+        try {
+            $output = instant_remote_process($this->scanCommands($uuid), $this->server, timeout: 60);
+        } finally {
+            instant_remote_process(["rm -rf /tmp/{$uuid}"], $this->server, false);
+        }
+
+        return $this->parseOutput((string) str($output)->trim()->afterLast("\n"));
+    }
+
+    /**
+     * Clones the repository without a checkout and lists the files with `git ls-tree`, so no file is
+     * written to the disk. Each command is one line because non-root servers send every line through
+     * parseCommandsByLineForSudo().
+     *
+     * @return Collection<int, string>
+     */
+    protected function scanCommands(string $uuid): Collection
+    {
+        $checkoutDir = "/tmp/{$uuid}/checkout";
+        $baseDir = trim($this->baseDirectory, '/');
+        if (preg_match('~(^|/)\.\.?(/|$)~', $baseDir) || ! preg_match('~^[a-zA-Z0-9_./-]*$~', $baseDir)) {
+            throw new RuntimeException('Invalid repository base directory.');
+        }
+        $tree = escapeshellarg($baseDir === '' ? 'HEAD' : "HEAD:{$baseDir}");
+        $maxEnvBytes = self::MAX_ENV_FILE_BYTES;
+
+        $classifyFiles = <<<'AWK'
+{ split($1, meta, " "); if (meta[1] != "100644" && meta[1] != "100755") next; path = $2; lower = tolower(path); name = lower; sub(/.*\//, "", name); if (name ~ /^dockerfile(\.[a-z0-9_-]+)?$/) kind = "dockerfile"; else if (name ~ /^(docker-)?compose\.ya?ml$/) kind = "compose"; else if (lower ~ /^\.env\.(example|sample|template|dist|local\.example)$/) kind = "env"; else next; print kind "\t" meta[3] "\t" path }
+AWK;
+        $exposedPort = <<<'AWK'
+{ sub(/\r$/, "") } toupper($1) == "EXPOSE" { split($2, p, "/"); if (p[1] ~ /^[0-9]+$/ && p[1] + 0 > 0 && p[1] + 0 <= 65535) print p[1] + 0; exit }
+AWK;
+        $summary = '{dockerfiles: map(select(.kind == "dockerfile") | .file), dockerComposeFiles: map(select(.kind == "compose") | .file), envFiles: (map(select(.kind == "env") | {(.file): .content}) | add // {}), dockerfilePorts: (map(select(.kind == "dockerfile") | {(.file): .port}) | add // {})}';
+
+        $scan = 'tab=$(printf "\t"); '
+            ."git -c core.quotePath=false ls-tree -r {$tree} | awk -F '\\t' ".escapeshellarg($classifyFiles)
+            .' | while IFS="$tab" read -r kind object file; do case "$kind" in '
+            .'dockerfile) port=$(git cat-file blob "$object" | awk '.escapeshellarg($exposedPort).'); '
+            .'jq -nc --arg file "$file" --argjson port "${port:-null}" \'{kind: "dockerfile", file: $file, port: $port}\' ;; '
+            .'compose) jq -nc --arg file "$file" \'{kind: "compose", file: $file}\' ;; '
+            ."env) git cat-file blob \"\$object\" | head -c {$maxEnvBytes} | jq -Rsc --arg file \"\$file\" '{kind: \"env\", file: \$file, content: .}' ;; "
+            .'esac; done | jq -sc '.escapeshellarg($summary);
+
+        return collect([
+            "rm -rf /tmp/{$uuid}",
+            "mkdir -p /tmp/{$uuid}",
+            "cd /tmp/{$uuid}",
+            'sh -c '.escapeshellarg($this->application->serverCheckoutCommand($uuid, $checkoutDir)),
+            "cd {$checkoutDir}",
+            'sh -c '.escapeshellarg($scan),
+        ]);
+    }
+
+    protected function parseOutput(string $output): RepositoryDetectionResult
+    {
+        $data = json_decode(trim($output), true);
+
+        if (! is_array($data)) {
+            return RepositoryDetectionResult::none();
+        }
+
+        foreach (['dockerfiles', 'dockerComposeFiles', 'envFiles', 'dockerfilePorts'] as $key) {
+            if (isset($data[$key]) && ! is_array($data[$key])) {
+                return RepositoryDetectionResult::none();
+            }
+        }
+
+        $dockerfilePorts = [];
+        foreach ($data['dockerfilePorts'] ?? [] as $file => $port) {
+            $dockerfilePorts[$file] = (is_int($port) || (is_string($port) && ctype_digit($port))) && (int) $port > 0 && (int) $port <= 65535 ? (int) $port : null;
+        }
+
+        return new RepositoryDetectionResult(
+            dockerfiles: $this->sortByPreference(array_filter($data['dockerfiles'] ?? [], 'is_string'), '/^dockerfile$/i'),
+            dockerComposeFiles: $this->sortByPreference(array_filter($data['dockerComposeFiles'] ?? [], 'is_string'), '/^docker-compose\.ya?ml$/i'),
+            envFiles: array_filter($data['envFiles'] ?? [], fn ($content) => is_string($content) || $content === null),
+            dockerfilePorts: $dockerfilePorts,
+        );
+    }
+
+    /**
+     * Puts the file nearest to the base directory first. At the same depth, a file with the default
+     * name (for example `Dockerfile`) comes before a variant. Other files keep the scan order.
+     *
+     * @param  array<int|string, string>  $files
+     * @return array<int, string>
+     */
+    private function sortByPreference(array $files, string $defaultNamePattern): array
+    {
+        $files = array_values($files);
+        usort($files, fn (string $a, string $b): int => [substr_count($a, '/'), ! preg_match($defaultNamePattern, basename($a))]
+            <=> [substr_count($b, '/'), ! preg_match($defaultNamePattern, basename($b))]);
+
+        return $files;
+    }
+}
diff --git a/app/Services/Security/SensitiveDataRedactor.php b/app/Services/Security/SensitiveDataRedactor.php
new file mode 100644
index 0000000000..df9495868c
--- /dev/null
+++ b/app/Services/Security/SensitiveDataRedactor.php
@@ -0,0 +1,326 @@
+<?php
+
+namespace App\Services\Security;
+
+use DateTimeInterface;
+use Illuminate\Contracts\Support\Arrayable;
+use JsonSerializable;
+use RuntimeException;
+use Stringable;
+use Throwable;
+use UnitEnum;
+
+final class SensitiveDataRedactor
+{
+    public const FAILURE_MESSAGE = '[LOG SUPPRESSED: REDACTION FAILED]';
+
+    private const CHUNK_BYTES = 262144;
+
+    private const MIN_KNOWN_SECRET_LENGTH = 8;
+
+    private const EMAIL_PATTERN = '/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}/';
+
+    private bool $redactEmails = true;
+
+    private const SENSITIVE_KEYS = ['password', 'passwd', 'secret', 'client_secret', 'api_key', 'apikey', 'access_key', 'private_key', 'token', 'access_token', 'refresh_token', 'auth_token', 'authorization', 'proxy_authorization', 'cookie', 'set_cookie', 'webhook_secret', 'signing_secret', 'credential', 'credentials', 'connection_string', 'database_url'];
+
+    /**
+     * Return a copy that keeps email addresses, for sinks such as the audit log that must record who acted.
+     */
+    public function withoutEmailRedaction(): self
+    {
+        $redactor = clone $this;
+        $redactor->redactEmails = false;
+
+        return $redactor;
+    }
+
+    /**
+     * Tell if redactText() would hide one of these known secrets in the text.
+     *
+     * @param  array<array-key, mixed>  $knownSecrets
+     */
+    public function containsKnownSecret(string $text, array $knownSecrets): bool
+    {
+        foreach ($knownSecrets as $secret) {
+            if (is_scalar($secret) && trim((string) $secret) !== '' && strlen((string) $secret) >= self::MIN_KNOWN_SECRET_LENGTH && str_contains($text, (string) $secret)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @param  array<array-key, mixed>  $knownSecrets  Exact values to replace when they are long enough to be safe to match, such as unlocked environment values.
+     * @param  array<array-key, mixed>  $lockedSecrets  Exact values to always replace, whatever their length, such as locked or remote secrets.
+     */
+    public function redactText(string $text, array $knownSecrets = [], array $lockedSecrets = []): string
+    {
+        try {
+            $text = $this->normalizeText($text);
+            $text = $this->replaceKnownSecrets($text, $knownSecrets, $lockedSecrets);
+
+            $redacted = '';
+            foreach ($this->chunks($text) as $chunk) {
+                $redacted .= $this->redactChunk($chunk);
+            }
+
+            return $redacted;
+        } catch (Throwable) {
+            return self::FAILURE_MESSAGE;
+        }
+    }
+
+    /**
+     * @param  array<array-key, mixed>  $knownSecrets
+     */
+    public function redactValue(mixed $value, array $knownSecrets = [], ?string $key = null): mixed
+    {
+        try {
+            if ($key !== null && $this->isSensitiveKey($key)) {
+                return REDACTED;
+            }
+            if (is_array($value)) {
+                $redacted = [];
+                foreach ($value as $itemKey => $itemValue) {
+                    $redacted[$itemKey] = $this->redactValue($itemValue, $knownSecrets, is_string($itemKey) ? $itemKey : null);
+                }
+
+                return $redacted;
+            }
+            if (is_string($value)) {
+                return $this->redactText($value, $knownSecrets);
+            }
+            if (! is_object($value) || $value instanceof UnitEnum || $value instanceof DateTimeInterface) {
+                return $value;
+            }
+            if ($value instanceof Arrayable) {
+                return $this->redactValue($value->toArray(), $knownSecrets);
+            }
+            if ($value instanceof JsonSerializable) {
+                return $this->redactValue($value->jsonSerialize(), $knownSecrets);
+            }
+            if ($value instanceof Stringable) {
+                return $this->redactText((string) $value, $knownSecrets);
+            }
+
+            return '[object '.$value::class.']';
+        } catch (Throwable) {
+            return self::FAILURE_MESSAGE;
+        }
+    }
+
+    /**
+     * Redact one chunk. When a pattern hits a PCRE limit, redact the chunk line by line so one huge line
+     * or an unterminated private key does not suppress the whole log. A line that still fails is suppressed.
+     */
+    private function redactChunk(string $chunk): string
+    {
+        try {
+            return $this->redactAssignments($this->redactPatterns($chunk));
+        } catch (RuntimeException) {
+            $redacted = '';
+            $insidePrivateKey = false;
+            foreach (preg_split('/(?<=\n)/', $chunk) ?: [$chunk] as $line) {
+                if (! $insidePrivateKey && preg_match('/-----BEGIN [A-Z ]*PRIVATE KEY-----/', $line) === 1 && preg_match('/-----END [A-Z ]*PRIVATE KEY-----/', $line) !== 1) {
+                    $insidePrivateKey = true;
+                    $redacted .= REDACTED.(str_ends_with($line, "\n") ? "\n" : '');
+
+                    continue;
+                }
+                if ($insidePrivateKey) {
+                    $insidePrivateKey = preg_match('/-----END [A-Z ]*PRIVATE KEY-----/', $line) !== 1;
+
+                    continue;
+                }
+                try {
+                    $redacted .= $this->redactAssignments($this->redactPatterns($line));
+                } catch (RuntimeException) {
+                    $redacted .= self::FAILURE_MESSAGE.(str_ends_with($line, "\n") ? "\n" : '');
+                }
+            }
+
+            return $redacted;
+        }
+    }
+
+    private function normalizeText(string $text): string
+    {
+        $text = sanitize_utf8_text($text);
+        $text = preg_replace('/\x1B(?:[@-Z\\-_]|\[[0-?]*[ -\/]*[@-~])/', '', $text);
+        if ($text === null) {
+            throw new RuntimeException('Log normalization failed.');
+        }
+        $text = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $text);
+        if ($text === null) {
+            throw new RuntimeException('Log normalization failed.');
+        }
+
+        return $text;
+    }
+
+    /**
+     * Split large text on line boundaries so the regular expressions stay inside PCRE limits.
+     * A chunk never ends inside a private key block.
+     *
+     * @return iterable<int, string>
+     */
+    private function chunks(string $text): iterable
+    {
+        $length = strlen($text);
+        $offset = 0;
+        while ($offset < $length) {
+            $end = $this->lineEnd($text, $offset + self::CHUNK_BYTES);
+            $chunk = substr($text, $offset, $end - $offset);
+            if (preg_match('/-----BEGIN [A-Z ]*PRIVATE KEY-----(?![\s\S]*-----END [A-Z ]*PRIVATE KEY-----)/', $chunk) === 1) {
+                $end = preg_match('/-----END [A-Z ]*PRIVATE KEY-----/', $text, $match, PREG_OFFSET_CAPTURE, $end) === 1
+                    ? $this->lineEnd($text, $match[0][1] + strlen($match[0][0]))
+                    : $length;
+                $chunk = substr($text, $offset, $end - $offset);
+            }
+
+            yield $chunk;
+            $offset = $end;
+        }
+    }
+
+    /**
+     * Find the end of the line that contains $position, without copying the text.
+     */
+    private function lineEnd(string $text, int $position): int
+    {
+        if ($position >= strlen($text)) {
+            return strlen($text);
+        }
+
+        $newline = strpos($text, "\n", $position);
+
+        return $newline === false ? strlen($text) : $newline + 1;
+    }
+
+    /**
+     * @param  array<array-key, mixed>  $knownSecrets
+     * @param  array<array-key, mixed>  $lockedSecrets
+     */
+    private function replaceKnownSecrets(string $text, array $knownSecrets, array $lockedSecrets): string
+    {
+        $variants = [];
+        $shortVariants = [];
+        foreach ([[$knownSecrets, self::MIN_KNOWN_SECRET_LENGTH], [$lockedSecrets, 1]] as [$secrets, $minimumLength]) {
+            foreach ($secrets as $secret) {
+                if (! is_scalar($secret) || trim((string) $secret) === '' || strlen((string) $secret) < $minimumLength) {
+                    continue;
+                }
+                $secret = (string) $secret;
+                $json = json_encode($secret, JSON_THROW_ON_ERROR | JSON_INVALID_UTF8_SUBSTITUTE);
+                // Short locked values such as "ab" would hit inside ordinary words, so they only match as whole tokens.
+                if (strlen($secret) < self::MIN_KNOWN_SECRET_LENGTH) {
+                    array_push($shortVariants, $secret, rawurlencode($secret), substr($json, 1, -1));
+                } else {
+                    array_push($variants, $secret, rawurlencode($secret), substr($json, 1, -1));
+                }
+            }
+        }
+        $byLengthDescending = fn (string $left, string $right): int => strlen($right) <=> strlen($left);
+        $variants = array_values(array_unique(array_filter($variants)));
+        usort($variants, $byLengthDescending);
+        $text = str_replace($variants, REDACTED, $text);
+
+        // The text is valid UTF-8 after normalization, so a variant that is not valid UTF-8 cannot appear in it.
+        $shortVariants = array_values(array_unique(array_filter($shortVariants, fn (string $variant): bool => $variant !== '' && mb_check_encoding($variant, 'UTF-8'))));
+        if ($shortVariants === []) {
+            return $text;
+        }
+        usort($shortVariants, $byLengthDescending);
+        $alternatives = implode('|', array_map(fn (string $variant): string => preg_quote($variant, '/'), $shortVariants));
+        $text = preg_replace('/(?<![\p{L}\p{M}\p{N}_])(?:'.$alternatives.')(?![\p{L}\p{M}\p{N}_])/u', REDACTED, $text);
+        if ($text === null) {
+            throw new RuntimeException('Log redaction failed.');
+        }
+
+        return $text;
+    }
+
+    private function redactAssignments(string $text): string
+    {
+        $assignmentKeys = array_diff(self::SENSITIVE_KEYS, ['authorization', 'proxy_authorization']);
+        $keys = implode('|', array_map(fn (string $key): string => preg_quote($key, '/'), $assignmentKeys));
+        // A key matches when it is a sensitive name or ends with one, such as smtp_password or github-token.
+        $keys = '(?i:(?:[a-z0-9]+[_-])*(?:'.$keys.'))|[A-Z][A-Z0-9_]*(?:SECRET|PASSWORD|TOKEN|PASSWD|API_KEY|PRIVATE_KEY)[A-Z0-9_]*';
+        $value = '(?<value>"(?:[^"\\\\\r\n]|\\\\.)*"|\'(?:[^\'\\\\\r\n]|\\\\.)*\'|[^\s,;}\]]+)';
+        // Skip values that an earlier rule already replaced, such as the token in https://x-access-token:<REDACTED>@host.
+        $alreadyRedacted = '(?!'.preg_quote(REDACTED, '/').')';
+        // Set when nothing but a delimiter follows the value on its line, as in YAML or object literals.
+        $endsValue = '(?<end>(?=[^\S\r\n]*(?:$|[\r\n,;}\]])))?';
+        // A quote that opens before the key and closes after the value wraps the whole assignment, as in
+        // the shell argument 'DB_PASSWORD=a b'. Hide everything up to the closing quote and keep the quote.
+        $text = preg_replace('/(?<![\w-])(["\'])((?:'.$keys.')\s*=\s*)'.$alreadyRedacted.'(?:(?!\1)[^\r\n])*\1/', '$1$2'.REDACTED.'$1', $text);
+        if ($text === null) {
+            throw new RuntimeException('Log redaction failed.');
+        }
+        $result = preg_replace_callback('/(?<![\w-])(?<prefix>["\']?(?<key>'.$keys.')["\']?\s*(?<separator>[=:])\s*)'.$alreadyRedacted.$value.$endsValue.'/m', function (array $match): string {
+            $value = $match['value'];
+            $quote = strlen($value) > 1 && in_array($value[0], ['"', "'"], true) && str_ends_with($value, $value[0]) ? $value[0] : '';
+            // Prose such as "Failed to refresh token: Connection refused" uses a plain word key, a colon, and a plain word value.
+            $isProse = $quote === ''
+                && $match['separator'] === ':'
+                && ! in_array($match['prefix'][0], ['"', "'"], true)
+                && preg_match('/^[A-Za-z][a-z]*$/', $match['key']) === 1
+                && ctype_alpha($value)
+                && $match['end'] === null;
+
+            return $isProse ? $match[0] : $match['prefix'].$quote.REDACTED.$quote;
+        }, $text, flags: PREG_UNMATCHED_AS_NULL);
+        if ($result === null) {
+            throw new RuntimeException('Log redaction failed.');
+        }
+
+        return $result;
+    }
+
+    private function redactPatterns(string $text): string
+    {
+        $patterns = [
+            '/((?:Authorization|Proxy-Authorization)\s*:\s*)[^\r\n]+/i' => '$1'.REDACTED,
+            '/x-access-token:.*?(?=@)/' => 'x-access-token:'.REDACTED,
+            '/oauth2:.*?(?=@)/' => 'oauth2:'.REDACTED,
+            // User and password cannot contain whitespace, so a match never spans log lines.
+            '/((?:https?|postgres|mysql|mongodb|rediss?|mariadb|ftp|sftp|ssh|amqp|amqps|ldap|ldaps|s3):\/\/[^:\s@\/]+:)[^@\s]+(@)/i' => '$1'.REDACTED.'$2',
+            self::EMAIL_PATTERN => REDACTED,
+            '/Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/i' => 'Bearer '.REDACTED,
+            '/Bearer\s+[^\s,;]+/i' => 'Bearer '.REDACTED,
+            '/\bgh[pousr]_[A-Za-z0-9.\-_]{36,}(?![A-Za-z0-9.\-_])/' => REDACTED,
+            '/\b(gl(?:pat|cbt|rt)-[A-Za-z0-9\-_]{20,})\b/' => REDACTED,
+            '/\b(A(?:KIA|BIA|CCA|SIA)[A-Z0-9]{16})\b/' => REDACTED,
+            '/(aws_secret_access_key|AWS_SECRET_ACCESS_KEY)[=:]\s*[\'\"]?([A-Za-z0-9\/+\=]{40})[\'\"]?/i' => '$1='.REDACTED,
+            '/(api[_-]?key|apikey|api[_-]?secret|secret[_-]?key)[=:]\s*[\'\"]?[A-Za-z0-9\-_]{16,}[\'\"]?/i' => '$1='.REDACTED,
+            '/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/' => REDACTED,
+        ];
+        if (! $this->redactEmails) {
+            unset($patterns[self::EMAIL_PATTERN]);
+        }
+
+        foreach ($patterns as $pattern => $replacement) {
+            $text = preg_replace($pattern, $replacement, $text);
+            if ($text === null) {
+                throw new RuntimeException('Log redaction failed.');
+            }
+        }
+
+        return $text;
+    }
+
+    private function isSensitiveKey(string $key): bool
+    {
+        $normalized = strtolower(preg_replace(['/([a-z0-9])([A-Z])/', '/[-\s]+/'], ['$1_$2', '_'], $key) ?? $key);
+
+        foreach (self::SENSITIVE_KEYS as $sensitiveKey) {
+            if ($normalized === $sensitiveKey || str_ends_with($normalized, '_'.$sensitiveKey)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/app/Services/SentinelMetricsClient.php b/app/Services/SentinelMetricsClient.php
new file mode 100644
index 0000000000..7d11edd852
--- /dev/null
+++ b/app/Services/SentinelMetricsClient.php
@@ -0,0 +1,230 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Server;
+use Illuminate\Support\Facades\Cache;
+
+class SentinelMetricsClient
+{
+    private string $base = 'http://localhost:8888/api';
+
+    public function __construct(protected Server $server) {}
+
+    /** Rounded to the minute so the history URL (and its cache key) is stable within a minute. */
+    public static function rangeFrom(string $range): string
+    {
+        $now = now()->startOfMinute();
+
+        $from = match ($range) {
+            '7d' => $now->subDays(7),
+            '30d' => $now->subDays(30),
+            default => $now->subDay(),
+        };
+
+        return $from->toIso8601ZuluString();
+    }
+
+    /** Bucket width per range, kept at roughly 300 points per series. */
+    public static function bucketMs(string $range): int
+    {
+        return match ($range) {
+            '7d' => 30 * 60_000,
+            '30d' => 2 * 60 * 60_000,
+            default => 5 * 60_000,
+        };
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    public function summary(): ?array
+    {
+        try {
+            $json = json_decode($this->raw($this->url('/summary')), true);
+        } catch (\Throwable) {
+            return null;
+        }
+
+        if (! is_array($json)) {
+            return null;
+        }
+
+        $disk = $this->rootMount($json['disk'] ?? []);
+
+        return [
+            'online' => true,
+            'cpu' => isset($json['cpu']['percent']) ? (float) $json['cpu']['percent'] : null,
+            'memUsed' => isset($json['memory']['used']) ? (int) $json['memory']['used'] : null,
+            'memTotal' => isset($json['memory']['total']) ? (int) $json['memory']['total'] : null,
+            'diskUsed' => $disk['used'],
+            'diskTotal' => $disk['total'],
+            'diskPercent' => $disk['percent'],
+            'load1' => isset($json['load']['load1']) ? (float) $json['load']['load1'] : null,
+            'netRx' => isset($json['network']['rxBytesPerSec']) ? (float) $json['network']['rxBytesPerSec'] : null,
+            'netTx' => isset($json['network']['txBytesPerSec']) ? (float) $json['network']['txBytesPerSec'] : null,
+        ];
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    public function containersCurrent(): array
+    {
+        try {
+            $rows = json_decode($this->raw($this->url('/containers/current')), true);
+        } catch (\Throwable) {
+            return [];
+        }
+
+        if (! is_array($rows)) {
+            return [];
+        }
+
+        return array_values(array_map(function ($c) {
+            $disk = ($c['disk']['writableLayer'] ?? 0) + ($c['disk']['volumesTotal'] ?? 0);
+            $net = ($c['network']['rxBytesPerSec'] ?? 0) + ($c['network']['txBytesPerSec'] ?? 0);
+
+            return [
+                'id' => (string) ($c['id'] ?? ''),
+                'cpu' => isset($c['cpu']['percent']) ? (float) $c['cpu']['percent'] : null,
+                'memUsed' => isset($c['memory']['used']) ? (int) $c['memory']['used'] : null,
+                'memPercent' => isset($c['memory']['usedPercent']) ? (float) $c['memory']['usedPercent'] : null,
+                'diskBytes' => isset($c['disk']) ? (int) $disk : null,
+                'net' => isset($c['network']) ? (float) $net : null,
+            ];
+        }, $rows));
+    }
+
+    /**
+     * @return array<int, array{0: int, 1: float}>
+     */
+    public function history(string $metric, string $range): array
+    {
+        [$path, $field] = match ($metric) {
+            'memory' => ['/memory/history', 'used'],
+            'disk' => ['/disk/history', 'usedPercent'],
+            'load' => ['/load/history', 'load1'],
+            default => ['/cpu/history', 'percent'],
+        };
+
+        return $this->seriesRows($this->url($path, ['from' => self::rangeFrom($range)]), $field, $range, $metric === 'disk');
+    }
+
+    /**
+     * @return array{rx: array<int, array{0: int, 1: float}>, tx: array<int, array{0: int, 1: float}>}
+     */
+    public function networkHistory(string $range): array
+    {
+        $url = $this->url('/network/history', ['from' => self::rangeFrom($range)]);
+
+        return [
+            'rx' => $this->seriesRows($url, 'rxBytesPerSec', $range),
+            'tx' => $this->seriesRows($url, 'txBytesPerSec', $range),
+        ];
+    }
+
+    /**
+     * @return array<int, array{0: int, 1: float}>
+     */
+    private function seriesRows(string $url, string $field, string $range, bool $rootOnly = false): array
+    {
+        try {
+            $rows = json_decode($this->raw($url), true);
+        } catch (\Throwable) {
+            return [];
+        }
+
+        if (! is_array($rows)) {
+            return [];
+        }
+
+        // Disk history interleaves every mount; keep the root filesystem only.
+        if ($rootOnly && array_any($rows, fn ($row) => array_key_exists('mount', $row))) {
+            $rows = array_filter($rows, fn ($row) => ($row['mount'] ?? null) === '/');
+        }
+
+        // Average raw samples into epoch-aligned buckets so every server shares the same
+        // timestamps and the fleet aggregator can sum them point by point.
+        $bucketMs = self::bucketMs($range);
+        $sums = [];
+        $counts = [];
+        foreach ($rows as $r) {
+            $bucket = intdiv((int) ($r['time'] ?? 0), $bucketMs) * $bucketMs;
+            $sums[$bucket] = ($sums[$bucket] ?? 0.0) + (float) ($r[$field] ?? 0);
+            $counts[$bucket] = ($counts[$bucket] ?? 0) + 1;
+        }
+        ksort($sums);
+
+        return array_map(fn ($bucket) => [$bucket, round($sums[$bucket] / $counts[$bucket], 2)], array_keys($sums));
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $mounts
+     * @return array{used: ?int, total: ?int, percent: ?float}
+     */
+    private function rootMount(array $mounts): array
+    {
+        $root = collect($mounts)->firstWhere('mount', '/');
+        if ($root === null && ! array_any($mounts, fn ($mount) => array_key_exists('mount', $mount))) {
+            $root = $mounts[0] ?? null;
+        }
+
+        if ($root === null) {
+            return ['used' => null, 'total' => null, 'percent' => null];
+        }
+
+        return [
+            'used' => (int) ($root['used'] ?? 0),
+            'total' => (int) ($root['total'] ?? 0),
+            'percent' => (float) ($root['usedPercent'] ?? 0),
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $query
+     */
+    private function url(string $path, array $query = []): string
+    {
+        $qs = empty($query) ? '' : '?'.str_replace('%3A', ':', http_build_query($query));
+
+        return $this->base.$path.$qs;
+    }
+
+    private function cacheKey(string $url): string
+    {
+        return 'metrics:'.$this->server->uuid.':'.md5($url);
+    }
+
+    protected function raw(string $url): string
+    {
+        return Cache::remember($this->cacheKey($url), 60, fn () => $this->guard($this->remoteFetch($url)));
+    }
+
+    protected function remoteFetch(string $url): string
+    {
+        $token = $this->server->settings->ensureValidSentinelToken();
+
+        return instant_remote_process(
+            ["docker exec coolify-sentinel sh -c 'curl -s --max-time 10 -H \"Authorization: Bearer {$token}\" \"{$url}\"'"],
+            $this->server,
+            false,
+            timeout: 15
+        );
+    }
+
+    private function guard(string $response): string
+    {
+        $payload = json_decode($response, true);
+
+        if ($payload === null) {
+            throw new \RuntimeException('Metrics returned an invalid response.');
+        }
+
+        if (is_array($payload) && array_key_exists('error', $payload)) {
+            throw new \RuntimeException('Metrics request failed.');
+        }
+
+        return $response;
+    }
+}
diff --git a/app/Services/SentinelTrafficClient.php b/app/Services/SentinelTrafficClient.php
index 73c2b70556..1c5c28e2d8 100644
--- a/app/Services/SentinelTrafficClient.php
+++ b/app/Services/SentinelTrafficClient.php
@@ -48,7 +48,7 @@ class SentinelTrafficClient
 
     /** @var array<int, string> */
     private const ALLOWED_DIMENSIONS = [
-        'status', 'method', 'country', 'referer', 'browser', 'os', 'device', 'protocol', 'scheme', 'tls', 'cache', 'bot', 'agent', 'ip', 'useragent',
+        'status', 'method', 'country', 'city', 'referer', 'browser', 'os', 'device', 'protocol', 'scheme', 'tls', 'cache', 'bot', 'agent', 'ip', 'useragent',
     ];
 
     public function __construct(protected Server $server) {}
diff --git a/app/Services/ServerCanvas.php b/app/Services/ServerCanvas.php
new file mode 100644
index 0000000000..5539c481c3
--- /dev/null
+++ b/app/Services/ServerCanvas.php
@@ -0,0 +1,278 @@
+<?php
+
+namespace App\Services;
+
+use App\Enums\ApplicationDeploymentStatus;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\ResourceLink;
+use App\Models\Server;
+use App\Models\Service;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Builds the server canvas: one zone per server with every resource of the team on it,
+ * in the same shape as the environment canvas. Cards and project / environment groups use the positions saved on
+ * their environment canvas (node.saved); admins move whole groups and single cards here, which saves the group's cards on that environment
+ * canvas, and change links through the environment canvas endpoints of each card.
+ */
+class ServerCanvas
+{
+    public function __construct(private EnvironmentCanvas $canvas) {}
+
+    /**
+     * @param  Collection<int, Server>  $servers  servers of the team to show
+     * @return array{title: string, title_link: ?string, can_edit: bool, can_move: false, can_move_groups: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array{}}
+     */
+    public function payload(int $teamId, Collection $servers, ?Server $single, bool $canReadSensitive, bool $canEdit = false): array
+    {
+        $environments = Environment::query()
+            ->whereHas('project', fn ($query) => $query->where('team_id', $teamId))
+            ->with('project')
+            ->get(['id', 'uuid', 'name', 'project_id']);
+        $environmentIds = $environments->pluck('id');
+        $resources = $this->loadResources($environmentIds);
+        $links = ResourceLink::query()->whereIn('environment_id', $environmentIds)->orderBy('id')->get();
+        $graph = $this->canvas->graph($resources, $links, $canReadSensitive);
+
+        $serverUuids = $servers->pluck('uuid')->all();
+        $context = $resources->map(fn (Model $resource) => [
+            'context' => $resource->environment->project->name.' / '.$resource->environment->name,
+            'context_link' => route('project.resource.index', ['project_uuid' => $resource->environment->project->uuid, 'environment_uuid' => $resource->environment->uuid]),
+            // The canvas filters resources by project and environment.
+            'project' => ['uuid' => $resource->environment->project->uuid, 'name' => $resource->environment->project->name],
+            'environment' => ['uuid' => $resource->environment->uuid, 'name' => $resource->environment->name],
+        ]);
+        $nodes = collect($graph['nodes'])
+            ->filter(fn (array $node) => array_intersect([$node['zone'], ...$node['extra_zones']], $serverUuids) !== [])
+            ->map(function (array $node) use ($serverUuids, $context) {
+                // A resource that also runs on a shown server (additional server) sits in that server's zone.
+                if (! in_array($node['zone'], $serverUuids, true)) {
+                    $node['zone'] = collect($node['extra_zones'])->first(fn ($uuid) => in_array($uuid, $serverUuids, true));
+                }
+
+                return [...$node, ...$context->get($node['id'])];
+            })
+            ->values();
+        $shown = $nodes->pluck('id')->flip();
+        // Every-server canvases: environments without resources show as placeholder cards next to the other environments of their project.
+        $used = $resources->pluck('environment_id')->flip();
+        $zoneOf = $this->canvas->projectZones($nodes, $serverUuids[0] ?? EnvironmentCanvas::EMPTY_ZONE);
+        $empty = $single ? collect() : $environments
+            ->reject(fn (Environment $environment) => $used->has($environment->id))
+            ->map(fn (Environment $environment) => $this->canvas->emptyNode($environment->project, $environment, $zoneOf($environment->project), $environment->project->name.' / '.$environment->name, $canEdit))
+            ->values();
+        // The canvas draws a zone around its cards, so a server without cards gets a placeholder card.
+        $filled = $nodes->concat($empty)->pluck('zone')->flip();
+        $bare = $servers->reject(fn (Server $server) => $filled->has($server->uuid))->map(fn (Server $server) => [
+            'id' => 'empty-server:'.$server->uuid,
+            'type' => 'empty',
+            'name' => 'No resources yet',
+            'subtitle' => 'Open to see this server',
+            'status' => null,
+            'zone' => $server->uuid,
+            'extra_zones' => [],
+            'urls' => [],
+            'children' => [],
+            'link' => route('server.show', ['server_uuid' => $server->uuid]),
+            'context' => null,
+            'project' => null,
+            'environment' => null,
+        ])->values();
+
+        return [
+            'title' => $single ? $single->name : 'Servers',
+            'title_link' => $single ? route('server.show', ['server_uuid' => $single->uuid]) : null,
+            // Unmanaged containers need a command on the server, so the canvas loads them after it renders.
+            'containers_endpoint' => $single ? '/servers/'.$single->uuid.'/canvas/containers' : null,
+            'can_edit' => $canEdit,
+            'can_move' => false,
+            // Admins drag the project / environment group boxes; the canvas saves the moved cards on their environment canvas.
+            'can_move_groups' => $canEdit,
+            // Tells the canvas to group cards by project / environment and place linked cards side by side.
+            'layout' => 'server',
+            'zones' => $servers->map(fn (Server $server) => [...$this->canvas->zone($server, $canReadSensitive), 'details' => $this->details($server)])
+                ->when($empty->contains('zone', EnvironmentCanvas::EMPTY_ZONE), fn (Collection $zones) => $zones->push($this->canvas->emptyZone()))
+                ->values()->all(),
+            'nodes' => $nodes->concat($empty)->concat($bare)->all(),
+            'links' => collect($graph['links'])->filter(fn (array $link) => $shown->has($link['source']) && $shown->has($link['target']))->values()->all(),
+            'positions' => [],
+        ];
+    }
+
+    /**
+     * Host facts and proxy of a server for its zone header. Live usage loads after the canvas renders
+     * (usage_endpoint), because it runs a command on the server.
+     *
+     * @return array{os: ?string, arch: ?string, cpus: ?int, memory_bytes: ?int, uptime_since: ?string, proxy: ?array{type: string, status: ?string}, usage_endpoint: ?string}
+     */
+    public function details(Server $server): array
+    {
+        $meta = $server->server_metadata ?? [];
+        $proxyType = $server->proxyType();
+        $live = $server->settings?->is_reachable && $server->settings?->is_metrics_enabled;
+
+        return [
+            'os' => $meta['os'] ?? null,
+            'arch' => $meta['arch'] ?? null,
+            'cpus' => isset($meta['cpus']) ? (int) $meta['cpus'] : null,
+            'memory_bytes' => isset($meta['memory_bytes']) ? (int) $meta['memory_bytes'] : null,
+            'uptime_since' => $meta['uptime_since'] ?? null,
+            'proxy' => $proxyType && $proxyType !== 'NONE' ? ['type' => $proxyType, 'status' => data_get($server->proxy, 'status')] : null,
+            'usage_endpoint' => $live ? '/servers/'.$server->uuid.'/canvas/usage' : null,
+        ];
+    }
+
+    /**
+     * Latest CPU, memory and root disk usage in percent from Sentinel, cached briefly so that
+     * canvas refreshes do not run a command on the server each time. Null values: no data.
+     *
+     * @return array{cpu: ?float, memory: ?float, disk: ?float}
+     */
+    public function usage(Server $server): array
+    {
+        return Cache::remember("server-canvas-usage:{$server->id}", 30, function () use ($server) {
+            $latest = function (callable $read): ?float {
+                try {
+                    $value = data_get(last($read() ?: [null]), 1);
+
+                    return is_numeric($value) ? round((float) $value, 1) : null;
+                } catch (\Throwable) {
+                    return null;
+                }
+            };
+
+            return [
+                'cpu' => $latest(fn () => $server->getCpuMetrics(1)),
+                'memory' => $latest(fn () => $server->getMemoryMetrics(1)),
+                'disk' => $latest(fn () => $server->getDiskMetrics(1)),
+            ];
+        });
+    }
+
+    /**
+     * Dashboard canvas: the server canvas of the team, on each application card its
+     * running or queued deployment (the oldest first, as the deployment queue runs them),
+     * and the list of active and recent deployments.
+     *
+     * @param  Collection<int, Server>  $servers  servers of the team to show
+     * @return array<string, mixed>
+     */
+    public function dashboardPayload(int $teamId, Collection $servers, bool $canReadSensitive, bool $canEdit = false): array
+    {
+        $payload = $this->payload($teamId, $servers, null, $canReadSensitive, $canEdit);
+
+        $columns = ['deployment_uuid', 'application_id', 'application_name', 'status', 'deployment_url', 'pull_request_id', 'server_name', 'created_at', 'finished_at'];
+        $query = fn () => ApplicationDeploymentQueue::query()->whereIn('server_id', $servers->pluck('id'));
+        $activeStatuses = [ApplicationDeploymentStatus::IN_PROGRESS->value, ApplicationDeploymentStatus::QUEUED->value];
+        $active = $query()->whereIn('status', $activeStatuses)->orderBy('status')->orderBy('id')->get($columns);
+        $recent = $query()->whereNotIn('status', $activeStatuses)->orderByDesc('id')->limit(8)->get($columns);
+        $applicationUuids = Application::query()
+            ->whereIn('id', $active->concat($recent)->pluck('application_id')->unique())
+            ->pluck('uuid', 'id');
+        $uuidOf = fn (ApplicationDeploymentQueue $deployment) => $applicationUuids->get((int) $deployment->application_id);
+        $summary = fn (ApplicationDeploymentQueue $deployment) => [
+            'status' => $deployment->status,
+            'link' => $deployment->deployment_url,
+            'pull_request_id' => (int) $deployment->pull_request_id ?: null,
+        ];
+        $byUuid = $active
+            ->filter($uuidOf)
+            ->unique('application_id')
+            ->mapWithKeys(fn (ApplicationDeploymentQueue $deployment) => [$uuidOf($deployment) => $summary($deployment)]);
+
+        return [
+            ...$payload,
+            'title' => 'Dashboard',
+            'title_link' => route('dashboard'),
+            'nodes' => collect($payload['nodes'])
+                ->map(fn (array $node) => $node['type'] === 'application' && $byUuid->has($node['id'])
+                    ? [...$node, 'deployment' => $byUuid->get($node['id'])]
+                    : $node)
+                ->all(),
+            // The deployment panel: running and queued deployments first, then the latest finished ones.
+            'deployments' => $active->concat($recent)
+                ->map(fn (ApplicationDeploymentQueue $deployment) => [
+                    'id' => $deployment->deployment_uuid,
+                    'application' => $uuidOf($deployment),
+                    'name' => $deployment->application_name,
+                    'server' => $deployment->server_name,
+                    'created_at' => $deployment->created_at?->toIso8601String(),
+                    'finished_at' => $deployment->finished_at?->toIso8601String(),
+                    ...$summary($deployment),
+                ])
+                ->values()
+                ->all(),
+        ];
+    }
+
+    /**
+     * Read-only cards for the Docker containers on the server that Coolify does not manage.
+     * Only the one-server canvas loads them, in a separate request, because this runs a command on the server.
+     *
+     * @return Collection<int, array<string, mixed>>
+     */
+    public function unmanagedContainerNodes(Server $server): Collection
+    {
+        try {
+            $containers = $server->loadUnmanagedContainers();
+        } catch (\Throwable) {
+            return collect();
+        }
+
+        return $containers
+            ->filter(fn ($container) => filled(data_get($container, 'ID')))
+            ->map(function ($container) use ($server) {
+                $health = str((string) data_get($container, 'Status'))->match('/\((healthy|unhealthy)\)/')->value();
+
+                return [
+                    'id' => 'container:'.data_get($container, 'ID'),
+                    'type' => 'container',
+                    'name' => (string) data_get($container, 'Names'),
+                    'status' => collect([(string) data_get($container, 'State', 'unknown'), $health])->filter()->implode(':'),
+                    'zone' => $server->uuid,
+                    'extra_zones' => [],
+                    'urls' => [],
+                    'subtitle' => (string) data_get($container, 'Image'),
+                    'children' => [],
+                    'link' => route('server.resources', ['server_uuid' => $server->uuid]),
+                    'context' => 'Unmanaged containers',
+                    'context_link' => route('server.resources', ['server_uuid' => $server->uuid]),
+                ];
+            })
+            ->sortBy('name', SORT_NATURAL)
+            ->values();
+    }
+
+    /**
+     * Top-level resources of the given environments, keyed by uuid, with the relations the canvas reads.
+     *
+     * @param  Collection<int, int>  $environmentIds
+     * @return Collection<string, Model>
+     */
+    public function loadResources(Collection $environmentIds): Collection
+    {
+        $applications = Application::query()->whereIn('environment_id', $environmentIds)
+            ->with(['environment.project', 'destination.server.settings', 'additional_servers.settings'])
+            ->get();
+        $services = Service::query()->whereIn('environment_id', $environmentIds)
+            ->with([
+                'environment.project',
+                'server.settings',
+                'destination.server.settings',
+                'applications',
+                'databases',
+            ])
+            ->get();
+        $databases = collect(EnvironmentCanvas::DATABASE_RELATIONS)
+            ->flatMap(fn (string $relation) => (new Environment)->{$relation}()->getRelated()->newQuery()
+                ->whereIn('environment_id', $environmentIds)
+                ->with(['environment.project', 'destination.server.settings'])
+                ->get());
+
+        return collect()->concat($applications)->concat($services)->concat($databases)->keyBy('uuid');
+    }
+}
diff --git a/app/Services/ServerTransfer/ServerTransferBundle.php b/app/Services/ServerTransfer/ServerTransferBundle.php
index 692842d085..aa5936d14e 100644
--- a/app/Services/ServerTransfer/ServerTransferBundle.php
+++ b/app/Services/ServerTransfer/ServerTransferBundle.php
@@ -2,16 +2,12 @@
 
 namespace App\Services\ServerTransfer;
 
-use Illuminate\Support\Facades\Crypt;
 use Illuminate\Validation\ValidationException;
-use RuntimeException;
 
 class ServerTransferBundle
 {
     public const SCHEMA_VERSION = 1;
 
-    public const MAILBOX_DIR = '/data/coolify/exports';
-
     /**
      * @param  array<string, mixed>  $payload
      */
@@ -19,6 +15,7 @@ class ServerTransferBundle
     {
         return array_merge([
             'schema_version' => self::SCHEMA_VERSION,
+            'coolify_version' => config('constants.coolify.version'),
             'exported_at' => now()->toIso8601String(),
             'export_id' => new_public_id(),
         ], $payload);
@@ -39,6 +36,14 @@ class ServerTransferBundle
             $errors[] = 'Unsupported schema_version '.$bundle['schema_version'].'. Expected '.self::SCHEMA_VERSION.'.';
         }
 
+        $bundleVersion = data_get($bundle, 'coolify_version');
+        $instanceVersion = (string) config('constants.coolify.version');
+        if (! is_string($bundleVersion) || $bundleVersion === '') {
+            $errors[] = 'Missing coolify_version. Export the server again with Coolify '.$instanceVersion.' or newer.';
+        } elseif (version_compare($bundleVersion, $instanceVersion, '>')) {
+            $errors[] = "This bundle was exported from Coolify {$bundleVersion}. Upgrade this instance (Coolify {$instanceVersion}) to {$bundleVersion} or newer before you import it.";
+        }
+
         if (! isset($bundle['export_id']) || ! is_string($bundle['export_id']) || $bundle['export_id'] === '') {
             $errors[] = 'Missing export_id.';
         }
@@ -90,90 +95,4 @@ class ServerTransferBundle
             ]);
         }
     }
-
-    /**
-     * Encrypt an entire bundle for mailbox/API transport with a user passphrase.
-     *
-     * @param  array<string, mixed>  $bundle
-     * @return array{encrypted: true, schema_version: int, payload: string}
-     */
-    public static function encryptWithPassphrase(array $bundle, string $passphrase): array
-    {
-        if ($passphrase === '') {
-            throw new RuntimeException('Passphrase must not be empty.');
-        }
-
-        $json = json_encode($bundle, JSON_THROW_ON_ERROR);
-        $key = hash('sha256', $passphrase, true);
-        $iv = random_bytes(16);
-        $cipher = openssl_encrypt($json, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
-        if ($cipher === false) {
-            throw new RuntimeException('Failed to encrypt transfer bundle.');
-        }
-
-        $mac = hash_hmac('sha256', $iv.$cipher, $key);
-
-        return [
-            'encrypted' => true,
-            'schema_version' => self::SCHEMA_VERSION,
-            'payload' => base64_encode($iv.$mac.$cipher),
-        ];
-    }
-
-    /**
-     * @param  array<string, mixed>  $encrypted
-     * @return array<string, mixed>
-     */
-    public static function decryptWithPassphrase(array $encrypted, string $passphrase): array
-    {
-        if (! data_get($encrypted, 'encrypted')) {
-            throw new RuntimeException('Bundle is not encrypted.');
-        }
-
-        $raw = base64_decode((string) data_get($encrypted, 'payload'), true);
-        if ($raw === false || strlen($raw) < 48) {
-            throw new RuntimeException('Invalid encrypted payload.');
-        }
-
-        $key = hash('sha256', $passphrase, true);
-        $iv = substr($raw, 0, 16);
-        $mac = substr($raw, 16, 64);
-        $cipher = substr($raw, 80);
-        $expectedMac = hash_hmac('sha256', $iv.$cipher, $key);
-        if (! hash_equals($expectedMac, $mac)) {
-            throw new RuntimeException('Invalid passphrase or corrupted bundle.');
-        }
-
-        $json = openssl_decrypt($cipher, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
-        if ($json === false) {
-            throw new RuntimeException('Failed to decrypt transfer bundle.');
-        }
-
-        /** @var array<string, mixed> $bundle */
-        $bundle = json_decode($json, true, 512, JSON_THROW_ON_ERROR);
-
-        return $bundle;
-    }
-
-    /**
-     * Optionally re-seal secrets with Laravel's app key for intermediate storage.
-     * Prefer passphrase encryption for cross-instance transfers.
-     *
-     * @param  array<string, mixed>  $bundle
-     */
-    public static function sealWithAppKey(array $bundle): string
-    {
-        return Crypt::encryptString(json_encode($bundle, JSON_THROW_ON_ERROR));
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    public static function unsealWithAppKey(string $sealed): array
-    {
-        /** @var array<string, mixed> $bundle */
-        $bundle = json_decode(Crypt::decryptString($sealed), true, 512, JSON_THROW_ON_ERROR);
-
-        return $bundle;
-    }
 }
diff --git a/app/Services/ServerTransfer/ServerTransferClaimer.php b/app/Services/ServerTransfer/ServerTransferClaimer.php
index 593bdd91ed..f479b1fb49 100644
--- a/app/Services/ServerTransfer/ServerTransferClaimer.php
+++ b/app/Services/ServerTransfer/ServerTransferClaimer.php
@@ -2,7 +2,16 @@
 
 namespace App\Services\ServerTransfer;
 
+use App\Enums\GithubRunnerStatus;
+use App\Jobs\DeleteResourceJob;
+use App\Models\GithubRunnerExecution;
+use App\Models\ManagedDnsRecord;
 use App\Models\Server;
+use App\Notifications\Internal\GeneralNotification;
+use App\Services\Dns\CloudflareDnsProvider;
+use App\Services\Dns\ManagedDnsRecordCleanup;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 use RuntimeException;
@@ -10,11 +19,20 @@ use Throwable;
 
 class ServerTransferClaimer
 {
+    /**
+     * The managed host records which claim owns it. Both instances can reach the host, so it is the one
+     * place where an instance can learn that another instance took the server over.
+     */
+    public const OWNER_MARKER_DIR = '/data/coolify/transfer';
+
+    public const OWNER_MARKER_PATH = self::OWNER_MARKER_DIR.'/owner.json';
+
     /**
      * Take management of a server on this Coolify instance and bind Sentinel to it.
      *
      * Database ownership (metadata + Sentinel settings) is committed in one transaction so a
-     * mid-flight failure rolls back.
+     * mid-flight failure rolls back. The owner marker on the host is written last in that
+     * transaction: if the host cannot be reached, the claim fails and nothing changes here.
      *
      * @return array{
      *     server_uuid: string,
@@ -36,6 +54,7 @@ class ServerTransferClaimer
         $exportId = data_get($server->server_metadata, 'transfer.export_id');
 
         $claim = [
+            'claim_id' => new_public_id(),
             'instance_url' => $instanceUrl,
             'server_uuid' => $server->uuid,
             'team_id' => $server->team_id,
@@ -47,13 +66,16 @@ class ServerTransferClaimer
         return DB::transaction(function () use ($server, $claim, $instanceUrl) {
             $server = Server::query()->with('settings')->lockForUpdate()->findOrFail($server->id);
 
+            // A disabled server refuses SSH, so the owner marker could not be written.
+            if ($server->team->serverOverflow()) {
+                throw new RuntimeException('Your team is over its server limit. Upgrade your subscription or remove a server first.');
+            }
+
             if ($server->settings) {
                 $server->settings->sentinel_custom_url = $instanceUrl;
                 $server->settings->ensureValidSentinelToken();
                 $server->settings->is_sentinel_enabled = true;
-                if (! $server->team->serverOverflow()) {
-                    $server->settings->force_disabled = false;
-                }
+                $server->settings->force_disabled = false;
                 $server->settings->save();
             }
 
@@ -66,6 +88,8 @@ class ServerTransferClaimer
             $server->server_metadata = $metadata;
             $server->save();
 
+            $this->writeOwnerMarker($server, $claim);
+
             return [
                 'server_uuid' => $server->uuid,
                 'claim' => $claim,
@@ -81,18 +105,15 @@ class ServerTransferClaimer
      * All database writes run in one transaction so partial disable state cannot stick on failure.
      * Local SSH key cache cleanup runs after commit (filesystem; not transactional).
      *
-     * $managementDisabled marks a manual "Disable management" action: the server is not moved yet,
-     * only ready to be transferred to another instance.
-     *
      * @return array{server_uuid: string, message: string}
      */
-    public function markTransferred(Server $server, ?string $exportId = null, ?string $targetInstanceUrl = null, bool $managementDisabled = false): array
+    public function markTransferred(Server $server, ?string $exportId = null, ?string $targetInstanceUrl = null): array
     {
         if ($server->id === 0) {
             throw new RuntimeException('Cannot transfer the Coolify host itself.');
         }
 
-        $result = DB::transaction(function () use ($server, $exportId, $targetInstanceUrl, $managementDisabled) {
+        $result = DB::transaction(function () use ($server, $exportId, $targetInstanceUrl) {
             $server = Server::query()->with('settings')->lockForUpdate()->findOrFail($server->id);
 
             if ($server->settings) {
@@ -107,8 +128,15 @@ class ServerTransferClaimer
                 'export_id' => $exportId ?? data_get($metadata, 'transfer.export_id'),
                 'target_instance_url' => $targetInstanceUrl,
                 'transferred_at' => now()->toIso8601String(),
-                'management_disabled' => $managementDisabled,
             ]);
+            unset($metadata['transfer']['finish'], $metadata['transfer']['taken_back_at']);
+            $server->server_metadata = $metadata;
+            $server->save();
+
+            $this->releaseGithubRunners($server);
+
+            // Kept for a take back. Not owned, so this instance never changes or deletes them at the provider.
+            $metadata['transfer']['parked_dns_record_ids'] = app(ManagedDnsRecordCleanup::class)->parkResources($this->dnsResources($server));
             $server->server_metadata = $metadata;
             $server->save();
 
@@ -123,6 +151,144 @@ class ServerTransferClaimer
         return $result;
     }
 
+    /**
+     * The runners on the server belong to the target now. Queued runners are cancelled. Started runners are marked
+     * finished without removing them at GitHub: their jobs keep running, and deleting the archive here later must
+     * not deregister them. A disabled config also stops new runners for this server from GitHub webhooks.
+     */
+    /**
+     * The other instance serves the hostnames of a transferred server. Without this, deleting the archive here,
+     * or the orphaned-record cleanup after it, would delete live DNS records at the provider.
+     */
+    public function forgetDnsRecords(Server $server): void
+    {
+        app(ManagedDnsRecordCleanup::class)->forgetResources($this->dnsResources($server));
+    }
+
+    /**
+     * Delete the archive of a transferred server with its resources, records only: another instance manages the
+     * host, so nothing runs on the server and nothing changes at a provider.
+     */
+    public function deleteArchive(Server $server): void
+    {
+        if (! $server->isTransferredAway()) {
+            throw new RuntimeException('Only the archive of a transferred server can be deleted this way.');
+        }
+
+        $this->forgetDnsRecords($server);
+        foreach ($server->definedResources() as $resource) {
+            (new DeleteResourceJob($resource, deleteFromCoolifyOnly: true))->handle();
+        }
+        $server->forceDelete();
+    }
+
+    /**
+     * @return Collection<int, Model>
+     */
+    private function dnsResources(Server $server): Collection
+    {
+        return $server->applications()
+            ->concat($server->services()->with('applications')->get()->flatMap->applications);
+    }
+
+    /**
+     * After a take back: own the parked DNS records again where Cloudflare confirms them, then start the steps that
+     * finish the take back (webhooks, runners, records that this instance could not take back). Provider calls run
+     * here, after the claim committed.
+     *
+     * @return list<array<string, mixed>> the steps
+     */
+    public function restoreAfterTakeBack(Server $server): array
+    {
+        $dns = app(CloudflareDnsProvider::class);
+        $parkedIds = (array) data_get($server->server_metadata, 'transfer.parked_dns_record_ids', []);
+        foreach (ManagedDnsRecord::query()->whereIn('id', $parkedIds)->get() as $record) {
+            if ($dns->reclaimRecord($record)) {
+                $record->update(['owned' => true]);
+            }
+        }
+
+        DB::transaction(function () use ($server) {
+            $locked = Server::query()->lockForUpdate()->findOrFail($server->id);
+            $metadata = $locked->server_metadata ?? [];
+            unset($metadata['transfer']['parked_dns_record_ids']);
+            $metadata['transfer']['taken_back_at'] = now()->toIso8601String();
+            $locked->server_metadata = $metadata;
+            $locked->save();
+            $server->server_metadata = $metadata;
+        });
+
+        return app(TransferFinishChecklist::class)->start($server);
+    }
+
+    private function releaseGithubRunners(Server $server): void
+    {
+        $server->githubRunnerConfig()->update(['is_enabled' => false]);
+
+        $message = 'The server was transferred to another Coolify instance. This instance stopped managing its runners.';
+        GithubRunnerExecution::query()
+            ->where('server_id', $server->id)
+            ->whereIn('status', GithubRunnerStatus::active())
+            ->get()
+            ->each(fn (GithubRunnerExecution $execution) => $execution->finish(GithubRunnerStatus::Cancelled, $message));
+    }
+
+    /**
+     * Stop managing a claimed server when its owner marker names a claim of another instance.
+     * A server that was added here without a claim ignores the marker: a marker can be left over on a
+     * host that an old instance deleted, and the next claim overwrites it.
+     *
+     * @return bool true when this instance released the server
+     */
+    public function releaseIfClaimedElsewhere(Server $server, ?string $markerJson): bool
+    {
+        if ($server->id === 0 || data_get($server->server_metadata, 'transfer.status') !== 'claimed') {
+            return false;
+        }
+
+        $marker = json_decode((string) $markerJson, true);
+        $markerClaimId = data_get($marker, 'claim_id');
+        if (! is_string($markerClaimId) || $markerClaimId === '') {
+            return false;
+        }
+
+        if ($markerClaimId === data_get($server->server_metadata, 'transfer.claim.claim_id')) {
+            return false;
+        }
+
+        $owner = data_get($marker, 'instance_url');
+        $owner = is_string($owner) && $owner !== '' ? $owner : null;
+
+        $this->markTransferred($server, targetInstanceUrl: $owner);
+
+        Log::warning('Server is claimed by another Coolify instance; management stopped here', [
+            'server_uuid' => $server->uuid,
+            'owner_instance_url' => $owner,
+        ]);
+        $server->team?->notify(new GeneralNotification(
+            "Server '{$server->name}' is now managed by ".($owner ?? 'another Coolify instance').'. This instance stopped managing it.',
+            success: false,
+        ));
+
+        return true;
+    }
+
+    /**
+     * @param  array<string, mixed>  $claim
+     */
+    private function writeOwnerMarker(Server $server, array $claim): void
+    {
+        $marker = json_encode([
+            'claim_id' => $claim['claim_id'],
+            'instance_url' => $claim['instance_url'],
+            'server_uuid' => $claim['server_uuid'],
+            'claimed_at' => $claim['claimed_at'],
+        ], JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES);
+
+        instant_remote_process(['mkdir -p '.self::OWNER_MARKER_DIR], $server);
+        instant_remote_write_file($server, self::OWNER_MARKER_PATH, $marker);
+    }
+
     /**
      * Best-effort local SSH mux/key cleanup after transfer (filesystem; not part of DB rollback).
      * forceDisableServer is idempotent for force_disabled and also clears cached SSH key material.
@@ -139,51 +305,4 @@ class ServerTransferClaimer
             ]);
         }
     }
-
-    /**
-     * Write export bundle to the managed host mailbox (air-gapped transfer).
-     *
-     * @param  array<string, mixed>  $bundle
-     * @return array{path: string, written: bool}
-     */
-    public function writeMailbox(Server $server, array $bundle, ?string $passphrase = null): array
-    {
-        ServerTransferBundle::assertValid($bundle);
-
-        $exportId = (string) data_get($bundle, 'export_id', new_public_id());
-        $filename = "server-transfer-{$exportId}.coolify.json";
-        $path = ServerTransferBundle::MAILBOX_DIR.'/'.$filename;
-
-        $payload = $passphrase
-            ? ServerTransferBundle::encryptWithPassphrase($bundle, $passphrase)
-            : $bundle;
-
-        $json = json_encode($payload, JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES);
-        $b64 = base64_encode($json);
-
-        $written = false;
-        try {
-            instant_remote_process([
-                'mkdir -p '.escapeshellarg(ServerTransferBundle::MAILBOX_DIR),
-                // tee, not a redirect: the SSH user's shell opens a redirect, and a non-root user cannot enter /data/coolify.
-                'echo '.escapeshellarg($b64).' | base64 -d | tee '.escapeshellarg($path).' > /dev/null',
-                'chmod 600 '.escapeshellarg($path),
-                'chown 9999:root '.escapeshellarg($path).' || true',
-            ], $server, true);
-            $written = true;
-        } catch (Throwable $e) {
-            Log::warning('Failed to write server transfer mailbox', [
-                'server_uuid' => $server->uuid,
-                'error' => $e->getMessage(),
-            ]);
-            if (! app()->runningUnitTests()) {
-                throw $e;
-            }
-        }
-
-        return [
-            'path' => $path,
-            'written' => $written,
-        ];
-    }
 }
diff --git a/app/Services/ServerTransfer/ServerTransferCoverage.php b/app/Services/ServerTransfer/ServerTransferCoverage.php
new file mode 100644
index 0000000000..1c615e304d
--- /dev/null
+++ b/app/Services/ServerTransfer/ServerTransferCoverage.php
@@ -0,0 +1,351 @@
+<?php
+
+namespace App\Services\ServerTransfer;
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\ApplicationSetting;
+use App\Models\AuditEvent;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\DatabaseBackupS3Replica;
+use App\Models\DiscordNotificationSettings;
+use App\Models\DnsProviderZone;
+use App\Models\DockerCleanupExecution;
+use App\Models\EmailNotificationSettings;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
+use App\Models\ManagedDnsRecordReference;
+use App\Models\NotificationThrottle;
+use App\Models\OauthIdentity;
+use App\Models\OauthSetting;
+use App\Models\PersonalAccessToken;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\ProjectSetting;
+use App\Models\PushoverNotificationSettings;
+use App\Models\ResourceLink;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledJobDelivery;
+use App\Models\ScheduledJobState;
+use App\Models\ScheduledTask;
+use App\Models\ScheduledTaskExecution;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\SecretManagerLink;
+use App\Models\Server;
+use App\Models\ServerSetting;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\SlackNotificationSettings;
+use App\Models\SslCertificate;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\StandaloneSqlite;
+use App\Models\Subscription;
+use App\Models\SwarmDocker;
+use App\Models\Tag;
+use App\Models\Team;
+use App\Models\TeamInvitation;
+use App\Models\TelegramNotificationSettings;
+use App\Models\User;
+use App\Models\UserChangelogRead;
+use App\Models\VolumeBackupS3Replica;
+use App\Models\WebhookNotificationSettings;
+
+/**
+ * The decision for every model and every column: does a server transfer move it to the other instance?
+ *
+ * ServerTransferCoverageTest exports a server that has a record of every transferred model and fails when
+ * a model is not listed here, or when a column of a transferred table is neither in the bundle nor in
+ * NOT_EXPORTED_COLUMNS. So a new model or column gets a transfer decision when it is added.
+ */
+final class ServerTransferCoverage
+{
+    /**
+     * Transferred models and where their records are in the bundle. `*` matches every list item. When a
+     * record has an `attributes` object, its keys also count. `model` limits a path to one database class.
+     *
+     * @var array<class-string, list<string>>
+     */
+    public const TRANSFERRED = [
+        Server::class => ['server'],
+        ServerSetting::class => ['server.settings'],
+        PrivateKey::class => ['private_key', 'private_keys.*'],
+        StandaloneDocker::class => ['destinations.*'],
+        SwarmDocker::class => ['destinations.*'],
+        CloudProviderToken::class => ['cloud_provider_tokens.*'],
+        IntegrationToken::class => ['integration_tokens.*'],
+        DnsProviderZone::class => ['dns_zones.*'],
+        ManagedDnsRecord::class => ['managed_dns_records.*'],
+        ManagedDnsRecordReference::class => ['managed_dns_records.*.references.*'],
+        SecretManagerLink::class => [
+            'projects.*.environments.*.applications.*.secret_manager_link',
+            'projects.*.environments.*.databases.*.secret_manager_link',
+            'projects.*.environments.*.services.*.secret_manager_link',
+        ],
+        SslCertificate::class => ['ssl_certificates.*'],
+        GithubApp::class => ['github_apps.*'],
+        GithubRunnerConfig::class => ['github_runner_config'],
+        GitlabApp::class => ['gitlab_apps.*'],
+        GiteaApp::class => ['gitea_apps.*'],
+        S3Storage::class => ['s3_storages.*'],
+        Project::class => ['projects.*'],
+        Environment::class => ['projects.*.environments.*'],
+        ResourceLink::class => ['projects.*.environments.*.resource_links.*'],
+        SharedEnvironmentVariable::class => [
+            'shared_environment_variables.server.*',
+            'shared_environment_variables.team.*',
+            'projects.*.shared_environment_variables.*',
+            'projects.*.environments.*.shared_environment_variables.*',
+        ],
+        Application::class => ['projects.*.environments.*.applications.*'],
+        ApplicationSetting::class => ['projects.*.environments.*.applications.*.settings'],
+        ApplicationPreview::class => ['projects.*.environments.*.applications.*.previews.*'],
+        EnvironmentVariable::class => [
+            'projects.*.environments.*.applications.*.environment_variables.*',
+            'projects.*.environments.*.applications.*.environment_variables_preview.*',
+            'projects.*.environments.*.databases.*.environment_variables.*',
+            'projects.*.environments.*.services.*.environment_variables.*',
+        ],
+        LocalPersistentVolume::class => [
+            'projects.*.environments.*.applications.*.persistent_storages.*',
+            'projects.*.environments.*.databases.*.persistent_storages.*',
+        ],
+        LocalFileVolume::class => [
+            'projects.*.environments.*.applications.*.file_storages.*',
+            'projects.*.environments.*.databases.*.file_storages.*',
+        ],
+        ScheduledTask::class => [
+            'projects.*.environments.*.applications.*.scheduled_tasks.*',
+            'projects.*.environments.*.services.*.scheduled_tasks.*',
+        ],
+        Tag::class => [
+            'projects.*.environments.*.applications.*.tags.*',
+            'projects.*.environments.*.databases.*.tags.*',
+            'projects.*.environments.*.services.*.tags.*',
+        ],
+        ScheduledDatabaseBackup::class => ['projects.*.environments.*.databases.*.scheduled_backups.*'],
+        ScheduledVolumeBackup::class => ['volume_backups.*'],
+        Service::class => ['projects.*.environments.*.services.*'],
+        ServiceApplication::class => ['projects.*.environments.*.services.*.applications.*'],
+        ServiceDatabase::class => ['projects.*.environments.*.services.*.databases.*'],
+        StandalonePostgresql::class => ['projects.*.environments.*.databases.*'],
+        StandaloneMysql::class => ['projects.*.environments.*.databases.*'],
+        StandaloneMariadb::class => ['projects.*.environments.*.databases.*'],
+        StandaloneMongodb::class => ['projects.*.environments.*.databases.*'],
+        StandaloneRedis::class => ['projects.*.environments.*.databases.*'],
+        StandaloneKeydb::class => ['projects.*.environments.*.databases.*'],
+        StandaloneDragonfly::class => ['projects.*.environments.*.databases.*'],
+        StandaloneClickhouse::class => ['projects.*.environments.*.databases.*'],
+        StandaloneSqlite::class => ['projects.*.environments.*.databases.*'],
+    ];
+
+    private const LINKED = 'The bundle links the record by UUID or by its place in the bundle; the target sets its own ID.';
+
+    private const TEAM = 'The target imports into one of its own teams.';
+
+    private const RUNTIME = 'Runtime state: the target sets it again when it manages the server.';
+
+    /**
+     * Columns of transferred models that are not in the bundle under their own name, with the reason.
+     * Columns in ALWAYS_NOT_EXPORTED are left out of every model.
+     *
+     * @var array<class-string, array<string, string>>
+     */
+    public const NOT_EXPORTED_COLUMNS = [
+        Server::class => [
+            'team_id' => self::TEAM, 'private_key_id' => self::LINKED, 'cloud_provider_token_id' => self::LINKED,
+            'unreachable_count' => self::RUNTIME, 'high_disk_usage_notification_sent' => self::RUNTIME,
+            'log_drain_notification_sent' => self::RUNTIME, 'validation_logs' => self::RUNTIME,
+            'sentinel_updated_at' => self::RUNTIME, 'sentinel_waiting_since' => self::RUNTIME, 'ip_previous' => self::RUNTIME,
+            'is_validating' => self::RUNTIME, 'detected_traefik_version' => self::RUNTIME, 'traefik_outdated_info' => self::RUNTIME,
+            'hetzner_server_status' => self::RUNTIME, 'vultr_instance_status' => self::RUNTIME,
+            'digitalocean_droplet_status' => self::RUNTIME, 'hostinger_virtual_machine_status' => self::RUNTIME,
+            'server_metadata' => 'Facts about the host and the transfer state of the source; the target collects its own.',
+        ],
+        ServerSetting::class => [
+            'server_id' => self::LINKED, 'is_reachable' => self::RUNTIME, 'is_usable' => self::RUNTIME, 'force_disabled' => self::RUNTIME,
+            'is_sentinel_enabled' => 'The target enables Sentinel when it claims the server.',
+            'is_sentinel_debug_enabled' => 'The target enables Sentinel when it claims the server.',
+            'sentinel_token' => 'The target makes a new Sentinel token when it claims the server.',
+            'sentinel_custom_url' => 'The target sets its own URL when it claims the server.',
+            'cloudflare_tunnel_integration_token_id' => 'Exported as cloudflare_tunnel_integration_token_uuid. '.self::LINKED,
+            'patch_check_result' => self::RUNTIME, 'patch_check_error' => self::RUNTIME, 'patch_checked_at' => self::RUNTIME,
+        ],
+        PrivateKey::class => ['team_id' => self::TEAM],
+        StandaloneDocker::class => ['server_id' => self::LINKED],
+        SwarmDocker::class => ['server_id' => self::LINKED],
+        CloudProviderToken::class => ['team_id' => self::TEAM],
+        IntegrationToken::class => ['team_id' => self::TEAM],
+        DnsProviderZone::class => ['integration_token_id' => self::LINKED],
+        ManagedDnsRecord::class => ['team_id' => self::TEAM, 'integration_token_id' => self::LINKED, 'dns_provider_zone_id' => self::LINKED],
+        ManagedDnsRecordReference::class => [
+            'managed_dns_record_id' => 'The reference is part of its record in the bundle.',
+            'resource_type' => self::LINKED, 'resource_id' => self::LINKED,
+        ],
+        SecretManagerLink::class => ['resourceable_type' => self::LINKED, 'resourceable_id' => self::LINKED, 'integration_token_id' => self::LINKED],
+        SslCertificate::class => ['server_id' => self::LINKED, 'resource_type' => self::LINKED, 'resource_id' => self::LINKED],
+        GithubApp::class => ['team_id' => self::TEAM, 'private_key_id' => self::LINKED],
+        GithubRunnerConfig::class => [
+            'server_id' => self::LINKED,
+            'github_app_id' => 'Exported as github_app_uuid. '.self::LINKED,
+        ],
+        GitlabApp::class => ['team_id' => self::TEAM, 'private_key_id' => self::LINKED],
+        GiteaApp::class => ['team_id' => self::TEAM, 'private_key_id' => self::LINKED],
+        S3Storage::class => ['team_id' => self::TEAM, 'unusable_email_sent' => self::RUNTIME],
+        Project::class => [
+            'team_id' => self::TEAM,
+            'icon_path' => 'The icon file is exported as `icon` (base64 content). The target stores it in its own icon storage and sets the path.',
+            'icon_storage_type' => 'The target uses its own default icon storage. See icon_path.',
+            'icon_s3_storage_id' => 'The target uses its own default icon storage. See icon_path.',
+        ],
+        Environment::class => ['project_id' => self::LINKED],
+        ResourceLink::class => [
+            'environment_id' => 'The link is part of its environment in the bundle.',
+            'source_type' => 'Exported as source.kind and source.uuid. '.self::LINKED,
+            'source_id' => 'Exported as source.kind and source.uuid. '.self::LINKED,
+            'target_type' => 'Exported as target.kind and target.uuid. '.self::LINKED,
+            'target_id' => 'Exported as target.kind and target.uuid. '.self::LINKED,
+            'created_by' => 'A user of the source instance; the target leaves it empty.',
+        ],
+        SharedEnvironmentVariable::class => [
+            'type' => 'The scope follows from the place of the variable in the bundle.',
+            'team_id' => self::TEAM, 'project_id' => self::LINKED, 'environment_id' => self::LINKED, 'server_id' => self::LINKED,
+            'version' => 'The Coolify version that created the variable; the target sets its own.',
+        ],
+        Application::class => [
+            'environment_id' => self::LINKED, 'destination_type' => self::LINKED, 'destination_id' => self::LINKED,
+            'source_type' => self::LINKED, 'source_id' => self::LINKED, 'private_key_id' => self::LINKED,
+        ],
+        ApplicationSetting::class => ['application_id' => self::LINKED],
+        ApplicationPreview::class => [
+            'application_id' => self::LINKED, 'last_online_at' => self::RUNTIME, 'domain_dns_statuses' => self::RUNTIME,
+            'restart_count' => self::RUNTIME, 'restart_limit_reached' => self::RUNTIME, 'last_restart_at' => self::RUNTIME,
+            'last_restart_type' => self::RUNTIME,
+        ],
+        EnvironmentVariable::class => ['resourceable_type' => self::LINKED, 'resourceable_id' => self::LINKED],
+        LocalPersistentVolume::class => [
+            'resource_type' => self::LINKED, 'resource_id' => self::LINKED, 'standalone_sqlite_id' => self::LINKED,
+            'container_id' => 'Not used: only listed in $fillable.',
+        ],
+        LocalFileVolume::class => ['resource_type' => self::LINKED, 'resource_id' => self::LINKED],
+        ScheduledTask::class => ['team_id' => self::TEAM, 'application_id' => self::LINKED, 'service_id' => self::LINKED],
+        Tag::class => ['team_id' => self::TEAM],
+        ScheduledDatabaseBackup::class => [
+            'team_id' => self::TEAM, 'database_type' => self::LINKED, 'database_id' => self::LINKED, 's3_storage_id' => self::LINKED,
+            'last_execution_at' => 'Execution history of the source.',
+        ],
+        ScheduledVolumeBackup::class => [
+            'team_id' => self::TEAM, 'backupable_type' => self::LINKED, 'backupable_id' => self::LINKED, 's3_storage_id' => self::LINKED,
+        ],
+        Service::class => [
+            'environment_id' => self::LINKED, 'server_id' => self::LINKED, 'destination_type' => self::LINKED, 'destination_id' => self::LINKED,
+        ],
+        ServiceApplication::class => ['service_id' => self::LINKED],
+        ServiceDatabase::class => ['service_id' => self::LINKED],
+        StandalonePostgresql::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneMysql::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneMariadb::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneMongodb::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneRedis::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneKeydb::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneDragonfly::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneClickhouse::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneSqlite::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+            'is_public' => 'Not used: SQLite has no public port.',
+        ],
+    ];
+
+    /**
+     * Created on the target instance for every record.
+     *
+     * @var list<string>
+     */
+    public const ALWAYS_NOT_EXPORTED = ['id', 'created_at', 'updated_at', 'deleted_at'];
+
+    /**
+     * Models that a transfer does not move, with the reason.
+     *
+     * @var array<class-string, string>
+     */
+    public const NOT_TRANSFERRED = [
+        Team::class => 'Instance-wide: the target imports into one of its own teams.',
+        User::class => 'Instance-wide: users are not moved with a server.',
+        TeamInvitation::class => 'Team data, not server data.',
+        Subscription::class => 'Billing of the source instance.',
+        InstanceSettings::class => 'Settings of the source instance.',
+        OauthSetting::class => 'Settings of the source instance.',
+        OauthIdentity::class => 'User login data of the source instance.',
+        PersonalAccessToken::class => 'API tokens of the source instance.',
+        UserChangelogRead::class => 'User data of the source instance.',
+        AuditEvent::class => 'Audit log of the source instance.',
+        NotificationThrottle::class => 'Runtime state of the source instance.',
+        ScheduledJobState::class => 'Scheduler state of the source instance.',
+        ScheduledJobDelivery::class => 'Scheduler state of the source instance.',
+        EmailNotificationSettings::class => 'Team notification settings, not server data.',
+        DiscordNotificationSettings::class => 'Team notification settings, not server data.',
+        SlackNotificationSettings::class => 'Team notification settings, not server data.',
+        TelegramNotificationSettings::class => 'Team notification settings, not server data.',
+        PushoverNotificationSettings::class => 'Team notification settings, not server data.',
+        WebhookNotificationSettings::class => 'Team notification settings, not server data.',
+        CloudInitScript::class => 'Team server-creation templates, not server data.',
+        ProjectSetting::class => 'Created with the project on the target; it has no settings of its own yet.',
+        ApplicationDeploymentQueue::class => 'Deployment history.',
+        ScheduledTaskExecution::class => 'Execution history.',
+        ScheduledDatabaseBackupExecution::class => 'Execution history.',
+        ScheduledVolumeBackupExecution::class => 'Execution history.',
+        DatabaseBackupS3Replica::class => 'Backup history.',
+        VolumeBackupS3Replica::class => 'Backup history.',
+        DockerCleanupExecution::class => 'Execution history.',
+        GithubRunnerExecution::class => 'Execution history. The source stops tracking the runners of the server when it is transferred.',
+    ];
+}
diff --git a/app/Services/ServerTransfer/ServerTransferExporter.php b/app/Services/ServerTransfer/ServerTransferExporter.php
index d31fee36c8..4b1255f6e5 100644
--- a/app/Services/ServerTransfer/ServerTransferExporter.php
+++ b/app/Services/ServerTransfer/ServerTransferExporter.php
@@ -5,31 +5,46 @@ namespace App\Services\ServerTransfer;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\CloudProviderToken;
+use App\Models\DnsProviderZone;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
 use App\Models\GitlabApp;
+use App\Models\IntegrationToken;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
+use App\Models\ManagedDnsRecordReference;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledTask;
+use App\Models\ScheduledVolumeBackup;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\SharedEnvironmentVariable;
 use App\Models\StandaloneDocker;
 use App\Models\SwarmDocker;
 use App\Models\Tag;
+use App\Services\ProjectIconStorageService;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Str;
 use RuntimeException;
+use Throwable;
 
 class ServerTransferExporter
 {
+    /**
+     * Larger project icons are not put in the bundle. Icons that Coolify stores are small JPEG files.
+     */
+    public const MAX_PROJECT_ICON_BYTES = 2 * 1024 * 1024;
+
     /**
      * Settings that are instance-bound or runtime health state and must not transfer.
      *
@@ -47,6 +62,12 @@ class ServerTransferExporter
         'sentinel_custom_url',
         'is_sentinel_enabled',
         'is_sentinel_debug_enabled',
+        // Exported as cloudflare_tunnel_integration_token_uuid.
+        'cloudflare_tunnel_integration_token_id',
+        // The last patch check of the source; the target runs its own.
+        'patch_check_result',
+        'patch_check_error',
+        'patch_checked_at',
     ];
 
     /**
@@ -85,6 +106,9 @@ class ServerTransferExporter
         if (! $privateKey instanceof PrivateKey) {
             throw new RuntimeException('Server has no private key to export.');
         }
+        if ((int) $privateKey->team_id !== (int) $server->team_id) {
+            throw new RuntimeException('The server private key does not belong to the server team. Select a private key of this team first.');
+        }
 
         if (! $includeSensitive) {
             throw new RuntimeException('Server transfer export requires sensitive data access (read:sensitive).');
@@ -99,15 +123,36 @@ class ServerTransferExporter
         $this->assertNoAdditionalDestinations($server, $applications);
 
         $projectIds = $this->collectProjectIds($applications, $databases, $services);
-        $projects = Project::query()->whereIn('id', $projectIds)->orderBy('name')->get();
+        $projects = Project::query()->where('team_id', $server->team_id)->whereIn('id', $projectIds)->orderBy('name')->get();
+        if ($projects->count() !== collect($projectIds)->unique()->count()) {
+            throw new RuntimeException('Some resources on this server belong to a project of another team. Move them to a project of this team first.');
+        }
 
         $destinationUuidByKey = $this->destinationUuidMap($server);
-        $dependencies = $this->collectDependencies($server, $applications, $databases, $services);
+        $runnerConfig = $server->githubRunnerConfig()->with('githubApp')->first();
+        $dependencies = $this->collectDependencies($server, $applications, $databases, $services, $runnerConfig);
 
         $sourceInstanceUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
-        $warnings = $this->buildWarnings($applications, $dependencies, $sourceInstanceUrl);
-        if ($secretManagerWarning = $this->secretManagerWarning($applications->concat($databases)->concat($services))) {
-            $warnings[] = $secretManagerWarning;
+        $managedDns = $this->collectManagedDnsRecords($server, $applications, $services);
+        $integrationTokens = $this->collectIntegrationTokens($server, $applications->concat($databases)->concat($services), $managedDns['records']);
+
+        $serverSharedEnvVars = $this->exportSharedEnvVars(
+            SharedEnvironmentVariable::query()
+                ->where('type', 'server')
+                ->where('server_id', $server->id)
+                ->get()
+        );
+        $projectWarnings = [];
+        $leftOutLinks = 0;
+        $projectPayloads = $projects->map(function (Project $project) use ($destinationUuidByKey, $applications, $databases, $services, &$projectWarnings, &$leftOutLinks) {
+            return $this->exportProject($project, $destinationUuidByKey, $applications, $databases, $services, $projectWarnings, $leftOutLinks);
+        })->values()->all();
+
+        $warnings = $this->buildWarnings($applications, $dependencies);
+        $warnings = array_merge($warnings, $managedDns['warnings'], $projectWarnings);
+        if ($leftOutLinks > 0) {
+            $warnings[] = $leftOutLinks.' '.Str::plural('link', $leftOutLinks).' between resources on the environment canvas '
+                .($leftOutLinks === 1 ? 'is' : 'are').' not transferred, because one of the linked resources stays on this instance.';
         }
 
         $payload = ServerTransferBundle::wrap([
@@ -116,29 +161,30 @@ class ServerTransferExporter
                 'name' => config('app.name'),
             ],
             'warnings' => $warnings,
+            // Manual steps after the transfer. The source replaces {target_url} with the URL of the target.
+            'post_transfer_checklist' => $this->postTransferChecklist($dependencies, $runnerConfig, $applications),
             // Back-compat: single server key
             'private_key' => $this->exportPrivateKey($privateKey),
             // All keys needed by server, apps, and git sources
             'private_keys' => $dependencies['private_keys']->map(fn (PrivateKey $key) => $this->exportPrivateKey($key))->values()->all(),
             'github_apps' => $dependencies['github_apps']->map(fn (GithubApp $app) => $this->exportGithubApp($app))->values()->all(),
             'gitlab_apps' => $dependencies['gitlab_apps']->map(fn (GitlabApp $app) => $this->exportGitlabApp($app))->values()->all(),
+            'gitea_apps' => $dependencies['gitea_apps']->map(fn (GiteaApp $app) => $this->exportGiteaApp($app))->values()->all(),
             's3_storages' => $dependencies['s3_storages']->map(fn (S3Storage $storage) => $this->exportS3Storage($storage))->values()->all(),
             'cloud_provider_tokens' => $dependencies['cloud_provider_tokens']->map(fn (CloudProviderToken $token) => $this->exportCloudProviderToken($token))->values()->all(),
+            'integration_tokens' => $integrationTokens->map(fn (IntegrationToken $token) => $this->exportIntegrationToken($token))->values()->all(),
+            'dns_zones' => $managedDns['records']->pluck('zone')->unique('id')->map(fn (DnsProviderZone $zone) => $this->exportDnsZone($zone))->values()->all(),
+            'managed_dns_records' => $managedDns['records']->map(fn (ManagedDnsRecord $record) => $this->exportManagedDnsRecord($record, $managedDns['resource_keys']))->values()->all(),
             'ssl_certificates' => $this->exportSslCertificates($server),
             'volume_backups' => $this->exportVolumeBackups($applications, $databases, $services),
             'server' => $this->exportServer($server),
             'destinations' => $this->exportDestinations($server),
+            'github_runner_config' => $runnerConfig ? $this->exportGithubRunnerConfig($runnerConfig) : null,
             'shared_environment_variables' => [
-                'server' => $this->exportSharedEnvVars(
-                    SharedEnvironmentVariable::query()
-                        ->where('type', 'server')
-                        ->where('server_id', $server->id)
-                        ->get()
-                ),
+                'server' => $serverSharedEnvVars,
+                'team' => $this->exportReferencedTeamSharedEnvVars($server->team_id, $serverSharedEnvVars, $projectPayloads),
             ],
-            'projects' => $projects->map(function (Project $project) use ($server, $destinationUuidByKey, $applications, $databases, $services) {
-                return $this->exportProject($project, $server, $destinationUuidByKey, $applications, $databases, $services);
-            })->values()->all(),
+            'projects' => $projectPayloads,
         ]);
 
         return $payload;
@@ -152,72 +198,84 @@ class ServerTransferExporter
      *     private_keys: Collection<int, PrivateKey>,
      *     github_apps: Collection<int, GithubApp>,
      *     gitlab_apps: Collection<int, GitlabApp>,
+     *     gitea_apps: Collection<int, GiteaApp>,
      *     s3_storages: Collection<int, S3Storage>,
      *     cloud_provider_tokens: Collection<int, CloudProviderToken>
      * }
      */
-    private function collectDependencies(Server $server, Collection $applications, Collection $databases, Collection $services): array
+    private function collectDependencies(Server $server, Collection $applications, Collection $databases, Collection $services, ?GithubRunnerConfig $runnerConfig): array
     {
+        $teamId = $server->team_id;
         $privateKeys = collect([$server->privateKey])->filter();
         $githubApps = collect();
         $gitlabApps = collect();
+        $giteaApps = collect();
         $s3Ids = collect();
 
+        // System-wide GitHub Apps are instance-owned; do not copy them. The application source and the runner
+        // config still record the App uuid, so the import can re-link to a system-wide App of the target.
+        $collectGithubApp = function (int|string $id) use ($teamId, $githubApps, $privateKeys): void {
+            $gh = $this->findGitSource(GithubApp::class, $id, $teamId);
+            if ($gh && ! $gh->is_system_wide) {
+                $githubApps->push($gh);
+                if ($gh->private_key_id) {
+                    $privateKeys->push($this->findTeamRecord(PrivateKey::class, $gh->private_key_id, $teamId, 'private key'));
+                }
+            }
+        };
+
+        if ($runnerConfig) {
+            $collectGithubApp($runnerConfig->github_app_id);
+        }
+
         foreach ($applications as $application) {
             if ($application->private_key_id) {
-                $key = PrivateKey::find($application->private_key_id);
-                if ($key) {
-                    $privateKeys->push($key);
-                }
+                $privateKeys->push($this->findTeamRecord(PrivateKey::class, $application->private_key_id, $teamId, 'private key'));
             }
 
             if ($application->source_type === GithubApp::class && $application->source_id !== null) {
-                $gh = GithubApp::find($application->source_id);
-                // System-wide GitHub Apps are instance-owned; do not copy them.
-                // Application export still records source.uuid so import can re-link
-                // to an existing system-wide app on the target instance.
-                if ($gh && ! $gh->is_system_wide) {
-                    $githubApps->push($gh);
-                    if ($gh->private_key_id) {
-                        $pk = PrivateKey::find($gh->private_key_id);
-                        if ($pk) {
-                            $privateKeys->push($pk);
-                        }
-                    }
-                }
+                $collectGithubApp($application->source_id);
             }
 
             if ($application->source_type === GitlabApp::class && $application->source_id !== null) {
-                $gl = GitlabApp::find($application->source_id);
+                $gl = $this->findGitSource(GitlabApp::class, $application->source_id, $teamId);
                 // System-wide GitLab Apps are instance-owned; re-link by UUID on import.
                 if ($gl && ! $gl->is_system_wide) {
                     $gitlabApps->push($gl);
                     if ($gl->private_key_id) {
-                        $pk = PrivateKey::find($gl->private_key_id);
-                        if ($pk) {
-                            $privateKeys->push($pk);
-                        }
+                        $privateKeys->push($this->findTeamRecord(PrivateKey::class, $gl->private_key_id, $teamId, 'private key'));
+                    }
+                }
+            }
+
+            if ($application->source_type === GiteaApp::class && $application->source_id !== null) {
+                $gt = $this->findGitSource(GiteaApp::class, $application->source_id, $teamId);
+                // System-wide Gitea Apps are instance-owned; re-link by UUID on import.
+                if ($gt && ! $gt->is_system_wide) {
+                    $giteaApps->push($gt);
+                    if ($gt->private_key_id) {
+                        $privateKeys->push($this->findTeamRecord(PrivateKey::class, $gt->private_key_id, $teamId, 'private key'));
                     }
                 }
             }
         }
 
-        $collectVolumeS3 = function ($resource) use (&$s3Ids): void {
+        $collectBackupS3 = function (ScheduledDatabaseBackup|ScheduledVolumeBackup $backup) use (&$s3Ids): void {
+            $s3Ids->push($backup->s3_storage_id, ...$backup->s3Storages()->pluck('s3_storages.id')->all());
+        };
+
+        $collectVolumeS3 = function ($resource) use ($collectBackupS3): void {
             if (method_exists($resource, 'persistentStorages')) {
                 foreach ($resource->persistentStorages as $volume) {
                     foreach ($volume->scheduledBackups as $vb) {
-                        if ($vb->s3_storage_id) {
-                            $s3Ids->push($vb->s3_storage_id);
-                        }
+                        $collectBackupS3($vb);
                     }
                 }
             }
             if (method_exists($resource, 'fileStorages')) {
                 foreach ($resource->fileStorages as $file) {
                     foreach ($file->scheduledBackups as $vb) {
-                        if ($vb->s3_storage_id) {
-                            $s3Ids->push($vb->s3_storage_id);
-                        }
+                        $collectBackupS3($vb);
                     }
                 }
             }
@@ -226,9 +284,7 @@ class ServerTransferExporter
         foreach ($databases as $database) {
             if (method_exists($database, 'scheduledBackups')) {
                 foreach ($database->scheduledBackups as $backup) {
-                    if ($backup->s3_storage_id) {
-                        $s3Ids->push($backup->s3_storage_id);
-                    }
+                    $collectBackupS3($backup);
                 }
             }
             $database->loadMissing(['persistentStorages.scheduledBackups', 'fileStorages.scheduledBackups']);
@@ -257,9 +313,7 @@ class ServerTransferExporter
             }
             foreach ($service->databases as $serviceDb) {
                 foreach ($serviceDb->scheduledBackups as $backup) {
-                    if ($backup->s3_storage_id) {
-                        $s3Ids->push($backup->s3_storage_id);
-                    }
+                    $collectBackupS3($backup);
                 }
                 $collectVolumeS3($serviceDb);
             }
@@ -267,37 +321,76 @@ class ServerTransferExporter
 
         $cloudTokens = collect();
         if ($server->cloud_provider_token_id) {
-            $token = CloudProviderToken::find($server->cloud_provider_token_id);
-            if ($token) {
-                $cloudTokens->push($token);
-            }
+            $cloudTokens->push($this->findTeamRecord(CloudProviderToken::class, $server->cloud_provider_token_id, $teamId, 'cloud provider token'));
         }
 
         return [
             'private_keys' => $privateKeys->unique('id')->values(),
             'github_apps' => $githubApps->unique('id')->values(),
             'gitlab_apps' => $gitlabApps->unique('id')->values(),
-            's3_storages' => S3Storage::query()->whereIn('id', $s3Ids->unique()->filter()->all())->get(),
+            'gitea_apps' => $giteaApps->unique('id')->values(),
+            's3_storages' => $this->findTeamS3Storages($s3Ids->unique()->filter()->values()->all(), $teamId),
             'cloud_provider_tokens' => $cloudTokens->unique('id')->values(),
         ];
     }
 
+    /**
+     * Load a credential record that must belong to the server team. A record of another team is
+     * never exported, so a broken reference stops the export instead of leaking its secrets.
+     *
+     * @template T of Model
+     *
+     * @param  class-string<T>  $modelClass
+     * @return T
+     */
+    private function findTeamRecord(string $modelClass, int|string $id, int $teamId, string $label): Model
+    {
+        $record = $modelClass::query()->where('team_id', $teamId)->find($id);
+        if (! $record) {
+            throw new RuntimeException("A {$label} used on this server does not belong to the server team. Select a {$label} of this team first.");
+        }
+
+        return $record;
+    }
+
+    /**
+     * System-wide git sources are returned as they are (they are only linked by UUID, never exported).
+     *
+     * @param  class-string<GithubApp|GitlabApp|GiteaApp>  $modelClass
+     */
+    private function findGitSource(string $modelClass, int|string $id, int $teamId): GithubApp|GitlabApp|GiteaApp|null
+    {
+        $source = $modelClass::find($id);
+        if ($source && ! $source->is_system_wide && (int) $source->team_id !== $teamId) {
+            throw new RuntimeException('A git source used on this server does not belong to the server team. Select a git source of this team first.');
+        }
+
+        return $source;
+    }
+
+    /**
+     * @param  list<int|string>  $ids
+     * @return Collection<int, S3Storage>
+     */
+    private function findTeamS3Storages(array $ids, int $teamId): Collection
+    {
+        $storages = S3Storage::query()->where('team_id', $teamId)->whereIn('id', $ids)->get();
+        if ($storages->count() !== count($ids)) {
+            throw new RuntimeException('An S3 storage used by a backup on this server does not belong to the server team. Select an S3 storage of this team first.');
+        }
+
+        return $storages;
+    }
+
     /**
      * @param  Collection<int, Application>  $applications
      * @param  array<string, mixed>  $dependencies
      * @return list<string>
      */
-    private function buildWarnings(Collection $applications, array $dependencies, string $sourceInstanceUrl): array
+    private function buildWarnings(Collection $applications, array $dependencies): array
     {
         $warnings = [];
 
-        if ($dependencies['github_apps']->isNotEmpty()) {
-            $warnings[] = 'Team-scoped GitHub Apps were exported with credentials (system-wide apps are skipped). After import, update each GitHub App webhook URL (and setup/callback URL if used) to this Coolify instance so push/PR automations keep working. '
-                ."Webhook path: {$sourceInstanceUrl}/webhooks/source/github/events "
-                .'(replace host with the target instance FQDN after import). '
-                .'Also reinstall/refresh the GitHub App installation if installation_id is invalid on the new host.';
-        }
-
         $usesSystemWideGithub = $applications->contains(function (Application $app) {
             if ($app->source_type !== GithubApp::class || $app->source_id === null) {
                 return false;
@@ -322,9 +415,16 @@ class ServerTransferExporter
             $warnings[] = 'Some applications use a system-wide GitLab App, which is not exported. On import, Coolify will re-link to a matching system-wide GitLab App on the target instance (by UUID) if one exists.';
         }
 
-        if ($dependencies['gitlab_apps']->isNotEmpty()) {
-            $warnings[] = 'Team-scoped GitLab Apps/OAuth sources were exported (system-wide apps are skipped). After import, update GitLab webhook URLs to the target Coolify instance '
-                ."({$sourceInstanceUrl}/webhooks/source/gitlab/events — use the new FQDN) and refresh OAuth tokens if needed.";
+        $usesSystemWideGitea = $applications->contains(function (Application $app) {
+            if ($app->source_type !== GiteaApp::class || $app->source_id === null) {
+                return false;
+            }
+            $gt = GiteaApp::find($app->source_id);
+
+            return $gt?->is_system_wide === true;
+        });
+        if ($usesSystemWideGitea) {
+            $warnings[] = 'Some applications use a system-wide Gitea App, which is not exported. On import, Coolify will re-link to a matching system-wide Gitea App on the target instance (by UUID) if one exists.';
         }
 
         if ($dependencies['s3_storages']->isNotEmpty()) {
@@ -335,24 +435,184 @@ class ServerTransferExporter
     }
 
     /**
-     * Secret manager links point to integration tokens of this instance, which are not exported.
+     * Managed DNS records that only exported resources use. A record that a resource staying on this instance
+     * also uses is not exported: this instance keeps managing it.
      *
-     * @param  Collection<int, Model>  $resources
+     * @param  Collection<int, Application>  $applications
+     * @param  Collection<int, Service>  $services
+     * @return array{
+     *     records: Collection<int, ManagedDnsRecord>,
+     *     resource_keys: array<string, array{kind: string, uuid: string}|null>,
+     *     warnings: list<string>
+     * }
      */
-    private function secretManagerWarning(Collection $resources): ?string
+    private function collectManagedDnsRecords(Server $server, Collection $applications, Collection $services): array
     {
-        $linkedNames = $resources
-            ->filter(fn (Model $resource) => method_exists($resource, 'secretManagerLink') && $resource->secretManagerLink()->exists())
-            ->pluck('name')
-            ->unique()
-            ->values();
-
-        if ($linkedNames->isEmpty()) {
-            return null;
+        // Keyed by "morph type:id". Soft-deleted previews are covered, but their references are not exported.
+        $resourceKeys = [];
+        foreach ($applications as $application) {
+            $resourceKeys[$application->getMorphClass().':'.$application->id] = ['kind' => 'application', 'uuid' => $application->uuid];
+            foreach (ApplicationPreview::withTrashed()->where('application_id', $application->id)->get() as $preview) {
+                $resourceKeys[$preview->getMorphClass().':'.$preview->id] = $preview->trashed() ? null : ['kind' => 'preview', 'uuid' => $preview->uuid];
+            }
+        }
+        foreach ($services as $service) {
+            foreach ($service->applications as $serviceApplication) {
+                $resourceKeys[$serviceApplication->getMorphClass().':'.$serviceApplication->id] = ['kind' => 'service_application', 'uuid' => $serviceApplication->uuid];
+            }
+        }
+        if ($resourceKeys === []) {
+            return ['records' => collect(), 'resource_keys' => [], 'warnings' => []];
         }
 
-        return 'Some resources load environment variables from a secret manager: '.$linkedNames->implode(', ').'. '
-            .'Secret manager tokens and links are not exported. After import, add the integration token on the target instance and link the secret manager source again, or deployments of these resources fail.';
+        $records = ManagedDnsRecord::query()
+            ->whereHas('references', function ($query) use ($resourceKeys) {
+                $query->where(function ($query) use ($resourceKeys) {
+                    foreach (array_keys($resourceKeys) as $key) {
+                        [$type, $id] = explode(':', $key, 2);
+                        $query->orWhere(fn ($query) => $query->where('resource_type', $type)->where('resource_id', $id));
+                    }
+                });
+            })
+            ->with(['references', 'zone.integrationToken', 'integrationToken'])
+            ->orderBy('name')
+            ->get();
+
+        $exported = collect();
+        $warnings = [];
+        foreach ($records as $record) {
+            $teamId = (int) $server->team_id;
+            if ((int) $record->team_id !== $teamId
+                || (int) $record->integrationToken?->team_id !== $teamId
+                || (int) $record->zone?->integrationToken?->team_id !== $teamId) {
+                $warnings[] = "DNS record {$record->name} is not transferred, because its DNS provider token belongs to another team. The target instance does not manage it.";
+
+                continue;
+            }
+            $sharedWithOtherResources = $record->references
+                ->contains(fn (ManagedDnsRecordReference $reference) => ! array_key_exists($reference->resource_type.':'.$reference->resource_id, $resourceKeys));
+            if ($sharedWithOtherResources) {
+                $warnings[] = "DNS record {$record->name} stays managed by this instance, because a resource that is not transferred also uses it. The target instance does not update or delete it.";
+
+                continue;
+            }
+            $hasLiveReference = $record->references
+                ->contains(fn (ManagedDnsRecordReference $reference) => $resourceKeys[$reference->resource_type.':'.$reference->resource_id] !== null);
+            if ($hasLiveReference) {
+                $exported->push($record);
+            }
+        }
+
+        return ['records' => $exported, 'resource_keys' => $resourceKeys, 'warnings' => $warnings];
+    }
+
+    /**
+     * Integration tokens that the exported resources need: secret manager links, managed DNS records, and the
+     * Cloudflare tunnel of the server.
+     *
+     * @param  Collection<int, Model>  $resources
+     * @param  Collection<int, ManagedDnsRecord>  $dnsRecords
+     * @return Collection<int, IntegrationToken>
+     */
+    private function collectIntegrationTokens(Server $server, Collection $resources, Collection $dnsRecords): Collection
+    {
+        $tokenIds = collect([$server->settings?->cloudflare_tunnel_integration_token_id]);
+        foreach ($resources as $resource) {
+            if (method_exists($resource, 'secretManagerLink')) {
+                $tokenIds->push($resource->secretManagerLink()->value('integration_token_id'));
+            }
+        }
+        foreach ($dnsRecords as $record) {
+            $tokenIds->push($record->integration_token_id, $record->zone->integration_token_id);
+        }
+
+        return $tokenIds->filter()->unique()->values()
+            ->map(fn (int|string $id) => $this->findTeamRecord(IntegrationToken::class, $id, (int) $server->team_id, 'integration token'));
+    }
+
+    /**
+     * Manual steps after the transfer. {target_url} stands for the URL of the target instance.
+     *
+     * @param  array{github_apps: Collection<int, GithubApp>, gitlab_apps: Collection<int, GitlabApp>, gitea_apps: Collection<int, GiteaApp>}  $dependencies
+     * @param  Collection<int, Application>  $applications
+     * @return list<string>
+     */
+    private function postTransferChecklist(array $dependencies, ?GithubRunnerConfig $runnerConfig, Collection $applications): array
+    {
+        $steps = [];
+        // A manual webhook is set in the repository itself, so its URL still points to this instance. Every
+        // application has the secrets, so list the git applications that do not deploy through a private App.
+        $manualWebhookApps = $applications
+            ->filter(fn (Application $application) => $application->build_pack !== 'dockerimage' && filled($application->git_repository)
+                && (! $application->source || data_get($application->source, 'is_public') === true))
+            ->pluck('name');
+        if ($manualWebhookApps->isNotEmpty()) {
+            $steps[] = 'If a repository of these applications has a manual webhook to Coolify, change its URL to the target: '
+                .$manualWebhookApps->implode(', ').'. Use {target_url}/webhooks/source/github/events/manual, '
+                .'{target_url}/webhooks/source/gitlab/events/manual, {target_url}/webhooks/source/bitbucket/events/manual, '
+                .'or {target_url}/webhooks/source/gitea/events/manual.';
+        }
+        foreach ($dependencies['github_apps'] as $githubApp) {
+            $steps[] = "On GitHub, open the settings of GitHub App {$githubApp->name}. Set the Webhook URL to {target_url}/webhooks/source/github/events, "
+                .'the Setup URL to {target_url}/webhooks/source/github/install, and the Callback URL to {target_url}/login/github/app.';
+        }
+        foreach ($dependencies['gitlab_apps'] as $gitlabApp) {
+            $steps[] = "In GitLab, open Settings > Webhooks of every project that uses GitLab App {$gitlabApp->name}, and set the webhook URL to {target_url}/webhooks/source/gitlab/events.";
+        }
+        foreach ($dependencies['gitea_apps'] as $giteaApp) {
+            $steps[] = "In Gitea, open the OAuth2 application of Gitea App {$giteaApp->name} and set the redirect URI to {target_url}/webhooks/source/gitea/redirect. "
+                .'Then set the webhook URL of every repository that uses it to {target_url}/webhooks/source/gitea/events.';
+        }
+        if ($runnerConfig) {
+            $steps[] = 'After the GitHub App sends webhooks to {target_url}, open this server there, check the runner requirements, and enable GitHub runners. '
+                .'Enabling them stops runners that another Coolify instance started on this server.';
+        }
+
+        return $steps;
+    }
+
+    /**
+     * Team variables are exported only when an exported variable references them as {{team.KEY}}.
+     *
+     * @param  list<array<string, mixed>>  $serverVariables
+     * @param  list<array<string, mixed>>  $projects
+     * @return list<array<string, mixed>>
+     */
+    private function exportReferencedTeamSharedEnvVars(int $teamId, array $serverVariables, array $projects): array
+    {
+        $values = collect($serverVariables)->pluck('value');
+        foreach ([
+            '*.shared_environment_variables.*.value',
+            '*.environments.*.shared_environment_variables.*.value',
+            '*.environments.*.applications.*.environment_variables.*.value',
+            '*.environments.*.applications.*.environment_variables_preview.*.value',
+            '*.environments.*.databases.*.environment_variables.*.value',
+            '*.environments.*.services.*.environment_variables.*.value',
+            '*.environments.*.services.*.applications.*.environment_variables.*.value',
+        ] as $path) {
+            $values = $values->merge(data_get($projects, $path, []));
+        }
+
+        $keys = $values
+            ->filter(fn ($value) => is_string($value))
+            ->flatMap(function (string $value) {
+                preg_match_all('/{{\s*team\.(.+?)\s*}}/', $value, $matches);
+
+                return $matches[1];
+            })
+            ->unique()
+            ->values();
+        if ($keys->isEmpty()) {
+            return [];
+        }
+
+        return $this->exportSharedEnvVars(
+            SharedEnvironmentVariable::query()
+                ->where('type', 'team')
+                ->where('team_id', $teamId)
+                ->whereIn('key', $keys)
+                ->get()
+        );
     }
 
     /**
@@ -362,7 +622,7 @@ class ServerTransferExporter
     {
         try {
             $material = $key->private_key;
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             throw new RuntimeException(
                 "Cannot decrypt private key \"{$key->name}\" (uuid={$key->uuid}). "
                 .'This instance APP_KEY does not match the key that encrypted the data '
@@ -398,6 +658,9 @@ class ServerTransferExporter
                 // Read through cast so encrypted fields are plaintext for re-encryption on import.
                 $settingsPayload[$key] = $settings->{$key};
             }
+            $settingsPayload['cloudflare_tunnel_integration_token_uuid'] = $settings->cloudflare_tunnel_integration_token_id
+                ? IntegrationToken::query()->whereKey($settings->cloudflare_tunnel_integration_token_id)->value('uuid')
+                : null;
         }
 
         return [
@@ -405,12 +668,18 @@ class ServerTransferExporter
             'name' => $server->name,
             'description' => $server->description,
             'ip' => (string) $server->ip,
-            'port' => (int) $server->port,
+            'port' => $server->port ?: 22,
             'user' => (string) $server->user,
             'proxy' => $server->proxy?->toArray() ?? [],
             'server_role' => $server->settings->effectiveServerRole()->value,
             'is_build_server' => $server->isBuildServer(),
             'cloud_provider_token_uuid' => $server->cloudProviderToken?->uuid,
+            'hetzner_server_id' => $server->hetzner_server_id,
+            'vultr_instance_id' => $server->vultr_instance_id,
+            'digitalocean_droplet_id' => $server->digitalocean_droplet_id,
+            'hostinger_virtual_machine_id' => $server->hostinger_virtual_machine_id,
+            'proxy_error_page' => $server->proxy_error_page,
+            'swarm_cluster' => $server->swarm_cluster,
             'settings' => $settingsPayload,
         ];
     }
@@ -446,29 +715,37 @@ class ServerTransferExporter
      * @param  Collection<int, Model>  $databases
      * @param  Collection<int, Service>  $services
      * @param  array<string, string>  $destinationUuidByKey
+     * @param  list<string>  $warnings
      * @return array<string, mixed>
      */
     private function exportProject(
         Project $project,
-        Server $server,
         array $destinationUuidByKey,
         Collection $applications,
         Collection $databases,
         Collection $services,
+        array &$warnings,
+        int &$leftOutLinks,
     ): array {
-        $environments = $project->environments()->orderBy('name')->get();
+        // Only environments with a resource of this server. The other environments stay on this instance.
+        $environmentIds = $applications->pluck('environment_id')
+            ->merge($databases->pluck('environment_id'))
+            ->merge($services->pluck('environment_id'))
+            ->unique();
+        $environments = $project->environments()->whereIn('id', $environmentIds)->orderBy('name')->get();
 
         return [
             'uuid' => $project->uuid,
             'name' => $project->name,
             'description' => $project->description,
+            'icon' => $this->exportProjectIcon($project, $warnings),
             'shared_environment_variables' => $this->exportSharedEnvVars(
                 SharedEnvironmentVariable::query()
                     ->where('type', 'project')
                     ->where('project_id', $project->id)
                     ->get()
             ),
-            'environments' => $environments->map(function (Environment $environment) use ($destinationUuidByKey, $applications, $databases, $services) {
+            'environments' => $environments->map(function (Environment $environment) use ($destinationUuidByKey, $applications, $databases, $services, &$leftOutLinks) {
                 $envApps = $applications->where('environment_id', $environment->id)->values();
                 $envDbs = $databases->where('environment_id', $environment->id)->values();
                 $envServices = $services->where('environment_id', $environment->id)->values();
@@ -477,6 +754,10 @@ class ServerTransferExporter
                     'uuid' => $environment->uuid,
                     'name' => $environment->name,
                     'description' => $environment->description,
+                    // Keyed by resource uuid; only the positions of exported resources.
+                    'canvas_positions' => collect($environment->canvas_positions ?? [])
+                        ->only($envApps->pluck('uuid')->merge($envDbs->pluck('uuid'))->merge($envServices->pluck('uuid')))
+                        ->all(),
                     'shared_environment_variables' => $this->exportSharedEnvVars(
                         SharedEnvironmentVariable::query()
                             ->where('type', 'environment')
@@ -486,11 +767,105 @@ class ServerTransferExporter
                     'applications' => $envApps->map(fn (Application $app) => $this->exportApplication($app, $destinationUuidByKey))->all(),
                     'databases' => $envDbs->map(fn (Model $db) => $this->exportDatabase($db, $destinationUuidByKey))->all(),
                     'services' => $envServices->map(fn (Service $service) => $this->exportService($service, $destinationUuidByKey))->all(),
+                    'resource_links' => $this->exportResourceLinks($environment, $envApps, $envDbs, $envServices, $leftOutLinks),
                 ];
             })->values()->all(),
         ];
     }
 
+    /**
+     * The icon file travels in the bundle; the target stores it in its own icon storage.
+     *
+     * @param  list<string>  $warnings
+     * @return array{content_base64: string, extension: string, mime: string}|null
+     */
+    private function exportProjectIcon(Project $project, array &$warnings): ?array
+    {
+        if (blank($project->icon_path)) {
+            return null;
+        }
+
+        try {
+            $contents = app(ProjectIconStorageService::class)->projectContents($project);
+        } catch (Throwable) {
+            $contents = null;
+        }
+        if (! is_string($contents) || $contents === '') {
+            $warnings[] = "The icon of project {$project->name} cannot be read, so it is not transferred. Upload it again on the target instance.";
+
+            return null;
+        }
+        if (strlen($contents) > self::MAX_PROJECT_ICON_BYTES) {
+            $warnings[] = "The icon of project {$project->name} is larger than 2 MB, so it is not transferred. Upload it again on the target instance.";
+
+            return null;
+        }
+
+        return [
+            'content_base64' => base64_encode($contents),
+            'extension' => strtolower(pathinfo($project->icon_path, PATHINFO_EXTENSION)) ?: 'jpg',
+            'mime' => (new \finfo(FILEINFO_MIME_TYPE))->buffer($contents) ?: 'application/octet-stream',
+        ];
+    }
+
+    /**
+     * Canvas links whose two resources are both exported. Each end is the kind and uuid of a resource of the
+     * environment, the same keys that the import uses for its resource maps.
+     *
+     * @param  Collection<int, Application>  $applications
+     * @param  Collection<int, Model>  $databases
+     * @param  Collection<int, Service>  $services
+     * @return list<array{uuid: string, label: string|null, source: array{kind: string, uuid: string}, target: array{kind: string, uuid: string}}>
+     */
+    private function exportResourceLinks(Environment $environment, Collection $applications, Collection $databases, Collection $services, int &$leftOut): array
+    {
+        $ends = collect();
+        foreach (['application' => $applications, 'database' => $databases, 'service' => $services] as $kind => $resources) {
+            foreach ($resources as $resource) {
+                $ends->put($resource->getMorphClass().':'.$resource->getKey(), ['kind' => $kind, 'uuid' => $resource->uuid]);
+            }
+        }
+
+        $out = [];
+        foreach ($environment->resourceLinks()->orderBy('id')->get() as $link) {
+            $source = $ends->get($link->source_type.':'.$link->source_id);
+            $target = $ends->get($link->target_type.':'.$link->target_id);
+            if (! $source || ! $target) {
+                $leftOut++;
+
+                continue;
+            }
+            $out[] = ['uuid' => $link->uuid, 'label' => $link->label, 'source' => $source, 'target' => $target];
+        }
+
+        return $out;
+    }
+
+    /**
+     * The target imports the config disabled. Enabling it there removes the runner containers of the source.
+     *
+     * @return array<string, mixed>
+     */
+    private function exportGithubRunnerConfig(GithubRunnerConfig $config): array
+    {
+        return [
+            'uuid' => $config->uuid,
+            'github_app_uuid' => $config->githubApp?->uuid,
+            'labels' => $config->labels ?? [],
+            'is_enabled' => (bool) $config->is_enabled,
+            'is_dedicated' => (bool) $config->is_dedicated,
+            'allow_pull_requests' => (bool) $config->allow_pull_requests,
+            'max_runners' => $config->max_runners,
+            'docker_mode' => $config->docker_mode?->value,
+            'runner_image' => $config->runner_image,
+            'cpu_limit' => $config->cpu_limit,
+            'memory_limit' => $config->memory_limit,
+            'capacity_wait_timeout' => $config->capacity_wait_timeout,
+            'idle_timeout' => $config->idle_timeout,
+            'job_timeout' => $config->job_timeout,
+        ];
+    }
+
     /**
      * @param  array<string, string>  $destinationUuidByKey
      * @return array<string, mixed>
@@ -533,6 +908,8 @@ class ServerTransferExporter
             'docker_compose',
             'docker_compose_raw',
             'custom_labels',
+            'is_maintenance_enabled',
+            'maintenance_page',
         ] as $hidden) {
             if (in_array($hidden, $columns, true)) {
                 $attrs[$hidden] = $application->{$hidden};
@@ -553,9 +930,11 @@ class ServerTransferExporter
 
         $source = null;
         if ($application->source_type === GithubApp::class && $application->source) {
-            $source = ['type' => 'github_app', 'uuid' => $application->source->uuid];
+            $source = ['type' => 'github_app', 'uuid' => $application->source->uuid, 'system_wide' => (bool) $application->source->is_system_wide];
         } elseif ($application->source_type === GitlabApp::class && $application->source) {
-            $source = ['type' => 'gitlab_app', 'uuid' => $application->source->uuid];
+            $source = ['type' => 'gitlab_app', 'uuid' => $application->source->uuid, 'system_wide' => (bool) $application->source->is_system_wide];
+        } elseif ($application->source_type === GiteaApp::class && $application->source) {
+            $source = ['type' => 'gitea_app', 'uuid' => $application->source->uuid, 'system_wide' => (bool) $application->source->is_system_wide];
         }
 
         return [
@@ -571,6 +950,7 @@ class ServerTransferExporter
             'scheduled_tasks' => $this->exportScheduledTasks($application->scheduled_tasks()->get()),
             'tags' => $this->exportTags($application->tags),
             'previews' => $this->exportPreviews($application->previews),
+            'secret_manager_link' => $this->exportSecretManagerLink($application),
             'source' => $source,
             'private_key_uuid' => $application->private_key?->uuid,
             'had_git_source' => filled($application->source_id),
@@ -615,6 +995,11 @@ class ServerTransferExporter
             }
         }
 
+        // Not fillable
+        if (in_array('include_coolify_default_variables', $columns, true)) {
+            $attrs['include_coolify_default_variables'] = $database->include_coolify_default_variables;
+        }
+
         $destinationKey = $database->destination_type.':'.$database->destination_id;
 
         return [
@@ -638,6 +1023,7 @@ class ServerTransferExporter
             'scheduled_backups' => method_exists($database, 'scheduledBackups')
                 ? $this->exportScheduledBackups($database->scheduledBackups)
                 : [],
+            'secret_manager_link' => $this->exportSecretManagerLink($database),
         ];
     }
 
@@ -671,8 +1057,8 @@ class ServerTransferExporter
             $attrs[$field] = $service->{$field};
         }
 
-        // Hidden compose fields
-        foreach (['docker_compose', 'docker_compose_raw'] as $hidden) {
+        // Hidden compose fields, maintenance mode and the Coolify default variables switch (not fillable)
+        foreach (['docker_compose', 'docker_compose_raw', 'is_maintenance_enabled', 'maintenance_page', 'include_coolify_default_variables'] as $hidden) {
             if (in_array($hidden, $columns, true)) {
                 $attrs[$hidden] = $service->{$hidden};
             }
@@ -688,6 +1074,7 @@ class ServerTransferExporter
             'environment_variables' => $this->exportEnvVars($service->environment_variables()->get()),
             'scheduled_tasks' => $this->exportScheduledTasks($service->scheduled_tasks()->get()),
             'tags' => $this->exportTags($service->tags),
+            'secret_manager_link' => $this->exportSecretManagerLink($service),
             'applications' => $service->applications
                 ->map(fn ($app) => $this->exportServiceApplication($app))
                 ->values()
@@ -864,8 +1251,11 @@ class ServerTransferExporter
                 'is_shared' => (bool) $variable->is_shared,
                 'is_required' => (bool) ($variable->is_required ?? false),
                 'uses_legacy_escaping' => (bool) $variable->uses_legacy_escaping,
+                'preserve_compose_null' => (bool) $variable->preserve_compose_null,
                 'comment' => $variable->comment,
                 'order' => $variable->order,
+                // The Coolify version that created the variable.
+                'version' => $variable->version,
             ];
         }
 
@@ -982,7 +1372,9 @@ class ServerTransferExporter
                 'database_backup_retention_max_storage_s3' => $backup->database_backup_retention_max_storage_s3,
                 'timeout' => $backup->timeout,
                 'disable_local_backup' => (bool) ($backup->disable_local_backup ?? false),
+                'missing_backup_notification_days' => $backup->missing_backup_notification_days,
                 's3_storage_uuid' => $backup->s3?->uuid,
+                's3_storage_uuids' => $backup->selectedS3Storages()->pluck('uuid')->values()->all(),
                 'had_s3_storage' => filled($backup->s3_storage_id),
             ];
         }
@@ -1014,6 +1406,10 @@ class ServerTransferExporter
             'metadata' => $app->metadata,
             'pull_requests' => $app->pull_requests,
             'administration' => $app->administration,
+            'organization_self_hosted_runners' => $app->organization_self_hosted_runners,
+            'actions' => $app->actions,
+            'webhook_events' => $app->webhook_events,
+            'runner_group_id' => $app->runner_group_id,
             'private_key_uuid' => $app->privateKey?->uuid,
             'webhook_url_hint' => '/webhooks/source/github/events',
         ];
@@ -1052,6 +1448,33 @@ class ServerTransferExporter
         ];
     }
 
+    /**
+     * @return array<string, mixed>
+     */
+    private function exportGiteaApp(GiteaApp $app): array
+    {
+        return [
+            'uuid' => $app->uuid,
+            'name' => $app->name,
+            'organization' => $app->organization,
+            'api_url' => $app->api_url,
+            'html_url' => $app->html_url,
+            'custom_port' => $app->custom_port,
+            'custom_user' => $app->custom_user,
+            'is_system_wide' => false,
+            'is_public' => (bool) $app->is_public,
+            'client_id' => $app->client_id,
+            'client_secret' => $app->client_secret,
+            'access_token' => $app->access_token,
+            'refresh_token' => $app->refresh_token,
+            'expires_at' => $app->expires_at,
+            'redirect_uri' => $app->redirect_uri,
+            'webhook_secret' => $app->webhook_secret,
+            'private_key_uuid' => $app->privateKey?->uuid,
+            'webhook_url_hint' => '/webhooks/source/gitea/events',
+        ];
+    }
+
     /**
      * @return array<string, mixed>
      */
@@ -1084,6 +1507,85 @@ class ServerTransferExporter
         ];
     }
 
+    /**
+     * The token is read through its cast, so the bundle has it in plaintext like the other credentials.
+     *
+     * @return array<string, mixed>
+     */
+    private function exportIntegrationToken(IntegrationToken $token): array
+    {
+        return [
+            'uuid' => $token->uuid,
+            'provider' => $token->provider,
+            'name' => $token->name,
+            'token' => $token->token,
+            'capabilities' => $token->capabilities,
+            'metadata' => $token->metadata,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function exportDnsZone(DnsProviderZone $zone): array
+    {
+        return [
+            'uuid' => $zone->uuid,
+            'integration_token_uuid' => $zone->integrationToken->uuid,
+            'provider_zone_id' => $zone->provider_zone_id,
+            'name' => $zone->name,
+            'account_id' => $zone->account_id,
+            'account_name' => $zone->account_name,
+        ];
+    }
+
+    /**
+     * The ownership comment proves at the provider that this instance created the record. The target compares it
+     * with the remote comment before it takes ownership.
+     *
+     * @param  array<string, array{kind: string, uuid: string}|null>  $resourceKeys
+     * @return array<string, mixed>
+     */
+    private function exportManagedDnsRecord(ManagedDnsRecord $record, array $resourceKeys): array
+    {
+        return [
+            'uuid' => $record->uuid,
+            'integration_token_uuid' => $record->integrationToken->uuid,
+            'dns_provider_zone_uuid' => $record->zone->uuid,
+            'provider_record_id' => $record->provider_record_id,
+            'type' => $record->type,
+            'name' => $record->name,
+            'content' => $record->content,
+            'owned' => (bool) $record->owned,
+            'ownership_comment' => $record->ownershipComment(),
+            'references' => $record->references
+                ->map(fn (ManagedDnsRecordReference $reference) => $resourceKeys[$reference->resource_type.':'.$reference->resource_id] ?? null)
+                ->filter()
+                ->values()
+                ->all(),
+        ];
+    }
+
+    /**
+     * @return array{uuid: string, integration_token_uuid: string, settings: array<string, mixed>|null}|null
+     */
+    private function exportSecretManagerLink(Model $resource): ?array
+    {
+        if (! method_exists($resource, 'secretManagerLink')) {
+            return null;
+        }
+        $link = $resource->secretManagerLink()->with('integrationToken')->first();
+        if (! $link) {
+            return null;
+        }
+
+        return [
+            'uuid' => $link->uuid,
+            'integration_token_uuid' => $link->integrationToken->uuid,
+            'settings' => $link->settings,
+        ];
+    }
+
     /**
      * @return list<array<string, mixed>>
      */
@@ -1140,6 +1642,8 @@ class ServerTransferExporter
                 'git_type' => $preview->git_type,
                 'docker_compose_domains' => $preview->docker_compose_domains,
                 'docker_registry_image_tag' => $preview->docker_registry_image_tag,
+                'domain_port_overrides' => $preview->domain_port_overrides,
+                'max_restart_count' => $preview->max_restart_count,
                 'persistent_storages' => method_exists($preview, 'persistentStorages')
                     ? $this->exportPersistentStorages($preview->persistentStorages)
                     : [],
@@ -1194,7 +1698,9 @@ class ServerTransferExporter
                         'retention_days_s3' => $backup->retention_days_s3,
                         'retention_max_storage_s3' => $backup->retention_max_storage_s3,
                         'timeout' => $backup->timeout,
+                        'missing_backup_notification_days' => $backup->missing_backup_notification_days,
                         's3_storage_uuid' => $backup->s3?->uuid,
+                        's3_storage_uuids' => $backup->selectedS3Storages()->pluck('uuid')->values()->all(),
                         'had_s3_storage' => filled($backup->s3_storage_id),
                     ];
                 }
diff --git a/app/Services/ServerTransfer/ServerTransferImporter.php b/app/Services/ServerTransfer/ServerTransferImporter.php
index 3d91ee783d..11bd69663d 100644
--- a/app/Services/ServerTransfer/ServerTransferImporter.php
+++ b/app/Services/ServerTransfer/ServerTransferImporter.php
@@ -2,22 +2,31 @@
 
 namespace App\Services\ServerTransfer;
 
+use App\Enums\GithubRunnerDockerMode;
 use App\Enums\ServerRole;
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\CloudProviderToken;
+use App\Models\DnsProviderZone;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
 use App\Models\GitlabApp;
+use App\Models\IntegrationToken;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
 use App\Models\PrivateKey;
 use App\Models\Project;
+use App\Models\ResourceLink;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledTask;
 use App\Models\ScheduledVolumeBackup;
+use App\Models\SecretManagerLink;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -37,9 +46,18 @@ use App\Models\StandaloneSqlite;
 use App\Models\SwarmDocker;
 use App\Models\Tag;
 use App\Models\Team;
+use App\Notifications\Internal\GeneralNotification;
+use App\Rules\DockerImageFormat;
+use App\Rules\ValidServerIp;
+use App\Services\Dns\CloudflareDnsProvider;
+use App\Services\ProjectIconStorageService;
+use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
 use Illuminate\Validation\ValidationException;
 use RuntimeException;
 use Throwable;
@@ -70,21 +88,52 @@ class ServerTransferImporter
     /** @var array<string, GitlabApp> */
     private array $gitlabAppMap = [];
 
+    /** @var array<string, GiteaApp> */
+    private array $giteaAppMap = [];
+
     /** @var array<string, S3Storage> */
     private array $s3StorageMap = [];
 
     /** @var array<string, CloudProviderToken> */
     private array $cloudTokenMap = [];
 
+    /** @var array<string, IntegrationToken> */
+    private array $integrationTokenMap = [];
+
+    /** @var array<string, DnsProviderZone> */
+    private array $dnsZoneMap = [];
+
+    /**
+     * Imported owned DNS records that carry the ownership comment of the source instance. This instance takes
+     * ownership at the provider after the import transaction commits.
+     *
+     * @var list<array{record_id: int, previous_comment: string}>
+     */
+    private array $pendingDnsAdoptions = [];
+
+    /**
+     * Icons of imported projects. They are stored after the import transaction commits, so a storage error
+     * cannot roll back DB rows.
+     *
+     * @var list<array{project: Project, icon: array<string, mixed>}>
+     */
+    private array $pendingProjectIcons = [];
+
     /** @var array<string, LocalPersistentVolume|LocalFileVolume> */
     private array $volumeMap = [];
 
     /** @var array<string, Application> */
     private array $applicationMap = [];
 
+    /** @var array<string, ApplicationPreview> */
+    private array $previewMap = [];
+
     /** @var array<string, Service> */
     private array $serviceMap = [];
 
+    /** @var array<string, ServiceApplication> */
+    private array $serviceApplicationMap = [];
+
     /** @var array<string, Model> */
     private array $databaseMap = [];
 
@@ -95,6 +144,21 @@ class ServerTransferImporter
      */
     private array $pendingSqliteLinks = [];
 
+    /**
+     * Warnings about references of imported resources that this instance cannot resolve.
+     *
+     * @var list<string>
+     */
+    private array $importWarnings = [];
+
+    /**
+     * Applications whose git source needs a check after the transfer: a system-wide source of the source
+     * instance, or a source that this instance does not have.
+     *
+     * @var list<string>
+     */
+    private array $gitSourceApplications = [];
+
     /**
      * @param  array<string, mixed>  $bundle
      * @return array{
@@ -106,7 +170,8 @@ class ServerTransferImporter
      *     preserved_uuids: bool,
      *     export_id: string|null,
      *     claimed: bool,
-     *     claim: array<string, mixed>|null
+     *     claim: array<string, mixed>|null,
+     *     checklist: list<string>
      * }
      */
     public function import(
@@ -117,6 +182,13 @@ class ServerTransferImporter
         bool $adoptMode = true,
     ): array {
         ServerTransferBundle::assertValid($bundle);
+        $this->assertValidServerPayload((array) data_get($bundle, 'server', []));
+
+        if ($adoptMode && ! $preserveUuids) {
+            throw ValidationException::withMessages([
+                'preserve_uuids' => ['Adopt mode keeps the running containers, so it needs the original UUIDs. Import with preserve_uuids=true.'],
+            ]);
+        }
 
         $validation = ServerTransferBundle::validate($bundle);
         $warnings = $validation['warnings'];
@@ -127,27 +199,20 @@ class ServerTransferImporter
         $serverUuid = (string) data_get($bundle, 'server.uuid');
         $serverIp = (string) data_get($bundle, 'server.ip');
 
-        $uuidConflict = Server::withTrashed()->where('uuid', $serverUuid)->exists() && $preserveUuids;
-        $existingIp = Server::where('ip', Server::normalizeIp($serverIp))->first();
-        $ipConflict = $existingIp !== null;
+        // A server that comes back replaces the archived copy that this instance kept from the first transfer.
+        $archive = $preserveUuids ? $this->replaceableArchive($serverUuid, $teamId) : null;
+        $uuidConflict = $archive === null && $preserveUuids && Server::withTrashed()->where('uuid', $serverUuid)->exists();
+        $ipConflict = Server::where('ip', Server::normalizeIp($serverIp))->when($archive, fn ($query) => $query->whereKeyNot($archive->id))->exists();
 
-        if (! $dryRun && $uuidConflict) {
-            throw ValidationException::withMessages([
-                'server.uuid' => ["A server with UUID {$serverUuid} already exists on this instance. Delete/transfer it first, or import with preserve_uuids=false."],
-            ]);
-        }
-
-        if (! $dryRun && $ipConflict) {
-            throw ValidationException::withMessages([
-                'server.ip' => ["A server with IP/domain {$serverIp} already exists (uuid={$existingIp->uuid}). Complete handoff on the source instance first."],
-            ]);
+        if (! $dryRun) {
+            $this->assertCanImport($serverUuid, $serverIp, $teamId, $preserveUuids);
         }
 
         if ($uuidConflict) {
             $warnings[] = "A server with UUID {$serverUuid} already exists on this instance.";
         }
         if ($ipConflict) {
-            $warnings[] = "A server with IP/domain {$serverIp} already exists (uuid={$existingIp->uuid}).";
+            $warnings[] = "A server with IP/domain {$serverIp} already exists on this instance.";
         }
 
         $created = [
@@ -160,8 +225,11 @@ class ServerTransferImporter
             'private_keys' => 0,
             'github_apps' => 0,
             'gitlab_apps' => 0,
+            'gitea_apps' => 0,
             's3_storages' => 0,
             'cloud_provider_tokens' => 0,
+            'integration_tokens' => 0,
+            'managed_dns_records' => 0,
             'ssl_certificates' => 0,
             'volume_backups' => 0,
             'previews' => 0,
@@ -187,20 +255,14 @@ class ServerTransferImporter
             );
             $created['github_apps'] = count(data_get($bundle, 'github_apps', []));
             $created['gitlab_apps'] = count(data_get($bundle, 'gitlab_apps', []));
+            $created['gitea_apps'] = count(data_get($bundle, 'gitea_apps', []));
             $created['s3_storages'] = count(data_get($bundle, 's3_storages', []));
             $created['cloud_provider_tokens'] = count(data_get($bundle, 'cloud_provider_tokens', []));
+            $created['integration_tokens'] = count(data_get($bundle, 'integration_tokens', []));
+            $created['managed_dns_records'] = count(data_get($bundle, 'managed_dns_records', []));
             $created['ssl_certificates'] = count(data_get($bundle, 'ssl_certificates', []));
             $created['volume_backups'] = count(data_get($bundle, 'volume_backups', []));
 
-            // Append transfer hints for the target instance FQDN.
-            $targetUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
-            if (count(data_get($bundle, 'github_apps', [])) > 0) {
-                $warnings[] = "After import, set GitHub App webhook URL to {$targetUrl}/webhooks/source/github/events (and update setup/callback URLs in GitHub if needed) so automations work on this instance.";
-            }
-            if (count(data_get($bundle, 'gitlab_apps', [])) > 0) {
-                $warnings[] = "After import, set GitLab webhook URL to {$targetUrl}/webhooks/source/gitlab/events so automations work on this instance.";
-            }
-
             return [
                 'dry_run' => true,
                 'warnings' => $warnings,
@@ -211,22 +273,36 @@ class ServerTransferImporter
                 'export_id' => data_get($bundle, 'export_id'),
                 'claimed' => false,
                 'claim' => null,
+                'checklist' => $this->postTransferChecklist($bundle),
             ];
         }
 
-        $result = DB::transaction(function () use ($bundle, $teamId, $preserveUuids, $adoptMode, $warnings, &$created) {
+        $result = DB::transaction(function () use ($bundle, $teamId, $preserveUuids, $adoptMode, $warnings, $archive, &$created) {
+            // Removed in the same transaction as the import, so a failed import keeps the archive.
+            if ($archive) {
+                app(ServerTransferClaimer::class)->deleteArchive($archive);
+            }
             Team::ensureServerCapacity($teamId);
 
             $this->privateKeyMap = [];
             $this->githubAppMap = [];
             $this->gitlabAppMap = [];
+            $this->giteaAppMap = [];
             $this->s3StorageMap = [];
             $this->cloudTokenMap = [];
+            $this->integrationTokenMap = [];
+            $this->dnsZoneMap = [];
+            $this->pendingDnsAdoptions = [];
+            $this->pendingProjectIcons = [];
             $this->volumeMap = [];
             $this->applicationMap = [];
+            $this->previewMap = [];
             $this->serviceMap = [];
+            $this->serviceApplicationMap = [];
             $this->databaseMap = [];
             $this->pendingSqliteLinks = [];
+            $this->importWarnings = [];
+            $this->gitSourceApplications = [];
 
             // Import shared dependencies first
             $keyPayloads = data_get($bundle, 'private_keys', []);
@@ -262,6 +338,17 @@ class ServerTransferImporter
                 $created['gitlab_apps']++;
             }
 
+            foreach (data_get($bundle, 'gitea_apps', []) as $gtPayload) {
+                // Defensive: never import system-wide Gitea Apps from a bundle.
+                if ((bool) data_get($gtPayload, 'is_system_wide', false)) {
+                    continue;
+                }
+                $gt = $this->importGiteaApp($gtPayload, $teamId, $preserveUuids);
+                $this->giteaAppMap[(string) data_get($gtPayload, 'uuid', $gt->uuid)] = $gt;
+                $this->giteaAppMap[$gt->uuid] = $gt;
+                $created['gitea_apps']++;
+            }
+
             foreach (data_get($bundle, 's3_storages', []) as $s3Payload) {
                 $s3 = $this->importS3Storage($s3Payload, $teamId, $preserveUuids);
                 $this->s3StorageMap[(string) data_get($s3Payload, 'uuid', $s3->uuid)] = $s3;
@@ -276,6 +363,13 @@ class ServerTransferImporter
                 $created['cloud_provider_tokens']++;
             }
 
+            foreach (data_get($bundle, 'integration_tokens', []) as $tokenPayload) {
+                $token = $this->importIntegrationToken($tokenPayload, $teamId, $preserveUuids);
+                $this->integrationTokenMap[(string) data_get($tokenPayload, 'uuid', $token->uuid)] = $token;
+                $this->integrationTokenMap[$token->uuid] = $token;
+                $created['integration_tokens']++;
+            }
+
             $serverKeyUuid = (string) data_get($bundle, 'private_key.uuid', '');
             $privateKey = $this->privateKeyMap[$serverKeyUuid]
                 ?? $this->importPrivateKey(data_get($bundle, 'private_key', []), $teamId, $preserveUuids);
@@ -283,8 +377,10 @@ class ServerTransferImporter
             $server = $this->importServer(data_get($bundle, 'server', []), $privateKey, $teamId, $preserveUuids, $adoptMode);
             $destinationMap = $this->importDestinations(data_get($bundle, 'destinations', []), $server, $preserveUuids);
             $created['destinations'] = count($destinationMap);
+            $this->importGithubRunnerConfig(data_get($bundle, 'github_runner_config'), $server, $teamId, $preserveUuids);
 
             $this->importServerSharedEnvVars(data_get($bundle, 'shared_environment_variables.server', []), $server, $teamId);
+            $this->importTeamSharedEnvVars(data_get($bundle, 'shared_environment_variables.team', []), $teamId);
 
             foreach (data_get($bundle, 'projects', []) as $projectPayload) {
                 $project = $this->importProject($projectPayload, $teamId, $preserveUuids, $created);
@@ -311,21 +407,20 @@ class ServerTransferImporter
                         $this->serviceMap[(string) data_get($servicePayload, 'uuid', $service->uuid)] = $service;
                         $created['services']++;
                     }
+
+                    $this->importCanvasPositions((array) data_get($environmentPayload, 'canvas_positions', []), $environment);
+                    $this->importResourceLinks((array) data_get($environmentPayload, 'resource_links', []), $environment, $preserveUuids);
                 }
             }
 
             $warnings = array_merge($warnings, $this->linkSqliteVolumes());
 
+            $this->importDnsZones(data_get($bundle, 'dns_zones', []), $preserveUuids);
+            $created['managed_dns_records'] = $this->importManagedDnsRecords(data_get($bundle, 'managed_dns_records', []), $teamId, $preserveUuids);
+
             $created['ssl_certificates'] = $this->importSslCertificates(data_get($bundle, 'ssl_certificates', []), $server);
             $created['volume_backups'] = $this->importVolumeBackups(data_get($bundle, 'volume_backups', []), $teamId);
-
-            $targetUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
-            if ($created['github_apps'] > 0) {
-                $warnings[] = "GitHub Apps imported. Update webhook URL to {$targetUrl}/webhooks/source/github/events (and setup/callback URLs in GitHub) so automations work on this instance.";
-            }
-            if ($created['gitlab_apps'] > 0) {
-                $warnings[] = "GitLab sources imported. Update webhook URL to {$targetUrl}/webhooks/source/gitlab/events so automations work on this instance.";
-            }
+            $warnings = array_merge($warnings, $this->importWarnings);
 
             $metadata = $server->server_metadata ?? [];
             $metadata['transfer'] = [
@@ -334,6 +429,7 @@ class ServerTransferImporter
                 'source_instance_url' => data_get($bundle, 'source_instance.url'),
                 'imported_at' => now()->toIso8601String(),
                 'adopt_mode' => $adoptMode,
+                'git_source_applications' => array_values(array_unique($this->gitSourceApplications)),
             ];
             $server->server_metadata = $metadata;
             $server->save();
@@ -348,9 +444,13 @@ class ServerTransferImporter
                 'export_id' => data_get($bundle, 'export_id'),
                 'claimed' => false,
                 'claim' => null,
+                'checklist' => $this->postTransferChecklist($bundle),
             ];
         });
 
+        // Provider and storage calls run after the import transaction commits, so an error cannot roll back DB rows.
+        $result['warnings'] = array_values(array_unique(array_merge($result['warnings'], $this->adoptManagedDnsRecords(), $this->storeProjectIcons())));
+
         // Claim after the import transaction commits so a claim failure cannot roll back DB rows.
         if (filled(data_get($result, 'server_uuid'))) {
             $server = Server::where('uuid', $result['server_uuid'])->where('team_id', $teamId)->first();
@@ -358,6 +458,10 @@ class ServerTransferImporter
                 try {
                     $result['claim'] = app(ServerTransferClaimer::class)->claim($server);
                     $result['claimed'] = true;
+                    // Same check as the Validate button. A running proxy and Docker are kept as they are.
+                    ValidateAndInstallServerJob::dispatch($server);
+                    $this->startFinishChecklist($server);
+                    $result['server_url'] = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/').'/server/'.$server->uuid;
                 } catch (Throwable $e) {
                     $result['claimed'] = false;
                     $result['claim'] = null;
@@ -369,6 +473,130 @@ class ServerTransferImporter
         return $result;
     }
 
+    /**
+     * Check the server connection fields with the same rules as the create server API.
+     *
+     * @param  array<string, mixed>  $server
+     */
+    private function assertValidServerPayload(array $server): void
+    {
+        Validator::make($server, [
+            'name' => 'nullable|string|max:255',
+            'ip' => ['required', 'string', new ValidServerIp],
+            'port' => 'required|integer|between:1,65535',
+            'user' => ValidationPatterns::serverUsernameRules(required: false),
+        ], [], [
+            'ip' => 'server.ip',
+            'port' => 'server.port',
+            'user' => 'server.user',
+        ])->validate();
+    }
+
+    /**
+     * Checks that a server can be imported into the team, without the bundle. Every check runs, so the
+     * source instance can show which checks are OK and which failed.
+     *
+     * @return list<array{field: string, label: string, ok: bool, message: string|null}>
+     */
+    public function importChecks(string $serverUuid, string $serverIp, int $teamId, bool $preserveUuids = true): array
+    {
+        $team = Team::find($teamId);
+        $archive = $preserveUuids ? $this->replaceableArchive($serverUuid, $teamId) : null;
+        // The archive is replaced, so the import does not add a server.
+        $limitReached = ! $team || ($archive === null && Team::serverLimitReached($team));
+
+        $existingServer = $preserveUuids && $archive === null ? Server::withTrashed()->where('uuid', $serverUuid)->first() : null;
+        $uuidMessage = match (true) {
+            $existingServer === null => null,
+            $existingServer->trashed() => "The server with UUID {$serverUuid} is still being deleted on this instance. Wait a minute, then transfer again.",
+            $existingServer->isTransferredAway() => "Another team of this instance has the archived copy of server {$existingServer->name}. Transfer the server into that team, or delete the archive there first.",
+            default => "A server with UUID {$serverUuid} already exists on this instance. Delete/transfer it first, or import with preserve_uuids=false.",
+        };
+
+        $ipExists = Server::where('ip', Server::normalizeIp($serverIp))->when($archive, fn ($query) => $query->whereKeyNot($archive->id))->exists();
+
+        return [
+            [
+                'field' => 'server',
+                'label' => 'the team can have one more server',
+                'ok' => ! $limitReached,
+                'message' => $limitReached ? 'Server limit reached for your subscription.' : null,
+            ],
+            [
+                'field' => 'server.uuid',
+                'label' => $archive ? 'the archived copy of this server on this instance is replaced' : 'no server with the same UUID exists',
+                'ok' => $uuidMessage === null,
+                'message' => $uuidMessage,
+            ],
+            [
+                'field' => 'server.ip',
+                'label' => 'no server with the same IP exists',
+                'ok' => ! $ipExists,
+                'message' => $ipExists ? "A server with IP/domain {$serverIp} already exists on this instance. Remove it first." : null,
+            ],
+        ];
+    }
+
+    /**
+     * The steps that finish the transfer here, and one notification that points the team to them.
+     * A failure here never fails the import: the server is imported and claimed already.
+     */
+    private function startFinishChecklist(Server $server): void
+    {
+        try {
+            $items = app(TransferFinishChecklist::class)->start($server);
+            $server->team?->notify(new GeneralNotification(
+                "Server '{$server->name}' was transferred to this instance. Open the server to finish the transfer: ".count($items).' steps to check.'
+            ));
+        } catch (Throwable $e) {
+            Log::warning('Could not start the transfer finish checklist', ['server_uuid' => $server->uuid, 'error' => $e->getMessage()]);
+        }
+    }
+
+    /**
+     * The archive that this instance kept when it transferred the server away. A transfer back into the same team
+     * replaces it.
+     */
+    private function replaceableArchive(string $serverUuid, int $teamId): ?Server
+    {
+        $server = Server::query()->where('uuid', $serverUuid)->where('team_id', $teamId)->first();
+
+        return $server?->isTransferredAway() ? $server : null;
+    }
+
+    /**
+     * @throws ValidationException with the first failed import check
+     */
+    public function assertCanImport(string $serverUuid, string $serverIp, int $teamId, bool $preserveUuids = true): void
+    {
+        foreach ($this->importChecks($serverUuid, $serverIp, $teamId, $preserveUuids) as $check) {
+            if (! $check['ok']) {
+                throw ValidationException::withMessages([$check['field'] => [$check['message']]]);
+            }
+        }
+    }
+
+    /**
+     * Running containers are found by the resource UUID. In adopt mode a new UUID would leave them
+     * without a resource, so a conflict stops the import instead.
+     *
+     * @param  class-string<Model>  $modelClass
+     */
+    private function resolveResourceUuid(string $modelClass, string $uuid, bool $adoptMode, string $label): string
+    {
+        if (! $modelClass::withTrashed()->where('uuid', $uuid)->exists()) {
+            return $uuid;
+        }
+
+        if ($adoptMode) {
+            throw ValidationException::withMessages([
+                'bundle' => ["The {$label} UUID {$uuid} is already used on this instance. Delete that {$label} permanently first, because adopt mode needs the same UUID to keep the running containers."],
+            ]);
+        }
+
+        return new_public_id();
+    }
+
     /**
      * @param  array<string, mixed>  $payload
      */
@@ -450,6 +678,12 @@ class ServerTransferImporter
             'private_key_id' => $privateKey->id,
             'team_id' => $teamId,
             'cloud_provider_token_id' => $cloudTokenId,
+            'hetzner_server_id' => data_get($payload, 'hetzner_server_id'),
+            'vultr_instance_id' => data_get($payload, 'vultr_instance_id'),
+            'digitalocean_droplet_id' => data_get($payload, 'digitalocean_droplet_id'),
+            'hostinger_virtual_machine_id' => data_get($payload, 'hostinger_virtual_machine_id'),
+            'proxy_error_page' => data_get($payload, 'proxy_error_page'),
+            'swarm_cluster' => data_get($payload, 'swarm_cluster'),
         ]);
         $server->uuid = $uuid;
         $server->save();
@@ -479,9 +713,17 @@ class ServerTransferImporter
                     'id', 'server_id', 'created_at', 'updated_at',
                     'is_reachable', 'is_usable', 'force_disabled',
                     'sentinel_token', 'sentinel_custom_url',
+                    // A foreign key of the source instance; older bundles still contain it.
+                    'cloudflare_tunnel_integration_token_id',
+                    'cloudflare_tunnel_integration_token_uuid',
+                    'patch_check_result', 'patch_check_error', 'patch_checked_at',
                 ])
                 ->all();
             $server->settings->fill($safe);
+            $server->settings->cloudflare_tunnel_integration_token_id = $this->importedIntegrationTokenId(
+                data_get($settingsPayload, 'cloudflare_tunnel_integration_token_uuid'),
+                'The Cloudflare tunnel of this server: its Cloudflare API token was not found on this instance; select it again in the Cloudflare tunnel settings.',
+            );
             // Imported servers start not validated; claim will rebind sentinel.
             $server->settings->is_reachable = false;
             $server->settings->is_usable = false;
@@ -593,6 +835,38 @@ class ServerTransferImporter
         }
     }
 
+    /**
+     * A team variable that already exists keeps the value of this instance.
+     *
+     * @param  list<array<string, mixed>>  $variables
+     */
+    private function importTeamSharedEnvVars(array $variables, int $teamId): void
+    {
+        foreach ($variables as $variable) {
+            $key = (string) data_get($variable, 'key');
+            $exists = SharedEnvironmentVariable::query()
+                ->where('type', 'team')
+                ->where('team_id', $teamId)
+                ->where('key', $key)
+                ->exists();
+            if ($exists) {
+                $this->importWarnings[] = "Team shared variable {$key} already exists on this instance. It keeps its value here, which can differ from the value on the source instance.";
+
+                continue;
+            }
+            SharedEnvironmentVariable::create([
+                'key' => $key,
+                'value' => data_get($variable, 'value'),
+                'is_multiline' => (bool) data_get($variable, 'is_multiline', false),
+                'is_literal' => (bool) data_get($variable, 'is_literal', false),
+                'is_shown_once' => (bool) data_get($variable, 'is_shown_once', false),
+                'comment' => data_get($variable, 'comment'),
+                'type' => 'team',
+                'team_id' => $teamId,
+            ]);
+        }
+    }
+
     /**
      * @param  array<string, mixed>  $payload
      * @param  array<string, int>  $created
@@ -603,9 +877,14 @@ class ServerTransferImporter
             ? (string) data_get($payload, 'uuid')
             : new_public_id();
 
+        $icon = data_get($payload, 'icon');
         $existing = Project::where('uuid', $uuid)->where('team_id', $teamId)->first();
         if ($existing) {
             $this->importProjectSharedEnvVars(data_get($payload, 'shared_environment_variables', []), $existing, $teamId);
+            // An icon that the project already has on this instance is kept.
+            if (is_array($icon) && blank($existing->icon_path)) {
+                $this->pendingProjectIcons[] = ['project' => $existing, 'icon' => $icon];
+            }
 
             return $existing;
         }
@@ -624,7 +903,124 @@ class ServerTransferImporter
 
         $this->importProjectSharedEnvVars(data_get($payload, 'shared_environment_variables', []), $project, $teamId);
 
-        return $project->fresh(['environments']);
+        $project = $project->fresh(['environments']);
+        if (is_array($icon)) {
+            $this->pendingProjectIcons[] = ['project' => $project, 'icon' => $icon];
+        }
+
+        return $project;
+    }
+
+    /**
+     * Stores the icons of the imported projects in the icon storage of this instance. Coolify stores every
+     * icon as a JPEG file and serves it as one, so other content is not stored.
+     *
+     * @return list<string> warnings
+     */
+    private function storeProjectIcons(): array
+    {
+        $warnings = [];
+        foreach ($this->pendingProjectIcons as ['project' => $project, 'icon' => $icon]) {
+            $contents = base64_decode((string) data_get($icon, 'content_base64', ''), true);
+            $problem = match (true) {
+                ! is_string($contents) || $contents === '' => 'its content is not valid',
+                strlen($contents) > ServerTransferExporter::MAX_PROJECT_ICON_BYTES => 'it is larger than 2 MB',
+                (new \finfo(FILEINFO_MIME_TYPE))->buffer($contents) !== 'image/jpeg' => 'it is not a JPEG image',
+                default => null,
+            };
+            if ($problem === null) {
+                try {
+                    app(ProjectIconStorageService::class)->storeProjectContents($project, $contents);
+
+                    continue;
+                } catch (Throwable) {
+                    $problem = 'the icon storage of this instance is not available';
+                }
+            }
+            $warnings[] = "The icon of project {$project->name} was not imported, because {$problem}. Upload it again in the project settings.";
+        }
+        $this->pendingProjectIcons = [];
+
+        return $warnings;
+    }
+
+    /**
+     * Manual steps after the transfer, with the URL of this instance in place of {target_url}.
+     *
+     * @param  array<string, mixed>  $bundle
+     * @return list<string>
+     */
+    private function postTransferChecklist(array $bundle): array
+    {
+        $targetUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
+
+        return array_values(array_unique(array_map(
+            fn (string $step) => str_replace('{target_url}', $targetUrl, $step),
+            array_filter((array) data_get($bundle, 'post_transfer_checklist', []), 'is_string'),
+        )));
+    }
+
+    /**
+     * The config is imported disabled: an enabled config makes this instance remove every runner container on
+     * the server that it does not know, also the runners that the source started. The user enables it after
+     * the GitHub App sends its webhooks here.
+     */
+    private function importGithubRunnerConfig(mixed $payload, Server $server, int $teamId, bool $preserveUuids): void
+    {
+        if (! is_array($payload)) {
+            return;
+        }
+
+        $appUuid = (string) data_get($payload, 'github_app_uuid', '');
+        $githubApp = $appUuid === '' ? null : ($this->githubAppMap[$appUuid]
+            ?? GithubApp::query()->where('uuid', $appUuid)->where('is_system_wide', true)->first()
+            ?? GithubApp::query()->where('uuid', $appUuid)->where('team_id', $teamId)->first());
+        if (! $githubApp) {
+            $this->importWarnings[] = 'The GitHub runner settings of this server were not imported, because their GitHub App was not found on this instance. Set up GitHub runners on the server again.';
+
+            return;
+        }
+
+        $validator = Validator::make($payload, [
+            'labels' => ['required', 'array', 'min:1'],
+            'labels.*' => ['string', 'regex:/\A[a-z0-9][a-z0-9._-]{0,99}\z/'],
+            'max_runners' => ['required', 'integer', 'min:1', 'max:32'],
+            'docker_mode' => ['required', Rule::enum(GithubRunnerDockerMode::class)],
+            'runner_image' => ['nullable', 'string', 'max:255', new DockerImageFormat],
+            'cpu_limit' => ['nullable', 'string', 'regex:/\A\d+(\.\d+)?\z/'],
+            'memory_limit' => ['nullable', 'string', 'regex:/\A\d+[bkmg]?\z/i'],
+            'capacity_wait_timeout' => ['required', 'integer', 'min:1', 'max:1440'],
+            'idle_timeout' => ['required', 'integer', 'min:1', 'max:1440'],
+            'job_timeout' => ['required', 'integer', 'min:1', 'max:7200'],
+        ]);
+        if ($validator->fails()) {
+            $this->importWarnings[] = 'The GitHub runner settings of this server were not imported, because they are not valid: '.$validator->errors()->first().' Set up GitHub runners on the server again.';
+
+            return;
+        }
+
+        $uuid = (string) data_get($payload, 'uuid', '');
+        $config = new GithubRunnerConfig;
+        $config->forceFill([
+            'server_id' => $server->id,
+            'github_app_id' => $githubApp->id,
+            'labels' => array_values($payload['labels']),
+            'is_enabled' => false,
+            'is_dedicated' => (bool) data_get($payload, 'is_dedicated', false),
+            'allow_pull_requests' => (bool) data_get($payload, 'allow_pull_requests', false),
+            'max_runners' => (int) $payload['max_runners'],
+            'docker_mode' => GithubRunnerDockerMode::from($payload['docker_mode']),
+            'runner_image' => data_get($payload, 'runner_image'),
+            'cpu_limit' => data_get($payload, 'cpu_limit'),
+            'memory_limit' => data_get($payload, 'memory_limit'),
+            'capacity_wait_timeout' => (int) $payload['capacity_wait_timeout'],
+            'idle_timeout' => (int) $payload['idle_timeout'],
+            'job_timeout' => (int) $payload['job_timeout'],
+        ]);
+        if ($preserveUuids && $uuid !== '' && ! GithubRunnerConfig::where('uuid', $uuid)->exists()) {
+            $config->uuid = $uuid;
+        }
+        $config->save();
     }
 
     /**
@@ -733,6 +1129,86 @@ class ServerTransferImporter
         }
     }
 
+    /**
+     * Canvas positions are keyed by resource uuid. Resources may get a new uuid on import.
+     *
+     * @param  array<string, mixed>  $positions
+     */
+    private function importCanvasPositions(array $positions, Environment $environment): void
+    {
+        $imported = [];
+        foreach ($positions as $uuid => $position) {
+            $resource = $this->applicationMap[$uuid] ?? $this->databaseMap[$uuid] ?? $this->serviceMap[$uuid] ?? null;
+            if ($resource) {
+                $imported[$resource->uuid] = $position;
+            }
+        }
+        if ($imported === []) {
+            return;
+        }
+
+        $environment->canvas_positions = array_merge($environment->canvas_positions ?? [], $imported);
+        $environment->save();
+    }
+
+    /**
+     * Links between two imported resources of the environment. The user who drew the link is a user of the
+     * source instance, so created_by stays empty.
+     *
+     * @param  list<array<string, mixed>>  $links
+     */
+    private function importResourceLinks(array $links, Environment $environment, bool $preserveUuids): void
+    {
+        foreach ($links as $link) {
+            $source = $this->linkedResource(data_get($link, 'source'));
+            $target = $this->linkedResource(data_get($link, 'target'));
+            if (! $source || ! $target || $source->is($target)
+                || (int) $source->environment_id !== $environment->id || (int) $target->environment_id !== $environment->id) {
+                $this->importWarnings[] = "A link between resources on the canvas of environment {$environment->name} was not imported, because one of its resources was not imported.";
+
+                continue;
+            }
+
+            $attributes = [
+                'environment_id' => $environment->id,
+                'source_type' => $source->getMorphClass(),
+                'source_id' => $source->getKey(),
+                'target_type' => $target->getMorphClass(),
+                'target_id' => $target->getKey(),
+            ];
+            if (ResourceLink::query()->where($attributes)->exists()) {
+                continue;
+            }
+
+            $label = data_get($link, 'label');
+            $resourceLink = new ResourceLink([
+                ...$attributes,
+                'label' => is_string($label) && trim($label) !== '' ? mb_substr(trim($label), 0, 64) : null,
+                'created_by' => null,
+            ]);
+            $uuid = (string) data_get($link, 'uuid', '');
+            if ($preserveUuids && $uuid !== '' && ! ResourceLink::where('uuid', $uuid)->exists()) {
+                $resourceLink->uuid = $uuid;
+            }
+            $resourceLink->save();
+        }
+    }
+
+    /**
+     * An end of a canvas link: the kind and the original uuid of an imported resource.
+     */
+    private function linkedResource(mixed $end): ?Model
+    {
+        $uuid = (string) data_get($end, 'uuid', '');
+
+        return match (data_get($end, 'kind')) {
+            'application' => $this->applicationMap[$uuid] ?? null,
+            'database' => $this->databaseMap[$uuid] ?? null,
+            'service' => $this->serviceMap[$uuid] ?? null,
+            default => null,
+        };
+    }
+
     /**
      * @param  array<string, mixed>  $payload
      * @param  array<string, StandaloneDocker|SwarmDocker>  $destinationMap
@@ -750,9 +1226,7 @@ class ServerTransferImporter
             ? (string) data_get($payload, 'uuid')
             : new_public_id();
 
-        if (Application::withTrashed()->where('uuid', $uuid)->exists()) {
-            $uuid = new_public_id();
-        }
+        $uuid = $this->resolveResourceUuid(Application::class, $uuid, $adoptMode, 'application');
 
         $attributes = (array) data_get($payload, 'attributes', []);
         unset($attributes['id'], $attributes['environment_id'], $attributes['destination_id'], $attributes['destination_type'], $attributes['source_id'], $attributes['source_type'], $attributes['private_key_id']);
@@ -763,6 +1237,8 @@ class ServerTransferImporter
         $attributes['destination_id'] = $destination->id;
         $attributes['destination_type'] = $destination->getMorphClass();
 
+        $name = (string) data_get($attributes, 'name', $uuid);
+
         // Re-link git source
         $source = data_get($payload, 'source');
         if (is_array($source) && filled(data_get($source, 'uuid'))) {
@@ -784,14 +1260,38 @@ class ServerTransferImporter
                     $attributes['source_type'] = GitlabApp::class;
                     $attributes['source_id'] = $gl->id;
                 }
+            } elseif ($sourceType === 'gitea_app') {
+                $gt = $this->giteaAppMap[$sourceUuid]
+                    ?? GiteaApp::query()->where('uuid', $sourceUuid)->where('is_system_wide', true)->first()
+                    ?? GiteaApp::query()->where('uuid', $sourceUuid)->where('team_id', $teamId)->first();
+                if ($gt) {
+                    $attributes['source_type'] = GiteaApp::class;
+                    $attributes['source_id'] = $gt->id;
+                }
             }
         }
+        $sourceMissing = data_get($payload, 'had_git_source') && ! isset($attributes['source_id']);
+        if ($sourceMissing || data_get($payload, 'source.system_wide') === true) {
+            $this->gitSourceApplications[] = $uuid;
+        }
+        if ($sourceMissing) {
+            $sourceLabel = match (data_get($payload, 'source.type')) {
+                'github_app' => 'GitHub App',
+                'gitlab_app' => 'GitLab App',
+                'gitea_app' => 'Gitea App',
+                default => 'git source',
+            };
+            $this->importWarnings[] = "Application {$name}: its {$sourceLabel} was not found on this instance; set the source again.";
+        }
 
         // Re-link deploy key
         $appKeyUuid = data_get($payload, 'private_key_uuid');
         if ($appKeyUuid && isset($this->privateKeyMap[$appKeyUuid])) {
             $attributes['private_key_id'] = $this->privateKeyMap[$appKeyUuid]->id;
         }
+        if (data_get($payload, 'had_private_key') && ! isset($attributes['private_key_id'])) {
+            $this->importWarnings[] = "Application {$name}: its private key was not found on this instance; select the private key again.";
+        }
 
         if ($adoptMode) {
             // Keep runtime status if provided so inventory can match, but default exited if empty.
@@ -800,7 +1300,10 @@ class ServerTransferImporter
             $attributes['status'] = 'exited';
         }
 
-        $application = Application::create($attributes);
+        $application = new Application($attributes);
+        // Maintenance mode is not fillable.
+        $application->forceFill(collect($attributes)->only(['is_maintenance_enabled', 'maintenance_page'])->all());
+        $application->save();
 
         $settings = (array) data_get($payload, 'settings', []);
         if ($settings !== [] && $application->settings) {
@@ -815,6 +1318,7 @@ class ServerTransferImporter
         $this->importScheduledTasks(data_get($payload, 'scheduled_tasks', []), $application, $teamId);
         $this->importTags(data_get($payload, 'tags', []), $application, $teamId);
         $this->importPreviews(data_get($payload, 'previews', []), $application, $preserveUuids, $adoptMode, $teamId);
+        $this->importSecretManagerLink(data_get($payload, 'secret_manager_link'), $application, "Application {$name}");
 
         return $application;
     }
@@ -832,12 +1336,9 @@ class ServerTransferImporter
         int $teamId = 0,
     ): ?Model {
         $type = (string) data_get($payload, 'type', 'StandalonePostgresql');
-        $modelClass = self::DATABASE_MODELS[$type]
-            ?? (is_string(data_get($payload, 'model')) && class_exists((string) data_get($payload, 'model'))
-                ? (string) data_get($payload, 'model')
-                : null);
+        $modelClass = self::DATABASE_MODELS[$type] ?? null;
 
-        if (! $modelClass || ! class_exists($modelClass)) {
+        if (! $modelClass) {
             throw new RuntimeException("Unsupported database type: {$type}");
         }
 
@@ -846,9 +1347,7 @@ class ServerTransferImporter
             ? (string) data_get($payload, 'uuid')
             : new_public_id();
 
-        if ($modelClass::withTrashed()->where('uuid', $uuid)->exists()) {
-            $uuid = new_public_id();
-        }
+        $uuid = $this->resolveResourceUuid($modelClass, $uuid, $adoptMode, 'database');
 
         $attributes = (array) data_get($payload, 'attributes', []);
         unset($attributes['id'], $attributes['environment_id'], $attributes['destination_id'], $attributes['destination_type']);
@@ -878,6 +1377,7 @@ class ServerTransferImporter
             $this->importTags(data_get($payload, 'tags', []), $database, $teamId);
         }
         $this->importScheduledBackups(data_get($payload, 'scheduled_backups', []), $database, $teamId);
+        $this->importSecretManagerLink(data_get($payload, 'secret_manager_link'), $database, "Database {$database->name}");
 
         return $database;
     }
@@ -900,9 +1400,7 @@ class ServerTransferImporter
             ? (string) data_get($payload, 'uuid')
             : new_public_id();
 
-        if (Service::withTrashed()->where('uuid', $uuid)->exists()) {
-            $uuid = new_public_id();
-        }
+        $uuid = $this->resolveResourceUuid(Service::class, $uuid, $adoptMode, 'service');
 
         $attributes = (array) data_get($payload, 'attributes', []);
         unset($attributes['id'], $attributes['environment_id'], $attributes['destination_id'], $attributes['destination_type'], $attributes['server_id']);
@@ -913,14 +1411,19 @@ class ServerTransferImporter
         $attributes['destination_id'] = $destination->id;
         $attributes['destination_type'] = $destination->getMorphClass();
 
-        $service = Service::create($attributes);
+        $service = new Service($attributes);
+        // Maintenance mode and the Coolify default variables switch are not fillable.
+        $service->forceFill(collect($attributes)->only(['is_maintenance_enabled', 'maintenance_page', 'include_coolify_default_variables'])->all());
+        $service->save();
 
         $this->importEnvVars(data_get($payload, 'environment_variables', []), $service, false);
         $this->importScheduledTasks(data_get($payload, 'scheduled_tasks', []), $service, $teamId);
         $this->importTags(data_get($payload, 'tags', []), $service, $teamId);
+        $this->importSecretManagerLink(data_get($payload, 'secret_manager_link'), $service, "Service {$service->name}");
 
         foreach (data_get($payload, 'applications', []) as $appPayload) {
-            $this->importServiceApplication($appPayload, $service, $preserveUuids, $adoptMode);
+            $serviceApp = $this->importServiceApplication($appPayload, $service, $preserveUuids, $adoptMode);
+            $this->serviceApplicationMap[(string) data_get($appPayload, 'uuid', $serviceApp->uuid)] = $serviceApp;
         }
 
         foreach (data_get($payload, 'databases', []) as $dbPayload) {
@@ -1033,11 +1536,16 @@ class ServerTransferImporter
                     'is_required' => (bool) data_get($variable, 'is_required', false),
                     // Exports from older versions have no flag; their values use the old escaping.
                     'uses_legacy_escaping' => (bool) data_get($variable, 'uses_legacy_escaping', true),
+                    'preserve_compose_null' => (bool) data_get($variable, 'preserve_compose_null', false),
                     'comment' => data_get($variable, 'comment'),
                     'order' => data_get($variable, 'order'),
                     'resourceable_type' => $resource->getMorphClass(),
                     'resourceable_id' => $resource->id,
                 ]);
+                // Older bundles have no version; the column default applies.
+                if (filled(data_get($variable, 'version'))) {
+                    $env->version = (string) data_get($variable, 'version');
+                }
                 $env->uuid = $uuid;
                 $env->save();
             });
@@ -1239,13 +1747,11 @@ class ServerTransferImporter
                 $uuid = new_public_id();
             }
 
-            $s3Id = null;
-            $s3Uuid = data_get($backup, 's3_storage_uuid');
-            if ($s3Uuid && isset($this->s3StorageMap[$s3Uuid])) {
-                $s3Id = $this->s3StorageMap[$s3Uuid]->id;
-            }
+            $s3Ids = $this->importedBackupS3StorageIds($backup);
+            $s3Id = $s3Ids[0] ?? null;
+            $this->warnAboutMissingS3Storage($backup, $s3Id, "database {$database->name}");
 
-            ScheduledDatabaseBackup::create([
+            $importedBackup = ScheduledDatabaseBackup::create([
                 'uuid' => $uuid,
                 'team_id' => $teamId,
                 'description' => data_get($backup, 'description'),
@@ -1262,13 +1768,45 @@ class ServerTransferImporter
                 'database_backup_retention_max_storage_s3' => data_get($backup, 'database_backup_retention_max_storage_s3'),
                 'timeout' => data_get($backup, 'timeout'),
                 'disable_local_backup' => (bool) data_get($backup, 'disable_local_backup', false),
+                'missing_backup_notification_days' => (int) data_get($backup, 'missing_backup_notification_days', 0),
                 's3_storage_id' => $s3Id,
                 'database_type' => $database->getMorphClass(),
                 'database_id' => $database->id,
             ]);
+            $importedBackup->syncS3Storages($s3Ids);
         }
     }
 
+    /**
+     * @param  array<string, mixed>  $backup
+     */
+    private function warnAboutMissingS3Storage(array $backup, ?int $s3Id, string $backupOf): void
+    {
+        if (! data_get($backup, 'had_s3_storage') || $s3Id !== null) {
+            return;
+        }
+
+        $this->importWarnings[] = data_get($backup, 'save_s3')
+            ? "Backup of {$backupOf}: S3 upload was turned off because its S3 storage was not found."
+            : "Backup of {$backupOf}: its S3 storage was not found; select it again.";
+    }
+
+    /**
+     * Maps the exported S3 destinations of a backup to imported storages, primary first. Older bundles only have
+     * `s3_storage_uuid`.
+     *
+     * @param  array<string, mixed>  $backup
+     * @return list<int>
+     */
+    private function importedBackupS3StorageIds(array $backup): array
+    {
+        $uuids = collect(data_get($backup, 's3_storage_uuids', []))
+            ->prepend(data_get($backup, 's3_storage_uuid'))
+            ->filter(fn ($uuid): bool => is_string($uuid) && isset($this->s3StorageMap[$uuid]));
+
+        return $uuids->map(fn (string $uuid): int => $this->s3StorageMap[$uuid]->id)->unique()->values()->all();
+    }
+
     /**
      * @param  array<string, mixed>  $payload
      */
@@ -1313,6 +1851,10 @@ class ServerTransferImporter
             'metadata' => data_get($payload, 'metadata'),
             'pull_requests' => data_get($payload, 'pull_requests'),
             'administration' => data_get($payload, 'administration'),
+            'organization_self_hosted_runners' => data_get($payload, 'organization_self_hosted_runners'),
+            'actions' => data_get($payload, 'actions'),
+            'webhook_events' => data_get($payload, 'webhook_events'),
+            'runner_group_id' => data_get($payload, 'runner_group_id'),
         ]);
         $app->uuid = $uuid;
         $app->save();
@@ -1375,6 +1917,55 @@ class ServerTransferImporter
         return $app;
     }
 
+    /**
+     * @param  array<string, mixed>  $payload
+     */
+    private function importGiteaApp(array $payload, int $teamId, bool $preserveUuids): GiteaApp
+    {
+        $uuid = $preserveUuids && filled(data_get($payload, 'uuid'))
+            ? (string) data_get($payload, 'uuid')
+            : new_public_id();
+
+        $existing = GiteaApp::where('uuid', $uuid)->where('team_id', $teamId)->first();
+        if ($existing) {
+            return $existing;
+        }
+        if (GiteaApp::where('uuid', $uuid)->exists()) {
+            $uuid = new_public_id();
+        }
+
+        $privateKeyId = null;
+        $keyUuid = data_get($payload, 'private_key_uuid');
+        if ($keyUuid && isset($this->privateKeyMap[$keyUuid])) {
+            $privateKeyId = $this->privateKeyMap[$keyUuid]->id;
+        }
+
+        $app = new GiteaApp;
+        $app->forceFill([
+            'team_id' => $teamId,
+            'private_key_id' => $privateKeyId,
+            'name' => data_get($payload, 'name') ?: 'Imported Gitea App',
+            'organization' => data_get($payload, 'organization'),
+            'api_url' => data_get($payload, 'api_url'),
+            'html_url' => data_get($payload, 'html_url'),
+            'custom_port' => data_get($payload, 'custom_port') ?? 22,
+            'custom_user' => data_get($payload, 'custom_user') ?? 'git',
+            'is_system_wide' => false,
+            'is_public' => (bool) data_get($payload, 'is_public', false),
+            'client_id' => data_get($payload, 'client_id'),
+            'client_secret' => data_get($payload, 'client_secret'),
+            'access_token' => data_get($payload, 'access_token'),
+            'refresh_token' => data_get($payload, 'refresh_token'),
+            'expires_at' => data_get($payload, 'expires_at'),
+            'redirect_uri' => data_get($payload, 'redirect_uri'),
+            'webhook_secret' => data_get($payload, 'webhook_secret'),
+        ]);
+        $app->uuid = $uuid;
+        $app->save();
+
+        return $app;
+    }
+
     /**
      * @param  array<string, mixed>  $payload
      */
@@ -1450,6 +2041,222 @@ class ServerTransferImporter
         return $token;
     }
 
+    /**
+     * A token with the same UUID in the target team is reused. A UUID that another team uses gets a new UUID.
+     *
+     * @param  array<string, mixed>  $payload
+     */
+    private function importIntegrationToken(array $payload, int $teamId, bool $preserveUuids): IntegrationToken
+    {
+        $uuid = $preserveUuids && filled(data_get($payload, 'uuid'))
+            ? (string) data_get($payload, 'uuid')
+            : new_public_id();
+
+        $existing = IntegrationToken::where('uuid', $uuid)->where('team_id', $teamId)->first();
+        if ($existing) {
+            return $existing;
+        }
+        if (IntegrationToken::where('uuid', $uuid)->exists()) {
+            $uuid = new_public_id();
+        }
+
+        $token = new IntegrationToken;
+        $token->forceFill([
+            'team_id' => $teamId,
+            'provider' => (string) data_get($payload, 'provider'),
+            'name' => data_get($payload, 'name') ?: 'Imported integration token',
+            'token' => (string) data_get($payload, 'token'),
+            'capabilities' => (array) data_get($payload, 'capabilities', []),
+            'metadata' => data_get($payload, 'metadata'),
+        ]);
+        $token->uuid = $uuid;
+        $token->save();
+
+        return $token;
+    }
+
+    /**
+     * The ID of the imported token, or null with a warning when the bundle names a token that it does not contain.
+     */
+    private function importedIntegrationTokenId(mixed $tokenUuid, string $missingWarning): ?int
+    {
+        if (! is_string($tokenUuid) || $tokenUuid === '') {
+            return null;
+        }
+        if (! isset($this->integrationTokenMap[$tokenUuid])) {
+            $this->importWarnings[] = $missingWarning;
+
+            return null;
+        }
+
+        return $this->integrationTokenMap[$tokenUuid]->id;
+    }
+
+    private function importSecretManagerLink(mixed $payload, Model $resource, string $label): void
+    {
+        if (! is_array($payload) || ! method_exists($resource, 'secretManagerLink')) {
+            return;
+        }
+
+        $tokenId = $this->importedIntegrationTokenId(
+            data_get($payload, 'integration_token_uuid'),
+            "{$label}: its secret manager token was not found on this instance; link the secret manager source again.",
+        );
+        if ($tokenId === null) {
+            return;
+        }
+
+        $uuid = filled(data_get($payload, 'uuid')) ? (string) data_get($payload, 'uuid') : new_public_id();
+        if (SecretManagerLink::where('uuid', $uuid)->exists()) {
+            $uuid = new_public_id();
+        }
+
+        $link = new SecretManagerLink;
+        $link->forceFill([
+            'resourceable_type' => $resource->getMorphClass(),
+            'resourceable_id' => $resource->getKey(),
+            'integration_token_id' => $tokenId,
+            'settings' => data_get($payload, 'settings'),
+        ]);
+        $link->uuid = $uuid;
+        $link->save();
+    }
+
+    /**
+     * A zone of the same token and provider zone that the target team already has is reused.
+     *
+     * @param  list<array<string, mixed>>  $zones
+     */
+    private function importDnsZones(array $zones, bool $preserveUuids): void
+    {
+        foreach ($zones as $payload) {
+            $token = $this->integrationTokenMap[(string) data_get($payload, 'integration_token_uuid')] ?? null;
+            if (! $token) {
+                continue;
+            }
+
+            $zone = DnsProviderZone::query()
+                ->where('integration_token_id', $token->id)
+                ->where('provider_zone_id', (string) data_get($payload, 'provider_zone_id'))
+                ->first();
+            if (! $zone) {
+                $uuid = $preserveUuids && filled(data_get($payload, 'uuid')) ? (string) data_get($payload, 'uuid') : new_public_id();
+                if (DnsProviderZone::where('uuid', $uuid)->exists()) {
+                    $uuid = new_public_id();
+                }
+                $zone = new DnsProviderZone;
+                $zone->forceFill([
+                    'integration_token_id' => $token->id,
+                    'provider_zone_id' => (string) data_get($payload, 'provider_zone_id'),
+                    'name' => strtolower((string) data_get($payload, 'name')),
+                    'account_id' => data_get($payload, 'account_id'),
+                    'account_name' => data_get($payload, 'account_name'),
+                ]);
+                $zone->uuid = $uuid;
+                $zone->save();
+            }
+
+            $this->dnsZoneMap[(string) data_get($payload, 'uuid', $zone->uuid)] = $zone;
+        }
+    }
+
+    /**
+     * Imports the managed DNS records and links them to the imported resources. An owned record keeps the ownership
+     * comment of the source at the provider until adoptManagedDnsRecords() replaces it.
+     *
+     * @param  list<array<string, mixed>>  $records
+     */
+    private function importManagedDnsRecords(array $records, int $teamId, bool $preserveUuids): int
+    {
+        $count = 0;
+        foreach ($records as $payload) {
+            $name = (string) data_get($payload, 'name');
+            $zone = $this->dnsZoneMap[(string) data_get($payload, 'dns_provider_zone_uuid')] ?? null;
+            $resources = collect(data_get($payload, 'references', []))
+                ->map(fn ($reference) => match (data_get($reference, 'kind')) {
+                    'application' => $this->applicationMap[(string) data_get($reference, 'uuid')] ?? null,
+                    'preview' => $this->previewMap[(string) data_get($reference, 'uuid')] ?? null,
+                    'service_application' => $this->serviceApplicationMap[(string) data_get($reference, 'uuid')] ?? null,
+                    default => null,
+                })
+                ->filter()
+                ->values();
+            if (! $zone || $resources->isEmpty()) {
+                $this->importWarnings[] = "DNS record {$name}: its DNS zone or resources were not imported, so this instance does not manage it.";
+
+                continue;
+            }
+
+            $record = ManagedDnsRecord::query()
+                ->where('dns_provider_zone_id', $zone->id)
+                ->where('provider_record_id', (string) data_get($payload, 'provider_record_id'))
+                ->first();
+            if (! $record) {
+                $uuid = $preserveUuids && filled(data_get($payload, 'uuid')) ? (string) data_get($payload, 'uuid') : new_public_id();
+                if (ManagedDnsRecord::where('uuid', $uuid)->exists()) {
+                    $uuid = new_public_id();
+                }
+                $previousComment = data_get($payload, 'ownership_comment');
+                // Without the source comment there is no proof of ownership at the provider.
+                $owned = (bool) data_get($payload, 'owned', false) && is_string($previousComment) && $previousComment !== '';
+
+                $record = ManagedDnsRecord::query()->create([
+                    'uuid' => $uuid,
+                    'team_id' => $teamId,
+                    'integration_token_id' => $zone->integration_token_id,
+                    'dns_provider_zone_id' => $zone->id,
+                    'provider_record_id' => (string) data_get($payload, 'provider_record_id'),
+                    'type' => (string) data_get($payload, 'type'),
+                    'name' => $name,
+                    'content' => (string) data_get($payload, 'content'),
+                    'owned' => $owned,
+                ]);
+                if ($owned && $previousComment !== $record->ownershipComment()) {
+                    $this->pendingDnsAdoptions[] = ['record_id' => $record->id, 'previous_comment' => $previousComment];
+                }
+                $count++;
+            }
+
+            foreach ($resources as $resource) {
+                $record->addReference($resource);
+            }
+        }
+
+        return $count;
+    }
+
+    /**
+     * Replaces the ownership comment of the source instance with the comment of this instance at the provider.
+     * A record that cannot be adopted is no longer owned, so this instance never changes or deletes it.
+     *
+     * @return list<string> warnings
+     */
+    private function adoptManagedDnsRecords(): array
+    {
+        $warnings = [];
+        foreach ($this->pendingDnsAdoptions as $adoption) {
+            $record = ManagedDnsRecord::query()->find($adoption['record_id']);
+            if (! $record) {
+                continue;
+            }
+
+            try {
+                $adopted = app(CloudflareDnsProvider::class)->adoptRecord($record, $adoption['previous_comment']);
+            } catch (Throwable) {
+                $adopted = false;
+            }
+            if ($adopted) {
+                continue;
+            }
+
+            $record->forceFill(['owned' => false])->save();
+            $warnings[] = "DNS record {$record->name}: this instance could not take ownership; it will not change or delete it.";
+        }
+        $this->pendingDnsAdoptions = [];
+
+        return $warnings;
+    }
+
     /**
      * @param  list<array<string, mixed>>  $previews
      */
@@ -1517,6 +2324,8 @@ class ServerTransferImporter
                 'git_type' => data_get($previewPayload, 'git_type'),
                 'docker_compose_domains' => data_get($previewPayload, 'docker_compose_domains'),
                 'docker_registry_image_tag' => data_get($previewPayload, 'docker_registry_image_tag'),
+                'domain_port_overrides' => data_get($previewPayload, 'domain_port_overrides'),
+                'max_restart_count' => (int) data_get($previewPayload, 'max_restart_count', 0),
             ];
 
             if ($preview) {
@@ -1537,6 +2346,8 @@ class ServerTransferImporter
                 $preview->save();
             }
 
+            $this->previewMap[(string) data_get($previewPayload, 'uuid', $preview->uuid)] = $preview;
+
             // Avoid duplicating volumes when re-importing the same preview.
             if ($preview->wasRecentlyCreated || $preview->persistentStorages()->count() === 0) {
                 $this->importPersistentStorages(data_get($previewPayload, 'persistent_storages', []), $preview);
@@ -1614,13 +2425,11 @@ class ServerTransferImporter
                 $uuid = new_public_id();
             }
 
-            $s3Id = null;
-            $s3Uuid = data_get($backupPayload, 's3_storage_uuid');
-            if ($s3Uuid && isset($this->s3StorageMap[$s3Uuid])) {
-                $s3Id = $this->s3StorageMap[$s3Uuid]->id;
-            }
+            $s3Ids = $this->importedBackupS3StorageIds($backupPayload);
+            $s3Id = $s3Ids[0] ?? null;
+            $this->warnAboutMissingS3Storage($backupPayload, $s3Id, 'volume '.($volume->name ?? $volume->mount_path));
 
-            ScheduledVolumeBackup::create([
+            $importedBackup = ScheduledVolumeBackup::create([
                 'uuid' => $uuid,
                 'backupable_type' => $volume->getMorphClass(),
                 'backupable_id' => $volume->id,
@@ -1638,7 +2447,9 @@ class ServerTransferImporter
                 'retention_days_s3' => data_get($backupPayload, 'retention_days_s3'),
                 'retention_max_storage_s3' => data_get($backupPayload, 'retention_max_storage_s3'),
                 'timeout' => data_get($backupPayload, 'timeout'),
+                'missing_backup_notification_days' => (int) data_get($backupPayload, 'missing_backup_notification_days', 0),
             ]);
+            $importedBackup->syncS3Storages($s3Ids);
             $count++;
         }
 
diff --git a/app/Services/ServerTransfer/ServerTransferMigrator.php b/app/Services/ServerTransfer/ServerTransferMigrator.php
index 2ec3b6c63d..1c8922c8d5 100644
--- a/app/Services/ServerTransfer/ServerTransferMigrator.php
+++ b/app/Services/ServerTransfer/ServerTransferMigrator.php
@@ -2,21 +2,402 @@
 
 namespace App\Services\ServerTransfer;
 
+use App\Enums\ApplicationDeploymentStatus;
+use App\Jobs\MigrateServerToInstanceJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\Project;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\User;
 use App\Rules\SafeWebhookUrl;
+use App\Services\Security\SensitiveDataRedactor;
+use Carbon\Carbon;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\QueryException;
 use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Validator;
+use Illuminate\Support\Sleep;
+use Illuminate\Support\Str;
 use RuntimeException;
 use Throwable;
 
 class ServerTransferMigrator
 {
+    /** Time the target gets for one import request. Its nginx can stop waiting earlier (99 s). */
+    public const IMPORT_TIMEOUT_SECONDS = 300;
+
+    /** How often and how long to ask the target for the result after the import request failed. */
+    public const STATUS_PROBE_ATTEMPTS = 20;
+
+    public const STATUS_PROBE_INTERVAL_SECONDS = 15;
+
+    public const STATUS_REQUEST_TIMEOUT_SECONDS = 15;
+
+    public const CHECK_TIMEOUT_SECONDS = 15;
+
+    /**
+     * Time the queued job gets. It must be longer than the import request and all status probes together,
+     * plus time for the export, so the worker does not stop the job after the target took the server.
+     */
+    public const MIGRATION_TIMEOUT_SECONDS = 1500;
+
+    /** Longer than the job timeout, so a running state older than this one is stale. */
+    public const STALE_MIGRATION_SECONDS = 1800;
+
     public function __construct(
         private ServerTransferExporter $exporter,
         private ServerTransferClaimer $claimer,
     ) {}
 
+    /** The UI shows this many of the latest log lines. */
+    public const MAX_LOG_ENTRIES = 100;
+
+    /**
+     * System-wide git sources that the target of the last precheck does not have.
+     *
+     * @var array{github: list<string>, gitlab: list<string>}
+     */
+    private array $missingSystemSources = ['github' => [], 'gitlab' => []];
+
+    /**
+     * Run the prechecks now, so the user sees problems at once, then run the transfer in a queued job.
+     * Every check writes a line to the transfer log; a failed check stops the transfer before it starts.
+     */
+    public function start(Server $server, string $targetUrl, string $targetToken): void
+    {
+        $targetUrl = $this->normalizeTargetUrl($targetUrl);
+        $token = $this->normalizeToken($targetToken);
+        if ($this->hasRunningMigration($server->fresh())) {
+            throw new RuntimeException('A transfer of this server is already running.');
+        }
+
+        $startedAt = now()->toIso8601String();
+        $log = [$this->logEntry("Running checks before the transfer to {$targetUrl}.")];
+        $checks = [
+            ...$this->migrationChecks($server),
+            $this->sshCheck($server),
+            ...$this->targetChecks($server, $targetUrl, $token),
+        ];
+        foreach ($checks as $check) {
+            $log[] = match ($check['ok']) {
+                true => ['at' => $check['at'], 'level' => 'success', 'message' => "OK: {$check['label']}."],
+                false => ['at' => $check['at'], 'level' => 'error', 'message' => "FAILED: {$check['label']}. {$check['message']}"],
+                null => ['at' => $check['at'], 'level' => 'warning', 'message' => "NOT CHECKED: {$check['label']}. {$check['message']}"],
+            };
+        }
+        foreach ([...$this->sharedProjectNotes($server), ...$this->systemSourceNotes($server)] as $note) {
+            $log[] = $this->logEntry($note);
+        }
+
+        $failed = array_values(array_filter($checks, fn (array $check) => $check['ok'] === false));
+        if ($failed !== []) {
+            $error = count($failed).' of '.count($checks).' checks failed: '.implode(' ', array_column($failed, 'message'));
+            $log[] = $this->logEntry('The transfer did not start, because '.count($failed).' check(s) failed. Fix them, then transfer again.', 'error');
+            DB::transaction(function () use ($server, $targetUrl, $startedAt, $error, $log) {
+                $this->writeMigration(Server::query()->lockForUpdate()->findOrFail($server->id), [
+                    'status' => 'failed',
+                    'phase' => 'checks',
+                    'target_url' => $targetUrl,
+                    'started_at' => $startedAt,
+                    'finished_at' => now()->toIso8601String(),
+                    'error' => $error,
+                    'log' => $log,
+                ]);
+            });
+
+            throw new RuntimeException($error);
+        }
+
+        $log[] = $this->logEntry('All checks passed. The transfer is queued.');
+        DB::transaction(function () use ($server, $targetUrl, $startedAt, $log) {
+            $locked = Server::query()->lockForUpdate()->findOrFail($server->id);
+            if ($this->hasRunningMigration($locked)) {
+                throw new RuntimeException('A transfer of this server is already running.');
+            }
+            $this->writeMigration($locked, [
+                'status' => 'running',
+                'target_url' => $targetUrl,
+                'started_at' => $startedAt,
+                'log' => $log,
+            ]);
+        });
+
+        MigrateServerToInstanceJob::dispatch($server, $targetUrl, $token);
+    }
+
+    /**
+     * Save the state of the queued transfer on the source server, so the UI and the API can show it.
+     *
+     * @param  array<string, mixed>  $details
+     */
+    public function recordMigration(Server $server, string $status, array $details = []): void
+    {
+        $entry = match ($status) {
+            'succeeded' => $this->logEntry('Transfer finished. The target instance manages the server now.', 'success'),
+            'unknown' => $this->logEntry('Transfer result unknown: '.data_get($details, 'error', 'unknown error'), 'warning'),
+            default => $this->logEntry('Transfer failed: '.data_get($details, 'error', 'unknown error'), 'error'),
+        };
+
+        DB::transaction(function () use ($server, $status, $details, $entry) {
+            $locked = Server::query()->lockForUpdate()->find($server->id);
+            if (! $locked) {
+                return;
+            }
+            $migration = array_merge((array) data_get($locked->server_metadata, 'migration', []), $details, [
+                'status' => $status,
+                'finished_at' => now()->toIso8601String(),
+            ]);
+            $migration['log'] = $this->appendToLog((array) data_get($migration, 'log', []), $entry);
+            $this->writeMigration($locked, $migration);
+        });
+    }
+
+    /**
+     * Record the result of a transfer job that the worker stopped, for example at its timeout. When the export
+     * was already sent, ask the target once, because the target can manage the server already.
+     */
+    public function recordStoppedMigration(Server $server, string $targetUrl, string $targetToken, string $error): void
+    {
+        $exportId = data_get($server->fresh()?->server_metadata, 'migration.export_id');
+        if (! is_string($exportId)) {
+            $this->recordMigration($server, 'failed', ['error' => $error]);
+
+            return;
+        }
+
+        $targetUrl = $this->normalizeTargetUrl($targetUrl);
+        $status = $this->targetTransferStatus($targetUrl, $this->normalizeToken($targetToken), $server->uuid, $exportId);
+
+        if ($status === 'claimed') {
+            try {
+                $this->claimer->markTransferred($server, exportId: $exportId, targetInstanceUrl: $targetUrl);
+                $this->recordMigration($server, 'succeeded', [
+                    'warnings' => ['The transfer job stopped before it finished. The target status confirms that the target manages the server.'],
+                ]);
+            } catch (Throwable) {
+                $this->recordMigration($server, 'unknown', [
+                    'error' => "{$error} The target manages the server, but this instance could not mark it as transferred. Call POST /api/v1/servers/{$server->uuid}/transfer/complete on this instance.",
+                ]);
+            }
+
+            return;
+        }
+
+        // The target answered that it does not manage this export, so this instance still manages the server.
+        if (in_array($status, ['imported', 'absent'], true)) {
+            $this->recordMigration($server, 'failed', ['error' => $error]);
+
+            return;
+        }
+
+        $this->recordMigration($server, 'unknown', [
+            'error' => "{$error} This instance could not ask {$targetUrl} whether it imported the server. ".
+                "Check the server on the target. If the target manages it, call POST /api/v1/servers/{$server->uuid}/transfer/complete on this instance. ".
+                'If not, transfer again.',
+        ]);
+    }
+
+    /**
+     * Add one line to the transfer log, so the UI can show where the transfer is.
+     *
+     * @param  array<string, mixed>  $fields  values to save in the transfer state with the line
+     */
+    public function log(Server $server, string $message, string $level = 'info', array $fields = []): void
+    {
+        $entry = $this->logEntry($message, $level);
+
+        DB::transaction(function () use ($server, $entry, $fields) {
+            $locked = Server::query()->lockForUpdate()->find($server->id);
+            if (! $locked) {
+                return;
+            }
+            $migration = array_merge((array) data_get($locked->server_metadata, 'migration', []), $fields);
+            $migration['log'] = $this->appendToLog((array) data_get($migration, 'log', []), $entry);
+            $this->writeMigration($locked, $migration);
+        });
+    }
+
+    /**
+     * @return array{at: string, level: string, message: string}
+     */
+    private function logEntry(string $message, string $level = 'info'): array
+    {
+        return ['at' => now()->toIso8601String(), 'level' => $level, 'message' => $message];
+    }
+
+    /**
+     * @param  list<array<string, string>>  $log
+     * @param  array<string, string>  $entry
+     * @return list<array<string, string>>
+     */
+    private function appendToLog(array $log, array $entry): array
+    {
+        return array_slice([...$log, $entry], -self::MAX_LOG_ENTRIES);
+    }
+
+    /**
+     * @return array{label: string, ok: bool|null, message: string|null, at: string}
+     */
+    private function check(string $label, ?bool $ok, ?string $message = null): array
+    {
+        return ['label' => $label, 'ok' => $ok, 'message' => $message, 'at' => now()->toIso8601String()];
+    }
+
+    /**
+     * @return array{label: string, ok: bool|null, message: string|null, at: string}
+     */
+    private function sshCheck(Server $server): array
+    {
+        ['uptime' => $reachable, 'error' => $error] = $server->validateConnection();
+
+        return $this->check(
+            'this instance can connect to the server over SSH',
+            (bool) $reachable,
+            $reachable ? null : 'This instance cannot connect to the server over SSH: '.rtrim($error ?: 'unknown error', '. ').'. Fix the connection, then transfer again.',
+        );
+    }
+
+    /**
+     * A running state older than the job can run is left over from a stopped worker, so it does not block a new start.
+     */
+    private function hasRunningMigration(Server $server): bool
+    {
+        $startedAt = data_get($server->server_metadata, 'migration.started_at');
+
+        return data_get($server->server_metadata, 'migration.status') === 'running'
+            && is_string($startedAt)
+            && Carbon::parse($startedAt)->gt(now()->subSeconds(self::STALE_MIGRATION_SECONDS));
+    }
+
+    /**
+     * @param  array<string, mixed>  $migration
+     */
+    private function writeMigration(Server $server, array $migration): void
+    {
+        $metadata = $server->server_metadata ?? [];
+        $metadata['migration'] = $migration;
+        $server->server_metadata = $metadata;
+        $server->save();
+    }
+
+    /**
+     * @return list<array{label: string, ok: bool|null, message: string|null, at: string}>
+     */
+    private function migrationChecks(Server $server): array
+    {
+        $activeDeployments = ApplicationDeploymentQueue::query()
+            ->where('server_id', $server->id)
+            ->whereIn('status', [ApplicationDeploymentStatus::QUEUED->value, ApplicationDeploymentStatus::IN_PROGRESS->value])
+            ->count();
+
+        return [
+            $this->check('the server is not the Coolify host', $server->id !== 0,
+                'The Coolify host (localhost) cannot be transferred between instances.'),
+            $this->check('this instance manages the server', ! $server->isTransferredAway(),
+                'This server was already transferred to another instance.'),
+            $this->check('no deployment is queued or running on the server', $activeDeployments === 0,
+                "{$activeDeployments} deployment(s) on this server are queued or running. Wait until they finish or cancel them, then transfer the server."),
+        ];
+    }
+
+    /**
+     * System-wide git sources are not transferred: an application re-links only to one with the same uuid on the
+     * target. One note per source that the target does not have, with the applications that lose their source.
+     *
+     * @return list<string>
+     */
+    private function systemSourceNotes(Server $server): array
+    {
+        $notes = [];
+        foreach ($this->systemSources($server) as $kind => $sources) {
+            foreach ($sources as $uuid => $source) {
+                if (in_array($uuid, $this->missingSystemSources[$kind], true)) {
+                    $label = $kind === 'github' ? 'GitHub App' : 'GitLab App';
+                    $notes[] = "NOTE: the system-wide {$label} '{$source['name']}' of this instance is not transferred, and the target has no matching one. "
+                        .'These applications need a new git source on the target: '.implode(', ', $source['applications']).'. The finish list on the target shows them.';
+                }
+            }
+        }
+
+        return $notes;
+    }
+
+    /**
+     * @return array{github: array<string, array{name: string, applications: list<string>}>, gitlab: array<string, array{name: string, applications: list<string>}>}
+     */
+    private function systemSources(Server $server): array
+    {
+        $sources = ['github' => [], 'gitlab' => []];
+        foreach ($server->applications()->unique('id') as $application) {
+            $source = $application->source;
+            $kind = match (true) {
+                $source instanceof GithubApp => 'github',
+                $source instanceof GitlabApp => 'gitlab',
+                default => null,
+            };
+            if ($kind === null || ! $source->is_system_wide) {
+                continue;
+            }
+            $sources[$kind][$source->uuid]['name'] = $source->name;
+            $sources[$kind][$source->uuid]['applications'][] = $application->name;
+        }
+
+        return $sources;
+    }
+
+    /**
+     * One note for every project that has resources on this server and on other servers. Only the
+     * resources of this server are transferred, so the user must know that the project is split.
+     *
+     * @return list<string>
+     */
+    private function sharedProjectNotes(Server $server): array
+    {
+        $resourcesOnServer = collect([
+            ...$server->applications(),
+            ...$server->databases(),
+            ...$server->services()->get(),
+        ]);
+        $keysOnServer = $resourcesOnServer->map(fn (Model $resource) => $resource::class.':'.$resource->getKey())->flip();
+
+        $projectIds = Environment::query()
+            ->whereIn('id', $resourcesOnServer->pluck('environment_id')->filter()->unique())
+            ->distinct()
+            ->pluck('project_id');
+        $projectIdByEnvironment = Environment::query()->whereIn('project_id', $projectIds)->pluck('project_id', 'id');
+
+        $otherServerCounts = collect([Application::class, Service::class, ...array_values(STANDALONE_DATABASE_MODELS)])
+            ->flatMap(fn (string $model) => $model::query()
+                ->whereIn('environment_id', $projectIdByEnvironment->keys())
+                ->pluck('environment_id', 'id')
+                ->reject(fn (int|string $environmentId, int|string $id) => $keysOnServer->has("{$model}:{$id}")))
+            ->countBy(fn (int|string $environmentId) => $projectIdByEnvironment[$environmentId]);
+
+        return Project::query()
+            ->whereIn('id', $otherServerCounts->keys())
+            ->orderBy('name')
+            ->get(['id', 'name'])
+            ->map(fn (Project $project) => "NOTE: project '{$project->name}' also has {$otherServerCounts[$project->id]} ".
+                Str::plural('resource', $otherServerCounts[$project->id]).' on other servers. They stay on this instance; only the resources of this server are transferred.')
+            ->all();
+    }
+
+    private function assertCanMigrate(Server $server): void
+    {
+        foreach ($this->migrationChecks($server) as $check) {
+            if (! $check['ok']) {
+                throw new RuntimeException($check['message']);
+            }
+        }
+    }
+
     /**
      * One-shot migrate: export on this instance → import+claim on target → complete on this instance.
      *
@@ -27,37 +408,41 @@ class ServerTransferMigrator
      *     import: array<string, mixed>,
      *     complete: array<string, mixed>,
      *     warnings: list<string>,
+     *     checklist: list<string>,
      *     message: string
      * }
      */
-    public function migrate(
-        Server $server,
-        string $targetUrl,
-        string $targetToken,
-        bool $preserveUuids = true,
-        bool $adoptMode = true,
-    ): array {
-        if ($server->id === 0) {
-            throw new RuntimeException('The Coolify host (localhost) cannot be transferred between instances.');
-        }
+    public function migrate(Server $server, string $targetUrl, string $targetToken): array
+    {
+        $server->refresh();
+        $this->assertCanMigrate($server);
 
         $targetUrl = $this->normalizeTargetUrl($targetUrl);
         $token = $this->normalizeToken($targetToken);
 
+        $this->log($server, 'Exporting the server configuration and its resources.');
         $bundle = $this->exporter->export($server, includeSensitive: true);
         $exportId = data_get($bundle, 'export_id');
         $warnings = array_values((array) data_get($bundle, 'warnings', []));
+        $checklist = $this->postTransferChecklist($bundle, $targetUrl);
+        // A job that the worker stops after this line reads the export ID to ask the target for the result.
+        $this->log($server, "Export {$exportId} created. Sending it to {$targetUrl}. The target imports the server and takes over management.", fields: ['export_id' => $exportId]);
 
         // Target import+claim runs in its own DB transaction on the remote instance.
         // Source DB is unchanged until markTransferred below — so a failed remote import leaves source intact.
         $importBody = $this->postImportToTarget(
+            server: $server,
             targetUrl: $targetUrl,
             token: $token,
             bundle: $bundle,
-            preserveUuids: $preserveUuids,
-            adoptMode: $adoptMode,
         );
 
+        // The target fills in its own public URL; the URL typed here can be an internal address.
+        $targetChecklist = array_values(array_filter((array) data_get($importBody, 'checklist', []), 'is_string'));
+        if ($targetChecklist !== []) {
+            $checklist = $targetChecklist;
+        }
+
         if (is_array(data_get($importBody, 'warnings'))) {
             $warnings = array_values(array_unique(array_merge($warnings, $importBody['warnings'])));
         }
@@ -66,13 +451,15 @@ class ServerTransferMigrator
         if (data_get($importBody, 'claimed') !== true) {
             throw new RuntimeException(
                 "Server was imported on {$targetUrl}, but the target could not take management of it. ".
-                'This instance still manages the server. Fix the problem on the target, click Enable management there, then click Disable management here. '.
+                'This instance still manages the server. Delete the imported server on the target, fix the problem, then transfer again. '.
                 'Target warnings: '.(implode(' ', (array) data_get($importBody, 'warnings', [])) ?: 'none')
             );
         }
 
+        $this->log($server, 'The target imported the server and manages it now. Disabling management on this instance.', 'success');
+
         // Cross-instance 2PC is impossible: if complete fails after a successful import, the target
-        // already owns the server. Surface that clearly so the operator can disable management here.
+        // already owns the server. Surface that clearly so the operator can complete the transfer here.
         try {
             $complete = $this->claimer->markTransferred(
                 $server,
@@ -80,9 +467,11 @@ class ServerTransferMigrator
                 targetInstanceUrl: $targetUrl,
             );
         } catch (Throwable $e) {
+            // Query errors include SQL and bindings, so they are never shown to the user.
+            $reason = $e instanceof QueryException ? 'a database error occurred' : remove_iip($e->getMessage());
             throw new RuntimeException(
-                "Server was imported on {$targetUrl}, but this instance could not mark it as transferred: {$e->getMessage()}. ".
-                'Disable management of this server here (or API: POST /api/v1/servers/{uuid}/transfer/complete) so automations stay disabled. Do not re-import on the target.',
+                "Server was imported on {$targetUrl}, but this instance could not mark it as transferred: {$reason}. ".
+                'Call POST /api/v1/servers/{uuid}/transfer/complete on this instance so automations stay disabled here. Do not re-import on the target.',
                 previous: $e
             );
         }
@@ -91,13 +480,80 @@ class ServerTransferMigrator
             'server_uuid' => $server->uuid,
             'export_id' => is_string($exportId) ? $exportId : null,
             'target_url' => $targetUrl,
-            'import' => $importBody,
+            'import' => app(SensitiveDataRedactor::class)->redactValue($importBody),
             'complete' => $complete,
             'warnings' => $warnings,
+            'checklist' => $checklist,
+            'target_server_url' => is_string(data_get($importBody, 'server_url')) ? data_get($importBody, 'server_url') : null,
             'message' => 'Server migrated to '.$targetUrl.'. Automations disabled on this instance.',
         ];
     }
 
+    /**
+     * Manual steps the user must do after the transfer. The exporter writes {target_url} where the URL of the target belongs.
+     *
+     * @param  array<string, mixed>  $bundle
+     * @return list<string>
+     */
+    private function postTransferChecklist(array $bundle, string $targetUrl): array
+    {
+        $steps = array_filter((array) data_get($bundle, 'post_transfer_checklist', []), 'is_string');
+
+        return array_values(array_unique(array_map(
+            fn (string $step) => str_replace('{target_url}', $targetUrl, $step),
+            $steps,
+        )));
+    }
+
+    /**
+     * Undo a transfer: ask the instance that manages the server now to transfer it back to this instance. That
+     * instance runs its prechecks at once and then a normal transfer; the import here replaces the archive.
+     * This instance creates a short-lived token for the import, scoped to the team of the archive.
+     */
+    public function requestTransferBack(Server $archive, User $user, string $managerUrl, string $managerToken, string $thisInstanceUrl): void
+    {
+        if (! $archive->isTransferredAway()) {
+            throw new RuntimeException('Only a server that was transferred to another instance can be transferred back.');
+        }
+
+        $managerUrl = $this->normalizeTargetUrl($managerUrl);
+        $managerToken = $this->normalizeToken($managerToken);
+        $thisInstanceUrl = rtrim(trim($thisInstanceUrl), '/');
+        if (! filter_var($thisInstanceUrl, FILTER_VALIDATE_URL)) {
+            throw new RuntimeException('Enter the URL at which the other instance reaches this instance.');
+        }
+
+        $importToken = $user->createToken("transfer back {$archive->uuid}", ['read', 'write'], now()->addHours(3), $archive->team_id);
+        $migrateUrl = $managerUrl.'/api/v1/servers/'.rawurlencode($archive->uuid).'/migrate';
+
+        try {
+            $response = $this->targetRequest($migrateUrl, $managerToken, self::CHECK_TIMEOUT_SECONDS * 4)
+                ->post($migrateUrl, ['target_url' => $thisInstanceUrl, 'target_token' => $importToken->plainTextToken]);
+        } catch (ConnectionException $e) {
+            $importToken->accessToken->delete();
+            throw new RuntimeException('This instance cannot reach '.remove_iip($managerUrl).': '.remove_iip($e->getMessage()), previous: $e);
+        }
+
+        if ($response->status() !== 202) {
+            $importToken->accessToken->delete();
+            $message = remove_iip((string) (data_get($response->json(), 'message') ?: 'no details'));
+            throw new RuntimeException(match ($response->status()) {
+                401 => 'The other instance does not accept the API token.',
+                403 => 'The API token of the other instance needs root, or read:sensitive and write, from an admin or owner. '.$message,
+                404 => 'The other instance does not know this server, or does not support transfers. '.$message,
+                default => "The other instance did not start the transfer back (HTTP {$response->status()}): {$message}",
+            });
+        }
+
+        DB::transaction(function () use ($archive, $managerUrl) {
+            $locked = Server::query()->lockForUpdate()->findOrFail($archive->id);
+            $metadata = $locked->server_metadata ?? [];
+            $metadata['transfer']['transfer_back'] = ['requested_at' => now()->toIso8601String(), 'from' => $managerUrl];
+            $locked->server_metadata = $metadata;
+            $locked->save();
+        });
+    }
+
     private function normalizeTargetUrl(string $targetUrl): string
     {
         $targetUrl = rtrim(trim($targetUrl), '/');
@@ -117,6 +573,10 @@ class ServerTransferMigrator
             return $targetUrl;
         }
 
+        if (strtolower((string) parse_url($targetUrl, PHP_URL_SCHEME)) !== 'https') {
+            throw new RuntimeException('The target instance URL must use https, because the transfer sends credentials.');
+        }
+
         Validator::make(['target_url' => $targetUrl], [
             'target_url' => ['required', new SafeWebhookUrl],
         ])->validate();
@@ -138,7 +598,7 @@ class ServerTransferMigrator
             $token = trim(substr($token, 7));
         }
         if ($token === '') {
-            throw new RuntimeException('A target instance API token is required (root or write + create servers).');
+            throw new RuntimeException('A target instance API token is required (root or write + deploy).');
         }
 
         return $token;
@@ -148,38 +608,40 @@ class ServerTransferMigrator
      * @param  array<string, mixed>  $bundle
      * @return array<string, mixed>
      */
-    private function postImportToTarget(
-        string $targetUrl,
-        string $token,
-        array $bundle,
-        bool $preserveUuids,
-        bool $adoptMode,
-    ): array {
+    private function postImportToTarget(Server $server, string $targetUrl, string $token, array $bundle): array
+    {
         $importUrl = $targetUrl.'/api/v1/servers/import';
 
         try {
-            $response = Http::timeout(120)
-                ->withOptions($this->isLocalDevelopmentTarget($importUrl)
-                    ? ['allow_redirects' => false]
-                    : SafeWebhookUrl::httpClientOptions($importUrl))
-                ->acceptJson()
-                ->withToken($token)
-                ->asJson()
+            $response = $this->targetRequest($importUrl, $token, self::IMPORT_TIMEOUT_SECONDS)
                 ->post($importUrl, [
                     'bundle' => $bundle,
                     'dry_run' => false,
-                    'preserve_uuids' => $preserveUuids,
-                    'adopt_mode' => $adoptMode,
+                    'preserve_uuids' => true,
+                    'adopt_mode' => true,
                 ]);
         } catch (ConnectionException $e) {
-            throw new RuntimeException("Could not reach target instance at {$importUrl}: {$e->getMessage()}", previous: $e);
+            return $this->resultFromTargetStatus($server, $targetUrl, $token, $bundle, 'the request could not reach the target or timed out')
+                ?? throw new RuntimeException('Could not reach target instance at '.remove_iip($importUrl).': '.remove_iip($e->getMessage()), previous: $e);
         } catch (Throwable $e) {
-            throw new RuntimeException("Transfer to target failed: {$e->getMessage()}", previous: $e);
+            throw new RuntimeException('Transfer to target failed: '.remove_iip($e->getMessage()), previous: $e);
         }
 
         $importBody = $response->json();
         if (! is_array($importBody)) {
-            $importBody = ['raw' => $response->body()];
+            $importBody = ['raw' => remove_iip($response->body())];
+        }
+
+        if ($response->status() === 404) {
+            throw new RuntimeException('The target instance does not support server transfer. Upgrade it to Coolify '.config('constants.coolify.version').' or newer.');
+        }
+
+        // A proxy timeout (502/504) or a server error does not mean that the import failed: the target can still finish it.
+        if ($response->serverError()) {
+            $result = $this->resultFromTargetStatus($server, $targetUrl, $token, $bundle, "the target answered with HTTP {$response->status()}");
+            if ($result !== null) {
+                return $result;
+            }
         }
 
         if (! $response->successful()) {
@@ -189,9 +651,160 @@ class ServerTransferMigrator
             if (is_array($message)) {
                 $message = json_encode($message);
             }
-            throw new RuntimeException("Target import failed (HTTP {$response->status()}): {$message}");
+            throw new RuntimeException("Target import failed (HTTP {$response->status()}): ".remove_iip((string) $message));
         }
 
         return $importBody;
     }
+
+    /**
+     * Ask the target whether it accepts the token and can import this server, so a wrong token or a
+     * conflict on the target fails before the transfer starts instead of in the queued job. When a
+     * check fails that the target checks depend on, those checks are reported as not checked.
+     *
+     * @return list<array{label: string, ok: bool|null, message: string|null, at: string}>
+     */
+    private function targetChecks(Server $server, string $targetUrl, string $token): array
+    {
+        $checkUrl = $targetUrl.'/api/v1/servers/import/check';
+        $reachLabel = 'the target instance at '.remove_iip($targetUrl).' can be reached';
+        $notChecked = fn (string $label) => $this->check('the checks on the target instance', null, "They did not run, because \"{$label}\" failed.");
+
+        $systemSources = $this->systemSources($server);
+        $this->missingSystemSources = ['github' => [], 'gitlab' => []];
+        try {
+            $response = $this->targetRequest($checkUrl, $token, self::CHECK_TIMEOUT_SECONDS)
+                ->get($checkUrl, [
+                    'server_uuid' => $server->uuid,
+                    'ip' => $server->ip,
+                    'port' => $server->port,
+                    'schema_version' => ServerTransferBundle::SCHEMA_VERSION,
+                    'system_github_apps' => array_keys($systemSources['github']),
+                    'system_gitlab_apps' => array_keys($systemSources['gitlab']),
+                ]);
+        } catch (ConnectionException $e) {
+            return [
+                $this->check($reachLabel, false, 'This instance cannot reach the target instance: '.remove_iip($e->getMessage())),
+                $notChecked($reachLabel),
+            ];
+        }
+
+        $checks = [$this->check($reachLabel, true)];
+        $status = $response->status();
+        $message = remove_iip((string) (data_get($response->json(), 'message') ?: 'no details'));
+
+        // An unknown route answers 404 before the token is checked, so this check comes first.
+        $gates = [
+            [404, 'the target instance supports server transfer', 'The target instance does not support server transfer. Upgrade it to Coolify '.config('constants.coolify.version').' or newer.'],
+            [401, 'the target instance accepts the API token', 'The target instance does not accept the API token. Create a new token on the target instance and paste it here.'],
+            [403, 'the API token can create servers on the target instance', 'Use a token with the root permission, or the write and deploy permissions, from an admin or owner. Target response: '.$message],
+        ];
+        foreach ($gates as [$failStatus, $label, $failMessage]) {
+            if ($status === $failStatus) {
+                return [...$checks, $this->check($label, false, $failMessage), $notChecked($label)];
+            }
+            $checks[] = $this->check($label, true);
+        }
+
+        foreach (['github', 'gitlab'] as $kind) {
+            $this->missingSystemSources[$kind] = array_values(array_filter((array) data_get($response->json(), "missing_system_sources.{$kind}", []), 'is_string'));
+        }
+
+        $remoteChecks = data_get($response->json(), 'checks');
+        if (! in_array($status, [200, 422], true) || ! is_array($remoteChecks)) {
+            return [...$checks, $this->check('the target instance answered the checks', false, "The target instance answered with HTTP {$status}: {$message}")];
+        }
+
+        foreach ($remoteChecks as $remoteCheck) {
+            $checks[] = $this->check(
+                'on the target: '.data_get($remoteCheck, 'label', 'unknown check'),
+                (bool) data_get($remoteCheck, 'ok'),
+                is_string(data_get($remoteCheck, 'message')) ? remove_iip(data_get($remoteCheck, 'message')) : null,
+            );
+        }
+
+        return $checks;
+    }
+
+    /**
+     * Ask the target whether it imported this export. Returns null when the target does not know it.
+     *
+     * @param  array<string, mixed>  $bundle
+     * @return array<string, mixed>|null
+     */
+    private function resultFromTargetStatus(Server $server, string $targetUrl, string $token, array $bundle, string $reason): ?array
+    {
+        $serverUuid = (string) data_get($bundle, 'server.uuid');
+        $exportId = (string) data_get($bundle, 'export_id');
+
+        $this->log($server, "The import request did not finish ({$reason}). The target can still finish the import, so this instance asks the target for the result.", 'warning');
+
+        for ($attempt = 1; $attempt <= self::STATUS_PROBE_ATTEMPTS; $attempt++) {
+            Sleep::for(self::STATUS_PROBE_INTERVAL_SECONDS)->seconds();
+            $this->log($server, "Asking the target for the import result (attempt {$attempt} of ".self::STATUS_PROBE_ATTEMPTS.').');
+
+            $status = $this->targetTransferStatus($targetUrl, $token, $serverUuid, $exportId);
+
+            // A rejected token stays rejected, so more attempts cannot confirm the import.
+            if ($status === 'rejected') {
+                return null;
+            }
+
+            if (in_array($status, ['claimed', 'imported'], true)) {
+                return [
+                    'server_uuid' => $serverUuid,
+                    'export_id' => $exportId,
+                    'claimed' => $status === 'claimed',
+                    'warnings' => ['The import request to the target timed out. The target status confirms the import.'],
+                ];
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Ask the target once what it knows about this export: 'claimed' or 'imported', 'absent' when the target
+     * does not have it, 'rejected' when the target rejects the token, or 'unknown' when there is no clear answer.
+     *
+     * @return 'claimed'|'imported'|'absent'|'rejected'|'unknown'
+     */
+    private function targetTransferStatus(string $targetUrl, string $token, string $serverUuid, string $exportId): string
+    {
+        $statusUrl = $targetUrl.'/api/v1/servers/'.rawurlencode($serverUuid).'/transfer';
+
+        try {
+            $response = $this->targetRequest($statusUrl, $token, self::STATUS_REQUEST_TIMEOUT_SECONDS)->get($statusUrl);
+        } catch (Throwable) {
+            return 'unknown';
+        }
+
+        if (in_array($response->status(), [401, 403], true)) {
+            return 'rejected';
+        }
+        if ($response->status() === 404) {
+            return 'absent';
+        }
+        if (! $response->successful()) {
+            return 'unknown';
+        }
+        if (data_get($response->json(), 'transfer.export_id') !== $exportId) {
+            return 'absent';
+        }
+
+        $status = data_get($response->json(), 'transfer.status');
+
+        return in_array($status, ['claimed', 'imported'], true) ? $status : 'unknown';
+    }
+
+    private function targetRequest(string $url, string $token, int $timeout): PendingRequest
+    {
+        return Http::timeout($timeout)
+            ->withOptions($this->isLocalDevelopmentTarget($url)
+                ? ['allow_redirects' => false]
+                : SafeWebhookUrl::httpClientOptions($url))
+            ->acceptJson()
+            ->withToken($token)
+            ->asJson();
+    }
 }
diff --git a/app/Services/ServerTransfer/TransferFinishChecklist.php b/app/Services/ServerTransfer/TransferFinishChecklist.php
new file mode 100644
index 0000000000..ee8d93dd79
--- /dev/null
+++ b/app/Services/ServerTransfer/TransferFinishChecklist.php
@@ -0,0 +1,581 @@
+<?php
+
+namespace App\Services\ServerTransfer;
+
+use App\Events\TransferFinishChanged;
+use App\Jobs\CheckTransferFinishStepsJob;
+use App\Models\Application;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\ManagedDnsRecord;
+use App\Models\ManagedDnsRecordReference;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\ServiceApplication;
+use App\Models\User;
+use App\Services\Dns\CloudflareDnsProvider;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+use Throwable;
+
+/**
+ * The steps that finish a transfer on the instance that manages the server now: webhooks, DNS, Sentinel, backups,
+ * and runners. Coolify checks each step where it can, and fixes some. The list is saved in
+ * server_metadata.transfer.finish, so its state survives a reload and is the same for every user of the team.
+ *
+ * An item is {key, type, subject, label, status, hint, message, details, error, link, link_label, checked_at}. The hint
+ * says what to do; message is the short result of the last check; details are values to copy (URLs); error is the
+ * technical reason of the last check.
+ * Status: pending (not checked yet), ok, action (the user must do something), done (the user marked it), or
+ * unchecked (Coolify cannot check it).
+ */
+class TransferFinishChecklist
+{
+    public const OPEN_STATUSES = ['pending', 'action', 'unchecked'];
+
+    /** Open steps are checked again in the background when the last check is older than this. */
+    public const RECHECK_AFTER_SECONDS = 30;
+
+    /** @var array<string, string> */
+    public const GROUPS = [
+        'server' => 'Server',
+        'git' => 'Git and webhooks',
+        'dns' => 'Domains and DNS',
+    ];
+
+    private const GROUP_OF_TYPE = [
+        'server_connection' => 'server', 'sentinel' => 'server', 's3_storage' => 'server',
+        'github_app_webhook' => 'git', 'github_app_urls' => 'git', 'gitlab_webhook' => 'git', 'manual_webhook' => 'git',
+        'git_source' => 'git', 'github_runners' => 'git',
+        'dns_record' => 'dns', 'domain' => 'dns',
+    ];
+
+    /** Types that the user can only mark as done. */
+    private const MANUAL_TYPES = ['github_app_urls'];
+
+    /** Types that Coolify can fix with one click. */
+    private const FIX_LABELS = [
+        'github_app_webhook' => 'Set webhook URL',
+        'sentinel' => 'Restart Sentinel',
+        'dns_record' => 'Take ownership',
+    ];
+
+    /**
+     * Build the list for a server that this instance manages now. It replaces an earlier list.
+     *
+     * @return list<array<string, mixed>>
+     */
+    public function start(Server $server): array
+    {
+        $items = $this->buildItems($server);
+        $this->save($server, [
+            'started_at' => now()->toIso8601String(),
+            'finished_at' => null,
+            'finished_by' => null,
+            'skipped' => [],
+            'items' => $items,
+        ]);
+
+        return $items;
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    public function of(Server $server): ?array
+    {
+        $finish = data_get($server->server_metadata, 'transfer.finish');
+
+        return is_array($finish) ? $finish : null;
+    }
+
+    public function isOpen(Server $server): bool
+    {
+        $finish = $this->of($server);
+
+        return $finish !== null && $finish['finished_at'] === null && ! $server->isTransferredAway();
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    public function openItems(Server $server): array
+    {
+        return array_values(array_filter((array) data_get($this->of($server), 'items', []), fn (array $item) => in_array($item['status'], self::OPEN_STATUSES, true)));
+    }
+
+    public function groupOf(array $item): string
+    {
+        return self::GROUP_OF_TYPE[$item['type']] ?? 'server';
+    }
+
+    /**
+     * Run the checks of the open steps in a queued job when the last run is older than RECHECK_AFTER_SECONDS.
+     */
+    public function checkWhenStale(Server $server): void
+    {
+        $finish = $this->of($server);
+        if (! $this->isOpen($server) || $this->openItems($server) === []) {
+            return;
+        }
+        $lastCheckedAt = data_get($finish, 'last_checked_at');
+        if (is_string($lastCheckedAt) && Carbon::parse($lastCheckedAt)->isAfter(now()->subSeconds(self::RECHECK_AFTER_SECONDS))) {
+            return;
+        }
+
+        CheckTransferFinishStepsJob::dispatch($server);
+    }
+
+    public function canCheck(array $item): bool
+    {
+        return ! in_array($item['type'], self::MANUAL_TYPES, true);
+    }
+
+    /**
+     * Where the user does the step. GitHub App links are built on each render, so lists saved before a rename of
+     * the App, or before the link existed, still point to the right page.
+     *
+     * @return array{0: string, 1: string}|null
+     */
+    public function linkOf(array $item): ?array
+    {
+        if (in_array($item['type'], ['github_app_webhook', 'github_app_urls'], true)) {
+            $githubApp = GithubApp::where('uuid', $item['subject'])->first();
+
+            return $githubApp ? [$githubApp->settingsUrl(), 'Open on GitHub'] : null;
+        }
+
+        return filled($item['link'] ?? null) ? [$item['link'], $item['link_label'] ?? 'Open'] : null;
+    }
+
+    public function fixLabel(array $item): ?string
+    {
+        return self::FIX_LABELS[$item['type']] ?? null;
+    }
+
+    public function check(Server $server, string $key): array
+    {
+        return $this->update($server, $key, fn (array $item) => $this->runCheck($server, $item));
+    }
+
+    public function checkAll(Server $server): void
+    {
+        foreach ($this->openItems($server) as $item) {
+            if ($this->canCheck($item)) {
+                $this->check($server, $item['key']);
+            }
+        }
+
+        $finish = (array) $this->of($server->fresh());
+        $finish['last_checked_at'] = now()->toIso8601String();
+        $this->save($server, $finish);
+    }
+
+    public function fix(Server $server, string $key): array
+    {
+        return $this->update($server, $key, function (array $item) use ($server) {
+            if ($this->fixLabel($item) === null) {
+                throw new RuntimeException('Coolify cannot fix this step. Do it by hand, then mark it as done.');
+            }
+            $this->runFix($server, $item);
+
+            // Sentinel restarts in the background, so a check now would always fail.
+            return $item['type'] === 'sentinel'
+                ? ['pending', 'Sentinel restarts. The step turns OK when Sentinel sends data.', null]
+                : $this->runCheck($server, $item);
+        });
+    }
+
+    public function markDone(Server $server, string $key): array
+    {
+        return $this->update($server, $key, fn (array $item) => ['done', 'Marked as done by '.(auth()->user()?->name ?? 'a user').'.', null]);
+    }
+
+    /**
+     * The user finished the transfer. Open steps are not checked again; they are kept in the list as skipped.
+     */
+    public function finish(Server $server, User $user): void
+    {
+        $finish = $this->of($server) ?? throw new RuntimeException('This server has no transfer to finish.');
+        $finish['finished_at'] = now()->toIso8601String();
+        $finish['finished_by'] = $user->id;
+        $finish['skipped'] = array_column($this->openItems($server), 'key');
+        $this->save($server, $finish);
+    }
+
+    /**
+     * Webhook controllers call this when a verified webhook arrives, so a check can see that the new URL works.
+     */
+    public static function recordWebhook(string $kind, ?string $uuid): void
+    {
+        if (filled($uuid)) {
+            Cache::put("transfer-finish:webhook:{$kind}:{$uuid}", now()->toIso8601String(), now()->addDays(60));
+        }
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    private function buildItems(Server $server): array
+    {
+        $applications = $server->applications()->unique('id')->values();
+        $serviceApplications = $server->services()->with('applications')->get()->flatMap->applications;
+        $runnerConfig = $server->githubRunnerConfig()->with('githubApp')->first();
+        $items = [
+            $this->item('server_connection', 'server', 'Connection to the server'),
+            $this->item('sentinel', 'server', 'Sentinel sends its data to this instance'),
+        ];
+
+        $githubApps = $applications->map(fn (Application $application) => $application->source)
+            ->push($runnerConfig?->githubApp)
+            ->filter(fn ($source) => $source instanceof GithubApp && ! $source->is_system_wide && ! $source->is_public)
+            ->unique('id');
+        foreach ($githubApps as $githubApp) {
+            $items[] = $this->item('github_app_webhook', $githubApp->uuid, "Webhook URL of GitHub App {$githubApp->name}",
+                'GitHub must send webhooks to this instance.', [['label' => 'Webhook URL', 'value' => $this->githubWebhookUrl()]]);
+            $items[] = $this->item('github_app_urls', $githubApp->uuid, "Setup and Callback URL of GitHub App {$githubApp->name}",
+                'Set both in the GitHub App settings. GitHub has no API for them.', [
+                    ['label' => 'Setup URL', 'value' => $this->instanceUrl().'/webhooks/source/github/install'],
+                    ['label' => 'Callback URL', 'value' => $this->instanceUrl().'/login/github/app'],
+                ]);
+        }
+
+        $gitlabApps = $applications->map(fn (Application $application) => $application->source)
+            ->filter(fn ($source) => $source instanceof GitlabApp && ! $source->is_system_wide)
+            ->unique('id');
+        foreach ($gitlabApps as $gitlabApp) {
+            $items[] = $this->item('gitlab_webhook', $gitlabApp->uuid, "GitLab webhooks of GitLab App {$gitlabApp->name}",
+                'Set the webhook URL in each GitLab project that uses it, then push once.',
+                [['label' => 'Webhook URL', 'value' => $this->instanceUrl().'/webhooks/source/gitlab/events']]);
+        }
+
+        // These applications get a git source step instead: their source is not on this instance.
+        $gitSourceApplications = (array) data_get($server->server_metadata, 'transfer.git_source_applications', []);
+        foreach ($applications as $application) {
+            // A Docker image application keeps a default git_repository, but it never deploys from git.
+            if (! in_array($application->uuid, $gitSourceApplications, true) && $application->build_pack !== 'dockerimage' && filled($application->git_repository) && (! $application->source || data_get($application->source, 'is_public') === true)) {
+                $items[] = $this->item('manual_webhook', $application->uuid, "Manual webhook of {$application->name}",
+                    'If the repository has a webhook to Coolify, change its URL, then push once.',
+                    array_map(fn (string $provider, string $label) => ['label' => $label, 'value' => "{$this->instanceUrl()}/webhooks/source/{$provider}/events/manual"],
+                        ['github', 'gitlab', 'bitbucket', 'gitea'], ['GitHub', 'GitLab', 'Bitbucket', 'Gitea']));
+            }
+        }
+
+        foreach ($this->dnsRecords($applications, $serviceApplications) as $record) {
+            $items[] = $this->item('dns_record', $record->uuid, "DNS record {$record->name}");
+        }
+
+        $hosts = $applications->flatMap(fn (Application $application) => $application->fqdns)
+            ->concat($serviceApplications->flatMap(fn (ServiceApplication $application) => explode(',', (string) $application->fqdn)))
+            ->map(fn ($url) => strtolower((string) parse_url(trim((string) $url), PHP_URL_HOST)))
+            ->filter()
+            ->unique();
+        foreach ($hosts as $host) {
+            $items[] = $this->item('domain', $host, "Domain {$host} points to the server");
+        }
+
+        foreach ($this->s3Storages($server) as $storage) {
+            $items[] = $this->item('s3_storage', $storage->uuid, "S3 storage {$storage->name} works from this instance");
+        }
+
+        if ($runnerConfig) {
+            $items[] = $this->item('github_runners', $runnerConfig->uuid, 'GitHub runners on this server',
+                'Disabled after the transfer. Enable them when the GitHub App sends its webhooks here.', [],
+                route('server.github-runners', ['server_uuid' => $server->uuid], false), 'Open runners');
+        }
+
+        // Links are relative: the list is built during the import request, whose host can be an internal one.
+        // The importer lists applications that used a system-wide git source, or a source that this instance lacks.
+        foreach ($applications->whereIn('uuid', $gitSourceApplications) as $application) {
+            $environment = $application->environment;
+            $items[] = $this->item('git_source', $application->uuid, "Git source of {$application->name}",
+                'System-wide git sources are not transferred. Select a source of this instance.', [],
+                $environment?->project ? route('project.application.source', [
+                    'project_uuid' => $environment->project->uuid,
+                    'environment_uuid' => $environment->uuid,
+                    'application_uuid' => $application->uuid,
+                ], false) : null, 'Open source');
+        }
+
+        return $items;
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null} status, short message, technical reason
+     */
+    private function runCheck(Server $server, array $item): array
+    {
+        $startedAt = Carbon::parse((string) data_get($this->of($server), 'started_at', now()->toIso8601String()));
+
+        return match ($item['type']) {
+            'server_connection' => ($result = $server->validateConnection())['uptime']
+                ? ['ok', 'This instance connects to the server over SSH.', null]
+                : ['action', 'This instance cannot connect to the server over SSH.', $result['error']],
+            'sentinel' => $server->sentinel_updated_at && Carbon::parse($server->sentinel_updated_at)->isAfter($startedAt)
+                ? ['ok', 'Sentinel sent data at '.Carbon::parse($server->sentinel_updated_at)->format('H:i').'.', null]
+                : ['action', 'No data from Sentinel since the transfer.', null],
+            'github_app_webhook' => $this->checkGithubAppWebhook($item['subject'], $startedAt),
+            'gitlab_webhook' => $this->checkWebhookReceipt('gitlab_app', $item['subject'], $startedAt),
+            'manual_webhook' => $this->checkWebhookReceipt('application', $item['subject'], $startedAt),
+            'dns_record' => $this->checkDnsRecord($item['subject']),
+            'domain' => $this->checkDomain($server, $item['subject']),
+            's3_storage' => $this->checkS3Storage($item['subject']),
+            'git_source' => $this->checkGitSource($item['subject']),
+            'github_runners' => $server->githubRunnerConfig()->value('is_enabled')
+                ? ['ok', 'GitHub runners are enabled.', null]
+                : ['action', 'Disabled after the transfer. Enable them when the GitHub App sends its webhooks here.', null],
+            default => throw new RuntimeException('Coolify cannot check this step. Do it by hand, then mark it as done.'),
+        };
+    }
+
+    private function runFix(Server $server, array $item): void
+    {
+        match ($item['type']) {
+            'github_app_webhook' => $this->githubAppRequest(GithubApp::where('uuid', $item['subject'])->firstOrFail(), 'patch', '/app/hook/config', ['url' => $this->githubWebhookUrl()]),
+            'sentinel' => $server->restartSentinel(),
+            'dns_record' => app(CloudflareDnsProvider::class)->reclaimRecord(ManagedDnsRecord::where('uuid', $item['subject'])->firstOrFail())
+                ? ManagedDnsRecord::where('uuid', $item['subject'])->update(['owned' => true])
+                : throw new RuntimeException('Coolify could not take ownership: the record changed at Cloudflare, or Cloudflare cannot be reached.'),
+        };
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkGithubAppWebhook(string $uuid, Carbon $startedAt): array
+    {
+        $githubApp = GithubApp::where('uuid', $uuid)->first();
+        if (! $githubApp) {
+            return ['unchecked', 'The GitHub App does not exist on this instance anymore.', null];
+        }
+
+        try {
+            $url = (string) data_get($this->githubAppRequest($githubApp, 'get', '/app/hook/config'), 'url');
+        } catch (Throwable $e) {
+            // Without the API, a webhook that arrives here still proves the URL.
+            [$status, $message] = $this->checkWebhookReceipt('github_app', $uuid, $startedAt);
+
+            return [$status, $status === 'ok' ? $message : 'GitHub cannot be asked with the App key. '.$message, $e->getMessage()];
+        }
+
+        return rtrim($url, '/') === $this->githubWebhookUrl()
+            ? ['ok', 'GitHub sends webhooks to this instance.', null]
+            : ['action', 'GitHub sends webhooks to another URL.', 'Current URL: '.($url ?: 'none')];
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkWebhookReceipt(string $kind, string $uuid, Carbon $startedAt): array
+    {
+        $receivedAt = Cache::get("transfer-finish:webhook:{$kind}:{$uuid}");
+        if (is_string($receivedAt) && Carbon::parse($receivedAt)->isAfter($startedAt)) {
+            return ['ok', 'A webhook arrived at '.Carbon::parse($receivedAt)->format('H:i').'.', null];
+        }
+
+        return ['action', 'No webhook arrived since the transfer.', null];
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkDnsRecord(string $uuid): array
+    {
+        $record = ManagedDnsRecord::where('uuid', $uuid)->first();
+        if (! $record) {
+            return ['unchecked', 'This instance does not track this record anymore.', null];
+        }
+        if ($record->owned && app(CloudflareDnsProvider::class)->reclaimRecord($record)) {
+            return ['ok', 'This instance manages the record at Cloudflare.', null];
+        }
+
+        return $record->owned
+            ? ['action', 'Cloudflare does not confirm the record.', 'The record changed at Cloudflare, or Cloudflare cannot be reached with the token.']
+            : ['action', 'This instance does not own the record yet.', 'Until it owns the record, this instance does not change or delete it.'];
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkDomain(Server $server, string $host): array
+    {
+        $serverIps = filter_var($server->ip, FILTER_VALIDATE_IP) ? [$server->ip] : (gethostbynamel($server->ip) ?: []);
+        $records = @dns_get_record($host, DNS_A | DNS_AAAA) ?: [];
+        $ips = array_values(array_filter(array_map(fn (array $record) => $record['ip'] ?? $record['ipv6'] ?? null, $records)));
+        if ($ips === []) {
+            return ['action', 'The domain does not resolve.', null];
+        }
+        if (array_intersect($ips, $serverIps) !== []) {
+            return ['ok', 'The domain points to the server.', null];
+        }
+
+        return ['action', 'The domain points to another address.', 'Resolves to '.implode(', ', $ips).'; the server is '.implode(', ', $serverIps ?: [$server->ip]).'. If a proxy or load balancer is in front, mark it as done.'];
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkS3Storage(string $uuid): array
+    {
+        $storage = S3Storage::where('uuid', $uuid)->first();
+        if (! $storage) {
+            return ['unchecked', 'The S3 storage does not exist on this instance anymore.', null];
+        }
+        try {
+            $storage->testConnection(shouldSave: true);
+        } catch (Throwable $e) {
+            return ['action', 'This instance cannot use the S3 storage.', $e->getMessage()];
+        }
+
+        return $storage->fresh()->is_usable ? ['ok', 'This instance can use the S3 storage.', null] : ['action', 'This instance cannot use the S3 storage.', null];
+    }
+
+    private function githubAppRequest(GithubApp $githubApp, string $method, string $path, array $data = []): array
+    {
+        $response = Http::GitSource($githubApp->api_url)
+            ->withHeaders(['Authorization' => 'Bearer '.generateGithubJwt($githubApp), 'Accept' => 'application/vnd.github+json'])
+            ->{$method}(rtrim($githubApp->api_url, '/').$path, $data);
+        if (! $response->successful()) {
+            throw new RuntimeException('GitHub answered with HTTP '.$response->status().': '.data_get($response->json(), 'message', 'no details'));
+        }
+
+        return (array) $response->json();
+    }
+
+    /**
+     * @param  Collection<int, Application>  $applications
+     * @param  Collection<int, ServiceApplication>  $serviceApplications
+     * @return Collection<int, ManagedDnsRecord>
+     */
+    private function dnsRecords(Collection $applications, Collection $serviceApplications): Collection
+    {
+        $ids = ManagedDnsRecordReference::query()
+            ->where(function ($query) use ($applications, $serviceApplications) {
+                $query->where(fn ($q) => $q->where('resource_type', (new Application)->getMorphClass())->whereIn('resource_id', $applications->pluck('id')))
+                    ->orWhere(fn ($q) => $q->where('resource_type', (new ServiceApplication)->getMorphClass())->whereIn('resource_id', $serviceApplications->pluck('id')));
+            })
+            ->pluck('managed_dns_record_id');
+
+        return ManagedDnsRecord::query()->whereIn('id', $ids)->orderBy('name')->get();
+    }
+
+    /**
+     * @return Collection<int, S3Storage>
+     */
+    private function s3Storages(Server $server): Collection
+    {
+        $ids = collect($server->databases())
+            ->flatMap(fn ($database) => method_exists($database, 'scheduledBackups') ? $database->scheduledBackups()->get() : [])
+            ->flatMap(fn ($backup) => [$backup->s3_storage_id, ...$backup->s3Storages()->pluck('s3_storages.id')->all()])
+            ->filter()
+            ->unique();
+
+        return S3Storage::query()->whereIn('id', $ids)->where('team_id', $server->team_id)->get();
+    }
+
+    /**
+     * @param  callable(array<string, mixed>): array{0: string, 1: string}  $change
+     * @return array<string, mixed>
+     */
+    private function update(Server $server, string $key, callable $change): array
+    {
+        $finish = $this->of($server) ?? throw new RuntimeException('This server has no transfer to finish.');
+        $index = array_search($key, array_column($finish['items'], 'key'), true);
+        if ($index === false) {
+            throw new RuntimeException('This step is not in the list.');
+        }
+
+        try {
+            [$status, $message, $error] = $change($finish['items'][$index]) + [2 => null];
+        } catch (Throwable $e) {
+            [$status, $message, $error] = ['action', 'Coolify could not do this step.', $e->getMessage()];
+        }
+
+        return DB::transaction(function () use ($server, $key, $status, $message, $error) {
+            $finish = (array) data_get(Server::query()->lockForUpdate()->findOrFail($server->id)->server_metadata, 'transfer.finish');
+            $index = array_search($key, array_column($finish['items'], 'key'), true);
+            $finish['items'][$index] = [...$finish['items'][$index], 'status' => $status, 'message' => $message, 'error' => $error, 'checked_at' => now()->toIso8601String()];
+            $this->save($server, $finish);
+
+            return $finish['items'][$index];
+        });
+    }
+
+    /**
+     * Writes only transfer.finish, on the current row: callers can hold an older copy of the server, for example
+     * from before the claim, and must not write its other metadata back.
+     */
+    private function save(Server $server, array $finish): void
+    {
+        DB::transaction(function () use ($server, $finish) {
+            $locked = Server::query()->lockForUpdate()->findOrFail($server->id);
+            $metadata = $locked->server_metadata ?? [];
+            $metadata['transfer']['finish'] = $finish;
+            $locked->server_metadata = $metadata;
+            $locked->save();
+            $server->server_metadata = $metadata;
+            $server->syncOriginalAttribute('server_metadata');
+        });
+        TransferFinishChanged::dispatch($server);
+    }
+
+    /**
+     * @return array{0: string, 1: string}
+     */
+    private function checkGitSource(string $applicationUuid): array
+    {
+        $application = Application::where('uuid', $applicationUuid)->first();
+        $source = $application?->source;
+        if (! $source instanceof GithubApp && ! $source instanceof GitlabApp) {
+            return ['action', 'No git source on this instance, so deployments from git fail.', null];
+        }
+        if ($source instanceof GithubApp && ! $source->is_public) {
+            try {
+                generateGithubInstallationToken($source);
+            } catch (Throwable $e) {
+                return ['action', "GitHub App {$source->name} cannot read the repository.", $e->getMessage()];
+            }
+        }
+
+        // Push webhooks of a system-wide App go to the instance where the App is registered.
+        return ['ok', "Uses {$source->name}.", $source->is_system_wide ? 'For push-to-deploy, use a manual webhook if the system-wide App is registered on another instance.' : null];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    /**
+     * @param  list<array{label: string, value: string}>  $details
+     */
+    private function item(string $type, string $subject, string $label, ?string $hint = null, array $details = [], ?string $link = null, ?string $linkLabel = null): array
+    {
+        return [
+            'key' => "{$type}:{$subject}",
+            'type' => $type,
+            'subject' => $subject,
+            'label' => $label,
+            'status' => 'pending',
+            'hint' => $hint,
+            'message' => null,
+            'details' => $details,
+            'error' => null,
+            'link' => $link,
+            'link_label' => $linkLabel,
+            'checked_at' => null,
+        ];
+    }
+
+    private function instanceUrl(): string
+    {
+        return rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
+    }
+
+    private function githubWebhookUrl(): string
+    {
+        return $this->instanceUrl().'/webhooks/source/github/events';
+    }
+}
diff --git a/app/Services/SharedVariableCanvas.php b/app/Services/SharedVariableCanvas.php
new file mode 100644
index 0000000000..775faa8a48
--- /dev/null
+++ b/app/Services/SharedVariableCanvas.php
@@ -0,0 +1,383 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\Team;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+
+/**
+ * Builds the shared variables canvas of one scope (team, project, environment or server):
+ * the shared variables on the left, the resources that can use them on the right, and a link
+ * for every resource that references a variable ({{team.KEY}}, ...) in one of its own variables.
+ *
+ * Links come from the saved resource variables, so a deleted reference removes the link and a
+ * reference to a deleted shared variable shows as a missing variable. Values are never sent.
+ */
+class SharedVariableCanvas
+{
+    public const SCOPES = ['team', 'project', 'environment', 'server'];
+
+    public const SOURCES_ZONE = 'sources';
+
+    public const CONNECTED_ZONE = 'connected';
+
+    public const RESOURCES_ZONE = 'resources';
+
+    /**
+     * Server variables that Coolify creates on every server. Resources get them only through a reference,
+     * but every server has them, so the canvas and the overview leave them out to stay readable.
+     */
+    public const BUILT_IN_SERVER_KEYS = ['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME'];
+
+    public function __construct(private EnvironmentCanvas $canvas, private ServerCanvas $serverCanvas) {}
+
+    /**
+     * @return array{title: string, title_link: string, can_edit: bool, can_move: false, layout: 'connect', scope: string, zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array{}}
+     */
+    public function payload(string $scope, Model $owner, bool $canEdit): array
+    {
+        $hidden = $scope === 'server' ? self::BUILT_IN_SERVER_KEYS : [];
+        $variables = $this->variables($owner)->reject(fn (SharedEnvironmentVariable $variable) => in_array($variable->key, $hidden, true))->values();
+        $resources = $this->resources($scope, $owner);
+        // A reference to a hidden variable is not a reference to a deleted one: leave its link out too.
+        $links = collect($this->links($scope, $variables, $resources))
+            ->reject(fn (array $link) => in_array($link['key'], $hidden, true))
+            ->values()
+            ->all();
+
+        $missing = collect($links)
+            ->where('missing', true)
+            ->unique('source')
+            ->map(fn (array $link) => [
+                'id' => $link['source'],
+                'type' => 'variable',
+                'name' => $link['key'],
+                'subtitle' => 'Deleted shared variable',
+                'reference' => $this->reference($scope, $link['key']),
+                'missing' => true,
+                'zone' => self::SOURCES_ZONE,
+                'extra_zones' => [],
+                'status' => null,
+            ]);
+
+        $resourceNodes = $this->resourceNodes($resources);
+
+        return [
+            'title' => $this->title($scope, $owner),
+            'title_link' => $this->pageLink($scope, $owner),
+            'can_edit' => $canEdit,
+            'can_move' => false,
+            'layout' => 'connect',
+            'scope' => $scope,
+            'zones' => [
+                ['id' => self::SOURCES_ZONE, 'name' => str($scope)->headline().' variables', 'icon' => 'variable'],
+                // The canvas moves the resources that use a variable into this zone.
+                ['id' => self::CONNECTED_ZONE, 'name' => 'Using these variables', 'icon' => 'link'],
+                ['id' => self::RESOURCES_ZONE, 'name' => 'Other resources', 'icon' => 'service'],
+            ],
+            'nodes' => $variables
+                ->map(fn (SharedEnvironmentVariable $variable) => [
+                    'id' => $this->variableNodeId($variable),
+                    'type' => 'variable',
+                    'name' => $variable->key,
+                    'subtitle' => filled($variable->comment) ? $variable->comment : str($scope)->headline().' variable',
+                    'reference' => $this->reference($scope, $variable->key),
+                    'missing' => false,
+                    'zone' => self::SOURCES_ZONE,
+                    'extra_zones' => [],
+                    'status' => null,
+                ])
+                ->concat($missing)
+                ->concat($resourceNodes)
+                ->values()
+                ->all(),
+            'links' => $links,
+            'positions' => [],
+        ];
+    }
+
+    /**
+     * Resource cards of a connect canvas (shared variables or tags), with the project / environment
+     * the canvas groups and filters them by. The canvas moves used ones into the connected zone.
+     *
+     * @param  Collection<string, Model>  $resources  keyed by uuid
+     * @return Collection<int, array<string, mixed>>
+     */
+    public function resourceNodes(Collection $resources): Collection
+    {
+        $graph = $this->canvas->graph($resources, collect(), false);
+
+        return collect($graph['nodes'])->map(function (array $node) use ($resources) {
+            $environment = $resources->get($node['id'])->environment;
+
+            return [
+                ...$node,
+                'zone' => self::RESOURCES_ZONE,
+                'extra_zones' => [],
+                'context' => $environment->project->name.' / '.$environment->name,
+                'context_link' => route('project.resource.index', ['project_uuid' => $environment->project->uuid, 'environment_uuid' => $environment->uuid]),
+                // The canvas filters resources by project and environment.
+                'project' => ['uuid' => $environment->project->uuid, 'name' => $environment->project->name],
+                'environment' => ['uuid' => $environment->uuid, 'name' => $environment->name],
+            ];
+        });
+    }
+
+    /**
+     * Shared variables of the scope owner, by key.
+     *
+     * @return Collection<int, SharedEnvironmentVariable>
+     */
+    public function variables(Model $owner): Collection
+    {
+        return $owner->environment_variables()->orderBy('key')->get();
+    }
+
+    /**
+     * Top-level resources that can use the variables of the scope, keyed by uuid.
+     *
+     * @return Collection<string, Model>
+     */
+    public function resources(string $scope, Model $owner): Collection
+    {
+        $environmentIds = match ($scope) {
+            'team' => Environment::query()->whereHas('project', fn ($query) => $query->where('team_id', $owner->id))->pluck('id'),
+            'project' => $owner->environments()->pluck('id'),
+            'environment' => collect([$owner->id]),
+            'server' => Environment::query()->whereHas('project', fn ($query) => $query->where('team_id', $owner->team_id))->pluck('id'),
+        };
+        $resources = $this->serverCanvas->loadResources($environmentIds);
+
+        if ($scope === 'server') {
+            // {{server.KEY}} resolves against the main server of the resource.
+            $resources = $resources->filter(fn (Model $resource) => $this->mainServer($resource)?->id === $owner->id);
+        }
+
+        return $resources->sortBy(fn (Model $resource) => mb_strtolower($resource->name))->keyBy('uuid');
+    }
+
+    /**
+     * One link per (shared variable, resource) pair where a variable of the resource references the shared variable.
+     *
+     * @param  Collection<int, SharedEnvironmentVariable>  $variables
+     * @param  Collection<string, Model>  $resources
+     * @return array<int, array{id: string, source: string, target: string, key: string, keys: array<int, string>, label: ?string, removable: bool, missing: bool}>
+     */
+    public function links(string $scope, Collection $variables, Collection $resources): array
+    {
+        $nodeIdByKey = $variables->mapWithKeys(fn (SharedEnvironmentVariable $variable) => [$variable->key => $this->variableNodeId($variable)]);
+        $resourceByMorph = $resources->mapWithKeys(fn (Model $resource) => [$resource->getMorphClass().'#'.$resource->getKey() => $resource]);
+        $links = [];
+        foreach ($this->resourceVariables($resources) as $environmentVariable) {
+            $resource = $resourceByMorph->get($environmentVariable->resourceable_type.'#'.$environmentVariable->resourceable_id);
+            foreach ($this->referencedKeys($scope, $environmentVariable->value) as $key) {
+                $source = $nodeIdByKey->get($key, 'missing:'.$key);
+                $id = $source.'|'.$resource->uuid;
+                $links[$id] ??= ['id' => $id, 'source' => $source, 'target' => $resource->uuid, 'key' => $key, 'keys' => [], 'label' => null, 'removable' => true, 'missing' => ! $nodeIdByKey->has($key)];
+                $links[$id]['keys'][] = $environmentVariable->key;
+                // Only a variable that holds nothing but the reference can be removed from the canvas.
+                $links[$id]['removable'] = $links[$id]['removable'] && $this->isExactReference($scope, $key, $environmentVariable->value);
+            }
+        }
+
+        return collect($links)
+            ->map(function (array $link) {
+                $keys = array_values(array_unique($link['keys']));
+
+                // Label the link when the resource uses another name for the variable.
+                return [...$link, 'keys' => $keys, 'label' => $keys === [$link['key']] ? null : implode(', ', $keys)];
+            })
+            ->values()
+            ->all();
+    }
+
+    /**
+     * Saved variables (not preview copies) of the given resources.
+     *
+     * @param  Collection<string, Model>  $resources
+     * @return Collection<int, EnvironmentVariable>
+     */
+    public function resourceVariables(Collection $resources): Collection
+    {
+        if ($resources->isEmpty()) {
+            return collect();
+        }
+
+        return EnvironmentVariable::query()
+            ->where('is_preview', false)
+            ->where(function ($query) use ($resources) {
+                foreach ($resources->groupBy(fn (Model $resource) => $resource->getMorphClass()) as $type => $group) {
+                    $query->orWhere(fn ($query) => $query->where('resourceable_type', $type)->whereIn('resourceable_id', $group->map->getKey()->all()));
+                }
+            })
+            ->orderBy('key')
+            ->get();
+    }
+
+    /**
+     * Keys of the shared variables of the scope that the value references.
+     *
+     * @return array<int, string>
+     */
+    public function referencedKeys(string $scope, ?string $value): array
+    {
+        if (blank($value)) {
+            return [];
+        }
+        preg_match_all('/{{\s*'.preg_quote($scope, '/').'\.(.+?)\s*}}/', $value, $matches);
+
+        return array_values(array_unique($matches[1]));
+    }
+
+    public function isExactReference(string $scope, string $key, ?string $value): bool
+    {
+        return preg_match('/^{{\s*'.preg_quote($scope, '/').'\.'.preg_quote($key, '/').'\s*}}$/', trim((string) $value)) === 1;
+    }
+
+    public function reference(string $scope, string $key): string
+    {
+        return '{{'.$scope.'.'.$key.'}}';
+    }
+
+    public function variableNodeId(SharedEnvironmentVariable $variable): string
+    {
+        return 'variable:'.$variable->id;
+    }
+
+    /**
+     * The shared variables overview of a team: counts per scope, recently changed variables,
+     * and how many resources use each variable (from the {{scope.KEY}} references in the
+     * saved resource variables). Keys and counts only; values are never read out.
+     *
+     * @return array{scopes: array<string, array{variables: int, owners: int}>, recent: Collection<int, array<string, mixed>>, used: Collection<int, array<string, mixed>>, unused: Collection<int, array<string, mixed>>, missing: int}
+     */
+    public function overview(Team $team): array
+    {
+        $variables = SharedEnvironmentVariable::query()
+            ->where('team_id', $team->id)
+            ->with(['project', 'environment.project', 'server'])
+            ->get()
+            // Built-in server variables; the server variables page hides them too.
+            ->reject(fn (SharedEnvironmentVariable $variable) => $variable->type === 'server' && in_array($variable->key, self::BUILT_IN_SERVER_KEYS, true));
+
+        $scopes = collect(self::SCOPES)->mapWithKeys(function (string $scope) use ($variables) {
+            $ofScope = $variables->where('type', $scope);
+            $ownerColumn = $scope === 'team' ? 'team_id' : $scope.'_id';
+
+            return [$scope => ['variables' => $ofScope->count(), 'owners' => $ofScope->pluck($ownerColumn)->unique()->count()]];
+        })->all();
+
+        // Resources per variable: "scope|owner id|KEY" => resource uuids.
+        $idByReference = $variables->mapWithKeys(fn (SharedEnvironmentVariable $variable) => [
+            $variable->type.'|'.($variable->type === 'team' ? $variable->team_id : $variable->{$variable->type.'_id'}).'|'.$variable->key => $variable->id,
+        ]);
+        $resources = $this->resources('team', $team);
+        $resourceByMorph = $resources->mapWithKeys(fn (Model $resource) => [$resource->getMorphClass().'#'.$resource->getKey() => $resource]);
+        $usedBy = [];
+        $missing = [];
+        foreach ($this->resourceVariables($resources) as $environmentVariable) {
+            $resource = $resourceByMorph->get($environmentVariable->resourceable_type.'#'.$environmentVariable->resourceable_id);
+            $owners = [
+                'team' => $team->id,
+                'project' => $resource->environment->project_id,
+                'environment' => $resource->environment_id,
+                'server' => $this->mainServer($resource)?->id,
+            ];
+            foreach ($owners as $scope => $ownerId) {
+                foreach ($this->referencedKeys($scope, $environmentVariable->value) as $key) {
+                    $reference = $scope.'|'.$ownerId.'|'.$key;
+                    if ($idByReference->has($reference)) {
+                        $usedBy[$idByReference->get($reference)][$resource->uuid] = true;
+                    } else {
+                        $missing[$reference] = true;
+                    }
+                }
+            }
+        }
+
+        $rows = $variables->map(fn (SharedEnvironmentVariable $variable) => [
+            'key' => $variable->key,
+            'scope' => $variable->type,
+            'owner' => match ($variable->type) {
+                'team' => 'Team',
+                'project' => $variable->project?->name,
+                'environment' => $variable->environment ? $variable->environment->project?->name.' / '.$variable->environment->name : null,
+                'server' => $variable->server?->name,
+                default => null,
+            },
+            'link' => $this->connectLink($variable),
+            'resources' => count($usedBy[$variable->id] ?? []),
+            'updated_at' => $variable->updated_at,
+        ]);
+
+        return [
+            'scopes' => $scopes,
+            'recent' => $rows->sortByDesc('updated_at')->take(6)->values(),
+            'used' => $rows->where('resources', '>', 0)->sortByDesc('resources')->take(6)->values(),
+            'unused' => $rows->where('resources', 0)->sortBy('key')->values(),
+            'missing' => count($missing),
+        ];
+    }
+
+    /**
+     * The team of the scope owner.
+     */
+    public function teamId(string $scope, Model $owner): int
+    {
+        return (int) match ($scope) {
+            'team' => $owner->id,
+            'project', 'server' => $owner->team_id,
+            'environment' => $owner->project->team_id,
+        };
+    }
+
+    public function mainServer(Model $resource): ?Server
+    {
+        return $resource instanceof Service ? $resource->server : $resource->destination?->server;
+    }
+
+    public function title(string $scope, Model $owner): string
+    {
+        return match ($scope) {
+            'team' => 'Team variables',
+            'project' => $owner->name.' variables',
+            'environment' => $owner->project->name.' / '.$owner->name.' variables',
+            'server' => $owner->name.' variables',
+        };
+    }
+
+    /**
+     * The canvas of the variable's scope, with the variable selected.
+     */
+    public function connectLink(SharedEnvironmentVariable $variable): ?string
+    {
+        $query = '?select='.urlencode($this->variableNodeId($variable));
+
+        return match ($variable->type) {
+            'team' => route('shared-variables.team.canvas').$query,
+            'project' => $variable->project ? route('shared-variables.project.canvas', ['project_uuid' => $variable->project->uuid]).$query : null,
+            'environment' => $variable->environment?->project
+                ? route('shared-variables.environment.canvas', ['project_uuid' => $variable->environment->project->uuid, 'environment_uuid' => $variable->environment->uuid]).$query
+                : null,
+            'server' => $variable->server ? route('shared-variables.server.canvas', ['server_uuid' => $variable->server->uuid]).$query : null,
+            default => null,
+        };
+    }
+
+    public function pageLink(string $scope, Model $owner): string
+    {
+        return match ($scope) {
+            'team' => route('shared-variables.team.index'),
+            'project' => route('shared-variables.project.show', ['project_uuid' => $owner->uuid]),
+            'environment' => route('shared-variables.environment.show', ['project_uuid' => $owner->project->uuid, 'environment_uuid' => $owner->uuid]),
+            'server' => route('shared-variables.server.show', ['server_uuid' => $owner->uuid]),
+        };
+    }
+}
diff --git a/app/Services/TagCanvas.php b/app/Services/TagCanvas.php
new file mode 100644
index 0000000000..a1d9132d3f
--- /dev/null
+++ b/app/Services/TagCanvas.php
@@ -0,0 +1,120 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Environment;
+use App\Models\Tag;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+
+/**
+ * Builds the tags canvas of a team: the tags on the left, the resources on the right, and a link
+ * for every tag on a resource. Same layout and wording slots as the shared variables canvas.
+ */
+class TagCanvas
+{
+    public function __construct(private SharedVariableCanvas $connect, private ServerCanvas $serverCanvas) {}
+
+    /**
+     * @return array{title: string, title_link: string, can_edit: bool, can_move: false, layout: 'connect', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array{}}
+     */
+    public function payload(int $teamId, bool $canEdit): array
+    {
+        $tags = $this->tags($teamId);
+        $resources = $this->resources($teamId);
+
+        return [
+            'title' => 'Tags',
+            'title_link' => route('tags.show'),
+            'can_edit' => $canEdit,
+            'can_move' => false,
+            'layout' => 'connect',
+            'zones' => [
+                ['id' => SharedVariableCanvas::SOURCES_ZONE, 'name' => 'Tags', 'icon' => 'tag'],
+                // The canvas moves the tagged resources into this zone.
+                ['id' => SharedVariableCanvas::CONNECTED_ZONE, 'name' => 'Tagged resources', 'icon' => 'link'],
+                ['id' => SharedVariableCanvas::RESOURCES_ZONE, 'name' => 'Other resources', 'icon' => 'service'],
+            ],
+            'nodes' => $tags
+                ->map(fn (Tag $tag) => [
+                    'id' => $this->nodeId($tag),
+                    'type' => 'tag',
+                    'name' => $tag->name,
+                    'link' => route('tags.show', ['tagName' => $tag->name]),
+                    'missing' => false,
+                    'zone' => SharedVariableCanvas::SOURCES_ZONE,
+                    'extra_zones' => [],
+                    'status' => null,
+                ])
+                ->concat($this->connect->resourceNodes($resources))
+                ->values()
+                ->all(),
+            'links' => $this->links($tags, $resources),
+            'positions' => [],
+        ];
+    }
+
+    /**
+     * @return Collection<int, Tag>
+     */
+    public function tags(int $teamId): Collection
+    {
+        return Tag::query()->where('team_id', $teamId)->orderBy('name')->get();
+    }
+
+    /**
+     * Top-level resources of the team with their tags, keyed by uuid.
+     *
+     * @return Collection<string, Model>
+     */
+    public function resources(int $teamId): Collection
+    {
+        $environmentIds = Environment::query()->whereHas('project', fn ($query) => $query->where('team_id', $teamId))->pluck('id');
+        $resources = $this->serverCanvas->loadResources($environmentIds);
+        $resources->groupBy(fn (Model $resource) => $resource::class)
+            ->each(fn (Collection $group) => (new EloquentCollection($group->values()->all()))->load('tags'));
+
+        return $resources->sortBy(fn (Model $resource) => mb_strtolower($resource->name))->keyBy('uuid');
+    }
+
+    /**
+     * @param  Collection<int, Tag>  $tags
+     * @param  Collection<string, Model>  $resources
+     * @return array<int, array{id: string, source: string, target: string, key: string, keys: array{}, label: null, removable: true, missing: false}>
+     */
+    public function links(Collection $tags, Collection $resources): array
+    {
+        $teamTags = $tags->keyBy('id');
+
+        return $resources
+            ->flatMap(fn (Model $resource) => $resource->tags
+                ->filter(fn (Tag $tag) => $teamTags->has($tag->id))
+                ->map(fn (Tag $tag) => $this->link($tag, $resource)))
+            ->values()
+            ->all();
+    }
+
+    /**
+     * @return array{id: string, source: string, target: string, key: string, keys: array{}, label: null, removable: true, missing: false}
+     */
+    public function link(Tag $tag, Model $resource): array
+    {
+        $source = $this->nodeId($tag);
+
+        return ['id' => $source.'|'.$resource->uuid, 'source' => $source, 'target' => $resource->uuid, 'key' => $tag->name, 'keys' => [], 'label' => null, 'removable' => true, 'missing' => false];
+    }
+
+    public function nodeId(Tag $tag): string
+    {
+        return 'tag:'.$tag->uuid;
+    }
+
+    /**
+     * The tags canvas with the tag selected.
+     */
+    public function connectLink(Tag $tag): string
+    {
+        return route('tags.canvas').'?select='.urlencode($this->nodeId($tag));
+    }
+}
diff --git a/app/Services/TeamAvatarStorageService.php b/app/Services/TeamAvatarStorageService.php
new file mode 100644
index 0000000000..ee66f8bff7
--- /dev/null
+++ b/app/Services/TeamAvatarStorageService.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Team;
+use Illuminate\Http\UploadedFile;
+use RuntimeException;
+
+class TeamAvatarStorageService extends AvatarStorageService
+{
+    public function storeTeam(Team $team, UploadedFile $upload): void
+    {
+        $settings = instanceSettings();
+        $storageType = $settings->avatar_storage_type === 's3' && $settings->avatar_s3_storage_id ? 's3' : 'local';
+        $s3StorageId = $storageType === 's3' ? $settings->avatar_s3_storage_id : null;
+        $disk = $this->disk($storageType, $s3StorageId);
+        $path = "team-avatars/{$team->id}/avatar.jpg";
+
+        if (! $disk->put($path, $this->compress($upload))) {
+            throw new RuntimeException('Unable to store the team avatar.');
+        }
+
+        $oldStorageType = $team->avatar_storage_type;
+        $oldS3StorageId = $team->avatar_s3_storage_id;
+        $oldPath = $team->avatar_path;
+
+        $team->forceFill([
+            'avatar_path' => $path,
+            'avatar_storage_type' => $storageType,
+            'avatar_s3_storage_id' => $s3StorageId,
+        ])->save();
+
+        if ($oldPath && ($oldStorageType !== $storageType || $oldS3StorageId !== $s3StorageId)) {
+            $this->disk($oldStorageType ?? 'local', $oldS3StorageId)->delete($oldPath);
+        }
+    }
+
+    public function teamContents(Team $team): ?string
+    {
+        if (! $team->avatar_path) {
+            return null;
+        }
+
+        try {
+            $disk = $this->disk($team->avatar_storage_type ?? 'local', $team->avatar_s3_storage_id);
+        } catch (RuntimeException) {
+            return null;
+        }
+
+        return $disk->exists($team->avatar_path) ? $disk->get($team->avatar_path) : null;
+    }
+
+    public function deleteTeam(Team $team): void
+    {
+        $this->deleteTeamFile($team);
+
+        $team->forceFill([
+            'avatar_path' => null,
+            'avatar_storage_type' => null,
+            'avatar_s3_storage_id' => null,
+        ])->save();
+    }
+
+    public function deleteTeamFile(Team $team): void
+    {
+        if (! $team->avatar_path) {
+            return;
+        }
+
+        try {
+            $this->disk($team->avatar_storage_type ?? 'local', $team->avatar_s3_storage_id)
+                ->delete($team->avatar_path);
+        } catch (RuntimeException) {
+        }
+    }
+}
diff --git a/app/Services/TerminalSessionService.php b/app/Services/TerminalSessionService.php
index eea260b5a5..b2fb4d09a2 100644
--- a/app/Services/TerminalSessionService.php
+++ b/app/Services/TerminalSessionService.php
@@ -14,7 +14,10 @@ class TerminalSessionService
 {
     private const TOKEN_TTL_SECONDS = 60;
 
-    public function issue(User $user, Server $server, ?string $container = null): string
+    /**
+     * @param  'shell'|'attach'  $mode  Container terminal mode: docker exec or docker attach.
+     */
+    public function issue(User $user, Server $server, ?string $container = null, string $mode = 'shell'): string
     {
         $token = Str::random(64);
 
@@ -23,6 +26,7 @@ class TerminalSessionService
             'team_id' => $user->currentTeam()->id,
             'server_uuid' => $server->uuid,
             'container' => $container,
+            'mode' => $mode === 'attach' ? 'attach' : 'shell',
         ], now()->addSeconds(self::TOKEN_TTL_SECONDS));
 
         return $token;
@@ -63,8 +67,7 @@ class TerminalSessionService
                 throw new AccessDeniedHttpException('Terminal container is not authorized.');
             }
 
-            $dockerCommand = 'docker exec -it '.escapeshellarg($container).' sh -c '.escapeshellarg($command);
-            $command = $server->isNonRoot() ? "sudo {$dockerCommand}" : $dockerCommand;
+            $command = $this->containerCommand($server, $container, data_get($payload, 'mode') === 'attach' ? 'attach' : 'shell');
         }
 
         return SshMultiplexingHelper::generateSshCommand(
@@ -74,6 +77,34 @@ class TerminalSessionService
         );
     }
 
+    /**
+     * Build the docker command that runs on the remote server for the given mode.
+     *
+     * @param  'shell'|'attach'  $mode
+     */
+    public function containerCommand(Server $server, string $container, string $mode): string
+    {
+        $escapedContainer = escapeshellarg($container);
+        // Add sudo for non-root users to access the Docker socket.
+        $sudo = $server->isNonRoot() ? 'sudo ' : '';
+
+        if ($mode === 'attach') {
+            $detachKeys = config('constants.terminal.detach_keys');
+            $historyLines = (int) config('constants.terminal.console_history_lines');
+
+            // Print recent output first so the console is not blank, then attach for live output.
+            $primeHistory = $historyLines > 0
+                ? "{$sudo}docker logs --tail {$historyLines} {$escapedContainer} 2>&1; "
+                : '';
+
+            // Attach to the container's main process. --detach-keys lets the user leave with
+            // Ctrl-P, Ctrl-Q and --sig-proxy=false stops the client forwarding signals to the app.
+            return "{$primeHistory}exec {$sudo}docker attach --detach-keys=\"{$detachKeys}\" --sig-proxy=false {$escapedContainer}";
+        }
+
+        return "{$sudo}docker exec -it {$escapedContainer} sh -c ".escapeshellarg($this->shellCommand());
+    }
+
     private function shellCommand(): string
     {
         return 'PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin && '.
diff --git a/app/Services/TrafficAnalyticsAggregator.php b/app/Services/TrafficAnalyticsAggregator.php
index e58a78bc3b..66ef76432e 100644
--- a/app/Services/TrafficAnalyticsAggregator.php
+++ b/app/Services/TrafficAnalyticsAggregator.php
@@ -161,6 +161,12 @@ class TrafficAnalyticsAggregator
             $this->breakdowns[$dimension][$value] ??= ['value' => $value, 'requests' => 0, 'bytesOut' => 0];
             $this->breakdowns[$dimension][$value]['requests'] += (int) ($data['requests'] ?? 0);
             $this->breakdowns[$dimension][$value]['bytesOut'] += (int) ($data['bytesOut'] ?? 0);
+
+            // City rows carry coordinates; the first server that has them wins.
+            if (isset($data['lat'], $data['lon'])) {
+                $this->breakdowns[$dimension][$value]['lat'] ??= (float) $data['lat'];
+                $this->breakdowns[$dimension][$value]['lon'] ??= (float) $data['lon'];
+            }
         }
     }
 
@@ -205,7 +211,7 @@ class TrafficAnalyticsAggregator
     }
 
     /**
-     * @return array<string, array<int, array{value: string, requests: int, bytesOut: int}>>
+     * @return array<string, array<int, array{value: string, requests: int, bytesOut: int, lat?: float, lon?: float}>>
      */
     public function breakdowns(int $limit = 50): array
     {
diff --git a/app/Support/DatabaseImport/DatabaseImportCommandBuilder.php b/app/Support/DatabaseImport/DatabaseImportCommandBuilder.php
index bdc37974d0..61c4d2af9e 100644
--- a/app/Support/DatabaseImport/DatabaseImportCommandBuilder.php
+++ b/app/Support/DatabaseImport/DatabaseImportCommandBuilder.php
@@ -3,6 +3,7 @@
 namespace App\Support\DatabaseImport;
 
 use App\Models\ServiceDatabase;
+use App\Support\PostgresUser;
 use InvalidArgumentException;
 
 class DatabaseImportCommandBuilder
@@ -64,7 +65,7 @@ AWK;
     public function buildRestoreCommand(object $resource, string $path, bool $dumpAll, bool $replaceExisting = false, bool $keepOwners = false, ?string $sqliteDatabase = null, bool $restoreMysqlUsers = false): string
     {
         $script = match ($this->databaseType($resource)) {
-            'postgresql' => $dumpAll ? $this->postgresqlDumpAll() : $this->postgresqlSingle($replaceExisting, $keepOwners),
+            'postgresql' => $this->postgresqlPrelude().($dumpAll ? $this->postgresqlDumpAll() : $this->postgresqlSingle($replaceExisting, $keepOwners)),
             'mysql' => $this->mysql('mysql', 'MYSQL', $dumpAll, $restoreMysqlUsers),
             'mariadb' => $this->mysql('mariadb', 'MARIADB', $dumpAll, $restoreMysqlUsers),
             'mongodb' => $this->mongodb($replaceExisting),
@@ -177,6 +178,24 @@ SH;
         };
     }
 
+    /**
+     * Sets the PostgreSQL user once (see PostgresUser) and defines the checks that run after the
+     * backup format is accepted and before the first change. When no user variable is set,
+     * "postgres" is a guess, so a failed connection must stop the restore with a clear error.
+     */
+    private function postgresqlPrelude(): string
+    {
+        return 'pg_user='.PostgresUser::shellExpression()."\n".<<<'SH'
+check_connection() {
+  psql -U "$pg_user" -d template1 -Atc 'SELECT 1' >/dev/null 2>&1 || fail "Cannot connect to PostgreSQL as user \"$pg_user\". Set POSTGRES_USER on the database container to its superuser. Nothing was changed."
+}
+check_superuser() {
+  [ "$(psql -U "$pg_user" -d template1 -Atc 'SELECT rolsuper FROM pg_roles WHERE rolname = current_user' 2>/dev/null)" = t ] || fail "Restoring all databases needs a PostgreSQL superuser, and \"$pg_user\" is not one or cannot connect. Set POSTGRES_USER on the database container to its superuser. Nothing was changed."
+}
+
+SH;
+    }
+
     /**
      * pg_dump custom and tar archives are restored with pg_restore, SQL dumps with psql.
      * pg_restore cannot read gzip files, so both clients receive the backup on stdin.
@@ -193,32 +212,35 @@ SH;
         $suffix = bin2hex(random_bytes(16));
         $sqlRestore = $replaceExisting ? "\n  new=coolify_restore_new_{$suffix}\n  old=coolify_restore_old_{$suffix}\n".<<<'SH'
 
+  check_connection
   echo 'SQL backups cannot replace single objects. The backup is restored into a new database first; the current database is replaced only when that restore succeeds.'
-  if ! existing=$(printf '%s\n' "SELECT 1 FROM pg_database WHERE datname IN (:'new', :'old');" | psql -v ON_ERROR_STOP=1 -At -v new="$new" -v old="$old" -U $POSTGRES_USER -d template1); then
+  if ! existing=$(printf '%s\n' "SELECT 1 FROM pg_database WHERE datname IN (:'new', :'old');" | psql -v ON_ERROR_STOP=1 -At -v new="$new" -v old="$old" -U "$pg_user" -d template1); then
     fail 'The temporary database names could not be checked. Nothing was changed.'
   fi
   [ -z "$existing" ] || fail 'A temporary database name is already in use. Nothing was changed.'
-  createdb -U $POSTGRES_USER "$new" || exit 1
-  if ! stream | psql -v ON_ERROR_STOP=1 --single-transaction -U $POSTGRES_USER -d "$new"; then
-    PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$new"
+  createdb -U "$pg_user" "$new" || exit 1
+  if ! stream | psql -v ON_ERROR_STOP=1 --single-transaction -U "$pg_user" -d "$new"; then
+    PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U "$pg_user" --if-exists "$new"
     fail 'The SQL restore failed. The current database was not changed.'
   fi
-  if ! printf '%s\n' "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = :'db' AND pid <> pg_backend_pid();" 'ALTER DATABASE :"db" RENAME TO :"old";' 'ALTER DATABASE :"new" RENAME TO :"db";' | psql -v ON_ERROR_STOP=1 -v db="$db" -v old="$old" -v new="$new" -U $POSTGRES_USER -d template1 >/dev/null; then
+  if ! printf '%s\n' "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = :'db' AND pid <> pg_backend_pid();" 'ALTER DATABASE :"db" RENAME TO :"old";' 'ALTER DATABASE :"new" RENAME TO :"db";' | psql -v ON_ERROR_STOP=1 -v db="$db" -v old="$old" -v new="$new" -U "$pg_user" -d template1 >/dev/null; then
     # Undo a half-done swap: the current database keeps its name and data.
-    printf '%s\n' 'ALTER DATABASE :"old" RENAME TO :"db";' | psql -v db="$db" -v old="$old" -U $POSTGRES_USER -d template1 >/dev/null 2>&1
-    PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$new"
+    printf '%s\n' 'ALTER DATABASE :"old" RENAME TO :"db";' | psql -v db="$db" -v old="$old" -U "$pg_user" -d template1 >/dev/null 2>&1
+    PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U "$pg_user" --if-exists "$new"
     fail 'The current database is in use and could not be replaced. Nothing was changed.'
   fi
-  PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U $POSTGRES_USER --if-exists "$old" || exit 1
+  PGOPTIONS='-c client_min_messages=warning' dropdb --maintenance-db=template1 -U "$pg_user" --if-exists "$old" || exit 1
 SH : <<<'SH'
 
-  stream | psql -v ON_ERROR_STOP=1 --single-transaction -U $POSTGRES_USER -d "$db"
+  check_connection
+  stream | psql -v ON_ERROR_STOP=1 --single-transaction -U "$pg_user" -d "$db"
 SH;
 
         return <<<SH
-db=\${POSTGRES_DB:-\${POSTGRES_USER:-postgres}}
+db=\${POSTGRES_DB:-\$pg_user}
 if [ "\$(stream | head -c 5)" = PGDMP ] || is_tar; then
-  stream | pg_restore --exit-on-error --single-transaction{$owners}{$clean} -U \$POSTGRES_USER -d "\$db"
+  check_connection
+  stream | pg_restore --exit-on-error --single-transaction{$owners}{$clean} -U "\$pg_user" -d "\$db"
 elif ! is_text; then
   fail 'Unsupported PostgreSQL backup format. Use a pg_dump archive (custom or tar format) or an SQL file.'
 elif stream | head -c 4096 | grep -q 'PostgreSQL database cluster dump'; then
@@ -235,7 +257,7 @@ SH;
     private function postgresqlDumpAll(): string
     {
         return <<<'SH'
-db=${POSTGRES_DB:-${POSTGRES_USER:-postgres}}
+db=${POSTGRES_DB:-$pg_user}
 if [ "$(stream | head -c 5)" = PGDMP ] || is_tar; then
   kind=archive
   stream | pg_restore -l >/dev/null 2>&1 || fail 'pg_restore cannot read this backup archive. Nothing was changed.'
@@ -244,13 +266,14 @@ elif is_text; then
 else
   fail 'Unsupported PostgreSQL backup format. Use a pg_dump archive (custom or tar format) or an SQL file. Nothing was changed.'
 fi
-psql -U ${POSTGRES_USER} -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname IS NOT NULL AND pid <> pg_backend_pid()" || exit 1
-psql -U ${POSTGRES_USER} -t -c "SELECT datname FROM pg_database WHERE NOT datistemplate" | xargs -I {} dropdb -U ${POSTGRES_USER} --if-exists {} || exit 1
-createdb -U ${POSTGRES_USER} "$db" || exit 1
+check_superuser
+psql -U "$pg_user" -d template1 -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname IS NOT NULL AND pid <> pg_backend_pid()" || exit 1
+psql -U "$pg_user" -d template1 -t -c "SELECT datname FROM pg_database WHERE NOT datistemplate" | xargs -I {} dropdb -U "$pg_user" --maintenance-db=template1 --if-exists {} || exit 1
+createdb -U "$pg_user" "$db" || exit 1
 if [ "$kind" = archive ]; then
-  stream | pg_restore -U ${POSTGRES_USER} -d "$db"
+  stream | pg_restore -U "$pg_user" -d "$db"
 else
-  stream | psql -U ${POSTGRES_USER} -d "$db"
+  stream | psql -U "$pg_user" -d "$db"
 fi
 SH;
     }
diff --git a/app/Support/Metrics/PressureLevel.php b/app/Support/Metrics/PressureLevel.php
new file mode 100644
index 0000000000..2904c56504
--- /dev/null
+++ b/app/Support/Metrics/PressureLevel.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Support\Metrics;
+
+class PressureLevel
+{
+    public static function for(?float $percent, string $kind = 'default'): string
+    {
+        if ($percent === null) {
+            return 'ok';
+        }
+
+        [$warn, $error] = $kind === 'disk' ? [80.0, 90.0] : [70.0, 90.0];
+
+        return match (true) {
+            $percent >= $error => 'error',
+            $percent >= $warn => 'warning',
+            default => 'ok',
+        };
+    }
+
+    public static function textClass(string $level): string
+    {
+        return match ($level) {
+            'error' => 'text-red-500 dark:text-red-400',
+            'warning' => 'text-orange-500 dark:text-warning',
+            default => 'text-black dark:text-fg',
+        };
+    }
+
+    public static function barClass(string $level): string
+    {
+        return match ($level) {
+            'error' => 'bg-red-500 dark:bg-red-400',
+            'warning' => 'bg-orange-500 dark:bg-warning',
+            default => 'bg-neutral-400 dark:bg-white/30',
+        };
+    }
+}
diff --git a/app/Support/PasskeyRelyingParty.php b/app/Support/PasskeyRelyingParty.php
new file mode 100644
index 0000000000..c066feec41
--- /dev/null
+++ b/app/Support/PasskeyRelyingParty.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Support;
+
+use Illuminate\Http\Request;
+
+class PasskeyRelyingParty
+{
+    /**
+     * @return array{id: string, origins: list<string>}|null
+     */
+    public static function resolve(Request $request): ?array
+    {
+        $requestHost = $request->getHost();
+
+        foreach ([instanceSettings()->fqdn, config('app.url')] as $url) {
+            $parts = parse_url((string) $url);
+            $host = strtolower($parts['host'] ?? '');
+
+            if (strtolower($parts['scheme'] ?? '') !== 'https' || $host !== $requestHost) {
+                continue;
+            }
+            if (filter_var(trim($host, '[]'), FILTER_VALIDATE_IP) !== false) {
+                continue;
+            }
+
+            $origins = ['https://'.$host.(isset($parts['port']) ? ':'.$parts['port'] : '')];
+
+            // The fqdn setting stores no port, so a custom port can only come from the request.
+            if (! isset($parts['port']) && ! in_array($request->getPort(), [80, 443])) {
+                $origins[] = 'https://'.$host.':'.$request->getPort();
+            }
+
+            return ['id' => $host, 'origins' => $origins];
+        }
+
+        if ($requestHost === 'localhost') {
+            return ['id' => 'localhost', 'origins' => [$request->getSchemeAndHttpHost()]];
+        }
+
+        return null;
+    }
+
+    public static function isAvailable(?Request $request = null): bool
+    {
+        return (bool) instanceSettings()->is_passkey_enabled
+            && self::resolve($request ?? request()) !== null;
+    }
+}
diff --git a/app/Support/PostgresUser.php b/app/Support/PostgresUser.php
new file mode 100644
index 0000000000..24aaefe0a1
--- /dev/null
+++ b/app/Support/PostgresUser.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Support;
+
+/**
+ * Finds the PostgreSQL user inside a database container, the same way for backups and imports.
+ *
+ * The official image uses POSTGRES_USER (default "postgres"). Other images use PGUSER (read
+ * by libpq) or POSTGRESQL_USERNAME (Bitnami). When none is set, "postgres" is only a guess,
+ * so callers must check the connection before they change data.
+ */
+final class PostgresUser
+{
+    /**
+     * @var list<string>
+     */
+    public const ENV_NAMES = ['POSTGRES_USER', 'PGUSER', 'POSTGRESQL_USERNAME'];
+
+    public const DEFAULT = 'postgres';
+
+    /**
+     * Shell parameter expansion that resolves the user from the container environment.
+     */
+    public static function shellExpression(): string
+    {
+        return array_reduce(
+            array_reverse(self::ENV_NAMES),
+            fn (string $fallback, string $name): string => '${'.$name.':-'.$fallback.'}',
+            self::DEFAULT,
+        );
+    }
+
+    /**
+     * Resolves the user from `env` output lines (NAME=value) of the container.
+     *
+     * @param  iterable<string>  $envLines
+     */
+    public static function fromEnvLines(iterable $envLines): string
+    {
+        $values = [];
+        foreach ($envLines as $line) {
+            [$name, $value] = array_pad(explode('=', trim((string) $line), 2), 2, '');
+            $values[$name] = $value;
+        }
+
+        foreach (self::ENV_NAMES as $name) {
+            if (($values[$name] ?? '') !== '') {
+                return $values[$name];
+            }
+        }
+
+        return self::DEFAULT;
+    }
+}
diff --git a/app/Support/ResourceStartActivity.php b/app/Support/ResourceStartActivity.php
index 64b969587e..ac125bcc7f 100644
--- a/app/Support/ResourceStartActivity.php
+++ b/app/Support/ResourceStartActivity.php
@@ -158,12 +158,14 @@ class ResourceStartActivity
     }
 
     /**
-     * Mark an activity as failed, append the reason to its log and stop log polling.
+     * Mark an activity as failed, append the redacted reason to its log and stop log polling.
      *
      * @param  array<string, mixed>  $extraProperties
      */
     public static function markFailed(Activity $activity, string $message, array $extraProperties = []): void
     {
+        // Callers can pass exception or command output text, which can contain secrets.
+        $message = remove_iip($message);
         $properties = [
             ...$extraProperties,
             'status' => ProcessStatus::ERROR->value,
diff --git a/app/Traits/ExecuteRemoteCommand.php b/app/Traits/ExecuteRemoteCommand.php
index 57b19f91b8..21912fb82f 100644
--- a/app/Traits/ExecuteRemoteCommand.php
+++ b/app/Traits/ExecuteRemoteCommand.php
@@ -2,12 +2,13 @@
 
 namespace App\Traits;
 
+use App\Actions\CoolifyTask\RunRemoteProcess;
 use App\Enums\ApplicationDeploymentStatus;
 use App\Exceptions\DeploymentException;
 use App\Helpers\SshMultiplexingHelper;
 use App\Models\EnvironmentVariable;
 use App\Models\Server;
-use Carbon\Carbon;
+use App\Services\Security\SensitiveDataRedactor;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Stringable;
@@ -22,52 +23,44 @@ trait ExecuteRemoteCommand
 
     public static int $batch_counter = 0;
 
-    private function redact_sensitive_info($text)
+    /** @var array{known: array<int, string>, locked: array<int, string>}|null */
+    private ?array $logRedactionSecrets = null;
+
+    /** @var array<int, string>|null */
+    private ?array $remoteSecretLogRedactionValues = null;
+
+    private function redact_sensitive_info(string $text): string
     {
         try {
-            $text = remove_iip($text);
-
-            if (! isset($this->application)) {
-                return $text;
-            }
-
-            $lockedVars = collect([]);
-
-            if (isset($this->application->environment_variables)) {
-                $lockedVars = $lockedVars->merge(
-                    $this->application->environment_variables
-                        ->where('is_shown_once', true)
-                        ->flatMap(fn (EnvironmentVariable $variable): array => $variable->logRedactionValues())
-                        ->filter()
-                );
-            }
-
-            if (isset($this->pull_request_id) && $this->pull_request_id !== 0 && isset($this->application->environment_variables_preview)) {
-                $lockedVars = $lockedVars->merge(
-                    $this->application->environment_variables_preview
-                        ->where('is_shown_once', true)
-                        ->flatMap(fn (EnvironmentVariable $variable): array => $variable->logRedactionValues())
-                        ->filter()
-                );
-            }
-
-            if (isset($this->remote_secrets_cache)) {
-                $lockedVars = $lockedVars->merge(EnvironmentVariable::remoteSecretLogRedactionValues($this->remote_secrets_cache));
-            }
-
-            foreach ($lockedVars as $key => $value) {
-                $escapedValue = preg_quote($value, '/');
-                $text = preg_replace(
-                    '/'.$escapedValue.'/',
-                    REDACTED,
-                    $text
-                );
-            }
-
-            return is_string($text) ? $text : REDACTED;
+            // Remote secrets come from the job's remote_secrets_cache below, so they are not fetched again.
+            $this->logRedactionSecrets ??= EnvironmentVariable::logRedactionSecretsFor(
+                $this->application ?? null,
+                isset($this->pull_request_id) && $this->pull_request_id !== 0,
+                resolveRemoteSecrets: false,
+            );
         } catch (\Throwable) {
             return REDACTED;
         }
+
+        $remoteSecrets = isset($this->remote_secrets_cache)
+            ? ($this->remoteSecretLogRedactionValues ??= EnvironmentVariable::remoteSecretLogRedactionValues($this->remote_secrets_cache))
+            : [];
+
+        return app(SensitiveDataRedactor::class)->redactText(
+            $text,
+            $this->logRedactionSecrets['known'],
+            array_merge($this->logRedactionSecrets['locked'], $remoteSecrets),
+        );
+    }
+
+    /**
+     * Remote secrets are never stored in Coolify, so the deployment log model must get them from the job.
+     */
+    private function registerRemoteSecretsForLogs(): void
+    {
+        if (isset($this->application_deployment_queue, $this->remote_secrets_cache)) {
+            $this->application_deployment_queue->redactRemoteSecrets($this->remote_secrets_cache);
+        }
     }
 
     public function execute_remote_command(...$commands)
@@ -81,9 +74,7 @@ trait ExecuteRemoteCommand
         if ($this->server instanceof Server === false) {
             throw new \RuntimeException('Server is not set or is not an instance of Server model');
         }
-        if (isset($this->application_deployment_queue, $this->remote_secrets_cache)) {
-            $this->application_deployment_queue->redactRemoteSecrets($this->remote_secrets_cache);
-        }
+        $this->registerRemoteSecretsForLogs();
         $commandsText->each(function ($single_command) {
             $command = data_get($single_command, 'command') ?? $single_command[0] ?? null;
             if ($command === null) {
@@ -181,57 +172,46 @@ trait ExecuteRemoteCommand
         $remote_command = $input === null
             ? SshMultiplexingHelper::generateSshCommand($this->server, $command)
             : SshMultiplexingHelper::generateSshStdinCommand($this->server, $command);
-        $process = Process::timeout(config('constants.ssh.command_timeout'))->idleTimeout(3600)->input($input)->start($remote_command, function (string $type, string $output) use ($command, $hidden, $customType, $append, $command_hidden, $skip_command_log) {
+        $addLogEntry = function (string $type, string $output) use ($command, $hidden, $customType, $command_hidden, $skip_command_log): void {
             // Sanitize output to ensure valid UTF-8 encoding before JSON encoding
-            $sanitized_output = sanitize_utf8_text($output);
-            $log_output = str($sanitized_output)->trim();
+            $log_output = str(sanitize_utf8_text($output))->trim();
             if ($log_output->startsWith('╔')) {
                 $log_output = "\n".$log_output;
             }
 
-            $new_log_entry = [
-                'command' => $skip_command_log || $command_hidden ? null : $this->redact_sensitive_info($command),
-                'output' => $this->redact_sensitive_info($skip_command_log ? $this->redactSensitiveCommandPayloads((string) $log_output, (string) $command) : $log_output),
-                'type' => $customType ?? ($type === 'err' ? 'stderr' : 'stdout'),
-                'timestamp' => Carbon::now('UTC'),
-                'hidden' => $hidden,
-                'batch' => static::$batch_counter,
-            ];
-            if (! $this->application_deployment_queue->logs) {
-                $new_log_entry['order'] = 1;
-            } else {
-                try {
-                    $previous_logs = json_decode($this->application_deployment_queue->logs, associative: true, flags: JSON_THROW_ON_ERROR);
-                } catch (\JsonException $e) {
-                    // If existing logs are corrupted, start fresh
-                    $previous_logs = [];
-                    $new_log_entry['order'] = 1;
-                }
-                if (is_array($previous_logs)) {
-                    $new_log_entry['order'] = count($previous_logs) + 1;
-                } else {
-                    $previous_logs = [];
-                    $new_log_entry['order'] = 1;
-                }
-            }
-            $previous_logs[] = $new_log_entry;
-
-            try {
-                $this->application_deployment_queue->logs = json_encode($previous_logs, flags: JSON_THROW_ON_ERROR);
-            } catch (\JsonException $e) {
-                // If JSON encoding still fails, use fallback with invalid sequences replacement
-                $this->application_deployment_queue->logs = json_encode($previous_logs, flags: JSON_INVALID_UTF8_SUBSTITUTE);
+            $this->application_deployment_queue->addLogEntry(
+                message: $skip_command_log ? $this->redactSensitiveCommandPayloads((string) $log_output, (string) $command) : (string) $log_output,
+                type: $customType ?? ($type === 'err' ? 'stderr' : 'stdout'),
+                hidden: $hidden,
+                command: $skip_command_log || $command_hidden ? null : $command,
+                batch: static::$batch_counter,
+            );
+        };
+        // Output is logged per complete line, so a secret split across two output chunks is still redacted.
+        $pending = [];
+        $process = Process::timeout(config('constants.ssh.command_timeout'))->idleTimeout(3600)->input($input)->start($remote_command, function (string $type, string $output) use ($addLogEntry, $append, &$pending) {
+            $pending[$type] = ($pending[$type] ?? '').$output;
+            $complete_output = RunRemoteProcess::takeCompleteOutput($pending[$type]);
+            if ($complete_output !== '') {
+                $addLogEntry($type, $complete_output);
             }
 
-            $this->application_deployment_queue->save();
-
-            $this->saveCommandOutput($sanitized_output, $append);
+            $this->saveCommandOutput(sanitize_utf8_text($output), $append);
         });
         $this->application_deployment_queue->update([
             'current_process_id' => $process->id(),
         ]);
 
-        $process_result = $process->wait();
+        try {
+            $process_result = $process->wait();
+        } finally {
+            foreach ($pending as $type => $output) {
+                $remaining_output = RunRemoteProcess::takeCompleteOutput($pending[$type], final: true);
+                if ($remaining_output !== '') {
+                    $addLogEntry($type, $remaining_output);
+                }
+            }
+        }
         if ($process_result->exitCode() !== 0) {
             if (! $ignore_errors) {
                 // Check if deployment was cancelled while command was running
@@ -339,40 +319,10 @@ trait ExecuteRemoteCommand
     {
         $retryMessage = "SSH connection failed. Retrying... (Attempt {$attempt}/{$maxRetries}, waiting {$delay}s)\nError: {$errorMessage}";
 
-        $new_log_entry = [
-            'output' => $this->redact_sensitive_info($retryMessage),
-            'type' => 'stdout',
-            'timestamp' => Carbon::now('UTC'),
-            'hidden' => false,
-            'batch' => static::$batch_counter,
-        ];
-
-        if (! $this->application_deployment_queue->logs) {
-            $new_log_entry['order'] = 1;
-            $previous_logs = [];
-        } else {
-            try {
-                $previous_logs = json_decode($this->application_deployment_queue->logs, associative: true, flags: JSON_THROW_ON_ERROR);
-            } catch (\JsonException $e) {
-                $previous_logs = [];
-                $new_log_entry['order'] = 1;
-            }
-            if (is_array($previous_logs)) {
-                $new_log_entry['order'] = count($previous_logs) + 1;
-            } else {
-                $previous_logs = [];
-                $new_log_entry['order'] = 1;
-            }
-        }
-
-        $previous_logs[] = $new_log_entry;
-
-        try {
-            $this->application_deployment_queue->logs = json_encode($previous_logs, flags: JSON_THROW_ON_ERROR);
-        } catch (\JsonException $e) {
-            $this->application_deployment_queue->logs = json_encode($previous_logs, flags: JSON_INVALID_UTF8_SUBSTITUTE);
-        }
-
-        $this->application_deployment_queue->save();
+        $this->registerRemoteSecretsForLogs();
+        $this->application_deployment_queue->addLogEntry(
+            message: $retryMessage,
+            batch: static::$batch_counter,
+        );
     }
 }
diff --git a/app/Traits/HandlesNotificationResponse.php b/app/Traits/HandlesNotificationResponse.php
index 77d8b8477d..ede61dbfa0 100644
--- a/app/Traits/HandlesNotificationResponse.php
+++ b/app/Traits/HandlesNotificationResponse.php
@@ -2,10 +2,15 @@
 
 namespace App\Traits;
 
+use App\Rules\SafeWebhookUrl;
+use Closure;
+use GuzzleHttp\Exception\TransferException;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\RequestException;
 use Illuminate\Http\Client\Response;
 use Illuminate\Support\Facades\Log;
-use Illuminate\Support\Str;
 use RuntimeException;
+use Symfony\Component\HttpFoundation\Response as HttpResponse;
 
 /**
  * Shared response handling for the notification jobs. The job must have a
@@ -14,6 +19,28 @@ use RuntimeException;
  */
 trait HandlesNotificationResponse
 {
+    /**
+     * Send the request and replace HTTP client exceptions, whose messages contain
+     * the full URL (bot token, secret webhook path), with one that only names the
+     * scheme and host. The original exception is not kept as `previous`, so the
+     * URL never reaches failed_jobs or the logs.
+     *
+     * @param  Closure(): Response  $send
+     */
+    protected function sendNotificationRequest(string $channel, string $url, Closure $send): Response
+    {
+        try {
+            return $send();
+        } catch (ConnectionException|RequestException|TransferException $e) {
+            throw new RuntimeException(sprintf(
+                '%s notification request to %s failed (%s).',
+                $channel,
+                SafeWebhookUrl::redactedUrlForLog($url),
+                class_basename($e),
+            ));
+        }
+    }
+
     /**
      * Rate limits and server errors are retried by the queue. A configuration
      * error (invalid token, deleted webhook) counts as a delivery failure and
@@ -32,7 +59,8 @@ trait HandlesNotificationResponse
             throw new RuntimeException("{$channel} notification failed with {$response->status()} status code.");
         }
 
-        $reason = "{$channel} returned HTTP {$response->status()}: ".Str::limit($response->body(), 200);
+        // The response body is never part of the reason: it can echo tokens or webhook secrets.
+        $reason = "{$channel} returned HTTP {$response->status()} (".(HttpResponse::$statusTexts[$response->status()] ?? 'Client Error').').';
 
         if ($isConfigurationError) {
             $this->settings?->recordDeliveryFailure($reason);
diff --git a/app/Traits/HasLogRedactionSetting.php b/app/Traits/HasLogRedactionSetting.php
new file mode 100644
index 0000000000..5077bb0922
--- /dev/null
+++ b/app/Traits/HasLogRedactionSetting.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Traits;
+
+/**
+ * The "Environment values in logs" setting of a standalone database.
+ */
+trait HasLogRedactionSetting
+{
+    public function initializeHasLogRedactionSetting(): void
+    {
+        $this->mergeFillable(['redact_all_env_values_in_logs']);
+        $this->mergeCasts(['redact_all_env_values_in_logs' => 'boolean']);
+    }
+
+    /**
+     * Tell if every environment value is hidden in logs. When false, only locked values are hidden.
+     */
+    public function redactsAllEnvValuesInLogs(): bool
+    {
+        return $this->redact_all_env_values_in_logs ?? true;
+    }
+}
diff --git a/app/Traits/HasMaintenancePage.php b/app/Traits/HasMaintenancePage.php
new file mode 100644
index 0000000000..ed5b9d3827
--- /dev/null
+++ b/app/Traits/HasMaintenancePage.php
@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\Server;
+use Illuminate\Support\Collection;
+use Spatie\Url\Url;
+
+/**
+ * Maintenance mode for a resource with domains: the proxy shows a maintenance page with
+ * status 503 instead of the resource. The resource containers keep running.
+ *
+ * @property bool $is_maintenance_enabled
+ * @property string|null $maintenance_page
+ */
+trait HasMaintenancePage
+{
+    /**
+     * @return Collection<int, array{url: string, force_https: bool}>
+     */
+    abstract public function maintenanceDomains(): Collection;
+
+    /**
+     * @return Collection<int, Server>
+     */
+    abstract public function maintenanceServers(): Collection;
+
+    /**
+     * Proxy routes for the maintenance page. Domains go into the Traefik and Caddy configuration
+     * as plain text, so a domain with an unexpected host or path is skipped.
+     *
+     * @return Collection<int, array{scheme: string, host: string, path: string, force_https: bool}>
+     */
+    public function maintenanceRoutes(): Collection
+    {
+        return $this->maintenanceDomains()
+            ->map(function (array $domain): ?array {
+                try {
+                    $url = Url::fromString(trim($domain['url']));
+                } catch (\Throwable) {
+                    return null;
+                }
+                // Host and scheme stay as the proxy labels use them, so the Caddy site address is the same.
+                $scheme = $url->getScheme();
+                $host = $url->getHost();
+                $path = $url->getPath() ?: '/';
+
+                if (! in_array($scheme, ['http', 'https'], true)
+                    || ! preg_match('/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/i', $host)
+                    || ! preg_match('#^/[A-Za-z0-9/._~%-]*$#', $path)) {
+                    return null;
+                }
+
+                return ['scheme' => $scheme, 'host' => $host, 'path' => $path, 'force_https' => $domain['force_https']];
+            })
+            ->filter()
+            ->unique(fn (array $route) => "{$route['scheme']}://{$route['host']}{$route['path']}")
+            ->values();
+    }
+
+    /**
+     * The custom maintenance page HTML, or the Coolify default page.
+     */
+    public function maintenancePageHtml(): string
+    {
+        return filled($this->maintenance_page) ? $this->maintenance_page : view('proxy.maintenance-page')->render();
+    }
+
+    public function maintenancePageFile(): string
+    {
+        return "maintenance-{$this->uuid}.html";
+    }
+
+    /**
+     * Applies the maintenance state of this resource on every server that runs it.
+     */
+    public function syncMaintenancePage(?Collection $servers = null): void
+    {
+        foreach ($servers ?? $this->maintenanceServers() as $server) {
+            if ($server->isFunctional()) {
+                $server->setupMaintenancePages();
+            }
+        }
+    }
+}
diff --git a/app/Traits/HasMetrics.php b/app/Traits/HasMetrics.php
index 712f09a48b..cdf5a9c2e9 100644
--- a/app/Traits/HasMetrics.php
+++ b/app/Traits/HasMetrics.php
@@ -27,7 +27,63 @@ trait HasMetrics
         return convertContainerMemoryBytesToMegabytes($metrics);
     }
 
+    /**
+     * Root filesystem usage percentage over time. Disk history interleaves every
+     * mount, so we keep only the root mount before mapping.
+     */
+    public function getDiskMetrics(int $mins = 5): ?array
+    {
+        $rows = $this->fetchMetricRows('disk', $mins);
+        if ($rows === null) {
+            return null;
+        }
+
+        if (array_any($rows, fn ($row) => array_key_exists('mount', $row))) {
+            $rows = array_values(array_filter($rows, fn ($row) => ($row['mount'] ?? null) === '/'));
+        }
+
+        return $this->mapRows($rows, 'usedPercent', $mins);
+    }
+
+    /**
+     * Host load average (1 minute) over time.
+     */
+    public function getLoadMetrics(int $mins = 5): ?array
+    {
+        return $this->getMetrics('load', $mins, 'load1');
+    }
+
+    /**
+     * Network throughput over time, as separate receive/transmit byte-rate series.
+     *
+     * @return array{rx: ?array, tx: ?array}|null
+     */
+    public function getNetworkMetrics(int $mins = 5): ?array
+    {
+        $rows = $this->fetchMetricRows('network', $mins);
+        if ($rows === null) {
+            return null;
+        }
+
+        return [
+            'rx' => $this->mapRows($rows, 'rxBytesPerSec', $mins),
+            'tx' => $this->mapRows($rows, 'txBytesPerSec', $mins),
+        ];
+    }
+
     private function getMetrics(string $type, int $mins, string $valueField): ?array
+    {
+        return $this->mapRows($this->fetchMetricRows($type, $mins), $valueField, $mins);
+    }
+
+    /**
+     * Fetch and decode the raw Sentinel history rows for a metric type, or null when
+     * metrics are disabled. Throws on a Sentinel error response (caller decides whether
+     * to treat that as fatal or optional).
+     *
+     * @return array<int, array<string, mixed>>|null
+     */
+    protected function fetchMetricRows(string $type, int $mins): ?array
     {
         $server = $this->getMetricsServer();
         if (! $server->isMetricsEnabled()) {
@@ -63,7 +119,21 @@ trait HasMetrics
             throw new \Exception($error);
         }
 
-        $metrics = collect(json_decode($response, true))->map(function ($metric) use ($valueField) {
+        return json_decode($response, true) ?: [];
+    }
+
+    /**
+     * Map raw rows to [timestampMs, value] pairs, downsampling long ranges.
+     *
+     * @param  array<int, array<string, mixed>>|null  $rows
+     */
+    private function mapRows(?array $rows, string $valueField, int $mins): ?array
+    {
+        if ($rows === null) {
+            return null;
+        }
+
+        $metrics = collect($rows)->map(function ($metric) use ($valueField) {
             return [(int) $metric['time'], (float) ($metric[$valueField] ?? 0.0)];
         })->toArray();
 
diff --git a/app/Traits/HasRepositoryDetection.php b/app/Traits/HasRepositoryDetection.php
new file mode 100644
index 0000000000..d89d5314eb
--- /dev/null
+++ b/app/Traits/HasRepositoryDetection.php
@@ -0,0 +1,274 @@
+<?php
+
+namespace App\Traits;
+
+use App\Data\RepositoryDetectionResult;
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\PrivateKey;
+use App\Rules\ValidGitBranch;
+use App\Services\RepositoryDetector;
+use App\Support\ValidationPatterns;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Validator;
+use Livewire\Attributes\Locked;
+
+/**
+ * @property string $build_pack
+ * @property int $port
+ * @property string|null $docker_compose_location
+ *
+ * @method void updatedBuildPack()
+ */
+trait HasRepositoryDetection
+{
+    public bool $detectionRan = false;
+
+    public bool $detectionFailed = false;
+
+    /**
+     * Build pack that the scan selected from a file in the base directory.
+     */
+    #[Locked]
+    public ?string $suggestedBuildPack = null;
+
+    #[Locked]
+    public array $detectedDockerfiles = [];
+
+    #[Locked]
+    public array $detectedDockerComposeFiles = [];
+
+    public ?string $selectedDockerfile = null;
+
+    public ?string $selectedDockerComposeFile = null;
+
+    public ?int $detectedPort = null;
+
+    #[Locked]
+    public array $dockerfilePorts = [];
+
+    #[Locked]
+    public array $detectedEnvFiles = [];
+
+    public ?string $selectedEnvFile = null;
+
+    #[Locked]
+    public array $parsedEnvFiles = [];
+
+    public array $envExampleVars = [];
+
+    public bool $envImported = false;
+
+    /**
+     * Unsaved application with the repository, branch, and Git source or deploy key to scan.
+     */
+    abstract protected function applicationForDetection(): Application;
+
+    public function detectRepository(): void
+    {
+        $this->authorize('create', Application::class);
+        try {
+            $application = $this->applicationForDetection();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return;
+        }
+        Validator::make([
+            'branch' => $application->git_branch,
+            'base_directory' => $this->base_directory ?? '/',
+        ], [
+            'branch' => ['required', new ValidGitBranch],
+            'base_directory' => ['required', 'string', 'regex:~^/?(?:[a-zA-Z0-9_.-]+/)*[a-zA-Z0-9_.-]*$~', 'not_regex:~(^|/)\.\.?(/|$)~'],
+        ])->validate();
+
+        $destination = find_resource_destination_for_current_team(data_get($this->query, 'destination'));
+        if (! $destination) {
+            $this->dispatch('error', 'Destination not found.');
+
+            return;
+        }
+        $this->authorize('update', $destination->server);
+
+        $this->detectionRan = false;
+        $this->detectionFailed = false;
+        $this->applyDetectionResult(RepositoryDetectionResult::none());
+        try {
+            $detector = new RepositoryDetector($application, $this->base_directory ?? '/', $destination->server);
+            $this->applyDetectionResult($detector->detect());
+        } catch (\Throwable $e) {
+            // The exception can contain the clone command with a Git token, so do not log the message.
+            Log::debug('Repository detection failed', ['exception' => $e::class]);
+            $this->detectionFailed = true;
+            $this->dispatch('error', 'Smart Scan could not read the repository. Check the repository access and the branch.');
+        }
+        $this->detectionRan = true;
+    }
+
+    /**
+     * Builds an application that is not saved, only to generate the clone command for the scan.
+     */
+    protected function unsavedApplicationForDetection(string $repository, string $branch, GithubApp|GitlabApp|GiteaApp|null $source = null, ?PrivateKey $privateKey = null): Application
+    {
+        $application = (new Application)->forceFill([
+            'git_repository' => $repository,
+            'git_branch' => $branch,
+            'git_commit_sha' => 'HEAD',
+            'private_key_id' => $privateKey?->id,
+        ]);
+        $application->setRelation('settings', (new ApplicationSetting)->forceFill([
+            'is_git_shallow_clone_enabled' => true,
+            'is_git_submodules_enabled' => false,
+        ]));
+        $application->setRelation('source', $source);
+        $application->setRelation('private_key', $privateKey);
+
+        return $application;
+    }
+
+    protected function importDetectedEnvironmentVariables(Application $application): void
+    {
+        if (! $this->envImported || empty($this->envExampleVars)) {
+            return;
+        }
+        Validator::make(['variables' => $this->envExampleVars], [
+            'variables' => ['array'],
+            'variables.*' => ['nullable', 'string'],
+        ])->validate();
+        $application->getConnection()->transaction(function () use ($application): void {
+            foreach ($this->envExampleVars as $key => $value) {
+                if (! preg_match('/^[A-Z_][A-Z0-9_]*$/i', (string) $key)) {
+                    continue;
+                }
+                EnvironmentVariable::create([
+                    'key' => $key,
+                    'value' => $value,
+                    'resourceable_type' => $application->getMorphClass(),
+                    'resourceable_id' => $application->id,
+                    'is_preview' => false,
+                ]);
+            }
+        });
+    }
+
+    protected function applyDetectionResult(RepositoryDetectionResult $result): void
+    {
+        $this->detectedDockerfiles = $result->dockerfiles;
+        $this->detectedDockerComposeFiles = $result->dockerComposeFiles;
+        $this->dockerfilePorts = $result->dockerfilePorts;
+
+        $this->selectedDockerfile = null;
+        $this->selectedDockerComposeFile = null;
+        $this->detectedPort = null;
+        $this->detectedEnvFiles = [];
+        $this->parsedEnvFiles = [];
+        $this->selectedEnvFile = null;
+        $this->envExampleVars = [];
+        $this->envImported = false;
+
+        $this->suggestedBuildPack = $result->getSuggestedBuildPack()?->value;
+        if ($this->suggestedBuildPack && $this->suggestedBuildPack !== $this->build_pack) {
+            $this->build_pack = $this->suggestedBuildPack;
+            $this->updatedBuildPack();
+        }
+
+        if ($result->hasDockerfile()) {
+            $this->selectedDockerfile = $result->dockerfiles[0];
+            $port = $result->dockerfilePorts[$this->selectedDockerfile] ?? null;
+            $this->port = $port ?? 3000;
+            $this->detectedPort = $port;
+        }
+
+        if ($result->hasDockerCompose()) {
+            $this->selectedDockerComposeFile = $result->dockerComposeFiles[0];
+            $this->docker_compose_location = '/'.$this->selectedDockerComposeFile;
+        }
+
+        if ($result->hasEnvFiles()) {
+            $this->detectedEnvFiles = array_keys($result->envFiles);
+            $this->parsedEnvFiles = [];
+            foreach ($result->envFiles as $filename => $content) {
+                $parsed = $content !== null ? parseEnvFormatToArray($content) : [];
+                // parseEnvFormatToArray returns ['KEY' => ['value' => ..., 'comment' => ...]].
+                // Flatten to a plain ['KEY' => 'value'] map for the import form.
+                $this->parsedEnvFiles[$filename] = collect($parsed)
+                    ->map(fn ($item) => is_array($item) ? (string) ($item['value'] ?? '') : (string) $item)
+                    ->all();
+            }
+            $this->selectedEnvFile = $this->detectedEnvFiles[0];
+            $this->envExampleVars = $this->parsedEnvFiles[$this->selectedEnvFile] ?? [];
+        }
+    }
+
+    /**
+     * Repository path without a leading slash, so a typed path matches the detected paths.
+     */
+    protected function normalizeRepositoryFilePath(?string $path): ?string
+    {
+        $path = ltrim(trim((string) $path), '/');
+
+        return $path === '' ? null : $path;
+    }
+
+    /**
+     * Dockerfile location for the new application: a detected file or a path the user typed.
+     */
+    protected function selectedDockerfileLocation(): ?string
+    {
+        $path = $this->normalizeRepositoryFilePath($this->selectedDockerfile);
+        if ($path === null) {
+            return null;
+        }
+        $location = '/'.$path;
+        Validator::make(
+            ['selectedDockerfile' => $location],
+            ['selectedDockerfile' => ValidationPatterns::filePathRules()],
+            ValidationPatterns::filePathMessages('selectedDockerfile', 'Dockerfile'),
+        )->validate();
+
+        return $location;
+    }
+
+    public function updatedSelectedDockerfile(): void
+    {
+        $this->selectedDockerfile = $this->normalizeRepositoryFilePath($this->selectedDockerfile);
+        $this->resetErrorBag('selectedDockerfile');
+        $this->selectedDockerfileLocation();
+
+        $port = $this->dockerfilePorts[$this->selectedDockerfile ?? ''] ?? null;
+        $this->port = $port ?? 3000;
+        $this->detectedPort = $port;
+    }
+
+    public function updatedSelectedDockerComposeFile(): void
+    {
+        $this->selectedDockerComposeFile = $this->normalizeRepositoryFilePath($this->selectedDockerComposeFile);
+
+        if ($this->selectedDockerComposeFile) {
+            $this->docker_compose_location = '/'.$this->selectedDockerComposeFile;
+        }
+    }
+
+    public function updatedSelectedEnvFile(): void
+    {
+        if ($this->selectedEnvFile && isset($this->parsedEnvFiles[$this->selectedEnvFile])) {
+            $this->envExampleVars = $this->parsedEnvFiles[$this->selectedEnvFile];
+            $this->envImported = false;
+        }
+    }
+
+    public function confirmEnvImport(): void
+    {
+        $this->envImported = true;
+    }
+
+    public function clearEnvVars(): void
+    {
+        $this->envImported = false;
+        $this->envExampleVars = $this->parsedEnvFiles[$this->selectedEnvFile] ?? [];
+    }
+}
diff --git a/app/Traits/HasS3Destinations.php b/app/Traits/HasS3Destinations.php
new file mode 100644
index 0000000000..59668f3961
--- /dev/null
+++ b/app/Traits/HasS3Destinations.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\S3Storage;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Support\Collection;
+
+/**
+ * S3 destinations of a backup schedule. The `s3_storage_id` column keeps the primary destination for older clients.
+ */
+trait HasS3Destinations
+{
+    abstract public function s3Storages(): BelongsToMany;
+
+    /**
+     * @return Collection<int, S3Storage> The primary destination comes first.
+     */
+    public function selectedS3Storages(): Collection
+    {
+        $storages = $this->relationLoaded('s3Storages')
+            ? $this->s3Storages->sortBy('name')
+            : $this->s3Storages()->orderBy('s3_storages.name')->get();
+
+        if ($storages->isEmpty()) {
+            return $this->s3 ? collect([$this->s3]) : collect();
+        }
+
+        return $storages
+            ->sortBy(fn (S3Storage $storage): int => $storage->id === $this->s3_storage_id ? 0 : 1)
+            ->values();
+    }
+
+    /**
+     * Schedules that send backups to the given storage.
+     */
+    public function scopeUsingS3Storage(Builder $query, int $storageId): Builder
+    {
+        return $query->where(fn (Builder $query) => $query
+            ->where('s3_storage_id', $storageId)
+            ->orWhereHas('s3Storages', fn (Builder $query) => $query->whereKey($storageId)));
+    }
+
+    /**
+     * Gives a cloned schedule the same destinations, limited to storages of the clone's team.
+     */
+    public function copyS3StoragesTo(self $copy): void
+    {
+        $copy->s3Storages()->sync(
+            $this->s3Storages()->where('s3_storages.team_id', $copy->team_id)->pluck('s3_storages.id')->all(),
+        );
+    }
+
+    /**
+     * Replaces the selected destinations. The current primary destination stays primary when it is still selected.
+     *
+     * @param  array<int, int|string>  $storageIds
+     */
+    public function syncS3Storages(array $storageIds): void
+    {
+        $storageIds = collect($storageIds)->map(fn ($id): int => (int) $id)->filter()->unique()->values();
+
+        $this->s3Storages()->sync($storageIds->all());
+        $this->s3_storage_id = $storageIds->contains($this->s3_storage_id) ? $this->s3_storage_id : $storageIds->first();
+        $this->save();
+    }
+}
diff --git a/app/Traits/HasS3Replicas.php b/app/Traits/HasS3Replicas.php
new file mode 100644
index 0000000000..0d63823cd6
--- /dev/null
+++ b/app/Traits/HasS3Replicas.php
@@ -0,0 +1,117 @@
+<?php
+
+namespace App\Traits;
+
+use App\Services\FileDownloadStorageService;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+/**
+ * S3 copies of a backup execution, one per destination. The `s3_uploaded` and `s3_storage_deleted` columns of the
+ * execution summarize them.
+ */
+trait HasS3Replicas
+{
+    abstract public function s3Replicas(): HasMany;
+
+    /**
+     * Deletes the backup file from every destination that still has a copy.
+     */
+    public function deleteS3Copies(): void
+    {
+        $replicas = $this->s3Replicas()
+            ->with('s3')
+            ->where('s3_uploaded', true)
+            ->where('s3_storage_deleted', false)
+            ->get();
+
+        try {
+            foreach ($replicas as $replica) {
+                if (! $replica->s3) {
+                    throw new \RuntimeException('The S3 storage used by an existing backup is unavailable.');
+                }
+                if (filled($this->filename)) {
+                    deleteBackupsS3($this->filename, $replica->s3);
+                }
+                $replica->update(['s3_storage_deleted' => true]);
+            }
+        } finally {
+            $this->refreshS3Summary();
+        }
+    }
+
+    public function hasLiveS3Copies(): bool
+    {
+        return $this->s3Replicas()->where('s3_uploaded', true)->where('s3_storage_deleted', false)->exists();
+    }
+
+    /**
+     * Whether a local file or a live S3 copy is left to download.
+     */
+    public function isDownloadable(): bool
+    {
+        return ! $this->local_storage_deleted
+            || $this->s3Replicas->contains(fn ($replica): bool => $replica->s3_uploaded === true && $replica->s3_storage_deleted === false);
+    }
+
+    /**
+     * A short-lived presigned download URL for the first live copy in a usable S3 storage of the given team, the
+     * primary storage first. Null when no such copy exists.
+     */
+    public function s3DownloadUrl(int $teamId, ?int $primaryStorageId): ?string
+    {
+        if (blank($this->filename)) {
+            return null;
+        }
+
+        $replica = $this->s3Replicas()
+            ->with('s3')
+            ->where('s3_uploaded', true)
+            ->where('s3_storage_deleted', false)
+            ->whereHas('s3', fn (Builder $query) => $query->where('team_id', $teamId)->where('is_usable', true))
+            ->orderBy('id')
+            ->get()
+            ->sortByDesc(fn ($replica): bool => $replica->s3_storage_id === $primaryStorageId)
+            ->first();
+
+        if (! $replica) {
+            return null;
+        }
+
+        // The upload copies the file to "<bucket><backup directory>/", so the object key is the local file path.
+        return $replica->s3->filesystem()->temporaryUrl(
+            $this->filename,
+            now()->addMinutes(FileDownloadStorageService::LINK_TTL_MINUTES),
+            ['ResponseContentDisposition' => FileDownloadStorageService::contentDisposition(basename($this->filename))],
+        );
+    }
+
+    /**
+     * Writes the replica states to the summary columns: uploaded when every copy uploaded, deleted when every uploaded
+     * copy is deleted.
+     */
+    public function refreshS3Summary(): void
+    {
+        $replicas = $this->s3Replicas()->get();
+        if ($replicas->isEmpty()) {
+            return;
+        }
+
+        $uploaded = $replicas->where('s3_uploaded', true);
+
+        $this->update([
+            's3_uploaded' => $replicas->every(fn ($replica): bool => $replica->s3_uploaded === true),
+            's3_storage_deleted' => $uploaded->isNotEmpty() && $uploaded->every(fn ($replica): bool => $replica->s3_storage_deleted),
+        ]);
+    }
+
+    /**
+     * Executions that have no S3 copy left to keep.
+     */
+    public function scopeWithoutLiveS3Copies(Builder $query): Builder
+    {
+        return $query->whereDoesntHave('s3Replicas', fn (Builder $query) => $query
+            ->where('s3_uploaded', true)
+            ->where('s3_storage_deleted', false));
+    }
+}
diff --git a/app/Traits/IncludesDeploymentCommitDetails.php b/app/Traits/IncludesDeploymentCommitDetails.php
new file mode 100644
index 0000000000..6248481266
--- /dev/null
+++ b/app/Traits/IncludesDeploymentCommitDetails.php
@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use Illuminate\Support\Str;
+
+trait IncludesDeploymentCommitDetails
+{
+    public ?string $commit_sha = null;
+
+    public ?string $commit_message = null;
+
+    public ?string $commit_url = null;
+
+    public ?string $commit_branch = null;
+
+    /** Store plain strings from the job's in-memory deployment, so no query runs here. */
+    protected function resolveDeploymentCommitDetails(Application $application, ?ApplicationDeploymentQueue $deployment, ?ApplicationPreview $preview = null): void
+    {
+        if (! $deployment) {
+            return;
+        }
+
+        $commit = trim((string) $deployment->commit);
+        if (preg_match('/^[0-9a-f]{7,64}$/i', $commit) === 1) {
+            $this->commit_sha = $commit;
+            $this->commit_url = $application->gitCommitLink($commit);
+        }
+
+        $message = trim(mb_scrub((string) $deployment->commitMessage(), 'UTF-8'));
+        if ($message !== '') {
+            $this->commit_message = Str::limit($message, 1000);
+        }
+
+        if (is_null($preview) && filled($application->git_branch)) {
+            $this->commit_branch = $application->git_branch;
+        }
+    }
+
+    /** @return array{sha: string|null, short_sha: string|null, url: string|null, branch: string|null, message: string|null}|null */
+    protected function deploymentCommitDetailsForMail(?object $notifiable): ?array
+    {
+        $enabled = (bool) data_get($notifiable, 'emailNotificationSettings.deployment_commit_details_email_notifications', false);
+
+        if (! $enabled || (is_null($this->commit_sha) && is_null($this->commit_message))) {
+            return null;
+        }
+
+        return [
+            'sha' => $this->commit_sha,
+            'short_sha' => $this->commit_sha ? substr($this->commit_sha, 0, 7) : null,
+            'url' => $this->commit_url,
+            'branch' => $this->commit_branch ? self::escapeMailMarkdown($this->commit_branch) : null,
+            'message' => $this->commit_message ? self::formatCommitMessageForMail($this->commit_message) : null,
+        ];
+    }
+
+    /** Escape Markdown in user-controlled text; Blade escapes the HTML. */
+    private static function escapeMailMarkdown(string $text): string
+    {
+        return preg_replace('/([\\\\`*_{}\[\]()#+\-.!|~=])/u', '\\\\$1', $text);
+    }
+
+    private static function formatCommitMessageForMail(string $message): string
+    {
+        $paragraphs = preg_split('/\R\s*\R/u', str_replace("\r\n", "\n", $message));
+
+        return collect($paragraphs)
+            ->map(fn (string $paragraph): string => collect(preg_split('/\R/u', $paragraph))
+                ->map(fn (string $line): string => self::escapeMailMarkdown(trim($line)))
+                ->filter(fn (string $line): bool => $line !== '')
+                ->implode("\\\n"))
+            ->filter(fn (string $paragraph): bool => $paragraph !== '')
+            ->implode("\n\n");
+    }
+}
diff --git a/app/Traits/PreparesBackupDownloads.php b/app/Traits/PreparesBackupDownloads.php
new file mode 100644
index 0000000000..118813fa5f
--- /dev/null
+++ b/app/Traits/PreparesBackupDownloads.php
@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Traits;
+
+use App\Jobs\PrepareFileDownloadJob;
+use App\Models\Server;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+
+/**
+ * Backup downloads through the instance download S3 storage: the server
+ * uploads the backup to S3 and the browser downloads it from there. Without
+ * the storage, when the local file is gone, or when the backup is larger
+ * than one S3 PUT, the browser uses the Coolify download route.
+ *
+ * The view must poll checkDownloads() while $pendingDownloads is not empty
+ * and open the URL of each `open-backup-download` window event.
+ */
+trait PreparesBackupDownloads
+{
+    private const MAX_PENDING_S3_DOWNLOADS = 3;
+
+    /** @var array<int, string> */
+    public array $pendingDownloads = [];
+
+    /**
+     * Authorize the user and load the backup from a record scoped to the
+     * component before you call this. Pass a null server or file name when
+     * the local file is gone; the download route then answers the request.
+     */
+    protected function prepareBackupDownload(?Server $server, ?string $filename, string $streamUrl): void
+    {
+        $storage = FileDownloadStorageService::configuredStorage();
+        $size = $storage && $server && filled($filename) ? FileDownloadStorageService::hostFileSize($server, $filename) : null;
+        if ($size === null || $size > FileDownloadStorageService::MAX_SIZE) {
+            $this->dispatch('open-backup-download', url: $streamUrl);
+
+            return;
+        }
+
+        if (count($this->pendingDownloads) >= self::MAX_PENDING_S3_DOWNLOADS
+            || ! RateLimiter::attempt('file-browser-s3-download:'.auth()->id(), 10, fn () => true, 3600)) {
+            $this->dispatch('error', 'Too many downloads are in progress. Wait for them to finish, then try again.');
+
+            return;
+        }
+
+        $downloadId = (string) Str::uuid();
+        $this->pendingDownloads[] = $downloadId;
+        PrepareFileDownloadJob::dispatch($downloadId, auth()->id(), $server->id, null, $filename, false, basename($filename), $storage->id);
+        $this->dispatch('info', 'Preparing '.basename($filename).'. The download starts when it is ready.');
+    }
+
+    /**
+     * Polled while S3 downloads are prepared. Opens each finished link once.
+     */
+    public function checkDownloads(): void
+    {
+        foreach ($this->pendingDownloads as $index => $downloadId) {
+            $result = Cache::get(PrepareFileDownloadJob::cacheKey($downloadId));
+            if (! is_array($result) || ($result['user_id'] ?? null) !== auth()->id()) {
+                continue;
+            }
+
+            unset($this->pendingDownloads[$index]);
+            Cache::forget(PrepareFileDownloadJob::cacheKey($downloadId));
+            if ($result['status'] === 'ready') {
+                $this->dispatch('open-backup-download', url: $result['url']);
+            } else {
+                $this->dispatch('error', $result['message']);
+            }
+        }
+        $this->pendingDownloads = array_values($this->pendingDownloads);
+    }
+
+    protected function s3BackupDownloadsEnabled(): bool
+    {
+        return FileDownloadStorageService::configuredStorage() !== null;
+    }
+}
diff --git a/app/Traits/TracksDeliveryFailures.php b/app/Traits/TracksDeliveryFailures.php
index 5b8c785437..8ab56705d4 100644
--- a/app/Traits/TracksDeliveryFailures.php
+++ b/app/Traits/TracksDeliveryFailures.php
@@ -40,8 +40,13 @@ trait TracksDeliveryFailures
         });
     }
 
+    /**
+     * The reason must not contain a provider response body. It is shared with the
+     * team, the team admins, and the instance admins, so it is redacted once more.
+     */
     public function recordDeliveryFailure(string $reason): void
     {
+        $reason = remove_iip($reason);
         $this->increment('failure_count');
 
         Log::warning('Notification delivery failed', [
diff --git a/bootstrap/helpers/api.php b/bootstrap/helpers/api.php
index 6a72c37ba7..081396b44b 100644
--- a/bootstrap/helpers/api.php
+++ b/bootstrap/helpers/api.php
@@ -2,6 +2,7 @@
 
 use App\Actions\Shared\MigrateResourceToDestination;
 use App\Enums\BuildPackTypes;
+use App\Enums\HttpBasicAuthHashAlgorithm;
 use App\Enums\RedirectTypes;
 use App\Enums\StaticImageTypes;
 use App\Models\Application;
@@ -202,6 +203,7 @@ function sharedDataApplications(?Application $application = null): array
         'inject_build_args_to_dockerfile' => 'boolean',
         'include_source_commit_in_build' => 'boolean',
         'is_env_sorting_enabled' => 'boolean',
+        'redact_all_env_values_in_logs' => 'boolean',
         'is_pr_deployments_public_enabled' => 'boolean',
         'is_gzip_enabled' => 'boolean',
         'is_stripprefix_enabled' => 'boolean',
@@ -211,9 +213,13 @@ function sharedDataApplications(?Application $application = null): array
         'is_log_drain_enabled' => 'boolean',
         'is_gpu_enabled' => 'boolean',
         'gpu_driver' => 'string|nullable',
-        'gpu_count' => 'string|nullable',
+        'gpu_count' => ['string', 'nullable', 'regex:'.ApplicationSetting::GPU_COUNT_PATTERN],
         'gpu_device_ids' => 'string|nullable',
-        'gpu_options' => 'string|nullable',
+        'gpu_options' => ['string', 'nullable', function (string $attribute, mixed $value, Closure $fail): void {
+            if (ApplicationSetting::parseGpuOptions($value) === null) {
+                $fail('The gpu_options must be key=value pairs or a YAML mapping.');
+            }
+        }],
         'is_consistent_container_name_enabled' => 'boolean',
         'custom_internal_name' => ['nullable', ...ValidationPatterns::containerNameRules()],
         'custom_container_name_prefix' => 'string|nullable|max:'.ApplicationSetting::MAX_CONTAINER_NAME_PREFIX_LENGTH,
@@ -283,6 +289,10 @@ function sharedDataApplications(?Application $application = null): array
         'docker_compose_custom_build_command' => ValidationPatterns::shellSafeCommandRules(),
         'is_container_label_escape_enabled' => 'boolean',
         'is_preserve_repository_enabled' => 'boolean',
+        'http_basic_auth_hash_algorithm' => Rule::enum(HttpBasicAuthHashAlgorithm::class),
+        'http_basic_auth_bcrypt_cost' => 'integer|min:4|max:14',
+        'http_basic_auth_argon2id_memory_cost' => 'integer|min:8192|max:262144',
+        'http_basic_auth_argon2id_time_cost' => 'integer|min:1|max:12',
     ];
 }
 
@@ -474,6 +484,7 @@ function removeUnnecessaryFieldsFromRequest(Request $request)
     $request->offsetUnset('disable_build_cache');
     $request->offsetUnset('inject_build_args_to_dockerfile');
     $request->offsetUnset('is_env_sorting_enabled');
+    $request->offsetUnset('redact_all_env_values_in_logs');
     $request->offsetUnset('is_pr_deployments_public_enabled');
     $request->offsetUnset('stop_grace_period');
     $request->offsetUnset('docker_images_to_keep');
diff --git a/bootstrap/helpers/databases.php b/bootstrap/helpers/databases.php
index ea30954350..a34fdde9a8 100644
--- a/bootstrap/helpers/databases.php
+++ b/bootstrap/helpers/databases.php
@@ -1,7 +1,9 @@
 <?php
 
+use App\Models\DatabaseBackupS3Replica;
 use App\Models\EnvironmentVariable;
 use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackupExecution;
 use App\Models\Server;
 use App\Models\ServiceDatabase;
 use App\Models\StandaloneClickhouse;
@@ -314,110 +316,96 @@ function deleteEmptyBackupFolder($folderPath, Server $server): void
 
 function removeOldBackups($backup): void
 {
-    try {
-        if ($backup->executions) {
-            // Delete old local backups (only if local backup is NOT disabled)
-            // Note: When disable_local_backup is enabled, each execution already marks its own
-            // local_storage_deleted status at the time of backup, so we don't need to retroactively
-            // update old executions
-            if (! $backup->disable_local_backup) {
-                $localBackupsToDelete = deleteOldBackupsLocally($backup);
-                if ($localBackupsToDelete->isNotEmpty()) {
-                    $backup->executions()
-                        ->whereIn('id', $localBackupsToDelete->pluck('id'))
-                        ->update(['local_storage_deleted' => true]);
-                }
-            }
-        }
-
-        if ($backup->save_s3 && $backup->executions) {
-            $s3BackupsToDelete = deleteOldBackupsFromS3($backup);
-            if ($s3BackupsToDelete->isNotEmpty()) {
-                $backup->executions()
-                    ->whereIn('id', $s3BackupsToDelete->pluck('id'))
-                    ->update(['s3_storage_deleted' => true]);
-            }
-        }
-
-        // Delete execution records where all backup copies are gone
-        // Case 1: Both local and S3 backups are deleted
+    // When local backups are disabled, retain the local file until an S3 copy is available.
+    $localBackupsToDelete = deleteOldBackupsLocally($backup);
+    if ($localBackupsToDelete->isNotEmpty()) {
         $backup->executions()
-            ->where('local_storage_deleted', true)
-            ->where('s3_storage_deleted', true)
-            ->delete();
-
-        // Case 2: Local backup is deleted and S3 was never used (s3_uploaded is null)
-        $backup->executions()
-            ->where('local_storage_deleted', true)
-            ->whereNull('s3_uploaded')
-            ->delete();
-
-    } catch (Exception $e) {
-        throw $e;
+            ->whereIn('id', $localBackupsToDelete->pluck('id'))
+            ->update(['local_storage_deleted' => true]);
     }
+
+    if ($backup->save_s3) {
+        deleteOldBackupsFromS3($backup);
+    }
+
+    // Delete execution records when no local file and no S3 copy is left
+    $backup->executions()
+        ->where('local_storage_deleted', true)
+        ->withoutLiveS3Copies()
+        ->delete();
 }
 
-function deleteOldBackupsLocally($backup): Collection
+/**
+ * Successful executions that fall outside the retention settings, newest execution first.
+ *
+ * @param  Collection<int, ScheduledDatabaseBackupExecution>  $executions  Sorted newest first.
+ * @return Collection<int, ScheduledDatabaseBackupExecution>
+ */
+function backupExecutionsOutsideRetention(Collection $executions, ?int $retentionAmount, ?int $retentionDays, int|float|null $maxStorageGB): Collection
 {
-    if (! $backup || ! $backup->executions) {
-        return collect();
-    }
-
-    $successfulBackups = $backup->executions()
-        ->where('status', 'success')
-        ->where('local_storage_deleted', false)
-        ->orderBy('created_at', 'desc')
-        ->get();
-
-    if ($successfulBackups->isEmpty()) {
-        return collect();
-    }
-
-    $retentionAmount = $backup->database_backup_retention_amount_locally;
-    $retentionDays = $backup->database_backup_retention_days_locally;
-    $maxStorageGB = $backup->database_backup_retention_max_storage_locally;
-
-    if ($retentionAmount === 0 && $retentionDays === 0 && $maxStorageGB === 0) {
+    if ($executions->isEmpty()) {
         return collect();
     }
 
     $backupsToDelete = collect();
 
     if ($retentionAmount > 0) {
-        $byAmount = $successfulBackups->skip($retentionAmount);
-        $backupsToDelete = $backupsToDelete->merge($byAmount);
+        $backupsToDelete = $backupsToDelete->merge($executions->skip($retentionAmount));
     }
 
     if ($retentionDays > 0) {
-        $oldestAllowedDate = $successfulBackups->first()->created_at->clone()->utc()->subDays($retentionDays);
-        $oldBackups = $successfulBackups->filter(fn ($execution) => $execution->created_at->utc() < $oldestAllowedDate);
-        $backupsToDelete = $backupsToDelete->merge($oldBackups);
+        $oldestAllowedDate = $executions->first()->created_at->clone()->utc()->subDays($retentionDays);
+        $backupsToDelete = $backupsToDelete->merge(
+            $executions->filter(fn ($execution) => $execution->created_at->utc() < $oldestAllowedDate)
+        );
     }
 
     if ($maxStorageGB > 0) {
         $maxStorageBytes = $maxStorageGB * pow(1024, 3);
         $totalSize = 0;
-        $backupsOverLimit = collect();
 
-        $backupsToCheck = $successfulBackups->skip(1);
-
-        foreach ($backupsToCheck as $backupExecution) {
+        foreach ($executions->skip(1) as $backupExecution) {
             $totalSize += (int) $backupExecution->size;
             if ($totalSize > $maxStorageBytes) {
-                $backupsOverLimit = $successfulBackups->filter(
+                $backupsToDelete = $backupsToDelete->merge($executions->filter(
                     fn ($b) => $b->created_at->utc() <= $backupExecution->created_at->utc()
-                )->skip(1);
+                )->skip(1));
                 break;
             }
         }
-
-        $backupsToDelete = $backupsToDelete->merge($backupsOverLimit);
     }
 
-    $backupsToDelete = $backupsToDelete->unique('id');
-    $processedBackups = collect();
+    return $backupsToDelete->unique('id')->values();
+}
+
+function deleteOldBackupsLocally($backup): Collection
+{
+    if (! $backup) {
+        return collect();
+    }
+
+    $successfulBackups = $backup->executions()
+        ->where('status', 'success')
+        ->where('local_storage_deleted', false)
+        ->when($backup->disable_local_backup, fn ($query) => $query
+            ->whereHas('s3Replicas', fn ($query) => $query
+                ->where('s3_uploaded', true)
+                ->where('s3_storage_deleted', false)))
+        ->orderBy('created_at', 'desc')
+        ->orderBy('id', 'desc')
+        ->get();
+
+    $backupsToDelete = backupExecutionsOutsideRetention(
+        $successfulBackups,
+        $backup->database_backup_retention_amount_locally,
+        $backup->database_backup_retention_days_locally,
+        $backup->database_backup_retention_max_storage_locally,
+    );
+
+    if ($backupsToDelete->isEmpty()) {
+        return collect();
+    }
 
-    $server = null;
     if ($backup->database_type === ServiceDatabase::class) {
         $server = $backup->database->service->server;
     } else {
@@ -433,89 +421,81 @@ function deleteOldBackupsLocally($backup): Collection
         ->pluck('filename')
         ->all();
 
-    if (! empty($filesToDelete)) {
-        deleteBackupsLocally($filesToDelete, $server);
-        $processedBackups = $backupsToDelete;
+    if (empty($filesToDelete)) {
+        return collect();
     }
 
-    return $processedBackups;
+    deleteBackupsLocally($filesToDelete, $server);
+
+    return $backupsToDelete;
 }
 
+/**
+ * Applies the S3 retention settings to each destination separately. Copies in a storage that no longer exists are
+ * marked as deleted.
+ *
+ * @return Collection<int, ScheduledDatabaseBackupExecution> The executions that lost at least one S3 copy.
+ */
 function deleteOldBackupsFromS3($backup): Collection
 {
-    if (! $backup || ! $backup->executions || ! $backup->s3) {
+    if (! $backup) {
         return collect();
     }
 
-    $successfulBackups = $backup->executions()
-        ->where('status', 'success')
+    $liveReplicas = DatabaseBackupS3Replica::query()
+        ->with('s3')
+        ->whereHas('execution', fn ($query) => $query
+            ->where('scheduled_database_backup_id', $backup->id)
+            ->where('status', 'success'))
+        ->where('s3_uploaded', true)
         ->where('s3_storage_deleted', false)
-        ->orderBy('created_at', 'desc')
         ->get();
 
-    if ($successfulBackups->isEmpty()) {
-        return collect();
-    }
+    $deletedReplicas = $liveReplicas->filter(fn (DatabaseBackupS3Replica $replica) => ! $replica->s3);
 
-    $retentionAmount = $backup->database_backup_retention_amount_s3;
-    $retentionDays = $backup->database_backup_retention_days_s3;
-    $maxStorageGB = $backup->database_backup_retention_max_storage_s3;
+    foreach ($liveReplicas->filter(fn (DatabaseBackupS3Replica $replica) => $replica->s3)->groupBy('s3_storage_id') as $replicas) {
+        $successfulBackups = $backup->executions()
+            ->whereIn('id', $replicas->pluck('execution_id'))
+            ->orderBy('created_at', 'desc')
+            ->orderBy('id', 'desc')
+            ->get();
 
-    if ($retentionAmount === 0 && $retentionDays === 0 && $maxStorageGB === 0) {
-        return collect();
-    }
+        $backupsToDelete = backupExecutionsOutsideRetention(
+            $successfulBackups,
+            $backup->database_backup_retention_amount_s3,
+            $backup->database_backup_retention_days_s3,
+            $backup->database_backup_retention_max_storage_s3,
+        );
 
-    $backupsToDelete = collect();
+        $filesToDelete = $backupsToDelete
+            ->filter(fn ($execution) => ! empty($execution->filename))
+            ->pluck('filename')
+            ->all();
 
-    if ($retentionAmount > 0) {
-        $byAmount = $successfulBackups->skip($retentionAmount);
-        $backupsToDelete = $backupsToDelete->merge($byAmount);
-    }
-
-    if ($retentionDays > 0) {
-        $oldestAllowedDate = $successfulBackups->first()->created_at->clone()->utc()->subDays($retentionDays);
-        $oldBackups = $successfulBackups->filter(fn ($execution) => $execution->created_at->utc() < $oldestAllowedDate);
-        $backupsToDelete = $backupsToDelete->merge($oldBackups);
-    }
-
-    if ($maxStorageGB > 0) {
-        $maxStorageBytes = $maxStorageGB * pow(1024, 3);
-        $totalSize = 0;
-        $backupsOverLimit = collect();
-
-        $backupsToCheck = $successfulBackups->skip(1);
-
-        foreach ($backupsToCheck as $backupExecution) {
-            $totalSize += (int) $backupExecution->size;
-            if ($totalSize > $maxStorageBytes) {
-                $backupsOverLimit = $successfulBackups->filter(
-                    fn ($b) => $b->created_at->utc() <= $backupExecution->created_at->utc()
-                )->skip(1);
-                break;
-            }
+        if (empty($filesToDelete)) {
+            continue;
         }
 
-        $backupsToDelete = $backupsToDelete->merge($backupsOverLimit);
-    }
-
-    $backupsToDelete = $backupsToDelete->unique('id');
-    $processedBackups = collect();
-
-    $filesToDelete = $backupsToDelete
-        ->filter(fn ($execution) => ! empty($execution->filename))
-        ->pluck('filename')
-        ->all();
-
-    if (! empty($filesToDelete)) {
         try {
-            deleteBackupsS3($filesToDelete, $backup->s3);
-            $processedBackups = $backupsToDelete;
+            deleteBackupsS3($filesToDelete, $replicas->first()->s3);
+            $deletedReplicas = $deletedReplicas->merge($replicas->whereIn('execution_id', $backupsToDelete->pluck('id')));
         } catch (Throwable $e) {
             report($e);
         }
     }
 
-    return $processedBackups;
+    if ($deletedReplicas->isEmpty()) {
+        return collect();
+    }
+
+    DatabaseBackupS3Replica::query()
+        ->whereKey($deletedReplicas->pluck('id'))
+        ->update(['s3_storage_deleted' => true]);
+
+    $executions = $backup->executions()->whereIn('id', $deletedReplicas->pluck('execution_id')->unique())->get();
+    $executions->each(fn (ScheduledDatabaseBackupExecution $execution) => $execution->refreshS3Summary());
+
+    return $executions;
 }
 
 function isPublicPortAlreadyUsed(Server $server, int $port, ?string $id = null): bool
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 4517fb11f2..c27eb4270d 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -774,7 +774,20 @@ function isNoindexDomain(string $domain, ?Collection $noindex_domains): bool
         ->contains($normalize($domain));
 }
 
-function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, ?string $image = null, string $redirect_direction = 'both', ?string $predefinedPort = null, bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $is_traffic_analytics_enabled = false, array $domainPortOverrides = [], bool $supports_log_append = false, bool $supports_basic_auth_directive = false, bool $is_permanent_redirect_enabled = false)
+/**
+ * Caddy site address of a domain. Maintenance blocks in the base Caddyfile must use the same
+ * address as the labels, so caddy-docker-proxy merges them into one site block.
+ */
+function caddySiteAddress(string $scheme, string $host, bool $isForceHttpsEnabled): string
+{
+    if ($scheme === 'https' && ! $isForceHttpsEnabled) {
+        return "http://{$host}, https://{$host}";
+    }
+
+    return "{$scheme}://{$host}";
+}
+
+function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, ?string $image = null, string $redirect_direction = 'both', ?string $predefinedPort = null, bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $is_traffic_analytics_enabled = false, array $domainPortOverrides = [], bool $supports_log_append = false, bool $supports_basic_auth_directive = false, ?int $http_basic_auth_bcrypt_cost = null, array $http_basic_auth_argon2id_options = [], bool $is_permanent_redirect_enabled = false)
 {
     $labels = collect([]);
     if ($serviceLabels) {
@@ -785,7 +798,9 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
 
     $is_http_basic_auth_enabled = $is_http_basic_auth_enabled && $http_basic_auth_username !== null && $http_basic_auth_password !== null;
     if ($is_http_basic_auth_enabled) {
-        $hashedPassword = password_hash($http_basic_auth_password, PASSWORD_BCRYPT, ['cost' => 10]);
+        $hashedPassword = $http_basic_auth_argon2id_options
+            ? password_hash($http_basic_auth_password, PASSWORD_ARGON2ID, $http_basic_auth_argon2id_options)
+            : password_hash($http_basic_auth_password, PASSWORD_BCRYPT, ['cost' => $http_basic_auth_bcrypt_cost ?? 10]);
     }
 
     $trafficAppKey = caddyTrafficAppKey($uuid, $service_name);
@@ -796,10 +811,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         $path = $url->getPath();
         $host_without_www = str($host)->replace('www.', '');
         $schema = $url->getScheme();
-        $siteAddress = "{$schema}://{$host}";
-        if ($schema === 'https' && ! $is_force_https_enabled) {
-            $siteAddress = "http://{$host}, https://{$host}";
-        }
+        $siteAddress = caddySiteAddress($schema, $host, $is_force_https_enabled);
         $portlessDomain = ServiceApplication::withoutPort($domain);
         $port = $url->getPort() ?? ($domainPortOverrides[$portlessDomain] ?? null);
         $handle = 'handle_path';
@@ -843,6 +855,9 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         if ($is_http_basic_auth_enabled) {
             // Caddy 2.8 renamed basicauth to basic_auth; see Server::caddySupportsBasicAuthDirective().
             $basicAuthDirective = $supports_basic_auth_directive ? 'basic_auth' : 'basicauth';
+            if ($http_basic_auth_argon2id_options) {
+                $labels->push("caddy_{$loop}.{$basicAuthDirective}=argon2id");
+            }
             $labels->push("caddy_{$loop}.{$basicAuthDirective}.{$http_basic_auth_username}=\"{$hashedPassword}\"");
         }
         if ($is_traffic_analytics_enabled) {
@@ -929,7 +944,7 @@ function traefikHostRulesWithoutIpv6Brackets(Collection $labels): Collection
     ) : $label);
 }
 
-function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [], ?string $certificate_resolver = 'letsencrypt', bool $is_permanent_redirect_enabled = false)
+function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [], ?string $certificate_resolver = 'letsencrypt', ?int $http_basic_auth_bcrypt_cost = null, bool $is_permanent_redirect_enabled = false)
 {
     $labels = collect([]);
     $labels->push('traefik.enable=true');
@@ -951,7 +966,7 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
     $is_http_basic_auth_enabled = $is_http_basic_auth_enabled && $http_basic_auth_username !== null && $http_basic_auth_password !== null;
     $http_basic_auth_label = "http-basic-auth-{$uuid}";
     if ($is_http_basic_auth_enabled) {
-        $hashedPassword = password_hash($http_basic_auth_password, PASSWORD_BCRYPT, ['cost' => 10]);
+        $hashedPassword = password_hash($http_basic_auth_password, PASSWORD_BCRYPT, ['cost' => $http_basic_auth_bcrypt_cost ?? 10]);
     }
 
     if ($is_http_basic_auth_enabled) {
@@ -1222,6 +1237,10 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
         $appUuid = $appUuid.'-pr-'.$pull_request_id;
     }
     $labels = collect([]);
+    $httpBasicAuthArgon2idOptions = $application->usesArgon2idBasicAuth() ? [
+        'memory_cost' => $application->http_basic_auth_argon2id_memory_cost,
+        'time_cost' => $application->http_basic_auth_argon2id_time_cost,
+    ] : [];
     if ($pull_request_id === 0) {
         if ($application->fqdn) {
             $domains = str(data_get($application, 'fqdn'))->explode(',');
@@ -1242,6 +1261,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             is_http_basic_auth_enabled: $application->is_http_basic_auth_enabled,
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
+                            http_basic_auth_bcrypt_cost: $application->http_basic_auth_bcrypt_cost,
                             noindex_domains: $noindexDomains,
                             domainPortOverrides: $application->domain_port_overrides ?? [],
                             certificate_resolver: $application->destination->server->traefikCertificateResolver($application->settings?->traefik_certificate_resolver),
@@ -1261,6 +1281,8 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             is_http_basic_auth_enabled: $application->is_http_basic_auth_enabled,
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
+                            http_basic_auth_bcrypt_cost: $application->http_basic_auth_bcrypt_cost,
+                            http_basic_auth_argon2id_options: $httpBasicAuthArgon2idOptions,
                             noindex_domains: $noindexDomains,
                             is_traffic_analytics_enabled: $application->destination->server->isTrafficAnalyticsEnabled(),
                             supports_log_append: $application->destination->server->caddySupportsLogAppend(),
@@ -1282,6 +1304,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     is_http_basic_auth_enabled: $application->is_http_basic_auth_enabled,
                     http_basic_auth_username: $application->http_basic_auth_username,
                     http_basic_auth_password: $application->http_basic_auth_password,
+                    http_basic_auth_bcrypt_cost: $application->http_basic_auth_bcrypt_cost,
                     noindex_domains: $noindexDomains,
                     escape_redirect_replacement_for_compose: false,
                     domainPortOverrides: $application->domain_port_overrides ?? [],
@@ -1300,6 +1323,8 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     is_http_basic_auth_enabled: $application->is_http_basic_auth_enabled,
                     http_basic_auth_username: $application->http_basic_auth_username,
                     http_basic_auth_password: $application->http_basic_auth_password,
+                    http_basic_auth_bcrypt_cost: $application->http_basic_auth_bcrypt_cost,
+                    http_basic_auth_argon2id_options: $httpBasicAuthArgon2idOptions,
                     noindex_domains: $noindexDomains,
                     is_traffic_analytics_enabled: $application->destination->server->isTrafficAnalyticsEnabled(),
                     supports_log_append: $application->destination->server->caddySupportsLogAppend(),
@@ -1331,6 +1356,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         is_http_basic_auth_enabled: $application->is_http_basic_auth_enabled,
                         http_basic_auth_username: $application->http_basic_auth_username,
                         http_basic_auth_password: $application->http_basic_auth_password,
+                        http_basic_auth_bcrypt_cost: $application->http_basic_auth_bcrypt_cost,
                         noindex_domains: $noindexDomains,
                         escape_redirect_replacement_for_compose: false,
                         domainPortOverrides: $preview->domain_port_overrides ?? [],
@@ -1350,6 +1376,8 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         is_http_basic_auth_enabled: $application->is_http_basic_auth_enabled,
                         http_basic_auth_username: $application->http_basic_auth_username,
                         http_basic_auth_password: $application->http_basic_auth_password,
+                        http_basic_auth_bcrypt_cost: $application->http_basic_auth_bcrypt_cost,
+                        http_basic_auth_argon2id_options: $httpBasicAuthArgon2idOptions,
                         noindex_domains: $noindexDomains,
                         is_traffic_analytics_enabled: $application->destination->server->isTrafficAnalyticsEnabled(),
                         supports_log_append: $application->destination->server->caddySupportsLogAppend(),
@@ -1370,6 +1398,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 is_http_basic_auth_enabled: $application->is_http_basic_auth_enabled,
                 http_basic_auth_username: $application->http_basic_auth_username,
                 http_basic_auth_password: $application->http_basic_auth_password,
+                http_basic_auth_bcrypt_cost: $application->http_basic_auth_bcrypt_cost,
                 noindex_domains: $noindexDomains,
                 escape_redirect_replacement_for_compose: false,
                 domainPortOverrides: $preview->domain_port_overrides ?? [],
@@ -1387,6 +1416,8 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 is_http_basic_auth_enabled: $application->is_http_basic_auth_enabled,
                 http_basic_auth_username: $application->http_basic_auth_username,
                 http_basic_auth_password: $application->http_basic_auth_password,
+                http_basic_auth_bcrypt_cost: $application->http_basic_auth_bcrypt_cost,
+                http_basic_auth_argon2id_options: $httpBasicAuthArgon2idOptions,
                 noindex_domains: $noindexDomains,
                 is_traffic_analytics_enabled: $application->destination->server->isTrafficAnalyticsEnabled(),
                 supports_log_append: $application->destination->server->caddySupportsLogAppend(),
@@ -1752,6 +1783,27 @@ function convertDockerRunToCompose(?string $custom_docker_run_options = null)
         }
     }
 
+    // Short interactive/TTY flags (-i, -t, -it, -ti) and their long forms are not matched by
+    // the long-option regex above. Map them to compose so a single-image app can keep STDIN
+    // open (docker -i) and/or allocate a TTY (docker -t) — required for `docker attach` to an
+    // interactive main process, e.g. game-server consoles.
+    // Keep quoted option values together so flags inside an entrypoint are not options.
+    preg_match_all('/(?:[^\\s\'"\\\\]+|\\\\.|"(?:\\\\.|[^"\\\\])*"|\'(?:\\\\.|[^\'\\\\])*\')+/', (string) $custom_docker_run_options, $tokens);
+    foreach ($tokens[0] as $token) {
+        if ($token === '--interactive') {
+            $compose_options->put('stdin_open', true);
+        } elseif ($token === '--tty') {
+            $compose_options->put('tty', true);
+        } elseif (preg_match('/^-[dit]+$/', $token)) {
+            if (str_contains($token, 'i')) {
+                $compose_options->put('stdin_open', true);
+            }
+            if (str_contains($token, 't')) {
+                $compose_options->put('tty', true);
+            }
+        }
+    }
+
     return $compose_options->toArray();
 }
 
@@ -1769,6 +1821,10 @@ function unsupportedDockerRunOptions(?string $custom_docker_run_options): array
         if (! str_starts_with($word, '-') || preg_match('/^-\d/', $word)) {
             continue;
         }
+        // convertDockerRunToCompose() maps these outside DOCKER_RUN_OPTION_MAPPING
+        if (preg_match('/^(-[dit]+|--interactive|--tty)$/', $word)) {
+            continue;
+        }
         $option = str_starts_with($word, '--') ? '--'.ltrim(strtok($word, '='), '-') : strtok($word, '=');
         if (! array_key_exists($option, DOCKER_RUN_OPTION_MAPPING)) {
             $unsupported[] = $option;
@@ -2171,3 +2227,37 @@ function injectDockerComposeBuildArgs(string $command, string $buildArgsString):
 
     return $modifiedCommand ?? $command;
 }
+
+/**
+ * Run a command that uses the Railpack BuildKit builder, then stop the builder when no other
+ * process uses it. An idle buildkitd keeps the memory of earlier builds until it restarts.
+ *
+ * The lock file is in the buildx metadata directory, which all helper containers of a server share.
+ * The script has no `&&`, `||`, pipe, or `$(`, because the sudo parser would put sudo into it.
+ */
+function railpackBuilderLockedScript(string $command): string
+{
+    return 'exec 9>/root/.docker/buildx/coolify-railpack.lock; if flock -s 9; then :; else exit $?; fi; '
+        ."{$command}; status=\$?; "
+        .'if flock -n -x 9; then DOCKER_CONFIG=/root/.docker docker buildx stop coolify-railpack >/dev/null 2>&1; fi; '
+        .'exit $status';
+}
+
+/**
+ * The buildx metadata of a server, as the `docker run -v` source that the deployment helper uses.
+ */
+function railpackBuildxMetadataVolume(Server $server): string
+{
+    return isDev() && $server->isLocalhost() ? 'coolify-buildx' : '$HOME/.docker/buildx';
+}
+
+/**
+ * Run a command for the Railpack builder from a temporary helper container, then stop the builder
+ * when no build uses it.
+ */
+function railpackBuilderHelperCommand(string $buildxMetadataVolume, string $helperImage, string $command): string
+{
+    $script = railpackBuilderLockedScript($command);
+
+    return "docker run --rm -v {$buildxMetadataVolume}:/root/.docker/buildx -v /var/run/docker.sock:/var/run/docker.sock {$helperImage} bash -c '{$script}' 2>/dev/null || true";
+}
diff --git a/bootstrap/helpers/gitea.php b/bootstrap/helpers/gitea.php
new file mode 100644
index 0000000000..b1911c481b
--- /dev/null
+++ b/bootstrap/helpers/gitea.php
@@ -0,0 +1,163 @@
+<?php
+
+use App\Models\GiteaApp;
+use App\Models\PrivateKey;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+
+/**
+ * Gitea caps page sizes at its MAX_RESPONSE_ITEMS setting (default 50).
+ */
+const GITEA_PAGE_SIZE = 50;
+
+function refreshGiteaToken(GiteaApp $source): void
+{
+    if (! $source->refresh_token) {
+        throw new RuntimeException('Gitea source has no refresh token. Please reconnect the Gitea app.');
+    }
+
+    $safetyMargin = 60;
+    if ($source->expires_at && $source->expires_at > time() + $safetyMargin) {
+        return;
+    }
+
+    $lock = Cache::lock("gitea_token_refresh_{$source->id}", 20);
+    if (! $lock->block(20)) {
+        $source->refresh();
+        if ($source->expires_at && $source->expires_at > time() + $safetyMargin) {
+            return;
+        }
+        throw new RuntimeException('Gitea token refresh timed out. Please try again.');
+    }
+
+    try {
+        $source->refresh();
+        if ($source->expires_at && $source->expires_at > time() + $safetyMargin) {
+            return;
+        }
+
+        $baseUrl = rtrim($source->html_url, '/');
+
+        $response = Http::GitSource($baseUrl)->asForm()->post("{$baseUrl}/login/oauth/access_token", [
+            'client_id' => $source->client_id,
+            'client_secret' => $source->client_secret,
+            'refresh_token' => $source->refresh_token,
+            'grant_type' => 'refresh_token',
+        ]);
+
+        if (! $response->successful()) {
+            $error = data_get($response->json(), 'error_description', $response->body());
+            throw new RuntimeException("Failed to refresh Gitea token: {$error}");
+        }
+
+        $data = $response->json();
+        $source->update([
+            'access_token' => $data['access_token'],
+            'refresh_token' => $data['refresh_token'] ?? $source->refresh_token,
+            'expires_at' => time() + ($data['expires_in'] ?? 3600),
+        ]);
+    } finally {
+        $lock->release();
+    }
+}
+
+function giteaApi(GiteaApp $source, string $endpoint, string $method = 'get', ?array $data = null): array
+{
+    refreshGiteaToken($source);
+
+    $client = Http::Gitea($source->apiUrlBase(), $source->access_token)
+        ->timeout(20)
+        ->retry(3, 200, throw: false);
+
+    if ($data && in_array(strtolower($method), ['post', 'patch', 'put'])) {
+        $response = $client->$method($endpoint, $data);
+    } else {
+        $response = $client->$method($endpoint);
+    }
+
+    if (! $response->successful()) {
+        $errorMessage = data_get($response->json(), 'message', $response->body());
+        throw new RuntimeException("Gitea API call failed: {$errorMessage}");
+    }
+
+    return [
+        'data' => collect($response->json()),
+        'total' => (int) $response->header('x-total-count', 0),
+    ];
+}
+
+function giteaAppPrivateKey(GiteaApp $source): ?PrivateKey
+{
+    $privateKey = $source->privateKey;
+
+    return $privateKey?->team_id === $source->team_id ? $privateKey : null;
+}
+
+function generateGiteaCloneToken(GiteaApp $source): string
+{
+    refreshGiteaToken($source);
+
+    return $source->access_token;
+}
+
+function loadGiteaRepositories(GiteaApp $source, int $page = 1): array
+{
+    refreshGiteaToken($source);
+
+    $response = Http::Gitea($source->apiUrlBase(), $source->access_token)
+        ->timeout(20)
+        ->retry(3, 200, throw: false)
+        ->get('/user/repos', [
+            'limit' => GITEA_PAGE_SIZE,
+            'page' => $page,
+        ]);
+
+    if (! $response->successful()) {
+        return ['total_count' => 0, 'has_more' => false, 'repositories' => []];
+    }
+
+    $repositories = collect($response->json());
+    $hasMore = count($response->json()) === GITEA_PAGE_SIZE;
+
+    $organizations = collect(explode(',', (string) $source->organization))
+        ->map(fn ($organization) => strtolower(trim($organization)))
+        ->filter();
+    if ($organizations->isNotEmpty()) {
+        $repositories = $repositories->filter(
+            fn ($repository) => $organizations->contains(strtolower((string) data_get($repository, 'owner.login')))
+        );
+    }
+
+    return [
+        'total_count' => $repositories->count(),
+        'has_more' => $hasMore,
+        'repositories' => $repositories->map(fn ($repository) => [
+            'id' => data_get($repository, 'id'),
+            'name' => data_get($repository, 'name'),
+            'full_name' => data_get($repository, 'full_name'),
+            'default_branch' => data_get($repository, 'default_branch', 'main'),
+            'html_url' => data_get($repository, 'html_url'),
+            'owner' => data_get($repository, 'owner.login'),
+        ])->values()->all(),
+    ];
+}
+
+function loadGiteaBranches(GiteaApp $source, string $fullName, int $page = 1): array
+{
+    refreshGiteaToken($source);
+
+    $repositoryPath = collect(explode('/', $fullName, 2))->map(fn ($part) => rawurlencode($part))->implode('/');
+    $response = Http::Gitea($source->apiUrlBase(), $source->access_token)
+        ->timeout(20)
+        ->retry(3, 200, throw: false)
+        ->get("/repos/{$repositoryPath}/branches", [
+            'limit' => GITEA_PAGE_SIZE,
+            'page' => $page,
+        ]);
+
+    if (! $response->successful()) {
+        return [];
+    }
+
+    return $response->json();
+}
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 8f94775fc3..09c2b69422 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1462,7 +1462,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
 
         if ($server->isLogDrainEnabled()) {
             if ($resource->isLogDrainEnabled()) {
-                $logging = generate_fluentd_configuration();
+                $logging = generate_log_drain_configuration($server);
             }
         }
         $volumes = collect(data_get($service, 'volumes', []));
@@ -2848,7 +2848,7 @@ function serviceParser(Service $resource): Collection
 
         if ($server->isLogDrainEnabled()) {
             if ($serviceAppsLogDrainEnabledMap->get($serviceName)) {
-                $logging = generate_fluentd_configuration();
+                $logging = generate_log_drain_configuration($server);
             }
         }
         $volumes = collect(data_get($service, 'volumes', []));
diff --git a/bootstrap/helpers/proxy.php b/bootstrap/helpers/proxy.php
index a4b98ca5fc..613f925102 100644
--- a/bootstrap/helpers/proxy.php
+++ b/bootstrap/helpers/proxy.php
@@ -950,3 +950,16 @@ function getTraefikVersionFromDockerCompose(Server $server): ?string
         return null;
     }
 }
+
+/**
+ * Validation rule for an HTML page that Coolify sends to the proxy in one shell command
+ * (see Server::PROXY_ERROR_PAGE_MAX_BYTES).
+ */
+function proxyPageSizeRule(string $name): Closure
+{
+    return function (string $attribute, mixed $value, Closure $fail) use ($name): void {
+        if (strlen((string) $value) > Server::PROXY_ERROR_PAGE_MAX_BYTES) {
+            $fail("The {$name} must not be larger than ".(Server::PROXY_ERROR_PAGE_MAX_BYTES / 1024).' KB.');
+        }
+    };
+}
diff --git a/bootstrap/helpers/remoteProcess.php b/bootstrap/helpers/remoteProcess.php
index f1f4638907..877d790266 100644
--- a/bootstrap/helpers/remoteProcess.php
+++ b/bootstrap/helpers/remoteProcess.php
@@ -9,6 +9,7 @@ use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Services\Security\SensitiveDataRedactor;
 use App\Support\RemoteProcessCommand;
 use Carbon\Carbon;
 use Illuminate\Contracts\Process\ProcessResult;
@@ -370,46 +371,7 @@ function decode_remote_command_output(?ApplicationDeploymentQueue $application_d
 
 function remove_iip($text)
 {
-    // Ensure the input is valid UTF-8 before processing
-    $text = sanitize_utf8_text($text);
-
-    // Git access tokens
-    $text = preg_replace('/x-access-token:.*?(?=@)/', 'x-access-token:'.REDACTED, $text);
-    $text = preg_replace('/oauth2:.*?(?=@)/', 'oauth2:'.REDACTED, $text);
-
-    // ANSI color codes
-    $text = preg_replace('/\x1b\[[0-9;]*m/', '', $text);
-
-    // Generic URLs with passwords (covers database URLs, ftp, amqp, ssh, git basic auth, etc.)
-    // (protocol://user:password@host → protocol://user:<REDACTED>@host)
-    // User and password cannot contain whitespace, so a match never spans log lines.
-    $text = preg_replace('/((?:https?|postgres|mysql|mongodb|rediss?|mariadb|ftp|sftp|ssh|amqp|amqps|ldap|ldaps|s3):\/\/[^:\s@\/]+:)[^@\s]+(@)/i', '$1'.REDACTED.'$2', $text);
-
-    // Email addresses
-    $text = preg_replace('/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/', REDACTED, $text);
-
-    // Bearer/JWT tokens
-    $text = preg_replace('/Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/i', 'Bearer '.REDACTED, $text);
-
-    // GitHub tokens (ghp_ = personal, gho_ = OAuth, ghu_ = user-to-server, ghs_ = server-to-server, ghr_ = refresh)
-    $text = preg_replace('/\bgh[pousr]_[A-Za-z0-9.\-_]{36,}(?![A-Za-z0-9.\-_])/', REDACTED, $text);
-
-    // GitLab tokens (glpat- = personal access token, glcbt- = CI build token, glrt- = runner token)
-    $text = preg_replace('/\b(gl(?:pat|cbt|rt)-[A-Za-z0-9\-_]{20,})\b/', REDACTED, $text);
-
-    // AWS credentials (Access Key ID starts with AKIA, ABIA, ACCA, ASIA)
-    $text = preg_replace('/\b(A(?:KIA|BIA|CCA|SIA)[A-Z0-9]{16})\b/', REDACTED, $text);
-
-    // AWS Secret Access Key (40 character base64-ish string, typically follows access key)
-    $text = preg_replace('/(aws_secret_access_key|AWS_SECRET_ACCESS_KEY)[=:]\s*[\'"]?([A-Za-z0-9\/+=]{40})[\'"]?/i', '$1='.REDACTED, $text);
-
-    // API keys (common patterns)
-    $text = preg_replace('/(api[_-]?key|apikey|api[_-]?secret|secret[_-]?key)[=:]\s*[\'"]?[A-Za-z0-9\-_]{16,}[\'"]?/i', '$1='.REDACTED, $text);
-
-    // Private key blocks
-    $text = preg_replace('/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/', REDACTED, $text);
-
-    return $text;
+    return app(SensitiveDataRedactor::class)->redactText((string) $text);
 }
 
 /**
diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index 442debc04b..8aff368171 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -26,15 +26,111 @@ function service_logo_urls(mixed $logo): array
 }
 
 use App\Models\Application;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
 use App\Models\LocalFileVolume;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Stringable;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
 
+/**
+ * The URL of a logo in public/svgs/resources. The file's modification time is the version, so
+ * browsers load a changed logo instead of their cached copy.
+ */
+function resource_logo_url(string $name): string
+{
+    $path = "svgs/resources/{$name}.svg";
+    $modifiedAt = is_file(public_path($path)) ? filemtime(public_path($path)) : false;
+
+    return asset($path).($modifiedAt ? "?v={$modifiedAt}" : '');
+}
+
+/**
+ * The logo of a resource, the same one shown on the "New resource" page: the database engine,
+ * the service template, or how the application is built. Null when there is no specific logo.
+ *
+ * Applications with a domain also get the favicon URL of their first domain. The browser loads it
+ * and shows it in place of the logo when it loads. Coolify itself never requests it.
+ *
+ * @return array{src: string, dark: ?string, fallback: ?string, padded: bool, favicon: ?string}|null
+ */
+function resource_logo(Model $resource): ?array
+{
+    $resourceLogo = function (string $name, bool $hasDarkVariant = false): array {
+        return [
+            'src' => resource_logo_url($name),
+            'dark' => $hasDarkVariant ? resource_logo_url("{$name}-dark") : null,
+            'fallback' => null,
+            'padded' => false,
+            'favicon' => null,
+        ];
+    };
+
+    if ($resource instanceof Service) {
+        $templates = once(fn () => get_service_templates());
+        $type = filled($resource->service_type) ? $resource->service_type : str($resource->name)->beforeLast('-')->value();
+        $logo = data_get($templates->get(resolve_service_template_key($type, $templates)), 'logo');
+        if (! is_string($logo) || $logo === '' || basename($logo) === 'default.webp') {
+            return null;
+        }
+        $urls = service_logo_urls($logo);
+
+        return ['src' => $urls['logo'], 'dark' => null, 'fallback' => $urls['logo_cdn_url'], 'padded' => true, 'favicon' => null];
+    }
+
+    if ($resource instanceof Application) {
+        $logo = match (true) {
+            $resource->build_pack === 'dockerimage' => $resourceLogo('docker-image'),
+            $resource->build_pack === 'dockerfile' => $resourceLogo('dockerfile'),
+            $resource->build_pack === 'dockercompose' => $resourceLogo('docker-compose'),
+            $resource->source_type === GithubApp::class => $resourceLogo('github-app', true),
+            $resource->source_type === GitlabApp::class => $resourceLogo('gitlab-app'),
+            default => $resourceLogo('public-repo'),
+        };
+
+        return [...$logo, 'favicon' => resource_favicon_url($resource->fqdn)];
+    }
+
+    if (! method_exists($resource, 'type')) {
+        return null;
+    }
+
+    return match (str($resource->type())->after('standalone-')->value()) {
+        'postgresql' => $resourceLogo('postgres'),
+        'mysql' => $resourceLogo('mysql'),
+        'mariadb' => $resourceLogo('mariadb'),
+        'mongodb' => $resourceLogo('mongodb'),
+        'redis' => $resourceLogo('redis'),
+        'keydb' => $resourceLogo('keydb', true),
+        'dragonfly' => $resourceLogo('dragonfly', true),
+        'clickhouse' => $resourceLogo('clickhouse'),
+        'sqlite' => $resourceLogo('sqlite'),
+        default => null,
+    };
+}
+
+/**
+ * The favicon URL of the first domain in a comma-separated domain list, or null when there is no usable domain.
+ */
+function resource_favicon_url(?string $fqdn): ?string
+{
+    $domain = str((string) $fqdn)->explode(',')->map(fn (string $url) => trim($url))->first(fn (string $url) => $url !== '');
+    $parts = parse_url((string) $domain);
+    $scheme = strtolower((string) ($parts['scheme'] ?? ''));
+    $host = (string) ($parts['host'] ?? '');
+    if (! in_array($scheme, ['http', 'https'], true) || $host === '' || str_contains($host, '*')) {
+        return null;
+    }
+    $port = isset($parts['port']) ? ':'.$parts['port'] : '';
+
+    return "{$scheme}://{$host}{$port}/favicon.ico";
+}
+
 function replaceRegex(?string $name = null)
 {
     return "/\\\${?{$name}[^}]*}?|\\\${$name}\w+/";
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index b4b92e5a9e..48aa00a907 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -9,6 +9,7 @@ use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\ApplicationPreview;
 use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\InstanceSettings;
@@ -38,6 +39,7 @@ use App\Models\StandaloneSqlite;
 use App\Models\SwarmDocker;
 use App\Models\Team;
 use App\Models\User;
+use App\Services\Security\SensitiveDataRedactor;
 use App\Support\DnsRecordHints;
 use Carbon\CarbonImmutable;
 use DanHarrin\LivewireRateLimiting\Exceptions\TooManyRequestsException;
@@ -701,14 +703,8 @@ function get_route_parameters(): array
 
 function get_latest_sentinel_version(): string
 {
-    try {
-        $response = Http::get(config('constants.coolify.versions_url'));
-        $versions = $response->json();
-
-        return data_get($versions, 'coolify.sentinel.version');
-    } catch (Throwable) {
-        return '0.0.0';
-    }
+    // Read the local versions.json, which CheckForUpdatesJob refreshes every hour. Do not ask the CDN for each server.
+    return data_get(get_versions_data(), 'coolify.sentinel.version') ?? '0.0.0';
 }
 function get_latest_version_of_coolify(): string
 {
@@ -891,6 +887,10 @@ function profile_avatar_url(User $user): string
         }
     }
 
+    if (auth()->check() && $user->id !== auth()->id()) {
+        return route('team.member.avatar', ['user_id' => $user->id, 'v' => $user->updated_at->timestamp]);
+    }
+
     return route('profile.avatar', ['v' => $user->updated_at->timestamp]);
 }
 
@@ -909,6 +909,21 @@ function project_icon_url(Project $project): string
     ]);
 }
 
+function team_avatar_url(Team $team): string
+{
+    if ($team->avatar_storage_type === 's3') {
+        $url = s3_image_url($team->avatar_s3_storage_id, $team->avatar_path, $team->updated_at->timestamp);
+        if ($url) {
+            return $url;
+        }
+    }
+
+    return route('team.avatar', [
+        'team_id' => $team->id,
+        'v' => $team->updated_at->timestamp,
+    ]);
+}
+
 function s3_image_url(?int $storageId, ?string $path, int $version): ?string
 {
     if (! $storageId || blank($path)) {
@@ -1741,10 +1756,14 @@ function removeAnsiColors($text)
     return preg_replace('/\e[[][A-Za-z0-9];?[0-9]*m?/', '', $text);
 }
 
-function sanitizeLogsForExport(string $text): string
+/**
+ * Redact log text before it leaves Coolify (copy, download, API, MCP).
+ *
+ * @param  array{known?: array<int, string>, locked?: array<int, string>}  $secrets  Resource values to hide, usually from EnvironmentVariable::logRedactionSecretsFor().
+ */
+function sanitizeLogsForExport(string $text, array $secrets = []): string
 {
-    // All sanitization is now handled by remove_iip()
-    return remove_iip($text);
+    return app(SensitiveDataRedactor::class)->redactText($text, $secrets['known'] ?? [], $secrets['locked'] ?? []);
 }
 
 function getTopLevelNetworks(Service|Application $resource): Collection
@@ -3588,7 +3607,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                     }
                 }
                 if ($resource->server->isLogDrainEnabled() && $savedService->isLogDrainEnabled()) {
-                    data_set($service, 'logging', generate_fluentd_configuration());
+                    data_set($service, 'logging', generate_log_drain_configuration($resource->server));
                 }
                 if ($serviceLabels->count() > 0) {
                     if ($resource->is_container_label_escape_enabled) {
@@ -4413,7 +4432,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
 
             if ($server->isLogDrainEnabled()) {
                 if ($resource instanceof Application && $resource->isLogDrainEnabled()) {
-                    data_set($service, 'logging', generate_fluentd_configuration());
+                    data_set($service, 'logging', generate_log_drain_configuration($server));
                 }
             }
             if ($serviceLabels->count() > 0) {
@@ -4473,6 +4492,31 @@ function generate_fluentd_configuration(): array
     ];
 }
 
+function generate_log_drain_configuration(Server $server): array
+{
+    if ($server->isFluentBitLogDrainEnabled()) {
+        return generate_fluentd_configuration();
+    }
+
+    $settings = $server->settings;
+    $options = [
+        'awslogs-region' => $settings->logdrain_cloudwatch_region,
+        'awslogs-group' => $settings->logdrain_cloudwatch_group,
+        'awslogs-create-group' => 'true',
+        // Like fluentd-async: a CloudWatch outage or missing credentials must not block or fail the container.
+        'mode' => 'non-blocking',
+        // The stream is named after the container; awslogs-stream is never set because it would override this tag.
+        'tag' => ($settings->logdrain_cloudwatch_stream_prefix ?? '').'{{.Name}}',
+    ];
+
+    return [
+        'driver' => 'awslogs',
+        'options' => collect($options)
+            ->reject(fn ($value) => blank($value))
+            ->all(),
+    ];
+}
+
 function isAssociativeArray($array)
 {
     if ($array instanceof Collection) {
@@ -4578,6 +4622,20 @@ function wireNavigate(): string
     }
 }
 
+/**
+ * Registers a resource menu that the main sidebar shows in place of its main menu on wide screens
+ * (see components/navbar.blade.php). The menu teleports itself into #main-nav-context-{depth}.
+ * Back on a menu shows the menu one depth lower, and Back at depth 0 shows the main menu.
+ */
+function registerMainNavContext(int $depth, string $label, string $backTitle): void
+{
+    $levels = request()->attributes->get('mainNavContext', []);
+    $levels[$depth] = ['label' => $label, 'backTitle' => $backTitle];
+    ksort($levels);
+
+    request()->attributes->set('mainNavContext', $levels);
+}
+
 /**
  * Flattens a grouped settings sidebar into the items that the command palette
  * shows for the current page: every page, its child pages, and its in-page sections.
@@ -4603,6 +4661,10 @@ function settingsSearchItems(iterable $groupedItems, array $routeParameters, arr
 
     foreach ($groupedItems as $groupLabel => $groupItems) {
         foreach ($groupItems as $item) {
+            if ($item['disabled'] ?? false) {
+                continue;
+            }
+
             $href = route($item['route'], $routeParameters);
             $add($item['label'], $groupLabel, $href, $item['navigate'] ?? true);
 
@@ -4856,7 +4918,7 @@ function gitRepositorySlug(?string $gitRepository): string
     return str($gitRepository)->trim('/')->replaceEnd('.git', '')->toString();
 }
 
-function convertGitUrl(string $gitRepository, string $deploymentType, GithubApp|GitlabApp|null $source = null): array
+function convertGitUrl(string $gitRepository, string $deploymentType, GithubApp|GitlabApp|GiteaApp|null $source = null): array
 {
     $repository = $gitRepository;
     $providerInfo = [
@@ -4876,6 +4938,7 @@ function convertGitUrl(string $gitRepository, string $deploymentType, GithubApp|
         switch ($source->getMorphClass()) {
             case GithubApp::class:
             case GitlabApp::class:
+            case GiteaApp::class:
                 $providerInfo['host'] = Url::fromString($source->html_url)->getHost();
                 $providerInfo['port'] = $source->custom_port;
                 $providerInfo['user'] = $source->custom_user;
@@ -5714,6 +5777,115 @@ function deviceLabel(?string $device): string
     };
 }
 
+/**
+ * Prepare aggregated `city` breakdown rows (`CC|subdivision|City`, from
+ * TrafficAnalyticsAggregator::breakdowns(), not raw Sentinel rows) for display,
+ * largest first. `name` and `detail` are the two parts of `label` ("Berlin" and
+ * "BE, Germany"). `CC||` (sent by older Sentinel builds) is an unknown city of
+ * that country. `__other__` and malformed values are merged into one "Other"
+ * row, which stays last. Returns [] when no row has a real city.
+ *
+ * @param  iterable<int, array{value?: string, requests?: int, bytesOut?: int, lat?: float, lon?: float}>  $rows
+ * @return array<int, array{key: string, country: string, label: string, name: string, detail: string, requests: int, bytesOut: int, lat: ?float, lon: ?float}>
+ */
+function trafficCityRows(iterable $rows): array
+{
+    $out = [];
+    $hasCity = false;
+
+    foreach ($rows as $row) {
+        $requests = (int) data_get($row, 'requests', 0);
+        if ($requests <= 0) {
+            continue;
+        }
+
+        $value = (string) data_get($row, 'value', '');
+        $parts = explode('|', $value, 3);
+        $parts[0] = strtoupper($parts[0]);
+        $isCityKey = count($parts) === 3 && preg_match('/^[A-Z]{2}$/', $parts[0]) === 1;
+
+        $key = '__other__';
+        $country = '';
+        $label = 'Other';
+        $name = 'Other';
+        $detail = '';
+        $lat = null;
+        $lon = null;
+
+        if ($isCityKey) {
+            [$country, $subdivision, $city] = array_map('trim', $parts);
+            $key = $value;
+
+            if ($city === '') {
+                $label = 'Unknown, '.$country;
+                $name = 'Unknown';
+                $detail = countryName($country);
+            } else {
+                $hasCity = true;
+                $region = preg_match('/^[A-Z]{2,3}$/', $subdivision) === 1 ? $subdivision.', ' : '';
+                $label = $city.', '.$region.$country;
+                $name = $city;
+                $detail = $region.countryName($country);
+
+                $rawLat = data_get($row, 'lat');
+                $rawLon = data_get($row, 'lon');
+                if (is_numeric($rawLat) && is_numeric($rawLon)) {
+                    $lat = (float) $rawLat;
+                    $lon = (float) $rawLon;
+                }
+            }
+        }
+
+        $out[$key] ??= ['key' => $key, 'country' => $country, 'label' => $label, 'name' => $name, 'detail' => $detail, 'requests' => 0, 'bytesOut' => 0, 'lat' => $lat, 'lon' => $lon];
+        $out[$key]['requests'] += $requests;
+        $out[$key]['bytesOut'] += (int) data_get($row, 'bytesOut', 0);
+    }
+
+    if (! $hasCity) {
+        return [];
+    }
+
+    $other = $out['__other__'] ?? null;
+    unset($out['__other__']);
+    $out = array_values($out);
+    usort($out, fn (array $a, array $b): int => $b['requests'] <=> $a['requests']);
+
+    return $other === null ? $out : [...$out, $other];
+}
+
+/**
+ * Marker data for the analytics globe, one set for each view of the Locations
+ * card: a marker per country with a valid ISO-A2 code, and a marker per city
+ * that has coordinates.
+ *
+ * @param  iterable<int, mixed>  $countryRows
+ * @param  iterable<int, mixed>  $cityRows
+ * @return array{countries: array<int, array{code: string, requests: int}>, cities: array<int, array{lat: float, lon: float, requests: int}>}
+ */
+function trafficGeoMarkers(iterable $countryRows, iterable $cityRows): array
+{
+    $countries = [];
+    foreach ($countryRows as $row) {
+        $code = strtoupper((string) data_get($row, 'value', ''));
+        $requests = (int) data_get($row, 'requests', 0);
+        if ($requests > 0 && preg_match('/^[A-Z]{2}$/', $code) === 1) {
+            $countries[] = ['code' => $code, 'requests' => $requests];
+        }
+    }
+
+    $cities = [];
+    foreach ($cityRows as $row) {
+        $requests = (int) data_get($row, 'requests', 0);
+        $lat = data_get($row, 'lat');
+        $lon = data_get($row, 'lon');
+        if ($requests > 0 && is_numeric($lat) && is_numeric($lon)) {
+            $cities[] = ['lat' => (float) $lat, 'lon' => (float) $lon, 'requests' => $requests];
+        }
+    }
+
+    return ['countries' => $countries, 'cities' => $cities];
+}
+
 /**
  * Resolve an ISO 3166-1 alpha-2 country code to its English country name.
  *
diff --git a/bootstrap/helpers/subscriptions.php b/bootstrap/helpers/subscriptions.php
index 971afdfb79..95442ca359 100644
--- a/bootstrap/helpers/subscriptions.php
+++ b/bootstrap/helpers/subscriptions.php
@@ -85,6 +85,12 @@ function allowedPathsForUnsubscribedAccounts()
         // Account basics stay available without a paid plan.
         'profile',
         'profile/appearance',
+        'profile/passkeys/confirm',
+        'user/confirm-password',
+        'user/passkeys',
+        'user/passkeys/options',
+        'passkeys/confirm',
+        'passkeys/confirm/options',
     ];
 }
 function allowedPathsForBoardingAccounts()
diff --git a/bootstrap/helpers/versions.php b/bootstrap/helpers/versions.php
index bb4694de58..ef6e34f295 100644
--- a/bootstrap/helpers/versions.php
+++ b/bootstrap/helpers/versions.php
@@ -1,7 +1,12 @@
 <?php
 
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Http\Client\RequestException;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
 
 /**
  * Get cached versions data from versions.json.
@@ -51,3 +56,103 @@ function invalidate_versions_cache(): void
 {
     Cache::forget('coolify:versions:all');
 }
+
+/**
+ * HTTP client for the Coolify CDN. It retries only transient failures (connection errors, 429, 5xx)
+ * and does not throw for a failed response.
+ */
+function cdn_http(int $tries = 3): PendingRequest
+{
+    return Http::timeout(10)
+        ->connectTimeout(10)
+        ->retry(
+            $tries,
+            fn (int $attempt, Throwable $exception) => cdn_retry_delay_ms($attempt, $exception),
+            fn (Throwable $exception) => $exception instanceof ConnectionException
+                || ($exception instanceof RequestException
+                    && ($exception->response->status() === 429 || $exception->response->serverError())),
+            throw: false,
+        );
+}
+
+/**
+ * Wait as long as the Retry-After header says (Cloudflare sends 60 seconds with error 1200),
+ * or 2^attempt seconds without it. A random part of up to the same length is added, so instances
+ * that failed in the same burst do not retry in the same second.
+ */
+function cdn_retry_delay_ms(int $attempt, Throwable $exception): int
+{
+    $retryAfter = $exception instanceof RequestException ? (int) $exception->response->header('Retry-After') : 0;
+    $seconds = $retryAfter > 0 ? min($retryAfter, 60) : 2 ** $attempt;
+
+    return ($seconds + random_int(0, $seconds)) * 1000;
+}
+
+/**
+ * Fetch versions.json from the CDN and write it to the local file of this node.
+ * The Coolify version never goes below the cached or the running version.
+ * When the CDN fails, the local file stays as it is.
+ *
+ * @return array|null The written versions data, or null if the CDN fetch failed
+ */
+function refresh_versions_file(int $tries = 3): ?array
+{
+    $response = cdn_http($tries)->get(config('constants.coolify.versions_url'));
+    $versions = $response->json();
+    if ($response->failed() || ! is_array($versions)) {
+        Log::warning('Could not fetch versions.json from the CDN, using the local file', ['status' => $response->status()]);
+
+        return null;
+    }
+
+    $latestVersion = data_get($versions, 'coolify.v4.version');
+    $currentVersion = config('constants.coolify.version');
+
+    $existingCoolifyVersion = null;
+    if (File::exists(base_path('versions.json'))) {
+        $existingVersions = json_decode(File::get(base_path('versions.json')), true);
+        $existingCoolifyVersion = data_get($existingVersions, 'coolify.v4.version');
+    }
+
+    $bestVersion = $latestVersion;
+
+    if ($existingCoolifyVersion && version_compare($existingCoolifyVersion, $bestVersion, '>')) {
+        Log::warning('CDN served older Coolify version than cache', [
+            'cdn_version' => $latestVersion,
+            'cached_version' => $existingCoolifyVersion,
+            'current_version' => $currentVersion,
+        ]);
+        $bestVersion = $existingCoolifyVersion;
+    }
+
+    if (version_compare($bestVersion, $currentVersion, '<')) {
+        Log::warning('Version downgrade prevented in CheckForUpdatesJob', [
+            'cdn_version' => $latestVersion,
+            'cached_version' => $existingCoolifyVersion,
+            'current_version' => $currentVersion,
+            'attempted_best' => $bestVersion,
+            'using' => $currentVersion,
+        ]);
+        $bestVersion = $currentVersion;
+    }
+
+    data_set($versions, 'coolify.v4.version', $bestVersion);
+
+    File::put(base_path('versions.json'), json_encode($versions, JSON_PRETTY_PRINT));
+    invalidate_versions_cache();
+    update_helper_version($versions);
+
+    return $versions;
+}
+
+/**
+ * Store the helper image version of the versions data when it is newer than the stored one.
+ */
+function update_helper_version(?array $versions): void
+{
+    $latestVersion = data_get($versions, 'coolify.helper.version');
+    $settings = instanceSettings();
+    if ($latestVersion && version_compare($latestVersion, (string) $settings->helper_version, '>')) {
+        $settings->update(['helper_version' => $latestVersion]);
+    }
+}
diff --git a/composer.json b/composer.json
index a30c8a9708..29d24ed495 100644
--- a/composer.json
+++ b/composer.json
@@ -12,66 +12,67 @@
     ],
     "require": {
         "php": "^8.4",
-        "danharrin/livewire-rate-limiting": "2.2.1",
-        "doctrine/dbal": "4.4.4",
-        "firebase/php-jwt": "7.1.0",
-        "guzzlehttp/guzzle": "7.15.3",
-        "laravel/fortify": "1.37.3",
-        "laravel/framework": "12.69.3",
-        "laravel/horizon": "5.48.2",
-        "laravel/mcp": "1.0.1",
-        "laravel/pail": "1.2.7",
-        "laravel/prompts": "0.3.22",
-        "laravel/reverb": "1.11.1",
-        "laravel/sanctum": "4.3.3",
-        "laravel/socialite": "5.29.0",
-        "laravel/tinker": "2.11.1",
-        "laravel/ui": "4.6.3",
-        "lcobucci/jwt": "5.6.0",
-        "league/flysystem-aws-s3-v3": "3.35.2",
-        "league/flysystem-sftp-v3": "3.33.0",
-        "livewire/livewire": "3.8.7",
-        "log1x/laravel-webfonts": "2.0.1",
-        "lorisleiva/laravel-actions": "2.10.2",
-        "nubs/random-name-generator": "2.2.0",
-        "phpseclib/phpseclib": "3.0.57",
-        "pion/laravel-chunk-upload": "1.6.3",
-        "poliander/cron": "3.3.1",
-        "purplepixie/phpdns": "2.3.6",
-        "pusher/pusher-php-server": "7.3.0",
-        "resend/resend-laravel": "1.5.0",
-        "socialiteproviders/authentik": "5.3.0",
-        "socialiteproviders/clerk": "5.1.0",
-        "socialiteproviders/discord": "4.2.0",
-        "socialiteproviders/google": "4.1.0",
-        "socialiteproviders/infomaniak": "4.0.0",
-        "socialiteproviders/microsoft-azure": "5.2.0",
-        "socialiteproviders/zitadel": "4.2.0",
-        "spatie/laravel-activitylog": "4.12.3",
-        "spatie/laravel-data": "4.23.0",
-        "spatie/laravel-markdown": "2.8.0",
-        "spatie/laravel-schemaless-attributes": "2.6.0",
-        "spatie/url": "2.4.0",
-        "stevebauman/purify": "6.3.2",
-        "stripe/stripe-php": "16.6.0",
-        "symfony/yaml": "7.4.15",
-        "visus/cuid2": "6.0.0",
-        "yosymfony/toml": "1.0.4",
-        "zircote/swagger-php": "5.8.3"
+        "danharrin/livewire-rate-limiting": "^2.3.0",
+        "doctrine/dbal": "^4.5.0",
+        "firebase/php-jwt": "^7.2.1",
+        "guzzlehttp/guzzle": "^7.15.5",
+        "laravel/fortify": "^1.40.0",
+        "laravel/framework": "^12.69.3",
+        "laravel/horizon": "^5.50.0",
+        "laravel/mcp": "^1.0.1",
+        "laravel/pail": "^1.2.7",
+        "laravel/prompts": "^0.3.24",
+        "laravel/reverb": "^1.12.0",
+        "laravel/sanctum": "^4.3.3",
+        "laravel/socialite": "^5.30.0",
+        "laravel/tinker": "^3.0.2",
+        "laravel/ui": "^4.6.3",
+        "lcobucci/jwt": "^5.6.0",
+        "league/flysystem-aws-s3-v3": "^3.35.3",
+        "league/flysystem-sftp-v3": "^3.36.0",
+        "livewire/livewire": "^3.8.10",
+        "log1x/laravel-webfonts": "^2.0.1",
+        "lorisleiva/laravel-actions": "^2.12.0",
+        "nubs/random-name-generator": "^2.2.0",
+        "phpseclib/phpseclib": "^3.0.57",
+        "pion/laravel-chunk-upload": "^1.6.3",
+        "poliander/cron": "^3.3.1",
+        "purplepixie/phpdns": "^2.4.0",
+        "pusher/pusher-php-server": "^7.3.0",
+        "resend/resend-laravel": "^1.6.0",
+        "socialiteproviders/authentik": "^5.3.0",
+        "socialiteproviders/clerk": "^5.1.0",
+        "socialiteproviders/discord": "^4.2.0",
+        "socialiteproviders/google": "^4.1.0",
+        "socialiteproviders/infomaniak": "^4.0.0",
+        "socialiteproviders/microsoft-azure": "^5.2.1",
+        "socialiteproviders/zitadel": "^4.2.0",
+        "spatie/laravel-activitylog": "^4.12.3",
+        "spatie/laravel-data": "^4.23.0",
+        "spatie/laravel-markdown": "^2.8.0",
+        "spatie/laravel-schemaless-attributes": "^2.6.0",
+        "spatie/url": "^2.4.0",
+        "stevebauman/purify": "^6.3.2",
+        "stripe/stripe-php": "^16.6.0",
+        "symfony/yaml": "^8.1.8",
+        "visus/cuid2": "^7.0.0",
+        "yosymfony/toml": "^1.0.4",
+        "zircote/swagger-php": "^6.11.0"
     },
     "require-dev": {
-        "driftingly/rector-laravel": "2.5.0",
-        "fakerphp/faker": "1.24.1",
-        "laravel/boost": "2.10.0",
-        "laravel/pint": "1.30.4",
-        "mockery/mockery": "1.6.12",
-        "nunomaduro/collision": "8.9.5",
-        "pestphp/pest": "4.7.8",
-        "pestphp/pest-plugin-browser": "4.3.1",
-        "phpstan/phpstan": "2.2.8",
-        "rector/rector": "2.6.1",
-        "serversideup/spin": "3.3.0",
-        "symfony/http-client": "7.4.16"
+        "driftingly/rector-laravel": "^2.6.2",
+        "fakerphp/faker": "^1.24.1",
+        "laravel/boost": "^2.10.0",
+        "laravel/pint": "^1.32.1",
+        "laravel/vet": "^0.2.1",
+        "mockery/mockery": "^1.6.15",
+        "nunomaduro/collision": "^8.9.5",
+        "pestphp/pest": "^4.7.8",
+        "pestphp/pest-plugin-browser": "^4.3.1",
+        "phpstan/phpstan": "^2.2.16",
+        "rector/rector": "^2.6.7",
+        "serversideup/spin": "^3.5.2",
+        "symfony/http-client": "^8.1.8"
     },
     "minimum-stability": "stable",
     "prefer-stable": true,
@@ -93,7 +94,8 @@
     "config": {
         "allow-plugins": {
             "pestphp/pest-plugin": true,
-            "php-http/discovery": true
+            "php-http/discovery": true,
+            "laravel/vet": true
         },
         "optimize-autoloader": true,
         "preferred-install": "dist",
diff --git a/composer.lock b/composer.lock
index f45ff18dde..02f3e6112f 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "2f4e1a1b6f34572a9673d85ac8c29017",
+    "content-hash": "f97af22f1628cec49170f1d40c582a9d",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -62,16 +62,16 @@
         },
         {
             "name": "aws/aws-sdk-php",
-            "version": "3.391.1",
+            "version": "3.398.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/aws/aws-sdk-php.git",
-                "reference": "90920ce5518aa864e04da0224bb0ba0ee9e31d7f"
+                "reference": "1dc5a7813aa23b65de0bfb6239b93387971f7143"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/aws/aws-sdk-php/zipball/90920ce5518aa864e04da0224bb0ba0ee9e31d7f",
-                "reference": "90920ce5518aa864e04da0224bb0ba0ee9e31d7f",
+                "url": "https://api.github.com/repos/aws/aws-sdk-php/zipball/1dc5a7813aa23b65de0bfb6239b93387971f7143",
+                "reference": "1dc5a7813aa23b65de0bfb6239b93387971f7143",
                 "shasum": ""
             },
             "require": {
@@ -153,9 +153,9 @@
             "support": {
                 "forum": "https://github.com/aws/aws-sdk-php/discussions",
                 "issues": "https://github.com/aws/aws-sdk-php/issues",
-                "source": "https://github.com/aws/aws-sdk-php/tree/3.391.1"
+                "source": "https://github.com/aws/aws-sdk-php/tree/3.398.4"
             },
-            "time": "2026-08-07T20:18:18+00:00"
+            "time": "2026-09-30T18:20:49+00:00"
         },
         {
             "name": "bacon/bacon-qr-code",
@@ -274,16 +274,16 @@
         },
         {
             "name": "carbonphp/carbon-doctrine-types",
-            "version": "3.2.0",
+            "version": "3.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/CarbonPHP/carbon-doctrine-types.git",
-                "reference": "18ba5ddfec8976260ead6e866180bd5d2f71aa1d"
+                "reference": "5fa5eacafd9ef47c8c6ab9143fc901ba0194d3dc"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/CarbonPHP/carbon-doctrine-types/zipball/18ba5ddfec8976260ead6e866180bd5d2f71aa1d",
-                "reference": "18ba5ddfec8976260ead6e866180bd5d2f71aa1d",
+                "url": "https://api.github.com/repos/CarbonPHP/carbon-doctrine-types/zipball/5fa5eacafd9ef47c8c6ab9143fc901ba0194d3dc",
+                "reference": "5fa5eacafd9ef47c8c6ab9143fc901ba0194d3dc",
                 "shasum": ""
             },
             "require": {
@@ -298,6 +298,11 @@
                 "phpunit/phpunit": "^10.3"
             },
             "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "3.x-dev"
+                }
+            },
             "autoload": {
                 "psr-4": {
                     "Carbon\\Doctrine\\": "src/Carbon/Doctrine/"
@@ -323,7 +328,7 @@
             ],
             "support": {
                 "issues": "https://github.com/CarbonPHP/carbon-doctrine-types/issues",
-                "source": "https://github.com/CarbonPHP/carbon-doctrine-types/tree/3.2.0"
+                "source": "https://github.com/CarbonPHP/carbon-doctrine-types/tree/3.2.1"
             },
             "funding": [
                 {
@@ -339,7 +344,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-02-09T16:56:22+00:00"
+            "time": "2026-09-06T14:11:38+00:00"
         },
         {
             "name": "clue/redis-protocol",
@@ -473,16 +478,16 @@
         },
         {
             "name": "danharrin/livewire-rate-limiting",
-            "version": "v2.2.1",
+            "version": "v2.3.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/danharrin/livewire-rate-limiting.git",
-                "reference": "69436717dc70e30f80d7f8fd02504c22992a9ad5"
+                "reference": "46c4ceaf7997c713c79afe7c507a39649f6c9d6f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/danharrin/livewire-rate-limiting/zipball/69436717dc70e30f80d7f8fd02504c22992a9ad5",
-                "reference": "69436717dc70e30f80d7f8fd02504c22992a9ad5",
+                "url": "https://api.github.com/repos/danharrin/livewire-rate-limiting/zipball/46c4ceaf7997c713c79afe7c507a39649f6c9d6f",
+                "reference": "46c4ceaf7997c713c79afe7c507a39649f6c9d6f",
                 "shasum": ""
             },
             "require": {
@@ -523,7 +528,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-06T08:41:51+00:00"
+            "time": "2026-09-18T07:38:01+00:00"
         },
         {
             "name": "dasprid/enum",
@@ -652,16 +657,16 @@
         },
         {
             "name": "doctrine/dbal",
-            "version": "4.4.4",
+            "version": "4.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/doctrine/dbal.git",
-                "reference": "fb9e0ffe15e1590e24dc61c0c0a23f9a33ee42ce"
+                "reference": "c435cd7ea33e17d2a89288caf994cf3d4549b879"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/doctrine/dbal/zipball/fb9e0ffe15e1590e24dc61c0c0a23f9a33ee42ce",
-                "reference": "fb9e0ffe15e1590e24dc61c0c0a23f9a33ee42ce",
+                "url": "https://api.github.com/repos/doctrine/dbal/zipball/c435cd7ea33e17d2a89288caf994cf3d4549b879",
+                "reference": "c435cd7ea33e17d2a89288caf994cf3d4549b879",
                 "shasum": ""
             },
             "require": {
@@ -677,9 +682,9 @@
                 "phpstan/phpstan": "2.1.30",
                 "phpstan/phpstan-phpunit": "2.0.7",
                 "phpstan/phpstan-strict-rules": "^2",
-                "phpunit/phpunit": "11.5.50",
-                "slevomat/coding-standard": "8.27.1",
-                "squizlabs/php_codesniffer": "4.0.1",
+                "phpunit/phpunit": "11.5.56",
+                "slevomat/coding-standard": "8.31.1",
+                "squizlabs/php_codesniffer": "4.0.4",
                 "symfony/cache": "^6.3.8|^7.0|^8.0",
                 "symfony/console": "^5.4|^6.3|^7.0|^8.0"
             },
@@ -738,7 +743,7 @@
             ],
             "support": {
                 "issues": "https://github.com/doctrine/dbal/issues",
-                "source": "https://github.com/doctrine/dbal/tree/4.4.4"
+                "source": "https://github.com/doctrine/dbal/tree/4.5.0"
             },
             "funding": [
                 {
@@ -754,7 +759,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-21T14:34:40+00:00"
+            "time": "2026-09-24T16:11:26+00:00"
         },
         {
             "name": "doctrine/deprecations",
@@ -1149,16 +1154,16 @@
         },
         {
             "name": "ezyang/htmlpurifier",
-            "version": "v4.19.0",
+            "version": "v4.19.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/ezyang/htmlpurifier.git",
-                "reference": "b287d2a16aceffbf6e0295559b39662612b77fcf"
+                "reference": "5e0539132d934f936fbae2c88b55d58f9438623f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/b287d2a16aceffbf6e0295559b39662612b77fcf",
-                "reference": "b287d2a16aceffbf6e0295559b39662612b77fcf",
+                "url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/5e0539132d934f936fbae2c88b55d58f9438623f",
+                "reference": "5e0539132d934f936fbae2c88b55d58f9438623f",
                 "shasum": ""
             },
             "require": {
@@ -1204,32 +1209,32 @@
             ],
             "support": {
                 "issues": "https://github.com/ezyang/htmlpurifier/issues",
-                "source": "https://github.com/ezyang/htmlpurifier/tree/v4.19.0"
+                "source": "https://github.com/ezyang/htmlpurifier/tree/v4.19.1"
             },
-            "time": "2025-10-17T16:34:55+00:00"
+            "time": "2026-09-15T15:42:51+00:00"
         },
         {
             "name": "firebase/php-jwt",
-            "version": "v7.1.0",
+            "version": "v7.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/googleapis/php-jwt.git",
-                "reference": "b374a5d1a4f1f67fadc2165cdb284645945e2fc0"
+                "reference": "0501f5729b9e2448516674aff07c7d1727869b8e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/googleapis/php-jwt/zipball/b374a5d1a4f1f67fadc2165cdb284645945e2fc0",
-                "reference": "b374a5d1a4f1f67fadc2165cdb284645945e2fc0",
+                "url": "https://api.github.com/repos/googleapis/php-jwt/zipball/0501f5729b9e2448516674aff07c7d1727869b8e",
+                "reference": "0501f5729b9e2448516674aff07c7d1727869b8e",
                 "shasum": ""
             },
             "require": {
                 "php": "^8.0"
             },
             "require-dev": {
-                "guzzlehttp/guzzle": "^7.4",
+                "guzzlehttp/guzzle": "^7.4||^8.0",
                 "phpfastcache/phpfastcache": "^9.2",
                 "phpseclib/phpseclib": "~3.0",
-                "phpspec/prophecy-phpunit": "^2.0",
+                "phpspec/prophecy-phpunit": "^2.2",
                 "phpunit/phpunit": "^9.5",
                 "psr/cache": "^2.0||^3.0",
                 "psr/http-client": "^1.0",
@@ -1241,6 +1246,14 @@
                 "phpseclib/phpseclib": "Support PS256 (RSASSA-PSS) signatures"
             },
             "type": "library",
+            "extra": {
+                "component": {
+                    "id": "jwt",
+                    "path": "Jwt",
+                    "entry": "README.md",
+                    "target": "googleapis/php-jwt.git"
+                }
+            },
             "autoload": {
                 "psr-4": {
                     "Firebase\\JWT\\": "src"
@@ -1270,9 +1283,9 @@
             ],
             "support": {
                 "issues": "https://github.com/googleapis/php-jwt/issues",
-                "source": "https://github.com/googleapis/php-jwt/tree/v7.1.0"
+                "source": "https://github.com/googleapis/php-jwt/tree/v7.2.1"
             },
-            "time": "2026-06-11T17:54:14+00:00"
+            "time": "2026-09-28T17:51:46+00:00"
         },
         {
             "name": "fruitcake/php-cors",
@@ -1347,24 +1360,24 @@
         },
         {
             "name": "graham-campbell/result-type",
-            "version": "v1.1.4",
+            "version": "v1.2.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/GrahamCampbell/Result-Type.git",
-                "reference": "e01f4a821471308ba86aa202fed6698b6b695e3b"
+                "reference": "adccca3324eece92ca35463648c12b9e6293c05b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/GrahamCampbell/Result-Type/zipball/e01f4a821471308ba86aa202fed6698b6b695e3b",
-                "reference": "e01f4a821471308ba86aa202fed6698b6b695e3b",
+                "url": "https://api.github.com/repos/GrahamCampbell/Result-Type/zipball/adccca3324eece92ca35463648c12b9e6293c05b",
+                "reference": "adccca3324eece92ca35463648c12b9e6293c05b",
                 "shasum": ""
             },
             "require": {
                 "php": "^7.2.5 || ^8.0",
-                "phpoption/phpoption": "^1.9.5"
+                "phpoption/phpoption": "^1.10"
             },
             "require-dev": {
-                "phpunit/phpunit": "^8.5.41 || ^9.6.22 || ^10.5.45 || ^11.5.7"
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34 || ^10.5.63 || ^11.5.55 || ^12.5.14"
             },
             "type": "library",
             "autoload": {
@@ -1393,7 +1406,7 @@
             ],
             "support": {
                 "issues": "https://github.com/GrahamCampbell/Result-Type/issues",
-                "source": "https://github.com/GrahamCampbell/Result-Type/tree/v1.1.4"
+                "source": "https://github.com/GrahamCampbell/Result-Type/tree/v1.2.0"
             },
             "funding": [
                 {
@@ -1405,26 +1418,26 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-12-27T19:43:20+00:00"
+            "time": "2026-08-24T09:06:52+00:00"
         },
         {
             "name": "guzzlehttp/guzzle",
-            "version": "7.15.3",
+            "version": "7.15.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/guzzle.git",
-                "reference": "ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc"
+                "reference": "ee80339fd9177ba44c49cdb653ff02a4d1106b9a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc",
-                "reference": "ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc",
+                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/ee80339fd9177ba44c49cdb653ff02a4d1106b9a",
+                "reference": "ee80339fd9177ba44c49cdb653ff02a4d1106b9a",
                 "shasum": ""
             },
             "require": {
                 "ext-json": "*",
-                "guzzlehttp/promises": "^2.5.2",
-                "guzzlehttp/psr7": "^2.13",
+                "guzzlehttp/promises": "^2.5.3",
+                "guzzlehttp/psr7": "^2.13.1",
                 "php": "^7.2.5 || ^8.0",
                 "psr/http-client": "^1.0",
                 "symfony/deprecation-contracts": "^2.5 || ^3.0",
@@ -1517,7 +1530,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/guzzle/issues",
-                "source": "https://github.com/guzzle/guzzle/tree/7.15.3"
+                "source": "https://github.com/guzzle/guzzle/tree/7.15.5"
             },
             "funding": [
                 {
@@ -1533,20 +1546,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-05T19:48:21+00:00"
+            "time": "2026-08-24T09:21:06+00:00"
         },
         {
             "name": "guzzlehttp/promises",
-            "version": "2.5.2",
+            "version": "2.5.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/promises.git",
-                "reference": "2823687acff28b2dbe67b2508a6b300e2c3fa4ce"
+                "reference": "cde49999552d185d64715fe9c1f77a2aadd2f9f1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/promises/zipball/2823687acff28b2dbe67b2508a6b300e2c3fa4ce",
-                "reference": "2823687acff28b2dbe67b2508a6b300e2c3fa4ce",
+                "url": "https://api.github.com/repos/guzzle/promises/zipball/cde49999552d185d64715fe9c1f77a2aadd2f9f1",
+                "reference": "cde49999552d185d64715fe9c1f77a2aadd2f9f1",
                 "shasum": ""
             },
             "require": {
@@ -1601,7 +1614,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/promises/issues",
-                "source": "https://github.com/guzzle/promises/tree/2.5.2"
+                "source": "https://github.com/guzzle/promises/tree/2.5.3"
             },
             "funding": [
                 {
@@ -1617,7 +1630,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-05T19:30:54+00:00"
+            "time": "2026-08-24T09:11:28+00:00"
         },
         {
             "name": "guzzlehttp/psr7",
@@ -1740,16 +1753,16 @@
         },
         {
             "name": "guzzlehttp/uri-template",
-            "version": "v1.0.10",
+            "version": "v1.0.11",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/uri-template.git",
-                "reference": "f6c24c21f42b990e9a58912b332d0874df6ba839"
+                "reference": "d0058dccf4299d70c3d9da3378b8908b32780368"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/uri-template/zipball/f6c24c21f42b990e9a58912b332d0874df6ba839",
-                "reference": "f6c24c21f42b990e9a58912b332d0874df6ba839",
+                "url": "https://api.github.com/repos/guzzle/uri-template/zipball/d0058dccf4299d70c3d9da3378b8908b32780368",
+                "reference": "d0058dccf4299d70c3d9da3378b8908b32780368",
                 "shasum": ""
             },
             "require": {
@@ -1806,7 +1819,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/uri-template/issues",
-                "source": "https://github.com/guzzle/uri-template/tree/v1.0.10"
+                "source": "https://github.com/guzzle/uri-template/tree/v1.0.11"
             },
             "funding": [
                 {
@@ -1822,20 +1835,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-17T13:53:03+00:00"
+            "time": "2026-08-24T09:15:32+00:00"
         },
         {
             "name": "laravel/fortify",
-            "version": "v1.37.3",
+            "version": "v1.40.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/fortify.git",
-                "reference": "66b9503330e7c18b3edebb9c3b4087037826573b"
+                "reference": "fe0fce8814660317df0684f2c7be3b573def67d3"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/fortify/zipball/66b9503330e7c18b3edebb9c3b4087037826573b",
-                "reference": "66b9503330e7c18b3edebb9c3b4087037826573b",
+                "url": "https://api.github.com/repos/laravel/fortify/zipball/fe0fce8814660317df0684f2c7be3b573def67d3",
+                "reference": "fe0fce8814660317df0684f2c7be3b573def67d3",
                 "shasum": ""
             },
             "require": {
@@ -1849,7 +1862,7 @@
             },
             "require-dev": {
                 "orchestra/testbench": "^9.15|^10.8|^11.0",
-                "phpstan/phpstan": "^1.10"
+                "phpstan/phpstan": "^2.2.6"
             },
             "type": "library",
             "extra": {
@@ -1886,7 +1899,7 @@
                 "issues": "https://github.com/laravel/fortify/issues",
                 "source": "https://github.com/laravel/fortify"
             },
-            "time": "2026-06-29T16:22:02+00:00"
+            "time": "2026-09-10T11:52:08+00:00"
         },
         {
             "name": "laravel/framework",
@@ -2112,16 +2125,16 @@
         },
         {
             "name": "laravel/horizon",
-            "version": "v5.48.2",
+            "version": "v5.50.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/horizon.git",
-                "reference": "2ebe3cb25ab6461b53a4e3ef42e167edeafe7932"
+                "reference": "009177cc3d0829c839c8ab573dd17d158fc0b71e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/horizon/zipball/2ebe3cb25ab6461b53a4e3ef42e167edeafe7932",
-                "reference": "2ebe3cb25ab6461b53a4e3ef42e167edeafe7932",
+                "url": "https://api.github.com/repos/laravel/horizon/zipball/009177cc3d0829c839c8ab573dd17d158fc0b71e",
+                "reference": "009177cc3d0829c839c8ab573dd17d158fc0b71e",
                 "shasum": ""
             },
             "require": {
@@ -2186,9 +2199,9 @@
             ],
             "support": {
                 "issues": "https://github.com/laravel/horizon/issues",
-                "source": "https://github.com/laravel/horizon/tree/v5.48.2"
+                "source": "https://github.com/laravel/horizon/tree/v5.50.0"
             },
-            "time": "2026-07-27T13:13:49+00:00"
+            "time": "2026-09-15T13:59:54+00:00"
         },
         {
             "name": "laravel/mcp",
@@ -2414,16 +2427,16 @@
         },
         {
             "name": "laravel/prompts",
-            "version": "v0.3.22",
+            "version": "v0.3.24",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/prompts.git",
-                "reference": "02b89b39e8972a998db4d5d4ad4719239dd4aee4"
+                "reference": "5d3cdef29e93ca3b62b1871359db3078cd99908b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/prompts/zipball/02b89b39e8972a998db4d5d4ad4719239dd4aee4",
-                "reference": "02b89b39e8972a998db4d5d4ad4719239dd4aee4",
+                "url": "https://api.github.com/repos/laravel/prompts/zipball/5d3cdef29e93ca3b62b1871359db3078cd99908b",
+                "reference": "5d3cdef29e93ca3b62b1871359db3078cd99908b",
                 "shasum": ""
             },
             "require": {
@@ -2467,22 +2480,22 @@
             "description": "Add beautiful and user-friendly forms to your command-line applications.",
             "support": {
                 "issues": "https://github.com/laravel/prompts/issues",
-                "source": "https://github.com/laravel/prompts/tree/v0.3.22"
+                "source": "https://github.com/laravel/prompts/tree/v0.3.24"
             },
-            "time": "2026-08-04T14:50:50+00:00"
+            "time": "2026-08-20T12:55:36+00:00"
         },
         {
             "name": "laravel/reverb",
-            "version": "v1.11.1",
+            "version": "v1.12.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/reverb.git",
-                "reference": "52ce5fd88cd1d7eacfdcf6b91cea4704cc546f27"
+                "reference": "e233471f53641a447d3b7a2150446d47a0e8c043"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/reverb/zipball/52ce5fd88cd1d7eacfdcf6b91cea4704cc546f27",
-                "reference": "52ce5fd88cd1d7eacfdcf6b91cea4704cc546f27",
+                "url": "https://api.github.com/repos/laravel/reverb/zipball/e233471f53641a447d3b7a2150446d47a0e8c043",
+                "reference": "e233471f53641a447d3b7a2150446d47a0e8c043",
                 "shasum": ""
             },
             "require": {
@@ -2502,6 +2515,7 @@
                 "symfony/http-foundation": "^6.3|^7.0|^8.0"
             },
             "require-dev": {
+                "jasonmccreary/double": "~0.10",
                 "orchestra/testbench": "^8.36|^9.15|^10.8|^11.0",
                 "pestphp/pest": "^2.0|^3.0|^4.0",
                 "phpstan/phpstan": "^1.10",
@@ -2545,10 +2559,9 @@
                 "websocket"
             ],
             "support": {
-                "issues": "https://github.com/laravel/reverb/issues",
-                "source": "https://github.com/laravel/reverb/tree/v1.11.1"
+                "source": "https://github.com/laravel/reverb/tree/v1.12.0"
             },
-            "time": "2026-08-06T14:48:58+00:00"
+            "time": "2026-09-22T14:25:47+00:00"
         },
         {
             "name": "laravel/sanctum",
@@ -2671,16 +2684,16 @@
         },
         {
             "name": "laravel/serializable-closure",
-            "version": "v2.0.15",
+            "version": "v2.1.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/serializable-closure.git",
-                "reference": "dccd8bcb851bb03fcc005df650b708b57cc52661"
+                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/dccd8bcb851bb03fcc005df650b708b57cc52661",
-                "reference": "dccd8bcb851bb03fcc005df650b708b57cc52661",
+                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/2d5869a838bbcf37e0d8b0568fc41914e81374b5",
+                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5",
                 "shasum": ""
             },
             "require": {
@@ -2728,20 +2741,20 @@
                 "issues": "https://github.com/laravel/serializable-closure/issues",
                 "source": "https://github.com/laravel/serializable-closure"
             },
-            "time": "2026-07-21T16:49:22+00:00"
+            "time": "2026-09-22T14:32:34+00:00"
         },
         {
             "name": "laravel/socialite",
-            "version": "v5.29.0",
+            "version": "v5.30.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/socialite.git",
-                "reference": "cd343a5841f02292af119ee607edc71300c9ae4f"
+                "reference": "caf714f55d51ab0d914b40033d8b0f489d6219cc"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/socialite/zipball/cd343a5841f02292af119ee607edc71300c9ae4f",
-                "reference": "cd343a5841f02292af119ee607edc71300c9ae4f",
+                "url": "https://api.github.com/repos/laravel/socialite/zipball/caf714f55d51ab0d914b40033d8b0f489d6219cc",
+                "reference": "caf714f55d51ab0d914b40033d8b0f489d6219cc",
                 "shasum": ""
             },
             "require": {
@@ -2800,37 +2813,37 @@
                 "issues": "https://github.com/laravel/socialite/issues",
                 "source": "https://github.com/laravel/socialite"
             },
-            "time": "2026-07-01T13:50:23+00:00"
+            "time": "2026-08-13T23:01:33+00:00"
         },
         {
             "name": "laravel/tinker",
-            "version": "v2.11.1",
+            "version": "v3.0.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/tinker.git",
-                "reference": "c9f80cc835649b5c1842898fb043f8cc098dd741"
+                "reference": "4faba77764bd33411735936acdf30446d058c78b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/tinker/zipball/c9f80cc835649b5c1842898fb043f8cc098dd741",
-                "reference": "c9f80cc835649b5c1842898fb043f8cc098dd741",
+                "url": "https://api.github.com/repos/laravel/tinker/zipball/4faba77764bd33411735936acdf30446d058c78b",
+                "reference": "4faba77764bd33411735936acdf30446d058c78b",
                 "shasum": ""
             },
             "require": {
-                "illuminate/console": "^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0",
-                "illuminate/contracts": "^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0",
-                "illuminate/support": "^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0",
-                "php": "^7.2.5|^8.0",
-                "psy/psysh": "^0.11.1|^0.12.0",
-                "symfony/var-dumper": "^4.3.4|^5.0|^6.0|^7.0|^8.0"
+                "illuminate/console": "^8.0|^9.0|^10.0|^11.0|^12.0|^13.0",
+                "illuminate/contracts": "^8.0|^9.0|^10.0|^11.0|^12.0|^13.0",
+                "illuminate/support": "^8.0|^9.0|^10.0|^11.0|^12.0|^13.0",
+                "php": "^8.1",
+                "psy/psysh": "^0.12.0",
+                "symfony/var-dumper": "^5.4|^6.0|^7.0|^8.0"
             },
             "require-dev": {
                 "mockery/mockery": "~1.3.3|^1.4.2",
                 "phpstan/phpstan": "^1.10",
-                "phpunit/phpunit": "^8.5.8|^9.3.3|^10.0"
+                "phpunit/phpunit": "^10.5|^11.5"
             },
             "suggest": {
-                "illuminate/database": "The Illuminate Database package (^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0)."
+                "illuminate/database": "The Illuminate Database package (^8.0|^9.0|^10.0|^11.0|^12.0|^13.0)."
             },
             "type": "library",
             "extra": {
@@ -2838,6 +2851,9 @@
                     "providers": [
                         "Laravel\\Tinker\\TinkerServiceProvider"
                     ]
+                },
+                "branch-alias": {
+                    "dev-master": "3.x-dev"
                 }
             },
             "autoload": {
@@ -2864,9 +2880,9 @@
             ],
             "support": {
                 "issues": "https://github.com/laravel/tinker/issues",
-                "source": "https://github.com/laravel/tinker/tree/v2.11.1"
+                "source": "https://github.com/laravel/tinker/tree/v3.0.2"
             },
-            "time": "2026-02-06T14:12:35+00:00"
+            "time": "2026-03-17T14:54:13+00:00"
         },
         {
             "name": "laravel/ui",
@@ -3278,16 +3294,16 @@
         },
         {
             "name": "league/flysystem-aws-s3-v3",
-            "version": "3.35.2",
+            "version": "3.35.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/flysystem-aws-s3-v3.git",
-                "reference": "8475ef9adfc6498b85469e2abec6fe3118cd08c4"
+                "reference": "b03780cb97585ee7e48977f40ed599b33b751634"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/flysystem-aws-s3-v3/zipball/8475ef9adfc6498b85469e2abec6fe3118cd08c4",
-                "reference": "8475ef9adfc6498b85469e2abec6fe3118cd08c4",
+                "url": "https://api.github.com/repos/thephpleague/flysystem-aws-s3-v3/zipball/b03780cb97585ee7e48977f40ed599b33b751634",
+                "reference": "b03780cb97585ee7e48977f40ed599b33b751634",
                 "shasum": ""
             },
             "require": {
@@ -3327,9 +3343,9 @@
                 "storage"
             ],
             "support": {
-                "source": "https://github.com/thephpleague/flysystem-aws-s3-v3/tree/3.35.2"
+                "source": "https://github.com/thephpleague/flysystem-aws-s3-v3/tree/3.35.3"
             },
-            "time": "2026-07-01T23:25:49+00:00"
+            "time": "2026-08-08T16:19:23+00:00"
         },
         {
             "name": "league/flysystem-local",
@@ -3382,16 +3398,16 @@
         },
         {
             "name": "league/flysystem-sftp-v3",
-            "version": "3.33.0",
+            "version": "3.36.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/flysystem-sftp-v3.git",
-                "reference": "34ff5ef0f841add92e2b902c1005f72135b03646"
+                "reference": "5004b451cedd3bc4fdf84fcd427b858ec1b66a02"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/flysystem-sftp-v3/zipball/34ff5ef0f841add92e2b902c1005f72135b03646",
-                "reference": "34ff5ef0f841add92e2b902c1005f72135b03646",
+                "url": "https://api.github.com/repos/thephpleague/flysystem-sftp-v3/zipball/5004b451cedd3bc4fdf84fcd427b858ec1b66a02",
+                "reference": "5004b451cedd3bc4fdf84fcd427b858ec1b66a02",
                 "shasum": ""
             },
             "require": {
@@ -3425,9 +3441,9 @@
                 "sftp"
             ],
             "support": {
-                "source": "https://github.com/thephpleague/flysystem-sftp-v3/tree/3.33.0"
+                "source": "https://github.com/thephpleague/flysystem-sftp-v3/tree/3.36.0"
             },
-            "time": "2026-03-20T13:22:31+00:00"
+            "time": "2026-09-02T07:49:56+00:00"
         },
         {
             "name": "league/mime-type-detection",
@@ -3487,23 +3503,23 @@
         },
         {
             "name": "league/oauth1-client",
-            "version": "v1.11.0",
+            "version": "v1.12.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/oauth1-client.git",
-                "reference": "f9c94b088837eb1aae1ad7c4f23eb65cc6993055"
+                "reference": "aa8fe766f772f9233d6c06f9ef003fd8129e408d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/oauth1-client/zipball/f9c94b088837eb1aae1ad7c4f23eb65cc6993055",
-                "reference": "f9c94b088837eb1aae1ad7c4f23eb65cc6993055",
+                "url": "https://api.github.com/repos/thephpleague/oauth1-client/zipball/aa8fe766f772f9233d6c06f9ef003fd8129e408d",
+                "reference": "aa8fe766f772f9233d6c06f9ef003fd8129e408d",
                 "shasum": ""
             },
             "require": {
                 "ext-json": "*",
                 "ext-openssl": "*",
-                "guzzlehttp/guzzle": "^6.0|^7.0",
-                "guzzlehttp/psr7": "^1.7|^2.0",
+                "guzzlehttp/guzzle": "^6.5.8||^7.8.2||^8.0",
+                "guzzlehttp/psr7": "^1.9.1||^2.6.3||^3.0",
                 "php": ">=7.1||>=8.0"
             },
             "require-dev": {
@@ -3557,9 +3573,9 @@
             ],
             "support": {
                 "issues": "https://github.com/thephpleague/oauth1-client/issues",
-                "source": "https://github.com/thephpleague/oauth1-client/tree/v1.11.0"
+                "source": "https://github.com/thephpleague/oauth1-client/tree/v1.12.0"
             },
-            "time": "2024-12-10T19:59:05+00:00"
+            "time": "2026-09-19T05:12:51+00:00"
         },
         {
             "name": "league/uri",
@@ -3745,16 +3761,16 @@
         },
         {
             "name": "livewire/livewire",
-            "version": "v3.8.7",
+            "version": "v3.8.10",
             "source": {
                 "type": "git",
                 "url": "https://github.com/livewire/livewire.git",
-                "reference": "ff019f8f6f48b7a2315922e45a70ad8fd75d1934"
+                "reference": "3adc7ff5d0898876f9848ab155310a296c717c1b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/livewire/livewire/zipball/ff019f8f6f48b7a2315922e45a70ad8fd75d1934",
-                "reference": "ff019f8f6f48b7a2315922e45a70ad8fd75d1934",
+                "url": "https://api.github.com/repos/livewire/livewire/zipball/3adc7ff5d0898876f9848ab155310a296c717c1b",
+                "reference": "3adc7ff5d0898876f9848ab155310a296c717c1b",
                 "shasum": ""
             },
             "require": {
@@ -3809,7 +3825,7 @@
             "description": "A front-end framework for Laravel.",
             "support": {
                 "issues": "https://github.com/livewire/livewire/issues",
-                "source": "https://github.com/livewire/livewire/tree/v3.8.7"
+                "source": "https://github.com/livewire/livewire/tree/v3.8.10"
             },
             "funding": [
                 {
@@ -3817,7 +3833,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-31T15:40:46+00:00"
+            "time": "2026-09-28T18:12:47+00:00"
         },
         {
             "name": "log1x/laravel-webfonts",
@@ -3883,16 +3899,16 @@
         },
         {
             "name": "lorisleiva/laravel-actions",
-            "version": "v2.10.2",
+            "version": "v2.12.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/lorisleiva/laravel-actions.git",
-                "reference": "40da1bbd3cf115f4e885c197b91777d596c9317a"
+                "reference": "8d58b11d4fbca08fbcdb87243a4607bb3ae1db8d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/lorisleiva/laravel-actions/zipball/40da1bbd3cf115f4e885c197b91777d596c9317a",
-                "reference": "40da1bbd3cf115f4e885c197b91777d596c9317a",
+                "url": "https://api.github.com/repos/lorisleiva/laravel-actions/zipball/8d58b11d4fbca08fbcdb87243a4607bb3ae1db8d",
+                "reference": "8d58b11d4fbca08fbcdb87243a4607bb3ae1db8d",
                 "shasum": ""
             },
             "require": {
@@ -3901,8 +3917,13 @@
                 "php": "^8.2"
             },
             "require-dev": {
+                "friendsofphp/php-cs-fixer": "^3.0",
+                "larastan/larastan": "^3.0",
                 "orchestra/testbench": "^9.0|^10.0|^11.0",
                 "pestphp/pest": "^3.0|^4.0",
+                "phpstan/extension-installer": "^1.4",
+                "phpstan/phpstan": "^2.1",
+                "phpstan/phpstan-phpunit": "^2.0",
                 "phpunit/phpunit": "^11.5|^12.0"
             },
             "type": "library",
@@ -3914,6 +3935,11 @@
                     "providers": [
                         "Lorisleiva\\Actions\\ActionServiceProvider"
                     ]
+                },
+                "phpstan": {
+                    "includes": [
+                        "extension.neon"
+                    ]
                 }
             },
             "autoload": {
@@ -3947,7 +3973,7 @@
             ],
             "support": {
                 "issues": "https://github.com/lorisleiva/laravel-actions/issues",
-                "source": "https://github.com/lorisleiva/laravel-actions/tree/v2.10.2"
+                "source": "https://github.com/lorisleiva/laravel-actions/tree/v2.12.0"
             },
             "funding": [
                 {
@@ -3955,20 +3981,20 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-07-26T11:03:26+00:00"
+            "time": "2026-08-25T14:17:11+00:00"
         },
         {
             "name": "lorisleiva/lody",
-            "version": "v0.7.0",
+            "version": "v0.7.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/lorisleiva/lody.git",
-                "reference": "82ecb6faa55fb20109e6959f42f0f652cd77674b"
+                "reference": "018d3d384872d4b28f5194dae5fd05894db7fabe"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/lorisleiva/lody/zipball/82ecb6faa55fb20109e6959f42f0f652cd77674b",
-                "reference": "82ecb6faa55fb20109e6959f42f0f652cd77674b",
+                "url": "https://api.github.com/repos/lorisleiva/lody/zipball/018d3d384872d4b28f5194dae5fd05894db7fabe",
+                "reference": "018d3d384872d4b28f5194dae5fd05894db7fabe",
                 "shasum": ""
             },
             "require": {
@@ -4019,7 +4045,7 @@
             ],
             "support": {
                 "issues": "https://github.com/lorisleiva/lody/issues",
-                "source": "https://github.com/lorisleiva/lody/tree/v0.7.0"
+                "source": "https://github.com/lorisleiva/lody/tree/v0.7.1"
             },
             "funding": [
                 {
@@ -4027,20 +4053,20 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-03-18T12:49:31+00:00"
+            "time": "2026-09-01T11:53:49+00:00"
         },
         {
             "name": "monolog/monolog",
-            "version": "3.10.0",
+            "version": "3.12.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Seldaek/monolog.git",
-                "reference": "b321dd6749f0bf7189444158a3ce785cc16d69b0"
+                "reference": "d7059e4c691d05ea1222b5124bed0f961be46e15"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/b321dd6749f0bf7189444158a3ce785cc16d69b0",
-                "reference": "b321dd6749f0bf7189444158a3ce785cc16d69b0",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/d7059e4c691d05ea1222b5124bed0f961be46e15",
+                "reference": "d7059e4c691d05ea1222b5124bed0f961be46e15",
                 "shasum": ""
             },
             "require": {
@@ -4066,6 +4092,7 @@
                 "phpstan/phpstan-strict-rules": "^2",
                 "phpunit/phpunit": "^10.5.17 || ^11.0.7",
                 "predis/predis": "^1.1 || ^2",
+                "psr/clock": "^1.0",
                 "rollbar/rollbar": "^4.0",
                 "ruflin/elastica": "^7 || ^8",
                 "symfony/mailer": "^5.4 || ^6",
@@ -4084,6 +4111,7 @@
                 "graylog2/gelf-php": "Allow sending log messages to a GrayLog2 server",
                 "mongodb/mongodb": "Allow sending log messages to a MongoDB server (via library)",
                 "php-amqplib/php-amqplib": "Allow sending log messages to an AMQP server using php-amqplib",
+                "psr/clock": "Required to pass a clock to the Logger and control the timestamp of log records",
                 "rollbar/rollbar": "Allow sending log messages to Rollbar",
                 "ruflin/elastica": "Allow sending log messages to an Elastic Search server"
             },
@@ -4118,7 +4146,7 @@
             ],
             "support": {
                 "issues": "https://github.com/Seldaek/monolog/issues",
-                "source": "https://github.com/Seldaek/monolog/tree/3.10.0"
+                "source": "https://github.com/Seldaek/monolog/tree/3.12.1"
             },
             "funding": [
                 {
@@ -4130,7 +4158,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-01-02T08:56:05+00:00"
+            "time": "2026-09-29T19:21:12+00:00"
         },
         {
             "name": "mtdowling/jmespath.php",
@@ -4200,16 +4228,16 @@
         },
         {
             "name": "nesbot/carbon",
-            "version": "3.13.2",
+            "version": "3.14.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/CarbonPHP/carbon.git",
-                "reference": "a1c54919f5fff9800cd03c32bd01defd5a4061cb"
+                "reference": "34e9109535165bf1d7ff17a610492372ae73a896"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/CarbonPHP/carbon/zipball/a1c54919f5fff9800cd03c32bd01defd5a4061cb",
-                "reference": "a1c54919f5fff9800cd03c32bd01defd5a4061cb",
+                "url": "https://api.github.com/repos/CarbonPHP/carbon/zipball/34e9109535165bf1d7ff17a610492372ae73a896",
+                "reference": "34e9109535165bf1d7ff17a610492372ae73a896",
                 "shasum": ""
             },
             "require": {
@@ -4301,7 +4329,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-08T11:40:35+00:00"
+            "time": "2026-09-27T12:07:26+00:00"
         },
         {
             "name": "nette/schema",
@@ -4463,16 +4491,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v5.8.0",
+            "version": "v5.9.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "044a6a392ff8ad0d61f14370a5fbbd0a0107152f"
+                "reference": "9e33da9553fe7786f0962b35f4e4ecf01be89def"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/044a6a392ff8ad0d61f14370a5fbbd0a0107152f",
-                "reference": "044a6a392ff8ad0d61f14370a5fbbd0a0107152f",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/9e33da9553fe7786f0962b35f4e4ecf01be89def",
+                "reference": "9e33da9553fe7786f0962b35f4e4ecf01be89def",
                 "shasum": ""
             },
             "require": {
@@ -4514,9 +4542,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v5.8.0"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.9.0"
             },
-            "time": "2026-07-04T14:30:18+00:00"
+            "time": "2026-09-13T18:51:52+00:00"
         },
         {
             "name": "nubs/random-name-generator",
@@ -4779,20 +4807,25 @@
         },
         {
             "name": "phpdocumentor/reflection-common",
-            "version": "2.2.0",
+            "version": "2.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpDocumentor/ReflectionCommon.git",
-                "reference": "1d01c49d4ed62f25aa84a747ad35d5a16924662b"
+                "reference": "ee15a5a2022c8383906b225055e9496a6a5e6e3b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpDocumentor/ReflectionCommon/zipball/1d01c49d4ed62f25aa84a747ad35d5a16924662b",
-                "reference": "1d01c49d4ed62f25aa84a747ad35d5a16924662b",
+                "url": "https://api.github.com/repos/phpDocumentor/ReflectionCommon/zipball/ee15a5a2022c8383906b225055e9496a6a5e6e3b",
+                "reference": "ee15a5a2022c8383906b225055e9496a6a5e6e3b",
                 "shasum": ""
             },
             "require": {
-                "php": "^7.2 || ^8.0"
+                "php": "^7.4 || ^8.0"
+            },
+            "require-dev": {
+                "phpstan/phpstan": "^1.8",
+                "phpunit/phpunit": "^9.5",
+                "vimeo/psalm": "^4.25"
             },
             "type": "library",
             "extra": {
@@ -4816,7 +4849,7 @@
                 }
             ],
             "description": "Common reflection classes used by phpdocumentor to reflect the code structure",
-            "homepage": "http://www.phpdoc.org",
+            "homepage": "https://www.phpdoc.org",
             "keywords": [
                 "FQSEN",
                 "phpDocumentor",
@@ -4826,9 +4859,9 @@
             ],
             "support": {
                 "issues": "https://github.com/phpDocumentor/ReflectionCommon/issues",
-                "source": "https://github.com/phpDocumentor/ReflectionCommon/tree/2.x"
+                "source": "https://github.com/phpDocumentor/ReflectionCommon/tree/2.2.1"
             },
-            "time": "2020-06-27T09:03:43+00:00"
+            "time": "2025-11-10T21:21:55+00:00"
         },
         {
             "name": "phpdocumentor/reflection-docblock",
@@ -4897,16 +4930,16 @@
         },
         {
             "name": "phpdocumentor/type-resolver",
-            "version": "2.0.0",
+            "version": "2.1.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpDocumentor/TypeResolver.git",
-                "reference": "327a05bbee54120d4786a0dc67aad30226ad4cf9"
+                "reference": "dbe2133bb23e2e33a6834f4ed417f24a1b167769"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpDocumentor/TypeResolver/zipball/327a05bbee54120d4786a0dc67aad30226ad4cf9",
-                "reference": "327a05bbee54120d4786a0dc67aad30226ad4cf9",
+                "url": "https://api.github.com/repos/phpDocumentor/TypeResolver/zipball/dbe2133bb23e2e33a6834f4ed417f24a1b167769",
+                "reference": "dbe2133bb23e2e33a6834f4ed417f24a1b167769",
                 "shasum": ""
             },
             "require": {
@@ -4949,22 +4982,22 @@
             "description": "A PSR-5 based resolver of Class names, Types and Structural Element Names",
             "support": {
                 "issues": "https://github.com/phpDocumentor/TypeResolver/issues",
-                "source": "https://github.com/phpDocumentor/TypeResolver/tree/2.0.0"
+                "source": "https://github.com/phpDocumentor/TypeResolver/tree/2.1.0"
             },
-            "time": "2026-01-06T21:53:42+00:00"
+            "time": "2026-09-27T19:32:54+00:00"
         },
         {
             "name": "phpoption/phpoption",
-            "version": "1.9.5",
+            "version": "1.10.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/schmittjoh/php-option.git",
-                "reference": "75365b91986c2405cf5e1e012c5595cd487a98be"
+                "reference": "67b192b6a42ec03944b972d6e633ddec78ad2c6d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/schmittjoh/php-option/zipball/75365b91986c2405cf5e1e012c5595cd487a98be",
-                "reference": "75365b91986c2405cf5e1e012c5595cd487a98be",
+                "url": "https://api.github.com/repos/schmittjoh/php-option/zipball/67b192b6a42ec03944b972d6e633ddec78ad2c6d",
+                "reference": "67b192b6a42ec03944b972d6e633ddec78ad2c6d",
                 "shasum": ""
             },
             "require": {
@@ -4972,7 +5005,7 @@
             },
             "require-dev": {
                 "bamarni/composer-bin-plugin": "^1.8.2",
-                "phpunit/phpunit": "^8.5.44 || ^9.6.25 || ^10.5.53 || ^11.5.34"
+                "phpunit/phpunit": "^8.5.54 || ^9.6.36 || ^10.5.64 || ^11.5.56 || ^12.5.33"
             },
             "type": "library",
             "extra": {
@@ -5014,7 +5047,7 @@
             ],
             "support": {
                 "issues": "https://github.com/schmittjoh/php-option/issues",
-                "source": "https://github.com/schmittjoh/php-option/tree/1.9.5"
+                "source": "https://github.com/schmittjoh/php-option/tree/1.10.0"
             },
             "funding": [
                 {
@@ -5026,7 +5059,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-12-27T19:41:33+00:00"
+            "time": "2026-08-24T00:54:40+00:00"
         },
         {
             "name": "phpseclib/phpseclib",
@@ -5140,16 +5173,16 @@
         },
         {
             "name": "phpstan/phpdoc-parser",
-            "version": "2.3.3",
+            "version": "2.3.6",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpdoc-parser.git",
-                "reference": "fb19eedd2bb67ff8cf7a5502ad329e701d6398a3"
+                "reference": "1427af4647235b4a73b13940b1f1258d3584f36e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpdoc-parser/zipball/fb19eedd2bb67ff8cf7a5502ad329e701d6398a3",
-                "reference": "fb19eedd2bb67ff8cf7a5502ad329e701d6398a3",
+                "url": "https://api.github.com/repos/phpstan/phpdoc-parser/zipball/1427af4647235b4a73b13940b1f1258d3584f36e",
+                "reference": "1427af4647235b4a73b13940b1f1258d3584f36e",
                 "shasum": ""
             },
             "require": {
@@ -5181,9 +5214,9 @@
             "description": "PHPDoc parser with support for nullable, intersection and generic types",
             "support": {
                 "issues": "https://github.com/phpstan/phpdoc-parser/issues",
-                "source": "https://github.com/phpstan/phpdoc-parser/tree/2.3.3"
+                "source": "https://github.com/phpstan/phpdoc-parser/tree/2.3.6"
             },
-            "time": "2026-07-08T07:01:06+00:00"
+            "time": "2026-09-27T20:07:45+00:00"
         },
         {
             "name": "pion/laravel-chunk-upload",
@@ -5300,16 +5333,16 @@
         },
         {
             "name": "pragmarx/google2fa",
-            "version": "v9.0.0",
+            "version": "v9.1.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/antonioribeiro/google2fa.git",
-                "reference": "e6bc62dd6ae83acc475f57912e27466019a1f2cf"
+                "reference": "f00bc788c555adfb6765c437ff3538e59cd88af1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/antonioribeiro/google2fa/zipball/e6bc62dd6ae83acc475f57912e27466019a1f2cf",
-                "reference": "e6bc62dd6ae83acc475f57912e27466019a1f2cf",
+                "url": "https://api.github.com/repos/antonioribeiro/google2fa/zipball/f00bc788c555adfb6765c437ff3538e59cd88af1",
+                "reference": "f00bc788c555adfb6765c437ff3538e59cd88af1",
                 "shasum": ""
             },
             "require": {
@@ -5317,8 +5350,11 @@
                 "php": "^7.1|^8.0"
             },
             "require-dev": {
-                "phpstan/phpstan": "^1.9",
-                "phpunit/phpunit": "^7.5.15|^8.5|^9.0"
+                "phpstan/phpstan": "^1.0|^2.0",
+                "phpstan/phpstan-phpunit": "^1.0|^2.0",
+                "phpunit/phpunit": "~9|~10|~11|~12|~13",
+                "psalm/plugin-phpunit": "^0.19|^0.20",
+                "vimeo/psalm": "^5.26|^6.13"
             },
             "type": "library",
             "autoload": {
@@ -5341,14 +5377,23 @@
             "keywords": [
                 "2fa",
                 "Authentication",
+                "MFA",
                 "Two Factor Authentication",
-                "google2fa"
+                "google-authenticator",
+                "google2fa",
+                "hotp",
+                "otp",
+                "rfc4226",
+                "rfc6238",
+                "totp"
             ],
             "support": {
+                "docs": "https://github.com/antonioribeiro/google2fa#readme",
                 "issues": "https://github.com/antonioribeiro/google2fa/issues",
-                "source": "https://github.com/antonioribeiro/google2fa/tree/v9.0.0"
+                "security": "https://github.com/antonioribeiro/google2fa/security/policy",
+                "source": "https://github.com/antonioribeiro/google2fa"
             },
-            "time": "2025-09-19T22:51:08+00:00"
+            "time": "2026-08-15T13:22:01+00:00"
         },
         {
             "name": "psr/cache",
@@ -5892,16 +5937,16 @@
         },
         {
             "name": "purplepixie/phpdns",
-            "version": "2.3.6",
+            "version": "2.4.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/purplepixie/phpdns.git",
-                "reference": "59e064513849adb426b416fef0717178a0a68a2d"
+                "reference": "51c838f6fd46a237d2ffa6fc12ecff6391ebcb20"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/purplepixie/phpdns/zipball/59e064513849adb426b416fef0717178a0a68a2d",
-                "reference": "59e064513849adb426b416fef0717178a0a68a2d",
+                "url": "https://api.github.com/repos/purplepixie/phpdns/zipball/51c838f6fd46a237d2ffa6fc12ecff6391ebcb20",
+                "reference": "51c838f6fd46a237d2ffa6fc12ecff6391ebcb20",
                 "shasum": ""
             },
             "require": {
@@ -5934,9 +5979,9 @@
             "description": "PHP DNS Direct Query Module",
             "support": {
                 "issues": "https://github.com/purplepixie/phpdns/issues",
-                "source": "https://github.com/purplepixie/phpdns/tree/2.3.6"
+                "source": "https://github.com/purplepixie/phpdns/tree/2.4.0"
             },
-            "time": "2025-11-03T12:17:11+00:00"
+            "time": "2026-09-06T10:05:57+00:00"
         },
         {
             "name": "pusher/pusher-php-server",
@@ -6001,6 +6046,68 @@
             },
             "time": "2026-08-07T12:47:11+00:00"
         },
+        {
+            "name": "radebatz/type-info-extras",
+            "version": "1.0.9",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/DerManoMann/type-info-extras.git",
+                "reference": "2d9f01d60d642f890d9f170c0d8fde1f75ab17fb"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/DerManoMann/type-info-extras/zipball/2d9f01d60d642f890d9f170c0d8fde1f75ab17fb",
+                "reference": "2d9f01d60d642f890d9f170c0d8fde1f75ab17fb",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.2",
+                "phpstan/phpdoc-parser": "^2.0",
+                "symfony/type-info": "^7.3.8 || ^7.4.1 || ^8.0 || ^8.1-@dev"
+            },
+            "require-dev": {
+                "friendsofphp/php-cs-fixer": "^3.70",
+                "phpstan/phpstan": "^2.1",
+                "phpunit/phpunit": "^11.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Radebatz\\TypeInfoExtras\\": "src"
+                },
+                "exclude-from-classmap": [
+                    "/tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Martin Rademacher",
+                    "email": "mano@radebatz.org"
+                }
+            ],
+            "description": "Extras for symfony/type-info",
+            "homepage": "http://radebatz.net/mano/",
+            "keywords": [
+                "component",
+                "symfony",
+                "type-info",
+                "types"
+            ],
+            "support": {
+                "issues": "https://github.com/DerManoMann/type-info-extras/issues",
+                "source": "https://github.com/DerManoMann/type-info-extras/tree/1.0.9"
+            },
+            "time": "2026-09-29T22:04:31+00:00"
+        },
         {
             "name": "ralouphie/getallheaders",
             "version": "3.0.3",
@@ -6123,20 +6230,20 @@
         },
         {
             "name": "ramsey/uuid",
-            "version": "4.9.3",
+            "version": "4.9.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/ramsey/uuid.git",
-                "reference": "1df15849d00943a67d677dc9cfd80795f038c9f8"
+                "reference": "75d73f48d02797c2c285a7e9f348fadc0102ffe2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/ramsey/uuid/zipball/1df15849d00943a67d677dc9cfd80795f038c9f8",
-                "reference": "1df15849d00943a67d677dc9cfd80795f038c9f8",
+                "url": "https://api.github.com/repos/ramsey/uuid/zipball/75d73f48d02797c2c285a7e9f348fadc0102ffe2",
+                "reference": "75d73f48d02797c2c285a7e9f348fadc0102ffe2",
                 "shasum": ""
             },
             "require": {
-                "brick/math": ">=0.8.16 <=0.18",
+                "brick/math": "^0.8.16 || ^0.9 || ^0.10 || ^0.11 || ^0.12 || ^0.13 || ^0.14 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0",
                 "php": "^8.0",
                 "ramsey/collection": "^1.2 || ^2.0"
             },
@@ -6195,9 +6302,9 @@
             ],
             "support": {
                 "issues": "https://github.com/ramsey/uuid/issues",
-                "source": "https://github.com/ramsey/uuid/tree/4.9.3"
+                "source": "https://github.com/ramsey/uuid/tree/4.9.4"
             },
-            "time": "2026-06-18T03:57:49+00:00"
+            "time": "2026-09-16T11:39:30+00:00"
         },
         {
             "name": "ratchet/rfc6455",
@@ -6790,16 +6897,16 @@
         },
         {
             "name": "resend/resend-laravel",
-            "version": "v1.5.0",
+            "version": "v1.6.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/resend/resend-laravel.git",
-                "reference": "3f67df5b6f61353b09d7f849e6c81df8cdbc079f"
+                "reference": "56d09b18c8850396a36a7f81e3d98365fe51bc6b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/resend/resend-laravel/zipball/3f67df5b6f61353b09d7f849e6c81df8cdbc079f",
-                "reference": "3f67df5b6f61353b09d7f849e6c81df8cdbc079f",
+                "url": "https://api.github.com/repos/resend/resend-laravel/zipball/56d09b18c8850396a36a7f81e3d98365fe51bc6b",
+                "reference": "56d09b18c8850396a36a7f81e3d98365fe51bc6b",
                 "shasum": ""
             },
             "require": {
@@ -6853,9 +6960,9 @@
             ],
             "support": {
                 "issues": "https://github.com/resend/resend-laravel/issues",
-                "source": "https://github.com/resend/resend-laravel/tree/v1.5.0"
+                "source": "https://github.com/resend/resend-laravel/tree/v1.6.0"
             },
-            "time": "2026-09-17T20:41:15+00:00"
+            "time": "2026-09-29T18:05:25+00:00"
         },
         {
             "name": "resend/resend-php",
@@ -7160,26 +7267,26 @@
         },
         {
             "name": "socialiteproviders/manager",
-            "version": "4.9.2",
+            "version": "4.10.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/SocialiteProviders/Manager.git",
-                "reference": "35372dc62787e61e91cfec73f45fd5d5ae0f8891"
+                "reference": "65ad770276875682e246e5435566146bf0baebf2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/SocialiteProviders/Manager/zipball/35372dc62787e61e91cfec73f45fd5d5ae0f8891",
-                "reference": "35372dc62787e61e91cfec73f45fd5d5ae0f8891",
+                "url": "https://api.github.com/repos/SocialiteProviders/Manager/zipball/65ad770276875682e246e5435566146bf0baebf2",
+                "reference": "65ad770276875682e246e5435566146bf0baebf2",
                 "shasum": ""
             },
             "require": {
-                "illuminate/support": "^11.0 || ^12.0 || ^13.0",
-                "laravel/socialite": "^5.5",
-                "php": "^8.2"
+                "illuminate/support": "^12.0 || ^13.0",
+                "laravel/socialite": "^5.29",
+                "php": "^8.3"
             },
             "require-dev": {
-                "mockery/mockery": "^1.2",
-                "phpunit/phpunit": "^9.0"
+                "mockery/mockery": "^1.6",
+                "phpunit/phpunit": "^12.5"
             },
             "type": "library",
             "extra": {
@@ -7230,24 +7337,23 @@
                 "issues": "https://github.com/socialiteproviders/manager/issues",
                 "source": "https://github.com/socialiteproviders/manager"
             },
-            "time": "2026-03-18T22:13:24+00:00"
+            "time": "2026-08-16T00:16:22+00:00"
         },
         {
             "name": "socialiteproviders/microsoft-azure",
-            "version": "5.2.0",
+            "version": "5.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/SocialiteProviders/Microsoft-Azure.git",
-                "reference": "453d62c9d7e3b3b76e94c913fb46e68a33347b16"
+                "reference": "d70ea3c60b09cc113a14350761a0618815bfa11c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/SocialiteProviders/Microsoft-Azure/zipball/453d62c9d7e3b3b76e94c913fb46e68a33347b16",
-                "reference": "453d62c9d7e3b3b76e94c913fb46e68a33347b16",
+                "url": "https://api.github.com/repos/SocialiteProviders/Microsoft-Azure/zipball/d70ea3c60b09cc113a14350761a0618815bfa11c",
+                "reference": "d70ea3c60b09cc113a14350761a0618815bfa11c",
                 "shasum": ""
             },
             "require": {
-                "ext-json": "*",
                 "php": "^8.0",
                 "socialiteproviders/manager": "^4.4"
             },
@@ -7281,7 +7387,7 @@
                 "issues": "https://github.com/socialiteproviders/providers/issues",
                 "source": "https://github.com/socialiteproviders/providers"
             },
-            "time": "2024-03-15T03:02:10+00:00"
+            "time": "2026-08-23T02:40:58+00:00"
         },
         {
             "name": "socialiteproviders/zitadel",
@@ -7646,16 +7752,16 @@
         },
         {
             "name": "spatie/laravel-package-tools",
-            "version": "1.93.1",
+            "version": "1.93.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/spatie/laravel-package-tools.git",
-                "reference": "d5552849801f2642aea710557463234b59ef65eb"
+                "reference": "7aeef26bd8d4909bec744dbf47aee7d1395588c1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/spatie/laravel-package-tools/zipball/d5552849801f2642aea710557463234b59ef65eb",
-                "reference": "d5552849801f2642aea710557463234b59ef65eb",
+                "url": "https://api.github.com/repos/spatie/laravel-package-tools/zipball/7aeef26bd8d4909bec744dbf47aee7d1395588c1",
+                "reference": "7aeef26bd8d4909bec744dbf47aee7d1395588c1",
                 "shasum": ""
             },
             "require": {
@@ -7695,7 +7801,7 @@
             ],
             "support": {
                 "issues": "https://github.com/spatie/laravel-package-tools/issues",
-                "source": "https://github.com/spatie/laravel-package-tools/tree/1.93.1"
+                "source": "https://github.com/spatie/laravel-package-tools/tree/1.93.3"
             },
             "funding": [
                 {
@@ -7703,7 +7809,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-05-19T14:06:37+00:00"
+            "time": "2026-09-28T07:16:50+00:00"
         },
         {
             "name": "spatie/laravel-schemaless-attributes",
@@ -8040,22 +8146,23 @@
         },
         {
             "name": "spomky-labs/cbor-php",
-            "version": "3.3.0",
+            "version": "3.4.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Spomky-Labs/cbor-php.git",
-                "reference": "013d13da69cf28b1ae501887daceccc850ca1c76"
+                "reference": "8f5ea00a07ad529d20886505cdbeb2b9ac7bb2d6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Spomky-Labs/cbor-php/zipball/013d13da69cf28b1ae501887daceccc850ca1c76",
-                "reference": "013d13da69cf28b1ae501887daceccc850ca1c76",
+                "url": "https://api.github.com/repos/Spomky-Labs/cbor-php/zipball/8f5ea00a07ad529d20886505cdbeb2b9ac7bb2d6",
+                "reference": "8f5ea00a07ad529d20886505cdbeb2b9ac7bb2d6",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.9|^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17|^0.18",
+                "brick/math": "^0.9|^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17|^0.18|^0.19|^0.20|^1.0",
                 "ext-mbstring": "*",
-                "php": ">=8.0"
+                "php": ">=8.0",
+                "symfony/polyfill-php81": "^1.32"
             },
             "require-dev": {
                 "ext-json": "*",
@@ -8064,8 +8171,8 @@
                 "symfony/var-dumper": "^6.4|^7.1|^8.0"
             },
             "suggest": {
-                "ext-bcmath": "GMP or BCMath extensions will drastically improve the library performance. BCMath extension needed to handle the Big Float and Decimal Fraction Tags",
-                "ext-gmp": "GMP or BCMath extensions will drastically improve the library performance"
+                "ext-bcmath": "Improves the library performance when ext-gmp is missing, and is required to handle the Big Float and Decimal Fraction Tags (4 and 5)",
+                "ext-gmp": "Strongly recommended when decoding untrusted input: without it, converting the byte string of a Big Number Tag (2 and 3) is quadratic in its length. Also improves the library performance overall"
             },
             "type": "library",
             "autoload": {
@@ -8095,7 +8202,7 @@
             ],
             "support": {
                 "issues": "https://github.com/Spomky-Labs/cbor-php/issues",
-                "source": "https://github.com/Spomky-Labs/cbor-php/tree/3.3.0"
+                "source": "https://github.com/Spomky-Labs/cbor-php/tree/3.4.2"
             },
             "funding": [
                 {
@@ -8107,24 +8214,24 @@
                     "type": "patreon"
                 }
             ],
-            "time": "2026-07-15T18:56:27+00:00"
+            "time": "2026-09-15T06:55:29+00:00"
         },
         {
             "name": "spomky-labs/pki-framework",
-            "version": "1.6.0",
+            "version": "1.6.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Spomky-Labs/pki-framework.git",
-                "reference": "80778a25426288acd2e3a7cde2def41a3d59cddf"
+                "reference": "792e909d4e387adffe3c4f404451c7d57a3d2022"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Spomky-Labs/pki-framework/zipball/80778a25426288acd2e3a7cde2def41a3d59cddf",
-                "reference": "80778a25426288acd2e3a7cde2def41a3d59cddf",
+                "url": "https://api.github.com/repos/Spomky-Labs/pki-framework/zipball/792e909d4e387adffe3c4f404451c7d57a3d2022",
+                "reference": "792e909d4e387adffe3c4f404451c7d57a3d2022",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17|^0.18|^0.19",
+                "brick/math": "^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17|^0.18|^0.19|^0.20|^1.0",
                 "ext-mbstring": "*",
                 "php": ">=8.1"
             },
@@ -8149,7 +8256,8 @@
             "suggest": {
                 "ext-bcmath": "For better performance (or GMP)",
                 "ext-gmp": "For better performance (or BCMath)",
-                "ext-openssl": "For OpenSSL based cyphering"
+                "ext-openssl": "For OpenSSL based cyphering",
+                "ext-sodium": "To verify Ed25519 signatures where the OpenSSL extension has no EdDSA"
             },
             "type": "library",
             "autoload": {
@@ -8204,7 +8312,7 @@
             ],
             "support": {
                 "issues": "https://github.com/Spomky-Labs/pki-framework/issues",
-                "source": "https://github.com/Spomky-Labs/pki-framework/tree/1.6.0"
+                "source": "https://github.com/Spomky-Labs/pki-framework/tree/1.6.3"
             },
             "funding": [
                 {
@@ -8216,7 +8324,7 @@
                     "type": "patreon"
                 }
             ],
-            "time": "2026-08-06T16:21:11+00:00"
+            "time": "2026-09-12T19:02:49+00:00"
         },
         {
             "name": "stevebauman/purify",
@@ -8422,16 +8530,16 @@
         },
         {
             "name": "symfony/console",
-            "version": "v7.4.16",
+            "version": "v7.4.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/console.git",
-                "reference": "f4c69c9aed03abf933b294257d618bdd9b30a06d"
+                "reference": "d7bca2fe05241dc7732d0c8b6d551b879f5d0a7d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/f4c69c9aed03abf933b294257d618bdd9b30a06d",
-                "reference": "f4c69c9aed03abf933b294257d618bdd9b30a06d",
+                "url": "https://api.github.com/repos/symfony/console/zipball/d7bca2fe05241dc7732d0c8b6d551b879f5d0a7d",
+                "reference": "d7bca2fe05241dc7732d0c8b6d551b879f5d0a7d",
                 "shasum": ""
             },
             "require": {
@@ -8496,7 +8604,7 @@
                 "terminal"
             ],
             "support": {
-                "source": "https://github.com/symfony/console/tree/v7.4.16"
+                "source": "https://github.com/symfony/console/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -8516,20 +8624,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-31T12:37:14+00:00"
+            "time": "2026-09-18T15:55:00+00:00"
         },
         {
             "name": "symfony/css-selector",
-            "version": "v8.1.0",
+            "version": "v8.1.6",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/css-selector.git",
-                "reference": "dc0e2be45c9b5588c82414f02ac574b4b986abcd"
+                "reference": "08e2905152a39cf3fd1745d83f8c483e258887d9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/css-selector/zipball/dc0e2be45c9b5588c82414f02ac574b4b986abcd",
-                "reference": "dc0e2be45c9b5588c82414f02ac574b4b986abcd",
+                "url": "https://api.github.com/repos/symfony/css-selector/zipball/08e2905152a39cf3fd1745d83f8c483e258887d9",
+                "reference": "08e2905152a39cf3fd1745d83f8c483e258887d9",
                 "shasum": ""
             },
             "require": {
@@ -8565,7 +8673,7 @@
             "description": "Converts CSS selectors to XPath expressions",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/css-selector/tree/v8.1.0"
+                "source": "https://github.com/symfony/css-selector/tree/v8.1.6"
             },
             "funding": [
                 {
@@ -8585,7 +8693,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-08-23T10:06:25+00:00"
         },
         {
             "name": "symfony/deprecation-contracts",
@@ -8660,16 +8768,16 @@
         },
         {
             "name": "symfony/error-handler",
-            "version": "v7.4.15",
+            "version": "v7.4.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/error-handler.git",
-                "reference": "d49f6a19f326db41ae7103bdc38e3eb35a791261"
+                "reference": "82239fe00f7cdc9f17c4166fff4ebdc22bd26ec0"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/error-handler/zipball/d49f6a19f326db41ae7103bdc38e3eb35a791261",
-                "reference": "d49f6a19f326db41ae7103bdc38e3eb35a791261",
+                "url": "https://api.github.com/repos/symfony/error-handler/zipball/82239fe00f7cdc9f17c4166fff4ebdc22bd26ec0",
+                "reference": "82239fe00f7cdc9f17c4166fff4ebdc22bd26ec0",
                 "shasum": ""
             },
             "require": {
@@ -8718,7 +8826,7 @@
             "description": "Provides tools to manage errors and ease debugging PHP code",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/error-handler/tree/v7.4.15"
+                "source": "https://github.com/symfony/error-handler/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -8738,7 +8846,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-21T15:13:06+00:00"
+            "time": "2026-09-22T18:56:40+00:00"
         },
         {
             "name": "symfony/event-dispatcher",
@@ -8908,16 +9016,16 @@
         },
         {
             "name": "symfony/filesystem",
-            "version": "v8.1.2",
+            "version": "v8.1.6",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/filesystem.git",
-                "reference": "17856b7a222664a26a5ea1cb06ee0721c2438217"
+                "reference": "7599ebb855fede59413ddb7f15198d67bfcae7ba"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/filesystem/zipball/17856b7a222664a26a5ea1cb06ee0721c2438217",
-                "reference": "17856b7a222664a26a5ea1cb06ee0721c2438217",
+                "url": "https://api.github.com/repos/symfony/filesystem/zipball/7599ebb855fede59413ddb7f15198d67bfcae7ba",
+                "reference": "7599ebb855fede59413ddb7f15198d67bfcae7ba",
                 "shasum": ""
             },
             "require": {
@@ -8955,7 +9063,7 @@
             "description": "Provides basic utilities for the filesystem",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/filesystem/tree/v8.1.2"
+                "source": "https://github.com/symfony/filesystem/tree/v8.1.6"
             },
             "funding": [
                 {
@@ -8975,20 +9083,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-22T15:42:13+00:00"
+            "time": "2026-08-23T10:06:25+00:00"
         },
         {
             "name": "symfony/finder",
-            "version": "v7.4.14",
+            "version": "v7.4.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/finder.git",
-                "reference": "13b38720174286f55d1761152b575a8d1436fc25"
+                "reference": "2dd31e5208db7a0fda7bfc998ad727b79c2e4d1e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/finder/zipball/13b38720174286f55d1761152b575a8d1436fc25",
-                "reference": "13b38720174286f55d1761152b575a8d1436fc25",
+                "url": "https://api.github.com/repos/symfony/finder/zipball/2dd31e5208db7a0fda7bfc998ad727b79c2e4d1e",
+                "reference": "2dd31e5208db7a0fda7bfc998ad727b79c2e4d1e",
                 "shasum": ""
             },
             "require": {
@@ -9023,7 +9131,7 @@
             "description": "Finds files and directories via an intuitive fluent interface",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/finder/tree/v7.4.14"
+                "source": "https://github.com/symfony/finder/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -9043,20 +9151,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-06-27T08:31:18+00:00"
+            "time": "2026-09-26T06:31:10+00:00"
         },
         {
             "name": "symfony/http-foundation",
-            "version": "v7.4.16",
+            "version": "v7.4.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-foundation.git",
-                "reference": "b676451bb638e99a7d34d8a2be90406822e301eb"
+                "reference": "9d0761c0da6bd5b801b401666834901a9a1ffc33"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-foundation/zipball/b676451bb638e99a7d34d8a2be90406822e301eb",
-                "reference": "b676451bb638e99a7d34d8a2be90406822e301eb",
+                "url": "https://api.github.com/repos/symfony/http-foundation/zipball/9d0761c0da6bd5b801b401666834901a9a1ffc33",
+                "reference": "9d0761c0da6bd5b801b401666834901a9a1ffc33",
                 "shasum": ""
             },
             "require": {
@@ -9105,7 +9213,7 @@
             "description": "Defines an object-oriented layer for the HTTP specification",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/http-foundation/tree/v7.4.16"
+                "source": "https://github.com/symfony/http-foundation/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -9125,20 +9233,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-07T11:50:27+00:00"
+            "time": "2026-09-24T07:12:44+00:00"
         },
         {
             "name": "symfony/http-kernel",
-            "version": "v7.4.16",
+            "version": "v7.4.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-kernel.git",
-                "reference": "f5e728670fa2218ae8be8ea91f2b44b7d6e5304c"
+                "reference": "392784b5d7b959b8d872542a2530c50c540a788f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/f5e728670fa2218ae8be8ea91f2b44b7d6e5304c",
-                "reference": "f5e728670fa2218ae8be8ea91f2b44b7d6e5304c",
+                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/392784b5d7b959b8d872542a2530c50c540a788f",
+                "reference": "392784b5d7b959b8d872542a2530c50c540a788f",
                 "shasum": ""
             },
             "require": {
@@ -9224,7 +9332,7 @@
             "description": "Provides a structured process for converting a Request into a Response",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/http-kernel/tree/v7.4.16"
+                "source": "https://github.com/symfony/http-kernel/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -9244,7 +9352,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-07T18:00:13+00:00"
+            "time": "2026-09-29T14:05:16+00:00"
         },
         {
             "name": "symfony/mailer",
@@ -9504,16 +9612,16 @@
         },
         {
             "name": "symfony/polyfill-intl-grapheme",
-            "version": "v1.41.0",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-intl-grapheme.git",
-                "reference": "bb899c1db0aa8127dc3afe8cda4a67eb24915f8d"
+                "reference": "5cac8f4db97208823aa353f59a01faad2da52c75"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/bb899c1db0aa8127dc3afe8cda4a67eb24915f8d",
-                "reference": "bb899c1db0aa8127dc3afe8cda4a67eb24915f8d",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/5cac8f4db97208823aa353f59a01faad2da52c75",
+                "reference": "5cac8f4db97208823aa353f59a01faad2da52c75",
                 "shasum": ""
             },
             "require": {
@@ -9562,7 +9670,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-intl-grapheme/tree/v1.41.0"
+                "source": "https://github.com/symfony/polyfill-intl-grapheme/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -9582,20 +9690,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-28T08:25:59+00:00"
+            "time": "2026-09-25T15:46:47+00:00"
         },
         {
             "name": "symfony/polyfill-intl-idn",
-            "version": "v1.42.0",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-intl-idn.git",
-                "reference": "51b5ff5ba85452b31ec6f55490b08148612339d9"
+                "reference": "533d68cf99c8f8ee2e8893c59ed59192e92cfd74"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-intl-idn/zipball/51b5ff5ba85452b31ec6f55490b08148612339d9",
-                "reference": "51b5ff5ba85452b31ec6f55490b08148612339d9",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-idn/zipball/533d68cf99c8f8ee2e8893c59ed59192e92cfd74",
+                "reference": "533d68cf99c8f8ee2e8893c59ed59192e92cfd74",
                 "shasum": ""
             },
             "require": {
@@ -9649,7 +9757,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.42.0"
+                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -9669,20 +9777,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-24T10:51:20+00:00"
+            "time": "2026-09-23T14:40:04+00:00"
         },
         {
             "name": "symfony/polyfill-intl-normalizer",
-            "version": "v1.42.0",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-intl-normalizer.git",
-                "reference": "aa20edea75bd9c48cfecc8360922e5a6e5c44502"
+                "reference": "ebd57ccc7edb93d632e184efbe7693d2517bab3b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-intl-normalizer/zipball/aa20edea75bd9c48cfecc8360922e5a6e5c44502",
-                "reference": "aa20edea75bd9c48cfecc8360922e5a6e5c44502",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-normalizer/zipball/ebd57ccc7edb93d632e184efbe7693d2517bab3b",
+                "reference": "ebd57ccc7edb93d632e184efbe7693d2517bab3b",
                 "shasum": ""
             },
             "require": {
@@ -9734,7 +9842,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-intl-normalizer/tree/v1.42.0"
+                "source": "https://github.com/symfony/polyfill-intl-normalizer/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -9754,20 +9862,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-07T06:33:24+00:00"
+            "time": "2026-09-23T22:02:09+00:00"
         },
         {
             "name": "symfony/polyfill-mbstring",
-            "version": "v1.38.2",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-mbstring.git",
-                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6"
+                "reference": "4d5d331bf731e0aedbc6b2f5e61135b7b7996a72"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
-                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
+                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/4d5d331bf731e0aedbc6b2f5e61135b7b7996a72",
+                "reference": "4d5d331bf731e0aedbc6b2f5e61135b7b7996a72",
                 "shasum": ""
             },
             "require": {
@@ -9819,7 +9927,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.2"
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -9839,20 +9947,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-27T06:59:30+00:00"
+            "time": "2026-09-24T15:19:04+00:00"
         },
         {
             "name": "symfony/polyfill-php80",
-            "version": "v1.37.0",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-php80.git",
-                "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411"
+                "reference": "9c6a5d6b01ca51d486c813e9a9c0ed55f208bb74"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
-                "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+                "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/9c6a5d6b01ca51d486c813e9a9c0ed55f208bb74",
+                "reference": "9c6a5d6b01ca51d486c813e9a9c0ed55f208bb74",
                 "shasum": ""
             },
             "require": {
@@ -9903,7 +10011,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php80/tree/v1.37.0"
+                "source": "https://github.com/symfony/polyfill-php80/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -9923,20 +10031,100 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-10T16:19:22+00:00"
+            "time": "2026-09-25T15:50:05+00:00"
         },
         {
-            "name": "symfony/polyfill-php83",
-            "version": "v1.41.0",
+            "name": "symfony/polyfill-php81",
+            "version": "v1.38.1",
             "source": {
                 "type": "git",
-                "url": "https://github.com/symfony/polyfill-php83.git",
-                "reference": "5ea99087fb99c273a9b9236ed4c31e78b16103c6"
+                "url": "https://github.com/symfony/polyfill-php81.git",
+                "reference": "6bfb9c766cacffbc8e118cb87217d08ed84e5cd7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php83/zipball/5ea99087fb99c273a9b9236ed4c31e78b16103c6",
-                "reference": "5ea99087fb99c273a9b9236ed4c31e78b16103c6",
+                "url": "https://api.github.com/repos/symfony/polyfill-php81/zipball/6bfb9c766cacffbc8e118cb87217d08ed84e5cd7",
+                "reference": "6bfb9c766cacffbc8e118cb87217d08ed84e5cd7",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Php81\\": ""
+                },
+                "classmap": [
+                    "Resources/stubs"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill backporting some PHP 8.1+ features to lower PHP versions",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "polyfill",
+                "portable",
+                "shim"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/polyfill-php81/tree/v1.38.1"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-05-26T12:45:58+00:00"
+        },
+        {
+            "name": "symfony/polyfill-php83",
+            "version": "v1.43.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-php83.git",
+                "reference": "80ccff923a8d61f73ebe9da0aa94e25232f004ce"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-php83/zipball/80ccff923a8d61f73ebe9da0aa94e25232f004ce",
+                "reference": "80ccff923a8d61f73ebe9da0aa94e25232f004ce",
                 "shasum": ""
             },
             "require": {
@@ -9983,7 +10171,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php83/tree/v1.41.0"
+                "source": "https://github.com/symfony/polyfill-php83/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -10003,20 +10191,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-01T12:47:55+00:00"
+            "time": "2026-09-25T15:50:05+00:00"
         },
         {
             "name": "symfony/polyfill-php84",
-            "version": "v1.38.1",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-php84.git",
-                "reference": "f4e1dfaee5b74aba5964fe1fd4dfc7ba5e3085fa"
+                "reference": "22c6548499cbe5c5bb072fc0c42312dff062a015"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php84/zipball/f4e1dfaee5b74aba5964fe1fd4dfc7ba5e3085fa",
-                "reference": "f4e1dfaee5b74aba5964fe1fd4dfc7ba5e3085fa",
+                "url": "https://api.github.com/repos/symfony/polyfill-php84/zipball/22c6548499cbe5c5bb072fc0c42312dff062a015",
+                "reference": "22c6548499cbe5c5bb072fc0c42312dff062a015",
                 "shasum": ""
             },
             "require": {
@@ -10063,7 +10251,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php84/tree/v1.38.1"
+                "source": "https://github.com/symfony/polyfill-php84/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -10083,20 +10271,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-26T12:51:13+00:00"
+            "time": "2026-09-23T22:01:09+00:00"
         },
         {
             "name": "symfony/polyfill-php85",
-            "version": "v1.41.0",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-php85.git",
-                "reference": "255fab485aaa1006ed411040c42aecd7b5302d7a"
+                "reference": "86a42cbcc07adc331481a5ab310a4024bfc227f6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php85/zipball/255fab485aaa1006ed411040c42aecd7b5302d7a",
-                "reference": "255fab485aaa1006ed411040c42aecd7b5302d7a",
+                "url": "https://api.github.com/repos/symfony/polyfill-php85/zipball/86a42cbcc07adc331481a5ab310a4024bfc227f6",
+                "reference": "86a42cbcc07adc331481a5ab310a4024bfc227f6",
                 "shasum": ""
             },
             "require": {
@@ -10143,7 +10331,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php85/tree/v1.41.0"
+                "source": "https://github.com/symfony/polyfill-php85/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -10163,20 +10351,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-01T12:47:55+00:00"
+            "time": "2026-09-25T15:46:47+00:00"
         },
         {
             "name": "symfony/polyfill-uuid",
-            "version": "v1.37.0",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-uuid.git",
-                "reference": "26dfec253c4cf3e51b541b52ddf7e42cb0908e94"
+                "reference": "b23ff8245cc5c4479ea2be3d0132d2e6dd433993"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-uuid/zipball/26dfec253c4cf3e51b541b52ddf7e42cb0908e94",
-                "reference": "26dfec253c4cf3e51b541b52ddf7e42cb0908e94",
+                "url": "https://api.github.com/repos/symfony/polyfill-uuid/zipball/b23ff8245cc5c4479ea2be3d0132d2e6dd433993",
+                "reference": "b23ff8245cc5c4479ea2be3d0132d2e6dd433993",
                 "shasum": ""
             },
             "require": {
@@ -10226,7 +10414,7 @@
                 "uuid"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-uuid/tree/v1.37.0"
+                "source": "https://github.com/symfony/polyfill-uuid/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -10246,20 +10434,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-10T16:19:22+00:00"
+            "time": "2026-09-24T05:20:52+00:00"
         },
         {
             "name": "symfony/process",
-            "version": "v7.4.13",
+            "version": "v7.4.19",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/process.git",
-                "reference": "f5804be144caceb570f6747519999636b664f24c"
+                "reference": "ed0ae095b86994d370d5791612e55984f15aa30e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/process/zipball/f5804be144caceb570f6747519999636b664f24c",
-                "reference": "f5804be144caceb570f6747519999636b664f24c",
+                "url": "https://api.github.com/repos/symfony/process/zipball/ed0ae095b86994d370d5791612e55984f15aa30e",
+                "reference": "ed0ae095b86994d370d5791612e55984f15aa30e",
                 "shasum": ""
             },
             "require": {
@@ -10291,7 +10479,7 @@
             "description": "Executes commands in sub-processes",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/process/tree/v7.4.13"
+                "source": "https://github.com/symfony/process/tree/v7.4.19"
             },
             "funding": [
                 {
@@ -10311,7 +10499,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-23T16:05:06+00:00"
+            "time": "2026-09-02T12:38:34+00:00"
         },
         {
             "name": "symfony/property-access",
@@ -10396,16 +10584,16 @@
         },
         {
             "name": "symfony/property-info",
-            "version": "v8.1.4",
+            "version": "v8.1.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/property-info.git",
-                "reference": "d3b1ba3e69dd9fbfff3e00416d2fc60c600c599d"
+                "reference": "fe727d4888a92ac9200a2c1b8e0a995b6022afa7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/property-info/zipball/d3b1ba3e69dd9fbfff3e00416d2fc60c600c599d",
-                "reference": "d3b1ba3e69dd9fbfff3e00416d2fc60c600c599d",
+                "url": "https://api.github.com/repos/symfony/property-info/zipball/fe727d4888a92ac9200a2c1b8e0a995b6022afa7",
+                "reference": "fe727d4888a92ac9200a2c1b8e0a995b6022afa7",
                 "shasum": ""
             },
             "require": {
@@ -10458,7 +10646,7 @@
                 "validator"
             ],
             "support": {
-                "source": "https://github.com/symfony/property-info/tree/v8.1.4"
+                "source": "https://github.com/symfony/property-info/tree/v8.1.8"
             },
             "funding": [
                 {
@@ -10478,20 +10666,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-07T15:02:39+00:00"
+            "time": "2026-09-28T19:13:15+00:00"
         },
         {
             "name": "symfony/routing",
-            "version": "v7.4.15",
+            "version": "v7.4.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/routing.git",
-                "reference": "80c0a93d3f8e7499f716204a1fb38ead942a7a2b"
+                "reference": "2bacb72be5eadeaf9874d5accb75bfb33d21c74b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/routing/zipball/80c0a93d3f8e7499f716204a1fb38ead942a7a2b",
-                "reference": "80c0a93d3f8e7499f716204a1fb38ead942a7a2b",
+                "url": "https://api.github.com/repos/symfony/routing/zipball/2bacb72be5eadeaf9874d5accb75bfb33d21c74b",
+                "reference": "2bacb72be5eadeaf9874d5accb75bfb33d21c74b",
                 "shasum": ""
             },
             "require": {
@@ -10543,7 +10731,7 @@
                 "url"
             ],
             "support": {
-                "source": "https://github.com/symfony/routing/tree/v7.4.15"
+                "source": "https://github.com/symfony/routing/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -10563,20 +10751,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-21T15:13:06+00:00"
+            "time": "2026-09-28T19:09:50+00:00"
         },
         {
             "name": "symfony/serializer",
-            "version": "v8.1.4",
+            "version": "v8.1.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/serializer.git",
-                "reference": "ec3ae778e49a4cee5b937a779056fa23c3e834fb"
+                "reference": "df54c4fe859d945eb633d2c5e6a410ce535f21e4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/serializer/zipball/ec3ae778e49a4cee5b937a779056fa23c3e834fb",
-                "reference": "ec3ae778e49a4cee5b937a779056fa23c3e834fb",
+                "url": "https://api.github.com/repos/symfony/serializer/zipball/df54c4fe859d945eb633d2c5e6a410ce535f21e4",
+                "reference": "df54c4fe859d945eb633d2c5e6a410ce535f21e4",
                 "shasum": ""
             },
             "require": {
@@ -10642,7 +10830,7 @@
             "description": "Handles serializing and deserializing data structures, including object graphs, into array structures or other formats like XML and JSON.",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/serializer/tree/v8.1.4"
+                "source": "https://github.com/symfony/serializer/tree/v8.1.8"
             },
             "funding": [
                 {
@@ -10662,7 +10850,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-06T09:53:08+00:00"
+            "time": "2026-09-28T09:40:25+00:00"
         },
         {
             "name": "symfony/service-contracts",
@@ -10753,16 +10941,16 @@
         },
         {
             "name": "symfony/string",
-            "version": "v8.1.2",
+            "version": "v8.1.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/string.git",
-                "reference": "286a76b7255e5cc4bf0101a0bc5388ecf1c38ccc"
+                "reference": "d950140b5f56f31901e5b7a0c04ffc3a3deb943c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/string/zipball/286a76b7255e5cc4bf0101a0bc5388ecf1c38ccc",
-                "reference": "286a76b7255e5cc4bf0101a0bc5388ecf1c38ccc",
+                "url": "https://api.github.com/repos/symfony/string/zipball/d950140b5f56f31901e5b7a0c04ffc3a3deb943c",
+                "reference": "d950140b5f56f31901e5b7a0c04ffc3a3deb943c",
                 "shasum": ""
             },
             "require": {
@@ -10819,7 +11007,7 @@
                 "utf8"
             ],
             "support": {
-                "source": "https://github.com/symfony/string/tree/v8.1.2"
+                "source": "https://github.com/symfony/string/tree/v8.1.7"
             },
             "funding": [
                 {
@@ -10839,20 +11027,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-28T07:35:25+00:00"
+            "time": "2026-09-11T14:51:16+00:00"
         },
         {
             "name": "symfony/translation",
-            "version": "v8.1.4",
+            "version": "v8.1.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/translation.git",
-                "reference": "c0955eb4aa417a110e65c8162237b8a5c7d910bf"
+                "reference": "d9e1caba0d6b6f9a26710af8a2f88d37f001215a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/translation/zipball/c0955eb4aa417a110e65c8162237b8a5c7d910bf",
-                "reference": "c0955eb4aa417a110e65c8162237b8a5c7d910bf",
+                "url": "https://api.github.com/repos/symfony/translation/zipball/d9e1caba0d6b6f9a26710af8a2f88d37f001215a",
+                "reference": "d9e1caba0d6b6f9a26710af8a2f88d37f001215a",
                 "shasum": ""
             },
             "require": {
@@ -10912,7 +11100,7 @@
             "description": "Provides tools to internationalize your application",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/translation/tree/v8.1.4"
+                "source": "https://github.com/symfony/translation/tree/v8.1.5"
             },
             "funding": [
                 {
@@ -10932,7 +11120,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-30T12:40:56+00:00"
+            "time": "2026-08-21T17:47:34+00:00"
         },
         {
             "name": "symfony/translation-contracts",
@@ -11018,16 +11206,16 @@
         },
         {
             "name": "symfony/type-info",
-            "version": "v8.1.0",
+            "version": "v8.1.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/type-info.git",
-                "reference": "9f24df8a79781b9b9f030fea7dfd2f3bd1e7e7e7"
+                "reference": "18e1d891f0b8776141f281f7b6f5e67e4df9d9cd"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/type-info/zipball/9f24df8a79781b9b9f030fea7dfd2f3bd1e7e7e7",
-                "reference": "9f24df8a79781b9b9f030fea7dfd2f3bd1e7e7e7",
+                "url": "https://api.github.com/repos/symfony/type-info/zipball/18e1d891f0b8776141f281f7b6f5e67e4df9d9cd",
+                "reference": "18e1d891f0b8776141f281f7b6f5e67e4df9d9cd",
                 "shasum": ""
             },
             "require": {
@@ -11076,7 +11264,7 @@
                 "type"
             ],
             "support": {
-                "source": "https://github.com/symfony/type-info/tree/v8.1.0"
+                "source": "https://github.com/symfony/type-info/tree/v8.1.8"
             },
             "funding": [
                 {
@@ -11096,20 +11284,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-09-28T19:13:15+00:00"
         },
         {
             "name": "symfony/uid",
-            "version": "v7.4.9",
+            "version": "v7.4.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/uid.git",
-                "reference": "2676b524340abcfe4d6151ec698463cebafee439"
+                "reference": "a96bbdb02a04ff3b5592cee6741b03edc78b56aa"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/uid/zipball/2676b524340abcfe4d6151ec698463cebafee439",
-                "reference": "2676b524340abcfe4d6151ec698463cebafee439",
+                "url": "https://api.github.com/repos/symfony/uid/zipball/a96bbdb02a04ff3b5592cee6741b03edc78b56aa",
+                "reference": "a96bbdb02a04ff3b5592cee6741b03edc78b56aa",
                 "shasum": ""
             },
             "require": {
@@ -11154,7 +11342,7 @@
                 "uuid"
             ],
             "support": {
-                "source": "https://github.com/symfony/uid/tree/v7.4.9"
+                "source": "https://github.com/symfony/uid/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -11174,20 +11362,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-30T15:19:22+00:00"
+            "time": "2026-09-23T16:18:28+00:00"
         },
         {
             "name": "symfony/var-dumper",
-            "version": "v7.4.15",
+            "version": "v7.4.18",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/var-dumper.git",
-                "reference": "04ba4add636a95ff437af3a5a9499bb1d6c6d4bd"
+                "reference": "e088da50b813f32473a76871616cbb8fa54653a8"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/var-dumper/zipball/04ba4add636a95ff437af3a5a9499bb1d6c6d4bd",
-                "reference": "04ba4add636a95ff437af3a5a9499bb1d6c6d4bd",
+                "url": "https://api.github.com/repos/symfony/var-dumper/zipball/e088da50b813f32473a76871616cbb8fa54653a8",
+                "reference": "e088da50b813f32473a76871616cbb8fa54653a8",
                 "shasum": ""
             },
             "require": {
@@ -11241,7 +11429,7 @@
                 "dump"
             ],
             "support": {
-                "source": "https://github.com/symfony/var-dumper/tree/v7.4.15"
+                "source": "https://github.com/symfony/var-dumper/tree/v7.4.18"
             },
             "funding": [
                 {
@@ -11261,32 +11449,32 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-21T15:13:06+00:00"
+            "time": "2026-08-30T20:10:52+00:00"
         },
         {
             "name": "symfony/yaml",
-            "version": "v7.4.15",
+            "version": "v8.1.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/yaml.git",
-                "reference": "e101850ded5d2c0d44bf32abb8996404afec2dec"
+                "reference": "030e96eed0303223bfca3af9109e9e64830b6ec3"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/yaml/zipball/e101850ded5d2c0d44bf32abb8996404afec2dec",
-                "reference": "e101850ded5d2c0d44bf32abb8996404afec2dec",
+                "url": "https://api.github.com/repos/symfony/yaml/zipball/030e96eed0303223bfca3af9109e9e64830b6ec3",
+                "reference": "030e96eed0303223bfca3af9109e9e64830b6ec3",
                 "shasum": ""
             },
             "require": {
-                "php": ">=8.2",
-                "symfony/deprecation-contracts": "^2.5|^3",
+                "php": ">=8.4.1",
                 "symfony/polyfill-ctype": "^1.8"
             },
             "conflict": {
-                "symfony/console": "<6.4"
+                "symfony/console": "<7.4"
             },
             "require-dev": {
-                "symfony/console": "^6.4|^7.0|^8.0"
+                "symfony/console": "^7.4|^8.0",
+                "yaml/yaml-test-suite": "*"
             },
             "bin": [
                 "Resources/bin/yaml-lint"
@@ -11317,7 +11505,7 @@
             "description": "Loads and dumps YAML files",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/yaml/tree/v7.4.15"
+                "source": "https://github.com/symfony/yaml/tree/v8.1.8"
             },
             "funding": [
                 {
@@ -11337,7 +11525,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-21T15:13:06+00:00"
+            "time": "2026-09-26T06:33:49+00:00"
         },
         {
             "name": "tijsverkoyen/css-to-inline-styles",
@@ -11396,35 +11584,34 @@
         },
         {
             "name": "visus/cuid2",
-            "version": "6.0.0",
+            "version": "7.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/visus-io/php-cuid2.git",
-                "reference": "834c8a1c04684931600ee7a4189150b331a5b56c"
+                "reference": "a495550b8a88a4813f6a15683eb74bbb60312fe1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/visus-io/php-cuid2/zipball/834c8a1c04684931600ee7a4189150b331a5b56c",
-                "reference": "834c8a1c04684931600ee7a4189150b331a5b56c",
+                "url": "https://api.github.com/repos/visus-io/php-cuid2/zipball/a495550b8a88a4813f6a15683eb74bbb60312fe1",
+                "reference": "a495550b8a88a4813f6a15683eb74bbb60312fe1",
                 "shasum": ""
             },
             "require": {
-                "php": "^8.2",
-                "symfony/polyfill-php83": "^1.32"
+                "php": "^8.3"
             },
             "require-dev": {
-                "captainhook/captainhook": "^5.27",
-                "captainhook/hook-installer": "^1.0",
-                "captainhook/plugin-composer": "^5.3",
-                "dealerdirect/phpcodesniffer-composer-installer": "^1.2",
-                "ergebnis/composer-normalize": "^2.29",
+                "captainhook/captainhook": "^5.29.2",
+                "captainhook/hook-installer": "^1.0.5",
+                "captainhook/plugin-composer": "^5.3.3",
+                "dealerdirect/phpcodesniffer-composer-installer": "^1.2.1",
+                "ergebnis/composer-normalize": "^2.52",
                 "php-parallel-lint/php-parallel-lint": "^1.4",
-                "phpbench/phpbench": "^1.4",
-                "phpstan/phpstan": "^1.9",
-                "phpunit/phpunit": "^10.5",
-                "ramsey/conventional-commits": "^1.5",
-                "slevomat/coding-standard": "^8.25",
-                "squizlabs/php_codesniffer": "^4.0"
+                "phpbench/phpbench": "^1.7",
+                "phpstan/phpstan": "^2.2.7",
+                "phpunit/phpunit": "^12.5.33",
+                "ramsey/conventional-commits": "^1.7",
+                "slevomat/coding-standard": "^8.31.1",
+                "squizlabs/php_codesniffer": "^4.0.1"
             },
             "suggest": {
                 "ext-gmp": "Enables faster math with arbitrary precision integers using GMP."
@@ -11460,29 +11647,29 @@
             ],
             "support": {
                 "issues": "https://github.com/visus-io/php-cuid2/issues",
-                "source": "https://github.com/visus-io/php-cuid2/tree/6.0.0"
+                "source": "https://github.com/visus-io/php-cuid2/tree/7.0.0"
             },
-            "time": "2025-12-18T14:52:27+00:00"
+            "time": "2026-09-21T10:58:46+00:00"
         },
         {
             "name": "vlucas/phpdotenv",
-            "version": "v5.6.4",
+            "version": "v5.7.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/vlucas/phpdotenv.git",
-                "reference": "416df702837983f8d5ff48c9c3fee4f5f57b980b"
+                "reference": "301c07936b16d88628b126b01d082ba153cf4c40"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/416df702837983f8d5ff48c9c3fee4f5f57b980b",
-                "reference": "416df702837983f8d5ff48c9c3fee4f5f57b980b",
+                "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40",
+                "reference": "301c07936b16d88628b126b01d082ba153cf4c40",
                 "shasum": ""
             },
             "require": {
                 "ext-pcre": "*",
-                "graham-campbell/result-type": "^1.1.4",
+                "graham-campbell/result-type": "^1.2",
                 "php": "^7.2.5 || ^8.0",
-                "phpoption/phpoption": "^1.9.5",
+                "phpoption/phpoption": "^1.10",
                 "symfony/polyfill-ctype": "^1.26",
                 "symfony/polyfill-mbstring": "^1.26",
                 "symfony/polyfill-php80": "^1.26"
@@ -11526,7 +11713,7 @@
                     "homepage": "https://github.com/vlucas"
                 }
             ],
-            "description": "Loads environment variables from `.env` to `getenv()`, `$_ENV` and `$_SERVER` automagically.",
+            "description": "Loads environment variables from `.env` to `$_ENV` and `$_SERVER` automagically, and optionally to `getenv()`.",
             "keywords": [
                 "dotenv",
                 "env",
@@ -11534,7 +11721,7 @@
             ],
             "support": {
                 "issues": "https://github.com/vlucas/phpdotenv/issues",
-                "source": "https://github.com/vlucas/phpdotenv/tree/v5.6.4"
+                "source": "https://github.com/vlucas/phpdotenv/tree/v5.7.0"
             },
             "funding": [
                 {
@@ -11546,7 +11733,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-06T19:11:50+00:00"
+            "time": "2026-08-24T18:07:49+00:00"
         },
         {
             "name": "voku/portable-ascii",
@@ -11624,32 +11811,36 @@
         },
         {
             "name": "web-auth/cose-lib",
-            "version": "4.6.0",
+            "version": "4.8.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/web-auth/cose-lib.git",
-                "reference": "3afe04df137baf97c5c3e28c5ee6f05536405148"
+                "reference": "8849e8bf043a2d42d0bec5bda5db2469ad376148"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/web-auth/cose-lib/zipball/3afe04df137baf97c5c3e28c5ee6f05536405148",
-                "reference": "3afe04df137baf97c5c3e28c5ee6f05536405148",
+                "url": "https://api.github.com/repos/web-auth/cose-lib/zipball/8849e8bf043a2d42d0bec5bda5db2469ad376148",
+                "reference": "8849e8bf043a2d42d0bec5bda5db2469ad376148",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.9|^0.10|^0.11|^0.12|^0.13|^0.14|^0.15|^0.16|^0.17|^0.18",
+                "brick/math": "^0.9 || ^0.10 || ^0.11 || ^0.12 || ^0.13 || ^0.14 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0",
                 "ext-json": "*",
                 "ext-openssl": "*",
                 "php": ">=8.1",
                 "spomky-labs/pki-framework": "^1.0"
             },
+            "conflict": {
+                "spomky-labs/cbor-php": "<3.4.0"
+            },
             "require-dev": {
-                "spomky-labs/cbor-php": "^3.2.2"
+                "spomky-labs/cbor-php": "^3.4"
             },
             "suggest": {
-                "ext-bcmath": "For better performance, please install either GMP (recommended) or BCMath extension",
-                "ext-gmp": "For better performance, please install either GMP (recommended) or BCMath extension",
-                "spomky-labs/cbor-php": "For COSE Signature support"
+                "ext-bcmath": "Recommended: without GMP or BCMath, signing with RSASSA-PSS (PS256/PS384/PS512) blinds its private exponentiation in pure PHP",
+                "ext-gmp": "Recommended: without GMP or BCMath, signing with RSASSA-PSS (PS256/PS384/PS512) blinds its private exponentiation in pure PHP",
+                "ext-sodium": "Required by the EdDSA/Ed25519 signature algorithms (-8, -19, -260, -261) and to recompute an OKP public key from its private key",
+                "spomky-labs/cbor-php": "Required by the RFC 9052 header reader and cryptographic structures. 3.4.0 or later: it ships the six COSE message classes (CBOR\\Tag\\CoseSign1Tag and its siblings) that replace the deprecated Cose\\...Tag classes, and its decoder is what enforces the RFC 9052 label uniqueness and nesting bounds this library relies on"
             },
             "type": "library",
             "autoload": {
@@ -11679,7 +11870,7 @@
             ],
             "support": {
                 "issues": "https://github.com/web-auth/cose-lib/issues",
-                "source": "https://github.com/web-auth/cose-lib/tree/4.6.0"
+                "source": "https://github.com/web-auth/cose-lib/tree/4.8.2"
             },
             "funding": [
                 {
@@ -11691,20 +11882,20 @@
                     "type": "patreon"
                 }
             ],
-            "time": "2026-07-16T10:19:49+00:00"
+            "time": "2026-09-15T17:30:33+00:00"
         },
         {
             "name": "web-auth/webauthn-lib",
-            "version": "5.3.5",
+            "version": "5.3.9",
             "source": {
                 "type": "git",
                 "url": "https://github.com/web-auth/webauthn-lib.git",
-                "reference": "9e0986d999f4102e24ac8a598d3a80d98b56c19f"
+                "reference": "727e378fb7a36c26be5c911e4a0120c146741ce7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/web-auth/webauthn-lib/zipball/9e0986d999f4102e24ac8a598d3a80d98b56c19f",
-                "reference": "9e0986d999f4102e24ac8a598d3a80d98b56c19f",
+                "url": "https://api.github.com/repos/web-auth/webauthn-lib/zipball/727e378fb7a36c26be5c911e4a0120c146741ce7",
+                "reference": "727e378fb7a36c26be5c911e4a0120c146741ce7",
                 "shasum": ""
             },
             "require": {
@@ -11716,7 +11907,7 @@
                 "psr/clock": "^1.0",
                 "psr/event-dispatcher": "^1.0",
                 "psr/log": "^1.0|^2.0|^3.0",
-                "spomky-labs/cbor-php": "^3.0",
+                "spomky-labs/cbor-php": "^3.4",
                 "spomky-labs/pki-framework": "^1.0",
                 "symfony/clock": "^6.4|^7.0|^8.0",
                 "symfony/deprecation-contracts": "^3.2",
@@ -11724,7 +11915,7 @@
                 "symfony/property-info": "^6.4|^7.0|^8.0",
                 "symfony/serializer": "^6.4|^7.0|^8.0",
                 "symfony/uid": "^6.4|^7.0|^8.0",
-                "web-auth/cose-lib": "^4.2.3"
+                "web-auth/cose-lib": "^4.8"
             },
             "suggest": {
                 "psr/log-implementation": "Recommended to receive logs from the library",
@@ -11765,7 +11956,7 @@
                 "webauthn"
             ],
             "support": {
-                "source": "https://github.com/web-auth/webauthn-lib/tree/5.3.5"
+                "source": "https://github.com/web-auth/webauthn-lib/tree/5.3.9"
             },
             "funding": [
                 {
@@ -11777,7 +11968,7 @@
                     "type": "patreon"
                 }
             ],
-            "time": "2026-05-31T15:00:08+00:00"
+            "time": "2026-09-10T21:10:45+00:00"
         },
         {
             "name": "webmozart/assert",
@@ -11957,24 +12148,25 @@
         },
         {
             "name": "zircote/swagger-php",
-            "version": "5.8.3",
+            "version": "6.11.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/zircote/swagger-php.git",
-                "reference": "098223019f764a16715f64089a58606096719c98"
+                "reference": "f998f7e712658fba61f86fccbdcf8e301a982175"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/zircote/swagger-php/zipball/098223019f764a16715f64089a58606096719c98",
-                "reference": "098223019f764a16715f64089a58606096719c98",
+                "url": "https://api.github.com/repos/zircote/swagger-php/zipball/f998f7e712658fba61f86fccbdcf8e301a982175",
+                "reference": "f998f7e712658fba61f86fccbdcf8e301a982175",
                 "shasum": ""
             },
             "require": {
-                "ext-json": "*",
                 "nikic/php-parser": "^4.19 || ^5.0",
-                "php": ">=7.4",
+                "php": ">=8.2",
                 "phpstan/phpdoc-parser": "^2.0",
                 "psr/log": "^1.1 || ^2.0 || ^3.0",
+                "radebatz/type-info-extras": "^1.0.2",
+                "symfony/console": "^6.4 || ^7.0 || ^8.0",
                 "symfony/deprecation-contracts": "^2 || ^3",
                 "symfony/finder": "^5.0 || ^6.0 || ^7.0 || ^8.0",
                 "symfony/yaml": "^5.4 || ^6.0 || ^7.0 || ^8.0"
@@ -11983,17 +12175,11 @@
                 "symfony/process": ">=6, <6.4.14"
             },
             "require-dev": {
-                "composer/package-versions-deprecated": "^1.11",
                 "doctrine/annotations": "^2.0",
-                "friendsofphp/php-cs-fixer": "^3.62.0",
-                "phpstan/phpstan": "^1.6 || ^2.0",
-                "phpunit/phpunit": "^9.0",
-                "rector/rector": "^1.0 || ^2.3.1",
-                "vimeo/psalm": "^4.30 || ^5.0"
-            },
-            "suggest": {
-                "doctrine/annotations": "^2.0",
-                "radebatz/type-info-extras": "^1.0.2"
+                "friendsofphp/php-cs-fixer": "3.95.23",
+                "phpstan/phpstan": "2.2.12",
+                "phpunit/phpunit": "^11.5 || >=12.5.22",
+                "rector/rector": "2.6.5"
             },
             "bin": [
                 "bin/openapi"
@@ -12001,7 +12187,7 @@
             "type": "library",
             "extra": {
                 "branch-alias": {
-                    "dev-master": "5.x-dev"
+                    "dev-master": "6.x-dev"
                 }
             },
             "autoload": {
@@ -12039,7 +12225,7 @@
             ],
             "support": {
                 "issues": "https://github.com/zircote/swagger-php/issues",
-                "source": "https://github.com/zircote/swagger-php/tree/5.8.3"
+                "source": "https://github.com/zircote/swagger-php/tree/6.11.0"
             },
             "funding": [
                 {
@@ -12047,7 +12233,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-03-02T00:47:18+00:00"
+            "time": "2026-09-26T07:11:30+00:00"
         }
     ],
     "packages-dev": [
@@ -12274,16 +12460,16 @@
         },
         {
             "name": "amphp/dns",
-            "version": "v2.4.0",
+            "version": "v2.4.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/amphp/dns.git",
-                "reference": "78eb3db5fc69bf2fc0cb503c4fcba667bc223c71"
+                "reference": "ec5948bfafac808f410406e18bc7b52a2d4629b7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/amphp/dns/zipball/78eb3db5fc69bf2fc0cb503c4fcba667bc223c71",
-                "reference": "78eb3db5fc69bf2fc0cb503c4fcba667bc223c71",
+                "url": "https://api.github.com/repos/amphp/dns/zipball/ec5948bfafac808f410406e18bc7b52a2d4629b7",
+                "reference": "ec5948bfafac808f410406e18bc7b52a2d4629b7",
                 "shasum": ""
             },
             "require": {
@@ -12302,7 +12488,7 @@
                 "amphp/php-cs-fixer-config": "^2",
                 "amphp/phpunit-util": "^3",
                 "phpunit/phpunit": "^9",
-                "psalm/phar": "5.20"
+                "psalm/phar": "6.16.1"
             },
             "type": "library",
             "autoload": {
@@ -12351,7 +12537,7 @@
             ],
             "support": {
                 "issues": "https://github.com/amphp/dns/issues",
-                "source": "https://github.com/amphp/dns/tree/v2.4.0"
+                "source": "https://github.com/amphp/dns/tree/v2.4.1"
             },
             "funding": [
                 {
@@ -12359,7 +12545,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2025-01-19T15:43:40+00:00"
+            "time": "2026-07-26T17:53:54+00:00"
         },
         {
             "name": "amphp/hpack",
@@ -12959,16 +13145,16 @@
         },
         {
             "name": "amphp/socket",
-            "version": "v2.4.0",
+            "version": "v2.4.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/amphp/socket.git",
-                "reference": "dadb63c5d3179fd83803e29dfeac27350e619314"
+                "reference": "b347be5aff6b2cc025208bb4d896607eb470c018"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/amphp/socket/zipball/dadb63c5d3179fd83803e29dfeac27350e619314",
-                "reference": "dadb63c5d3179fd83803e29dfeac27350e619314",
+                "url": "https://api.github.com/repos/amphp/socket/zipball/b347be5aff6b2cc025208bb4d896607eb470c018",
+                "reference": "b347be5aff6b2cc025208bb4d896607eb470c018",
                 "shasum": ""
             },
             "require": {
@@ -13031,7 +13217,7 @@
             ],
             "support": {
                 "issues": "https://github.com/amphp/socket/issues",
-                "source": "https://github.com/amphp/socket/tree/v2.4.0"
+                "source": "https://github.com/amphp/socket/tree/v2.4.1"
             },
             "funding": [
                 {
@@ -13039,7 +13225,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-04-19T15:09:56+00:00"
+            "time": "2026-08-22T18:13:20+00:00"
         },
         {
             "name": "amphp/sync",
@@ -13639,24 +13825,46 @@
         },
         {
             "name": "driftingly/rector-laravel",
-            "version": "2.5.0",
+            "version": "2.6.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/driftingly/rector-laravel.git",
-                "reference": "0dbdd842dfdbc821cfe5f47ca7326e2502b2a107"
+                "reference": "c0f9a2ff7365cec45d4dc64223608e7cec74604a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/driftingly/rector-laravel/zipball/0dbdd842dfdbc821cfe5f47ca7326e2502b2a107",
-                "reference": "0dbdd842dfdbc821cfe5f47ca7326e2502b2a107",
+                "url": "https://api.github.com/repos/driftingly/rector-laravel/zipball/c0f9a2ff7365cec45d4dc64223608e7cec74604a",
+                "reference": "c0f9a2ff7365cec45d4dc64223608e7cec74604a",
                 "shasum": ""
             },
             "require": {
-                "php": "^7.4 || ^8.0",
-                "rector/rector": "^2.2.7",
+                "php": ">=8.3",
+                "rector/rector": "^2.6.4",
+                "symplify/rule-doc-generator-contracts": "^11.2",
                 "webmozart/assert": "^1.11 || ^2.0"
             },
+            "require-dev": {
+                "boundwize/structarmed": "^0.16",
+                "nette/utils": "^4.0",
+                "nikic/php-parser": "^5.6",
+                "phpstan/extension-installer": "^1.3",
+                "phpstan/phpstan": "^2.2",
+                "phpstan/phpstan-deprecation-rules": "^2.0",
+                "phpstan/phpstan-strict-rules": "^2.0",
+                "phpstan/phpstan-webmozart-assert": "^2.0",
+                "phpunit/phpunit": "^10.5",
+                "symplify/rule-doc-generator": "^12.2",
+                "tightenco/duster": "^3.1",
+                "tracy/tracy": "^2.10"
+            },
             "type": "rector-extension",
+            "extra": {
+                "rector": {
+                    "includes": [
+                        "config/config.php"
+                    ]
+                }
+            },
             "autoload": {
                 "psr-4": {
                     "RectorLaravel\\": "src"
@@ -13669,9 +13877,9 @@
             "description": "Rector upgrades rules for Laravel Framework",
             "support": {
                 "issues": "https://github.com/driftingly/rector-laravel/issues",
-                "source": "https://github.com/driftingly/rector-laravel/tree/2.5.0"
+                "source": "https://github.com/driftingly/rector-laravel/tree/2.6.2"
             },
-            "time": "2026-06-02T16:22:14+00:00"
+            "time": "2026-08-29T21:42:57+00:00"
         },
         {
             "name": "fakerphp/faker",
@@ -13738,23 +13946,23 @@
         },
         {
             "name": "fidry/cpu-core-counter",
-            "version": "1.3.0",
+            "version": "1.4.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/theofidry/cpu-core-counter.git",
-                "reference": "db9508f7b1474469d9d3c53b86f817e344732678"
+                "reference": "d384a7d0d6e67aa497327260ca95023e92dc2032"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/theofidry/cpu-core-counter/zipball/db9508f7b1474469d9d3c53b86f817e344732678",
-                "reference": "db9508f7b1474469d9d3c53b86f817e344732678",
+                "url": "https://api.github.com/repos/theofidry/cpu-core-counter/zipball/d384a7d0d6e67aa497327260ca95023e92dc2032",
+                "reference": "d384a7d0d6e67aa497327260ca95023e92dc2032",
                 "shasum": ""
             },
             "require": {
                 "php": "^7.2 || ^8.0"
             },
             "require-dev": {
-                "fidry/makefile": "^0.2.0",
+                "fidry/makefile": "^0.2.0 || ^1.1.2",
                 "fidry/php-cs-fixer-config": "^1.1.2",
                 "phpstan/extension-installer": "^1.2.0",
                 "phpstan/phpstan": "^2.0",
@@ -13762,6 +13970,7 @@
                 "phpstan/phpstan-phpunit": "^2.0",
                 "phpstan/phpstan-strict-rules": "^2.0",
                 "phpunit/phpunit": "^8.5.31 || ^9.5.26",
+                "symfony/polyfill-mbstring": "^1.33",
                 "webmozarts/strict-phpunit": "^7.5"
             },
             "type": "library",
@@ -13787,7 +13996,7 @@
             ],
             "support": {
                 "issues": "https://github.com/theofidry/cpu-core-counter/issues",
-                "source": "https://github.com/theofidry/cpu-core-counter/tree/1.3.0"
+                "source": "https://github.com/theofidry/cpu-core-counter/tree/1.4.1"
             },
             "funding": [
                 {
@@ -13795,20 +14004,20 @@
                     "type": "github"
                 }
             ],
-            "time": "2025-08-14T07:29:31+00:00"
+            "time": "2026-09-29T22:11:39+00:00"
         },
         {
             "name": "filp/whoops",
-            "version": "2.18.4",
+            "version": "2.18.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filp/whoops.git",
-                "reference": "d2102955e48b9fd9ab24280a7ad12ed552752c4d"
+                "reference": "baec851ad6ae00db8bd0fdd30d208afc1b71c56e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filp/whoops/zipball/d2102955e48b9fd9ab24280a7ad12ed552752c4d",
-                "reference": "d2102955e48b9fd9ab24280a7ad12ed552752c4d",
+                "url": "https://api.github.com/repos/filp/whoops/zipball/baec851ad6ae00db8bd0fdd30d208afc1b71c56e",
+                "reference": "baec851ad6ae00db8bd0fdd30d208afc1b71c56e",
                 "shasum": ""
             },
             "require": {
@@ -13817,8 +14026,8 @@
             },
             "require-dev": {
                 "mockery/mockery": "^1.0",
-                "phpunit/phpunit": "^7.5.20 || ^8.5.8 || ^9.3.3",
-                "symfony/var-dumper": "^4.0 || ^5.0"
+                "phpunit/phpunit": "^7.5.20 || ^8.5.8 || ^9.3.3 || ^10.5.58",
+                "symfony/var-dumper": "^4.0 || ^5.0 || ^6.0 || ^7.0 || ^8.0"
             },
             "suggest": {
                 "symfony/var-dumper": "Pretty print complex values better with var-dumper available",
@@ -13858,7 +14067,7 @@
             ],
             "support": {
                 "issues": "https://github.com/filp/whoops/issues",
-                "source": "https://github.com/filp/whoops/tree/2.18.4"
+                "source": "https://github.com/filp/whoops/tree/2.18.5"
             },
             "funding": [
                 {
@@ -13866,23 +14075,25 @@
                     "type": "github"
                 }
             ],
-            "time": "2025-08-08T12:00:00+00:00"
+            "time": "2026-09-18T12:00:00+00:00"
         },
         {
             "name": "hamcrest/hamcrest-php",
-            "version": "v2.1.1",
+            "version": "v3.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/hamcrest/hamcrest-php.git",
-                "reference": "f8b1c0173b22fa6ec77a81fe63e5b01eba7e6487"
+                "reference": "b61cd040da1a4925bc90a51c074f5297e7c0fa52"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/hamcrest/hamcrest-php/zipball/f8b1c0173b22fa6ec77a81fe63e5b01eba7e6487",
-                "reference": "f8b1c0173b22fa6ec77a81fe63e5b01eba7e6487",
+                "url": "https://api.github.com/repos/hamcrest/hamcrest-php/zipball/b61cd040da1a4925bc90a51c074f5297e7c0fa52",
+                "reference": "b61cd040da1a4925bc90a51c074f5297e7c0fa52",
                 "shasum": ""
             },
             "require": {
+                "ext-ctype": "*",
+                "ext-dom": "*",
                 "php": "^7.4|^8.0"
             },
             "replace": {
@@ -13891,13 +14102,15 @@
                 "kodova/hamcrest-php": "*"
             },
             "require-dev": {
+                "phpstan/phpstan": "^2.1",
+                "phpstan/phpstan-phpunit": "^2.0",
                 "phpunit/php-file-iterator": "^1.4 || ^2.0 || ^3.0",
                 "phpunit/phpunit": "^4.8.36 || ^5.7 || ^6.5 || ^7.0 || ^8.0 || ^9.0"
             },
             "type": "library",
             "extra": {
                 "branch-alias": {
-                    "dev-master": "2.1-dev"
+                    "dev-master": "3.0-dev"
                 }
             },
             "autoload": {
@@ -13915,9 +14128,9 @@
             ],
             "support": {
                 "issues": "https://github.com/hamcrest/hamcrest-php/issues",
-                "source": "https://github.com/hamcrest/hamcrest-php/tree/v2.1.1"
+                "source": "https://github.com/hamcrest/hamcrest-php/tree/v3.0.0"
             },
-            "time": "2025-04-30T06:54:44+00:00"
+            "time": "2026-03-17T11:56:53+00:00"
         },
         {
             "name": "jean85/pretty-package-versions",
@@ -14105,16 +14318,16 @@
         },
         {
             "name": "laravel/pint",
-            "version": "v1.30.4",
+            "version": "v1.32.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/pint.git",
-                "reference": "a96cb6eee2961905d2fce7207aefb80945bf6b28"
+                "reference": "006bd7825eb01daf92959d060b89cd9514fe4253"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/pint/zipball/a96cb6eee2961905d2fce7207aefb80945bf6b28",
-                "reference": "a96cb6eee2961905d2fce7207aefb80945bf6b28",
+                "url": "https://api.github.com/repos/laravel/pint/zipball/006bd7825eb01daf92959d060b89cd9514fe4253",
+                "reference": "006bd7825eb01daf92959d060b89cd9514fe4253",
                 "shasum": ""
             },
             "require": {
@@ -14122,19 +14335,19 @@
                 "ext-mbstring": "*",
                 "ext-tokenizer": "*",
                 "ext-xml": "*",
-                "php": "^8.2.0"
+                "php": "^8.3.0"
             },
             "require-dev": {
                 "composer/semver": "^3.4.4",
-                "friendsofphp/php-cs-fixer": "^3.95.18",
-                "illuminate/view": "^12.65.0",
-                "larastan/larastan": "^3.10.0",
-                "laravel-zero/framework": "^12.1.0",
+                "friendsofphp/php-cs-fixer": "^3.95.25",
+                "illuminate/view": "^13.31.0",
+                "larastan/larastan": "^3.11.0",
+                "laravel-zero/framework": "^13.0.0",
                 "laravel/agent-detector": "^2.0.2",
-                "laravel/prompts": "^0.3.22",
-                "mockery/mockery": "^1.6.12",
+                "laravel/prompts": "^0.3.24",
+                "mockery/mockery": "^1.6.15",
                 "nunomaduro/termwind": "^2.4.0",
-                "pestphp/pest": "^3.8.7"
+                "pestphp/pest": "^4.7.8"
             },
             "bin": [
                 "builds/pint"
@@ -14171,7 +14384,7 @@
                 "issues": "https://github.com/laravel/pint/issues",
                 "source": "https://github.com/laravel/pint"
             },
-            "time": "2026-08-05T16:47:22+00:00"
+            "time": "2026-09-10T10:47:55+00:00"
         },
         {
             "name": "laravel/roster",
@@ -14235,6 +14448,82 @@
             },
             "time": "2026-07-18T17:53:15+00:00"
         },
+        {
+            "name": "laravel/vet",
+            "version": "v0.2.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/laravel/vet.git",
+                "reference": "7b10fd2beecf9f386c92731729c9f33a152b213b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/laravel/vet/zipball/7b10fd2beecf9f386c92731729c9f33a152b213b",
+                "reference": "7b10fd2beecf9f386c92731729c9f33a152b213b",
+                "shasum": ""
+            },
+            "require": {
+                "composer-plugin-api": "^2.0",
+                "ext-dom": "*",
+                "ext-mbstring": "*",
+                "ext-openssl": "*",
+                "ext-phar": "*",
+                "ext-tokenizer": "*",
+                "ext-zip": "*",
+                "php": "^8.4"
+            },
+            "require-dev": {
+                "guzzlehttp/guzzle": "^7.15.5|^8.0",
+                "laravel-zero/foundation": "^13.25",
+                "laravel-zero/framework": "^13.0",
+                "laravel/pint": "^1.32.1",
+                "mockery/mockery": "^1.6.15",
+                "pestphp/pest": "^5.2.1",
+                "pestphp/pest-plugin-phpstan": "^5.2.1",
+                "pestphp/pest-plugin-rector": "^5.0.4",
+                "phpstan/phpstan": "^2.2.16",
+                "rector/rector": "^2.6.7"
+            },
+            "bin": [
+                "builds/vet"
+            ],
+            "type": "composer-plugin",
+            "extra": {
+                "class": "Laravel\\Vet\\Composer\\Plugin"
+            },
+            "autoload": {
+                "psr-4": {
+                    "App\\": "app/",
+                    "Laravel\\Vet\\Composer\\": "src/Composer/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nuno Maduro",
+                    "email": "enunomaduro@gmail.com"
+                }
+            ],
+            "description": "A dependency audit trust file for PHP.",
+            "keywords": [
+                "Audit",
+                "cli",
+                "composer",
+                "console",
+                "dev",
+                "php",
+                "security",
+                "supply chain"
+            ],
+            "support": {
+                "issues": "https://github.com/laravel/vet/issues",
+                "source": "https://github.com/laravel/vet/tree/v0.2.1"
+            },
+            "time": "2026-09-27T14:39:48+00:00"
+        },
         {
             "name": "league/uri-components",
             "version": "7.8.1",
@@ -14321,29 +14610,28 @@
         },
         {
             "name": "mockery/mockery",
-            "version": "1.6.12",
+            "version": "1.6.15",
             "source": {
                 "type": "git",
                 "url": "https://github.com/mockery/mockery.git",
-                "reference": "1f4efdd7d3beafe9807b08156dfcb176d18f1699"
+                "reference": "967a801bd188989a5669bd280f252d51c0fdc9ee"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/mockery/mockery/zipball/1f4efdd7d3beafe9807b08156dfcb176d18f1699",
-                "reference": "1f4efdd7d3beafe9807b08156dfcb176d18f1699",
+                "url": "https://api.github.com/repos/mockery/mockery/zipball/967a801bd188989a5669bd280f252d51c0fdc9ee",
+                "reference": "967a801bd188989a5669bd280f252d51c0fdc9ee",
                 "shasum": ""
             },
             "require": {
-                "hamcrest/hamcrest-php": "^2.0.1",
-                "lib-pcre": ">=7.0",
+                "hamcrest/hamcrest-php": "^2.0 || ^3.0",
                 "php": ">=7.3"
             },
             "conflict": {
                 "phpunit/phpunit": "<8.0"
             },
             "require-dev": {
-                "phpunit/phpunit": "^8.5 || ^9.6.17",
-                "symplify/easy-coding-standard": "^12.1.14"
+                "phpunit/phpunit": "^9.6.36",
+                "symplify/easy-coding-standard": "^13.2.17"
             },
             "type": "library",
             "autoload": {
@@ -14400,24 +14688,24 @@
                 "security": "https://github.com/mockery/mockery/security/advisories",
                 "source": "https://github.com/mockery/mockery"
             },
-            "time": "2024-05-16T03:13:13+00:00"
+            "time": "2026-08-19T19:37:52+00:00"
         },
         {
             "name": "myclabs/deep-copy",
-            "version": "1.13.4",
+            "version": "1.14.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/myclabs/DeepCopy.git",
-                "reference": "07d290f0c47959fd5eed98c95ee5602db07e0b6a"
+                "reference": "8680aa248f8e07bc8fb43f56f0f5fc77a0c96aae"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a",
-                "reference": "07d290f0c47959fd5eed98c95ee5602db07e0b6a",
+                "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/8680aa248f8e07bc8fb43f56f0f5fc77a0c96aae",
+                "reference": "8680aa248f8e07bc8fb43f56f0f5fc77a0c96aae",
                 "shasum": ""
             },
             "require": {
-                "php": "^7.1 || ^8.0"
+                "php": "^8.0"
             },
             "conflict": {
                 "doctrine/collections": "<1.6.8",
@@ -14452,15 +14740,15 @@
             ],
             "support": {
                 "issues": "https://github.com/myclabs/DeepCopy/issues",
-                "source": "https://github.com/myclabs/DeepCopy/tree/1.13.4"
+                "source": "https://github.com/myclabs/DeepCopy/tree/1.14.0"
             },
             "funding": [
                 {
-                    "url": "https://tidelift.com/funding/github/packagist/myclabs/deep-copy",
-                    "type": "tidelift"
+                    "url": "https://github.com/mnapoli",
+                    "type": "github"
                 }
             ],
-            "time": "2025-08-01T08:46:24+00:00"
+            "time": "2026-08-11T10:17:44+00:00"
         },
         {
             "name": "nunomaduro/collision",
@@ -15151,11 +15439,11 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.2.8",
+            "version": "2.2.16",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/e285254e60f33c21902efef4a926ca0987c06804",
-                "reference": "e285254e60f33c21902efef4a926ca0987c06804",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/46a6d9060e5a7763adfcc21ebcb8b504ebdbcb92",
+                "reference": "46a6d9060e5a7763adfcc21ebcb8b504ebdbcb92",
                 "shasum": ""
             },
             "require": {
@@ -15211,7 +15499,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-04T22:21:45+00:00"
+            "time": "2026-09-25T09:31:51+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",
@@ -15303,23 +15591,23 @@
         },
         {
             "name": "phpunit/php-file-iterator",
-            "version": "6.0.1",
+            "version": "6.0.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sebastianbergmann/php-file-iterator.git",
-                "reference": "3d1cd096ef6bea4bf2762ba586e35dbd317cbfd5"
+                "reference": "a248d1640ab059b075f53a2ef0f9856e864e06b5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/3d1cd096ef6bea4bf2762ba586e35dbd317cbfd5",
-                "reference": "3d1cd096ef6bea4bf2762ba586e35dbd317cbfd5",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/a248d1640ab059b075f53a2ef0f9856e864e06b5",
+                "reference": "a248d1640ab059b075f53a2ef0f9856e864e06b5",
                 "shasum": ""
             },
             "require": {
                 "php": ">=8.3"
             },
             "require-dev": {
-                "phpunit/phpunit": "^12.0"
+                "phpunit/phpunit": "^12.5.33"
             },
             "type": "library",
             "extra": {
@@ -15352,7 +15640,7 @@
             "support": {
                 "issues": "https://github.com/sebastianbergmann/php-file-iterator/issues",
                 "security": "https://github.com/sebastianbergmann/php-file-iterator/security/policy",
-                "source": "https://github.com/sebastianbergmann/php-file-iterator/tree/6.0.1"
+                "source": "https://github.com/sebastianbergmann/php-file-iterator/tree/6.0.2"
             },
             "funding": [
                 {
@@ -15372,7 +15660,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-02-02T14:04:18+00:00"
+            "time": "2026-08-25T14:40:53+00:00"
         },
         {
             "name": "phpunit/php-invoker",
@@ -15650,21 +15938,21 @@
         },
         {
             "name": "rector/rector",
-            "version": "2.6.1",
+            "version": "2.6.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/rectorphp/rector.git",
-                "reference": "b8e68f058bca43e01a2e1caa51ef022d6551ed95"
+                "reference": "f4aa224edb9b0630fb43826d4cb6a49b62e48d4c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/rectorphp/rector/zipball/b8e68f058bca43e01a2e1caa51ef022d6551ed95",
-                "reference": "b8e68f058bca43e01a2e1caa51ef022d6551ed95",
+                "url": "https://api.github.com/repos/rectorphp/rector/zipball/f4aa224edb9b0630fb43826d4cb6a49b62e48d4c",
+                "reference": "f4aa224edb9b0630fb43826d4cb6a49b62e48d4c",
                 "shasum": ""
             },
             "require": {
                 "php": "^7.4|^8.0",
-                "phpstan/phpstan": "^2.2.6"
+                "phpstan/phpstan": "^2.2.14"
             },
             "conflict": {
                 "rector/rector-doctrine": "*",
@@ -15672,9 +15960,6 @@
                 "rector/rector-phpunit": "*",
                 "rector/rector-symfony": "*"
             },
-            "suggest": {
-                "ext-dom": "To manipulate phpunit.xml via the custom-rule command"
-            },
             "bin": [
                 "bin/rector"
             ],
@@ -15698,7 +15983,7 @@
             ],
             "support": {
                 "issues": "https://github.com/rectorphp/rector/issues",
-                "source": "https://github.com/rectorphp/rector/tree/2.6.1"
+                "source": "https://github.com/rectorphp/rector/tree/2.6.7"
             },
             "funding": [
                 {
@@ -15706,7 +15991,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-03T17:30:34+00:00"
+            "time": "2026-09-13T20:17:44+00:00"
         },
         {
             "name": "revolt/event-loop",
@@ -16001,24 +16286,24 @@
         },
         {
             "name": "sebastian/diff",
-            "version": "7.0.0",
+            "version": "7.0.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sebastianbergmann/diff.git",
-                "reference": "7ab1ea946c012266ca32390913653d844ecd085f"
+                "reference": "cd4cabe39f8a4e8ee6818ba99f10a05561ea4ad6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/7ab1ea946c012266ca32390913653d844ecd085f",
-                "reference": "7ab1ea946c012266ca32390913653d844ecd085f",
+                "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/cd4cabe39f8a4e8ee6818ba99f10a05561ea4ad6",
+                "reference": "cd4cabe39f8a4e8ee6818ba99f10a05561ea4ad6",
                 "shasum": ""
             },
             "require": {
                 "php": ">=8.3"
             },
             "require-dev": {
-                "phpunit/phpunit": "^12.0",
-                "symfony/process": "^7.2"
+                "phpunit/phpunit": "^12.5.33",
+                "symfony/process": "^7.4.17"
             },
             "type": "library",
             "extra": {
@@ -16056,15 +16341,27 @@
             "support": {
                 "issues": "https://github.com/sebastianbergmann/diff/issues",
                 "security": "https://github.com/sebastianbergmann/diff/security/policy",
-                "source": "https://github.com/sebastianbergmann/diff/tree/7.0.0"
+                "source": "https://github.com/sebastianbergmann/diff/tree/7.0.1"
             },
             "funding": [
                 {
                     "url": "https://github.com/sebastianbergmann",
                     "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/sebastian/diff",
+                    "type": "tidelift"
                 }
             ],
-            "time": "2025-02-07T04:55:46+00:00"
+            "time": "2026-08-25T15:35:54+00:00"
         },
         {
             "name": "sebastian/environment",
@@ -16691,16 +16988,16 @@
         },
         {
             "name": "serversideup/spin",
-            "version": "v3.3.0",
+            "version": "v3.5.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/serversideup/spin.git",
-                "reference": "4c65c3244470e2da44b0331efbefef5506a20fb2"
+                "reference": "faf54321caa9e16e4af172f467958c40cb5dd8c3"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/serversideup/spin/zipball/4c65c3244470e2da44b0331efbefef5506a20fb2",
-                "reference": "4c65c3244470e2da44b0331efbefef5506a20fb2",
+                "url": "https://api.github.com/repos/serversideup/spin/zipball/faf54321caa9e16e4af172f467958c40cb5dd8c3",
+                "reference": "faf54321caa9e16e4af172f467958c40cb5dd8c3",
                 "shasum": ""
             },
             "bin": [
@@ -16725,7 +17022,7 @@
             "description": "Replicate your production environment locally using Docker. Just run \"spin up\". It's really that easy.",
             "support": {
                 "issues": "https://github.com/serversideup/spin/issues",
-                "source": "https://github.com/serversideup/spin/tree/v3.3.0"
+                "source": "https://github.com/serversideup/spin/tree/v3.5.2"
             },
             "funding": [
                 {
@@ -16733,7 +17030,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-07-16T20:06:00+00:00"
+            "time": "2026-09-29T13:55:02+00:00"
         },
         {
             "name": "staabm/side-effects-detector",
@@ -16789,31 +17086,28 @@
         },
         {
             "name": "symfony/http-client",
-            "version": "v7.4.16",
+            "version": "v8.1.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-client.git",
-                "reference": "c513ed0ba5d1784a6b55fc84190dbe4451b12f41"
+                "reference": "e20aca4ceaa888197de5c792ffc551d99e43d98a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-client/zipball/c513ed0ba5d1784a6b55fc84190dbe4451b12f41",
-                "reference": "c513ed0ba5d1784a6b55fc84190dbe4451b12f41",
+                "url": "https://api.github.com/repos/symfony/http-client/zipball/e20aca4ceaa888197de5c792ffc551d99e43d98a",
+                "reference": "e20aca4ceaa888197de5c792ffc551d99e43d98a",
                 "shasum": ""
             },
             "require": {
-                "php": ">=8.2",
+                "php": ">=8.4.1",
                 "psr/log": "^1|^2|^3",
-                "symfony/deprecation-contracts": "^2.5|^3",
-                "symfony/http-client-contracts": "~3.4.4|^3.5.2",
-                "symfony/polyfill-php83": "^1.29",
+                "symfony/deprecation-contracts": "^2.5|^3.0",
+                "symfony/http-client-contracts": "^3.7",
                 "symfony/service-contracts": "^2.5|^3"
             },
             "conflict": {
-                "amphp/amp": "<2.5",
-                "amphp/socket": "<1.1",
-                "php-http/discovery": "<1.15",
-                "symfony/http-foundation": "<6.4"
+                "amphp/amp": "<3",
+                "php-http/discovery": "<1.15"
             },
             "provide": {
                 "php-http/async-client-implementation": "*",
@@ -16822,20 +17116,19 @@
                 "symfony/http-client-implementation": "3.0"
             },
             "require-dev": {
-                "amphp/http-client": "^4.2.1|^5.0",
-                "amphp/http-tunnel": "^1.0|^2.0",
-                "guzzlehttp/promises": "^1.4|^2.0",
+                "amphp/http-client": "^5.3.2",
+                "amphp/http-tunnel": "^2.0",
+                "guzzlehttp/guzzle": "^7.10|^8.0",
                 "nyholm/psr7": "^1.0",
                 "php-http/httplug": "^1.0|^2.0",
                 "psr/http-client": "^1.0",
-                "symfony/amphp-http-client-meta": "^1.0|^2.0",
-                "symfony/cache": "^6.4|^7.0|^8.0",
-                "symfony/dependency-injection": "^6.4|^7.0|^8.0",
-                "symfony/http-kernel": "^6.4|^7.0|^8.0",
-                "symfony/messenger": "^6.4|^7.0|^8.0",
-                "symfony/process": "^6.4|^7.0|^8.0",
-                "symfony/rate-limiter": "^6.4|^7.0|^8.0",
-                "symfony/stopwatch": "^6.4|^7.0|^8.0"
+                "symfony/cache": "^7.4|^8.0",
+                "symfony/dependency-injection": "^7.4|^8.0",
+                "symfony/http-kernel": "^7.4|^8.0",
+                "symfony/messenger": "^7.4|^8.0",
+                "symfony/process": "^7.4|^8.0",
+                "symfony/rate-limiter": "^7.4|^8.0",
+                "symfony/stopwatch": "^7.4|^8.0"
             },
             "type": "library",
             "autoload": {
@@ -16866,7 +17159,7 @@
                 "http"
             ],
             "support": {
-                "source": "https://github.com/symfony/http-client/tree/v7.4.16"
+                "source": "https://github.com/symfony/http-client/tree/v8.1.8"
             },
             "funding": [
                 {
@@ -16886,20 +17179,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-29T16:20:51+00:00"
+            "time": "2026-09-24T11:09:32+00:00"
         },
         {
             "name": "symfony/http-client-contracts",
-            "version": "v3.7.1",
+            "version": "v3.7.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-client-contracts.git",
-                "reference": "41fc42d276aeff21192465331ebbab7d83a743c0"
+                "reference": "35be0019e2c2c9fba80f9dc033290a5240f7b44f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-client-contracts/zipball/41fc42d276aeff21192465331ebbab7d83a743c0",
-                "reference": "41fc42d276aeff21192465331ebbab7d83a743c0",
+                "url": "https://api.github.com/repos/symfony/http-client-contracts/zipball/35be0019e2c2c9fba80f9dc033290a5240f7b44f",
+                "reference": "35be0019e2c2c9fba80f9dc033290a5240f7b44f",
                 "shasum": ""
             },
             "require": {
@@ -16948,7 +17241,7 @@
                 "standards"
             ],
             "support": {
-                "source": "https://github.com/symfony/http-client-contracts/tree/v3.7.1"
+                "source": "https://github.com/symfony/http-client-contracts/tree/v3.7.3"
             },
             "funding": [
                 {
@@ -16968,7 +17261,67 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-06-05T06:23:12+00:00"
+            "time": "2026-08-04T08:41:16+00:00"
+        },
+        {
+            "name": "symplify/rule-doc-generator-contracts",
+            "version": "11.2.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symplify/rule-doc-generator-contracts.git",
+                "reference": "479cfcfd46047f80624aba931d9789e50475b5c6"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symplify/rule-doc-generator-contracts/zipball/479cfcfd46047f80624aba931d9789e50475b5c6",
+                "reference": "479cfcfd46047f80624aba931d9789e50475b5c6",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "php-parallel-lint/php-parallel-lint": "^1.3",
+                "phpstan/extension-installer": "^1.2",
+                "rector/rector": "^0.15.10",
+                "symplify/easy-ci": "^11.1",
+                "symplify/easy-coding-standard": "^11.1",
+                "symplify/easy-testing": "^11.1",
+                "symplify/phpstan-extensions": "^11.1",
+                "symplify/phpstan-rules": "11.2.3.72",
+                "tomasvotruba/unused-public": "^0.0.34"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "11.2-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Symplify\\RuleDocGenerator\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "description": "Contracts for production code of RuleDocGenerator",
+            "support": {
+                "source": "https://github.com/symplify/rule-doc-generator-contracts/tree/11.2.0"
+            },
+            "funding": [
+                {
+                    "url": "https://www.paypal.me/rectorphp",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/tomasvotruba",
+                    "type": "github"
+                }
+            ],
+            "abandoned": true,
+            "time": "2024-03-18T22:02:54+00:00"
         },
         {
             "name": "ta-tikoma/phpunit-architecture-test",
diff --git a/config/app.php b/config/app.php
index 59aa6f4c28..43ce289433 100644
--- a/config/app.php
+++ b/config/app.php
@@ -11,6 +11,7 @@ use Illuminate\Auth\Passwords\PasswordResetServiceProvider;
 use Illuminate\Broadcasting\BroadcastServiceProvider;
 use Illuminate\Bus\BusServiceProvider;
 use Illuminate\Cache\CacheServiceProvider;
+use Illuminate\Concurrency\ConcurrencyServiceProvider;
 use Illuminate\Cookie\CookieServiceProvider;
 use Illuminate\Database\DatabaseServiceProvider;
 use Illuminate\Encryption\EncryptionServiceProvider;
@@ -217,6 +218,7 @@ return [
         BroadcastServiceProvider::class,
         BusServiceProvider::class,
         CacheServiceProvider::class,
+        ConcurrencyServiceProvider::class,
         ConsoleSupportServiceProvider::class,
         CookieServiceProvider::class,
         DatabaseServiceProvider::class,
diff --git a/config/constants.php b/config/constants.php
index 4a652fb3b9..a55249f041 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -5,8 +5,9 @@ $sshCommandTimeout = (int) env('SSH_COMMAND_TIMEOUT', 3600);
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.4.6',
-        'helper_version' => '1.0.17',
+        'version' => env('COOLIFY_VERSION') ?: '4.5.0',
+        'helper_version' => '1.0.18',
+        'railpack_version' => '0.40.1',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
         'base_config_path' => env('BASE_CONFIG_PATH', '/data/coolify'),
@@ -49,6 +50,12 @@ return [
         'host' => env('TERMINAL_HOST'),
         'port' => env('TERMINAL_PORT'),
         'command_timeout' => 0,
+        // Docker's default detach escape for `docker attach`. Pressing this
+        // sequence (Ctrl-P, Ctrl-Q) leaves the container's main process running.
+        'detach_keys' => 'ctrl-p,ctrl-q',
+        // Recent log lines shown when a console (attach) session opens, so the
+        // screen is not blank until the next line of live output arrives.
+        'console_history_lines' => 200,
     ],
 
     'pusher' => [
diff --git a/config/development-qemu.php b/config/development-qemu.php
index ed93362258..983cd587aa 100644
--- a/config/development-qemu.php
+++ b/config/development-qemu.php
@@ -145,7 +145,8 @@ return [
     'subnet' => $developmentQemuInstance === null ? '192.168.122.0/24' : "10.221.{$developmentQemuSlot}.0/24",
     'prefix' => 24,
     'dns' => '1.1.1.1',
-    'memory' => 2048,
+    // MiB per VM. Many dev instances share one host, so keep this small; existing VMs get it on their next start.
+    'memory' => (int) env('DEVELOPMENT_QEMU_MEMORY', 1024),
     'vcpus' => 2,
     'disk_size' => '20G',
     'libvirt_network' => $developmentQemuInstance === null ? 'default' : "coolify-dev-{$developmentQemuSlot}",
diff --git a/config/fortify.php b/config/fortify.php
index 5b7864af01..03b1c70ae0 100644
--- a/config/fortify.php
+++ b/config/fortify.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Middleware\ConfigurePasskeys;
 use App\Providers\RouteServiceProvider;
 use Laravel\Fortify\Features;
 
@@ -89,7 +90,7 @@ return [
     |
     */
 
-    'middleware' => ['web'],
+    'middleware' => ['web', ConfigurePasskeys::class],
 
     /*
     |--------------------------------------------------------------------------
@@ -106,6 +107,7 @@ return [
         'login' => 'login',
         'two-factor' => 'two-factor',
         'forgot-password' => 'forgot-password',
+        'passkeys' => 'passkeys',
     ],
 
     /*
@@ -121,6 +123,22 @@ return [
 
     'views' => true,
 
+    /*
+    |--------------------------------------------------------------------------
+    | Passkeys
+    |--------------------------------------------------------------------------
+    |
+    | Defaults only. ConfigurePasskeys sets the relying party for each request.
+    |
+    */
+
+    'passkeys' => [
+        'relying_party_id' => parse_url(config('app.url'), PHP_URL_HOST),
+        'allowed_origins' => [config('app.url')],
+        'user_handle_secret' => env('PASSKEYS_USER_HANDLE_SECRET', config('app.key')),
+        'timeout' => 60000,
+    ],
+
     /*
     |--------------------------------------------------------------------------
     | Features
@@ -142,6 +160,9 @@ return [
             'confirmPassword' => true,
             // 'window' => 0,
         ]),
+        Features::passkeys([
+            'confirmPassword' => true,
+        ]),
     ],
 
 ];
diff --git a/config/logging.php b/config/logging.php
index 40d372b58d..497d4bbdd5 100644
--- a/config/logging.php
+++ b/config/logging.php
@@ -1,5 +1,7 @@
 <?php
 
+use App\Logging\RedactSensitiveAuditData;
+use App\Logging\RedactSensitiveData;
 use Monolog\Handler\NullHandler;
 use Monolog\Handler\StreamHandler;
 use Monolog\Handler\SyslogUdpHandler;
@@ -50,6 +52,19 @@ return [
     |
     */
 
+    /*
+    |--------------------------------------------------------------------------
+    | Log Redaction
+    |--------------------------------------------------------------------------
+    |
+    | Secrets are removed from every log channel before a line is written.
+    | Self-hosted instances can set LOG_REDACTION_ENABLED=false to write the
+    | raw text, for example while debugging. Coolify Cloud always redacts.
+    |
+    */
+
+    'redaction_enabled' => (bool) env('LOG_REDACTION_ENABLED', true),
+
     'channels' => [
         'stack' => [
             'driver' => 'stack',
@@ -61,6 +76,7 @@ return [
             'driver' => 'single',
             'path' => storage_path('logs/laravel.log'),
             'level' => env('LOG_LEVEL', 'debug'),
+            'tap' => [RedactSensitiveData::class],
         ],
 
         'daily' => [
@@ -68,6 +84,7 @@ return [
             'path' => storage_path('logs/laravel.log'),
             'level' => env('LOG_LEVEL', 'debug'),
             'days' => 14,
+            'tap' => [RedactSensitiveData::class],
         ],
 
         'slack' => [
@@ -76,11 +93,13 @@ return [
             'username' => 'Laravel Log',
             'emoji' => ':boom:',
             'level' => env('LOG_LEVEL', 'critical'),
+            'tap' => [RedactSensitiveData::class],
         ],
 
         'papertrail' => [
             'driver' => 'monolog',
             'level' => env('LOG_LEVEL', 'debug'),
+            'tap' => [RedactSensitiveData::class],
             'handler' => env('LOG_PAPERTRAIL_HANDLER', SyslogUdpHandler::class),
             'handler_with' => [
                 'host' => env('PAPERTRAIL_URL'),
@@ -92,6 +111,7 @@ return [
         'stderr' => [
             'driver' => 'monolog',
             'level' => env('LOG_LEVEL', 'debug'),
+            'tap' => [RedactSensitiveData::class],
             'handler' => StreamHandler::class,
             'formatter' => env('LOG_STDERR_FORMATTER'),
             'with' => [
@@ -102,12 +122,14 @@ return [
         'syslog' => [
             'driver' => 'syslog',
             'level' => env('LOG_LEVEL', 'debug'),
+            'tap' => [RedactSensitiveData::class],
             'facility' => LOG_USER,
         ],
 
         'errorlog' => [
             'driver' => 'errorlog',
             'level' => env('LOG_LEVEL', 'debug'),
+            'tap' => [RedactSensitiveData::class],
         ],
 
         'null' => [
@@ -124,6 +146,7 @@ return [
             'path' => storage_path('logs/scheduled.log'),
             'level' => 'debug',
             'days' => 7,
+            'tap' => [RedactSensitiveData::class],
         ],
 
         'scheduled-errors' => [
@@ -131,6 +154,7 @@ return [
             'path' => storage_path('logs/scheduled-errors.log'),
             'level' => 'warning',
             'days' => 14,
+            'tap' => [RedactSensitiveData::class],
         ],
 
         'audit' => [
@@ -139,6 +163,7 @@ return [
             'level' => env('LOG_AUDIT_LEVEL', 'info'),
             'days' => env('LOG_AUDIT_DAYS', 90),
             'replace_placeholders' => true,
+            'tap' => [RedactSensitiveAuditData::class],
         ],
 
     ],
diff --git a/database/factories/ApplicationFactory.php b/database/factories/ApplicationFactory.php
index 2ffc9f07ce..8e797f0fa9 100644
--- a/database/factories/ApplicationFactory.php
+++ b/database/factories/ApplicationFactory.php
@@ -21,6 +21,9 @@ class ApplicationFactory extends Factory
             'ports_exposes' => '3000',
             'environment_id' => 1,
             'destination_id' => 1,
+            'http_basic_auth_bcrypt_cost' => 10,
+            'http_basic_auth_argon2id_memory_cost' => 65536,
+            'http_basic_auth_argon2id_time_cost' => 4,
         ];
     }
 }
diff --git a/database/migrations/2026_07_10_210239_add_hostinger_virtual_machine_fields_to_servers_table.php b/database/migrations/2026_07_10_210239_add_hostinger_virtual_machine_fields_to_servers_table.php
new file mode 100644
index 0000000000..496b2a3bce
--- /dev/null
+++ b/database/migrations/2026_07_10_210239_add_hostinger_virtual_machine_fields_to_servers_table.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('servers', function (Blueprint $table) {
+            $table->bigInteger('hostinger_virtual_machine_id')->nullable()->after('digitalocean_droplet_status');
+            $table->string('hostinger_virtual_machine_status')->nullable()->after('hostinger_virtual_machine_id');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('servers', function (Blueprint $table) {
+            $table->dropColumn([
+                'hostinger_virtual_machine_status',
+                'hostinger_virtual_machine_id',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_24_055934_add_cloudwatch_log_drain_to_server_settings_table.php b/database/migrations/2026_09_24_055934_add_cloudwatch_log_drain_to_server_settings_table.php
new file mode 100644
index 0000000000..97fbd6eecc
--- /dev/null
+++ b/database/migrations/2026_09_24_055934_add_cloudwatch_log_drain_to_server_settings_table.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('server_settings', function (Blueprint $table) {
+            $table->boolean('is_logdrain_cloudwatch_enabled')->default(false);
+            $table->string('logdrain_cloudwatch_region')->nullable();
+            $table->string('logdrain_cloudwatch_group', 512)->nullable();
+            $table->string('logdrain_cloudwatch_stream_prefix')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('server_settings', function (Blueprint $table) {
+            $table->dropColumn([
+                'is_logdrain_cloudwatch_enabled',
+                'logdrain_cloudwatch_region',
+                'logdrain_cloudwatch_group',
+                'logdrain_cloudwatch_stream_prefix',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_25_105051_add_redact_all_env_values_in_logs_to_resources.php b/database/migrations/2026_09_25_105051_add_redact_all_env_values_in_logs_to_resources.php
new file mode 100644
index 0000000000..0944bc2daa
--- /dev/null
+++ b/database/migrations/2026_09_25_105051_add_redact_all_env_values_in_logs_to_resources.php
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('application_settings', function (Blueprint $table) {
+            $table->boolean('redact_all_env_values_in_logs')->default(true);
+        });
+        Schema::table('services', function (Blueprint $table) {
+            $table->boolean('redact_all_env_values_in_logs')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('application_settings', function (Blueprint $table) {
+            $table->dropColumn('redact_all_env_values_in_logs');
+        });
+        Schema::table('services', function (Blueprint $table) {
+            $table->dropColumn('redact_all_env_values_in_logs');
+        });
+    }
+};
diff --git a/database/migrations/2026_10_01_132654_add_proxy_error_page_to_servers_table.php b/database/migrations/2026_10_01_132654_add_proxy_error_page_to_servers_table.php
new file mode 100644
index 0000000000..ad1a318250
--- /dev/null
+++ b/database/migrations/2026_10_01_132654_add_proxy_error_page_to_servers_table.php
@@ -0,0 +1,25 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Custom HTML that the proxy shows (with status 503) for requests that no resource handles.
+     */
+    public function up(): void
+    {
+        Schema::table('servers', function (Blueprint $table) {
+            $table->text('proxy_error_page')->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('servers', function (Blueprint $table) {
+            $table->dropColumn('proxy_error_page');
+        });
+    }
+};
diff --git a/database/migrations/2026_10_01_161644_add_maintenance_mode_to_applications_and_services_tables.php b/database/migrations/2026_10_01_161644_add_maintenance_mode_to_applications_and_services_tables.php
new file mode 100644
index 0000000000..cdafafc9e3
--- /dev/null
+++ b/database/migrations/2026_10_01_161644_add_maintenance_mode_to_applications_and_services_tables.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Maintenance mode: the proxy shows a maintenance page (status 503) instead of the resource.
+     */
+    public function up(): void
+    {
+        foreach (['applications', 'services'] as $table) {
+            Schema::table($table, function (Blueprint $table) {
+                $table->boolean('is_maintenance_enabled')->default(false);
+                $table->text('maintenance_page')->nullable();
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        foreach (['applications', 'services'] as $table) {
+            Schema::table($table, function (Blueprint $table) {
+                $table->dropColumn(['is_maintenance_enabled', 'maintenance_page']);
+            });
+        }
+    }
+};
diff --git a/database/migrations/2026_10_02_170101_add_http_basic_auth_hash_options_to_applications_table.php b/database/migrations/2026_10_02_170101_add_http_basic_auth_hash_options_to_applications_table.php
new file mode 100644
index 0000000000..17212a63a6
--- /dev/null
+++ b/database/migrations/2026_10_02_170101_add_http_basic_auth_hash_options_to_applications_table.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->string('http_basic_auth_hash_algorithm')->default('bcrypt');
+            $table->unsignedTinyInteger('http_basic_auth_bcrypt_cost')->default(10);
+            $table->unsignedInteger('http_basic_auth_argon2id_memory_cost')->default(65536);
+            $table->unsignedTinyInteger('http_basic_auth_argon2id_time_cost')->default(4);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn([
+                'http_basic_auth_hash_algorithm',
+                'http_basic_auth_bcrypt_cost',
+                'http_basic_auth_argon2id_memory_cost',
+                'http_basic_auth_argon2id_time_cost',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_10_07_125311_add_cloudflare_tunnel_api_fields_to_server_settings.php b/database/migrations/2026_10_07_125311_add_cloudflare_tunnel_api_fields_to_server_settings.php
new file mode 100644
index 0000000000..41cf9e0094
--- /dev/null
+++ b/database/migrations/2026_10_07_125311_add_cloudflare_tunnel_api_fields_to_server_settings.php
@@ -0,0 +1,31 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('server_settings', function (Blueprint $table) {
+            $table->string('cloudflare_tunnel_id')->nullable();
+            $table->string('cloudflare_tunnel_account_id')->nullable();
+            $table->foreignId('cloudflare_tunnel_integration_token_id')->nullable()->constrained('integration_tokens')->nullOnDelete();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('server_settings', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('cloudflare_tunnel_integration_token_id');
+            $table->dropColumn(['cloudflare_tunnel_id', 'cloudflare_tunnel_account_id']);
+        });
+    }
+};
diff --git a/database/migrations/2026_10_07_150000_create_backup_s3_destination_tables.php b/database/migrations/2026_10_07_150000_create_backup_s3_destination_tables.php
new file mode 100644
index 0000000000..39aff70ad2
--- /dev/null
+++ b/database/migrations/2026_10_07_150000_create_backup_s3_destination_tables.php
@@ -0,0 +1,126 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('scheduled_database_backup_s3_storage', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('scheduled_database_backup_id')
+                ->constrained(indexName: 'db_backup_s3_storage_backup_fk')
+                ->cascadeOnDelete();
+            $table->foreignId('s3_storage_id')
+                ->constrained(indexName: 'db_backup_s3_storage_storage_fk')
+                ->cascadeOnDelete();
+            $table->timestamps();
+            $table->unique(['scheduled_database_backup_id', 's3_storage_id'], 'db_backup_s3_storage_unique');
+        });
+
+        Schema::create('scheduled_volume_backup_s3_storage', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('scheduled_volume_backup_id')
+                ->constrained(indexName: 'volume_backup_s3_storage_backup_fk')
+                ->cascadeOnDelete();
+            $table->foreignId('s3_storage_id')
+                ->constrained(indexName: 'volume_backup_s3_storage_storage_fk')
+                ->cascadeOnDelete();
+            $table->timestamps();
+            $table->unique(['scheduled_volume_backup_id', 's3_storage_id'], 'volume_backup_s3_storage_unique');
+        });
+
+        Schema::create('database_backup_s3_replicas', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('execution_id')
+                ->index()
+                ->constrained('scheduled_database_backup_executions', indexName: 'db_backup_s3_replicas_execution_fk')
+                ->cascadeOnDelete();
+            $table->foreignId('s3_storage_id')
+                ->nullable()
+                ->constrained(indexName: 'db_backup_s3_replicas_storage_fk')
+                ->nullOnDelete();
+            $table->boolean('s3_uploaded')->nullable();
+            $table->boolean('s3_storage_deleted')->default(false);
+            $table->text('message')->nullable();
+            $table->timestamps();
+        });
+
+        Schema::create('volume_backup_s3_replicas', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('execution_id')
+                ->index()
+                ->constrained('scheduled_volume_backup_executions', indexName: 'volume_backup_s3_replicas_execution_fk')
+                ->cascadeOnDelete();
+            $table->foreignId('s3_storage_id')
+                ->nullable()
+                ->constrained(indexName: 'volume_backup_s3_replicas_storage_fk')
+                ->nullOnDelete();
+            $table->boolean('s3_uploaded')->nullable();
+            $table->boolean('s3_storage_deleted')->default(false);
+            $table->text('message')->nullable();
+            $table->timestamps();
+        });
+
+        $this->backfill();
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('volume_backup_s3_replicas');
+        Schema::dropIfExists('database_backup_s3_replicas');
+        Schema::dropIfExists('scheduled_volume_backup_s3_storage');
+        Schema::dropIfExists('scheduled_database_backup_s3_storage');
+    }
+
+    /**
+     * Copies the single S3 destination of existing schedules and executions into the new tables.
+     */
+    private function backfill(): void
+    {
+        $now = now();
+
+        DB::table('scheduled_database_backup_s3_storage')->insertUsing(
+            ['scheduled_database_backup_id', 's3_storage_id', 'created_at', 'updated_at'],
+            DB::table('scheduled_database_backups')
+                ->join('s3_storages', 's3_storages.id', '=', 'scheduled_database_backups.s3_storage_id')
+                ->select('scheduled_database_backups.id', 'scheduled_database_backups.s3_storage_id')
+                ->selectRaw('?, ?', [$now, $now]),
+        );
+
+        DB::table('scheduled_volume_backup_s3_storage')->insertUsing(
+            ['scheduled_volume_backup_id', 's3_storage_id', 'created_at', 'updated_at'],
+            DB::table('scheduled_volume_backups')
+                ->whereNotNull('s3_storage_id')
+                ->select('id', 's3_storage_id')
+                ->selectRaw('?, ?', [$now, $now]),
+        );
+
+        // Database executions have no storage column: the copy went to the storage of the schedule.
+        DB::table('database_backup_s3_replicas')->insertUsing(
+            ['execution_id', 's3_storage_id', 's3_uploaded', 's3_storage_deleted', 'created_at', 'updated_at'],
+            DB::table('scheduled_database_backup_executions')
+                ->join('scheduled_database_backups', 'scheduled_database_backups.id', '=', 'scheduled_database_backup_executions.scheduled_database_backup_id')
+                ->leftJoin('s3_storages', 's3_storages.id', '=', 'scheduled_database_backups.s3_storage_id')
+                ->whereNotNull('scheduled_database_backup_executions.s3_uploaded')
+                ->select(
+                    'scheduled_database_backup_executions.id',
+                    's3_storages.id',
+                    'scheduled_database_backup_executions.s3_uploaded',
+                    'scheduled_database_backup_executions.s3_storage_deleted',
+                )
+                ->selectRaw('?, ?', [$now, $now]),
+        );
+
+        DB::table('volume_backup_s3_replicas')->insertUsing(
+            ['execution_id', 's3_storage_id', 's3_uploaded', 's3_storage_deleted', 'created_at', 'updated_at'],
+            DB::table('scheduled_volume_backup_executions')
+                ->whereNotNull('s3_storage_id')
+                ->select('id', 's3_storage_id', 's3_uploaded', 's3_storage_deleted')
+                ->selectRaw('?, ?', [$now, $now]),
+        );
+    }
+};
diff --git a/database/migrations/2026_10_12_002632_add_is_backup_before_update_enabled_to_instance_settings_table.php b/database/migrations/2026_10_12_002632_add_is_backup_before_update_enabled_to_instance_settings_table.php
new file mode 100644
index 0000000000..ff6cc2509e
--- /dev/null
+++ b/database/migrations/2026_10_12_002632_add_is_backup_before_update_enabled_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->boolean('is_backup_before_update_enabled')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('is_backup_before_update_enabled');
+        });
+    }
+};
diff --git a/database/migrations/2026_10_12_100000_create_gitea_apps_table.php b/database/migrations/2026_10_12_100000_create_gitea_apps_table.php
new file mode 100644
index 0000000000..336ea1b3bb
--- /dev/null
+++ b/database/migrations/2026_10_12_100000_create_gitea_apps_table.php
@@ -0,0 +1,43 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('gitea_apps', function (Blueprint $table) {
+            $table->id();
+            $table->string('uuid')->unique();
+            $table->string('name');
+
+            $table->string('organization')->nullable();
+            $table->string('api_url');
+            $table->string('html_url');
+            $table->integer('custom_port')->default(22);
+            $table->string('custom_user')->default('git');
+            $table->boolean('is_system_wide')->default(false);
+            $table->boolean('is_public')->default(false);
+
+            $table->longText('client_id')->nullable();
+            $table->longText('client_secret')->nullable();
+            $table->longText('access_token')->nullable();
+            $table->longText('refresh_token')->nullable();
+            $table->integer('expires_at')->nullable();
+            $table->string('redirect_uri')->nullable();
+            $table->longText('webhook_secret')->nullable();
+
+            $table->foreignId('private_key_id')->nullable();
+            $table->foreignId('team_id');
+
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('gitea_apps');
+    }
+};
diff --git a/database/migrations/2026_10_12_154805_add_application_id_index_to_application_settings_table.php b/database/migrations/2026_10_12_154805_add_application_id_index_to_application_settings_table.php
new file mode 100644
index 0000000000..da19a54fb4
--- /dev/null
+++ b/database/migrations/2026_10_12_154805_add_application_id_index_to_application_settings_table.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        if (Schema::hasIndex('application_settings', ['application_id'])) {
+            return;
+        }
+
+        Schema::table('application_settings', function (Blueprint $table) {
+            $table->index('application_id');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        if (! Schema::hasIndex('application_settings', ['application_id'])) {
+            return;
+        }
+
+        Schema::table('application_settings', function (Blueprint $table) {
+            $table->dropIndex(['application_id']);
+        });
+    }
+};
diff --git a/database/migrations/2026_10_12_164601_create_passkeys_table.php b/database/migrations/2026_10_12_164601_create_passkeys_table.php
new file mode 100644
index 0000000000..97d6bf59b1
--- /dev/null
+++ b/database/migrations/2026_10_12_164601_create_passkeys_table.php
@@ -0,0 +1,42 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('passkeys', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->string('name');
+            $table->string('credential_id')->unique();
+            $table->json('credential');
+            $table->timestamp('last_used_at')->nullable();
+            $table->timestamps();
+
+            $table->index('user_id');
+        });
+
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->boolean('is_passkey_enabled')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('is_passkey_enabled');
+        });
+
+        Schema::dropIfExists('passkeys');
+    }
+};
diff --git a/database/migrations/2026_10_12_192444_add_canvas_positions_to_environments_table.php b/database/migrations/2026_10_12_192444_add_canvas_positions_to_environments_table.php
new file mode 100644
index 0000000000..aa4a3c3040
--- /dev/null
+++ b/database/migrations/2026_10_12_192444_add_canvas_positions_to_environments_table.php
@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('environments', function (Blueprint $table) {
+            $table->json('canvas_positions')->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('environments', function (Blueprint $table) {
+            $table->dropColumn('canvas_positions');
+        });
+    }
+};
diff --git a/database/migrations/2026_10_12_192445_create_resource_links_table.php b/database/migrations/2026_10_12_192445_create_resource_links_table.php
new file mode 100644
index 0000000000..6626982a51
--- /dev/null
+++ b/database/migrations/2026_10_12_192445_create_resource_links_table.php
@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('resource_links', function (Blueprint $table) {
+            $table->id();
+            $table->string('uuid')->unique();
+            $table->foreignId('environment_id')->constrained()->cascadeOnDelete();
+            $table->morphs('source');
+            $table->morphs('target');
+            $table->string('label', 64)->nullable();
+            $table->foreignId('created_by')->nullable()->constrained('users')->nullOnDelete();
+            $table->timestamps();
+
+            $table->unique(['environment_id', 'source_type', 'source_id', 'target_type', 'target_id'], 'resource_links_unique_direction');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('resource_links');
+    }
+};
diff --git a/database/migrations/2026_10_13_101731_add_redact_all_env_values_in_logs_to_standalone_databases.php b/database/migrations/2026_10_13_101731_add_redact_all_env_values_in_logs_to_standalone_databases.php
new file mode 100644
index 0000000000..28af764121
--- /dev/null
+++ b/database/migrations/2026_10_13_101731_add_redact_all_env_values_in_logs_to_standalone_databases.php
@@ -0,0 +1,50 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    private array $tables = [
+        'standalone_postgresqls',
+        'standalone_redis',
+        'standalone_mongodbs',
+        'standalone_mysqls',
+        'standalone_mariadbs',
+        'standalone_keydbs',
+        'standalone_dragonflies',
+        'standalone_clickhouses',
+        'standalone_sqlites',
+    ];
+
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        foreach ($this->tables as $table) {
+            if (Schema::hasColumn($table, 'redact_all_env_values_in_logs')) {
+                continue;
+            }
+            Schema::table($table, function (Blueprint $table) {
+                $table->boolean('redact_all_env_values_in_logs')->default(true);
+            });
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        foreach ($this->tables as $table) {
+            if (! Schema::hasColumn($table, 'redact_all_env_values_in_logs')) {
+                continue;
+            }
+            Schema::table($table, function (Blueprint $table) {
+                $table->dropColumn('redact_all_env_values_in_logs');
+            });
+        }
+    }
+};
diff --git a/database/migrations/2026_10_13_132049_add_avatar_columns_to_teams_table.php b/database/migrations/2026_10_13_132049_add_avatar_columns_to_teams_table.php
new file mode 100644
index 0000000000..2bb341cbb3
--- /dev/null
+++ b/database/migrations/2026_10_13_132049_add_avatar_columns_to_teams_table.php
@@ -0,0 +1,31 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('teams', function (Blueprint $table) {
+            $table->string('avatar_path')->nullable();
+            $table->string('avatar_storage_type')->nullable();
+            $table->foreignId('avatar_s3_storage_id')->nullable()->constrained('s3_storages')->nullOnDelete();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('teams', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('avatar_s3_storage_id');
+            $table->dropColumn(['avatar_path', 'avatar_storage_type']);
+        });
+    }
+};
diff --git a/database/migrations/2026_10_14_105230_add_file_download_storage_to_instance_settings_table.php b/database/migrations/2026_10_14_105230_add_file_download_storage_to_instance_settings_table.php
new file mode 100644
index 0000000000..ff1a43faba
--- /dev/null
+++ b/database/migrations/2026_10_14_105230_add_file_download_storage_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->foreignId('file_download_s3_storage_id')->nullable()->constrained('s3_storages')->nullOnDelete();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('file_download_s3_storage_id');
+        });
+    }
+};
diff --git a/database/migrations/2026_10_18_120000_add_deployment_commit_details_to_email_notification_settings.php b/database/migrations/2026_10_18_120000_add_deployment_commit_details_to_email_notification_settings.php
new file mode 100644
index 0000000000..2f8e613206
--- /dev/null
+++ b/database/migrations/2026_10_18_120000_add_deployment_commit_details_to_email_notification_settings.php
@@ -0,0 +1,26 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasColumn('email_notification_settings', 'deployment_commit_details_email_notifications')) {
+            Schema::table('email_notification_settings', function (Blueprint $table) {
+                $table->boolean('deployment_commit_details_email_notifications')->default(false);
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        if (Schema::hasColumn('email_notification_settings', 'deployment_commit_details_email_notifications')) {
+            Schema::table('email_notification_settings', function (Blueprint $table) {
+                $table->dropColumn('deployment_commit_details_email_notifications');
+            });
+        }
+    }
+};
diff --git a/database/migrations/2026_10_19_082209_add_patch_check_to_server_settings_table.php b/database/migrations/2026_10_19_082209_add_patch_check_to_server_settings_table.php
new file mode 100644
index 0000000000..4b6f0bd79a
--- /dev/null
+++ b/database/migrations/2026_10_19_082209_add_patch_check_to_server_settings_table.php
@@ -0,0 +1,25 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('server_settings', function (Blueprint $table) {
+            $table->string('patch_check_frequency')->nullable();
+            $table->json('patch_check_result')->nullable();
+            $table->text('patch_check_error')->nullable();
+            $table->timestamp('patch_checked_at')->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('server_settings', function (Blueprint $table) {
+            $table->dropColumn(['patch_check_frequency', 'patch_check_result', 'patch_check_error', 'patch_checked_at']);
+        });
+    }
+};
diff --git a/database/migrations/2026_10_19_120000_add_auto_security_updates_to_server_settings_table.php b/database/migrations/2026_10_19_120000_add_auto_security_updates_to_server_settings_table.php
new file mode 100644
index 0000000000..507da0a86a
--- /dev/null
+++ b/database/migrations/2026_10_19_120000_add_auto_security_updates_to_server_settings_table.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('server_settings', function (Blueprint $table) {
+            $table->boolean('is_auto_security_updates_enabled')->default(false);
+            $table->string('auto_security_updates_time')->default('03:00');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('server_settings', function (Blueprint $table) {
+            $table->dropColumn(['is_auto_security_updates_enabled', 'auto_security_updates_time']);
+        });
+    }
+};
diff --git a/docker-compose.dev-multi.yml b/docker-compose.dev-multi.yml
index 153e1c9a1b..1b5e3fad10 100644
--- a/docker-compose.dev-multi.yml
+++ b/docker-compose.dev-multi.yml
@@ -181,7 +181,10 @@ services:
     volumes:
       - minio_data:/data
     networks:
-      - coolify
+      coolify:
+        # The seeded "Local MinIO" storage (S3StorageSeeder) uses http://coolify-minio:9000.
+        aliases:
+          - coolify-minio
 
   minio-init:
     profiles: ["minio"]
diff --git a/docker-compose.dev-side-by-side.yml b/docker-compose.dev-side-by-side.yml
new file mode 100644
index 0000000000..5c8404495a
--- /dev/null
+++ b/docker-compose.dev-side-by-side.yml
@@ -0,0 +1,9 @@
+# Added by scripts/dev for side-by-side instances (COOLIFY_DEV_SIDE_BY_SIDE=1). Two instances of one
+# checkout share storage/, and both have a server with the uuid "localhost", so they would share the
+# SSH key and multiplexing files. This gives the instance its own SSH folder.
+services:
+  coolify:
+    volumes:
+      - ssh_data:/var/www/html/storage/app/ssh
+volumes:
+  ssh_data:
diff --git a/docker/coolify-helper/Dockerfile b/docker/coolify-helper/Dockerfile
index 1fe99f01c2..b3c068f437 100644
--- a/docker/coolify-helper/Dockerfile
+++ b/docker/coolify-helper/Dockerfile
@@ -12,9 +12,9 @@ ARG PACK_VERSION=0.38.2
 # https://github.com/railwayapp/nixpacks/releases
 ARG NIXPACKS_VERSION=1.41.0
 # https://github.com/railwayapp/railpack/releases
-ARG RAILPACK_VERSION=0.23.0
-# https://github.com/jdx/mise/releases — must match railpack's pinned version (https://raw.githubusercontent.com/railwayapp/railpack/refs/heads/main/core/mise/version.txt)
-ARG MISE_VERSION=2026.3.17
+ARG RAILPACK_VERSION=0.40.1
+# https://github.com/jdx/mise/releases — must match the version pinned at that railpack tag (https://raw.githubusercontent.com/railwayapp/railpack/v${RAILPACK_VERSION}/core/mise/version.txt)
+ARG MISE_VERSION=2026.9.15
 FROM quay.io/minio/aistor/mc:RELEASE.2026-09-06T02-44-40Z AS minio-client
 
 FROM ${BASE_IMAGE} AS base
@@ -36,7 +36,7 @@ RUN apk upgrade --no-cache && \
 RUN mkdir -p ~/.docker/cli-plugins
 
 # Install mise (musl build) at the path railpack expects (/tmp/railpack/mise/mise-VERSION).
-# Railpack hardcodes a glibc mise download that fails on Alpine, so we pre-place a musl binary.
+# Railpack skips its own mise download when this file exists.
 RUN mkdir -p /tmp/railpack/mise && \
     if [[ ${TARGETPLATFORM} == 'linux/amd64' ]]; then \
         curl -sSL "https://github.com/jdx/mise/releases/download/v${MISE_VERSION}/mise-v${MISE_VERSION}-linux-x64-musl.tar.gz" | tar xz && \
diff --git a/docker/coolify-terminal/terminal-server.js b/docker/coolify-terminal/terminal-server.js
index 92c6b84f11..8f34970a9c 100755
--- a/docker/coolify-terminal/terminal-server.js
+++ b/docker/coolify-terminal/terminal-server.js
@@ -11,8 +11,10 @@ import {
     extractSshArgs,
     extractTargetHost,
     extractTimeout,
+    detachPtyProcess,
     getTerminalProcessEnv,
     getTerminalSessionTimeout,
+    isAttachCommand,
     isAuthorizedTargetHost,
     rejectTerminalSocket,
     sanitizeSshArgs,
@@ -423,10 +425,13 @@ async function handleCommand(ws, command, userId) {
 
     userSession.ptyProcess = ptyProcess;
     userSession.isActive = true;
+    // Attach sessions share the container's main process, so they must be detached, not killed.
+    userSession.isAttach = isAttachCommand(hereDocContent);
 
     ws.send('pty-ready');
 
     ptyProcess.onData((data) => {
+        if (userSession.ptyProcess !== ptyProcess) return;
         ws.send(data);
     });
 
@@ -437,6 +442,14 @@ async function handleCommand(ws, command, userId) {
             exitCode,
             signal,
         });
+
+        // A previous PTY can exit late (e.g. an attach session detaching during a mode
+        // switch) after its replacement is already spawned. Only mutate the shared session
+        // state when this exit belongs to the session's current PTY.
+        if (userSession.ptyProcess !== ptyProcess) {
+            return;
+        }
+
         ws.send('pty-exited');
         userSession.isActive = false;
 
@@ -503,6 +516,10 @@ async function killPtyProcess(userId) {
     const session = userSessions.get(userId);
     if (!session?.ptyProcess) return false;
 
+    if (session.isAttach) {
+        return detachPtyProcess(session);
+    }
+
     return new Promise((resolve) => {
         // Loop to ensure terminal is killed before continuing
         let killAttempts = 0;
diff --git a/docker/coolify-terminal/terminal-utils.js b/docker/coolify-terminal/terminal-utils.js
index a1207b028a..6acb9645a6 100644
--- a/docker/coolify-terminal/terminal-utils.js
+++ b/docker/coolify-terminal/terminal-utils.js
@@ -138,6 +138,12 @@ export function extractTimeout(commandString) {
     return timeoutMatch ? parseInt(timeoutMatch[1], 10) : null;
 }
 
+// A `docker attach` session shares the container's main process. On disconnect we
+// must detach from it instead of killing it, otherwise we stop the running app.
+export function isAttachCommand(commandString) {
+    return /(?:^|\s)docker\s+attach(?:\s|$)/.test(commandString || '');
+}
+
 function normalizeShellArgument(argument) {
     if (!argument) {
         return argument;
@@ -393,3 +399,53 @@ export function sanitizeSshArgs(sshArgs) {
 
     return sanitizedArgs;
 }
+
+// Wait for this PTY to exit, not for mutable session state to change.
+export function detachPtyProcess(session) {
+    const ptyProcess = session.ptyProcess;
+    if (!ptyProcess || !session.isActive) return Promise.resolve(true);
+
+    return new Promise((resolve) => {
+        let timer;
+        let attempts = 0;
+        let settled = false;
+        const finish = (exited) => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            exitListener.dispose();
+            if (exited && session.ptyProcess === ptyProcess) {
+                session.isActive = false;
+                session.ptyProcess = null;
+                clearTimeout(session.terminalSessionTimer);
+                session.terminalSessionTimer = null;
+            }
+            resolve(exited);
+        };
+        const exitListener = ptyProcess.onExit(() => finish(true));
+        const attemptDetach = () => {
+            attempts++;
+            try {
+                ptyProcess.write('\x10\x11');
+            } catch (_) {
+                // An exit event is still required to confirm teardown.
+            }
+            if (settled) return;
+            timer = setTimeout(() => {
+                if (attempts < 3) {
+                    attemptDetach();
+                    return;
+                }
+                // --sig-proxy=false prevents forwarding signals to the container.
+                // Refuse a replacement if killing the local SSH client does not exit.
+                timer = setTimeout(() => finish(false), 1000);
+                try {
+                    ptyProcess.kill();
+                } catch (_) {
+                    // The bounded exit wait fails closed.
+                }
+            }, 500);
+        };
+        attemptDetach();
+    });
+}
diff --git a/docker/coolify-terminal/terminal-utils.test.js b/docker/coolify-terminal/terminal-utils.test.js
index fd6297fad4..b00dfa7d9f 100644
--- a/docker/coolify-terminal/terminal-utils.test.js
+++ b/docker/coolify-terminal/terminal-utils.test.js
@@ -9,6 +9,8 @@ import {
     extractTargetHost,
     getTerminalProcessEnv,
     getTerminalSessionTimeout,
+    isAttachCommand,
+    detachPtyProcess,
     isAuthorizedTargetHost,
     normalizeHostForAuthorization,
     rejectTerminalSocket,
@@ -16,6 +18,16 @@ import {
     validateSshArgs,
 } from './terminal-utils.js';
 
+test('isAttachCommand detects a docker attach session', () => {
+    assert.equal(isAttachCommand('docker attach --detach-keys="ctrl-p,ctrl-q" --sig-proxy=false \'minecraft\''), true);
+    assert.equal(isAttachCommand('sudo docker attach --sig-proxy=false \'minecraft\''), true);
+});
+
+test('isAttachCommand does not match a docker exec shell session', () => {
+    assert.equal(isAttachCommand("docker exec -it 'web-1' sh -c 'exec $SHELL'"), false);
+    assert.equal(isAttachCommand(''), false);
+});
+
 test('getTerminalProcessEnv preserves the PATH needed by SSH proxy commands', () => {
     assert.deepEqual(getTerminalProcessEnv({
         PATH: '/usr/local/bin:/usr/bin:/bin',
@@ -458,3 +470,63 @@ test('rejectTerminalSocket handles socket errors so unauthenticated clients cann
     assert.equal(ws.terminated, true);
     ws.peerClosed();
 });
+
+function attachSession() {
+    const listeners = new Set();
+    const process = {
+        writes: [],
+        kills: 0,
+        write(data) { this.writes.push(data); },
+        kill() { this.kills++; },
+        onExit(listener) {
+            listeners.add(listener);
+            return { dispose: () => listeners.delete(listener) };
+        },
+        exit() { for (const listener of [...listeners]) listener({ exitCode: 0 }); },
+    };
+    return { ptyProcess: process, isActive: true, terminalSessionTimer: null };
+}
+
+test('attach teardown waits for delayed exit after the kill fallback', async (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const session = attachSession();
+    const process = session.ptyProcess;
+    let resolved = false;
+    const completion = detachPtyProcess(session).then(result => { resolved = true; return result; });
+    for (let i = 0; i < 3; i++) t.mock.timers.tick(500);
+    await Promise.resolve();
+    assert.equal(process.kills, 1);
+    assert.equal(resolved, false);
+    assert.deepEqual(process.writes, ['\x10\x11', '\x10\x11', '\x10\x11']);
+    process.exit();
+    assert.equal(await completion, true);
+    assert.equal(session.isActive, false);
+    assert.equal(session.ptyProcess, null);
+});
+
+test('late attach exit cannot clear a replacement session or its timer', async (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const session = attachSession();
+    const process = session.ptyProcess;
+    const completion = detachPtyProcess(session);
+    const replacement = attachSession().ptyProcess;
+    session.ptyProcess = replacement;
+    const timer = setTimeout(() => {}, 10000);
+    session.terminalSessionTimer = timer;
+    process.exit();
+    assert.equal(await completion, true);
+    assert.equal(session.isActive, true);
+    assert.equal(session.ptyProcess, replacement);
+    assert.equal(session.terminalSessionTimer, timer);
+    t.mock.timers.tick(3000);
+    assert.equal(replacement.writes.length, 0);
+});
+
+test('attach teardown fails closed if the PTY never exits', async (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const session = attachSession();
+    const completion = detachPtyProcess(session);
+    for (let i = 0; i < 5; i++) t.mock.timers.tick(500);
+    assert.equal(await completion, false);
+    assert.equal(session.isActive, true);
+});
diff --git a/docker/development/Dockerfile b/docker/development/Dockerfile
index 9d48baf19d..a7ce68dffd 100644
--- a/docker/development/Dockerfile
+++ b/docker/development/Dockerfile
@@ -1,9 +1,8 @@
 # Versions
 # https://hub.docker.com/r/serversideup/php/tags?name=8.4-fpm-nginx-alpine
-# Pinned: v5 moved user bundles to /etc/s6-overlay/user-bundles.d and breaks startup (#12141)
-ARG SERVERSIDEUP_PHP_VERSION=8.4-fpm-nginx-alpine-v4.5.1
+ARG SERVERSIDEUP_PHP_VERSION=8.4-fpm-nginx-alpine-v5.0.2
 # https://github.com/cloudflare/cloudflared/releases
-ARG CLOUDFLARED_VERSION=2025.7.0
+ARG CLOUDFLARED_VERSION=2026.10.3
 # https://www.postgresql.org/support/versioning/
 # Note: We are using version 18 of the postgres client (while still using postgres 15 for the postgres server) as version 15 has been removed from Alpine 3.23+ https://pkgs.alpinelinux.org/packages?name=postgresql*-client&branch=v3.23&repo=&arch=x86_64&origin=&flagged=&maintainer=
 ARG POSTGRES_VERSION=18
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/horizon b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/horizon
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/horizon
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/horizon
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/init-setup b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/init-setup
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/init-setup
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/init-setup
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/reverb b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/reverb
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/reverb
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/reverb
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/scheduler-worker b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/scheduler-worker
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/scheduler-worker
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/scheduler-worker
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/terminal-server b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/terminal-server
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/terminal-server
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/terminal-server
diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile
index 46d5c40c4a..108417d79e 100644
--- a/docker/production/Dockerfile
+++ b/docker/production/Dockerfile
@@ -1,14 +1,15 @@
 # Versions
 # https://hub.docker.com/r/serversideup/php/tags?name=8.4-fpm-nginx-alpine
-# Pinned: v5 moved user bundles to /etc/s6-overlay/user-bundles.d and breaks startup (#12141)
-ARG SERVERSIDEUP_PHP_VERSION=8.4-fpm-nginx-alpine-v4.5.1
+ARG SERVERSIDEUP_PHP_VERSION=8.4-fpm-nginx-alpine-v5.0.2
 # https://github.com/cloudflare/cloudflared/releases
-ARG CLOUDFLARED_VERSION=2026.7.3
+ARG CLOUDFLARED_VERSION=2026.10.3
 # https://www.postgresql.org/support/versioning/
 # Note: We are using version 18 of the postgres client (while still using postgres 15 for the postgres server) as version 15 has been removed from Alpine 3.23+ https://pkgs.alpinelinux.org/packages?name=postgresql*-client&branch=v3.23&repo=&arch=x86_64&origin=&flagged=&maintainer=
 ARG POSTGRES_VERSION=18
 # https://nginx.org/en/linux_packages.html
 ARG NGINX_VERSION=1.31.2-r1
+# https://nodejs.org/en/about/previous-releases
+ARG NODE_VERSION=24.22.1
 # https://pecl.php.net/package/uv
 ARG PHP_UV_VERSION=0.3.0
 
@@ -49,10 +50,15 @@ RUN --mount=type=cache,target=/tmp/cache \
 
 USER www-data
 
+# Temporary: the node:24.22.1 multi-arch manifest is not published yet, pull the per-arch image instead
+FROM amd64/node:${NODE_VERSION}-alpine3.24 AS nodejs-amd64
+FROM arm64v8/node:${NODE_VERSION}-alpine3.24 AS nodejs-arm64
+FROM nodejs-${TARGETARCH} AS nodejs
+
 # =================================================================
 # Stage 2: Frontend assets compilation
 # =================================================================
-FROM node:24-alpine AS static-assets
+FROM nodejs AS static-assets
 
 WORKDIR /app
 COPY package*.json vite.config.js postcss.config.cjs ./
@@ -74,7 +80,10 @@ FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION} AS terminal-dependencies
 USER root
 
 RUN apk upgrade && \
-    apk add --no-cache nodejs npm make g++ python3
+    apk add --no-cache make g++ python3
+COPY --from=nodejs /usr/local/bin/node /usr/local/bin/node
+COPY --from=nodejs /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm
 COPY docker/coolify-terminal/package*.json /terminal/
 RUN --mount=type=cache,target=/root/.npm \
     npm ci --prefix /terminal && \
@@ -130,7 +139,7 @@ RUN --mount=type=cache,target=/var/cache/apk \
     apk upgrade && \
     apk add --no-cache \
     postgresql${POSTGRES_VERSION}-client \
-    nodejs \
+    libstdc++ \
     openssh-client \
     git \
     git-lfs \
@@ -160,6 +169,11 @@ RUN mkdir -p /usr/local/bin && \
 # Configure PHP
 COPY docker/production/etc/php/conf.d/zzz-custom-php.ini /usr/local/etc/php/conf.d/zzz-custom-php.ini
 ENV PHP_OPCACHE_ENABLE=1
+# v5 defaults this to 0. Keep 1: app:init rebuilds the Laravel caches while php-fpm already runs.
+ENV PHP_OPCACHE_VALIDATE_TIMESTAMPS=1
+# v5 defaults to 256 MB with 32 MB interned strings. Every PHP CLI process has its own cache, so keep it small.
+ENV PHP_OPCACHE_MEMORY_CONSUMPTION=128
+ENV PHP_OPCACHE_INTERNED_STRINGS_BUFFER=16
 
 # Configure entrypoint
 COPY --chmod=755 docker/production/entrypoint.d/ /etc/entrypoint.d
@@ -189,6 +203,7 @@ COPY --chown=www-data:www-data versions.json ./versions.json
 RUN composer dump-autoload
 
 # Install terminal WebSocket server dependencies
+COPY --from=nodejs /usr/local/bin/node /usr/local/bin/node
 COPY --from=terminal-dependencies --chown=www-data:www-data /terminal /terminal
 
 # Configure Nginx and S6 overlay
diff --git a/docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/db-migration b/docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/db-migration
similarity index 100%
rename from docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/db-migration
rename to docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/db-migration
diff --git a/docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/horizon b/docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/horizon
similarity index 100%
rename from docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/horizon
rename to docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/horizon
diff --git a/docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/init-script b/docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/init-script
similarity index 100%
rename from docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/init-script
rename to docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/init-script
diff --git a/docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/init-seeder b/docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/init-seeder
similarity index 100%
rename from docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/init-seeder
rename to docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/init-seeder
diff --git a/docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/reverb b/docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/reverb
similarity index 100%
rename from docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/reverb
rename to docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/reverb
diff --git a/docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/scheduler-worker b/docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/scheduler-worker
similarity index 100%
rename from docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/scheduler-worker
rename to docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/scheduler-worker
diff --git a/docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/terminal-server b/docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/terminal-server
similarity index 100%
rename from docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/terminal-server
rename to docker/production/etc/s6-overlay/user-bundles.d/user/contents.d/terminal-server
diff --git a/docker/tmp-php/Dockerfile b/docker/tmp-php/Dockerfile
new file mode 100644
index 0000000000..0be8e996dd
--- /dev/null
+++ b/docker/tmp-php/Dockerfile
@@ -0,0 +1,275 @@
+# Temporary copy of docker-library/php 8.4/alpine3.24/fpm (9dac3d0), only the PHP release and its SHA256 are build arguments
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM alpine:3.24
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+		autoconf \
+		dpkg-dev dpkg \
+		file \
+		g++ \
+		gcc \
+		libc-dev \
+		make \
+		pkgconf \
+		re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+		ca-certificates \
+		curl \
+		openssl \
+		tar \
+		xz
+
+# ensure www-data user exists
+RUN set -eux; \
+	adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+	mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+	[ ! -d /var/www/html ]; \
+	mkdir -p /var/www/html; \
+	chown www-data:www-data /var/www/html; \
+	chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD
+
+ARG PHP_VERSION
+ARG PHP_SHA256
+ENV PHP_VERSION ${PHP_VERSION}
+ENV PHP_URL="https://www.php.net/distributions/php-${PHP_VERSION}.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-${PHP_VERSION}.tar.xz.asc"
+ENV PHP_SHA256=${PHP_SHA256}
+
+RUN set -eux; \
+	\
+	apk add --no-cache --virtual .fetch-deps gnupg; \
+	\
+	mkdir -p /usr/src; \
+	cd /usr/src; \
+	\
+	curl -fsSL -o php.tar.xz "$PHP_URL"; \
+	\
+	if [ -n "$PHP_SHA256" ]; then \
+		echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+	fi; \
+	\
+	curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+	export GNUPGHOME="$(mktemp -d)"; \
+	for key in $GPG_KEYS; do \
+		gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+	done; \
+	gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME"; \
+	\
+	apk del --no-network .fetch-deps
+
+COPY docker-php-source /usr/local/bin/
+
+RUN set -eux; \
+	apk add --no-cache --virtual .build-deps \
+		$PHPIZE_DEPS \
+		argon2-dev \
+		coreutils \
+		curl-dev \
+		gnu-libiconv-dev \
+		libsodium-dev \
+		libxml2-dev \
+		linux-headers \
+		oniguruma-dev \
+		openssl-dev \
+		readline-dev \
+		sqlite-dev \
+	; \
+	\
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+	rm -vf /usr/include/iconv.h; \
+	\
+	export \
+		CFLAGS="$PHP_CFLAGS" \
+		CPPFLAGS="$PHP_CPPFLAGS" \
+		LDFLAGS="$PHP_LDFLAGS" \
+# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511
+		PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \
+		PHP_UNAME='Linux - Docker' \
+	; \
+	docker-php-source extract; \
+	cd /usr/src/php; \
+	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+	case "$gnuArch" in \
+		'i686-linux-'*) \
+			# php zend jit assumes SSE registers, xmm0-7, are available (and "Pentium4"/SSE2 is a reasonable baseline)
+			# https://github.com/php/php-src/pull/22832
+			# so, allow it and use SSE/SSE2 floating-point unit instead of the legacy stack
+			export \
+				CFLAGS="$CFLAGS -msse2 -mfpmath=sse" \
+				CPPFLAGS="$CPPFLAGS -msse2 -mfpmath=sse" \
+			; \
+			;; \
+	esac; \
+	test "$PHP_INI_DIR" != "${PHP_INI_DIR%/php}"; \
+	./configure \
+		--build="$gnuArch" \
+		--sysconfdir="${PHP_INI_DIR%/php}" \
+		--with-config-file-path="$PHP_INI_DIR" \
+		--with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+		\
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+		--enable-option-checking=fatal \
+		\
+# https://github.com/docker-library/php/issues/439
+		--with-mhash \
+		\
+# https://github.com/docker-library/php/issues/822
+		--with-pic \
+		\
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+		--enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+		--enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+		--with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+		--with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+		--with-pdo-sqlite=/usr \
+		--with-sqlite3=/usr \
+		\
+		--with-curl \
+		--with-iconv=/usr \
+		--with-openssl \
+		--with-readline \
+		--with-zlib \
+		\
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+		--disable-phpdbg \
+		\
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+		--with-pear \
+		\
+		\
+		--disable-cgi \
+		\
+		--enable-fpm \
+		--with-fpm-user=www-data \
+		--with-fpm-group=www-data \
+	; \
+	make -j "$(nproc)"; \
+	find -type f -name '*.a' -delete; \
+	make install; \
+	find \
+		/usr/local \
+		-type f \
+		-perm '/0111' \
+		-exec sh -euxc ' \
+			strip --strip-all "$@" || : \
+		' -- '{}' + \
+	; \
+	make clean; \
+	\
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+	cp -v php.ini-* "$PHP_INI_DIR/"; \
+	\
+	cd /; \
+	docker-php-source delete; \
+	\
+	runDeps="$( \
+		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+			| tr ',' '\n' \
+			| sort -u \
+			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+	)"; \
+	apk add --no-cache $runDeps; \
+	\
+	apk del --no-network .build-deps; \
+	\
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+	pecl update-channels; \
+	rm -rf /tmp/pear ~/.pearrc; \
+	\
+# smoke test
+	php --version
+
+COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/
+
+# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required)
+RUN docker-php-ext-enable opcache
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+	cd "${PHP_INI_DIR%/php}"; \
+	\
+	cp -v php-fpm.conf.default php-fpm.conf; \
+	cp -v php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+	\
+	# comment out localhost-only listen address
+	grep -E '^listen = 127.0.0.1:9000' php-fpm.d/www.conf; \
+	sed -ri 's/^(listen = 127.0.0.1:9000)/;\1/' php-fpm.d/www.conf; \
+	grep -E '^;listen = 127.0.0.1:9000' php-fpm.d/www.conf; \
+	\
+	{ \
+		echo '[global]'; \
+		echo 'error_log = /proc/self/fd/2'; \
+		echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+		echo; \
+		echo '[www]'; \
+		echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \
+		echo '; https://bugs.php.net/bug.php?id=73886'; \
+		echo 'access.log = /proc/self/fd/2'; \
+		echo; \
+		echo 'clear_env = no'; \
+		echo; \
+		echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+		echo 'catch_workers_output = yes'; \
+		echo 'decorate_workers_output = no'; \
+		echo; \
+		echo '; default listen address for easy override in later php-fpm.d/*.conf files'; \
+		echo 'listen = 9000'; \
+	} | tee php-fpm.d/docker.conf; \
+	{ \
+		echo '[global]'; \
+		echo 'daemonize = no'; \
+		echo; \
+		echo '; the [www] ini section below is for backwards compatibility and will be removed in 8.6+'; \
+		echo '[www]'; \
+	} | tee php-fpm.d/zz-docker.conf; \
+	mkdir -p "$PHP_INI_DIR/conf.d"; \
+	{ \
+		echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \
+		echo 'fastcgi.logging = Off'; \
+	} > "$PHP_INI_DIR/conf.d/docker-fpm.ini"
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/docker/tmp-php/docker-php-entrypoint b/docker/tmp-php/docker-php-entrypoint
new file mode 100755
index 0000000000..86343d8038
--- /dev/null
+++ b/docker/tmp-php/docker-php-entrypoint
@@ -0,0 +1,9 @@
+#!/bin/sh
+set -e
+
+# first arg is `-f` or `--some-option`
+if [ "${1#-}" != "$1" ]; then
+	set -- php-fpm "$@"
+fi
+
+exec "$@"
diff --git a/docker/tmp-php/docker-php-ext-configure b/docker/tmp-php/docker-php-ext-configure
new file mode 100755
index 0000000000..34fc1337d5
--- /dev/null
+++ b/docker/tmp-php/docker-php-ext-configure
@@ -0,0 +1,69 @@
+#!/bin/sh
+set -e
+
+# prefer user supplied CFLAGS, but default to our PHP_CFLAGS
+: ${CFLAGS:=$PHP_CFLAGS}
+: ${CPPFLAGS:=$PHP_CPPFLAGS}
+: ${LDFLAGS:=$PHP_LDFLAGS}
+export CFLAGS CPPFLAGS LDFLAGS
+
+srcExists=
+if [ -d /usr/src/php ]; then
+	srcExists=1
+fi
+docker-php-source extract
+if [ -z "$srcExists" ]; then
+	touch /usr/src/php/.docker-delete-me
+fi
+
+cd /usr/src/php/ext
+
+usage() {
+	echo "usage: $0 ext-name [configure flags]"
+	echo "   ie: $0 gd --with-jpeg-dir=/usr/local/something"
+	echo
+	echo 'Possible values for ext-name:'
+	find . \
+			-mindepth 2 \
+			-maxdepth 2 \
+			-type f \
+			-name 'config.m4' \
+		| xargs -n1 dirname \
+		| xargs -n1 basename \
+		| sort \
+		| xargs
+	echo
+	echo 'Some of the above modules are already compiled into PHP; please check'
+	echo 'the output of "php -i" to see which modules are already loaded.'
+}
+
+ext="$1"
+if [ -z "$ext" ] || [ ! -d "$ext" ]; then
+	usage >&2
+	exit 1
+fi
+shift
+
+pm='unknown'
+if [ -e /lib/apk/db/installed ]; then
+	pm='apk'
+fi
+
+if [ "$pm" = 'apk' ]; then
+	if \
+		[ -n "$PHPIZE_DEPS" ] \
+		&& ! apk info --installed .phpize-deps > /dev/null \
+		&& ! apk info --installed .phpize-deps-configure > /dev/null \
+	; then
+		apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS
+	fi
+fi
+
+if command -v dpkg-architecture > /dev/null; then
+	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"
+	set -- --build="$gnuArch" "$@"
+fi
+
+cd "$ext"
+phpize
+./configure --enable-option-checking=fatal "$@"
diff --git a/docker/tmp-php/docker-php-ext-enable b/docker/tmp-php/docker-php-ext-enable
new file mode 100755
index 0000000000..41d20bbe3f
--- /dev/null
+++ b/docker/tmp-php/docker-php-ext-enable
@@ -0,0 +1,121 @@
+#!/bin/sh
+set -e
+
+extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')"
+cd "$extDir"
+
+usage() {
+	echo "usage: $0 [options] module-name [module-name ...]"
+	echo "   ie: $0 gd mysqli"
+	echo "       $0 pdo pdo_mysql"
+	echo "       $0 --ini-name 0-apc.ini apcu apc"
+	echo
+	echo 'Possible values for module-name:'
+	find -maxdepth 1 \
+			-type f \
+			-name '*.so' \
+			-exec basename '{}' ';' \
+		| sort \
+		| xargs
+	echo
+	echo 'Some of the above modules are already compiled into PHP; please check'
+	echo 'the output of "php -i" to see which modules are already loaded.'
+}
+
+opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })"
+eval set -- "$opts"
+
+iniName=
+while true; do
+	flag="$1"
+	shift
+	case "$flag" in
+		--help|-h|'-?') usage && exit 0 ;;
+		--ini-name) iniName="$1" && shift ;;
+		--) break ;;
+		*)
+			{
+				echo "error: unknown flag: $flag"
+				usage
+			} >&2
+			exit 1
+			;;
+	esac
+done
+
+modules=
+for module; do
+	if [ -z "$module" ]; then
+		continue
+	fi
+	if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then
+		echo >&2 "error: '$module' does not exist"
+		echo >&2
+		usage >&2
+		exit 1
+	fi
+	modules="$modules $module"
+done
+
+if [ -z "$modules" ]; then
+	usage >&2
+	exit 1
+fi
+
+pm='unknown'
+if [ -e /lib/apk/db/installed ]; then
+	pm='apk'
+fi
+
+apkDel=
+if [ "$pm" = 'apk' ]; then
+	if \
+		[ -n "$PHPIZE_DEPS" ] \
+		&& ! apk info --installed .phpize-deps > /dev/null \
+		&& ! apk info --installed .phpize-deps-configure > /dev/null \
+	; then
+		apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils
+		apkDel='.docker-php-ext-enable-deps'
+	fi
+fi
+
+for module in $modules; do
+	moduleFile="$module"
+	if [ -f "$module.so" ] && ! [ -f "$module" ]; then
+		moduleFile="$module.so"
+	fi
+	if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then
+		# https://wiki.php.net/internals/extensions#loading_zend_extensions
+		line="zend_extension=$module"
+	else
+		line="extension=$module"
+	fi
+
+	ext="$(basename "$module")"
+	ext="${ext%.*}"
+	if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then
+		# this isn't perfect, but it's better than nothing
+		# (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache')
+		echo >&2
+		echo >&2 "warning: $ext ($module) is already loaded!"
+		echo >&2
+		continue
+	fi
+
+	case "$iniName" in
+		/*)
+			# allow an absolute path
+			ini="$iniName"
+			;;
+		*)
+			ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}"
+			;;
+	esac
+	if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then
+		echo "$line" >> "$ini"
+	fi
+done
+
+if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then
+	apk del --no-network $apkDel
+fi
diff --git a/docker/tmp-php/docker-php-ext-install b/docker/tmp-php/docker-php-ext-install
new file mode 100755
index 0000000000..fbf44849c0
--- /dev/null
+++ b/docker/tmp-php/docker-php-ext-install
@@ -0,0 +1,143 @@
+#!/bin/sh
+set -e
+
+# prefer user supplied CFLAGS, but default to our PHP_CFLAGS
+: ${CFLAGS:=$PHP_CFLAGS}
+: ${CPPFLAGS:=$PHP_CPPFLAGS}
+: ${LDFLAGS:=$PHP_LDFLAGS}
+export CFLAGS CPPFLAGS LDFLAGS
+
+srcExists=
+if [ -d /usr/src/php ]; then
+	srcExists=1
+fi
+docker-php-source extract
+if [ -z "$srcExists" ]; then
+	touch /usr/src/php/.docker-delete-me
+fi
+
+cd /usr/src/php/ext
+
+usage() {
+	echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]"
+	echo "   ie: $0 gd mysqli"
+	echo "       $0 pdo pdo_mysql"
+	echo "       $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop"
+	echo
+	echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure'
+	echo
+	echo 'Possible values for ext-name:'
+	find . \
+			-mindepth 2 \
+			-maxdepth 2 \
+			-type f \
+			-name 'config.m4' \
+		| xargs -n1 dirname \
+		| xargs -n1 basename \
+		| sort \
+		| xargs
+	echo
+	echo 'Some of the above modules are already compiled into PHP; please check'
+	echo 'the output of "php -i" to see which modules are already loaded.'
+}
+
+opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })"
+eval set -- "$opts"
+
+j=1
+iniName=
+while true; do
+	flag="$1"
+	shift
+	case "$flag" in
+		--help|-h|'-?') usage && exit 0 ;;
+		--ini-name) iniName="$1" && shift ;;
+		--jobs|-j) j="$1" && shift ;;
+		--) break ;;
+		*)
+			{
+				echo "error: unknown flag: $flag"
+				usage
+			} >&2
+			exit 1
+			;;
+	esac
+done
+
+exts=
+for ext; do
+	if [ -z "$ext" ]; then
+		continue
+	fi
+	if [ ! -d "$ext" ]; then
+		echo >&2 "error: $PWD/$ext does not exist"
+		echo >&2
+		usage >&2
+		exit 1
+	fi
+	exts="$exts $ext"
+done
+
+if [ -z "$exts" ]; then
+	usage >&2
+	exit 1
+fi
+
+pm='unknown'
+if [ -e /lib/apk/db/installed ]; then
+	pm='apk'
+fi
+
+apkDel=
+if [ "$pm" = 'apk' ]; then
+	if [ -n "$PHPIZE_DEPS" ]; then
+		if apk info --installed .phpize-deps-configure > /dev/null; then
+			apkDel='.phpize-deps-configure'
+		elif ! apk info --installed .phpize-deps > /dev/null; then
+			apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS
+			apkDel='.phpize-deps'
+		fi
+	fi
+fi
+
+popDir="$PWD"
+for ext in $exts; do
+	cd "$ext"
+
+	[ -e Makefile ] || docker-php-ext-configure "$ext"
+
+	make -j"$j"
+
+	if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then
+		# only "strip" modules if we aren't using a debug build of PHP
+		# (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option)
+		# https://github.com/docker-library/php/issues/1268
+
+		find modules \
+			-maxdepth 1 \
+			-name '*.so' \
+			-exec sh -euxc ' \
+				strip --strip-all "$@" || :
+			' -- '{}' +
+	fi
+
+	make -j"$j" install
+
+	find modules \
+		-maxdepth 1 \
+		-name '*.so' \
+		-exec basename '{}' '.so' ';' \
+			| xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"}
+
+	make -j"$j" clean
+
+	cd "$popDir"
+done
+
+if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then
+	apk del --no-network $apkDel
+fi
+
+if [ -e /usr/src/php/.docker-delete-me ]; then
+	docker-php-source delete
+fi
diff --git a/docker/tmp-php/docker-php-source b/docker/tmp-php/docker-php-source
new file mode 100755
index 0000000000..9033d243de
--- /dev/null
+++ b/docker/tmp-php/docker-php-source
@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+dir=/usr/src/php
+
+usage() {
+	echo "usage: $0 COMMAND"
+	echo
+	echo "Manage php source tarball lifecycle."
+	echo
+	echo "Commands:"
+	echo "   extract  extract php source tarball into directory $dir if not already done."
+	echo "   delete   delete extracted php source located into $dir if not already done."
+	echo
+}
+
+case "$1" in
+	extract)
+		mkdir -p "$dir"
+		if [ ! -f "$dir/.docker-extracted" ]; then
+			tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1
+			touch "$dir/.docker-extracted"
+		fi
+		;;
+
+	delete)
+		rm -rf "$dir"
+		;;
+
+	*)
+		usage
+		exit 1
+		;;
+esac
diff --git a/docs/server-transfer-full-coverage.md b/docs/server-transfer-full-coverage.md
new file mode 100644
index 0000000000..1574983fc3
--- /dev/null
+++ b/docs/server-transfer-full-coverage.md
@@ -0,0 +1,140 @@
+# Full-coverage server for transfer tests
+
+Set up one source server with everything below, transfer it, then compare each item on the target.
+Use values that are NOT the default, so that a lost value is visible after the transfer.
+
+Use the kit in `scripts/transfer-test/` (see its README): it starts the source (A) and the target (B) and seeds A with a basic set of deployed resources.
+
+Legend: ✅ `scripts/transfer-test/seed.sh` or `seed-extras.php` already creates it · ➕ add it · ⚠️ needs special infrastructure
+
+The models come from `ServerTransferCoverage::TRANSFERRED` (`app/Services/ServerTransfer/ServerTransferCoverage.php`).
+When you add a model or a setting to the transfer, add it to this file too.
+
+## 1. Server (Server → General / Proxy)
+
+| ✓ | What | Value to set |
+|---|---|---|
+| ✅ | Non-root SSH user | a dev VM with the `ubuntu-non-root` profile |
+| ➕ | Name, description | any text |
+| ➕ | Port | other than 22, if the VM allows it |
+| ➕ | Proxy: redirect | redirect enabled + target URL |
+| ✅ | Proxy: custom error page | custom HTML (`proxy_error_page`) |
+| ➕ | Server role / build server | mark a second server as a build server |
+| ⚠️ | Cloud provider link | Hetzner/Vultr/DigitalOcean/Hostinger server ID + cloud provider token (needs a real cloud server) |
+| ⚠️ | Swarm | swarm manager / worker + swarm cluster + swarm destination (needs a swarm server) |
+
+## 2. Server settings (Server → Advanced, Log drains, Sentinel/Metrics, Traffic, Cloudflare tunnel)
+
+| ✓ | What | Value to set |
+|---|---|---|
+| ➕ | Wildcard domain | `http://{ip}.sslip.io` style, not empty |
+| ➕ | Concurrent builds, dynamic timeout, deployment queue limit, connection timeout | 3, 1800, 5, 20 |
+| ➕ | Server timezone | `Europe/Budapest` |
+| ➕ | Docker cleanup | force cleanup on, frequency `0 4 * * *`, threshold 70, delete unused volumes on, delete unused networks on |
+| ➕ | Disk usage notification | threshold 70, check frequency `*/30 * * * *`, interval 12 h |
+| ➕ | Security > Patches | check frequency `daily`, automatic security updates on at `04:30` (the last check result is not moved; the target shows "never" until its first check) |
+| ➕ | Terminal | terminal access off |
+| ➕ | Image retention | "disable application image retention" on |
+| ➕ | Labels / Traefik | generate exact labels on, Traefik certificate resolver `custom` |
+| ➕ | Backup compression | CPU percentage 50 |
+| ➕ | Metrics / Sentinel | metrics on, refresh rate 10 s, history 14 days, push interval 30 s |
+| ➕ | Traffic analytics | on, top N 20, sample threshold, retention 1h=3 / 1d=60 days, IP mode `anonymized` |
+| ➕ | GeoIP | on, MaxMind license key, refresh 14 days |
+| ➕ | Log drains | New Relic (key + base URI), Highlight (project ID), Axiom (dataset + key), custom (config + parser), one of them enabled |
+| ✅ | Cloudflare tunnel | tunnel on, tunnel ID, account ID, Cloudflare integration token selected |
+| ➕ | Jump server flag | on (on a server that is only a jump host) |
+
+## 3. Server-level records
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | Default destination | created automatically |
+| ➕ | Second standalone destination | extra Docker network, one resource on it |
+| ➕ | Server shared variables | 2 variables, one multiline, one literal, one with a comment |
+| ➕ | SSL certificates | CA certificate (created automatically) + a database with SSL on (creates a server certificate) |
+| ✅ | GitHub runner config | labels, max runners 2, docker mode `dind`, image, CPU/memory limits, 3 timeouts, PR jobs off, dedicated on, uses the team GitHub App (see 4). Expected: on the target it is **disabled** and the checklist says to enable it |
+
+## 4. Team credentials the server uses
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | Server private key | |
+| ➕ | Deploy key | a second private key used by an application (git over SSH) |
+| ✅ | GitHub App (team, not system-wide) | with runner fields (`organization_self_hosted_runners`, `actions`, `webhook_events`, `runner_group_id`). Expected: checklist step for Webhook/Setup/Callback URL |
+| ➕ | GitLab App (team) | used by one application. Expected: checklist step for the webhook URL |
+| ➕ | S3 storage | the dev MinIO service (the VM must reach it), used by a database backup and a volume backup |
+| ✅ | Cloudflare integration token | for DNS zones and the tunnel |
+| ✅ | Secret manager token | Infisical, Doppler, or Vault |
+| ⚠️ | Cloud provider token | only with a real cloud server |
+
+## 5. Projects and environments
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | 2 projects, 2 environments | for example production and staging |
+| ✅/➕ | Project / environment shared variables | the seed tries to create them; check that they exist |
+| ✅ | Team shared variable | `TEAM_KEY`, used as `{{team.TEAM_KEY}}` in an application variable. Expected: created on the target |
+| ✅ | Project description + icon (JPEG) | Expected: the icon is on the target |
+| ✅ | Canvas positions | drag the nodes on the environment canvas |
+| ✅ | Resource links | a link between 2 resources on this server, and a link to a resource on another server. Expected: the first moves, the second does not, and the export warns |
+| ✅ | Environment with resources only on another server | Expected: it is not exported, and the prechecks show a `NOTE:` line |
+
+## 6. Applications (one per build pack and source)
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | Docker image app (whoami) | |
+| ✅ | Dockerfile app | |
+| ➕ | Nixpacks app, public GitHub repo | Expected: checklist step for manual webhooks |
+| ➕ | Static app (`is_static`, `is_spa`) | |
+| ➕ | Docker Compose app | raw compose on, one variable with an empty value (`preserve_compose_null`) |
+| ➕ | App with GitHub App source, app with GitLab App source, app with deploy key | |
+| ➕ | Domains | 2 domains, noindex domains, domain port overrides, preview URL template |
+| ➕ | Health check | custom path, port, method, return code, interval, retries, start period |
+| ➕ | Limits | memory, swap, swappiness, reservation, CPUs, cpuset, CPU shares |
+| ➕ | Advanced | custom labels, custom docker run options, pre/post deployment command + container, manual webhook secrets |
+| ✅ | Maintenance | maintenance mode on + custom maintenance page |
+| ➕ | All application settings that are not the default | git submodules, LFS, shallow clone, auto deploy off, force HTTPS, debug, preview deployments on, PR deployments public, log drain, GPU (driver, count, device IDs, options), include timestamps, swarm-only worker nodes, build server, consistent container name, gzip off, strip prefix off, connect to Docker network, custom internal name, container label escape off, env sorting, read-only labels, preserve repository, disable build cache, use build secrets, stop grace period 30, inject build args off, include source commit, Docker images to keep 5, custom container name prefix, redact env values in logs, Coolify default variables off, Traefik certificate resolver |
+| ➕ | Environment variables | normal, multiline, literal, shown once, build time only, runtime only, required, with comment, preview-only, and references to `{{team.*}}`, `{{project.*}}`, `{{environment.*}}`, `{{server.*}}` |
+| ✅/➕ | Persistent volume | the seed has one; add a host-path bind mount and preview suffix on |
+| ➕ | File mount + directory mount | content, chown, chmod |
+| ➕ | Volume backup | on the persistent volume: S3 on, stop during backup, all retention values, timeout, missing-backup days |
+| ✅/➕ | Scheduled tasks | the seed has one; add a disabled one with container + timeout |
+| ✅ | Tag | |
+| ➕ | Preview deployment | PR preview with domain port overrides + max restart count (needs the GitHub App, or create it in the database) |
+| ✅ | Secret manager link | the app loads variables from the secret manager token |
+| ✅ | Managed DNS record | owned record in the Cloudflare zone for the app domain. Expected: the target takes ownership (provider comment changes) |
+
+## 7. Databases (one of each of the 9 types)
+
+| ✓ | Type | Extra settings |
+|---|---|---|
+| ✅ | PostgreSQL | + init script, `postgres_conf`, host auth method, SSL on + mode |
+| ➕ | MySQL | + `mysql_conf`, SSL |
+| ✅ | MariaDB | + `mariadb_conf`, SSL |
+| ➕ | MongoDB | + `mongo_conf`, SSL |
+| ✅ | Redis | + `redis_conf`, SSL |
+| ➕ | KeyDB, Dragonfly, ClickHouse | defaults are enough, plus the common settings below |
+| ➕ | SQLite | database files list, volume link |
+
+Common settings on at least one database: custom image, public port + public on + public port timeout, limits, custom docker run options, health check values, log drain, include timestamps, redact env values, Coolify default variables off, environment variables, persistent volume + volume backup, tags, secret manager link (if the type supports it).
+
+Database backups (✅ one exists): add S3 on, dump all, databases list, local and S3 retention (amount, days, max storage), timeout, disable local backup, missing-backup days.
+
+## 8. Services
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | One-click service (uptime-kuma) | |
+| ➕ | Custom compose service with an app and a database part | |
+| ➕ | Service app settings | domain, gzip off, strip prefix off, force HTTPS, exclude from status, redirect, port overrides, log drain, custom image, Traefik resolver |
+| ➕ | Service database settings | public port + public on, custom type |
+| ➕ | Service level | connect to network, label escape off, redact env values, Coolify default variables off, maintenance mode + page, environment variables, scheduled task, tags, volume backup on a service volume |
+
+## 9. After the transfer, check
+
+- Transfer log: every check `OK`, the `NOTE:` line for the shared project.
+- "After the transfer" checklist: GitHub App URLs, GitLab webhook, manual webhooks, GitHub runners. All URLs use the public URL of the target.
+- Target: every item above has the same value. Runner config disabled. DNS records owned by the target.
+- Source: the server is an archive, the runner config is disabled, and no DNS records are tracked.
+- Delete the archive on the source: the containers, DNS records, and GitHub runners are not changed.
diff --git a/openapi.json b/openapi.json
index f837ab1987..5f720a54ae 100644
--- a/openapi.json
+++ b/openapi.json
@@ -86,9 +86,9 @@
                                 "properties": {
                                     "pull_request_id": {
                                         "type": "integer",
+                                        "example": 42,
                                         "maximum": 2147483647,
-                                        "minimum": 1,
-                                        "example": 42
+                                        "minimum": 1
                                     },
                                     "pull_request_html_url": {
                                         "type": [
@@ -889,6 +889,10 @@
                                         "type": "boolean",
                                         "description": "Sort environment variables."
                                     },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions."
+                                    },
                                     "is_pr_deployments_public_enabled": {
                                         "type": "boolean",
                                         "description": "Make pull request deployments public."
@@ -992,6 +996,36 @@
                                         "nullable": true,
                                         "description": "Password for HTTP Basic Authentication"
                                     },
+                                    "http_basic_auth_hash_algorithm": {
+                                        "type": "string",
+                                        "enum": [
+                                            "bcrypt",
+                                            "argon2id"
+                                        ],
+                                        "default": "bcrypt",
+                                        "description": "Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer."
+                                    },
+                                    "http_basic_auth_bcrypt_cost": {
+                                        "type": "integer",
+                                        "minimum": 4,
+                                        "maximum": 14,
+                                        "default": 10,
+                                        "description": "Bcrypt cost for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_memory_cost": {
+                                        "type": "integer",
+                                        "minimum": 8192,
+                                        "maximum": 262144,
+                                        "default": 65536,
+                                        "description": "Argon2id memory cost in KiB for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_time_cost": {
+                                        "type": "integer",
+                                        "minimum": 1,
+                                        "maximum": 12,
+                                        "default": 4,
+                                        "description": "Argon2id time cost (iterations) for the HTTP Basic Authentication password."
+                                    },
                                     "connect_to_docker_network": {
                                         "type": "boolean",
                                         "description": "The flag to connect the service to the predefined Docker network."
@@ -1492,6 +1526,10 @@
                                         "type": "boolean",
                                         "description": "Sort environment variables."
                                     },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions."
+                                    },
                                     "is_pr_deployments_public_enabled": {
                                         "type": "boolean",
                                         "description": "Make pull request deployments public."
@@ -1595,6 +1633,36 @@
                                         "nullable": true,
                                         "description": "Password for HTTP Basic Authentication"
                                     },
+                                    "http_basic_auth_hash_algorithm": {
+                                        "type": "string",
+                                        "enum": [
+                                            "bcrypt",
+                                            "argon2id"
+                                        ],
+                                        "default": "bcrypt",
+                                        "description": "Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer."
+                                    },
+                                    "http_basic_auth_bcrypt_cost": {
+                                        "type": "integer",
+                                        "minimum": 4,
+                                        "maximum": 14,
+                                        "default": 10,
+                                        "description": "Bcrypt cost for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_memory_cost": {
+                                        "type": "integer",
+                                        "minimum": 8192,
+                                        "maximum": 262144,
+                                        "default": 65536,
+                                        "description": "Argon2id memory cost in KiB for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_time_cost": {
+                                        "type": "integer",
+                                        "minimum": 1,
+                                        "maximum": 12,
+                                        "default": 4,
+                                        "description": "Argon2id time cost (iterations) for the HTTP Basic Authentication password."
+                                    },
                                     "connect_to_docker_network": {
                                         "type": "boolean",
                                         "description": "The flag to connect the service to the predefined Docker network."
@@ -2095,6 +2163,10 @@
                                         "type": "boolean",
                                         "description": "Sort environment variables."
                                     },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions."
+                                    },
                                     "is_pr_deployments_public_enabled": {
                                         "type": "boolean",
                                         "description": "Make pull request deployments public."
@@ -2198,6 +2270,36 @@
                                         "nullable": true,
                                         "description": "Password for HTTP Basic Authentication"
                                     },
+                                    "http_basic_auth_hash_algorithm": {
+                                        "type": "string",
+                                        "enum": [
+                                            "bcrypt",
+                                            "argon2id"
+                                        ],
+                                        "default": "bcrypt",
+                                        "description": "Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer."
+                                    },
+                                    "http_basic_auth_bcrypt_cost": {
+                                        "type": "integer",
+                                        "minimum": 4,
+                                        "maximum": 14,
+                                        "default": 10,
+                                        "description": "Bcrypt cost for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_memory_cost": {
+                                        "type": "integer",
+                                        "minimum": 8192,
+                                        "maximum": 262144,
+                                        "default": 65536,
+                                        "description": "Argon2id memory cost in KiB for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_time_cost": {
+                                        "type": "integer",
+                                        "minimum": 1,
+                                        "maximum": 12,
+                                        "default": 4,
+                                        "description": "Argon2id time cost (iterations) for the HTTP Basic Authentication password."
+                                    },
                                     "connect_to_docker_network": {
                                         "type": "boolean",
                                         "description": "The flag to connect the service to the predefined Docker network."
@@ -2593,6 +2695,10 @@
                                         "type": "boolean",
                                         "description": "Sort environment variables."
                                     },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions."
+                                    },
                                     "is_pr_deployments_public_enabled": {
                                         "type": "boolean",
                                         "description": "Make pull request deployments public."
@@ -2696,6 +2802,36 @@
                                         "nullable": true,
                                         "description": "Password for HTTP Basic Authentication"
                                     },
+                                    "http_basic_auth_hash_algorithm": {
+                                        "type": "string",
+                                        "enum": [
+                                            "bcrypt",
+                                            "argon2id"
+                                        ],
+                                        "default": "bcrypt",
+                                        "description": "Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer."
+                                    },
+                                    "http_basic_auth_bcrypt_cost": {
+                                        "type": "integer",
+                                        "minimum": 4,
+                                        "maximum": 14,
+                                        "default": 10,
+                                        "description": "Bcrypt cost for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_memory_cost": {
+                                        "type": "integer",
+                                        "minimum": 8192,
+                                        "maximum": 262144,
+                                        "default": 65536,
+                                        "description": "Argon2id memory cost in KiB for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_time_cost": {
+                                        "type": "integer",
+                                        "minimum": 1,
+                                        "maximum": 12,
+                                        "default": 4,
+                                        "description": "Argon2id time cost (iterations) for the HTTP Basic Authentication password."
+                                    },
                                     "connect_to_docker_network": {
                                         "type": "boolean",
                                         "description": "The flag to connect the service to the predefined Docker network."
@@ -3071,6 +3207,10 @@
                                         "type": "boolean",
                                         "description": "Sort environment variables."
                                     },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions."
+                                    },
                                     "is_pr_deployments_public_enabled": {
                                         "type": "boolean",
                                         "description": "Make pull request deployments public."
@@ -3174,6 +3314,36 @@
                                         "nullable": true,
                                         "description": "Password for HTTP Basic Authentication"
                                     },
+                                    "http_basic_auth_hash_algorithm": {
+                                        "type": "string",
+                                        "enum": [
+                                            "bcrypt",
+                                            "argon2id"
+                                        ],
+                                        "default": "bcrypt",
+                                        "description": "Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer."
+                                    },
+                                    "http_basic_auth_bcrypt_cost": {
+                                        "type": "integer",
+                                        "minimum": 4,
+                                        "maximum": 14,
+                                        "default": 10,
+                                        "description": "Bcrypt cost for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_memory_cost": {
+                                        "type": "integer",
+                                        "minimum": 8192,
+                                        "maximum": 262144,
+                                        "default": 65536,
+                                        "description": "Argon2id memory cost in KiB for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_time_cost": {
+                                        "type": "integer",
+                                        "minimum": 1,
+                                        "maximum": 12,
+                                        "default": 4,
+                                        "description": "Argon2id time cost (iterations) for the HTTP Basic Authentication password."
+                                    },
                                     "connect_to_docker_network": {
                                         "type": "boolean",
                                         "description": "The flag to connect the service to the predefined Docker network."
@@ -3753,6 +3923,32 @@
                                         "type": "boolean",
                                         "description": "Use Docker Build Secrets for build-time environment variables."
                                     },
+                                    "http_basic_auth_hash_algorithm": {
+                                        "type": "string",
+                                        "enum": [
+                                            "bcrypt",
+                                            "argon2id"
+                                        ],
+                                        "description": "Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer."
+                                    },
+                                    "http_basic_auth_bcrypt_cost": {
+                                        "type": "integer",
+                                        "minimum": 4,
+                                        "maximum": 14,
+                                        "description": "Bcrypt cost for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_memory_cost": {
+                                        "type": "integer",
+                                        "minimum": 8192,
+                                        "maximum": 262144,
+                                        "description": "Argon2id memory cost in KiB for the HTTP Basic Authentication password."
+                                    },
+                                    "http_basic_auth_argon2id_time_cost": {
+                                        "type": "integer",
+                                        "minimum": 1,
+                                        "maximum": 12,
+                                        "description": "Argon2id time cost (iterations) for the HTTP Basic Authentication password."
+                                    },
                                     "is_git_submodules_enabled": {
                                         "type": "boolean",
                                         "description": "Clone Git submodules."
@@ -3781,6 +3977,10 @@
                                         "type": "boolean",
                                         "description": "Sort environment variables."
                                     },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions."
+                                    },
                                     "is_pr_deployments_public_enabled": {
                                         "type": "boolean",
                                         "description": "Make pull request deployments public."
@@ -5512,7 +5712,7 @@
                     "Applications"
                 ],
                 "summary": "List Rollback Images",
-                "description": "List available Docker images for rolling back an application. Returns an empty list when the server is unavailable or remote inspection is not possible.",
+                "description": "List available Docker images for rolling back an application: images on the server (`local`) and, when a Docker registry image name is set, images of recent successful deployments in the registry (`registry`). Returns an empty list when the server is unavailable or remote inspection is not possible.",
                 "operationId": "list-application-rollback-images",
                 "parameters": [
                     {
@@ -5550,6 +5750,13 @@
                                                     },
                                                     "is_current": {
                                                         "type": "boolean"
+                                                    },
+                                                    "source": {
+                                                        "type": "string",
+                                                        "enum": [
+                                                            "local",
+                                                            "registry"
+                                                        ]
                                                     }
                                                 },
                                                 "type": "object"
@@ -6207,7 +6414,8 @@
                                                 "enum": [
                                                     "hetzner",
                                                     "digitalocean",
-                                                    "vultr"
+                                                    "vultr",
+                                                    "hostinger"
                                                 ]
                                             },
                                             "team_id": {
@@ -6266,7 +6474,8 @@
                                         "enum": [
                                             "hetzner",
                                             "digitalocean",
-                                            "vultr"
+                                            "vultr",
+                                            "hostinger"
                                         ],
                                         "example": "hetzner",
                                         "description": "The cloud provider."
@@ -6748,7 +6957,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "Get all backups for a database",
+                        "description": "Get all backups for a database. Each backup includes s3_storage_uuid (primary S3 destination) and s3_storage_uuids (every S3 destination, primary first).",
                         "content": {
                             "application\/json": {
                                 "schema": {
@@ -6818,7 +7027,14 @@
                                     },
                                     "s3_storage_uuid": {
                                         "type": "string",
-                                        "description": "S3 storage UUID (required if save_s3 is true)"
+                                        "description": "Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination. Either field is required if save_s3 is true."
+                                    },
+                                    "s3_storage_uuids": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        },
+                                        "description": "UUIDs of every S3 storage the backup is uploaded to. Replaces the current destinations. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination."
                                     },
                                     "databases_to_backup": {
                                         "type": "string",
@@ -7282,6 +7498,10 @@
                                         "description": "Healthcheck start period in seconds.",
                                         "minimum": 0,
                                         "default": 5
+                                    },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values, database passwords, and remote secrets are redacted. Requires team admin permissions."
                                     }
                                 },
                                 "type": "object"
@@ -7434,7 +7654,14 @@
                                     },
                                     "s3_storage_uuid": {
                                         "type": "string",
-                                        "description": "S3 storage UUID"
+                                        "description": "Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination; when it is already a destination, it becomes the primary destination and the other destinations stay."
+                                    },
+                                    "s3_storage_uuids": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        },
+                                        "description": "UUIDs of every S3 storage the backup is uploaded to. Replaces the current destinations. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination."
                                     },
                                     "backup_now": {
                                         "type": "boolean",
@@ -8975,7 +9202,7 @@
                     "Databases"
                 ],
                 "summary": "List backup executions",
-                "description": "Get all executions for a specific backup configuration.",
+                "description": "Get all executions for a specific backup configuration. The execution `message` is only returned (redacted) to tokens with the `read:sensitive` or `root` ability; otherwise it is `null`.",
                 "operationId": "list-backup-executions",
                 "parameters": [
                     {
@@ -9021,7 +9248,11 @@
                                                         "type": "string"
                                                     },
                                                     "message": {
-                                                        "type": "string"
+                                                        "description": "Redacted execution output. Null unless the token has the `read:sensitive` or `root` ability.",
+                                                        "type": [
+                                                            "string",
+                                                            "null"
+                                                        ]
                                                     },
                                                     "status": {
                                                         "type": "string"
@@ -10790,8 +11021,8 @@
                                     "network": {
                                         "description": "Name of a new Docker network. Must not be bridge, host, none, or a network that already exists on the server.",
                                         "type": "string",
-                                        "maxLength": 255,
-                                        "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
+                                        "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$",
+                                        "maxLength": 255
                                     },
                                     "type": {
                                         "type": "string",
@@ -12794,6 +13025,192 @@
                 ]
             }
         },
+        "\/hostinger\/data-centers": {
+            "get": {
+                "tags": [
+                    "Hostinger"
+                ],
+                "summary": "Get Hostinger VPS data centers",
+                "operationId": "get-hostinger-data-centers",
+                "responses": {
+                    "200": {
+                        "description": "List of Hostinger VPS data centers."
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "403": {
+                        "description": "Hostinger denied access to this resource for the cloud provider token."
+                    },
+                    "422": {
+                        "description": "Validation failed."
+                    },
+                    "429": {
+                        "description": "Hostinger rate limit exceeded."
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/hostinger\/catalog": {
+            "get": {
+                "tags": [
+                    "Hostinger"
+                ],
+                "summary": "Get Hostinger VPS plans and prices",
+                "operationId": "get-hostinger-catalog",
+                "responses": {
+                    "200": {
+                        "description": "List of Hostinger VPS plans and prices."
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "403": {
+                        "description": "Hostinger denied access to this resource for the cloud provider token."
+                    },
+                    "422": {
+                        "description": "Validation failed."
+                    },
+                    "429": {
+                        "description": "Hostinger rate limit exceeded."
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/hostinger\/templates": {
+            "get": {
+                "tags": [
+                    "Hostinger"
+                ],
+                "summary": "Get Hostinger VPS operating system templates",
+                "operationId": "get-hostinger-templates",
+                "responses": {
+                    "200": {
+                        "description": "List of Hostinger VPS templates."
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "403": {
+                        "description": "Hostinger denied access to this resource for the cloud provider token."
+                    },
+                    "422": {
+                        "description": "Validation failed."
+                    },
+                    "429": {
+                        "description": "Hostinger rate limit exceeded."
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/hostinger\/ssh-keys": {
+            "get": {
+                "tags": [
+                    "Hostinger"
+                ],
+                "summary": "Get Hostinger account SSH keys",
+                "operationId": "get-hostinger-ssh-keys",
+                "responses": {
+                    "200": {
+                        "description": "List of Hostinger account SSH keys."
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "403": {
+                        "description": "Hostinger denied access to this resource for the cloud provider token."
+                    },
+                    "422": {
+                        "description": "Validation failed."
+                    },
+                    "429": {
+                        "description": "Hostinger rate limit exceeded."
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/hostinger\/post-install-scripts": {
+            "get": {
+                "tags": [
+                    "Hostinger"
+                ],
+                "summary": "Get Hostinger post-install scripts",
+                "operationId": "get-hostinger-post-install-scripts",
+                "responses": {
+                    "200": {
+                        "description": "List of Hostinger post-install scripts."
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "403": {
+                        "description": "Hostinger denied access to this resource for the cloud provider token."
+                    },
+                    "422": {
+                        "description": "Validation failed."
+                    },
+                    "429": {
+                        "description": "Hostinger rate limit exceeded."
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/hostinger": {
+            "post": {
+                "tags": [
+                    "Hostinger"
+                ],
+                "summary": "Purchase a Hostinger VPS and create a linked server",
+                "operationId": "create-hostinger-server",
+                "responses": {
+                    "201": {
+                        "description": "Hostinger VPS purchased and linked to a Coolify server."
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "403": {
+                        "description": "The token needs the deploy permission for a post-install script or extra SSH keys."
+                    },
+                    "422": {
+                        "description": "Validation failed."
+                    },
+                    "429": {
+                        "description": "Hostinger rate limit exceeded."
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
         "\/settings\/email": {
             "get": {
                 "tags": [
@@ -13277,58 +13694,6 @@
                 ]
             }
         },
-        "\/enable": {
-            "post": {
-                "summary": "Enable API",
-                "description": "Enable API (only with root permissions).",
-                "operationId": "enable-api",
-                "responses": {
-                    "200": {
-                        "description": "Enable API.",
-                        "content": {
-                            "application\/json": {
-                                "schema": {
-                                    "properties": {
-                                        "message": {
-                                            "type": "string",
-                                            "example": "API enabled."
-                                        }
-                                    },
-                                    "type": "object"
-                                }
-                            }
-                        }
-                    },
-                    "403": {
-                        "description": "You are not allowed to enable the API.",
-                        "content": {
-                            "application\/json": {
-                                "schema": {
-                                    "properties": {
-                                        "message": {
-                                            "type": "string",
-                                            "example": "You are not allowed to enable the API."
-                                        }
-                                    },
-                                    "type": "object"
-                                }
-                            }
-                        }
-                    },
-                    "401": {
-                        "$ref": "#\/components\/responses\/401"
-                    },
-                    "400": {
-                        "$ref": "#\/components\/responses\/400"
-                    }
-                },
-                "security": [
-                    {
-                        "bearerAuth": []
-                    }
-                ]
-            }
-        },
         "\/disable": {
             "post": {
                 "summary": "Disable API",
@@ -15662,9 +16027,6 @@
                     "content": {
                         "application\/json": {
                             "schema": {
-                                "required": [
-                                    "private_key"
-                                ],
                                 "properties": {
                                     "name": {
                                         "type": "string"
@@ -16635,6 +16997,28 @@
                                         "logdrain_custom_config_parser": {
                                             "description": "Only present with read:sensitive.",
                                             "type": "string"
+                                        },
+                                        "is_logdrain_cloudwatch_enabled": {
+                                            "type": "boolean"
+                                        },
+                                        "logdrain_cloudwatch_region": {
+                                            "type": [
+                                                "string",
+                                                "null"
+                                            ]
+                                        },
+                                        "logdrain_cloudwatch_group": {
+                                            "type": [
+                                                "string",
+                                                "null"
+                                            ]
+                                        },
+                                        "logdrain_cloudwatch_stream_prefix": {
+                                            "description": "Prepended to the container name to form the log stream name.",
+                                            "type": [
+                                                "string",
+                                                "null"
+                                            ]
                                         }
                                     },
                                     "type": "object"
@@ -16708,6 +17092,28 @@
                                     },
                                     "logdrain_custom_config_parser": {
                                         "type": "string"
+                                    },
+                                    "is_logdrain_cloudwatch_enabled": {
+                                        "type": "boolean"
+                                    },
+                                    "logdrain_cloudwatch_region": {
+                                        "type": [
+                                            "string",
+                                            "null"
+                                        ]
+                                    },
+                                    "logdrain_cloudwatch_group": {
+                                        "type": [
+                                            "string",
+                                            "null"
+                                        ]
+                                    },
+                                    "logdrain_cloudwatch_stream_prefix": {
+                                        "description": "Prepended to the container name to form the log stream name.",
+                                        "type": [
+                                            "string",
+                                            "null"
+                                        ]
                                     }
                                 },
                                 "type": "object"
@@ -17362,6 +17768,307 @@
                 ]
             }
         },
+        "\/servers\/{uuid}\/migrate": {
+            "post": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Migrate server to another Coolify instance",
+                "description": "Start a transfer in the background: export this server, import and claim it on the target instance (with the given token), then disable automations here. Follow the progress with GET \/servers\/{uuid}\/transfer. The target URL must use https. Requires read:sensitive and write.",
+                "operationId": "migrate-server-between-instances",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "required": [
+                                    "target_url",
+                                    "target_token"
+                                ],
+                                "properties": {
+                                    "target_url": {
+                                        "type": "string",
+                                        "example": "https:\/\/coolify-b.example.com"
+                                    },
+                                    "target_token": {
+                                        "description": "API token on the target instance (root or write)",
+                                        "type": "string"
+                                    }
+                                },
+                                "type": "object"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "202": {
+                        "description": "Transfer started"
+                    },
+                    "403": {
+                        "description": "Missing sensitive permission"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "description": "Validation or remote import failed"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/{uuid}\/transfer": {
+            "get": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Get server transfer status",
+                "description": "Show the transfer state of a server on this instance: the import\/claim state (transfer) and the state of a running or finished transfer to another instance (migration).",
+                "operationId": "get-server-transfer-status",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Transfer status"
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/import\/check": {
+            "get": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Check server import",
+                "description": "Check that this instance can import a server, before the source instance starts the transfer. It checks the token, the bundle version, the server limit, servers with the same UUID or IP, and that this instance can reach the SSH port of the server.",
+                "operationId": "check-server-import",
+                "parameters": [
+                    {
+                        "name": "server_uuid",
+                        "in": "query",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "ip",
+                        "in": "query",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "port",
+                        "in": "query",
+                        "required": false,
+                        "schema": {
+                            "type": "integer",
+                            "default": 22
+                        }
+                    },
+                    {
+                        "name": "schema_version",
+                        "in": "query",
+                        "required": false,
+                        "schema": {
+                            "type": "integer"
+                        }
+                    },
+                    {
+                        "name": "system_github_apps[]",
+                        "in": "query",
+                        "description": "UUIDs of system-wide GitHub Apps that the server uses. The response lists the ones this instance does not have.",
+                        "required": false,
+                        "schema": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    },
+                    {
+                        "name": "system_gitlab_apps[]",
+                        "in": "query",
+                        "description": "UUIDs of system-wide GitLab Apps that the server uses. The response lists the ones this instance does not have.",
+                        "required": false,
+                        "schema": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "The server can be imported. Lists every check with its result."
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "422": {
+                        "description": "One or more checks failed. Lists every check with its result."
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/import": {
+            "post": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Import server transfer bundle",
+                "description": "Import a server transfer bundle into this Coolify instance (adopt mode by default). This instance then manages the server, and Sentinel reports to it. Needs a token with the write and deploy permissions.",
+                "operationId": "import-server-transfer-bundle",
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "properties": {
+                                    "bundle": {
+                                        "description": "Transfer bundle",
+                                        "type": "object"
+                                    },
+                                    "dry_run": {
+                                        "type": "boolean",
+                                        "default": false
+                                    },
+                                    "preserve_uuids": {
+                                        "type": "boolean",
+                                        "default": true
+                                    },
+                                    "adopt_mode": {
+                                        "description": "Import without forcing redeploy; keep statuses for adoption",
+                                        "type": "boolean",
+                                        "default": true
+                                    }
+                                },
+                                "type": "object"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "200": {
+                        "description": "Dry-run result"
+                    },
+                    "201": {
+                        "description": "Imported"
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "403": {
+                        "description": "The token needs the write and deploy permissions."
+                    },
+                    "422": {
+                        "description": "Validation failed"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/{uuid}\/transfer\/complete": {
+            "post": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Mark server transferred",
+                "description": "Source-instance recovery step: disable automations here when the target already manages the server but the transfer could not finish on this instance.",
+                "operationId": "complete-server-transfer",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "properties": {
+                                    "export_id": {
+                                        "type": [
+                                            "string",
+                                            "null"
+                                        ]
+                                    },
+                                    "target_instance_url": {
+                                        "type": [
+                                            "string",
+                                            "null"
+                                        ]
+                                    }
+                                },
+                                "type": "object"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "200": {
+                        "description": "Marked transferred"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
         "\/servers": {
             "get": {
                 "tags": [
@@ -19414,6 +20121,11 @@
                                         "default": true,
                                         "description": "Escape special characters in labels. By default, $ (and other chars) is escaped. If you want to use env variables inside the labels, turn this off."
                                     },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "default": true,
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions."
+                                    },
                                     "tags": {
                                         "type": "array",
                                         "items": {
@@ -19744,6 +20456,11 @@
                                         "type": "boolean",
                                         "default": true,
                                         "description": "Escape special characters in labels. By default, $ (and other chars) is escaped. If you want to use env variables inside the labels, turn this off."
+                                    },
+                                    "redact_all_env_values_in_logs": {
+                                        "type": "boolean",
+                                        "default": true,
+                                        "description": "Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions."
                                     }
                                 },
                                 "type": "object"
@@ -23389,8 +24106,8 @@
                 "properties": {
                     "frequency": {
                         "type": "string",
-                        "maxLength": 255,
-                        "example": "0 2 * * *"
+                        "example": "0 2 * * *",
+                        "maxLength": 255
                     },
                     "enabled": {
                         "type": "boolean",
@@ -23410,11 +24127,19 @@
                         "default": false
                     },
                     "s3_storage_uuid": {
+                        "description": "Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination.",
                         "type": [
                             "string",
                             "null"
                         ]
                     },
+                    "s3_storage_uuids": {
+                        "description": "UUIDs of every S3 storage the backup is uploaded to. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination. save_s3 requires at least one destination.",
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        }
+                    },
                     "retention_amount_locally": {
                         "type": "integer",
                         "default": 7,
@@ -23523,11 +24248,19 @@
                         "type": "boolean"
                     },
                     "s3_storage_uuid": {
+                        "description": "Primary S3 destination.",
                         "type": [
                             "string",
                             "null"
                         ]
                     },
+                    "s3_storage_uuids": {
+                        "description": "Every S3 destination, primary first.",
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        }
+                    },
                     "retention_amount_locally": {
                         "type": "integer"
                     },
@@ -23963,6 +24696,32 @@
                         "nullable": true,
                         "description": "Password for HTTP Basic Authentication"
                     },
+                    "http_basic_auth_hash_algorithm": {
+                        "type": "string",
+                        "enum": [
+                            "bcrypt",
+                            "argon2id"
+                        ],
+                        "description": "Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer."
+                    },
+                    "http_basic_auth_bcrypt_cost": {
+                        "type": "integer",
+                        "minimum": 4,
+                        "maximum": 14,
+                        "description": "Bcrypt cost for the HTTP Basic Authentication password."
+                    },
+                    "http_basic_auth_argon2id_memory_cost": {
+                        "type": "integer",
+                        "minimum": 8192,
+                        "maximum": 262144,
+                        "description": "Argon2id memory cost in KiB for the HTTP Basic Authentication password."
+                    },
+                    "http_basic_auth_argon2id_time_cost": {
+                        "type": "integer",
+                        "minimum": 1,
+                        "maximum": 12,
+                        "description": "Argon2id time cost (iterations) for the HTTP Basic Authentication password."
+                    },
                     "settings": {
                         "$ref": "#\/components\/schemas\/ApplicationSetting"
                     }
@@ -24181,6 +24940,10 @@
                     "use_build_secrets": {
                         "type": "boolean"
                     },
+                    "redact_all_env_values_in_logs": {
+                        "type": "boolean",
+                        "description": "Hide every environment variable value in logs. When false, only locked values are hidden."
+                    },
                     "inject_build_args_to_dockerfile": {
                         "type": "boolean"
                     },
@@ -24568,6 +25331,9 @@
                     "is_logdrain_axiom_enabled": {
                         "type": "boolean"
                     },
+                    "is_logdrain_cloudwatch_enabled": {
+                        "type": "boolean"
+                    },
                     "is_logdrain_custom_enabled": {
                         "type": "boolean"
                     },
@@ -24638,6 +25404,15 @@
                     "logdrain_axiom_dataset_name": {
                         "type": "string"
                     },
+                    "logdrain_cloudwatch_region": {
+                        "type": "string"
+                    },
+                    "logdrain_cloudwatch_group": {
+                        "type": "string"
+                    },
+                    "logdrain_cloudwatch_stream_prefix": {
+                        "type": "string"
+                    },
                     "logdrain_custom_config": {
                         "type": "string"
                     },
@@ -24766,6 +25541,10 @@
                         "type": "boolean",
                         "description": "The flag to enable the container label escape."
                     },
+                    "redact_all_env_values_in_logs": {
+                        "type": "boolean",
+                        "description": "Hide every environment variable value in logs. When false, only locked values are hidden."
+                    },
                     "is_container_label_readonly_enabled": {
                         "type": "boolean",
                         "description": "The flag to enable the container label readonly."
@@ -25102,6 +25881,10 @@
             "name": "Hetzner",
             "description": "Hetzner"
         },
+        {
+            "name": "Hostinger",
+            "description": "Hostinger"
+        },
         {
             "name": "Settings",
             "description": "Settings"
diff --git a/openapi.yaml b/openapi.yaml
index 4b952e70ea..fff4540097 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -62,9 +62,9 @@ paths:
               properties:
                 pull_request_id:
                   type: integer
+                  example: 42
                   maximum: 2147483647
                   minimum: 1
-                  example: 42
                 pull_request_html_url:
                   type: [string, 'null']
                   example: 'https://github.com/org/repo/pull/42'
@@ -574,6 +574,9 @@ paths:
                 is_env_sorting_enabled:
                   type: boolean
                   description: 'Sort environment variables.'
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'
                 is_pr_deployments_public_enabled:
                   type: boolean
                   description: 'Make pull request deployments public.'
@@ -655,6 +658,29 @@ paths:
                   type: string
                   nullable: true
                   description: 'Password for HTTP Basic Authentication'
+                http_basic_auth_hash_algorithm:
+                  type: string
+                  enum: [bcrypt, argon2id]
+                  default: bcrypt
+                  description: 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'
+                http_basic_auth_bcrypt_cost:
+                  type: integer
+                  minimum: 4
+                  maximum: 14
+                  default: 10
+                  description: 'Bcrypt cost for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_memory_cost:
+                  type: integer
+                  minimum: 8192
+                  maximum: 262144
+                  default: 65536
+                  description: 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_time_cost:
+                  type: integer
+                  minimum: 1
+                  maximum: 12
+                  default: 4
+                  description: 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'
                 connect_to_docker_network:
                   type: boolean
                   description: 'The flag to connect the service to the predefined Docker network.'
@@ -969,6 +995,9 @@ paths:
                 is_env_sorting_enabled:
                   type: boolean
                   description: 'Sort environment variables.'
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'
                 is_pr_deployments_public_enabled:
                   type: boolean
                   description: 'Make pull request deployments public.'
@@ -1050,6 +1079,29 @@ paths:
                   type: string
                   nullable: true
                   description: 'Password for HTTP Basic Authentication'
+                http_basic_auth_hash_algorithm:
+                  type: string
+                  enum: [bcrypt, argon2id]
+                  default: bcrypt
+                  description: 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'
+                http_basic_auth_bcrypt_cost:
+                  type: integer
+                  minimum: 4
+                  maximum: 14
+                  default: 10
+                  description: 'Bcrypt cost for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_memory_cost:
+                  type: integer
+                  minimum: 8192
+                  maximum: 262144
+                  default: 65536
+                  description: 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_time_cost:
+                  type: integer
+                  minimum: 1
+                  maximum: 12
+                  default: 4
+                  description: 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'
                 connect_to_docker_network:
                   type: boolean
                   description: 'The flag to connect the service to the predefined Docker network.'
@@ -1364,6 +1416,9 @@ paths:
                 is_env_sorting_enabled:
                   type: boolean
                   description: 'Sort environment variables.'
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'
                 is_pr_deployments_public_enabled:
                   type: boolean
                   description: 'Make pull request deployments public.'
@@ -1445,6 +1500,29 @@ paths:
                   type: string
                   nullable: true
                   description: 'Password for HTTP Basic Authentication'
+                http_basic_auth_hash_algorithm:
+                  type: string
+                  enum: [bcrypt, argon2id]
+                  default: bcrypt
+                  description: 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'
+                http_basic_auth_bcrypt_cost:
+                  type: integer
+                  minimum: 4
+                  maximum: 14
+                  default: 10
+                  description: 'Bcrypt cost for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_memory_cost:
+                  type: integer
+                  minimum: 8192
+                  maximum: 262144
+                  default: 65536
+                  description: 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_time_cost:
+                  type: integer
+                  minimum: 1
+                  maximum: 12
+                  default: 4
+                  description: 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'
                 connect_to_docker_network:
                   type: boolean
                   description: 'The flag to connect the service to the predefined Docker network.'
@@ -1700,6 +1778,9 @@ paths:
                 is_env_sorting_enabled:
                   type: boolean
                   description: 'Sort environment variables.'
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'
                 is_pr_deployments_public_enabled:
                   type: boolean
                   description: 'Make pull request deployments public.'
@@ -1781,6 +1862,29 @@ paths:
                   type: string
                   nullable: true
                   description: 'Password for HTTP Basic Authentication'
+                http_basic_auth_hash_algorithm:
+                  type: string
+                  enum: [bcrypt, argon2id]
+                  default: bcrypt
+                  description: 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'
+                http_basic_auth_bcrypt_cost:
+                  type: integer
+                  minimum: 4
+                  maximum: 14
+                  default: 10
+                  description: 'Bcrypt cost for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_memory_cost:
+                  type: integer
+                  minimum: 8192
+                  maximum: 262144
+                  default: 65536
+                  description: 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_time_cost:
+                  type: integer
+                  minimum: 1
+                  maximum: 12
+                  default: 4
+                  description: 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'
                 connect_to_docker_network:
                   type: boolean
                   description: 'The flag to connect the service to the predefined Docker network.'
@@ -2022,6 +2126,9 @@ paths:
                 is_env_sorting_enabled:
                   type: boolean
                   description: 'Sort environment variables.'
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'
                 is_pr_deployments_public_enabled:
                   type: boolean
                   description: 'Make pull request deployments public.'
@@ -2103,6 +2210,29 @@ paths:
                   type: string
                   nullable: true
                   description: 'Password for HTTP Basic Authentication'
+                http_basic_auth_hash_algorithm:
+                  type: string
+                  enum: [bcrypt, argon2id]
+                  default: bcrypt
+                  description: 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'
+                http_basic_auth_bcrypt_cost:
+                  type: integer
+                  minimum: 4
+                  maximum: 14
+                  default: 10
+                  description: 'Bcrypt cost for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_memory_cost:
+                  type: integer
+                  minimum: 8192
+                  maximum: 262144
+                  default: 65536
+                  description: 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_time_cost:
+                  type: integer
+                  minimum: 1
+                  maximum: 12
+                  default: 4
+                  description: 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'
                 connect_to_docker_network:
                   type: boolean
                   description: 'The flag to connect the service to the predefined Docker network.'
@@ -2467,6 +2597,25 @@ paths:
                 use_build_secrets:
                   type: boolean
                   description: 'Use Docker Build Secrets for build-time environment variables.'
+                http_basic_auth_hash_algorithm:
+                  type: string
+                  enum: [bcrypt, argon2id]
+                  description: 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'
+                http_basic_auth_bcrypt_cost:
+                  type: integer
+                  minimum: 4
+                  maximum: 14
+                  description: 'Bcrypt cost for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_memory_cost:
+                  type: integer
+                  minimum: 8192
+                  maximum: 262144
+                  description: 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'
+                http_basic_auth_argon2id_time_cost:
+                  type: integer
+                  minimum: 1
+                  maximum: 12
+                  description: 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'
                 is_git_submodules_enabled:
                   type: boolean
                   description: 'Clone Git submodules.'
@@ -2488,6 +2637,9 @@ paths:
                 is_env_sorting_enabled:
                   type: boolean
                   description: 'Sort environment variables.'
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'
                 is_pr_deployments_public_enabled:
                   type: boolean
                   description: 'Make pull request deployments public.'
@@ -3582,7 +3734,7 @@ paths:
       tags:
         - Applications
       summary: 'List Rollback Images'
-      description: 'List available Docker images for rolling back an application. Returns an empty list when the server is unavailable or remote inspection is not possible.'
+      description: 'List available Docker images for rolling back an application: images on the server (`local`) and, when a Docker registry image name is set, images of recent successful deployments in the registry (`registry`). Returns an empty list when the server is unavailable or remote inspection is not possible.'
       operationId: list-application-rollback-images
       parameters:
         -
@@ -3600,7 +3752,7 @@ paths:
               schema:
                 properties:
                   current: { type: [string, 'null'] }
-                  images: { type: array, items: { properties: { tag: { type: string }, created_at: { type: string }, is_current: { type: boolean } }, type: object } }
+                  images: { type: array, items: { properties: { tag: { type: string }, created_at: { type: string }, is_current: { type: boolean }, source: { type: string, enum: [local, registry] } }, type: object } }
                 type: object
         '401':
           $ref: '#/components/responses/401'
@@ -3989,7 +4141,7 @@ paths:
               schema:
                 type: array
                 items:
-                  properties: { uuid: { type: string }, name: { type: string }, provider: { type: string, enum: [hetzner, digitalocean, vultr] }, team_id: { type: integer }, servers_count: { type: integer }, created_at: { type: string }, updated_at: { type: string } }
+                  properties: { uuid: { type: string }, name: { type: string }, provider: { type: string, enum: [hetzner, digitalocean, vultr, hostinger] }, team_id: { type: integer }, servers_count: { type: integer }, created_at: { type: string }, updated_at: { type: string } }
                   type: object
         '401':
           $ref: '#/components/responses/401'
@@ -4017,7 +4169,7 @@ paths:
               properties:
                 provider:
                   type: string
-                  enum: [hetzner, digitalocean, vultr]
+                  enum: [hetzner, digitalocean, vultr, hostinger]
                   example: hetzner
                   description: 'The cloud provider.'
                 token:
@@ -4318,7 +4470,7 @@ paths:
             type: string
       responses:
         '200':
-          description: 'Get all backups for a database'
+          description: 'Get all backups for a database. Each backup includes s3_storage_uuid (primary S3 destination) and s3_storage_uuids (every S3 destination, primary first).'
           content:
             application/json:
               schema:
@@ -4369,7 +4521,11 @@ paths:
                   default: false
                 s3_storage_uuid:
                   type: string
-                  description: 'S3 storage UUID (required if save_s3 is true)'
+                  description: 'Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination. Either field is required if save_s3 is true.'
+                s3_storage_uuids:
+                  type: array
+                  items: { type: string }
+                  description: 'UUIDs of every S3 storage the backup is uploaded to. Replaces the current destinations. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination.'
                 databases_to_backup:
                   type: string
                   description: 'Comma separated list of databases to backup'
@@ -4701,6 +4857,9 @@ paths:
                   description: 'Healthcheck start period in seconds.'
                   minimum: 0
                   default: 5
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values, database passwords, and remote secrets are redacted. Requires team admin permissions.'
               type: object
       responses:
         '200':
@@ -4801,7 +4960,11 @@ paths:
                   description: 'Whether data is saved in s3 or not'
                 s3_storage_uuid:
                   type: string
-                  description: 'S3 storage UUID'
+                  description: 'Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination; when it is already a destination, it becomes the primary destination and the other destinations stay.'
+                s3_storage_uuids:
+                  type: array
+                  items: { type: string }
+                  description: 'UUIDs of every S3 storage the backup is uploaded to. Replaces the current destinations. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination.'
                 backup_now:
                   type: boolean
                   description: 'Whether to take a backup now or not. Needs a token with the deploy permission.'
@@ -5888,7 +6051,7 @@ paths:
       tags:
         - Databases
       summary: 'List backup executions'
-      description: 'Get all executions for a specific backup configuration.'
+      description: 'Get all executions for a specific backup configuration. The execution `message` is only returned (redacted) to tokens with the `read:sensitive` or `root` ability; otherwise it is `null`.'
       operationId: list-backup-executions
       parameters:
         -
@@ -5912,7 +6075,7 @@ paths:
             application/json:
               schema:
                 properties:
-                  executions: { type: array, items: { properties: { uuid: { type: string }, filename: { type: string }, size: { type: integer }, created_at: { type: string }, message: { type: string }, status: { type: string } }, type: object } }
+                  executions: { type: array, items: { properties: { uuid: { type: string }, filename: { type: string }, size: { type: integer }, created_at: { type: string }, message: { description: 'Redacted execution output. Null unless the token has the `read:sensitive` or `root` ability.', type: [string, 'null'] }, status: { type: string } }, type: object } }
                 type: object
         '404':
           description: 'Backup configuration not found.'
@@ -7031,8 +7194,8 @@ paths:
                 network:
                   description: 'Name of a new Docker network. Must not be bridge, host, none, or a network that already exists on the server.'
                   type: string
-                  maxLength: 255
                   pattern: '^[a-zA-Z0-9][a-zA-Z0-9._-]*$'
+                  maxLength: 255
                 type:
                   type: string
                   enum: [standalone, swarm]
@@ -8184,6 +8347,126 @@ paths:
       security:
         -
           bearerAuth: []
+  /hostinger/data-centers:
+    get:
+      tags:
+        - Hostinger
+      summary: 'Get Hostinger VPS data centers'
+      operationId: get-hostinger-data-centers
+      responses:
+        '200':
+          description: 'List of Hostinger VPS data centers.'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          description: 'Hostinger denied access to this resource for the cloud provider token.'
+        '422':
+          description: 'Validation failed.'
+        '429':
+          description: 'Hostinger rate limit exceeded.'
+      security:
+        -
+          bearerAuth: []
+  /hostinger/catalog:
+    get:
+      tags:
+        - Hostinger
+      summary: 'Get Hostinger VPS plans and prices'
+      operationId: get-hostinger-catalog
+      responses:
+        '200':
+          description: 'List of Hostinger VPS plans and prices.'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          description: 'Hostinger denied access to this resource for the cloud provider token.'
+        '422':
+          description: 'Validation failed.'
+        '429':
+          description: 'Hostinger rate limit exceeded.'
+      security:
+        -
+          bearerAuth: []
+  /hostinger/templates:
+    get:
+      tags:
+        - Hostinger
+      summary: 'Get Hostinger VPS operating system templates'
+      operationId: get-hostinger-templates
+      responses:
+        '200':
+          description: 'List of Hostinger VPS templates.'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          description: 'Hostinger denied access to this resource for the cloud provider token.'
+        '422':
+          description: 'Validation failed.'
+        '429':
+          description: 'Hostinger rate limit exceeded.'
+      security:
+        -
+          bearerAuth: []
+  /hostinger/ssh-keys:
+    get:
+      tags:
+        - Hostinger
+      summary: 'Get Hostinger account SSH keys'
+      operationId: get-hostinger-ssh-keys
+      responses:
+        '200':
+          description: 'List of Hostinger account SSH keys.'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          description: 'Hostinger denied access to this resource for the cloud provider token.'
+        '422':
+          description: 'Validation failed.'
+        '429':
+          description: 'Hostinger rate limit exceeded.'
+      security:
+        -
+          bearerAuth: []
+  /hostinger/post-install-scripts:
+    get:
+      tags:
+        - Hostinger
+      summary: 'Get Hostinger post-install scripts'
+      operationId: get-hostinger-post-install-scripts
+      responses:
+        '200':
+          description: 'List of Hostinger post-install scripts.'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          description: 'Hostinger denied access to this resource for the cloud provider token.'
+        '422':
+          description: 'Validation failed.'
+        '429':
+          description: 'Hostinger rate limit exceeded.'
+      security:
+        -
+          bearerAuth: []
+  /servers/hostinger:
+    post:
+      tags:
+        - Hostinger
+      summary: 'Purchase a Hostinger VPS and create a linked server'
+      operationId: create-hostinger-server
+      responses:
+        '201':
+          description: 'Hostinger VPS purchased and linked to a Coolify server.'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          description: 'The token needs the deploy permission for a post-install script or extra SSH keys.'
+        '422':
+          description: 'Validation failed.'
+        '429':
+          description: 'Hostinger rate limit exceeded.'
+      security:
+        -
+          bearerAuth: []
   /settings/email:
     get:
       tags:
@@ -8500,35 +8783,6 @@ paths:
       security:
         -
           bearerAuth: []
-  /enable:
-    post:
-      summary: 'Enable API'
-      description: 'Enable API (only with root permissions).'
-      operationId: enable-api
-      responses:
-        '200':
-          description: 'Enable API.'
-          content:
-            application/json:
-              schema:
-                properties:
-                  message: { type: string, example: 'API enabled.' }
-                type: object
-        '403':
-          description: 'You are not allowed to enable the API.'
-          content:
-            application/json:
-              schema:
-                properties:
-                  message: { type: string, example: 'You are not allowed to enable the API.' }
-                type: object
-        '401':
-          $ref: '#/components/responses/401'
-        '400':
-          $ref: '#/components/responses/400'
-      security:
-        -
-          bearerAuth: []
   /disable:
     post:
       summary: 'Disable API'
@@ -10020,8 +10274,6 @@ paths:
         content:
           application/json:
             schema:
-              required:
-                - private_key
               properties:
                 name:
                   type: string
@@ -10570,6 +10822,10 @@ paths:
                   is_logdrain_custom_enabled: { type: boolean }
                   logdrain_custom_config: { description: 'Only present with read:sensitive.', type: string }
                   logdrain_custom_config_parser: { description: 'Only present with read:sensitive.', type: string }
+                  is_logdrain_cloudwatch_enabled: { type: boolean }
+                  logdrain_cloudwatch_region: { type: [string, 'null'] }
+                  logdrain_cloudwatch_group: { type: [string, 'null'] }
+                  logdrain_cloudwatch_stream_prefix: { description: 'Prepended to the container name to form the log stream name.', type: [string, 'null'] }
                 type: object
         '401':
           $ref: '#/components/responses/401'
@@ -10618,6 +10874,15 @@ paths:
                   type: string
                 logdrain_custom_config_parser:
                   type: string
+                is_logdrain_cloudwatch_enabled:
+                  type: boolean
+                logdrain_cloudwatch_region:
+                  type: [string, 'null']
+                logdrain_cloudwatch_group:
+                  type: [string, 'null']
+                logdrain_cloudwatch_stream_prefix:
+                  description: 'Prepended to the container name to form the log stream name.'
+                  type: [string, 'null']
               type: object
       responses:
         '200':
@@ -10952,6 +11217,206 @@ paths:
       security:
         -
           bearerAuth: []
+  '/servers/{uuid}/migrate':
+    post:
+      tags:
+        - Servers
+      summary: 'Migrate server to another Coolify instance'
+      description: 'Start a transfer in the background: export this server, import and claim it on the target instance (with the given token), then disable automations here. Follow the progress with GET /servers/{uuid}/transfer. The target URL must use https. Requires read:sensitive and write.'
+      operationId: migrate-server-between-instances
+      parameters:
+        -
+          name: uuid
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              required:
+                - target_url
+                - target_token
+              properties:
+                target_url:
+                  type: string
+                  example: 'https://coolify-b.example.com'
+                target_token:
+                  description: 'API token on the target instance (root or write)'
+                  type: string
+              type: object
+      responses:
+        '202':
+          description: 'Transfer started'
+        '403':
+          description: 'Missing sensitive permission'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          description: 'Validation or remote import failed'
+      security:
+        -
+          bearerAuth: []
+  '/servers/{uuid}/transfer':
+    get:
+      tags:
+        - Servers
+      summary: 'Get server transfer status'
+      description: 'Show the transfer state of a server on this instance: the import/claim state (transfer) and the state of a running or finished transfer to another instance (migration).'
+      operationId: get-server-transfer-status
+      parameters:
+        -
+          name: uuid
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: 'Transfer status'
+        '401':
+          $ref: '#/components/responses/401'
+        '404':
+          $ref: '#/components/responses/404'
+      security:
+        -
+          bearerAuth: []
+  /servers/import/check:
+    get:
+      tags:
+        - Servers
+      summary: 'Check server import'
+      description: 'Check that this instance can import a server, before the source instance starts the transfer. It checks the token, the bundle version, the server limit, servers with the same UUID or IP, and that this instance can reach the SSH port of the server.'
+      operationId: check-server-import
+      parameters:
+        -
+          name: server_uuid
+          in: query
+          required: true
+          schema:
+            type: string
+        -
+          name: ip
+          in: query
+          required: true
+          schema:
+            type: string
+        -
+          name: port
+          in: query
+          required: false
+          schema:
+            type: integer
+            default: 22
+        -
+          name: schema_version
+          in: query
+          required: false
+          schema:
+            type: integer
+        -
+          name: 'system_github_apps[]'
+          in: query
+          description: 'UUIDs of system-wide GitHub Apps that the server uses. The response lists the ones this instance does not have.'
+          required: false
+          schema:
+            type: array
+            items:
+              type: string
+        -
+          name: 'system_gitlab_apps[]'
+          in: query
+          description: 'UUIDs of system-wide GitLab Apps that the server uses. The response lists the ones this instance does not have.'
+          required: false
+          schema:
+            type: array
+            items:
+              type: string
+      responses:
+        '200':
+          description: 'The server can be imported. Lists every check with its result.'
+        '401':
+          $ref: '#/components/responses/401'
+        '422':
+          description: 'One or more checks failed. Lists every check with its result.'
+      security:
+        -
+          bearerAuth: []
+  /servers/import:
+    post:
+      tags:
+        - Servers
+      summary: 'Import server transfer bundle'
+      description: 'Import a server transfer bundle into this Coolify instance (adopt mode by default). This instance then manages the server, and Sentinel reports to it. Needs a token with the write and deploy permissions.'
+      operationId: import-server-transfer-bundle
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              properties:
+                bundle:
+                  description: 'Transfer bundle'
+                  type: object
+                dry_run:
+                  type: boolean
+                  default: false
+                preserve_uuids:
+                  type: boolean
+                  default: true
+                adopt_mode:
+                  description: 'Import without forcing redeploy; keep statuses for adoption'
+                  type: boolean
+                  default: true
+              type: object
+      responses:
+        '200':
+          description: 'Dry-run result'
+        '201':
+          description: Imported
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          description: 'The token needs the write and deploy permissions.'
+        '422':
+          description: 'Validation failed'
+      security:
+        -
+          bearerAuth: []
+  '/servers/{uuid}/transfer/complete':
+    post:
+      tags:
+        - Servers
+      summary: 'Mark server transferred'
+      description: 'Source-instance recovery step: disable automations here when the target already manages the server but the transfer could not finish on this instance.'
+      operationId: complete-server-transfer
+      parameters:
+        -
+          name: uuid
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              properties:
+                export_id:
+                  type: [string, 'null']
+                target_instance_url:
+                  type: [string, 'null']
+              type: object
+      responses:
+        '200':
+          description: 'Marked transferred'
+        '404':
+          $ref: '#/components/responses/404'
+      security:
+        -
+          bearerAuth: []
   /servers:
     get:
       tags:
@@ -12268,6 +12733,10 @@ paths:
                   type: boolean
                   default: true
                   description: 'Escape special characters in labels. By default, $ (and other chars) is escaped. If you want to use env variables inside the labels, turn this off.'
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  default: true
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'
                 tags:
                   type: array
                   items: { type: string }
@@ -12456,6 +12925,10 @@ paths:
                   type: boolean
                   default: true
                   description: 'Escape special characters in labels. By default, $ (and other chars) is escaped. If you want to use env variables inside the labels, turn this off.'
+                redact_all_env_values_in_logs:
+                  type: boolean
+                  default: true
+                  description: 'Redact all environment variable values in logs. When false, only locked (shown once) values are redacted. Requires team admin permissions.'
               type: object
       responses:
         '200':
@@ -14830,8 +15303,8 @@ components:
       properties:
         frequency:
           type: string
-          maxLength: 255
           example: '0 2 * * *'
+          maxLength: 255
         enabled:
           type: boolean
           default: true
@@ -14846,9 +15319,15 @@ components:
           type: boolean
           default: false
         s3_storage_uuid:
+          description: 'Primary S3 storage UUID. Sent without s3_storage_uuids, it selects this storage as the only destination.'
           type:
             - string
             - 'null'
+        s3_storage_uuids:
+          description: 'UUIDs of every S3 storage the backup is uploaded to. When s3_storage_uuid is also sent, it must be in this list and becomes the primary destination; otherwise the first entry is the primary destination. save_s3 requires at least one destination.'
+          type: array
+          items:
+            type: string
         retention_amount_locally:
           type: integer
           default: 7
@@ -14936,9 +15415,15 @@ components:
         stop_during_backup:
           type: boolean
         s3_storage_uuid:
+          description: 'Primary S3 destination.'
           type:
             - string
             - 'null'
+        s3_storage_uuids:
+          description: 'Every S3 destination, primary first.'
+          type: array
+          items:
+            type: string
         retention_amount_locally:
           type: integer
         retention_days_locally:
@@ -15275,6 +15760,27 @@ components:
           type: string
           nullable: true
           description: 'Password for HTTP Basic Authentication'
+        http_basic_auth_hash_algorithm:
+          type: string
+          enum:
+            - bcrypt
+            - argon2id
+          description: 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'
+        http_basic_auth_bcrypt_cost:
+          type: integer
+          minimum: 4
+          maximum: 14
+          description: 'Bcrypt cost for the HTTP Basic Authentication password.'
+        http_basic_auth_argon2id_memory_cost:
+          type: integer
+          minimum: 8192
+          maximum: 262144
+          description: 'Argon2id memory cost in KiB for the HTTP Basic Authentication password.'
+        http_basic_auth_argon2id_time_cost:
+          type: integer
+          minimum: 1
+          maximum: 12
+          description: 'Argon2id time cost (iterations) for the HTTP Basic Authentication password.'
         settings:
           $ref: '#/components/schemas/ApplicationSetting'
       type: object
@@ -15425,6 +15931,9 @@ components:
           type: boolean
         use_build_secrets:
           type: boolean
+        redact_all_env_values_in_logs:
+          type: boolean
+          description: 'Hide every environment variable value in logs. When false, only locked values are hidden.'
         inject_build_args_to_dockerfile:
           type: boolean
         include_source_commit_in_build:
@@ -15703,6 +16212,8 @@ components:
           type: boolean
         is_logdrain_axiom_enabled:
           type: boolean
+        is_logdrain_cloudwatch_enabled:
+          type: boolean
         is_logdrain_custom_enabled:
           type: boolean
         is_logdrain_highlight_enabled:
@@ -15751,6 +16262,12 @@ components:
           type: string
         logdrain_axiom_dataset_name:
           type: string
+        logdrain_cloudwatch_region:
+          type: string
+        logdrain_cloudwatch_group:
+          type: string
+        logdrain_cloudwatch_stream_prefix:
+          type: string
         logdrain_custom_config:
           type: string
         logdrain_custom_config_parser:
@@ -15844,6 +16361,9 @@ components:
         is_container_label_escape_enabled:
           type: boolean
           description: 'The flag to enable the container label escape.'
+        redact_all_env_values_in_logs:
+          type: boolean
+          description: 'Hide every environment variable value in logs. When false, only locked values are hidden.'
         is_container_label_readonly_enabled:
           type: boolean
           description: 'The flag to enable the container label readonly.'
@@ -16072,6 +16592,9 @@ tags:
   -
     name: Hetzner
     description: Hetzner
+  -
+    name: Hostinger
+    description: Hostinger
   -
     name: Settings
     description: Settings
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index c8ee5c91c9..50f381b7b6 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,20 +1,20 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.4.6"
+            "version": "4.5.0"
         },
         "nightly": {
-            "version": "4.5-rc.1"
+            "version": "4.6-rc.1"
         },
         "helper": {
-            "version": "1.0.17"
+            "version": "1.0.18"
         },
         "sentinel": {
-            "version": "1.0.2"
+            "version": "1.1.2"
         },
         "sentinel-host": {
-            "version": "1.0.2",
-            "digest": "sha256:ef4a41f2dfaf20c91c165244508bda12f9b66eb046fd8ae8b575158ccd61262e"
+            "version": "1.1.1",
+            "digest": "sha256:b8b686616eb09fc014c616eeb6ff6c2c96fd62429d2fafa06706695fdbe72f1b"
         }
     },
     "traefik": {
diff --git a/package-lock.json b/package-lock.json
index 845040db6e..187d8593eb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6,6 +6,7 @@
         "": {
             "name": "coolify",
             "dependencies": {
+                "@laravel/passkeys": "^0.4.0",
                 "@tailwindcss/forms": "0.5.11",
                 "@tailwindcss/typography": "0.5.20",
                 "@tanstack/virtual-core": "3.17.11",
@@ -16,12 +17,14 @@
                 "tw-animate-css": "1.4.0"
             },
             "devDependencies": {
+                "@sveltejs/vite-plugin-svelte": "7.3.1",
                 "@tailwindcss/postcss": "4.3.3",
                 "laravel-vite-plugin": "3.1.3",
                 "postcss": "8.5.26",
+                "svelte": "5.57.2",
                 "tailwind-scrollbar": "4.0.2",
                 "tailwindcss": "4.3.3",
-                "vite": "8.2.1"
+                "vite": "8.3.4"
             }
         },
         "node_modules/@alloc/quick-lru": {
@@ -41,7 +44,7 @@
             "version": "0.3.13",
             "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
             "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-            "dev": true,
+            "devOptional": true,
             "license": "MIT",
             "dependencies": {
                 "@jridgewell/sourcemap-codec": "^1.5.0",
@@ -52,7 +55,7 @@
             "version": "2.3.5",
             "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
             "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-            "dev": true,
+            "devOptional": true,
             "license": "MIT",
             "dependencies": {
                 "@jridgewell/gen-mapping": "^0.3.5",
@@ -63,44 +66,89 @@
             "version": "3.1.2",
             "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
             "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-            "dev": true,
+            "devOptional": true,
             "license": "MIT",
             "engines": {
                 "node": ">=6.0.0"
             }
         },
         "node_modules/@jridgewell/sourcemap-codec": {
-            "version": "1.5.5",
-            "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-            "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-            "dev": true,
+            "version": "1.6.0",
+            "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+            "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
+            "devOptional": true,
             "license": "MIT"
         },
         "node_modules/@jridgewell/trace-mapping": {
             "version": "0.3.31",
             "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
             "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-            "dev": true,
+            "devOptional": true,
             "license": "MIT",
             "dependencies": {
                 "@jridgewell/resolve-uri": "^3.1.0",
                 "@jridgewell/sourcemap-codec": "^1.4.14"
             }
         },
+        "node_modules/@laravel/passkeys": {
+            "version": "0.4.0",
+            "resolved": "https://registry.npmjs.org/@laravel/passkeys/-/passkeys-0.4.0.tgz",
+            "integrity": "sha512-59UHJHZPrIT8f5hFQJUR1EXhazWZTg3DcJefxSfA3aRj6xu40I/lYDveUY4oL2/h/crq9jjptSKykZDDold7aA==",
+            "license": "MIT",
+            "dependencies": {
+                "@simplewebauthn/browser": "^13.0.0"
+            },
+            "engines": {
+                "node": ">=20.19.0"
+            },
+            "peerDependencies": {
+                "react": "^18.0.0 || ^19.0.0",
+                "svelte": "^5.0.0",
+                "vue": "^3.3.0"
+            },
+            "peerDependenciesMeta": {
+                "react": {
+                    "optional": true
+                },
+                "svelte": {
+                    "optional": true
+                },
+                "vue": {
+                    "optional": true
+                }
+            }
+        },
         "node_modules/@oxc-project/types": {
-            "version": "0.143.0",
-            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.143.0.tgz",
-            "integrity": "sha512-u6JZdLBTLotrNC9Vd6vPssINdzcCzleKAH6EJKImQb7GtYvX5keN2dxkoK44stCc4tffE6QQRtZTXVSzsLUlWA==",
+            "version": "0.154.0",
+            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.154.0.tgz",
+            "integrity": "sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==",
             "dev": true,
             "license": "MIT",
             "funding": {
-                "url": "https://github.com/sponsors/Boshen"
+                "url": "https://github.com/sponsors/oxc-project"
+            }
+        },
+        "node_modules/@rolldown/binding-android-arm-eabi": {
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.14.tgz",
+            "integrity": "sha512-aWR+XKH9+rW7m5fWq/5360J3mHycrx/o6xZM2DQFdJnTMdyP7/WzxPjhtLbVWdKo2y612/4U1bWqb3HQhiF7vg==",
+            "cpu": [
+                "arm"
+            ],
+            "dev": true,
+            "license": "MIT",
+            "optional": true,
+            "os": [
+                "android"
+            ],
+            "engines": {
+                "node": "^20.19.0 || >=22.12.0"
             }
         },
         "node_modules/@rolldown/binding-android-arm64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.3.tgz",
-            "integrity": "sha512-zrJtHDcaZJ1Fp7xf4hNl+7seH9Cn/N5TwLYkhgXREtBwAd/jaqW3uqeHxpDugJLVICWg4eW44kOQEGJ1r6jCGw==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.14.tgz",
+            "integrity": "sha512-QiVxHofl6A8lQU7WAtOUY4QMVZXohxwz7WJJoeh8NBEUyKfIkMRKhYyq8az/1RypNiIXzNTtiS6KwHz0erxYRQ==",
             "cpu": [
                 "arm64"
             ],
@@ -115,9 +163,9 @@
             }
         },
         "node_modules/@rolldown/binding-darwin-arm64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.3.tgz",
-            "integrity": "sha512-ieIiibVCp0tX7TLu2cafoNPv8wJyYi01ekXpbf8q2j7F4rGAhhXb/eQh7ge9DRBY78GwmRQtvjZDux7EDbA8kA==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.14.tgz",
+            "integrity": "sha512-lTQOzHuBIooh3jIr5XINQkjPGEuGy+Dsy0meXDr6Sjty0b99kYgGh4uBC/8mJX1T0kC8d6S0aPP1Y+bHkh6aBw==",
             "cpu": [
                 "arm64"
             ],
@@ -132,9 +180,9 @@
             }
         },
         "node_modules/@rolldown/binding-darwin-x64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.3.tgz",
-            "integrity": "sha512-Zh9tCon19eDXJoihx0rqKhMUlMYqzwj3aPsSuHmI4RWZh62dWUL+DJN4C5YQya5TcQBJU/Fe8+rY0jhXTQITqA==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.14.tgz",
+            "integrity": "sha512-hyMKEGatjmBYCs/Q4sbIcL/GqpFEqsX3wc+HYVQ/85A4rxc1o7rPm4DUI4GV4k/h0ITddwFSGpqQunI14GXjTA==",
             "cpu": [
                 "x64"
             ],
@@ -149,9 +197,9 @@
             }
         },
         "node_modules/@rolldown/binding-freebsd-x64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.3.tgz",
-            "integrity": "sha512-nGbJWewA1wrXXZiQhjAT5rhibGfns5ZNkDVqxsO6zJ3f3YvpoDNNmGMSbbhLuXKjNScaBJVOAboztAWVespQMg==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.14.tgz",
+            "integrity": "sha512-u371GbXoVXrEgP20PwzoGNOdAOqAMhzo19JzzY+V4YmmnC+DTOoqdbMu+O+54emM59Mik/UdrtWgcuEDKWRPKA==",
             "cpu": [
                 "x64"
             ],
@@ -166,9 +214,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.3.tgz",
-            "integrity": "sha512-QNniJr5Kml0kDEB98jiDOJjXNroxIIi0IXIbdYzY26Xt1pVbeP62+KnoIZLwirOymX/0jDk/2gI/bNUv7A7OIw==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.14.tgz",
+            "integrity": "sha512-BqwKsdZQf6EqVWr8fv2MrDYzAvOZ7+NYFSJESRGs87fkseEhs0TU9TXgRJTkZoRRkxTizyEg1LKUXfU3/78uqg==",
             "cpu": [
                 "arm"
             ],
@@ -183,9 +231,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm64-gnu": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.3.tgz",
-            "integrity": "sha512-TkqEAcmmvH3I/q4114NB4RVt6241Dao48pF45uLcFGrwAaIn0iITgTAKP/dLjbN0R4buJjGb91+UHSoFmpgIWw==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.14.tgz",
+            "integrity": "sha512-SD9kY8M009x/7s57Z1dgUVlP5+uYBgKQK0Tkr1WIWngrtUJmRCW1RJFMY7QDla2khXhmg2i5Io7MUjcmZNZ/KQ==",
             "cpu": [
                 "arm64"
             ],
@@ -203,9 +251,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm64-musl": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.3.tgz",
-            "integrity": "sha512-NHqjnxpsndf4MPymxteFAWHHfkTL8HjWh1KB7z23ofZ6QO2euONuxDXjat69dKZRALnGypg8k8SsK8vZJoXv1Q==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.14.tgz",
+            "integrity": "sha512-BJ2CL19M6uuWesMgnqJzgxoI+N+eV7b0A9O9vLV42y+gitC41fNa8KElau1tHVzuLWX5GzEuxMPhAO0tQXQMkg==",
             "cpu": [
                 "arm64"
             ],
@@ -223,9 +271,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.3.tgz",
-            "integrity": "sha512-6tbrbwfz5GB9DQ4Jwo6hy9v+vR31xZlvzZ6n5Xut6Hhx5PvrA9q/HsK8KMaYQp063iqZGXwNvZtYNLD7EM/x0w==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.14.tgz",
+            "integrity": "sha512-4+Kl8daPV8NDHaD7mfCcc1pRM+Qg7ab8DyMm5FG5WoZgv4h2i3KFN1CybYBNbQqmuYm7ftJLvmMI1eHYJ22S/Q==",
             "cpu": [
                 "ppc64"
             ],
@@ -243,9 +291,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-s390x-gnu": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.3.tgz",
-            "integrity": "sha512-oyuXxXmoZHjXC917IAPFAAv4wWAa0cM9afk8nx1+9/jNNOX1uPf8yDA6p7G0RypOfw/X0PQt5IfoquY1um+zSg==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.14.tgz",
+            "integrity": "sha512-V/h8ePq1fKDrmtFMz6xcCN3DKvuvMRrwwD1q0PkBeeo4DpK64biaKvqWGVxqCeYKqeRk7gE7/iKPxLCn08O97A==",
             "cpu": [
                 "s390x"
             ],
@@ -263,9 +311,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-x64-gnu": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.3.tgz",
-            "integrity": "sha512-TytMwF2KVGqP2tgd0I1OY0PAv78dZRAYcF5ssDzjM34SUXCED3uXvSd5+lHoC0bTD6eEdFz7LdQNCO1y0oVk9w==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.14.tgz",
+            "integrity": "sha512-WxalXzgrLVpKC93xfpaJ3gCXUWzeCr+FRCbDVD2mUAy4L6Vo3lNVz0epUEUpxPWJkLNYUwM4OSIikv36OJ9mLg==",
             "cpu": [
                 "x64"
             ],
@@ -283,9 +331,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-x64-musl": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.3.tgz",
-            "integrity": "sha512-/E9m3qstrJFVPoULV25mVQblSNExY2+kBsYe4sy0Tn0yOOgJ8wZbZt3KnRbF/XeU2Gl1STKUQnDNTqhIE5MD4A==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.14.tgz",
+            "integrity": "sha512-3G3tnAmTpdk9jO3GQtyHXqeFD2SlecfTws/Y3M2mmj9nMBwwuLT4kur8sZKeu7ENUHSpVO3cIsm5A52LEWWwlg==",
             "cpu": [
                 "x64"
             ],
@@ -303,9 +351,9 @@
             }
         },
         "node_modules/@rolldown/binding-openharmony-arm64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.3.tgz",
-            "integrity": "sha512-Kr0OcsoQI816i6HOl3vFHpd1K0eZyh76zgfj4c1nTyaTsd5r2Mj1lwM4R90y/qaCfmTn9eHy0SKwi98eitRxug==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.14.tgz",
+            "integrity": "sha512-qyr5XiNGxm2ytx17vvtcJ9nXn6v1gENETi503bJx3OGwZ1tSonj7BosxbMa/xeAfSl5iS9X6KjEWYXLu6v1L7Q==",
             "cpu": [
                 "arm64"
             ],
@@ -320,9 +368,9 @@
             }
         },
         "node_modules/@rolldown/binding-win32-arm64-msvc": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.3.tgz",
-            "integrity": "sha512-hOtMwTqnME+/gJcH/PCZ0wn0zPUjiWOgkHpxbSJpfGKMezHltx1S7/k1SitzVa7Ww2cqrDDaFbZEhcJZO8o+Jw==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.14.tgz",
+            "integrity": "sha512-oA4o5o0S2yB199YyYXDzKUv1Z56Rc+mgOjwm7Z/vJ9Z8igiDPYvoOuDyo6g7AK/ZaF09nPhDKVnGBcYHO11GXA==",
             "cpu": [
                 "arm64"
             ],
@@ -337,9 +385,9 @@
             }
         },
         "node_modules/@rolldown/binding-win32-x64-msvc": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.3.tgz",
-            "integrity": "sha512-ekcqMMkI2PlhYnfzQnB/cEdYUVVJViWvoUyLrbzgDoi3Snfc1mVBwdnc306ufA5ejy8JSPjT2RlW1nQSjW7efg==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.14.tgz",
+            "integrity": "sha512-9mE94bf2GZUaR/fUSXCMpBoWkctu421Mi0ORpm4zqfbkjKep7RxzPFa5etcGs5h+2KApoWBOA/hAJa/7saGgEQ==",
             "cpu": [
                 "x64"
             ],
@@ -360,6 +408,52 @@
             "dev": true,
             "license": "MIT"
         },
+        "node_modules/@simplewebauthn/browser": {
+            "version": "13.3.0",
+            "resolved": "https://registry.npmjs.org/@simplewebauthn/browser/-/browser-13.3.0.tgz",
+            "integrity": "sha512-BE/UWv6FOToAdVk0EokzkqQQDOWtNydYlY6+OrmiZ5SCNmb41VehttboTetUM3T/fr6EAFYVXjz4My2wg230rQ==",
+            "license": "MIT"
+        },
+        "node_modules/@sveltejs/acorn-typescript": {
+            "version": "1.0.13",
+            "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.13.tgz",
+            "integrity": "sha512-wgKggnhZVL9Bfx1OaKKTrYY9BFRk6C8UAkQNUcIv1+llzYrIqy+RZm5HPKzn0NpEBvTVhTqB4kQyllZywsRBRQ==",
+            "devOptional": true,
+            "license": "MIT",
+            "peerDependencies": {
+                "acorn": "^8.9.0"
+            }
+        },
+        "node_modules/@sveltejs/vite-plugin-svelte": {
+            "version": "7.3.1",
+            "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-7.3.1.tgz",
+            "integrity": "sha512-ZPsLN8B1e/En+Ak5s4V7srFDT532oS0qieLsQwu63NGKsS+iAjoO2Js1BochlHlglcU+Pt7WAO3C5Ee+4f6gVA==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "deepmerge": "^4.3.1",
+                "magic-string": "^1.0.0",
+                "obug": "^2.1.0",
+                "vitefu": "^1.1.2"
+            },
+            "engines": {
+                "node": "^20.19 || ^22.12 || >=24"
+            },
+            "peerDependencies": {
+                "svelte": "^5.46.4",
+                "vite": "^8.0.0-beta.7 || ^8.0.0"
+            }
+        },
+        "node_modules/@sveltejs/vite-plugin-svelte/node_modules/magic-string": {
+            "version": "1.4.3",
+            "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.3.tgz",
+            "integrity": "sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "@jridgewell/sourcemap-codec": "^1.6.0"
+            }
+        },
         "node_modules/@tailwindcss/forms": {
             "version": "0.5.11",
             "resolved": "https://registry.npmjs.org/@tailwindcss/forms/-/forms-0.5.11.tgz",
@@ -743,6 +837,13 @@
                 "url": "https://github.com/sponsors/tannerlinsley"
             }
         },
+        "node_modules/@types/estree": {
+            "version": "1.0.9",
+            "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+            "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+            "devOptional": true,
+            "license": "MIT"
+        },
         "node_modules/@types/prismjs": {
             "version": "1.26.6",
             "resolved": "https://registry.npmjs.org/@types/prismjs/-/prismjs-1.26.6.tgz",
@@ -765,11 +866,44 @@
                 "addons/*"
             ]
         },
+        "node_modules/acorn": {
+            "version": "8.19.0",
+            "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.19.0.tgz",
+            "integrity": "sha512-oJlA3XiRm7Cyk6qFD2Jn8ak9B7jSy0qy00ADO3+8dpT0LSjFihQYv4C02LFCSYJV3Q37xYwwRy5m+IpIiUzqWw==",
+            "devOptional": true,
+            "license": "MIT",
+            "bin": {
+                "acorn": "bin/acorn"
+            },
+            "engines": {
+                "node": ">=0.4.0"
+            }
+        },
+        "node_modules/aria-query": {
+            "version": "5.3.1",
+            "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
+            "integrity": "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==",
+            "devOptional": true,
+            "license": "Apache-2.0",
+            "engines": {
+                "node": ">= 0.4"
+            }
+        },
+        "node_modules/axobject-query": {
+            "version": "4.1.0",
+            "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
+            "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
+            "devOptional": true,
+            "license": "Apache-2.0",
+            "engines": {
+                "node": ">= 0.4"
+            }
+        },
         "node_modules/clsx": {
             "version": "2.1.1",
             "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
             "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
-            "dev": true,
+            "devOptional": true,
             "license": "MIT",
             "engines": {
                 "node": ">=6"
@@ -793,6 +927,16 @@
                 "node": ">=4"
             }
         },
+        "node_modules/deepmerge": {
+            "version": "4.3.1",
+            "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
+            "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=0.10.0"
+            }
+        },
         "node_modules/detect-libc": {
             "version": "2.1.2",
             "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -803,6 +947,13 @@
                 "node": ">=8"
             }
         },
+        "node_modules/devalue": {
+            "version": "5.9.4",
+            "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.9.4.tgz",
+            "integrity": "sha512-sPAT4pztbu6586/hrhOnMKS17IJrvg12mXiSPSS3W5qDeN2RGgvZ0diZCm31dBbnevfVmujNO3IM2wrS4Y2Rhg==",
+            "devOptional": true,
+            "license": "MIT"
+        },
         "node_modules/enhanced-resolve": {
             "version": "5.24.5",
             "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.5.tgz",
@@ -817,6 +968,31 @@
                 "node": ">=10.13.0"
             }
         },
+        "node_modules/esm-env": {
+            "version": "1.2.2",
+            "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
+            "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
+            "devOptional": true,
+            "license": "MIT"
+        },
+        "node_modules/esrap": {
+            "version": "2.4.0",
+            "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.4.0.tgz",
+            "integrity": "sha512-CQPcneEHw/czj32uwQC52nYnax8H4SXt25FCM+LIwGZ49cMIxpOj3bP8wmzcI+Z0HIy5KkClaPhRLfCySzwHPA==",
+            "devOptional": true,
+            "license": "MIT",
+            "dependencies": {
+                "@jridgewell/sourcemap-codec": "^1.4.15"
+            },
+            "peerDependencies": {
+                "@typescript-eslint/types": "^8.2.0"
+            },
+            "peerDependenciesMeta": {
+                "@typescript-eslint/types": {
+                    "optional": true
+                }
+            }
+        },
         "node_modules/fdir": {
             "version": "6.5.0",
             "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -856,6 +1032,16 @@
             "dev": true,
             "license": "ISC"
         },
+        "node_modules/is-reference": {
+            "version": "3.0.3",
+            "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
+            "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
+            "devOptional": true,
+            "license": "MIT",
+            "dependencies": {
+                "@types/estree": "^1.0.6"
+            }
+        },
         "node_modules/jiti": {
             "version": "2.7.0",
             "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
@@ -1166,11 +1352,18 @@
                 "url": "https://opencollective.com/parcel"
             }
         },
+        "node_modules/locate-character": {
+            "version": "3.0.0",
+            "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
+            "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
+            "devOptional": true,
+            "license": "MIT"
+        },
         "node_modules/magic-string": {
             "version": "0.30.21",
             "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
             "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
-            "dev": true,
+            "devOptional": true,
             "license": "MIT",
             "dependencies": {
                 "@jridgewell/sourcemap-codec": "^1.5.5"
@@ -1186,9 +1379,9 @@
             }
         },
         "node_modules/nanoid": {
-            "version": "3.3.18",
-            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
-            "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
+            "version": "3.3.20",
+            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
+            "integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
             "dev": true,
             "funding": [
                 {
@@ -1204,6 +1397,20 @@
                 "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
             }
         },
+        "node_modules/obug": {
+            "version": "2.2.1",
+            "resolved": "https://registry.npmjs.org/obug/-/obug-2.2.1.tgz",
+            "integrity": "sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==",
+            "dev": true,
+            "funding": [
+                "https://github.com/sponsors/sxzz",
+                "https://opencollective.com/debug"
+            ],
+            "license": "MIT",
+            "engines": {
+                "node": ">=12.20.0"
+            }
+        },
         "node_modules/picocolors": {
             "version": "1.1.1",
             "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -1212,9 +1419,9 @@
             "license": "ISC"
         },
         "node_modules/picomatch": {
-            "version": "4.0.5",
-            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-            "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+            "version": "4.0.7",
+            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+            "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -1314,7 +1521,7 @@
             "version": "19.2.8",
             "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
             "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
-            "dev": true,
+            "devOptional": true,
             "license": "MIT",
             "peer": true,
             "engines": {
@@ -1322,13 +1529,13 @@
             }
         },
         "node_modules/rolldown": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.3.tgz",
-            "integrity": "sha512-rn9wpmxplLf7NLNyCk9FyWh3FM43DbY8jOzCdEPzH7uflhTftRbCEpqi6Ly2osgoU8OwObtmavMbWLaWy4LX7A==",
+            "version": "1.2.14",
+            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.14.tgz",
+            "integrity": "sha512-eTBTTqMR6uHKLgcUqpJP8ntzDI6V4LYA8negAMBEI7gkgVvOdrx6VsvS2Ym+83KhOPdLCHWJu0w7UQFJZhHKNw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@oxc-project/types": "=0.143.0",
+                "@oxc-project/types": "=0.154.0",
                 "@rolldown/pluginutils": "^1.0.0"
             },
             "bin": {
@@ -1338,20 +1545,21 @@
                 "node": "^20.19.0 || >=22.12.0"
             },
             "optionalDependencies": {
-                "@rolldown/binding-android-arm64": "1.2.3",
-                "@rolldown/binding-darwin-arm64": "1.2.3",
-                "@rolldown/binding-darwin-x64": "1.2.3",
-                "@rolldown/binding-freebsd-x64": "1.2.3",
-                "@rolldown/binding-linux-arm-gnueabihf": "1.2.3",
-                "@rolldown/binding-linux-arm64-gnu": "1.2.3",
-                "@rolldown/binding-linux-arm64-musl": "1.2.3",
-                "@rolldown/binding-linux-ppc64-gnu": "1.2.3",
-                "@rolldown/binding-linux-s390x-gnu": "1.2.3",
-                "@rolldown/binding-linux-x64-gnu": "1.2.3",
-                "@rolldown/binding-linux-x64-musl": "1.2.3",
-                "@rolldown/binding-openharmony-arm64": "1.2.3",
-                "@rolldown/binding-win32-arm64-msvc": "1.2.3",
-                "@rolldown/binding-win32-x64-msvc": "1.2.3"
+                "@rolldown/binding-android-arm-eabi": "1.2.14",
+                "@rolldown/binding-android-arm64": "1.2.14",
+                "@rolldown/binding-darwin-arm64": "1.2.14",
+                "@rolldown/binding-darwin-x64": "1.2.14",
+                "@rolldown/binding-freebsd-x64": "1.2.14",
+                "@rolldown/binding-linux-arm-gnueabihf": "1.2.14",
+                "@rolldown/binding-linux-arm64-gnu": "1.2.14",
+                "@rolldown/binding-linux-arm64-musl": "1.2.14",
+                "@rolldown/binding-linux-ppc64-gnu": "1.2.14",
+                "@rolldown/binding-linux-s390x-gnu": "1.2.14",
+                "@rolldown/binding-linux-x64-gnu": "1.2.14",
+                "@rolldown/binding-linux-x64-musl": "1.2.14",
+                "@rolldown/binding-openharmony-arm64": "1.2.14",
+                "@rolldown/binding-win32-arm64-msvc": "1.2.14",
+                "@rolldown/binding-win32-x64-msvc": "1.2.14"
             }
         },
         "node_modules/source-map-js": {
@@ -1364,6 +1572,33 @@
                 "node": ">=0.10.0"
             }
         },
+        "node_modules/svelte": {
+            "version": "5.57.2",
+            "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.57.2.tgz",
+            "integrity": "sha512-1YiPCAXT0Ct6g1vOMmSLa0Nsc3QRMvtDF32ihgglGVrugIuIK38RyDiFNXVDhtQ81TJjSO57NdMw6DyYLqSGDQ==",
+            "devOptional": true,
+            "license": "MIT",
+            "dependencies": {
+                "@jridgewell/remapping": "^2.3.5",
+                "@jridgewell/sourcemap-codec": "^1.6.0",
+                "@sveltejs/acorn-typescript": "^1.0.13",
+                "@types/estree": "^1.0.9",
+                "acorn": "^8.18.0",
+                "aria-query": "5.3.1",
+                "axobject-query": "^4.1.0",
+                "clsx": "^2.1.1",
+                "devalue": "^5.9.2",
+                "esm-env": "^1.2.1",
+                "esrap": "^2.3.6",
+                "is-reference": "^3.0.3",
+                "locate-character": "^3.0.0",
+                "magic-string": "^0.30.11",
+                "zimmerframe": "^1.1.2"
+            },
+            "engines": {
+                "node": ">=18"
+            }
+        },
         "node_modules/tailwind-scrollbar": {
             "version": "4.0.2",
             "resolved": "https://registry.npmjs.org/tailwind-scrollbar/-/tailwind-scrollbar-4.0.2.tgz",
@@ -1433,16 +1668,16 @@
             "license": "MIT"
         },
         "node_modules/vite": {
-            "version": "8.2.1",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.1.tgz",
-            "integrity": "sha512-EU/eS7BH3XROHh2YnBefjM6DBKA6ZeMZEYQbj7NLWg5wHYlhB8B/Mayd5XsgWq+NFYccDOTemRpdETWR6Ka/lw==",
+            "version": "8.3.4",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.4.tgz",
+            "integrity": "sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "lightningcss": "^1.33.0",
-                "picomatch": "^4.0.5",
-                "postcss": "^8.5.25",
-                "rolldown": "~1.2.1",
+                "picomatch": "^4.0.7",
+                "postcss": "^8.5.29",
+                "rolldown": "~1.2.12",
                 "tinyglobby": "^0.2.17"
             },
             "bin": {
@@ -1459,7 +1694,7 @@
             },
             "peerDependencies": {
                 "@types/node": "^20.19.0 || >=22.12.0",
-                "@vitejs/devtools": "^0.4.0",
+                "@vitejs/devtools": "^0.7.1",
                 "esbuild": "^0.27.0 || ^0.28.0",
                 "jiti": ">=1.21.0",
                 "less": "^4.0.0",
@@ -1821,6 +2056,62 @@
                 "type": "opencollective",
                 "url": "https://opencollective.com/parcel"
             }
+        },
+        "node_modules/vite/node_modules/postcss": {
+            "version": "8.5.31",
+            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.31.tgz",
+            "integrity": "sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl3EnMLM4Hea7Sg==",
+            "dev": true,
+            "funding": [
+                {
+                    "type": "opencollective",
+                    "url": "https://opencollective.com/postcss/"
+                },
+                {
+                    "type": "tidelift",
+                    "url": "https://tidelift.com/funding/github/npm/postcss"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/ai"
+                }
+            ],
+            "license": "MIT",
+            "dependencies": {
+                "nanoid": "^3.3.20",
+                "picocolors": "^1.1.1",
+                "source-map-js": "^1.2.2"
+            },
+            "engines": {
+                "node": "^10 || ^12 || >=14"
+            }
+        },
+        "node_modules/vitefu": {
+            "version": "1.1.3",
+            "resolved": "https://registry.npmjs.org/vitefu/-/vitefu-1.1.3.tgz",
+            "integrity": "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg==",
+            "dev": true,
+            "license": "MIT",
+            "workspaces": [
+                "tests/deps/*",
+                "tests/projects/*",
+                "tests/projects/workspace/packages/*"
+            ],
+            "peerDependencies": {
+                "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+            },
+            "peerDependenciesMeta": {
+                "vite": {
+                    "optional": true
+                }
+            }
+        },
+        "node_modules/zimmerframe": {
+            "version": "1.1.5",
+            "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.5.tgz",
+            "integrity": "sha512-msJxIvYDYcoNL+PJsu+7qmpDWsYmAxTY+2TNYXXF0hzBzBk0BMecOqDOG/EckUoKCuKwObfbugIl8QpqHDXeFA==",
+            "devOptional": true,
+            "license": "MIT"
         }
     }
 }
diff --git a/package.json b/package.json
index 6436cd18f9..08d219cb7d 100644
--- a/package.json
+++ b/package.json
@@ -8,14 +8,17 @@
         "clean": "docker compose -f docker-compose.yml -f docker-compose.dev.yml down --remove-orphans"
     },
     "devDependencies": {
+        "@sveltejs/vite-plugin-svelte": "7.3.1",
         "@tailwindcss/postcss": "4.3.3",
         "laravel-vite-plugin": "3.1.3",
         "postcss": "8.5.26",
+        "svelte": "5.57.2",
         "tailwind-scrollbar": "4.0.2",
         "tailwindcss": "4.3.3",
-        "vite": "8.2.1"
+        "vite": "8.3.4"
     },
     "dependencies": {
+        "@laravel/passkeys": "^0.4.0",
         "@tailwindcss/forms": "0.5.11",
         "@tailwindcss/typography": "0.5.20",
         "@tanstack/virtual-core": "3.17.11",
diff --git a/public/svgs/resources/docker-compose.svg b/public/svgs/resources/docker-compose.svg
index 0101ad46c4..02255ccfc8 100644
--- a/public/svgs/resources/docker-compose.svg
+++ b/public/svgs/resources/docker-compose.svg
@@ -1,10 +1,5 @@
-<svg width="200" height="200" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<svg width="200" height="200" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="200" height="200" rx="55.2101" fill="#099CEC" fill-opacity="0.16"/>
-<g transform="translate(100,100) scale(0.72) translate(-100,-100)"><rect x="18" y="20" width="167.171" height="160.057" fill="url(#pattern0_12315_226)"/></g>
-<defs>
-<pattern id="pattern0_12315_226" patternContentUnits="objectBoundingBox" width="1" height="1">
-<use xlink:href="#image0_12315_226" transform="translate(0 -0.0166667) scale(0.00403646)"/>
-</pattern>
-<image id="image0_12315_226" width="256" height="256" preserveAspectRatio="none" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAMAAABrrFhUAAACi1BMVEUAAAAInOwJm+wHnegPlvAIm+wJm+sJm+sGm+wA//8Aqv8MneYJnOsInOsNofEAn98Af/8InOsAqv8AkdoJm+wHmu8Jm+wPn+8Km+sKnOoInOsJnOwLnu4Im+wJnO0Im+0Inu0AlOkIme0InOsKnOoJnOwIm+sInOwJm+sKnekJnOwGmesInOwJnOsJm+wJm+wJnOwJm+sJnOsAquIIm+wJm+sJm+wIm+sInOsJm+wIm+sGnuoMmfILnO0Jm+sKmeoHnOwJnOsJnOwJnOwKm+oInOsLmu0Im+wInOsInOsIm+sJnOsJmusInOwInOoJm+wIm+wIm+wJnOsInOsJm+sJnOsJnOwHnOwJmuwJm+wHmusJm+sHmekJnOsIme4Im+wJnewIm+wIneoKmukHm+wJnOsJnOwHn+8InOsInOwJm+wIm+sIm+wJm+sInOwJnOsJmuwInOsJnOsIm+wJm+sLm+gLlucJoOwJnOsJnOsJm+sJnOwIm+wKmu0GmuoJm+sInewInOsJm+sLm+4Im+sJnOsJmesIm+sImuoIm+sKm+sJm+wHm+kIm+sJm+sInOwIm+sInOwJnOsInO4JnOsIne4Km+0Rme4Jm+wAnOsInOwHm+wJnOsIm+sKnuoInOwInO0GnewJm+sIm+wOm/AInOsJnOsInOwKne0JmuwJnOwJm+wIm+sIm+wHnOsAmf8Jm+wJnOwHnOwInO0JnOwJnOwInOsJm+sAmeUInOsHnewInOsHm+sIm+sJm+wJnewInOsKm+0Ao+wInOwAf/8JnOwAoucJnOsJnOwInOwJm+sJm+sGnOsJm+sInOwJm+wInOwJm+wJm+sInOwJm+wHnewJnOsJnOwJm+zwClkZAAAA2XRSTlMAejYiEedNgykBAxX6dxMIAvAGB6Qh9hAzS5H4LbFVVx0MOl0xidDogC/zKMz9wPKMqfsJtJxu5HTYriUULJ0ZYNbCo0qbK+qOW8hOa5Y+il95ULjGhKZiVL5CaSPEHpdwmj8wRWjcIMm1Uu97oX+GOOOezWcXFhsagfFvfkcmu17H3y5zNDWsPdNm3SRahc+2fLofxTxkD/cNmWGq7DKzOSrgzhLR4cpJHPW8duVDBaK/RnJtU63DCtRE60CS9FHuSA7pBL0LoNeU/vkn/ObamHGfsMFj3v+IzzwotQAABUNJREFUeNrt2OVzFEkcxvEHQkJ24w4kuLu7u567u7u7K+7uboHgBELcZS/kEnjy5xxXV9TdhZmwMrM73fP7vH2q33yrq7qqIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIK3Q29hjcgsZaJIAEkAASQAJIAAkgASSABJAAEkACSAAJIAEkgASQABJASzHG+sh/uRBK2X7D2O8AUk22qwBgss2DYqJo7E8AnWisub1XQAJIAAkgASSABAhM4vkKdwd4lAP6uTlADMn41lTXBjgUzb8NG+rWAOn8x8gYdwboytt8TW4MkH+T/6r1uC/A1/yvGcluC9Aphf+T7nVZgEFs4x53BUgdyLYmuSrAYt5h+JtuCvAQ7/TWa+4JEDeGBuZ4XRNgFg3lInzSOhrLAOA12aYCgMk2FIEYTUNDZsIdPAU0NgPusIomhsfCFVbTzHVYKbGDsVIAWSZbVwBJJttFAGgy1gMALhif+xhtrKGZzGmwUKxZZrtegT9oqBFt/EZTz7siwDCaanFFgIk05YtzQ4B6mlvsggAVbMciFwSoYjtGAEDvXjldbmmY5tEyQG+2Y+So5pp63lZXvuSdt7tmaRbAywANH9B/sE4BkMnAXdnp1SfATQbjylVtAlxmUOp2bNckQDWD9ONpPQI0MVh1hVoEuMagVWsRICmTQfJ9q0UAnAz+AugR4AKD42vQJEBcPINyBpoEwKUgL4A2AToyGLUIzNM3jXUG0Mtk6w+gzGS7DgDRxqYAwA/G5ypxp7MMXMEh6KOfjwHbAo2kzmGgunugja25pxioDxKhiay+zdsYsBPvQwfHj31xsp5BiD+Gu4prdbTr1evWfskg1ffE3b1MbQ0phR9eoa4mD4Y/RlFT86vgl9HUUs05+KmSGpo9ywt/HaZu4ptjkuG/U9TK7l074xCQEurBF/3w3EGrGzwIVBEVV9IQFRWVmIRg+ai4VoSmjmob8yxCk021jUaIUqi2fQjRQirtLEL1KpV2DqF6nSo76EGo3qDKihGyM1TYMA9CtoYKK0XotlBdl2GB01TXZlggg8qaAiskD6Gi6qfCEkuoqFZY4wWqqbwM1lhGNfWFRfpRSSM8sIg3hQrKHgrLbKCC1sM666mej/JgnV+pnOwcWCi5nKpJgKXSqZhNXliqJ9VSshHWyi+iUophtV1USS0sd5EKOZoEy6UtpDLKj8MGi6iKMddgh1iqYgLs0UI1FMImD1IJ47ywSXINFXA0H7a5Qedr/AT2STtCpztwHICLr0B5A2xVMZmONnA6bPY4nSw6FrZ7gs4VvR/2WxBPp1q5CuFwHx1q+WcIi94r6UhntyJMNvvoQOlpCJv+dJy6QR6ET9paOkxRMcJqYwEdpfEnhNlVHx2kexbCrgMdo77JgwiopUPU7EFEeC/REc5UIULyLzPyjpQicqoqGWF1O8oAFxeYfS8ibGwzI2fkpDxEnLcbI6Ru7kw4wlc+RkLlL3CKa9EMu8PH4CBx3zG8ln/vhaNUPJDN8DlY7IHj7D/KMHkmxgMnqjifQvtlzl8Ax0rs5qO9ahIS4Wh79tI+KeP7wPk6rqMt6rv3SIIaGrqdoMW27V3xKRQS16GR1jn14cUqKKfPcyW0wImTuYOhqLzThQcYit17c/flQW05Ey4VMAglI0b1jIIePNPvL9xURH9NbBl//tzn0E1yxjcXascNGEgT8dFXNlQ/smxpzljoLbXXSy8u7bvi54SEd99LuOWpGz3mPdklowxCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhAifvwDAua/EpaY9sQAAAABJRU5ErkJggg=="/>
-</defs>
+<g transform="translate(54,26) scale(3.8333)"><path fill="#099CEC" d="M13.983 11.078h2.119a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.119a.185.185 0 00-.185.185v1.888c0 .102.083.185.185.185m-2.954-5.43h2.118a.186.186 0 00.186-.186V3.574a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m0 2.716h2.118a.187.187 0 00.186-.186V6.29a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.887c0 .102.082.185.185.186m-2.93 0h2.12a.186.186 0 00.184-.186V6.29a.185.185 0 00-.185-.185H8.1a.185.185 0 00-.185.185v1.887c0 .102.083.185.185.186m-2.964 0h2.119a.186.186 0 00.185-.186V6.29a.185.185 0 00-.185-.185H5.136a.186.186 0 00-.186.185v1.887c0 .102.084.185.186.186m5.893 2.715h2.118a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m-2.93 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.083.185.185.185m-2.964 0h2.119a.185.185 0 00.185-.185V9.006a.185.185 0 00-.184-.186h-2.12a.186.186 0 00-.186.186v1.887c0 .102.084.185.186.185m-2.92 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.082.185.185.185M23.763 9.89c-.065-.051-.672-.51-1.954-.51-.338.001-.676.03-1.01.087-.248-1.7-1.653-2.53-1.716-2.566l-.344-.199-.226.327c-.284.438-.49.922-.612 1.43-.23.97-.09 1.882.403 2.661-.595.332-1.55.413-1.744.42H.751a.751.751 0 00-.75.748 11.376 11.376 0 00.692 4.062c.545 1.428 1.355 2.48 2.41 3.124 1.18.723 3.1 1.137 5.275 1.137.983.003 1.963-.086 2.93-.266a12.248 12.248 0 003.823-1.389c.98-.567 1.86-1.288 2.61-2.136 1.252-1.418 1.998-2.997 2.553-4.4h.221c1.372 0 2.215-.549 2.68-1.009.309-.293.55-.65.707-1.046l.098-.288Z"/></g>
+<path d="M58 122L100 140L142 122M58 144L100 162L142 144" stroke="#099CEC" stroke-width="9" stroke-linecap="round" stroke-linejoin="round"/>
 </svg>
diff --git a/public/svgs/resources/docker-image.svg b/public/svgs/resources/docker-image.svg
index 28b300a9cf..3167ffece6 100644
--- a/public/svgs/resources/docker-image.svg
+++ b/public/svgs/resources/docker-image.svg
@@ -1,11 +1,4 @@
-<svg width="200" height="200" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<svg width="200" height="200" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="200" height="200" rx="55.2101" fill="#099CEC" fill-opacity="0.16"/>
-<g transform="translate(100,100) scale(0.72) translate(-100,-100)"><path d="M32.0004 148.667C32 148.143 32 147.603 32 147.046V52.9571C32 43.8718 32 39.3258 33.6371 35.8557C35.0772 32.8033 37.3734 30.3234 40.1997 28.7681C43.4128 27 47.6221 27 56.0344 27H143.154C151.566 27 155.77 27 158.983 28.7681C161.809 30.3234 164.11 32.8033 165.55 35.8557C167.185 39.3224 167.185 43.8629 167.185 52.9305V147.069C167.185 151.003 167.185 154.084 167.052 156.594M32.0004 148.667C32.0062 156.684 32.1004 160.88 33.6371 164.138C35.0772 167.19 37.3734 169.678 40.1997 171.234C43.4096 173 47.6138 173 56.0097 173H143.179C151.575 173 155.773 173 158.983 171.234C161.809 169.678 164.11 167.19 165.55 164.138C166.476 162.175 166.877 159.87 167.052 156.594M32.0004 148.667L67.8089 103.549L67.8195 103.536C70.9954 99.5344 72.5861 97.5302 74.4727 96.8078C76.13 96.1733 77.9394 96.1881 79.5884 96.8474C81.4675 97.5988 83.0328 99.6259 86.1636 103.683L106.225 129.683C109.123 133.438 110.58 135.327 112.35 136.085C113.911 136.754 115.632 136.829 117.242 136.316C119.076 135.732 120.69 133.989 123.917 130.504L127.65 126.472C130.936 122.923 132.578 121.15 134.438 120.571C136.071 120.062 137.817 120.171 139.388 120.872C141.177 121.67 142.628 123.623 145.531 127.541L167.052 156.594M167.052 156.594L167.185 156.775" stroke="#099CEC" stroke-width="9" stroke-linecap="round" stroke-linejoin="round"/>
-<rect x="77" y="27" width="81.4667" height="78" fill="url(#pattern0_12315_221)"/></g>
-<defs>
-<pattern id="pattern0_12315_221" patternContentUnits="objectBoundingBox" width="1" height="1">
-<use xlink:href="#image0_12315_221" transform="translate(0 -0.0166667) scale(0.00403646)"/>
-</pattern>
-<image id="image0_12315_221" width="256" height="256" preserveAspectRatio="none" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAMAAABrrFhUAAACi1BMVEUAAAAInOwJm+wHnegPlvAIm+wJm+sJm+sGm+wA//8Aqv8MneYJnOsInOsNofEAn98Af/8InOsAqv8AkdoJm+wHmu8Jm+wPn+8Km+sKnOoInOsJnOwLnu4Im+wJnO0Im+0Inu0AlOkIme0InOsKnOoJnOwIm+sInOwJm+sKnekJnOwGmesInOwJnOsJm+wJm+wJnOwJm+sJnOsAquIIm+wJm+sJm+wIm+sInOsJm+wIm+sGnuoMmfILnO0Jm+sKmeoHnOwJnOsJnOwJnOwKm+oInOsLmu0Im+wInOsInOsIm+sJnOsJmusInOwInOoJm+wIm+wIm+wJnOsInOsJm+sJnOsJnOwHnOwJmuwJm+wHmusJm+sHmekJnOsIme4Im+wJnewIm+wIneoKmukHm+wJnOsJnOwHn+8InOsInOwJm+wIm+sIm+wJm+sInOwJnOsJmuwInOsJnOsIm+wJm+sLm+gLlucJoOwJnOsJnOsJm+sJnOwIm+wKmu0GmuoJm+sInewInOsJm+sLm+4Im+sJnOsJmesIm+sImuoIm+sKm+sJm+wHm+kIm+sJm+sInOwIm+sInOwJnOsInO4JnOsIne4Km+0Rme4Jm+wAnOsInOwHm+wJnOsIm+sKnuoInOwInO0GnewJm+sIm+wOm/AInOsJnOsInOwKne0JmuwJnOwJm+wIm+sIm+wHnOsAmf8Jm+wJnOwHnOwInO0JnOwJnOwInOsJm+sAmeUInOsHnewInOsHm+sIm+sJm+wJnewInOsKm+0Ao+wInOwAf/8JnOwAoucJnOsJnOwInOwJm+sJm+sGnOsJm+sInOwJm+wInOwJm+wJm+sInOwJm+wHnewJnOsJnOwJm+zwClkZAAAA2XRSTlMAejYiEedNgykBAxX6dxMIAvAGB6Qh9hAzS5H4LbFVVx0MOl0xidDogC/zKMz9wPKMqfsJtJxu5HTYriUULJ0ZYNbCo0qbK+qOW8hOa5Y+il95ULjGhKZiVL5CaSPEHpdwmj8wRWjcIMm1Uu97oX+GOOOezWcXFhsagfFvfkcmu17H3y5zNDWsPdNm3SRahc+2fLofxTxkD/cNmWGq7DKzOSrgzhLR4cpJHPW8duVDBaK/RnJtU63DCtRE60CS9FHuSA7pBL0LoNeU/vkn/ObamHGfsMFj3v+IzzwotQAABUNJREFUeNrt2OVzFEkcxvEHQkJ24w4kuLu7u567u7u7K+7uboHgBELcZS/kEnjy5xxXV9TdhZmwMrM73fP7vH2q33yrq7qqIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIK3Q29hjcgsZaJIAEkAASQAJIAAkgASSABJAAEkACSAAJIAEkgASQABJASzHG+sh/uRBK2X7D2O8AUk22qwBgss2DYqJo7E8AnWisub1XQAJIAAkgASSABAhM4vkKdwd4lAP6uTlADMn41lTXBjgUzb8NG+rWAOn8x8gYdwboytt8TW4MkH+T/6r1uC/A1/yvGcluC9Aphf+T7nVZgEFs4x53BUgdyLYmuSrAYt5h+JtuCvAQ7/TWa+4JEDeGBuZ4XRNgFg3lInzSOhrLAOA12aYCgMk2FIEYTUNDZsIdPAU0NgPusIomhsfCFVbTzHVYKbGDsVIAWSZbVwBJJttFAGgy1gMALhif+xhtrKGZzGmwUKxZZrtegT9oqBFt/EZTz7siwDCaanFFgIk05YtzQ4B6mlvsggAVbMciFwSoYjtGAEDvXjldbmmY5tEyQG+2Y+So5pp63lZXvuSdt7tmaRbAywANH9B/sE4BkMnAXdnp1SfATQbjylVtAlxmUOp2bNckQDWD9ONpPQI0MVh1hVoEuMagVWsRICmTQfJ9q0UAnAz+AugR4AKD42vQJEBcPINyBpoEwKUgL4A2AToyGLUIzNM3jXUG0Mtk6w+gzGS7DgDRxqYAwA/G5ypxp7MMXMEh6KOfjwHbAo2kzmGgunugja25pxioDxKhiay+zdsYsBPvQwfHj31xsp5BiD+Gu4prdbTr1evWfskg1ffE3b1MbQ0phR9eoa4mD4Y/RlFT86vgl9HUUs05+KmSGpo9ywt/HaZu4ptjkuG/U9TK7l074xCQEurBF/3w3EGrGzwIVBEVV9IQFRWVmIRg+ai4VoSmjmob8yxCk021jUaIUqi2fQjRQirtLEL1KpV2DqF6nSo76EGo3qDKihGyM1TYMA9CtoYKK0XotlBdl2GB01TXZlggg8qaAiskD6Gi6qfCEkuoqFZY4wWqqbwM1lhGNfWFRfpRSSM8sIg3hQrKHgrLbKCC1sM666mej/JgnV+pnOwcWCi5nKpJgKXSqZhNXliqJ9VSshHWyi+iUophtV1USS0sd5EKOZoEy6UtpDLKj8MGi6iKMddgh1iqYgLs0UI1FMImD1IJ47ywSXINFXA0H7a5Qedr/AT2STtCpztwHICLr0B5A2xVMZmONnA6bPY4nSw6FrZ7gs4VvR/2WxBPp1q5CuFwHx1q+WcIi94r6UhntyJMNvvoQOlpCJv+dJy6QR6ET9paOkxRMcJqYwEdpfEnhNlVHx2kexbCrgMdo77JgwiopUPU7EFEeC/REc5UIULyLzPyjpQicqoqGWF1O8oAFxeYfS8ibGwzI2fkpDxEnLcbI6Ru7kw4wlc+RkLlL3CKa9EMu8PH4CBx3zG8ln/vhaNUPJDN8DlY7IHj7D/KMHkmxgMnqjifQvtlzl8Ax0rs5qO9ahIS4Wh79tI+KeP7wPk6rqMt6rv3SIIaGrqdoMW27V3xKRQS16GR1jn14cUqKKfPcyW0wImTuYOhqLzThQcYit17c/flQW05Ey4VMAglI0b1jIIePNPvL9xURH9NbBl//tzn0E1yxjcXascNGEgT8dFXNlQ/smxpzljoLbXXSy8u7bvi54SEd99LuOWpGz3mPdklowxCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhAifvwDAua/EpaY9sQAAAABJRU5ErkJggg=="/>
-</defs>
+<g transform="translate(40,40) scale(5)"><path fill="#099CEC" d="M13.983 11.078h2.119a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.119a.185.185 0 00-.185.185v1.888c0 .102.083.185.185.185m-2.954-5.43h2.118a.186.186 0 00.186-.186V3.574a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m0 2.716h2.118a.187.187 0 00.186-.186V6.29a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.887c0 .102.082.185.185.186m-2.93 0h2.12a.186.186 0 00.184-.186V6.29a.185.185 0 00-.185-.185H8.1a.185.185 0 00-.185.185v1.887c0 .102.083.185.185.186m-2.964 0h2.119a.186.186 0 00.185-.186V6.29a.185.185 0 00-.185-.185H5.136a.186.186 0 00-.186.185v1.887c0 .102.084.185.186.186m5.893 2.715h2.118a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m-2.93 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.083.185.185.185m-2.964 0h2.119a.185.185 0 00.185-.185V9.006a.185.185 0 00-.184-.186h-2.12a.186.186 0 00-.186.186v1.887c0 .102.084.185.186.185m-2.92 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.082.185.185.185M23.763 9.89c-.065-.051-.672-.51-1.954-.51-.338.001-.676.03-1.01.087-.248-1.7-1.653-2.53-1.716-2.566l-.344-.199-.226.327c-.284.438-.49.922-.612 1.43-.23.97-.09 1.882.403 2.661-.595.332-1.55.413-1.744.42H.751a.751.751 0 00-.75.748 11.376 11.376 0 00.692 4.062c.545 1.428 1.355 2.48 2.41 3.124 1.18.723 3.1 1.137 5.275 1.137.983.003 1.963-.086 2.93-.266a12.248 12.248 0 003.823-1.389c.98-.567 1.86-1.288 2.61-2.136 1.252-1.418 1.998-2.997 2.553-4.4h.221c1.372 0 2.215-.549 2.68-1.009.309-.293.55-.65.707-1.046l.098-.288Z"/></g>
 </svg>
diff --git a/public/svgs/resources/dockerfile.svg b/public/svgs/resources/dockerfile.svg
index f4a3efb11c..760ed42713 100644
--- a/public/svgs/resources/dockerfile.svg
+++ b/public/svgs/resources/dockerfile.svg
@@ -1,11 +1,5 @@
-<svg width="200" height="200" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<svg width="200" height="200" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="200" height="200" rx="55.2101" fill="#099CEC" fill-opacity="0.16"/>
 <g transform="translate(100,100) scale(0.72) translate(-100,-100)"><path d="M109.214 24.0073C108.376 24 107.434 24 106.359 24H67.0872C57.2563 24 52.3373 24 48.5824 25.8318C45.2795 27.4431 42.5961 30.0123 40.9132 33.1746C39 36.7697 39 41.4795 39 50.892V148.369C39 157.782 39 162.486 40.9132 166.081C42.5961 169.243 45.2795 171.817 48.5824 173.428C52.3336 175.258 57.2468 175.258 67.0586 175.258L133.816 175.258C143.627 175.258 148.533 175.258 152.284 173.428C155.587 171.817 158.28 169.243 159.963 166.081C161.874 162.489 161.874 157.792 161.874 148.398V77.1562C161.874 76.1249 161.874 75.2228 161.866 74.4194M109.214 24.0073C111.721 24.0292 113.307 24.1163 114.821 24.4644C116.612 24.8761 118.323 25.5568 119.893 26.4783C121.664 27.5173 123.185 28.9732 126.218 31.878L153.65 58.1422C156.686 61.0489 158.195 62.4982 159.281 64.1943C160.243 65.698 160.955 67.3376 161.385 69.0525C161.749 70.5014 161.842 72.0203 161.866 74.4194M109.214 24.0073V47.529C109.214 56.9415 109.214 61.6445 111.127 65.2396C112.81 68.4019 115.493 70.9781 118.796 72.5894C122.547 74.4194 127.46 74.4194 137.272 74.4194H161.866M161.866 74.4194H161.876" stroke="#099CEC" stroke-width="9.15285" stroke-linecap="round" stroke-linejoin="round"/>
-<rect x="49.2395" y="68.1162" width="107.516" height="102.941" fill="url(#pattern0_12315_218)"/></g>
-<defs>
-<pattern id="pattern0_12315_218" patternContentUnits="objectBoundingBox" width="1" height="1">
-<use xlink:href="#image0_12315_218" transform="translate(0 -0.0166667) scale(0.00403646)"/>
-</pattern>
-<image id="image0_12315_218" width="256" height="256" preserveAspectRatio="none" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAMAAABrrFhUAAACi1BMVEUAAAAInOwJm+wHnegPlvAIm+wJm+sJm+sGm+wA//8Aqv8MneYJnOsInOsNofEAn98Af/8InOsAqv8AkdoJm+wHmu8Jm+wPn+8Km+sKnOoInOsJnOwLnu4Im+wJnO0Im+0Inu0AlOkIme0InOsKnOoJnOwIm+sInOwJm+sKnekJnOwGmesInOwJnOsJm+wJm+wJnOwJm+sJnOsAquIIm+wJm+sJm+wIm+sInOsJm+wIm+sGnuoMmfILnO0Jm+sKmeoHnOwJnOsJnOwJnOwKm+oInOsLmu0Im+wInOsInOsIm+sJnOsJmusInOwInOoJm+wIm+wIm+wJnOsInOsJm+sJnOsJnOwHnOwJmuwJm+wHmusJm+sHmekJnOsIme4Im+wJnewIm+wIneoKmukHm+wJnOsJnOwHn+8InOsInOwJm+wIm+sIm+wJm+sInOwJnOsJmuwInOsJnOsIm+wJm+sLm+gLlucJoOwJnOsJnOsJm+sJnOwIm+wKmu0GmuoJm+sInewInOsJm+sLm+4Im+sJnOsJmesIm+sImuoIm+sKm+sJm+wHm+kIm+sJm+sInOwIm+sInOwJnOsInO4JnOsIne4Km+0Rme4Jm+wAnOsInOwHm+wJnOsIm+sKnuoInOwInO0GnewJm+sIm+wOm/AInOsJnOsInOwKne0JmuwJnOwJm+wIm+sIm+wHnOsAmf8Jm+wJnOwHnOwInO0JnOwJnOwInOsJm+sAmeUInOsHnewInOsHm+sIm+sJm+wJnewInOsKm+0Ao+wInOwAf/8JnOwAoucJnOsJnOwInOwJm+sJm+sGnOsJm+sInOwJm+wInOwJm+wJm+sInOwJm+wHnewJnOsJnOwJm+zwClkZAAAA2XRSTlMAejYiEedNgykBAxX6dxMIAvAGB6Qh9hAzS5H4LbFVVx0MOl0xidDogC/zKMz9wPKMqfsJtJxu5HTYriUULJ0ZYNbCo0qbK+qOW8hOa5Y+il95ULjGhKZiVL5CaSPEHpdwmj8wRWjcIMm1Uu97oX+GOOOezWcXFhsagfFvfkcmu17H3y5zNDWsPdNm3SRahc+2fLofxTxkD/cNmWGq7DKzOSrgzhLR4cpJHPW8duVDBaK/RnJtU63DCtRE60CS9FHuSA7pBL0LoNeU/vkn/ObamHGfsMFj3v+IzzwotQAABUNJREFUeNrt2OVzFEkcxvEHQkJ24w4kuLu7u567u7u7K+7uboHgBELcZS/kEnjy5xxXV9TdhZmwMrM73fP7vH2q33yrq7qqIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIK3Q29hjcgsZaJIAEkAASQAJIAAkgASSABJAAEkACSAAJIAEkgASQABJASzHG+sh/uRBK2X7D2O8AUk22qwBgss2DYqJo7E8AnWisub1XQAJIAAkgASSABAhM4vkKdwd4lAP6uTlADMn41lTXBjgUzb8NG+rWAOn8x8gYdwboytt8TW4MkH+T/6r1uC/A1/yvGcluC9Aphf+T7nVZgEFs4x53BUgdyLYmuSrAYt5h+JtuCvAQ7/TWa+4JEDeGBuZ4XRNgFg3lInzSOhrLAOA12aYCgMk2FIEYTUNDZsIdPAU0NgPusIomhsfCFVbTzHVYKbGDsVIAWSZbVwBJJttFAGgy1gMALhif+xhtrKGZzGmwUKxZZrtegT9oqBFt/EZTz7siwDCaanFFgIk05YtzQ4B6mlvsggAVbMciFwSoYjtGAEDvXjldbmmY5tEyQG+2Y+So5pp63lZXvuSdt7tmaRbAywANH9B/sE4BkMnAXdnp1SfATQbjylVtAlxmUOp2bNckQDWD9ONpPQI0MVh1hVoEuMagVWsRICmTQfJ9q0UAnAz+AugR4AKD42vQJEBcPINyBpoEwKUgL4A2AToyGLUIzNM3jXUG0Mtk6w+gzGS7DgDRxqYAwA/G5ypxp7MMXMEh6KOfjwHbAo2kzmGgunugja25pxioDxKhiay+zdsYsBPvQwfHj31xsp5BiD+Gu4prdbTr1evWfskg1ffE3b1MbQ0phR9eoa4mD4Y/RlFT86vgl9HUUs05+KmSGpo9ywt/HaZu4ptjkuG/U9TK7l074xCQEurBF/3w3EGrGzwIVBEVV9IQFRWVmIRg+ai4VoSmjmob8yxCk021jUaIUqi2fQjRQirtLEL1KpV2DqF6nSo76EGo3qDKihGyM1TYMA9CtoYKK0XotlBdl2GB01TXZlggg8qaAiskD6Gi6qfCEkuoqFZY4wWqqbwM1lhGNfWFRfpRSSM8sIg3hQrKHgrLbKCC1sM666mej/JgnV+pnOwcWCi5nKpJgKXSqZhNXliqJ9VSshHWyi+iUophtV1USS0sd5EKOZoEy6UtpDLKj8MGi6iKMddgh1iqYgLs0UI1FMImD1IJ47ywSXINFXA0H7a5Qedr/AT2STtCpztwHICLr0B5A2xVMZmONnA6bPY4nSw6FrZ7gs4VvR/2WxBPp1q5CuFwHx1q+WcIi94r6UhntyJMNvvoQOlpCJv+dJy6QR6ET9paOkxRMcJqYwEdpfEnhNlVHx2kexbCrgMdo77JgwiopUPU7EFEeC/REc5UIULyLzPyjpQicqoqGWF1O8oAFxeYfS8ibGwzI2fkpDxEnLcbI6Ru7kw4wlc+RkLlL3CKa9EMu8PH4CBx3zG8ln/vhaNUPJDN8DlY7IHj7D/KMHkmxgMnqjifQvtlzl8Ax0rs5qO9ahIS4Wh79tI+KeP7wPk6rqMt6rv3SIIaGrqdoMW27V3xKRQS16GR1jn14cUqKKfPcyW0wImTuYOhqLzThQcYit17c/flQW05Ey4VMAglI0b1jIIePNPvL9xURH9NbBl//tzn0E1yxjcXascNGEgT8dFXNlQ/smxpzljoLbXXSy8u7bvi54SEd99LuOWpGz3mPdklowxCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhAifvwDAua/EpaY9sQAAAABJRU5ErkJggg=="/>
-</defs>
+<g transform="translate(49.24,65.83) scale(4.4798)"><path fill="#099CEC" d="M13.983 11.078h2.119a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.119a.185.185 0 00-.185.185v1.888c0 .102.083.185.185.185m-2.954-5.43h2.118a.186.186 0 00.186-.186V3.574a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m0 2.716h2.118a.187.187 0 00.186-.186V6.29a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.887c0 .102.082.185.185.186m-2.93 0h2.12a.186.186 0 00.184-.186V6.29a.185.185 0 00-.185-.185H8.1a.185.185 0 00-.185.185v1.887c0 .102.083.185.185.186m-2.964 0h2.119a.186.186 0 00.185-.186V6.29a.185.185 0 00-.185-.185H5.136a.186.186 0 00-.186.185v1.887c0 .102.084.185.186.186m5.893 2.715h2.118a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m-2.93 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.083.185.185.185m-2.964 0h2.119a.185.185 0 00.185-.185V9.006a.185.185 0 00-.184-.186h-2.12a.186.186 0 00-.186.186v1.887c0 .102.084.185.186.185m-2.92 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.082.185.185.185M23.763 9.89c-.065-.051-.672-.51-1.954-.51-.338.001-.676.03-1.01.087-.248-1.7-1.653-2.53-1.716-2.566l-.344-.199-.226.327c-.284.438-.49.922-.612 1.43-.23.97-.09 1.882.403 2.661-.595.332-1.55.413-1.744.42H.751a.751.751 0 00-.75.748 11.376 11.376 0 00.692 4.062c.545 1.428 1.355 2.48 2.41 3.124 1.18.723 3.1 1.137 5.275 1.137.983.003 1.963-.086 2.93-.266a12.248 12.248 0 003.823-1.389c.98-.567 1.86-1.288 2.61-2.136 1.252-1.418 1.998-2.997 2.553-4.4h.221c1.372 0 2.215-.549 2.68-1.009.309-.293.55-.65.707-1.046l.098-.288Z"/></g></g>
 </svg>
diff --git a/resources/css/app.css b/resources/css/app.css
index a21c2e4344..afdae048ed 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -514,7 +514,7 @@ tr {
 }
 
 tr th {
-    @apply px-3 py-3.5 text-left text-black dark:text-white;
+    @apply px-3 py-3.5 text-left text-neutral-500 dark:text-fg-faint;
 }
 
 tr th:first-child {
@@ -1084,6 +1084,68 @@ html:not(.dark) .application-console-shell[data-console-theme="system"] .termina
     background: var(--coollabs-base);
 }
 
+/* Console (attach) command box. Colours come from the active terminal theme's
+   foreground (--console-fg), so the input is readable on every console theme. */
+.terminal-console-input {
+    border-color: color-mix(in srgb, var(--console-fg, #fff) 10%, transparent);
+}
+
+.console-command-row {
+    box-shadow: inset 0 0 0 1px transparent;
+    transition:
+        background-color 150ms ease,
+        box-shadow 150ms ease;
+}
+
+.console-command-row:hover {
+    background-color: color-mix(in srgb, var(--console-fg, #fff) 3%, transparent);
+}
+
+.console-command-row:focus-within {
+    background-color: color-mix(in srgb, var(--console-fg, #fff) 6%, transparent);
+    box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--console-fg, #fff) 22%, transparent);
+}
+
+.console-command-field {
+    color: var(--console-fg, #fff) !important;
+    caret-color: var(--console-fg, #fff);
+}
+
+.console-command-field::placeholder {
+    color: color-mix(in srgb, var(--console-fg, #fff) 40%, transparent);
+}
+
+.console-command-row:focus-within .console-command-field::placeholder {
+    color: color-mix(in srgb, var(--console-fg, #fff) 28%, transparent);
+}
+
+.console-command-prompt {
+    color: color-mix(in srgb, var(--console-fg, #fff) 40%, transparent);
+    transition: color 200ms ease;
+}
+
+.console-command-row:focus-within .console-command-prompt {
+    color: var(--console-fg, #fff);
+}
+
+.console-command-prompt[data-sent] {
+    color: #fcd452 !important;
+}
+
+.console-command-pending {
+    color: color-mix(in srgb, var(--console-fg, #fff) 60%, transparent);
+}
+
+.console-command-send {
+    color: color-mix(in srgb, var(--console-fg, #fff) 60%, transparent);
+    outline-color: color-mix(in srgb, var(--console-fg, #fff) 60%, transparent);
+}
+
+.console-command-send:hover {
+    color: var(--console-fg, #fff);
+    background-color: color-mix(in srgb, var(--console-fg, #fff) 8%, transparent);
+}
+
 .terminal-target-list {
     scrollbar-width: thin;
     scrollbar-color: var(--terminal-scrollbar, rgb(255 255 255 / 0.3)) transparent;
@@ -1206,15 +1268,21 @@ html:not(.dark) .application-console-shell[data-console-theme="system"] .termina
        visible steps: content 10 -> elevated 22 -> base 28 -> recessed 34.
        Pure neutral (r=g=b), matching the neutral borders/text and the light
        ladder, so every panel shares one temperature (no blue cast). */
-    --coollabs-canvas: oklch(14.48% 0 0);
+    --color-app: oklch(14.48% 0 0);
+    --color-panel: oklch(19.13% 0 0);
+    --coollabs-canvas: var(--color-app);
     --coollabs-elevated: oklch(20.02% 0 0);
     --coollabs-recessed: oklch(25.2% 0 0);
     --coollabs-base: oklch(22.64% 0 0);
     --coollabs-fill: oklch(29.31% 0 0);
-    --coollabs-line: oklch(32% 0 0);
-    /* Crisped from 26.9% (1.36:1 on canvas) to 32% (1.63:1) so dark cards
+    --color-surface: oklch(20.02% 0 0);
+    --color-raised: oklch(22.64% 0 0);
+    --color-selected: oklch(26.86% 0 0);
+    --color-log: oklch(15.91% 0 0);
+    --coollabs-line: oklch(36% 0 0);
+    /* Kept about 1.6:1 on the canvas so dark cards
        and tables show a visible edge instead of blending into the canvas. */
-    --coollabs-hairline: oklch(32% 0 0);
+    --coollabs-hairline: oklch(36% 0 0);
     --coollabs-subtle: oklch(70.8% 0 0);
     /* Neutral (was #a8a8b0 / #7a7a84, both cool-tinted). Sidebar text now shares
        the same neutral temperature as the content text, so the sidebar no longer
@@ -1383,7 +1451,7 @@ html[data-theme="custom"] .coolbox,
 html[data-theme="custom"] .resource-view,
 html[data-theme="custom"] [class~="bg-surface"],
 html[data-theme="custom"] [class~="dark:bg-surface"],
-html[data-theme="custom"] [class~="dark:bg-white/[0.025]"] {
+html[data-theme="custom"] [class*="dark:bg-white/[0.025]"] {
     background-color: var(--color-content-surface) !important;
 }
 
@@ -1714,23 +1782,87 @@ html[data-theme="custom"] textarea:disabled {
     margin-top: 1.75rem;
 }
 
-/* Layer card root: elevated shell with a hairline ring. overflow stays
-   visible so floating panels (listbox, tooltips) can escape the card. */
-.application-settings-section {
+/* Layer card root: soft outer box around a darker inset well (the body).
+   overflow stays visible so floating panels (listbox, tooltips) can escape
+   the card. */
+.application-settings-section,
+.application-settings-section-body,
+.empty-state {
+    --card-bg: rgb(0 0 0 / 0.75%);
+    /* The page color under a card. The card tints are translucent, so
+       top-level cards paint them over this color (see below). */
+    --card-underlay: var(--color-neutral-50);
+    --card-border: rgb(0 0 0 / 9%);
+    --well-bg: #ffffff;
+    --well-border: rgb(0 0 0 / 8%);
+    --well-shadow: 0 1px 2px rgb(0 0 0 / 6%);
+    /* Light mode has no dim/faint fg tokens; these keep WCAG AA on the card. */
+    --card-fg: oklch(14.5% 0 0);
+    --card-fg-dim: oklch(40% 0 0);
+    --card-fg-faint: var(--coollabs-subtle);
     margin: 0;
     display: flex;
     width: 100%;
     flex-direction: column;
-    border-radius: 8px;
-    border: none;
-    background: var(--coollabs-elevated);
-    /* crisp ring + a restrained lift so the card separates from the canvas
-       (shadcn-style), not a heavy floating shadow */
-    box-shadow: 0 0 0 1px var(--coollabs-hairline), 0 1px 2px 0 rgb(0 0 0 / 0.05);
+    border: 1px solid var(--card-border);
+    border-radius: 0.75rem;
+    padding: 0.375rem;
+    background: var(--card-bg);
+    box-shadow: 0 1px 2px rgb(0 0 0 / 5%);
     /* keep anchored scrolls (scrollIntoView) clear of the fixed topbar and page padding */
     scroll-margin-top: 7rem;
 }
 
+.dark .application-settings-section,
+.dark .application-settings-section-body,
+.dark .empty-state {
+    --card-bg: rgb(255 255 255 / 6%);
+    --card-underlay: var(--color-app);
+    --card-border: rgb(255 255 255 / 8%);
+    --well-bg: rgb(0 0 0 / 34%);
+    --well-border: rgb(255 255 255 / 7%);
+    --well-shadow: 0 1px 2px rgb(0 0 0 / 25%);
+    --card-fg: var(--color-fg);
+    --card-fg-dim: var(--color-fg-dim);
+    --card-fg-faint: var(--color-fg-faint);
+}
+
+html[data-theme="custom"]:not(.dark) :is(.application-settings-section, .application-settings-section-body, .empty-state) {
+    --card-underlay: var(--coollabs-canvas);
+}
+
+/* Top-level cards and wells sit on the page: paint the translucent tint over
+   the page color, so a page backdrop (the floating navigation dots) does not
+   show through. Nested ones keep the tint on top of their parent. */
+:is(.application-settings-section, .empty-state):not(:is(.application-settings-section, .application-settings-section-body) *) {
+    background: linear-gradient(var(--card-bg), var(--card-bg)), var(--card-underlay);
+}
+
+.application-settings-section-body:not(.application-settings-section *) {
+    background: linear-gradient(var(--well-bg), var(--well-bg)), var(--card-underlay);
+}
+
+/* Dark mode: top-level cards use the topbar color (see DESIGN.md). */
+.dark :is(.application-settings-section, .empty-state):not(:is(.application-settings-section, .application-settings-section-body) *) {
+    background: var(--color-panel);
+}
+
+/* Dark mode: collection tiles, pagination bars, and tables match the cards.
+   A tile is a card without a well, so it takes the topbar color. A table (a
+   shell with a header row) takes the topbar color on the header row and the
+   box content (well) color on the rows. */
+.dark [class~="rounded-xl"][class~="dark:bg-white/[0.05]"] {
+    background: var(--color-panel);
+}
+
+.dark [class~="rounded-xl"][class~="dark:bg-white/[0.05]"]:has(> [class~="border-b"]:first-child) {
+    background: color-mix(in srgb, var(--color-panel) 66%, black);
+}
+
+.dark [class~="rounded-xl"][class~="dark:bg-white/[0.05]"] > [class~="border-b"]:first-child {
+    background: var(--color-panel);
+}
+
 /* Brief accent ring when a settings nav sub-item scrolls a section into view.
    Use a real border on ::after (not animated multi-layer box-shadow) so the
    ring is the same weight on every side — box-shadow rings look thicker on
@@ -1765,63 +1897,91 @@ html[data-theme="custom"] textarea:disabled {
     animation: application-settings-section-highlight 500ms ease-out forwards;
 }
 
-/* Modals reuse the layer-card shell but size to content on large screens */
+/* Modals reuse the layer-card shell. The card tint is translucent, so paint it
+   over the page canvas to keep the page behind the modal hidden. */
+.application-settings-section.application-settings-form {
+    background: linear-gradient(var(--card-bg), var(--card-bg)), var(--coollabs-canvas);
+}
+
+/* Modals size to content on large screens */
 @media (min-width: 1024px) {
     .application-settings-section.application-settings-form {
         width: auto;
     }
 }
 
-/* Layer card header: compact strip on the shell, subtle title color */
+/* Layer card header: small title row on the outer box */
 .application-settings-section > :is(header, .application-settings-section-header) {
     display: flex;
-    min-height: 3rem;
     flex-wrap: wrap;
     align-items: center;
     justify-content: space-between;
-    gap: 0.5rem;
-    padding: 0.5rem 0.5rem 0.5rem 1rem;
-    border-radius: 8px 8px 0 0;
-    background: var(--coollabs-elevated);
+    gap: 1rem;
+    padding: 0.25rem 0.5rem 0.625rem;
     font-weight: 500;
-    color: var(--coollabs-subtle);
+    color: var(--card-fg-faint);
 }
 
 .application-settings-section > :is(header, .application-settings-section-header) :is(h2, h3) {
-    font-size: 0.875rem;
-    font-weight: 500;
+    font-size: 13px;
+    font-weight: 600;
     line-height: 1.25rem;
     letter-spacing: 0;
-    /* Card title is a heading, so give it a readable strength instead of the
-       muted --coollabs-subtle (5.66:1 light / 6.98:1 dark). ~8.7:1 in both
-       modes (comfortable AAA) while descriptions/labels stay muted. */
-    color: oklch(40% 0 0);
+    color: var(--card-fg-dim);
 }
 
-.dark .application-settings-section > :is(header, .application-settings-section-header) :is(h2, h3) {
-    color: var(--color-fg-dim);
+.application-settings-section > :is(header, .application-settings-section-header) :is(h2, h3) .info-helper {
+    color: inherit;
 }
 
 .application-settings-section > .application-settings-section-header p {
     margin-top: 0.125rem;
-    font-size: 0.75rem;
+    font-size: 11px;
     line-height: 1rem;
-    color: var(--coollabs-subtle);
+    color: var(--card-fg-faint);
 }
 
-/* Layer card body: nested rounded panel with base bg. Ring uses the same
-   --coollabs-hairline as the card shell (line ~1456) so the body edge and the
-   header edge read as one continuous border instead of two different grays
-   (fill was lighter than hairline, so the header sides and body sides did not
-   match). */
+.application-settings-section > :is(header, .application-settings-section-header) > div:nth-child(2) > a:not(.button) {
+    font-size: 11px;
+    font-weight: 500;
+    color: var(--card-fg-faint);
+}
+
+.application-settings-section > :is(header, .application-settings-section-header) > div:nth-child(2) > a:not(.button):hover {
+    color: var(--card-fg);
+}
+
+/* Layer card body: the inset well */
 .application-settings-section-body {
     position: relative;
-    border-radius: 8px;
-    background: var(--coollabs-base);
-    box-shadow: 0 0 0 1px var(--coollabs-hairline);
+    border: 1px solid var(--well-border);
+    border-radius: 0.5rem;
+    background: var(--well-bg);
+    box-shadow: var(--well-shadow);
     padding: 1rem;
 }
 
+/* The dark well is darker than the canvas, so controls inside it use a darker,
+   translucent fill and border (like haruvo) instead of the global opaque ones. */
+.dark .application-settings-section-body {
+    --coollabs-recessed: rgb(255 255 255 / 3%);
+    --coollabs-line: rgb(255 255 255 / 8%);
+}
+
+/* A well without a card around it sits straight on the canvas. In dark mode its
+   black fill would make it darker than the page, so it takes the card surface. */
+.dark .application-settings-section-body:not(.application-settings-section *) {
+    --well-bg: var(--card-bg);
+    --well-border: var(--card-border);
+    --well-shadow: 0 1px 2px rgb(0 0 0 / 5%);
+}
+
+/* Floating panels in the well must stay opaque: restore the global dark values. */
+.dark .application-settings-section-body :is(.listbox-panel, .searchable-listbox-panel, [role="listbox"], [role="menu"]) {
+    --coollabs-recessed: oklch(25.2% 0 0);
+    --coollabs-line: oklch(36% 0 0);
+}
+
 .settings-mobile-header {
     margin-bottom: 1.25rem;
 }
@@ -1856,6 +2016,13 @@ html[data-theme="custom"] textarea:disabled {
     min-width: 0;
 }
 
+/* Below xl the rail is a grid above the content; a canvas has no room for it. */
+@media (max-width: 1279.98px) {
+    .app-main-full .application-settings-navigation {
+        display: none;
+    }
+}
+
 @media (min-width: 1280px) {
     /* Fixed like the main sidebar (3rem → bottom); left tracks its width (--sidebar-w).
        Fixed leaves the grid, so the content sibling is pinned to column 2 below. */
@@ -1882,6 +2049,15 @@ html[data-theme="custom"] textarea:disabled {
         grid-column: 2;
     }
 
+    /* A resource menu that the main sidebar shows instead (navbar #main-nav-context-{depth}). */
+    .application-settings-navigation.in-main-nav {
+        display: none;
+    }
+
+    .application-settings-navigation.in-main-nav ~ * {
+        grid-column: 1 / -1;
+    }
+
     html:not(.dark) .application-settings-navigation {
         --rail-fill: var(--coollabs-base);
     }
@@ -1903,6 +2079,16 @@ html[data-theme="custom"] textarea:disabled {
         background: var(--coollabs-line);
     }
 
+    /* Canvas pages with a rail (server canvas): the rail stays above the canvas,
+       and the canvas starts after the rail. */
+    .app-main-full .application-settings-navigation {
+        z-index: 20;
+    }
+
+    .app-main-full .application-settings-navigation:not(.in-main-nav) ~ [data-environment-canvas] {
+        margin-left: calc(210px + 2.5rem);
+    }
+
     /* Embeds: keep the surface, drop the fixed positioning. */
     .application-settings-navigation.is-flush {
         position: static;
@@ -2018,6 +2204,17 @@ html[data-theme="custom"] textarea:disabled {
     background: transparent;
 }
 
+/* Main sidebar: only the menu scrolls on short or zoomed-in screens; the
+   footer stays visible. Hide the scrollbar so it does not take width from the
+   narrow collapsed rail and push the icons aside. */
+.sidebar-menu {
+    scrollbar-width: none; /* Firefox */
+}
+
+.sidebar-menu::-webkit-scrollbar {
+    display: none; /* Chrome/Safari */
+}
+
 /* Unified resource heading bar: hide tab-strip scrollbars; menus/actions stay overflow-visible for dropdowns */
 .resource-heading-navbar {
     overflow: visible;
@@ -2147,7 +2344,7 @@ html[data-theme="custom"] textarea:disabled {
 .application-heading-actions .button,
 .application-heading-actions .app-tab,
 .application-heading-actions .relative > button[x-ref='trigger'] {
-    height: 1.75rem;
+    height: 2rem;
     display: inline-flex;
     align-items: center;
     gap: 0.375rem;
@@ -2304,11 +2501,6 @@ html[data-theme="custom"] textarea:disabled {
     box-shadow: 0 0 0 1px var(--color-accent);
 }
 
-.application-heading-actions .split-action-main,
-.application-heading-actions .split-action-caret {
-    height: 1.75rem;
-}
-
 /* Custom listbox (replaces native <select>) */
 .listbox-trigger {
     display: flex;
@@ -2514,6 +2706,14 @@ input[type="search"]::-webkit-search-results-decoration {
     padding: 0;
 }
 
+/* The well does not clip (floating panels must escape it), so a filled table
+   header row needs the well's inner top radius, or its corners poke out. */
+.application-settings-section-body.is-flush > :first-child,
+.application-settings-section-body.is-flush > :first-child > :first-child {
+    border-top-left-radius: calc(0.5rem - 1px);
+    border-top-right-radius: calc(0.5rem - 1px);
+}
+
 /* Empty states inside cards keep the same inset as other card content. */
 .application-settings-section-body:has(> .empty-state:only-child),
 .application-settings-section-body.is-flush:has(> .empty-state:only-child),
@@ -2521,8 +2721,54 @@ input[type="search"]::-webkit-search-results-decoration {
     padding: 1rem;
 }
 
+/* Standalone empty state: the same outer box and inset well as a layer card */
 .empty-state {
-    background: var(--coollabs-base);
+    border: 1px solid var(--card-border);
+    border-radius: 0.75rem;
+    padding: 0.375rem;
+    background: var(--card-bg);
+    box-shadow: 0 1px 2px rgb(0 0 0 / 5%);
+}
+
+.empty-state-well {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    border: 1px solid var(--well-border);
+    border-radius: 0.5rem;
+    background: var(--well-bg);
+    box-shadow: var(--well-shadow);
+    padding: 2rem 1.5rem;
+    text-align: center;
+}
+
+.empty-state-title {
+    font-size: 0.875rem;
+    font-weight: 500;
+    line-height: 1.25rem;
+    color: var(--card-fg);
+}
+
+.empty-state-description {
+    margin-top: 0.25rem;
+    max-width: 28rem;
+    line-height: 1.25rem;
+    color: var(--coollabs-subtle);
+}
+
+/* Inside a layer card or a well, that box is the frame: show only the centered text. */
+:is(.application-settings-section, .application-settings-section-body) .empty-state,
+:is(.application-settings-section, .application-settings-section-body) .empty-state-well {
+    border: 0;
+    border-radius: 0;
+    padding-inline: 0;
+    background: none;
+    box-shadow: none;
+}
+
+:is(.application-settings-section, .application-settings-section-body) .empty-state {
+    padding: 0;
 }
 
 .loading-state-card {
@@ -2603,6 +2849,7 @@ input[type="search"]::-webkit-search-results-decoration {
 
 .dark .data-table-header {
     background: rgba(255, 255, 255, 0.02);
+    color: var(--color-fg-faint);
 }
 
 .data-table > .env-table-item {
@@ -2634,6 +2881,44 @@ input[type="search"]::-webkit-search-results-decoration {
     grid-template-columns: minmax(14rem, 2.5fr) 4.8rem 6rem 4rem 4.5rem 4.8rem 4.2rem 3rem;
 }
 
+/* File browser: icon, name, perms, size, modified, actions.
+   Every column is a fixed width except the flexible name column, so the
+   header grid and each row grid resolve identical tracks and stay aligned
+   (an `auto` column would size to its own content per row and drift). */
+.file-table-grid {
+    grid-template-columns: 1.75rem minmax(10rem, 1fr) 5rem 6rem 6rem 5rem 11rem 10rem;
+}
+
+@media (max-width: 768px) {
+    .data-table-header.file-table-grid {
+        display: none;
+    }
+
+    .data-table-row.file-table-grid {
+        grid-template-columns: 1.75rem minmax(0, 1fr) 10rem;
+        gap: 0.75rem;
+    }
+
+    /* Hide perms, owner, group, size and modified columns on small screens */
+    .data-table-row.file-table-grid > :nth-child(3),
+    .data-table-row.file-table-grid > :nth-child(4),
+    .data-table-row.file-table-grid > :nth-child(5),
+    .data-table-row.file-table-grid > :nth-child(6),
+    .data-table-row.file-table-grid > :nth-child(7) {
+        display: none;
+    }
+}
+
+/* File browser Monaco editor container: fixed viewport-relative height with a
+   rounded, hairline-framed surface that matches the rest of the settings UI. */
+.file-editor-monaco {
+    height: 60vh;
+    min-height: 320px;
+    overflow: hidden;
+    border-radius: 8px;
+    box-shadow: inset 0 0 0 1px var(--coollabs-line);
+}
+
 .environment-table-scroll {
     overflow-x: auto;
     overscroll-behavior-x: contain;
@@ -3136,8 +3421,20 @@ input[type="search"]::-webkit-search-results-decoration {
     }
 }
 
+@media (min-width: 1536px) {
+    .deployment-table-embedded .deployment-table-grid {
+        grid-template-columns: 6.5rem minmax(0, 1fr) 6.5rem;
+    }
+
+    .deployment-table-embedded .deployment-table-grid > :nth-child(2),
+    .deployment-table-embedded .deployment-table-grid > :nth-child(n + 5) {
+        display: none;
+    }
+}
+
+/* Status and Started only fit a badge and a short "3 hours ago"; the names get the rest. */
 .dashboard-deployment-table-grid {
-    grid-template-columns: minmax(0, 1.2fr) minmax(0, 1fr) minmax(6.25rem, 0.75fr) 10rem 8rem;
+    grid-template-columns: minmax(0, 1.4fr) minmax(0, 1fr) minmax(0, 0.7fr) 6.5rem 6rem;
 }
 
 .team-members-table-grid {
@@ -3156,6 +3453,26 @@ input[type="search"]::-webkit-search-results-decoration {
     grid-template-columns: minmax(9rem, 1.15fr) minmax(14rem, 1.9fr) 7rem 6.5rem 6.5rem 5.5rem;
 }
 
+.fleet-servers-table-grid {
+    grid-template-columns: minmax(9rem, 1.4fr) 8rem 8rem 8rem 5rem 8rem 5.5rem;
+}
+
+.fleet-containers-table-grid {
+    grid-template-columns: 2.25rem minmax(9rem, 1.7fr) minmax(6rem, 0.9fr) minmax(8.5rem, 1fr);
+}
+
+.scheduled-executions-table-grid {
+    grid-template-columns: 5.5rem minmax(9rem, 1fr) minmax(7rem, 0.7fr) 8.5rem 5rem minmax(12rem, 1.5fr);
+}
+
+.scheduler-runs-table-grid {
+    grid-template-columns: 9rem minmax(12rem, 1.5fr) 6rem 6rem 6rem;
+}
+
+.skipped-jobs-table-grid {
+    grid-template-columns: 9rem 7rem minmax(10rem, 1fr) minmax(12rem, 1.4fr);
+}
+
 .server-resources-managed-table-grid {
     grid-template-columns: minmax(10rem, 1.3fr) minmax(8rem, 1fr) minmax(8rem, 1fr) 8rem 9.5rem;
 }
@@ -3178,15 +3495,20 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 .backup-executions-table-grid {
-    grid-template-columns: 6.5rem minmax(7rem, 0.8fr) minmax(14rem, 1.5fr) 10rem 5rem 4rem minmax(8rem, 1fr) 5rem;
+    grid-template-columns: 6.5rem minmax(7rem, 0.8fr) minmax(14rem, 1.5fr) 10rem 5rem minmax(8rem, 1fr) 5rem;
     gap: 0.75rem;
-    min-width: 69rem;
+    min-width: 67.5rem;
 }
 
 .backup-executions-table-scroll {
     overflow-x: auto;
 }
 
+/* Match the grid width so the log output spans the full scrolled row. */
+.backup-execution-row {
+    min-width: 67.5rem;
+}
+
 .backup-execution-row:last-child > .data-table-row {
     border-bottom: 0;
 }
@@ -3239,11 +3561,10 @@ input[type="search"]::-webkit-search-results-decoration {
     }
 
     .backup-executions-table-grid {
-        grid-template-columns: 7.5rem minmax(9rem, 0.8fr) minmax(14rem, 1.5fr) 10rem 6rem minmax(9rem, auto);
+        grid-template-columns: 7.5rem minmax(9rem, 0.8fr) minmax(14rem, 1.5fr) 10rem minmax(8rem, 1fr) 5rem;
     }
 
-    .backup-executions-table-grid > :nth-child(6),
-    .backup-executions-table-grid > :nth-child(7) {
+    .backup-executions-table-grid > :nth-child(5) {
         display: none;
     }
 }
@@ -3323,15 +3644,18 @@ input[type="search"]::-webkit-search-results-decoration {
         display: none;
     }
 
+    .backup-executions-table-grid,
+    .backup-execution-row {
+        min-width: 42rem;
+    }
+
     .backup-executions-table-grid {
         grid-template-columns: 7.5rem 9rem minmax(14rem, 1fr) minmax(7rem, auto);
-        min-width: 42rem;
     }
 
     .backup-executions-table-grid > :nth-child(4),
     .backup-executions-table-grid > :nth-child(5),
-    .backup-executions-table-grid > :nth-child(6),
-    .backup-executions-table-grid > :nth-child(7) {
+    .backup-executions-table-grid > :nth-child(6) {
         display: none;
     }
 
@@ -5166,3 +5490,522 @@ a.command-palette-item:focus-visible {
         height: 2.5rem;
     }
 }
+
+/* Navigation items: each sidebar icon sits in a framed 30px tile with the 3D
+   depth of .button, like the canvas tool rail. Only the tile reacts; the row
+   has no background. Applies to both navigation styles. Appearance →
+   Navigation items → Flat sets data-nav-items="flat" on <html> and turns these
+   rules off, which brings back the plain rows. */
+html:where(:not([data-nav-items="flat"])) .menu-item:not(.sidebar-toggle) {
+    height: 2.25rem;
+    padding-left: 0.25rem;
+}
+
+/* In-page section rows have no icon tile, so they stay compact. */
+html:where(:not([data-nav-items="flat"])) .menu-subitem {
+    height: 1.75rem;
+}
+
+/* Only the icon tile reacts: no row background on hover or for the current
+   item; the current item shows through its tile and its brighter label.
+   In the utilities layer so it can beat the search row's !bg-* utilities
+   (a layered !important wins over an unlayered one). */
+@layer utilities {
+    /* The submenu Back row (navbar) keeps its fill. */
+    html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle, .menu-back),
+    html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle, .menu-back):hover {
+        background-color: transparent !important;
+    }
+
+    /* The expanded Search field keeps its input fill (see .menu-search below). */
+    html:where(:not([data-nav-items="flat"])) nav:not(.sidebar-collapsed) .menu-search.menu-item {
+        background-color: var(--color-neutral-100) !important;
+    }
+
+    html:where(:not([data-nav-items="flat"])) nav:not(.sidebar-collapsed) .menu-search.menu-item:hover {
+        background-color: var(--color-neutral-200) !important;
+    }
+
+    html.dark:where(:not([data-nav-items="flat"])) nav:not(.sidebar-collapsed) .menu-search.menu-item {
+        background-color: oklch(100% 0 0 / 0.04) !important;
+    }
+
+    html.dark:where(:not([data-nav-items="flat"])) nav:not(.sidebar-collapsed) .menu-search.menu-item:hover {
+        background-color: oklch(100% 0 0 / 0.07) !important;
+    }
+
+    @media (max-width: 1023.98px) {
+        html:where(:not([data-nav-items="flat"])) nav.sidebar-collapsed .menu-search.menu-item {
+            background-color: var(--color-neutral-100) !important;
+        }
+
+        html.dark:where(:not([data-nav-items="flat"])) nav.sidebar-collapsed .menu-search.menu-item {
+            background-color: oklch(100% 0 0 / 0.04) !important;
+        }
+    }
+}
+
+/* The current item's tile takes the accent, like the active tab pill. */
+html:where(:not([data-nav-items="flat"])) :is(.menu-item-active, .menu-subitem-active) .menu-item-icon {
+    color: var(--color-coollabs);
+    border-color: color-mix(in oklab, var(--color-coollabs) 45%, transparent) !important;
+    --button-depth-color: color-mix(in oklab, var(--color-coollabs) 45%, transparent) !important;
+}
+
+html.dark:where(:not([data-nav-items="flat"])) :is(.menu-item-active, .menu-subitem-active) .menu-item-icon {
+    color: var(--color-warning);
+    border-color: color-mix(in oklab, var(--color-warning) 40%, transparent) !important;
+    --button-depth-color: color-mix(in oklab, var(--color-warning) 35%, transparent) !important;
+}
+
+/* Danger Zone icons (<x-reicon name="danger">) stay red, also when active. */
+html:where(:not([data-nav-items="flat"])) :is(.menu-item-active, .menu-subitem-active) .menu-item-icon.text-error {
+    color: var(--color-error);
+    border-color: color-mix(in oklab, var(--color-error) 45%, transparent) !important;
+    --button-depth-color: color-mix(in oklab, var(--color-error) 40%, transparent) !important;
+}
+
+html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle):focus-visible {
+    outline: none;
+}
+
+html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle):focus-visible .menu-item-icon {
+    outline: 1px solid var(--color-accent);
+    outline-offset: 2px;
+}
+
+/* Sidebar menu swap: a deeper menu (submenu, resource menu) enters from the right, a lower one from the left.
+   CSS animations restart when an element is shown again, so x-show replays them on each swap. */
+@keyframes nav-swap-forward {
+    from {
+        opacity: 0;
+        transform: translateX(0.5rem);
+    }
+}
+
+@keyframes nav-swap-back {
+    from {
+        opacity: 0;
+        transform: translateX(-0.5rem);
+    }
+}
+
+.nav-swap-forward {
+    animation: nav-swap-forward 150ms ease-out;
+}
+
+.nav-swap-back {
+    animation: nav-swap-back 150ms ease-out;
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .nav-swap-forward,
+    .nav-swap-back {
+        animation: none;
+    }
+}
+
+/* Submenu Back chevron box: one icon wide (flat), or one icon tile wide (16px + padding + border). */
+.menu-back-icon {
+    width: 1rem;
+    height: 1rem;
+}
+
+html:where(:not([data-nav-items="flat"])) .menu-back-icon {
+    width: calc(1rem + 0.75rem + 2px);
+}
+
+html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle) .menu-item-icon {
+    box-sizing: content-box;
+    width: 1rem;
+    height: 1rem;
+    padding: 0.375rem;
+    border: 1px solid oklch(0% 0 0 / 0.09);
+    border-radius: 8px;
+    background: #fafafa;
+    opacity: 1;
+    /* Same 3D depth as .button: rests on a 2px ledge, lifts on hover, presses on click. */
+    --button-depth-color: rgb(0 0 0 / 0.22);
+    box-shadow: 0 2px 0 var(--button-depth-color);
+    transition: border-color 120ms, background-color 120ms, box-shadow 80ms, transform 80ms;
+}
+
+html.dark:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle) .menu-item-icon {
+    --button-depth-color: rgb(255 255 255 / 0.08);
+}
+
+html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle):hover .menu-item-icon {
+    transform: translateY(-1px);
+    box-shadow: 0 3px 0 var(--button-depth-color);
+}
+
+html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle):active .menu-item-icon {
+    transform: translateY(2px);
+    box-shadow: none;
+}
+
+html.dark:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle) .menu-item-icon {
+    border-color: oklch(100% 0 0 / 0.09);
+    background: oklch(100% 0 0 / 0.04);
+}
+
+html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle):hover .menu-item-icon,
+html:where(:not([data-nav-items="flat"])) :is(.menu-item-active, .menu-subitem-active) .menu-item-icon {
+    border-color: oklch(0% 0 0 / 0.18);
+    background: #fff;
+}
+
+html.dark:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle):hover .menu-item-icon,
+html.dark:where(:not([data-nav-items="flat"])) :is(.menu-item-active, .menu-subitem-active) .menu-item-icon {
+    border-color: oklch(100% 0 0 / 0.18);
+    background: oklch(100% 0 0 / 0.08);
+}
+
+/* Search keeps its original input look while the sidebar is expanded (always on
+   mobile, where the rail never collapses). Only the collapsed rail shows the 3D tile.
+   The icon resets use .menu-search.menu-item to beat the html.dark tile rules. */
+html:where(:not([data-nav-items="flat"])) nav:not(.sidebar-collapsed) .menu-search {
+    height: 2rem;
+    padding-left: 0.625rem;
+}
+
+html:where(:not([data-nav-items="flat"])) nav:not(.sidebar-collapsed) .menu-search.menu-item .menu-item-icon,
+html:where(:not([data-nav-items="flat"])) nav:not(.sidebar-collapsed) .menu-search.menu-item:is(:hover, :active, :focus-visible) .menu-item-icon {
+    box-sizing: border-box;
+    width: 1rem;
+    height: 1rem;
+    padding: 0;
+    border: 0;
+    background: transparent;
+    box-shadow: none;
+    transform: none;
+    outline: none;
+    opacity: 0.9;
+}
+
+html:where(:not([data-nav-items="flat"])) nav:not(.sidebar-collapsed) .menu-search:focus-visible {
+    outline: 1px solid var(--color-accent);
+}
+
+@media (max-width: 1023.98px) {
+    html:where(:not([data-nav-items="flat"])) nav.sidebar-collapsed .menu-search {
+        height: 2rem;
+        padding-left: 0.625rem;
+    }
+
+    html:where(:not([data-nav-items="flat"])) nav.sidebar-collapsed .menu-search.menu-item .menu-item-icon,
+    html:where(:not([data-nav-items="flat"])) nav.sidebar-collapsed .menu-search.menu-item:is(:hover, :active, :focus-visible) .menu-item-icon {
+        box-sizing: border-box;
+        width: 1rem;
+        height: 1rem;
+        padding: 0;
+        border: 0;
+        background: transparent;
+        box-shadow: none;
+        transform: none;
+        outline: none;
+        opacity: 0.9;
+    }
+}
+
+@media (min-width: 1024px) {
+    /* The collapsed rail is 64px wide with 40px of content: center the 30px tile. */
+    html:where(:not([data-nav-items="flat"])) .sidebar-collapsed .menu-item:not(.sidebar-toggle) {
+        padding-left: 0.3125rem;
+        padding-right: 0.3125rem;
+    }
+}
+
+/* Secondary navigation (settings rails): text-only rows with a filled pill for
+   the current item, like Sentry. Only the main sidebar keeps the icon tiles. */
+html .application-settings-navigation :is(.menu-item, .menu-subitem) {
+    height: 2rem;
+    padding-left: 0.625rem;
+}
+
+html .application-settings-navigation .menu-item-icon {
+    display: none;
+}
+
+/* In the utilities layer to beat the transparent row rule above. */
+@layer utilities {
+    html .application-settings-navigation :is(.menu-item, .menu-subitem):hover {
+        background-color: oklch(0% 0 0 / 0.04) !important;
+    }
+
+    html.dark .application-settings-navigation :is(.menu-item, .menu-subitem):hover {
+        background-color: oklch(100% 0 0 / 0.05) !important;
+    }
+
+    html .application-settings-navigation :is(.menu-item-active, .menu-subitem-active),
+    html .application-settings-navigation :is(.menu-item-active, .menu-subitem-active):hover {
+        background-color: oklch(0% 0 0 / 0.06) !important;
+    }
+
+    html.dark .application-settings-navigation :is(.menu-item-active, .menu-subitem-active),
+    html.dark .application-settings-navigation :is(.menu-item-active, .menu-subitem-active):hover {
+        background-color: oklch(100% 0 0 / 0.08) !important;
+    }
+}
+
+/* Canvases at full zoom: the grid dots turn into small Coolify logos, one
+   per 20px tile. setCanvasDots() (environment-canvas.js) sets .canvas-zoom-max. */
+.canvas-zoom-max {
+    --canvas-dots-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 20 20'%3E%3Cpath transform='translate(8 8) scale(0.0125)' d='M64 256H0V64h64Zm0-192V0h256v64Zm0 192h256v64H64Z' fill='rgb(0 0 0 / 0.13)'/%3E%3C/svg%3E");
+}
+
+html.dark .canvas-zoom-max {
+    --canvas-dots-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 20 20'%3E%3Cpath transform='translate(8 8) scale(0.0125)' d='M64 256H0V64h64Zm0-192V0h256v64Zm0 192h256v64H64Z' fill='rgb(255 255 255 / 0.09)'/%3E%3C/svg%3E");
+}
+
+.canvas-zoom-max [data-ec-viewport] {
+    background-image: var(--canvas-dots-image);
+}
+
+/* "Floating" navigation (Appearance → Navigation style): the top bar, sidebar,
+   tab strip, and settings rail float as framed panels over a dotted backdrop,
+   like the canvas islands. Set on <html> by applyStoredTheme() from
+   localStorage.navStyle; the default style keeps edge-to-edge bars. */
+@media (min-width: 1024px) {
+    html[data-nav-style="floating"] {
+        --floating-gap: 0.5rem;
+        --floating-radius: 8px;
+        --floating-line: oklch(0% 0 0 / 0.09);
+        /* Bottom edge of the top bar panel plus one gap. */
+        --floating-top: calc(3rem + var(--floating-gap) * 2);
+    }
+
+    html.dark[data-nav-style="floating"] {
+        --floating-line: oklch(100% 0 0 / 0.08);
+        --floating-dot: rgb(255 255 255 / 0.09);
+    }
+
+    /* Dotted backdrop behind the floating panels and in the gaps between them,
+       like the canvas stage. Fixed so the dots stay still while content scrolls. */
+    html[data-nav-style="floating"] .app-shell {
+        background-image: radial-gradient(circle, var(--floating-dot, rgb(0 0 0 / 0.13)) 1px, transparent 1.3px);
+        background-size: 20px 20px;
+        background-attachment: fixed;
+    }
+
+    html[data-nav-style="floating"] .app-main {
+        background-color: transparent;
+    }
+
+    html[data-nav-style="floating"] .app-topbar {
+        background-color: #fff;
+    }
+
+    html.dark[data-nav-style="floating"] .app-topbar {
+        background-color: var(--color-panel);
+    }
+
+    html[data-nav-style="floating"] :is(.app-topbar, .app-sidebar > div > nav) {
+        border: 1px solid var(--floating-line);
+        border-radius: var(--floating-radius);
+    }
+
+    /* The top bar hugs its content (brand, breadcrumb, docked actions)
+       instead of spanning an empty full-width panel. */
+    html[data-nav-style="floating"] .app-topbar {
+        top: var(--floating-gap);
+        left: var(--floating-gap);
+        right: auto;
+        max-width: calc(100vw - var(--floating-gap) * 2);
+    }
+
+    /* The bar is opaque here, so it needs no blur. Without the backdrop filter
+       the bar is no longer the containing block for fixed children, which lets
+       the resource actions panel below sit against the screen edge. */
+    html[data-nav-style="floating"] .app-topbar {
+        backdrop-filter: none;
+    }
+
+    /* The panel border replaces the inner dividers of the top bar. */
+    html[data-nav-style="floating"] .app-topbar > div {
+        border-bottom-width: 0;
+    }
+
+    html[data-nav-style="floating"] .app-topbar > .app-topbar-brand {
+        border-radius: calc(var(--floating-radius) - 1px) 0 0 calc(var(--floating-radius) - 1px);
+    }
+
+    html[data-nav-style="floating"] .app-sidebar {
+        top: var(--floating-top);
+        bottom: var(--floating-gap);
+        left: var(--floating-gap);
+    }
+
+    html[data-nav-style="floating"] .app-sidebar > div > nav > .sidebar-footer {
+        border-radius: 0 0 var(--floating-radius) var(--floating-radius);
+    }
+
+    html[data-nav-style="floating"] .app-main {
+        margin-left: calc(var(--sidebar-w, 14rem) + var(--floating-gap));
+        /* The content top lines up with the sidebar and settings rail panels.
+           The cards draw their frame as a 1px ring outside the box, while the
+           panels use a 1px border inside it, so add 1px to match the edges. */
+        padding-top: calc(var(--floating-top) + 1px);
+    }
+
+    /* Full-bleed pages (canvases): no top padding gap, and the same gap as the panels. */
+    html[data-nav-style="floating"] .app-main.app-main-full {
+        margin-left: calc(var(--sidebar-w, 14rem) + var(--floating-gap) * 2);
+        padding: var(--floating-top) var(--floating-gap) var(--floating-gap) 0;
+    }
+
+    /* Canvases fill the space under the top bar too, and the canvas root
+       paints the canvas dots (set by the canvas JS) behind the top bar, so
+       the dots are the same there and on the canvas. */
+    html[data-nav-style="floating"] .app-main.app-main-full:has(:is([data-ec-root], .cv-root)) {
+        padding-top: 0;
+    }
+
+    /* The resource canvases fill the whole screen behind the floating panels
+       (top bar, toolbar, sidebar), so the panels do not cut off the cards. */
+    html[data-nav-style="floating"] .app-main.app-main-full:has([data-ec-root]) {
+        margin-left: 0;
+        padding: 0;
+    }
+
+    html[data-nav-style="floating"] .app-main-full [data-ec-root] {
+        padding: 0 !important;
+    }
+
+    html[data-nav-style="floating"] .app-main-full :is([data-ec-root], .cv-root) {
+        padding-top: calc(var(--floating-top) + 0.5rem);
+        background-image: var(--canvas-dots-image, radial-gradient(circle, var(--floating-dot, rgb(0 0 0 / 0.13)) 1px, transparent 1px));
+        background-size: var(--canvas-dots-size, 20px 20px);
+        background-position: var(--canvas-dots-position, 0 0);
+    }
+
+    /* The deploy canvas Steps panel starts at the same height as the sidebar. */
+    html[data-nav-style="floating"] .app-main-full .cv-root {
+        padding-top: var(--floating-top);
+    }
+
+    html[data-nav-style="floating"] .app-main-full [data-ec-viewport] {
+        background-image: none;
+    }
+
+    /* Full page width: the content is one gap from the sidebar and the screen edge. */
+    html[data-nav-style="floating"] .app-main.app-main-wide {
+        padding-right: var(--floating-gap);
+        padding-left: var(--floating-gap);
+        padding-bottom: var(--floating-gap);
+    }
+
+    /* Dashboard canvas Deployments panel: one gap from the floating sidebar and the screen bottom. */
+    /* Bottom-left zoom controls and deployments: the canvas fills the screen behind the sidebar, so start one gap after it. */
+    html[data-nav-style="floating"] .app-main-full [data-ec-dock] {
+        left: calc(var(--sidebar-w, 14rem) + var(--floating-gap) * 2);
+        bottom: var(--floating-gap);
+    }
+}
+
+@media (min-width: 1280px) {
+    /* Resource actions (Links, Deploy, …) float as their own panel at the top
+       right. The top bar panel stops one gap before it (the header publishes
+       --resource-actions-w). */
+    html[data-nav-style="floating"] #resource-action-hud-slot:not(:empty) {
+        position: fixed;
+        top: var(--floating-gap);
+        right: var(--floating-gap);
+        height: 3rem;
+        padding: 0 0.5rem;
+        border: 1px solid var(--floating-line);
+        border-radius: var(--floating-radius);
+        background-color: #fff;
+    }
+
+    html.dark[data-nav-style="floating"] #resource-action-hud-slot:not(:empty) {
+        background-color: var(--color-panel);
+    }
+
+    html[data-nav-style="floating"] .app-topbar:has(#resource-action-hud-slot:not(:empty)) {
+        max-width: calc(100vw - var(--floating-gap) * 3 - var(--resource-actions-w, 0px));
+    }
+
+    html[data-nav-style="floating"] .application-settings-navigation {
+        top: var(--floating-top);
+        left: calc(var(--sidebar-w, 14rem) + var(--floating-gap) * 2);
+        /* Hug the menu items; long menus scroll inside the viewport. */
+        height: auto;
+        max-height: calc(100dvh - var(--floating-top) - var(--floating-gap));
+        border: 1px solid var(--floating-line);
+        border-radius: var(--floating-radius);
+    }
+
+    /* Full page width: the content starts one gap after the settings rail. */
+    html[data-nav-style="floating"] .app-main-wide :has(> .application-settings-navigation) {
+        grid-template-columns: calc(210px + 2.5rem) minmax(0, 1fr);
+        column-gap: var(--floating-gap);
+    }
+
+    /* The canvas fills the screen behind the rail too; the canvas JS keeps cards clear of it. */
+    html[data-nav-style="floating"] .app-main-full .application-settings-navigation ~ [data-environment-canvas] {
+        margin-left: 0;
+    }
+}
+
+/* Dark mode (both navigation styles): the floating dotted backdrop shows through
+   see-through surfaces (dark:bg-white/[x] with or without `!`, .button, …). Give the
+   outermost ones the same color as an opaque mix with the app background, like the
+   canvas cards. The normal navigation uses the same colors so both styles match. Nested
+   surfaces keep their tint on top, also inside opaque CSS-class panels
+   (settings sections, boxes, tables, …) that are not app-colored. Generated from the dark:bg-white|black/x
+   utilities used in resources/views and resources/js; in the utilities layer
+   with !important so it beats the !bg-* utilities. */
+@layer utilities {
+    html.dark .app-main [class*="dark:bg-black/10"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #000 10%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-black/15"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #000 15%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-black/20"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #000 20%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-black/30"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #000 30%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-black/40"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #000 40%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-black/55"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #000 55%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-black/60"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #000 60%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/10"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 10%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/40"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 40%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.025]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 2.5%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.02]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 2%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.035]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 3.5%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.03]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 3%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.045]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 4.5%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.04]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 4%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.05]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 5%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.06]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 6%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.07]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 7%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.08]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 8%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.09]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 9%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.14]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 14%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:bg-white/[0.1]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 10%, var(--color-app)) !important; }
+    html.dark .app-main :is(.button, .view-toggle):not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *) { background-color: color-mix(in oklab, #fff 6%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/10"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 10%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.025]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 2.5%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.035]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 3.5%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.03]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 3%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.04]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 4%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.05]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 5%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.06]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 6%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.07]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 7%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.08]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 8%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.12]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 12%, var(--color-app)) !important; }
+    html.dark .app-main [class*="dark:hover:bg-white/[0.1]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 10%, var(--color-app)) !important; }
+    html.dark .app-main .button:not(:disabled):not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .application-settings-section-body, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 10%, var(--color-app)) !important; }
+}
+
+/* Resource menu in the collapsed main sidebar: icons only. */
+.sidebar-collapsed .nav-context-menu :is(.menu-item-label, .nav-children, .menu-item > :not(.menu-item-icon)) {
+    display: none !important;
+}
+
+.sidebar-collapsed .nav-context-menu .menu-item {
+    justify-content: center;
+    padding-left: 0;
+    padding-right: 0;
+}
+
+/* A page menu's own "Back to ..." item: the main sidebar copy has the back row instead (components/main-nav-menu). */
+.nav-context-menu [data-page-only] {
+    display: none !important;
+}
diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 96511bbf79..a35cb76471 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -249,11 +249,6 @@
     @apply px-2.5 pt-1 pb-1 text-[11px] font-medium text-nav-muted select-none;
 }
 
-/* Collapsible group header (accordion) for the resource settings sidebar. */
-@utility nav-section-toggle {
-    @apply w-full items-center justify-between gap-2 px-2.5 pt-1 pb-1 text-[11px] font-medium text-nav-muted select-none rounded-md transition-colors cursor-pointer hover:text-nav-active;
-}
-
 /* Indented child rows in a collapsible nav group */
 @utility menu-subitem {
     /* Label owns text ellipsis; keep this row overflow-visible so the focus ring is not clipped. */
@@ -435,6 +430,16 @@
         padding-right: 0.625rem;
     }
 
+    /* Flat rows show their own fill, so make it a 2rem square (same as the h-8
+       height) with the icon centered, in line with the footer controls. */
+    html[data-nav-items="flat"] .sidebar-collapsed .menu-item:not(.sidebar-toggle) {
+        width: 2rem;
+        margin-left: 0.1875rem;
+        justify-content: center;
+        padding-left: 0;
+        padding-right: 0;
+    }
+
     .sidebar-collapsed .sidebar-collapsed-label {
         display: none;
     }
diff --git a/resources/js/app.js b/resources/js/app.js
index dde95415a6..7e54193431 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -1,12 +1,32 @@
 import { initializeCopyButtonComponent } from './copy-button.js';
 import { initializeRuntimeLogsComponent } from './runtime-logs.js';
-import { initializeSettingsSidebarAccordionComponent } from './settings-sidebar-accordion.js';
 import { initializeTerminalComponent } from './terminal.js';
 import './traffic-globe.js';
+import './traffic-table.js';
 import { registerLivewireRequestFailureHandler } from './livewire-request-failure.js';
 import { registerLivewireUpdateDedupe } from './livewire-update-dedupe.js';
 import { parseSubmitAction } from './modal-confirmation.js';
 
+// The canvases (Svelte, Svelte Flow) load only on pages that have one. After the
+// import, each canvas mounts itself, also after later Livewire SPA navigation.
+const canvases = [
+    { selector: '[data-deploy-canvas]', load: () => import('./canvas/deploy/index.js').then((m) => m.initializeDeployCanvas()) },
+    { selector: '[data-environment-canvas]', load: () => import('./canvas/environment/index.js').then((m) => m.initializeEnvironmentCanvas()) },
+];
+const loadCanvases = () => {
+    for (const canvas of canvases) {
+        if (!canvas.loading && document.querySelector(canvas.selector)) {
+            canvas.loading = canvas.load();
+        }
+    }
+};
+if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', loadCanvases);
+} else {
+    loadCanvases();
+}
+document.addEventListener('livewire:navigated', loadCanvases);
+
 // Used by the modal-confirmation Blade component to call its submitAction.
 window.parseModalSubmitAction = parseSubmitAction;
 
@@ -29,7 +49,6 @@ document.addEventListener('livewire:navigated', () => {
 document.addEventListener('alpine:init', initializeTerminalComponent);
 document.addEventListener('alpine:init', initializeCopyButtonComponent);
 document.addEventListener('alpine:init', initializeRuntimeLogsComponent);
-document.addEventListener('alpine:init', initializeSettingsSidebarAccordionComponent);
 
 /**
  * Smooth-scroll a settings section into view, then flash its border for 500ms
@@ -38,6 +57,29 @@ document.addEventListener('alpine:init', initializeSettingsSidebarAccordionCompo
  *
  * @param {string|HTMLElement} target Section id or element
  */
+/** A resource favicon loaded: show it in place of the logo. */
+window.resourceLogoLoaded = function resourceLogoLoaded(img) {
+  img.closest('[data-resource-logo]')?.querySelector('[data-resource-logo-image]')?.setAttribute('hidden', '');
+  img.removeAttribute('hidden');
+};
+
+/** A resource logo failed to load: drop a favicon, try the fallback URL of a logo, then show the resource type icon instead. */
+window.resourceLogoError = function resourceLogoError(img) {
+  if (img.hasAttribute('data-resource-logo-favicon')) {
+    img.remove();
+    return;
+  }
+  if (img.dataset.fallback && img.src !== img.dataset.fallback) {
+    img.src = img.dataset.fallback;
+    return;
+  }
+  const wrapper = img.closest('[data-resource-logo]');
+  wrapper?.querySelector('[data-resource-logo-image]')?.setAttribute('hidden', '');
+  if (!wrapper?.querySelector('[data-resource-logo-favicon]:not([hidden])')) {
+    wrapper?.querySelector('[data-resource-logo-icon]')?.removeAttribute('hidden');
+  }
+};
+
 window.scrollToSettingsSection = function scrollToSettingsSection(target) {
     const el = typeof target === 'string' ? document.getElementById(target) : target;
     if (!el) {
diff --git a/resources/js/canvas-core.js b/resources/js/canvas-core.js
new file mode 100644
index 0000000000..4f2127df1c
--- /dev/null
+++ b/resources/js/canvas-core.js
@@ -0,0 +1,258 @@
+// Shared canvas core: API calls, pan/zoom and page mounting for the deploy
+// canvas and the environment canvas (Svelte components in resources/js/canvas/).
+//
+// The top level stays DOM-free: `node --test` imports the canvases.
+
+export const MIN_ZOOM = 0.25;
+export const MAX_ZOOM = 2;
+
+// ── Collisions ────────────────────────────────────────────────────────
+
+/** Space that cards and frames keep between them. */
+export const BOX_GAP = 16;
+
+/** True when boxes `a` and `b` ({ x, y, w, h }) are at least `gap` apart. */
+export const apart = (a, b, gap = BOX_GAP) => a.x >= b.x + b.w + gap || a.x + a.w + gap <= b.x || a.y >= b.y + b.h + gap || a.y + a.h + gap <= b.y;
+
+/**
+ * The free spot nearest to `box` ({ x, y, w, h }) that keeps `gap` clear of
+ * every box in `others` (and passes `fits`, when given): the box itself, or it
+ * pushed against an edge (or a corner) of the boxes in the way. Null when no
+ * such spot is found.
+ */
+export function freeSpot(box, others, gap = BOX_GAP, fits = () => true) {
+  const free = b => others.every(o => apart(b, o, gap)) && fits(b);
+  if (free(box)) return box;
+  const xs = [box.x, ...others.flatMap(o => [o.x - box.w - gap, o.x + o.w + gap])];
+  const ys = [box.y, ...others.flatMap(o => [o.y - box.h - gap, o.y + o.h + gap])];
+  let best = null;
+  let bestDistance = Infinity;
+  for (const x of xs) {
+    for (const y of ys) {
+      const distance = Math.hypot(x - box.x, y - box.y);
+      if (distance < bestDistance && free({ ...box, x, y })) {
+        best = { ...box, x, y };
+        bestDistance = distance;
+      }
+    }
+  }
+  return best;
+}
+
+// ── API (Coolify's API controllers at /canvas/api, browser session) ───
+
+/** The team of the open canvas page (data-team), fixed when the page was opened. */
+function canvasTeam() {
+  return document.querySelector('[data-environment-canvas], [data-deploy-canvas]')?.dataset.team || '';
+}
+
+export class ApiError extends Error {
+  constructor(status, body) {
+    const errors = body?.errors ? Object.values(body.errors).flat().map(String) : [];
+    super([body?.message || `Request failed (HTTP ${status}).`, ...errors.filter(e => e !== body?.message)].join(' '));
+    this.status = status;
+    this.body = body;
+  }
+}
+
+export async function api(method, path, body, options = {}) {
+  const response = await fetch(`/canvas/api${path}`, {
+    method,
+    credentials: 'same-origin',
+    keepalive: !!options.keepalive,
+    headers: {
+      Accept: 'application/json',
+      'X-Requested-With': 'XMLHttpRequest',
+      'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]')?.content || '',
+      'X-Canvas-Team': canvasTeam(),
+      ...(body ? { 'Content-Type': 'application/json' } : {}),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  let data = null;
+  try {
+    data = await response.json();
+  } catch {
+    // Empty body.
+  }
+  if (!response.ok) throw new ApiError(response.status, data);
+  return data;
+}
+
+// ── Pan and zoom ──────────────────────────────────────────────────────
+
+/** Viewport position inside the root, so the root's dots (floating nav, see app.css) line up with the viewport's. */
+export function canvasDotsOffset(root, viewport) {
+  const r = root.getBoundingClientRect();
+  const v = viewport.getBoundingClientRect();
+  return { x: v.left - r.left, y: v.top - r.top };
+}
+
+export function setCanvasDots(root, size, x, y, atMaxZoom = false) {
+  root.style.setProperty('--canvas-dots-size', `${size}px ${size}px`);
+  root.style.setProperty('--canvas-dots-position', `${x}px ${y}px`);
+  // Fully zoomed in: the grid dots turn into small Coolify logos (app.css).
+  root.classList.toggle('canvas-zoom-max', atMaxZoom);
+}
+
+/**
+ * The browser zoom shortcut in a keydown event (Cmd/Ctrl with +, - or 0), so the
+ * canvas can zoom itself instead: 'in', 'out', 'reset', or null for other keys.
+ */
+export function zoomShortcut(e) {
+  if (!(e.ctrlKey || e.metaKey) || e.altKey) return null;
+  if (e.key === '+' || e.key === '=') return 'in';
+  if (e.key === '-' || e.key === '_') return 'out';
+  if (e.key === '0') return 'reset';
+  return null;
+}
+
+/**
+ * Wheel zoom (ctrl/cmd) and pan, and drag-to-pan on the viewport background.
+ * getView() returns the current { x, y, z }, which is changed in place.
+ * canPan(event) decides which presses pan; onPanEnd(moved) runs on release.
+ */
+export function panZoom({ root, viewport, world, zoomLabel, getView, onChange, canPan, onPanStart, onPanEnd }) {
+  function apply() {
+    const { x, y, z } = getView();
+    const offset = canvasDotsOffset(root, viewport);
+    world.style.transform = `translate(${x}px, ${y}px) scale(${z})`;
+    viewport.style.backgroundSize = `${20 * z}px ${20 * z}px`;
+    viewport.style.backgroundPosition = `${x}px ${y}px`;
+    setCanvasDots(root, 20 * z, x + offset.x, y + offset.y, z >= MAX_ZOOM);
+    zoomLabel.textContent = `${Math.round(z * 100)}%`;
+    onChange?.();
+  }
+  function toWorld(cx, cy) {
+    const view = getView();
+    const r = viewport.getBoundingClientRect();
+    return { x: (cx - r.left - view.x) / view.z, y: (cy - r.top - view.y) / view.z };
+  }
+  /** Zooms to z around a screen point (the viewport centre by default). */
+  function zoomTo(z, cx, cy) {
+    const view = getView();
+    const r = viewport.getBoundingClientRect();
+    const px = cx ?? r.left + r.width / 2;
+    const py = cy ?? r.top + r.height / 2;
+    const before = toWorld(px, py);
+    view.z = Math.min(MAX_ZOOM, Math.max(MIN_ZOOM, z));
+    view.x = px - r.left - before.x * view.z;
+    view.y = py - r.top - before.y * view.z;
+    apply();
+  }
+
+  viewport.addEventListener('wheel', e => {
+    e.preventDefault();
+    const view = getView();
+    if (e.ctrlKey || e.metaKey) {
+      zoomTo(view.z * Math.exp(-e.deltaY * 0.01), e.clientX, e.clientY);
+    } else {
+      view.x -= e.deltaX;
+      view.y -= e.deltaY;
+      apply();
+    }
+  }, { passive: false });
+  // Touch: two fingers pinch to zoom and pan, anywhere on the viewport (also on cards).
+  // Capture phase on the viewport, so the pinch fingers do not also move cards or pan with one finger.
+  const touches = new Map();
+  const pinchFingers = new Set();
+  let pinch = null;
+  const pinchState = () => {
+    const [a, b] = [...touches.values()];
+    return { cx: (a.x + b.x) / 2, cy: (a.y + b.y) / 2, d: Math.max(1, Math.hypot(a.x - b.x, a.y - b.y)) };
+  };
+  viewport.addEventListener('pointerdown', e => {
+    if (e.pointerType !== 'touch') return;
+    touches.set(e.pointerId, { x: e.clientX, y: e.clientY });
+    if (touches.size !== 2) return;
+    for (const id of touches.keys()) pinchFingers.add(id);
+    const start = pinchState();
+    pinch = { ...start, z: getView().z, ...toWorld(start.cx, start.cy) };
+    onPanStart?.();
+    e.stopImmediatePropagation();
+  }, true);
+  viewport.addEventListener('pointermove', e => {
+    if (!touches.has(e.pointerId)) return;
+    touches.set(e.pointerId, { x: e.clientX, y: e.clientY });
+    if (!pinchFingers.has(e.pointerId)) return;
+    // Pinch fingers stay out of card drags and one-finger pans until they lift.
+    // Immediate: a one-finger pan listens on the viewport itself (capture listeners run first there).
+    e.stopImmediatePropagation();
+    if (!pinch || touches.size < 2) return;
+    const now = pinchState();
+    const view = getView();
+    const r = viewport.getBoundingClientRect();
+    view.z = Math.min(MAX_ZOOM, Math.max(MIN_ZOOM, pinch.z * now.d / pinch.d));
+    view.x = now.cx - r.left - pinch.x * view.z;
+    view.y = now.cy - r.top - pinch.y * view.z;
+    apply();
+  }, true);
+  // The release still reaches the drag that the first finger started, so that drag ends.
+  const liftFinger = e => {
+    touches.delete(e.pointerId);
+    pinchFingers.delete(e.pointerId);
+    if (touches.size < 2) pinch = null;
+  };
+  viewport.addEventListener('pointerup', liftFinger, true);
+  viewport.addEventListener('pointercancel', liftFinger, true);
+
+  viewport.addEventListener('pointerdown', e => {
+    if (e.button !== 0 || pinch || !canPan(e)) return;
+    onPanStart?.();
+    const view = getView();
+    const start = { cx: e.clientX, cy: e.clientY, x: view.x, y: view.y };
+    let moved = false;
+    try {
+      viewport.setPointerCapture(e.pointerId);
+    } catch {
+      // Synthetic or already released pointer.
+    }
+    viewport.classList.add('panning');
+    const move = ev => {
+      if (!moved && Math.hypot(ev.clientX - start.cx, ev.clientY - start.cy) < 4) return;
+      moved = true;
+      view.x = start.x + ev.clientX - start.cx;
+      view.y = start.y + ev.clientY - start.cy;
+      apply();
+    };
+    const up = () => {
+      viewport.classList.remove('panning');
+      viewport.removeEventListener('pointermove', move);
+      viewport.removeEventListener('pointerup', up);
+      viewport.removeEventListener('pointercancel', up);
+      onPanEnd?.(moved);
+    };
+    viewport.addEventListener('pointermove', move);
+    viewport.addEventListener('pointerup', up);
+    viewport.addEventListener('pointercancel', up);
+  });
+
+  return { apply, toWorld, zoomTo };
+}
+
+// ── Page mount (initial load and Livewire SPA navigation) ─────────────
+
+/**
+ * Mounts a canvas into the page's container unless it already holds the canvas root.
+ * mount(container) may return { root, unmount }, unmounted once its root leaves the page.
+ */
+export function mountOnPage(selector, rootSelector, mount) {
+  if (typeof document === 'undefined') return;
+  let active = null;
+  const run = () => {
+    if (active && !active.root.isConnected) {
+      active.unmount();
+      active = null;
+    }
+    const container = document.querySelector(selector);
+    if (!container || container.querySelector(rootSelector)) return;
+    active?.unmount();
+    active = mount(container) || null;
+  };
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', run);
+  } else {
+    run();
+  }
+  document.addEventListener('livewire:navigated', run);
+}
diff --git a/resources/js/canvas/CanvasControls.svelte b/resources/js/canvas/CanvasControls.svelte
new file mode 100644
index 0000000000..f4b2532891
--- /dev/null
+++ b/resources/js/canvas/CanvasControls.svelte
@@ -0,0 +1,35 @@
+<script>
+  // Zoom and fit controls that float in the bottom-left corner of a canvas.
+  // With `onrefresh` (environment canvas) it also has a Refresh button. `inline`: the parent places it.
+  // `children`: more actions after the zoom buttons (deploy canvas header).
+  import Icon from './environment/Icon.svelte';
+  import { zoomShortcut } from '../canvas-core.js';
+
+  let { zoom, onzoom, onfit, onrefresh = null, loading = false, inline = false, children = null } = $props();
+
+  const button = 'grid h-7 min-w-7 place-items-center rounded-md px-1.5 text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-neutral-900 disabled:pointer-events-none disabled:opacity-50 dark:text-fg-dim dark:hover:bg-white/[0.07] dark:hover:text-fg';
+
+  /** Cmd/Ctrl + / - / 0 zoom the canvas instead of the page. */
+  function onKeydown(e) {
+    const shortcut = e.defaultPrevented ? null : zoomShortcut(e);
+    if (!shortcut) return;
+    e.preventDefault();
+    onzoom(shortcut === 'in' ? zoom * 1.2 : shortcut === 'out' ? zoom / 1.2 : 1);
+  }
+</script>
+
+<svelte:window onkeydown={onKeydown} />
+
+<div class="{inline ? 'shrink-0' : 'absolute bottom-3 left-3 z-20'} flex items-center gap-0.5 rounded-lg border border-neutral-200 bg-white/85 p-0.5 shadow-sm backdrop-blur-sm dark:border-white/[0.08] dark:bg-panel/85" data-canvas-controls>
+  <button type="button" class={button} title="Zoom out" aria-label="Zoom out" onclick={() => onzoom(zoom / 1.2)}><Icon name="minus" /></button>
+  <button type="button" class="{button} w-12 text-[12px] font-medium tabular-nums" title="Reset zoom to 100%" onclick={() => onzoom(1)}>{Math.round(zoom * 100)}%</button>
+  <button type="button" class={button} title="Zoom in" aria-label="Zoom in" onclick={() => onzoom(zoom * 1.2)}><Icon name="plus" /></button>
+  <span class="mx-0.5 h-4 w-px bg-neutral-200 dark:bg-white/[0.08]"></span>
+  <button type="button" class={button} title="Fit to screen" aria-label="Fit to screen" onclick={onfit}><Icon name="fit" /></button>
+  {#if onrefresh}
+    <button type="button" class={button} title="Load the latest status" aria-label="Refresh" disabled={loading} onclick={onrefresh}><Icon name="refresh" class="size-3.5 {loading ? 'animate-spin' : ''}" /></button>
+  {/if}
+  {#if children}
+    <div class="ml-0.5 flex items-center gap-2 border-l border-neutral-200 pr-0.5 pl-2 dark:border-white/[0.08]">{@render children()}</div>
+  {/if}
+</div>
diff --git a/resources/js/canvas/deploy/DeployCanvas.svelte b/resources/js/canvas/deploy/DeployCanvas.svelte
new file mode 100644
index 0000000000..89dab86f61
--- /dev/null
+++ b/resources/js/canvas/deploy/DeployCanvas.svelte
@@ -0,0 +1,167 @@
+<script>
+  import { onMount } from 'svelte';
+  import { ICONS, load, nodeById, PALETTE, save, STORE, withoutSecrets } from '../../deploy-canvas.js';
+  import Dropdown from './Dropdown.svelte';
+  import Edges from './Edges.svelte';
+  import Icon from './Icon.svelte';
+  import Node from './Node.svelte';
+  import PaletteItem from './PaletteItem.svelte';
+  import RunPanel from './RunPanel.svelte';
+  import CanvasControls from '../CanvasControls.svelte';
+  import { closeMenu, cv, els, fit, hideResult, leave, pan, pickNext, PORT_Y, resetCanvas } from './state.svelte.js';
+
+  // The deploy canvas: header, step palette, and the canvas with the step
+  // cards. The state lives in state.svelte.js (init() runs before the mount).
+  // Theme: same as Coolify (html.dark).
+  let dark = $state(document.documentElement.classList.contains('dark'));
+  // Palette: full or icons only ('coolify-canvas:collapsed').
+  let folded = $state(load('collapsed', false));
+  // Small screens: a notice that the canvas is not optimized for mobile. CSS
+  // shows it below 768px; closed once, it stays closed.
+  let noticeOpen = $state(!load('mobile-notice-dismissed', false));
+  // Desktop: the header sits in the zoom controls bar (bottom left), as on the
+  // other canvases. Small screens: a box above the canvas.
+  const desktopQuery = matchMedia('(min-width: 1024px)');
+  let desktop = $state(desktopQuery.matches);
+
+  const stop = e => e.stopPropagation();
+  // A pill joined to the Deploy card: each address opens in a new tab.
+  const resultNode = $derived(cv.result && nodeById(cv.result.after, cv.flow));
+  const foldTitle = $derived(folded ? 'Show the step names' : 'Collapse the steps');
+
+  function toggleFolded() {
+    save('collapsed', !load('collapsed', false));
+    folded = load('collapsed', false);
+  }
+  function closeNotice() {
+    save('mobile-notice-dismissed', true);
+    noticeOpen = false;
+  }
+  // Opens the app's confirmation modal (deploy-canvas.blade.php), which
+  // dispatches deploy-canvas-reset on confirm.
+  function askReset() {
+    if (!cv.running) document.getElementById('deploy-canvas-reset-trigger')?.click();
+  }
+
+  // Save the flow (without secrets) and the view, 200 ms after a change.
+  let saveTimer = 0;
+  $effect(() => {
+    const flow = JSON.stringify(withoutSecrets(cv.flow));
+    const view = JSON.stringify(cv.view);
+    clearTimeout(saveTimer);
+    saveTimer = setTimeout(() => {
+      localStorage.setItem(`${STORE}:flow`, flow);
+      localStorage.setItem(`${STORE}:view`, view);
+    }, 200);
+  });
+
+  onMount(() => {
+    els.pz.apply();
+    if (els.fitOnOpen) requestAnimationFrame(fit);
+    const theme = new MutationObserver(() => { dark = document.documentElement.classList.contains('dark'); });
+    theme.observe(document.documentElement, { attributes: true, attributeFilter: ['class'] });
+    const escape = e => { if (els.root?.isConnected && e.key === 'Escape') closeMenu(); };
+    const reset = () => { if (els.root?.isConnected) resetCanvas(); };
+    addEventListener('keydown', escape);
+    addEventListener('deploy-canvas-reset', reset);
+    const media = () => { desktop = desktopQuery.matches; };
+    desktopQuery.addEventListener('change', media);
+    return () => {
+      desktopQuery.removeEventListener('change', media);
+      theme.disconnect();
+      removeEventListener('keydown', escape);
+      removeEventListener('deploy-canvas-reset', reset);
+      leave();
+    };
+  });
+</script>
+
+{#snippet header()}
+  <div class="mr-auto flex min-w-0 items-center gap-2">
+    {#if cv.target}
+      <!-- Opened from an environment's New resource page: back to that environment. -->
+      <a class="cv-back button px-2!" href="/project/{cv.target.project}/environment/{cv.target.environment}" title="Back to the environment" aria-label="Back to the environment"><Icon name="back" cls="size-4" /></a>
+    {/if}
+    <span class="shrink-0 rounded-full border border-coollabs/30 bg-coollabs/10 px-2 py-0.5 text-xs font-medium text-coollabs dark:border-warning/30 dark:bg-warning/15 dark:text-warning">Beta</span>
+  </div>
+  <button type="button" class="button shrink-0" title="Start again with an empty canvas" onclick={askReset}>Reset</button>
+{/snippet}
+
+<div class="cv-root" class:cv-dark={dark} class:cv-folded={folded} class:cv-docked={desktop}>
+  {#if !desktop}
+    <div class="cv-island cv-top">{@render header()}</div>
+  {/if}
+
+  {#if noticeOpen}
+    <div class="cv-island cv-notice" role="note">
+      <Icon name={ICONS.info} />
+      <p>The canvas is not optimized for mobile yet. It works best on a larger screen.{#if cv.target}{' On a phone, use the '}<a href="/project/{cv.target.project}/environment/{cv.target.environment}/new">New resource page</a>.{/if}</p>
+      <button type="button" class="cv-x" title="Close" aria-label="Close this notice" onclick={closeNotice}><Icon name={ICONS.x} /></button>
+    </div>
+  {/if}
+
+  <aside class="cv-island cv-palette">
+    <div class="cv-palette-head">
+      <div><b>Steps</b><span>Drag one onto the canvas</span></div>
+      <button type="button" class="cv-x cv-fold" title={foldTitle} aria-label={foldTitle} aria-expanded={!folded} onclick={toggleFolded}><Icon name={ICONS.fold} /></button>
+    </div>
+    {#each PALETTE as [group, types]}
+      <h4>{group}</h4>
+      {#each types as type}
+        <PaletteItem {type} />
+      {/each}
+    {/each}
+  </aside>
+
+  <section class="cv-island cv-stage">
+    <div class="cv-viewport" use:pan>
+      <div class="cv-world">
+        <Edges />
+        {#each cv.flow.nodes as n (n.id)}
+          <Node {n} />
+        {/each}
+        {#if resultNode}
+          <!-- svelte-ignore a11y_no_static_element_interactions -->
+          <div
+            class="cv-result"
+            style:left="{resultNode.x + (cv.sizes[resultNode.id]?.w || 296) + 72}px"
+            style:top="{resultNode.y + PORT_Y - 19}px"
+            onpointerdown={stop}
+          >
+            <span class="cv-port in"></span>
+            <i></i>
+            {#if cv.result.urls.length}
+              {#each cv.result.urls.slice(0, 3) as url}
+                <a href={url} target="_blank" rel="noopener noreferrer" title="Open {url}">{url.replace(/^https?:\/\//, '')}<Icon name={ICONS.out} /></a>
+              {/each}
+            {:else}
+              <a href={cv.result.href} target="_blank">Open in Coolify</a>
+            {/if}
+            <button class="cv-x" title="Hide" onclick={hideResult}><Icon name={ICONS.x} /></button>
+          </div>
+        {/if}
+      </div>
+    </div>
+    <RunPanel />
+    {#if cv.menu}
+      <div class="cv-menu" style:left="{cv.menu.left}px" style:top="{cv.menu.top}px">
+        <h5>Add the next step</h5>
+        {#each cv.menu.valid as type}
+          <PaletteItem {type} onpick={() => pickNext(type)} />
+        {/each}
+      </div>
+    {/if}
+    {#if cv.toast}
+      <div class="cv-toast" class:bad={cv.toast.bad}>{cv.toast.text}</div>
+    {/if}
+  </section>
+
+  <!-- Bottom left of the whole canvas, below the Steps panel. -->
+  <CanvasControls zoom={cv.view.z} onzoom={z => els.pz.zoomTo(z)} onfit={fit} children={desktop ? header : null} />
+
+  {#if cv.dropdown}
+    {#key cv.dropdown?.trigger}
+      <Dropdown />
+    {/key}
+  {/if}
+</div>
diff --git a/resources/js/canvas/deploy/Dropdown.svelte b/resources/js/canvas/deploy/Dropdown.svelte
new file mode 100644
index 0000000000..8806ded1a5
--- /dev/null
+++ b/resources/js/canvas/deploy/Dropdown.svelte
@@ -0,0 +1,137 @@
+<script>
+  import { onMount } from 'svelte';
+  import { ICONS } from '../../deploy-canvas.js';
+  import Icon from './Icon.svelte';
+  import { closeDropdown, cv, toast } from './state.svelte.js';
+
+  // Our dropdown panel: a searchable list under its trigger, and an optional
+  // "New …" row. Mounted again for each trigger (see DeployCanvas.svelte).
+  const { trigger, items, current, onPick, add } = cv.dropdown;
+
+  let panel;
+  let search = $state();
+  let listBox;
+  let addInput = $state();
+  let query = $state('');
+  let active = $state(Math.max(0, items.findIndex(([v]) => v === current)));
+  // The "New …" row: a click shows a name field; Enter creates it.
+  let adding = $state(false);
+  let name = $state('');
+  let busy = $state(false);
+  let problem = $state('');
+
+  const q = $derived(query.trim().toLowerCase());
+  const shown = $derived(items.filter(([, text]) => !q || String(text).toLowerCase().includes(q)));
+  const activeIndex = $derived(Math.min(active, Math.max(0, shown.length - 1)));
+
+  function pick(value) {
+    closeDropdown();
+    onPick(value);
+  }
+  function keys(e) {
+    if (e.key === 'Escape') {
+      e.preventDefault();
+      closeDropdown();
+      trigger.focus();
+    } else if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
+      e.preventDefault();
+      active = (activeIndex + (e.key === 'ArrowDown' ? 1 : -1) + shown.length) % Math.max(1, shown.length);
+    } else if (e.key === 'Enter' && shown[activeIndex]) {
+      e.preventDefault();
+      pick(shown[activeIndex][0]);
+    }
+  }
+  function startAdding() {
+    name = query.trim();
+    adding = true;
+  }
+  async function submit(e) {
+    e.preventDefault();
+    const typed = name.trim();
+    if (!typed || busy) return;
+    busy = true;
+    try {
+      const created = await add.create(typed);
+      closeDropdown();
+      add.done(created);
+      toast(`"${typed}" added.`);
+    } catch (error) {
+      problem = error.message;
+      busy = false;
+      addInput?.focus();
+    }
+  }
+
+  // Keep the active option in view.
+  $effect(() => {
+    shown;
+    listBox.children[activeIndex]?.scrollIntoView({ block: 'nearest' });
+  });
+  $effect(() => {
+    if (adding) addInput?.focus();
+  });
+
+  onMount(() => {
+    // Under the trigger (or above it when there is no room), as wide as it.
+    const r = trigger.getBoundingClientRect();
+    const width = Math.max(r.width, 200);
+    const below = innerHeight - r.bottom - 12;
+    panel.style.width = `${width}px`;
+    panel.style.left = `${Math.min(r.left, innerWidth - width - 12)}px`;
+    if (below < Math.min(panel.offsetHeight, 260) && r.top > below) panel.style.bottom = `${innerHeight - r.top + 6}px`;
+    else panel.style.top = `${r.bottom + 6}px`;
+    (search || listBox.children[activeIndex] || panel).focus?.();
+    const outside = e => {
+      if (!panel.contains(e.target) && e.target !== trigger && !trigger.contains(e.target)) closeDropdown();
+    };
+    addEventListener('pointerdown', outside, true);
+    return () => removeEventListener('pointerdown', outside, true);
+  });
+</script>
+
+<div class="cv-dd" role="listbox" tabindex="-1" bind:this={panel} onkeydown={keys}>
+  {#if items.length > 8}
+    <input class="cv-dd-search" placeholder="Search" spellcheck="false" bind:this={search} bind:value={query} oninput={() => (active = 0)} />
+  {/if}
+  <div class="cv-dd-list" bind:this={listBox}>
+    {#each shown as [value, text, badge], i}
+      <button
+        type="button"
+        role="option"
+        aria-selected={value === current}
+        class="cv-dd-opt"
+        class:on={value === current}
+        class:active={i === activeIndex}
+        onpointerenter={() => (active = i)}
+        onclick={() => pick(value)}
+      >
+        <span>{text}</span>
+        {#if badge}<em class="cv-badge">{badge}</em>{/if}
+        <Icon name={ICONS.check} />
+      </button>
+    {:else}
+      <p class="cv-dd-none">{q ? 'No match' : 'None yet'}</p>
+    {/each}
+  </div>
+  {#if add}
+    <div class="cv-dd-add">
+      {#if adding}
+        <form class="cv-dd-form" onsubmit={submit}>
+          <!-- Enter submits the form, not the list's "pick the active option". -->
+          <input
+            class="cv-dd-search"
+            placeholder={add.placeholder}
+            spellcheck="false"
+            bind:this={addInput}
+            bind:value={name}
+            onkeydown={e => { if (e.key !== 'Escape') e.stopPropagation(); }}
+          />
+          <button type="submit" class="button button-highlighted" disabled={busy}>Add</button>
+        </form>
+        <p class="cv-note bad">{problem}</p>
+      {:else}
+        <button type="button" class="cv-dd-opt cv-dd-new" onclick={startAdding}><Icon name={ICONS.plus} /><span>{add.label}</span></button>
+      {/if}
+    </div>
+  {/if}
+</div>
diff --git a/resources/js/canvas/deploy/Edges.svelte b/resources/js/canvas/deploy/Edges.svelte
new file mode 100644
index 0000000000..8eac07e5f6
--- /dev/null
+++ b/resources/js/canvas/deploy/Edges.svelte
@@ -0,0 +1,48 @@
+<script>
+  import { nodeById, planOf } from '../../deploy-canvas.js';
+  import { curve, cv, inPoint, outPoint, removeEdge } from './state.svelte.js';
+
+  // The lines: connections (click one to remove it), every resource line into
+  // Deploy, the result pill's line, and the line being dragged.
+  const lines = $derived.by(() => {
+    const flow = cv.flow;
+    const runState = cv.runState;
+    const out = [];
+    for (const edge of flow.edges) {
+      const a = nodeById(edge.from, flow);
+      const b = nodeById(edge.to, flow);
+      if (!a || !b) continue;
+      const st = runState[edge.to]?.state;
+      const cls = st === 'running' ? 'flow' : runState[edge.from]?.state === 'done' && st ? 'live' : null;
+      // Start's connection to the first Server cannot be removed.
+      const removable = !(edge.from === 'start' && edge.to === 'server');
+      out.push({ d: curve(outPoint(a), inPoint(b)), cls, edge: removable ? edge : null });
+    }
+    const plan = planOf(flow);
+    const st = plan.deploy && runState[plan.deploy.id]?.state;
+    for (const { end } of plan.lines) {
+      out.push({ d: curve(outPoint(end), inPoint(plan.deploy)), cls: st === 'running' ? 'flow' : st === 'done' ? 'live' : null, edge: null });
+    }
+    const after = cv.result && nodeById(cv.result.after, flow);
+    if (after) {
+      const a = outPoint(after);
+      out.push({ d: curve(a, { x: a.x + 72, y: a.y }), cls: 'live', edge: null });
+    }
+    return out;
+  });
+  const dragged = $derived(cv.temp ?? cv.pendingLine);
+</script>
+
+<svg class="cv-edges">
+  {#each lines as line}
+    {#if line.edge}
+      <!-- Pointer only, like the rest of the canvas. -->
+      <!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+      <path class="hit" d={line.d} onclick={() => removeEdge(line.edge)}><title>Click to remove this connection</title></path>
+    {/if}
+    <path class={line.cls} d={line.d} />
+  {/each}
+  {#if dragged}
+    <path class="temp" d={curve(dragged.a, dragged.b)} />
+  {/if}
+</svg>
diff --git a/resources/js/canvas/deploy/Field.svelte b/resources/js/canvas/deploy/Field.svelte
new file mode 100644
index 0000000000..293457c860
--- /dev/null
+++ b/resources/js/canvas/deploy/Field.svelte
@@ -0,0 +1,105 @@
+<script>
+  import { ICONS, lists, loaderKey } from '../../deploy-canvas.js';
+  import Icon from './Icon.svelte';
+  import { cv, openDropdown, setField } from './state.svelte.js';
+
+  // One field of a card: a note, segmented buttons, our dropdown, or a text input.
+  let { n, f } = $props();
+  let trigger = $state();
+
+  const stop = e => e.stopPropagation();
+  const set = value => setField(n, f, value);
+
+  // Select options: null while loading; undefined / '' when the field above is empty.
+  const list = $derived.by(() => {
+    cv.listsVersion;
+    return f.kind === 'select' ? (f.load ? f.load(n.data) : f.options) : null;
+  });
+  const error = $derived.by(() => {
+    cv.listsVersion;
+    return f.load ? lists.errors[loaderKey(f, n.data)] : null;
+  });
+  const value = $derived(n.data[f.key] ?? '');
+  // An optional field's default ("Default") is a real choice, not a placeholder.
+  const chosen = $derived((list || []).find(([v]) => v === value) || (list && f.optional && !value ? ['', f.optional] : null));
+  const placeholder = $derived(list ? (f.optional || `Choose ${f.label.toLowerCase()}`) : list === null ? 'Loading…' : 'Pick the field above first');
+  // `add`: a "New …" row at the end of the list creates one and selects it.
+  const add = $derived(f.add && cv.canAdd ? {
+    ...f.add,
+    create: name => f.add.create(name, n.data),
+    // Load the list again (it has the new one), then select it.
+    done: picked => {
+      delete lists.cache[f.add.list(n.data)];
+      cv.listsVersion++;
+      set(picked);
+    },
+  } : null);
+
+  function open() {
+    openDropdown(trigger, [...(f.optional ? [['', f.optional]] : []), ...(list || [])], value, set, add);
+  }
+  function keys(e) {
+    if (e.key === 'ArrowDown' || e.key === 'Enter' || e.key === ' ') {
+      e.preventDefault();
+      trigger.click();
+    }
+  }
+</script>
+
+{#if f.kind === 'note'}
+  <p class="cv-note">{f.text}</p>
+{:else}
+  <div class="cv-field">
+    <!-- svelte-ignore a11y_label_has_associated_control -->
+    <label>{f.label}{#if f.required}<em>{' *'}</em>{/if}</label>
+    {#if f.kind === 'segmented'}
+      <div class="cv-seg">
+        {#each f.options as [option, text]}
+          <button type="button" class={(n.data[f.key] ?? f.value) === option ? 'on' : ''} onclick={() => set(option)} onpointerdown={stop}>{text}</button>
+        {/each}
+      </div>
+    {:else if f.kind === 'select'}
+      <button
+        bind:this={trigger}
+        type="button"
+        class="cv-input cv-select"
+        class:empty={!chosen}
+        class:open={!!trigger && cv.dropdown?.trigger === trigger}
+        disabled={!list}
+        aria-haspopup="listbox"
+        onpointerdown={stop}
+        onclick={open}
+        onkeydown={keys}
+      >
+        <span>{chosen ? chosen[1] : placeholder}</span>
+        {#if chosen?.[2]}<em class="cv-badge">{chosen[2]}</em>{/if}
+        <Icon name={ICONS.chevron} />
+      </button>
+      {#if error}<span class="cv-note bad">{error}</span>{/if}
+    {:else if f.kind === 'textarea'}
+      <textarea
+        class="cv-input"
+        class:mono={f.mono}
+        rows={f.rows || 3}
+        placeholder={f.placeholder || ''}
+        spellcheck="false"
+        value={n.data[f.key] ?? ''}
+        oninput={e => set(e.currentTarget.value)}
+        onpointerdown={stop}
+        onkeydown={stop}
+      ></textarea>
+    {:else}
+      <input
+        type="text"
+        class="cv-input"
+        class:mono={f.mono}
+        placeholder={f.placeholder || ''}
+        spellcheck="false"
+        value={n.data[f.key] ?? ''}
+        oninput={e => set(e.currentTarget.value)}
+        onpointerdown={stop}
+        onkeydown={stop}
+      />
+    {/if}
+  </div>
+{/if}
diff --git a/resources/js/canvas/deploy/Icon.svelte b/resources/js/canvas/deploy/Icon.svelte
new file mode 100644
index 0000000000..f81085b6da
--- /dev/null
+++ b/resources/js/canvas/deploy/Icon.svelte
@@ -0,0 +1,25 @@
+<script>
+  import { LOCAL_ICONS } from '../../deploy-canvas.js';
+
+  // The app's reicon glyphs (rendered by the page into [data-deploy-canvas-icons]),
+  // or a few local paths in the same style. The svg is the direct child that the
+  // canvas CSS expects.
+  let { name, cls = '' } = $props();
+
+  const glyph = $derived.by(() => {
+    const node = document.querySelector('[data-deploy-canvas-icons]')?.content?.querySelector(`[data-icon="${name}"]`)?.cloneNode(true);
+    if (!node) return null;
+    if (cls) node.setAttribute('class', cls);
+    else node.removeAttribute('class');
+    node.setAttribute('aria-hidden', 'true');
+    return node.outerHTML;
+  });
+</script>
+
+{#if glyph}
+  {@html glyph}
+{:else}
+  <svg class={cls || undefined} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+    {#each LOCAL_ICONS[name] ?? [] as d}<path {d} />{/each}
+  </svg>
+{/if}
diff --git a/resources/js/canvas/deploy/Node.svelte b/resources/js/canvas/deploy/Node.svelte
new file mode 100644
index 0000000000..b6f36e6965
--- /dev/null
+++ b/resources/js/canvas/deploy/Node.svelte
@@ -0,0 +1,104 @@
+<script>
+  import { ICONS, logoOf, nextOf, onlyOption, planOf, prevOf, resourceLabel, sourceAbove, TYPES } from '../../deploy-canvas.js';
+  import Field from './Field.svelte';
+  import Icon from './Icon.svelte';
+  import { cv, dragNode, removeNode, runFlow, startConnect, track } from './state.svelte.js';
+
+  // A step card: header (drag handle), fields, ports, and its run status.
+  let { n } = $props();
+
+  const stop = e => e.stopPropagation();
+  const t = $derived(TYPES[n.type]);
+  const st = $derived(cv.runState[n.id]);
+  const plan = $derived(planOf(cv.flow));
+  // The logo of what the step creates (engine, template, build); a logo that fails to load
+  // shows its fallback, then the step's glyph.
+  const logo = $derived(logoOf(n));
+  let broken = $state({});
+  const logoSrc = $derived(logo && (broken[logo.src] ? logo.fallback : logo.src));
+  const fields = $derived(t.fields.filter(f => !f.show || f.show(n.data)));
+  // Start, Deploy and the first Server stay.
+  const removable = $derived(n.type !== 'start' && n.type !== 'deploy' && n.id !== 'server');
+  const hasOut = $derived(!!nextOf(n.id, cv.flow) || plan.lines.some(l => l.end.id === n.id));
+  const hasIn = $derived(!!prevOf(n.id, cv.flow) || (n.type === 'deploy' && plan.lines.length > 0));
+  // Blank canvas: the Server ring pulses and a dashed trail shows where to drag it.
+  const blank = $derived(n.id === 'server' && cv.flow.nodes.every(x => ['start', 'server', 'deploy'].includes(x.type)));
+
+  // A select with `only: true` takes its option when it has exactly one.
+  $effect(() => {
+    cv.listsVersion;
+    for (const f of fields) {
+      if (f.kind !== 'select' || !f.only) continue;
+      const only = onlyOption(f.load ? f.load(n.data) : f.options, n.data[f.key]);
+      if (only && only !== n.data[f.key]) n.data[f.key] = only;
+    }
+  });
+</script>
+
+<div
+  class="cv-node"
+  class:start={n.type === 'start'}
+  class:running={st?.state === 'running'}
+  class:done={st?.state === 'done'}
+  class:failed={st?.state === 'failed'}
+  class:invalid={cv.invalid[n.id]}
+  class:drop-ok={cv.dropTarget === n.id}
+  class:has-out={hasOut}
+  class:has-in={hasIn}
+  class:blank
+  data-id={n.id}
+  style:left="{n.x}px"
+  style:top="{n.y}px"
+  use:track={n.id}
+>
+  <!-- svelte-ignore a11y_no_static_element_interactions -->
+  <div class="cv-node-head" onpointerdown={e => dragNode(n, e)}>
+    <i class:cv-logo={logoSrc && !broken[logoSrc]} class:padded={logo?.padded}>
+      {#if logoSrc && !broken[logoSrc]}
+        <img class:cv-light={logo.dark} alt="" src={logoSrc} onerror={() => (broken[logoSrc] = true)} />
+        {#if logo.dark}<img class="cv-dark-only" alt="" src={logo.dark} />{/if}
+      {:else}
+        <Icon name={t.icon} />
+      {/if}
+    </i>
+    <div><b>{t.title}</b><small>{t.sub}</small></div>
+    {#if removable}
+      <button class="cv-x" title="Remove step" onpointerdown={stop} onclick={() => removeNode(n.id)}><Icon name={ICONS.x} /></button>
+    {/if}
+  </div>
+  <div class="cv-node-body">
+    {#each fields as f (f)}
+      <Field {n} {f} />
+    {/each}
+    {#if n.type === 'deploy'}
+      {#if !plan.lines.length}
+        <p class="cv-note">Every resource you connect to a Server shows here.</p>
+      {/if}
+      {#each plan.lines as { source } (source.id)}
+        <!-- svelte-ignore a11y_label_has_associated_control -->
+        <div class="cv-field"><label>{resourceLabel(source)}</label></div>
+      {/each}
+      <!-- Save only creates the resources in Coolify; Deploy also starts them. -->
+      <div class="cv-actions">
+        <button type="button" class="button cv-deploy-now" disabled={!!cv.running} title="Create the resources in Coolify without starting them" onpointerdown={stop} onclick={() => runFlow('save')}>
+          <span>{cv.running === 'save' ? 'Working…' : 'Save only'}</span>
+        </button>
+        <button type="button" class="button button-highlighted cv-deploy-now" disabled={!!cv.running} title="Create the resources and deploy them" onpointerdown={stop} onclick={() => runFlow('deploy')}>
+          <Icon name={ICONS.deploy} /><span>{cv.running === 'deploy' ? 'Working…' : 'Deploy'}</span>
+        </button>
+      </div>
+    {/if}
+    {#if t.stage === 'config' && !sourceAbove(n.id, cv.flow)}
+      <p class="cv-note">Connect it after a source step.</p>
+    {/if}
+  </div>
+  {#if n.type !== 'start'}<span class="cv-port in"></span>{/if}
+  {#if st?.message}<div class="cv-status {st.state}">{st.message}</div>{/if}
+  {#if n.type !== 'deploy'}
+    <!-- svelte-ignore a11y_no_static_element_interactions -->
+    <span class="cv-port out" class:armed={cv.armed === n.id} title="Drag to connect the next step" onpointerdown={e => startConnect(n, e)}></span>
+  {/if}
+  {#if blank}
+    <div class="cv-hint"><span>Drag and drop to add a step</span></div>
+  {/if}
+</div>
diff --git a/resources/js/canvas/deploy/PaletteItem.svelte b/resources/js/canvas/deploy/PaletteItem.svelte
new file mode 100644
index 0000000000..f7928cfb04
--- /dev/null
+++ b/resources/js/canvas/deploy/PaletteItem.svelte
@@ -0,0 +1,21 @@
+<script>
+  import { TYPES } from '../../deploy-canvas.js';
+  import Icon from './Icon.svelte';
+  import { dragFromPalette } from './state.svelte.js';
+
+  // A step in the palette (drag it, or click to add it to the chain), or in
+  // the "Add the next step" menu (onpick).
+  let { type, onpick = null } = $props();
+  const t = $derived(TYPES[type]);
+</script>
+
+<button
+  type="button"
+  class="cv-item"
+  title="{t.title} — {t.sub}"
+  onclick={onpick}
+  onpointerdown={onpick ? null : e => dragFromPalette(type, e)}
+>
+  <i><Icon name={t.icon} /></i>
+  <span><b>{t.title}</b><small>{t.sub}</small></span>
+</button>
diff --git a/resources/js/canvas/deploy/RunPanel.svelte b/resources/js/canvas/deploy/RunPanel.svelte
new file mode 100644
index 0000000000..77d5fc249e
--- /dev/null
+++ b/resources/js/canvas/deploy/RunPanel.svelte
@@ -0,0 +1,48 @@
+<script>
+  import { ICONS } from '../../deploy-canvas.js';
+  import Icon from './Icon.svelte';
+  import { cv, showPane } from './state.svelte.js';
+
+  // Run panel: an island with the steps as status lights, then the logs
+  // ("Steps", and a tab per deployed resource).
+  const r = $derived(cv.run);
+  // "Docker image · nginx #2" → "nginx #2"; the full name is the tooltip.
+  const short = label => (label.includes(' · ') ? label.slice(label.indexOf(' · ') + 3) : label);
+</script>
+
+<aside class="cv-run" hidden={!r.open}>
+  <header>
+    <div><b>{r.title}</b><span>{r.sub}</span></div>
+    <button class="cv-x" title="Close" onclick={() => { if (!cv.running) r.open = false; }}><Icon name={ICONS.x} /></button>
+  </header>
+  <div class="cv-steps">
+    {#each r.steps as step (step.id)}
+      <div class="cv-step {step.state}" data-id={step.id}>
+        <i></i>
+        <div><span>{step.label}</span><small>{step.message}</small></div>
+      </div>
+    {/each}
+  </div>
+  <div class="cv-seg cv-tabs" role="tablist" hidden={r.panes.length < 2}>
+    {#each r.panes as pane (pane.key)}
+      <button
+        type="button"
+        role="tab"
+        class:on={r.active === pane.key}
+        aria-selected={r.active === pane.key}
+        title="{pane.label}{pane.status ? `: ${pane.status}` : ''}"
+        onclick={() => showPane(pane.key)}
+      >
+        <i class={pane.state}></i><span>{short(pane.label)}</span>
+      </button>
+    {/each}
+  </div>
+  <div class="cv-logs-wrap">
+    {#each r.panes as pane (pane.key)}
+      <pre class="cv-logs" data-key={pane.key} hidden={r.active !== pane.key}>{#each pane.lines as line}<span class={line.cls}>{`${line.text}\n`}</span>{/each}</pre>
+    {/each}
+  </div>
+  <footer>
+    <a class="button" target="_blank" href={r.openHref || undefined} hidden={!r.showOpen}>Open</a>
+  </footer>
+</aside>
diff --git a/resources/js/canvas/deploy/index.js b/resources/js/canvas/deploy/index.js
new file mode 100644
index 0000000000..876d4487fd
--- /dev/null
+++ b/resources/js/canvas/deploy/index.js
@@ -0,0 +1,18 @@
+// Deploy canvas (Svelte): mounted on the /canvas page into [data-deploy-canvas],
+// on the first load and after Livewire SPA navigation.
+
+import { mount, unmount } from 'svelte';
+import { mountOnPage } from '../../canvas-core.js';
+import DeployCanvas from './DeployCanvas.svelte';
+import { init } from './state.svelte.js';
+import { injectStyles } from './styles.js';
+
+export function initializeDeployCanvas() {
+  mountOnPage('[data-deploy-canvas]', '.cv-root', container => {
+    injectStyles();
+    init(container);
+    container.replaceChildren();
+    const app = mount(DeployCanvas, { target: container });
+    return { root: container.querySelector('.cv-root'), unmount: () => unmount(app) };
+  });
+}
diff --git a/resources/js/canvas/deploy/state.svelte.js b/resources/js/canvas/deploy/state.svelte.js
new file mode 100644
index 0000000000..2cfb6c3c24
--- /dev/null
+++ b/resources/js/canvas/deploy/state.svelte.js
@@ -0,0 +1,608 @@
+// Deploy canvas runtime: the state of the open canvas, what the steps do to
+// it (add, connect, run…), and the Svelte actions around the imperative
+// helpers of canvas-core.js (pan/zoom, top bar placement, card sizes).
+
+import { flushSync, tick } from 'svelte';
+import { api, freeSpot, MIN_ZOOM, panZoom } from '../../canvas-core.js';
+import {
+  canFollow, defaults, domainList, fresh, LOG_POLL_MS, lists, load, multiOut, nextOf, nodeById, outsOf, planOf,
+  resourceHref, save, sleep, targetFrom, TYPES, uid, uniqueLabels, withDeploy, withoutSecrets, withTarget,
+} from '../../deploy-canvas.js';
+
+export const PORT_Y = 26; // header centre (3.25rem / 2)
+const CARD_W = 296;
+
+const emptyRun = () => ({ open: false, title: 'Deploy', sub: '', steps: [], panes: [], active: null, defaultHref: '', openHref: '', showOpen: false });
+
+export const cv = $state({
+  canAdd: false, // may create projects and environments (from the page)
+  target: null, // the environment that opened the canvas
+  flow: fresh(),
+  view: { x: 40, y: 40, z: 1 },
+  runState: {}, // node id -> { state: running|done|failed, message }
+  invalid: {}, // node id -> true: a required field is empty
+  // The last successful run's addresses, shown as a pill after Deploy.
+  result: null, // { after: node id, urls: [], href }
+  running: false, // false, 'save' or 'deploy'
+  sizes: {}, // node id -> { w, h } of its card
+  listsVersion: 0, // bumped when an option list loads
+  menu: null, // the "Add the next step" menu: { prev, valid, p, left, top }
+  pendingLine: null, // the dragged line, kept while its menu is open
+  temp: null, // the line being dragged from a port
+  armed: null, // node id of the port being dragged
+  dropTarget: null, // node id the dragged line would connect to
+  toast: null, // { text, bad }
+  dropdown: null, // { trigger, items, current, onPick, add }
+  run: emptyRun(), // the run panel
+});
+
+// DOM of the open canvas (set by the actions below); mount counts the
+// canvases, so a run of an earlier one stops writing here.
+export const els = { root: null, stage: null, viewport: null, pz: null, nodeEls: new Map(), mount: 0, fitOnOpen: false };
+
+lists.onChange = () => { cv.listsVersion++; };
+
+export function init(container) {
+  els.mount++;
+  els.nodeEls.clear();
+  cv.canAdd = container.dataset.canAdd === '1';
+  if (load('deployed', false)) {
+    save('flow', null);
+    save('result', null);
+    save('deployed', false);
+  }
+  cv.target = targetFrom(location.search);
+  cv.flow = withTarget(withDeploy(load('flow', null) || fresh()), cv.target);
+  save('flow', withoutSecrets(cv.flow)); // drops secrets that older versions stored
+  // Small screens: the default view is made for desktop, so the first visit fits the steps instead.
+  els.fitOnOpen = !load('view', null) && !matchMedia('(min-width: 768px)').matches;
+  cv.view = load('view', { x: 40, y: 40, z: 1 });
+  cv.result = load('result', null);
+  Object.assign(cv, { runState: {}, invalid: {}, running: false, sizes: {}, menu: null, pendingLine: null, temp: null, armed: null, dropTarget: null, toast: null, dropdown: null, run: emptyRun() });
+}
+
+/** The canvas left the page: its runs stop. */
+export function leave() {
+  els.mount++;
+}
+
+// ── Actions ────────────────────────────────────────────────────────────
+
+/** use:pan on the viewport: wheel and pinch zoom, drag to pan. */
+export function pan(viewport) {
+  const world = viewport.querySelector('.cv-world');
+  const edges = viewport.querySelector('.cv-edges');
+  els.viewport = viewport;
+  els.stage = viewport.parentElement;
+  els.root = viewport.closest('.cv-root');
+  els.pz = panZoom({
+    root: els.root,
+    viewport,
+    world,
+    zoomLabel: {}, // CanvasControls shows cv.view.z
+    getView: () => cv.view,
+    onChange: closeDropdown,
+    canPan: e => [viewport, world, edges].includes(e.target),
+    onPanStart: closeMenu,
+  });
+  // The root paints the dots, so move them with the viewport when the Steps panel folds or the window resizes.
+  const sizes = new ResizeObserver(() => els.pz.apply());
+  sizes.observe(viewport);
+  return { destroy: () => sizes.disconnect() };
+}
+
+/** use:track on a card: its element (for measuring) and its size (for the lines). */
+export function track(node, id) {
+  els.nodeEls.set(id, node);
+  const measure = () => { cv.sizes[id] = { w: node.offsetWidth, h: node.offsetHeight }; };
+  measure();
+  const observer = new ResizeObserver(measure);
+  observer.observe(node);
+  return {
+    destroy() {
+      observer.disconnect();
+      if (els.nodeEls.get(id) === node) els.nodeEls.delete(id);
+      delete cv.sizes[id];
+    },
+  };
+}
+
+// ── Canvas: geometry, fit ──────────────────────────────────────────────
+// Port positions in world coordinates.
+export const outPoint = n => ({ x: n.x + (cv.sizes[n.id]?.w || CARD_W), y: n.y + PORT_Y });
+export const inPoint = n => ({ x: n.x, y: n.y + PORT_Y });
+export const curve = (a, b) => {
+  const dx = Math.max(40, Math.abs(b.x - a.x) / 2);
+  return `M ${a.x} ${a.y} C ${a.x + dx} ${a.y}, ${b.x - dx} ${b.y}, ${b.x} ${b.y}`;
+};
+const toWorld = (cx, cy) => els.pz.toWorld(cx, cy);
+const width = n => els.nodeEls.get(n.id)?.offsetWidth || CARD_W;
+const height = n => els.nodeEls.get(n.id)?.offsetHeight || 160;
+// A card's box in world units (its rendered size, or a usual card size).
+const boxOf = n => ({ x: n.x, y: n.y, w: width(n), h: height(n) });
+
+export function fit() {
+  if (!els.nodeEls.size) return;
+  let minX = Infinity; let minY = Infinity; let maxX = -Infinity; let maxY = -Infinity;
+  for (const n of cv.flow.nodes) {
+    const node = els.nodeEls.get(n.id);
+    minX = Math.min(minX, n.x);
+    minY = Math.min(minY, n.y);
+    maxX = Math.max(maxX, n.x + (node?.offsetWidth || 280));
+    maxY = Math.max(maxY, n.y + (node?.offsetHeight || 120));
+  }
+  const pill = els.root.querySelector('.cv-result');
+  if (pill) {
+    maxX = Math.max(maxX, pill.offsetLeft + pill.offsetWidth);
+    maxY = Math.max(maxY, pill.offsetTop + pill.offsetHeight);
+  }
+  const r = els.viewport.getBoundingClientRect();
+  const pad = 60;
+  const view = cv.view;
+  view.z = Math.min(1.2, Math.max(MIN_ZOOM, Math.min((r.width - pad * 2) / (maxX - minX), (r.height - pad * 2) / (maxY - minY))));
+  view.x = (r.width - (maxX - minX) * view.z) / 2 - minX * view.z;
+  view.y = (r.height - (maxY - minY) * view.z) / 2 - minY * view.z;
+  els.pz.apply();
+}
+
+// ── Toast, menus, dropdown ─────────────────────────────────────────────
+let toastTimer = 0;
+export function toast(text, bad = false) {
+  cv.toast = { text, bad };
+  clearTimeout(toastTimer);
+  toastTimer = setTimeout(() => { cv.toast = null; }, bad ? 4200 : 2600);
+}
+
+export function closeMenu() {
+  cv.menu = null;
+  cv.pendingLine = null;
+}
+// Close an older menu but keep the line being dropped.
+function openNextMenu(prev, cx, cy, p) {
+  cv.menu = null;
+  const valid = Object.keys(TYPES).filter(type => canFollow(prev, type, null, cv.flow));
+  if (!valid.length) return toast('Nothing can follow this step.', true);
+  const r = els.stage.getBoundingClientRect();
+  cv.menu = { prev: prev.id, valid, p, left: Math.min(cx - r.left, r.width - 220), top: Math.min(cy - r.top, r.height - 40 * valid.length - 40) };
+}
+export function pickNext(type) {
+  const { prev, p } = cv.menu;
+  closeMenu();
+  const n = addNode(type, p.x + 8, p.y - PORT_Y, true);
+  connect(prev, n.id);
+}
+
+// Our dropdown panel (fixed in the canvas root, so zoom never shrinks it).
+export function closeDropdown() {
+  cv.dropdown = null;
+}
+export function openDropdown(trigger, items, current, onPick, add = null) {
+  if (cv.dropdown?.trigger === trigger) return closeDropdown();
+  cv.dropdown = { trigger, items, current, onPick, add };
+}
+
+// ── Flow edits ─────────────────────────────────────────────────────────
+// A structural change redraws the cards, which clears their invalid marks.
+const redraw = () => { cv.invalid = {}; };
+
+export function connect(from, to) {
+  const a = nodeById(from, cv.flow);
+  cv.flow.edges = cv.flow.edges.filter(e => !(e.from === from && e.to === to) && (multiOut(a) || e.from !== from) && e.to !== to);
+  cv.flow.edges.push({ from, to });
+  redraw();
+}
+export function removeEdge(edge) {
+  if (cv.running) return;
+  cv.flow.edges = cv.flow.edges.filter(e => e !== edge);
+  redraw();
+  toast('Connection removed.');
+}
+export function addNode(type, x, y, quiet) {
+  cv.flow.nodes.push({ id: uid(), type, x: Math.round(x), y: Math.round(y), data: defaults(type) });
+  const n = cv.flow.nodes.at(-1);
+  redraw();
+  flushSync(); // render the card, to measure it
+  settle(n);
+  if (!quiet) toast(`${TYPES[type].title} added. Connect it from the dot of the step before.`);
+  return n;
+}
+export function removeNode(id) {
+  if (cv.running) return;
+  cv.flow.nodes = cv.flow.nodes.filter(n => n.id !== id);
+  cv.flow.edges = cv.flow.edges.filter(e => e.from !== id && e.to !== id);
+  delete cv.runState[id];
+  redraw();
+}
+export function resetCanvas() {
+  if (cv.running) return;
+  cv.flow = withTarget(fresh(), cv.target);
+  cv.runState = {};
+  cv.result = null;
+  save('result', null);
+  save('deployed', false);
+  redraw();
+}
+export function hideResult() {
+  cv.result = null;
+  save('result', null);
+}
+// A field change. Fields loaded from the one changed (`rerender`) start empty again.
+export function setField(n, f, value) {
+  const fields = TYPES[n.type].fields;
+  n.data[f.key] = value;
+  f.after?.(n.data);
+  if (f.rerender) {
+    for (const other of fields) if (other.load && other !== f && other.key !== f.key && fields.indexOf(other) > fields.indexOf(f)) delete n.data[other.key];
+  }
+  delete cv.invalid[n.id];
+}
+
+// Move a card to the nearest spot where it does not cover another card.
+function settle(n) {
+  const spot = freeSpot(boxOf(n), cv.flow.nodes.filter(m => m !== n).map(boxOf));
+  if (!spot || (spot.x === n.x && spot.y === n.y)) return;
+  n.x = Math.round(spot.x);
+  n.y = Math.round(spot.y);
+}
+// Click on a step in the list: add it after the step it most likely follows.
+function appendToChain(type) {
+  const flow = cv.flow;
+  const plan = planOf(flow);
+  // The newest step in the tree this one can follow, with room for it.
+  const inTree = [plan.start, ...plan.servers, ...plan.lines.flatMap(l => [l.source, ...l.settings])];
+  const parent = inTree.reverse().find(n => canFollow(n, type, null, flow) && (multiOut(n) || !nextOf(n.id, flow)));
+  if (!parent) return addNode(type, ...centre());
+  const siblings = multiOut(parent) ? outsOf(parent.id, flow).map(id => nodeById(id, flow)).filter(Boolean) : [];
+  const y = siblings.length ? Math.max(...siblings.map(n => n.y + height(n))) + 40 : parent.y;
+  const n = addNode(type, parent.x + width(parent) + 80, y, true);
+  connect(parent.id, n.id);
+}
+function centre() {
+  const r = els.viewport.getBoundingClientRect();
+  const p = toWorld(r.left + r.width / 2, r.top + r.height / 2);
+  return [p.x - 140, p.y - 60];
+}
+
+// ── Pointer drags ──────────────────────────────────────────────────────
+
+/** A palette step: drag it to the canvas, or click to append it to the chain. */
+export function dragFromPalette(type, event) {
+  if (event.button !== 0) return;
+  const item = event.currentTarget;
+  const startX = event.clientX;
+  const startY = event.clientY;
+  let ghost = null;
+  const move = e => {
+    if (!ghost && Math.hypot(e.clientX - startX, e.clientY - startY) < 5) return;
+    if (!ghost) {
+      ghost = item.cloneNode(true);
+      Object.assign(ghost.style, { position: 'fixed', zIndex: 2147483001, width: `${item.offsetWidth}px`, pointerEvents: 'none', opacity: 0.9, background: 'var(--cv-ghost)', borderRadius: '8px', boxShadow: '0 8px 24px -8px rgb(0 0 0 / 0.35)' });
+      ghost.style.setProperty('--cv-ghost', 'light-dark(#fff, #222)');
+      els.root.append(ghost);
+    }
+    ghost.style.left = `${e.clientX - 20}px`;
+    ghost.style.top = `${e.clientY - 18}px`;
+  };
+  const stop = () => {
+    removeEventListener('pointermove', move);
+    removeEventListener('pointerup', up);
+    removeEventListener('pointercancel', cancel);
+  };
+  // Touch: a sideways swipe scrolls the step strip (small screens) and cancels the pointer.
+  const cancel = () => {
+    stop();
+    ghost?.remove();
+  };
+  const up = e => {
+    stop();
+    if (!ghost) return appendToChain(type);
+    ghost.remove();
+    const r = els.viewport.getBoundingClientRect();
+    if (e.clientX < r.left || e.clientX > r.right || e.clientY < r.top || e.clientY > r.bottom) return;
+    const p = toWorld(e.clientX, e.clientY);
+    addNode(type, p.x - 30, p.y - 16);
+  };
+  addEventListener('pointermove', move);
+  addEventListener('pointerup', up);
+  addEventListener('pointercancel', cancel);
+}
+
+/**
+ * Drag a card by its header. Pointer capture keeps the drag even when the
+ * pointer outruns the card.
+ */
+export function dragNode(n, event) {
+  if (event.button !== 0 || event.target.closest('button, input, select, textarea')) return;
+  const handle = event.currentTarget;
+  event.stopPropagation();
+  event.preventDefault();
+  closeMenu();
+  try { handle.setPointerCapture(event.pointerId); } catch { /* not capturable */ }
+  const ox = event.clientX / cv.view.z - n.x;
+  const oy = event.clientY / cv.view.z - n.y;
+  // The other cards stay put during the drag, so measure them once.
+  const others = cv.flow.nodes.filter(m => m !== n).map(boxOf);
+  const move = e => {
+    if (e.pointerId !== event.pointerId) return;
+    const wanted = { x: e.clientX / cv.view.z - ox, y: e.clientY / cv.view.z - oy, w: width(n), h: height(n) };
+    // Cards cannot cover each other: stop at the edge of a card in the way.
+    const spot = freeSpot(wanted, others);
+    if (!spot) return;
+    n.x = Math.round(spot.x);
+    n.y = Math.round(spot.y);
+  };
+  const up = e => {
+    if (e.pointerId !== event.pointerId) return;
+    removeEventListener('pointermove', move);
+    removeEventListener('pointerup', up);
+    removeEventListener('pointercancel', up);
+  };
+  addEventListener('pointermove', move);
+  addEventListener('pointerup', up);
+  addEventListener('pointercancel', up);
+}
+
+// Drag from an output port: drop on a node to connect, on empty space to pick.
+export function startConnect(n, event) {
+  event.stopPropagation();
+  event.preventDefault();
+  if (cv.running) return;
+  cv.armed = n.id;
+  const a = outPoint(n);
+  let target = null;
+  const move = e => {
+    cv.temp = { a, b: toWorld(e.clientX, e.clientY) };
+    const hit = document.elementFromPoint(e.clientX, e.clientY)?.closest?.('.cv-node');
+    const id = hit?.dataset.id;
+    const candidate = id && id !== n.id ? nodeById(id, cv.flow) : null;
+    target = candidate && canFollow(n, candidate.type, candidate, cv.flow) ? candidate : null;
+    cv.dropTarget = target?.id ?? null;
+  };
+  const up = e => {
+    removeEventListener('pointermove', move);
+    removeEventListener('pointerup', up);
+    cv.armed = null;
+    cv.temp = null;
+    cv.dropTarget = null;
+    if (target) return connect(n.id, target.id);
+    const over = document.elementFromPoint(e.clientX, e.clientY);
+    if (over?.closest?.('.cv-node')) return toast('That step cannot follow this one.', true);
+    const p = toWorld(e.clientX, e.clientY);
+    if (Math.hypot(p.x - a.x, p.y - a.y) < 12) return;
+    cv.pendingLine = { a, b: p };
+    openNextMenu(n, e.clientX, e.clientY, p);
+  };
+  addEventListener('pointermove', move);
+  addEventListener('pointerup', up);
+}
+
+// ── Run ────────────────────────────────────────────────────────────────
+// Log panes: "all" holds the steps; each deployment gets its own tab and pane.
+const paneOf = key => cv.run.panes.find(pane => pane.key === key);
+function openPane(key, label) {
+  if (!paneOf(key)) cv.run.panes.push({ key, label, href: '', state: '', status: '', lines: [] });
+  return paneOf(key);
+}
+export function showPane(key) {
+  const r = cv.run;
+  r.active = key;
+  const href = paneOf(key)?.href || r.defaultHref;
+  if (href) r.openHref = href;
+}
+function setPaneState(key, state, status) {
+  const pane = paneOf(key);
+  if (!pane) return;
+  pane.state = state;
+  pane.status = status;
+}
+function logLine(text, cls = '', key = 'all') {
+  const pane = paneOf(key) || paneOf('all');
+  const box = els.root?.querySelector(`.cv-logs[data-key="${pane.key}"]`);
+  const atEnd = !box || box.scrollTop + box.clientHeight >= box.scrollHeight - 30;
+  pane.lines.push({ text, cls });
+  if (box && atEnd) tick().then(() => { box.scrollTop = box.scrollHeight; });
+}
+function setStep(n, state, message) {
+  cv.runState[n.id] = { state, message };
+  delete cv.invalid[n.id];
+  const row = cv.run.steps.find(s => s.id === n.id);
+  if (row) {
+    row.state = state;
+    row.message = message || '';
+  }
+}
+
+function validate(plan) {
+  const problems = [];
+  if (!plan.servers.length) problems.push('Connect a Server right after Start.');
+  else if (!plan.lines.length) problems.push('Connect a source step (Git repository, Docker image, Dockerfile, Service or Database) to a Server.');
+  for (const n of [plan.start, ...new Set(plan.lines.map(l => l.server)), ...plan.lines.flatMap(l => [l.source, ...l.settings])]) {
+    const missing = TYPES[n.type].fields.filter(f => f.required && (!f.show || f.show(n.data)) && !String(n.data[f.key] ?? '').trim()).map(f => f.label);
+    if (missing.length) {
+      problems.push(`${TYPES[n.type].title}: fill in ${missing.join(', ')}.`);
+      cv.invalid[n.id] = true;
+    }
+  }
+  return problems;
+}
+
+export async function runFlow(action = 'deploy') {
+  if (cv.running) return;
+  closeMenu();
+  const plan = planOf(cv.flow);
+  const problems = validate(plan);
+  if (problems.length) {
+    toast(problems[0], true);
+    return;
+  }
+  cv.running = action;
+  cv.runState = {};
+  cv.result = null;
+  save('result', null);
+  save('deployed', false);
+  const servers = [...new Set(plan.lines.map(l => l.server))];
+  const list = [plan.start, ...servers, ...plan.lines.flatMap(l => [l.source, ...l.settings]), plan.deploy];
+  const names = uniqueLabels(plan.lines.map(l => l.source));
+  const labelOf = n => names.get(n.id) || TYPES[n.type].title;
+  const r = cv.run;
+  r.open = true;
+  r.title = action === 'save' ? 'Saving' : 'Deploying';
+  r.sub = `${plan.lines.length} resource${plan.lines.length === 1 ? '' : 's'}`;
+  r.panes = [];
+  r.active = null;
+  r.defaultHref = '';
+  openPane('all', 'Steps');
+  showPane('all');
+  r.showOpen = false;
+  r.steps = list.map(n => ({ id: n.id, label: labelOf(n), state: '', message: 'Waiting' }));
+  redraw();
+  // The page can be left (and the canvas mounted again) during a run.
+  const owner = els.mount;
+  const live = () => els.mount === owner;
+  // Run one step; false when it failed.
+  const step = async (n, work) => {
+    setStep(n, 'running', 'Running…');
+    try {
+      const message = await work();
+      if (!live()) return false;
+      setStep(n, 'done', message);
+      logLine(`✓ ${labelOf(n)}: ${message}`, 'dim');
+      return true;
+    } catch (error) {
+      if (!live()) return false;
+      setStep(n, 'failed', error.message);
+      logLine(`✗ ${labelOf(n)}: ${error.message}`, 'err');
+      return false;
+    }
+  };
+  const base = {};
+  let ok = await step(plan.start, () => TYPES.start.run(base, plan.start.data));
+  for (const server of servers) {
+    if (!ok) break;
+    ok = await step(server, async () => 'Server picked.');
+  }
+  const shipped = []; // { line, ctx, label } per created resource
+  for (const line of plan.lines) {
+    if (!ok) break;
+    const ctx = { ...base };
+    await TYPES.server.run(ctx, line.server.data);
+    const domainNode = line.settings.find(n => n.type === 'domain');
+    if (domainNode) ctx.domains = domainList(domainNode.data.domains);
+    for (const n of [line.source, ...line.settings]) {
+      ok = await step(n, () => TYPES[n.type].run(ctx, n.data));
+      if (!ok) break;
+    }
+    if (ctx.resource) shipped.push({ line, ctx, label: names.get(line.source.id) });
+  }
+  if (!live()) return;
+  const href = () => shipped.length === 1 ? resourceHref(shipped[0].ctx) : `/project/${base.project}/environment/${base.environment}`;
+  if (shipped.length) {
+    r.showOpen = true;
+    r.openHref = r.defaultHref = href();
+  }
+  if (ok) {
+    ok = await step(plan.deploy, async () => action === 'save'
+      ? `Saved ${shipped.length} resource${shipped.length === 1 ? '' : 's'}. Not deployed.`
+      : deployAll(shipped, live));
+  }
+  if (!live()) return;
+  if (shipped.length) r.defaultHref = href();
+  showPane(r.active);
+  if (ok) {
+    const urls = [];
+    for (const { ctx } of action === 'save' ? [] : shipped) {
+      let found = String(ctx.domains || ctx.createdDomains || '').split(',').map(v => v.trim()).filter(Boolean);
+      if (!found.length && ctx.resource.kind === 'application') {
+        try {
+          const app = await api('GET', `/applications/${ctx.resource.uuid}`);
+          found = String(app?.fqdn || '').split(',').map(v => v.trim()).filter(Boolean);
+        } catch { /* keep none */ }
+      }
+      urls.push(...found);
+    }
+    cv.result = { after: plan.deploy.id, urls, href: href() };
+    save('result', cv.result);
+    // The next visit starts with an empty canvas.
+    if (action === 'deploy') save('deployed', true);
+  }
+  r.title = ok ? 'Done' : 'Stopped';
+  r.sub = ok ? (action === 'save' ? 'Saved in Coolify. Deploy them from there or from here.' : 'Every step finished.') : 'A step failed. Fix it and try again.';
+  cv.running = false;
+}
+
+// Deploy every resource at once and follow them.
+async function deployAll(shipped, live) {
+  const many = shipped.length > 1;
+  // A tab per resource, in order; the first one opens.
+  for (const { line, ctx, label } of shipped) openPane(line.source.id, label).href = resourceHref(ctx);
+  if (shipped.length) showPane(shipped[0].line.source.id);
+  const results = await Promise.allSettled(shipped.map(async ({ line, ctx, label }) => {
+    const key = line.source.id;
+    setPaneState(key, 'running', 'Starting');
+    try {
+      const res = await api('POST', '/deploy', { uuid: ctx.resource.uuid });
+      if (!live()) return 'Left the canvas.';
+      const item = res?.deployments?.[0];
+      let message = item?.message || 'Started.';
+      if (item?.deployment_uuid) {
+        ctx.deployment = item.deployment_uuid;
+        paneOf(key).href = resourceHref(ctx);
+        if (cv.run.active === key) showPane(key);
+        message = await followDeployment(label, item.deployment_uuid, key, live);
+        if (!live()) return message;
+      } else {
+        logLine(message, '', key);
+      }
+      setPaneState(key, 'done', message);
+      logLine(`✓ ${label}: ${message}`, 'dim');
+      return `${label}: ${message}`;
+    } catch (error) {
+      if (live()) {
+        setPaneState(key, 'failed', error.message.replace(`${label}: `, ''));
+        logLine(error.message, 'err', key);
+      }
+      throw error;
+    }
+  }));
+  const failed = results.filter(res => res.status === 'rejected').map(res => res.reason.message);
+  if (failed.length) throw new Error(failed.join(' · '));
+  return many ? `${results.length} resources deployed.` : results[0].value;
+}
+
+// Poll the deployment (Coolify's own log view also polls every 2 s).
+// Logs go to the resource's own pane (key).
+async function followDeployment(label, deploymentUuid, key, live) {
+  logLine(`Deployment ${deploymentUuid}`, 'dim', key);
+  let shown = 0;
+  let warned = false;
+  for (;;) {
+    if (!live()) return 'Left the canvas.';
+    let dep;
+    try {
+      dep = await api('GET', `/deployments/${deploymentUuid}`);
+    } catch (error) {
+      if (!live()) return 'Left the canvas.';
+      logLine(`(could not read the deployment: ${error.message})`, 'err', key);
+      await sleep(LOG_POLL_MS * 2);
+      continue;
+    }
+    if (!live()) return 'Left the canvas.';
+    let entries = [];
+    if (typeof dep.logs === 'string') {
+      try { entries = JSON.parse(dep.logs) || []; } catch { entries = []; }
+    } else if (dep.logs === undefined && !warned) {
+      warned = true;
+      logLine('Logs are hidden: only team admins can see deployment logs.', 'err', key);
+    }
+    const visible = entries.filter(entry => !entry.hidden);
+    for (const entry of visible.slice(shown)) {
+      for (const line of String(entry.output ?? '').split('\n')) if (line.trim()) logLine(line, entry.type === 'stderr' ? 'err' : '', key);
+    }
+    shown = visible.length;
+    setPaneState(key, 'running', String(dep.status || '').replace(/_/g, ' '));
+    if (dep.status === 'finished') return 'Deployed.';
+    if (dep.status === 'failed') throw new Error(`${label}: deployment failed. See the logs.`);
+    if (dep.status === 'cancelled-by-user') throw new Error(`${label}: deployment cancelled.`);
+    await sleep(LOG_POLL_MS);
+  }
+}
diff --git a/resources/js/canvas/deploy/styles.js b/resources/js/canvas/deploy/styles.js
new file mode 100644
index 0000000000..869e76d236
--- /dev/null
+++ b/resources/js/canvas/deploy/styles.js
@@ -0,0 +1,327 @@
+// The deploy canvas look: islands on a backdrop. The colors are CSS variables
+// on .cv-root, so a custom color scheme can replace them. Injected once as a
+// <style> (outside the CSS build, which would rewrite light-dark()).
+const CSS = `
+  .cv-root {
+    /* The look of the environment canvas (environment-canvas.js): the app's
+       own color tokens (app.css), so custom color schemes apply too. */
+    --cv-island: light-dark(#ffffff, var(--color-panel));
+    --cv-backdrop: light-dark(#fafafa, var(--color-app));
+    --cv-card: light-dark(#ffffff, var(--color-raised));
+    --cv-popover: light-dark(#ffffff, var(--color-panel));
+    --cv-text: light-dark(#171717, var(--color-fg));
+    --cv-subtle: light-dark(#737373, var(--color-fg-faint));
+    --cv-placeholder: light-dark(#a3a3a3, var(--color-fg-faint));
+    /* The app's card border (app.css), as on the environment canvas cards. */
+    --cv-line: var(--coollabs-hairline, light-dark(#e5e5e5, rgb(255 255 255 / 0.08)));
+    --cv-input-bg: light-dark(#fafafa, rgb(255 255 255 / 0.04));
+    --cv-input-line: light-dark(#e5e5e5, rgb(255 255 255 / 0.08));
+    --cv-brand: light-dark(var(--color-coollabs), var(--color-warning));
+    --cv-brand-text: var(--cv-brand);
+    position: absolute; inset: 0; z-index: 10;
+    display: grid; grid-template-columns: 15.5rem minmax(0, 1fr); grid-template-rows: auto minmax(0, 1fr);
+    gap: 8px; padding: 8px;
+    background: var(--cv-backdrop); color: var(--cv-text);
+    /* The dots cover the whole backdrop, also under the Steps panel. pan()
+       (canvas-core.js) lines them up with the viewport through these variables. */
+    background-image: var(--canvas-dots-image, radial-gradient(circle, light-dark(rgb(0 0 0 / 0.13), rgb(255 255 255 / 0.09)) 1px, transparent 1.3px));
+    background-size: var(--canvas-dots-size, 20px 20px);
+    background-position: var(--canvas-dots-position, 0 0);
+    color-scheme: light; font: 13px/1.4 var(--font-sans, ui-sans-serif, system-ui, sans-serif);
+    -webkit-font-smoothing: antialiased;
+  }
+  .cv-root.cv-dark { color-scheme: dark; }
+  .cv-root *, .cv-root *::before, .cv-root *::after { box-sizing: border-box; }
+  /* Rounded boxes on the backdrop: the top bar and the step list. */
+  .cv-island { border: 1px solid var(--cv-line); border-radius: 8px; background: var(--cv-island); }
+  .cv-root svg { width: 1rem; height: 1rem; flex: none; }
+  .cv-root button:not(.button, [data-canvas-controls] button) { font: inherit; }
+
+  /* Header island on small screens; on desktop the header is in the zoom controls bar. */
+  .cv-top { grid-column: 1 / -1; display: flex; flex-wrap: wrap; align-items: center; gap: 0.75rem; padding: 0.625rem 0.75rem; }
+  .cv-root.cv-docked { grid-template-rows: minmax(0, 1fr); }
+  .cv-btn {
+    display: inline-flex; align-items: center; gap: 0.4375rem; height: 2rem; padding: 0 0.75rem;
+    border: 1px solid var(--cv-line); border-radius: 8px; background: var(--cv-input-bg);
+    color: var(--cv-text); font-weight: 500; font-size: 12.5px; cursor: pointer; text-decoration: none; white-space: nowrap;
+    transition: border-color 150ms ease, background-color 150ms ease;
+  }
+  .cv-btn:hover { border-color: light-dark(rgb(0 0 0 / 0.16), rgb(255 255 255 / 0.16)); }
+  .cv-btn svg { width: 0.875rem; height: 0.875rem; }
+  .cv-btn.icon { width: 2rem; padding: 0; justify-content: center; }
+  .cv-btn.ghost { border-color: transparent; background: transparent; }
+  .cv-btn.ghost:hover { background: light-dark(rgb(0 0 0 / 0.04), rgb(255 255 255 / 0.05)); }
+
+  /* Small-screen notice: only below 768px, until it is closed. */
+  .cv-notice { display: none; }
+  @media (max-width: 767px) {
+    .cv-root:has(> .cv-notice) { grid-template-rows: auto auto minmax(0, 1fr); }
+    .cv-notice { grid-column: 1 / -1; display: flex; align-items: flex-start; gap: 0.5rem; padding: 0.625rem 0.5rem 0.625rem 0.75rem; background: #dc2626; color: #fff; font-size: 12.5px; line-height: 1.125rem; }
+    .cv-notice > svg { margin-top: 0.0625rem; }
+    .cv-notice p { flex: 1; min-width: 0; margin: 0; }
+    .cv-notice a { color: inherit; font-weight: 600; text-decoration: underline; text-underline-offset: 2px; }
+    .cv-notice .cv-x { opacity: 1; margin-top: -0.1875rem; color: inherit; }
+    .cv-notice .cv-x:hover { background: rgb(255 255 255 / 0.18); color: inherit; }
+  }
+
+  /* Palette island */
+  /* Hugs its steps instead of filling the row; scrolls when the screen is short. */
+  /* The zoom controls sit below the Steps panel, so the panel leaves room for them. */
+  .cv-palette { display: flex; flex-direction: column; align-self: start; max-height: calc(100% - 3.25rem); overflow-y: auto; padding: 1rem 0.625rem 0.75rem; }
+  .cv-root > [data-canvas-controls] { bottom: 8px; left: 8px; }
+  .cv-palette-head { padding: 0 0.5rem 0.75rem; margin: 0 -0.625rem 0.5rem; padding-inline: 1.125rem; border-bottom: 1px solid var(--cv-line); }
+  .cv-palette-head b { display: block; font-size: 14px; font-weight: 600; }
+  .cv-palette-head span { color: var(--cv-subtle); font-size: 12px; }
+  .cv-palette h4 { margin: 0.75rem 0.5rem 0.25rem; color: var(--cv-subtle); font-size: 11px; font-weight: 500; }
+  .cv-item {
+    display: flex; align-items: center; gap: 0.625rem; width: 100%; min-height: 2.5rem; padding: 0.25rem 0.5rem 0.25rem 0.375rem;
+    border: 0; border-radius: 9px; background: none; color: var(--cv-text); text-align: left;
+    cursor: grab; user-select: none; touch-action: none;
+  }
+  /* Icon tiles: the neutral 32px tile of Coolify's collection cards. */
+  .cv-item i, .cv-node-head i { display: grid; flex: none; place-items: center; width: 2rem; height: 2rem; border: 1px solid var(--cv-line); border-radius: 8px; background: light-dark(#fafafa, rgb(255 255 255 / 0.04)); color: light-dark(#737373, var(--color-fg-dim, #c4c4c4)); }
+  .cv-item i svg { width: 1rem; height: 1rem; }
+  /* A resource logo fills the tile, like the environment canvas cards. */
+  .cv-node-head i.cv-logo { overflow: hidden; }
+  .cv-node-head i.cv-logo img { width: 100%; height: 100%; object-fit: contain; }
+  .cv-node-head i.cv-logo.padded img { padding: 0.25rem; }
+  .cv-node-head .cv-dark-only, .cv-root.cv-dark .cv-node-head .cv-light { display: none; }
+  .cv-root.cv-dark .cv-node-head .cv-dark-only { display: block; }
+  /* Palette tiles use the app's 3D button depth (app.css .button): a 2px ledge,
+     a lift on hover, and a press on click. */
+  /* Only the tile reacts; the row itself has no hover background. */
+  .cv-item i { --cv-depth: light-dark(rgb(0 0 0 / 0.22), rgb(255 255 255 / 0.08)); box-shadow: 0 2px 0 var(--cv-depth); transition: border-color 120ms, background-color 120ms, box-shadow 80ms, transform 80ms; }
+  .cv-item:hover i { transform: translateY(-1px); box-shadow: 0 3px 0 var(--cv-depth); border-color: light-dark(rgb(0 0 0 / 0.18), rgb(255 255 255 / 0.18)); background: light-dark(#fff, rgb(255 255 255 / 0.08)); }
+  .cv-item:focus-visible { outline: none; }
+  .cv-item:focus-visible i { outline: 1px solid var(--color-accent, currentColor); outline-offset: 2px; }
+  .cv-item:active i { transform: translateY(2px); box-shadow: none; }
+  .cv-item b { display: block; font-size: 13px; font-weight: 500; }
+  .cv-item small { display: block; color: var(--cv-subtle); font-size: 11.5px; }
+
+  /* Canvas island */
+  .cv-stage { position: relative; overflow: hidden; border: 0; background: transparent; }
+  .cv-viewport {
+    position: absolute; inset: 0; cursor: grab; touch-action: none;
+    /* The dots are on .cv-root, so the viewport has none of its own. */
+    background-image: none;
+  }
+  .cv-viewport.panning { cursor: grabbing; }
+  .cv-world { position: absolute; top: 0; left: 0; transform-origin: 0 0; }
+  .cv-edges { position: absolute; top: 0; left: 0; width: 1px; height: 1px; overflow: visible; pointer-events: none; }
+  .cv-edges path { fill: none; stroke: light-dark(#a3a3a3, rgb(255 255 255 / 0.35)); stroke-width: 1.75; }
+  .cv-edges path.hit { stroke: transparent; stroke-width: 14; pointer-events: stroke; cursor: pointer; }
+  .cv-edges path.hit:hover + path, .cv-edges path.live { stroke: color-mix(in srgb, var(--cv-brand) 70%, transparent); }
+  /* The line being dragged: moving dashes, like the environment canvas (.ec-temp). */
+  .cv-edges path.temp { stroke: var(--cv-brand); stroke-width: 2; stroke-linecap: round; stroke-dasharray: 6 6; animation: cv-flow 0.6s linear infinite; }
+  .cv-edges path.flow { stroke: var(--cv-brand); stroke-dasharray: 6 6; animation: cv-flow 0.8s linear infinite; }
+  @keyframes cv-flow { to { stroke-dashoffset: -12; } }
+
+  /* Nodes: a card like ux-polish's flow boxes — badge + title + subtitle, then fields. */
+  .cv-node {
+    position: absolute; width: 18.5rem;
+    border: 1px solid var(--cv-line); border-radius: 12px;
+    background: var(--cv-card);
+    box-shadow: 0 1px 3px rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
+    transition: box-shadow 150ms ease, border-color 150ms ease;
+  }
+  .cv-node:hover { border-color: light-dark(#d4d4d4, rgb(255 255 255 / 0.16)); box-shadow: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1); }
+  .cv-node.start { width: 16.5rem; }
+  .cv-node.running { border-color: var(--cv-brand); box-shadow: 0 0 0 4px color-mix(in srgb, var(--cv-brand) 16%, transparent); }
+  .cv-node.done { border-color: color-mix(in srgb, #10b981 70%, transparent); }
+  .cv-node.failed, .cv-node.invalid { border-color: color-mix(in srgb, #ef4444 75%, transparent); box-shadow: 0 0 0 4px color-mix(in srgb, #ef4444 12%, transparent); }
+  .cv-node.drop-ok { border-color: var(--cv-brand); box-shadow: 0 0 0 4px color-mix(in srgb, var(--cv-brand) 16%, transparent); }
+  .cv-root { user-select: none; }
+  .cv-root :is(input, textarea, .cv-logs) { user-select: text; }
+  .cv-actions { display: grid; grid-template-columns: 1fr 1fr; gap: 0.5rem; }
+  .cv-deploy-now { width: 100%; }
+  .cv-node-head { display: flex; align-items: center; gap: 0.625rem; height: 3.25rem; padding: 0 0.5rem 0 0.75rem; cursor: grab; user-select: none; }
+  .cv-node-head i svg { width: 1rem; height: 1rem; }
+  .cv-node-head div { display: grid; min-width: 0; margin-right: auto; }
+  .cv-node-head b { overflow: hidden; font-size: 13.5px; font-weight: 600; line-height: 1.125rem; text-overflow: ellipsis; white-space: nowrap; }
+  .cv-node-head small { overflow: hidden; color: var(--cv-subtle); font-size: 12px; line-height: 1rem; text-overflow: ellipsis; white-space: nowrap; }
+  .cv-x { display: grid; place-items: center; width: 1.625rem; height: 1.625rem; padding: 0; border: 0; border-radius: 7px; background: none; color: var(--cv-subtle); cursor: pointer; opacity: 0; transition: opacity 120ms ease; }
+  .cv-node:hover .cv-x, .cv-run .cv-x { opacity: 1; }
+  .cv-x:hover { background: light-dark(rgb(0 0 0 / 0.06), rgb(255 255 255 / 0.08)); color: var(--cv-text); }
+  .cv-x svg { width: 0.8125rem; height: 0.8125rem; }
+  .cv-node-body { display: grid; gap: 0.75rem; padding: 0.875rem 0.875rem 0.875rem; border-top: 1px solid var(--cv-line); }
+  .cv-field { display: grid; gap: 0.375rem; min-width: 0; }
+  .cv-field > label { color: var(--cv-subtle); font-size: 12px; font-weight: 500; }
+  .cv-field > label em { color: var(--cv-brand-text); font-style: normal; }
+  .cv-root .cv-input {
+    width: 100%; height: 2rem; margin: 0; padding: 0 0.625rem; border: 1px solid var(--cv-input-line); border-radius: 8px;
+    background: var(--cv-input-bg); color: var(--cv-text); font: inherit; font-size: 12.5px; outline: none; box-shadow: none;
+  }
+  .cv-root .cv-input::placeholder { color: var(--cv-placeholder); }
+  .cv-root .cv-input:focus, .cv-root .cv-input:focus-visible {
+    border-color: color-mix(in srgb, var(--cv-brand) 60%, transparent) !important;
+    outline: none !important;
+    box-shadow: 0 0 0 3px color-mix(in srgb, var(--cv-brand) 14%, transparent) !important;
+  }
+  .cv-root select.cv-input { padding-right: 1.75rem; appearance: none; background-image: url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%2024%2024%22%20fill%3D%22none%22%20stroke%3D%22%238a8a8a%22%20stroke-width%3D%222%22%20stroke-linecap%3D%22round%22%20stroke-linejoin%3D%22round%22%3E%3Cpath%20d%3D%22m6%209%206%206%206-6%22%2F%3E%3C%2Fsvg%3E"); background-repeat: no-repeat; background-position: right 0.5rem center; background-size: 0.875rem; }
+  .cv-root textarea.cv-input { height: auto; min-height: 4.25rem; padding: 0.4375rem 0.625rem; line-height: 1.3rem; resize: vertical; }
+  .cv-root .cv-input.mono, .cv-root textarea.cv-input { font-family: var(--font-mono, ui-monospace, SFMono-Regular, Menlo, monospace); font-size: 12px; }
+  .cv-seg { display: flex; gap: 2px; padding: 2px; border-radius: 8px; background: light-dark(#f4f4f5, rgb(255 255 255 / 0.05)); }
+  .cv-seg button { flex: 1; height: 1.625rem; padding: 0 0.5rem; border: 0; border-radius: 6px; background: none; color: var(--cv-subtle); font-size: 12px; font-weight: 500; cursor: pointer; }
+  .cv-seg button.on { background: light-dark(#fff, rgb(255 255 255 / 0.09)); color: var(--cv-text); box-shadow: 0 1px 2px rgb(0 0 0 / 0.08), 0 0 0 1px var(--cv-line); }
+  .cv-note { margin: 0; color: var(--cv-subtle); font-size: 11.5px; line-height: 1.4; }
+  .cv-note.bad { color: light-dark(#dc2626, #f87171); }
+  .cv-status { display: flex; gap: 0.5rem; align-items: flex-start; padding: 0.625rem 0.875rem; border-top: 1px solid var(--cv-line); font-size: 12px; line-height: 1.35; overflow-wrap: anywhere; }
+  .cv-status::before { content: ''; flex: none; width: 0.5rem; height: 0.5rem; margin-top: 0.25rem; border-radius: 50%; background: var(--st); }
+  .cv-status.running { --st: var(--cv-brand); }
+  .cv-status.done { --st: #10b981; }
+  .cv-status.failed { --st: #ef4444; color: light-dark(#dc2626, #f87171); }
+
+  /* Ports: filled dots on the header line, like the environment canvas. */
+  .cv-port {
+    position: absolute; top: calc(1.625rem - 0.375rem); width: 0.75rem; height: 0.75rem; border-radius: 50%;
+    border: 2px solid var(--cv-card); background: light-dark(#a3a3a3, #737373); z-index: 2;
+    box-shadow: 0 1px 3px rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
+    transition: transform 120ms ease, background-color 120ms ease;
+  }
+  .cv-port.out { right: -0.375rem; cursor: crosshair; }
+  .cv-port.in { left: -0.375rem; }
+  .cv-port.out:hover, .cv-port.out.armed { background: var(--cv-brand); transform: scale(1.2); }
+
+  /* Collapsed steps: icons only. */
+  .cv-root { transition: grid-template-columns 260ms cubic-bezier(0.4, 0, 0.2, 1); }
+  .cv-root.cv-folded { grid-template-columns: 3.75rem minmax(0, 1fr); }
+  .cv-palette-head { display: flex; align-items: flex-start; gap: 0.5rem; }
+  .cv-palette-head > div { min-width: 0; margin-right: auto; }
+  .cv-fold { opacity: 1; margin-top: 0.0625rem; }
+  .cv-fold svg { width: 1rem; height: 1rem; }
+  .cv-folded .cv-palette { padding-inline: 0.5rem; overflow-x: hidden; }
+  .cv-folded .cv-palette-head { justify-content: center; margin-inline: -0.5rem; padding-inline: 0; }
+  /* Only the step list folds; the "Add the next step" menu keeps its names. */
+  .cv-folded .cv-palette-head > div, .cv-folded .cv-palette .cv-item > span { display: none; }
+  .cv-folded .cv-fold svg { transform: scaleX(-1); }
+  .cv-folded .cv-palette h4 { height: 1px; margin: 0.5rem 0.375rem; overflow: hidden; color: transparent; background: var(--cv-line); }
+  .cv-folded .cv-palette .cv-item { justify-content: center; padding: 0.25rem; }
+
+  /* Our dropdown */
+  .cv-root .cv-select { display: flex; align-items: center; gap: 0.5rem; text-align: left; cursor: pointer; }
+  .cv-root .cv-select > span { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .cv-root .cv-select.empty > span { color: var(--cv-placeholder); }
+  .cv-root .cv-select > svg { width: 0.875rem; height: 0.875rem; color: var(--cv-subtle); transition: transform 180ms ease; }
+  .cv-root .cv-select.open > svg { transform: rotate(180deg); }
+  .cv-root .cv-select.open { border-color: color-mix(in srgb, var(--cv-brand) 60%, transparent); box-shadow: 0 0 0 3px color-mix(in srgb, var(--cv-brand) 14%, transparent); }
+  .cv-root .cv-select:disabled { cursor: default; opacity: 0.7; }
+  .cv-dd {
+    position: fixed; z-index: 60; display: flex; flex-direction: column; max-height: 17rem; padding: 0.3125rem;
+    border: 1px solid var(--cv-line); border-radius: 10px; background: var(--cv-popover);
+    box-shadow: 0 16px 40px -14px rgb(0 0 0 / 0.4); animation: cv-dd-in 120ms ease-out;
+  }
+  @keyframes cv-dd-in { from { opacity: 0; transform: translateY(-3px); } }
+  .cv-dd-search {
+    flex: none; height: 1.875rem; margin-bottom: 0.25rem; padding: 0 0.625rem; border: 1px solid var(--cv-input-line); border-radius: 7px;
+    background: var(--cv-input-bg); color: var(--cv-text); font: inherit; font-size: 12.5px; outline: none;
+  }
+  .cv-dd-search:focus { border-color: color-mix(in srgb, var(--cv-brand) 60%, transparent); }
+  .cv-dd-list { overflow-x: hidden; overflow-y: auto; display: grid; grid-template-columns: minmax(0, 1fr); gap: 1px; }
+  .cv-dd-opt {
+    display: flex; align-items: center; gap: 0.5rem; width: 100%; min-height: 2rem; padding: 0 0.5rem 0 0.625rem;
+    border: 0; border-radius: 7px; background: none; color: var(--cv-text); font-size: 12.5px; text-align: left; cursor: pointer;
+  }
+  .cv-dd-opt > span { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .cv-dd-opt > svg { width: 0.875rem; height: 0.875rem; color: var(--cv-brand-text); opacity: 0; }
+  .cv-dd-opt:focus, .cv-dd-opt:focus-visible { outline: none; box-shadow: none; }
+  .cv-dd-opt.on { font-weight: 600; }
+  .cv-badge { flex: none; padding: 0.0625rem 0.4375rem; border: 1px solid light-dark(rgb(217 119 6 / 0.3), rgb(251 191 36 / 0.3)); border-radius: 999px; background: light-dark(rgb(217 119 6 / 0.1), rgb(251 191 36 / 0.12)); color: light-dark(#b45309, #fbbf24); font-size: 11px; font-style: normal; font-weight: 500; line-height: 1.4; }
+  .cv-dd-opt.on > svg { opacity: 1; }
+  .cv-dd-opt.active { background: light-dark(rgb(0 0 0 / 0.045), rgb(255 255 255 / 0.06)); }
+  .cv-dd-none { margin: 0; padding: 0.5rem 0.625rem; color: var(--cv-subtle); font-size: 12px; }
+  .cv-dd-add { flex: none; margin-top: 0.25rem; padding-top: 0.25rem; border-top: 1px solid var(--cv-line); }
+  .cv-dd-opt.cv-dd-new { color: var(--cv-brand-text); font-weight: 500; }
+  .cv-dd-opt.cv-dd-new > svg { opacity: 1; color: inherit; }
+  .cv-dd-form { display: flex; gap: 0.375rem; }
+  .cv-dd-form .cv-dd-search { flex: 1; min-width: 0; margin: 0; }
+  .cv-dd-form .button { height: 1.875rem; }
+  .cv-dd-add .cv-note:not(:empty) { padding: 0.375rem 0.25rem 0.125rem; }
+
+  /* Result pill after Deploy: the live address(es). */
+  .cv-result {
+    position: absolute; display: flex; align-items: center; gap: 0.25rem; height: 2.375rem; padding: 0 0.25rem 0 0.875rem;
+    border: 1px solid color-mix(in srgb, #10b981 45%, transparent); border-radius: 999px;
+    background: var(--cv-card); box-shadow: 0 8px 24px -12px rgb(0 0 0 / 0.25); white-space: nowrap;
+  }
+  .cv-result > i { width: 0.5rem; height: 0.5rem; margin-right: 0.25rem; border-radius: 50%; background: #10b981; box-shadow: 0 0 0 4px color-mix(in srgb, #10b981 18%, transparent); }
+  .cv-result a { display: inline-flex; align-items: center; gap: 0.375rem; height: 1.75rem; padding: 0 0.625rem; border-radius: 999px; color: var(--cv-text); font-weight: 600; text-decoration: none; }
+  .cv-result a:hover { background: light-dark(rgb(0 0 0 / 0.05), rgb(255 255 255 / 0.07)); }
+  .cv-result a svg { width: 0.8125rem; height: 0.8125rem; color: var(--cv-subtle); }
+  .cv-result .cv-x { opacity: 1; }
+  .cv-result .cv-port.in { top: calc(50% - 0.375rem); }
+
+  /* Next-step menu, toasts */
+  .cv-menu { position: absolute; z-index: 20; width: 15rem; padding: 0.375rem; border: 1px solid var(--cv-line); border-radius: 12px; background: var(--cv-island); box-shadow: 0 16px 40px -16px rgb(0 0 0 / 0.4); }
+  .cv-menu h5 { margin: 0.25rem 0.5rem 0.375rem; color: var(--cv-subtle); font-size: 11.5px; font-weight: 500; }
+  .cv-menu .cv-item { cursor: pointer; }
+  .cv-toast { position: absolute; left: 50%; bottom: 1rem; z-index: 30; max-width: 80%; transform: translateX(-50%); padding: 0.5rem 0.875rem; border: 1px solid var(--cv-line); border-radius: 8px; background: var(--cv-island); color: var(--cv-text); font-size: 12px; pointer-events: none; box-shadow: 0 10px 15px -3px rgb(0 0 0 / 0.1), 0 4px 6px -4px rgb(0 0 0 / 0.1); }
+  .cv-toast.bad { border-color: light-dark(#fecaca, rgb(239 68 68 / 0.3)); color: light-dark(#b91c1c, #fca5a5); }
+  /* Blank canvas: the Start ring pulses and a dashed trail shows where to drag it. */
+  .cv-node.blank .cv-port.out { background: var(--cv-brand); }
+  .cv-node.blank .cv-port.out::after { content: ''; position: absolute; inset: -2px; border-radius: 50%; border: 2px solid var(--cv-brand); animation: cv-breathe 1.8s ease-out infinite; pointer-events: none; }
+  .cv-hint { position: absolute; left: calc(100% + 0.625rem); top: 1.625rem; transform: translateY(-50%); display: flex; align-items: center; gap: 0.5rem; color: var(--cv-brand-text); font-size: 12px; font-weight: 500; white-space: nowrap; pointer-events: none; }
+  .cv-hint::before { content: ''; width: 4.5rem; border-top: 2px dashed currentColor; opacity: 0.7; animation: cv-hint-grow 1.8s ease-in-out infinite; transform-origin: left; }
+  .cv-hint span { animation: cv-hint-fade 1.8s ease-in-out infinite; }
+  .cv-node:has(.cv-port.armed) .cv-hint, .cv-node:has(.cv-port.armed) .cv-port.out::after { display: none; }
+  @keyframes cv-hint-grow { 0% { transform: scaleX(0); } 60%, 100% { transform: scaleX(1); } }
+  @keyframes cv-hint-fade { 0%, 30% { opacity: 0; } 60%, 100% { opacity: 1; } }
+  @media (prefers-reduced-motion: reduce) { .cv-node.blank .cv-port.out::after, .cv-hint::before, .cv-hint span { animation: none; } }
+
+  /* Run panel: an island with the steps as status lights, then the logs. */
+  .cv-run { position: absolute; top: 0.75rem; right: 0.75rem; bottom: 0.75rem; z-index: 10; display: flex; flex-direction: column; width: min(26rem, 45%); overflow: hidden; border: 1px solid var(--cv-line); border-radius: 8px; background: var(--cv-island); box-shadow: 0 20px 48px -20px rgb(0 0 0 / 0.4); }
+  .cv-run[hidden] { display: none; }
+  .cv-run header { display: flex; align-items: flex-start; gap: 0.5rem; padding: 1rem 0.75rem 0.875rem 1.25rem; border-bottom: 1px solid var(--cv-line); }
+  .cv-run header div { display: grid; gap: 0.0625rem; margin-right: auto; }
+  .cv-run header b { font-size: 14px; font-weight: 600; }
+  .cv-run header span { color: var(--cv-subtle); font-size: 12.5px; }
+  .cv-steps { flex: none; max-height: 40%; overflow-y: auto; display: grid; gap: 0.25rem; padding: 0.75rem 1rem 0.875rem; border-bottom: 1px solid var(--cv-line); }
+  .cv-step { display: grid; grid-template-columns: 1.25rem minmax(0, 1fr); align-items: start; font-size: 12.5px; line-height: 1.25rem; }
+  .cv-step i { position: relative; width: 0.5rem; height: 0.5rem; margin: 0.375rem 0 0 0.125rem; border-radius: 50%; background: transparent; box-shadow: inset 0 0 0 1.5px light-dark(#c4c4c4, #4a4a4a); }
+  .cv-step.running i { background: var(--cv-brand); box-shadow: none; }
+  .cv-step.running i::after { content: ''; position: absolute; inset: 0; border-radius: 50%; background: var(--cv-brand); animation: cv-breathe 1.8s ease-out infinite; }
+  @keyframes cv-breathe { 0% { transform: scale(1); opacity: 0.5; } 80%, 100% { transform: scale(2.6); opacity: 0; } }
+  .cv-step.done i { background: #10b981; box-shadow: none; }
+  .cv-step.failed i { background: #ef4444; box-shadow: none; }
+  .cv-step small { display: block; color: var(--cv-subtle); font-size: 11.5px; line-height: 1rem; overflow-wrap: anywhere; }
+  .cv-step.failed small { color: light-dark(#dc2626, #f87171); }
+  .cv-tabs { flex: none; margin: 0.75rem 0.75rem 0; overflow-x: auto; scrollbar-width: none; }
+  .cv-tabs[hidden] { display: none; }
+  .cv-tabs button { flex: 0 1 auto; display: inline-flex; align-items: center; gap: 0.375rem; min-width: 0; max-width: 13rem; }
+  .cv-tabs button span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .cv-tabs i { flex: none; width: 0.4375rem; height: 0.4375rem; border-radius: 50%; box-shadow: inset 0 0 0 1.5px light-dark(#c4c4c4, #4a4a4a); }
+  .cv-tabs button:first-child { flex: none; }
+  .cv-tabs button:first-child i { display: none; }
+  .cv-tabs i.running { background: var(--cv-brand); box-shadow: none; animation: cv-blink 1.2s ease-in-out infinite; }
+  .cv-tabs i.done { background: #10b981; box-shadow: none; }
+  .cv-tabs i.failed { background: #ef4444; box-shadow: none; }
+  @keyframes cv-blink { 50% { opacity: 0.35; } }
+  .cv-logs-wrap { flex: 1; min-height: 0; padding: 0.75rem; display: flex; }
+  .cv-logs[hidden] { display: none; }
+  .cv-logs { flex: 1; min-height: 0; margin: 0; padding: 0.75rem 0.875rem; overflow: auto; border: 1px solid var(--cv-input-line); border-radius: 10px; background: var(--cv-input-bg); font: 11.5px/1.6 var(--font-mono, ui-monospace, SFMono-Regular, Menlo, monospace); white-space: pre-wrap; overflow-wrap: anywhere; }
+  .cv-logs:empty::before { content: 'Logs show here while it deploys.'; color: var(--cv-subtle); font-family: var(--font-sans, ui-sans-serif, system-ui, sans-serif); }
+  .cv-logs .err { color: light-dark(#dc2626, #f87171); }
+  .cv-logs .dim { color: var(--cv-subtle); }
+  .cv-run footer { display: flex; justify-content: flex-end; gap: 0.5rem; padding: 0 0.75rem 0.75rem; }
+  .cv-run footer a[hidden] { display: none; }
+
+  /* Small screens: one column. The steps are a strip above the canvas; swipe it sideways,
+     tap a step to add it to the chain, or drag it down onto the canvas. */
+  @media (max-width: 767px) {
+    .cv-root, .cv-root.cv-folded { grid-template-columns: minmax(0, 1fr); grid-template-rows: auto auto minmax(0, 1fr); }
+    .cv-root:has(> .cv-notice) { grid-template-rows: auto auto auto minmax(0, 1fr); }
+    .cv-root .cv-palette, .cv-root.cv-folded .cv-palette { flex-direction: row; align-items: center; gap: 0.25rem; align-self: stretch; max-height: none; padding: 0.375rem; overflow: auto hidden; }
+    .cv-palette-head, .cv-palette h4, .cv-root.cv-folded .cv-palette h4 { display: none; }
+    .cv-root .cv-palette .cv-item, .cv-root.cv-folded .cv-palette .cv-item { flex: none; width: auto; justify-content: flex-start; padding: 0.25rem 0.625rem 0.25rem 0.25rem; touch-action: pan-x; }
+    .cv-root.cv-folded .cv-palette .cv-item > span { display: block; }
+    .cv-item small { display: none; }
+    .cv-run { left: 0.75rem; width: auto; }
+  }
+`;
+
+export function injectStyles() {
+  if (document.getElementById('deploy-canvas-style')) return;
+  const style = document.createElement('style');
+  style.id = 'deploy-canvas-style';
+  style.textContent = CSS;
+  document.head.append(style);
+}
diff --git a/resources/js/canvas/environment/AddSection.svelte b/resources/js/canvas/environment/AddSection.svelte
new file mode 100644
index 0000000000..2dc38c9aa7
--- /dev/null
+++ b/resources/js/canvas/environment/AddSection.svelte
@@ -0,0 +1,40 @@
+<script>
+  // Searchable list of cards, each with an Add button (connect view side panels).
+  import Icon from './Icon.svelte';
+
+  let { title, placeholder, empty, candidates, describe, onadd } = $props();
+  let query = $state('');
+  let busy = $state({});
+  const search = $derived(query.trim().toLowerCase());
+
+  async function add(candidate) {
+    busy[candidate.id] = true;
+    await onadd(candidate);
+    busy[candidate.id] = false;
+  }
+</script>
+
+<section class="border-t border-neutral-100 px-4 py-3 dark:border-white/[0.06]">
+  <h3 class="mb-1.5 text-[11px]! leading-4! font-medium! text-neutral-400 dark:text-fg-faint">{title}</h3>
+  <div class="flex flex-col gap-2">
+    {#if candidates.length}
+      <input bind:value={query} class="input h-8 w-full text-[12px]" type="search" {placeholder} aria-label={placeholder} />
+    {/if}
+    <ul class="flex flex-col gap-1.5">
+      {#if !candidates.length}<li class="text-[12px] text-neutral-400 dark:text-fg-faint">{empty}</li>{/if}
+      {#each candidates as candidate (candidate.id)}
+        {@const { title: addTitle, sub } = describe(candidate)}
+        <li class="flex items-center gap-1" class:hidden={!!search && !`${candidate.name} ${sub}`.toLowerCase().includes(search)}>
+          <div class="flex min-w-0 flex-1 items-center gap-2 px-1.5 py-1 text-[12px]">
+            <Icon name={candidate.type} class="size-3.5 text-neutral-400 dark:text-fg-faint" />
+            <div class="min-w-0 flex-1">
+              <div class="truncate {candidate.type === 'variable' ? 'font-mono' : ''}">{candidate.name}</div>
+              {#if sub}<div class="truncate text-[11px] text-neutral-400 dark:text-fg-faint">{sub}</div>{/if}
+            </div>
+          </div>
+          <button type="button" class="button h-6! shrink-0 px-2! text-[11px]!" title={addTitle} disabled={busy[candidate.id]} onclick={() => add(candidate)}>Add</button>
+        </li>
+      {/each}
+    </ul>
+  </div>
+</section>
diff --git a/resources/js/canvas/environment/Card.svelte b/resources/js/canvas/environment/Card.svelte
new file mode 100644
index 0000000000..ef1636e528
--- /dev/null
+++ b/resources/js/canvas/environment/Card.svelte
@@ -0,0 +1,143 @@
+<script>
+  // A resource card (or, connect view, a shared variable / tag card).
+  import { isSource, MAX_CHILDREN, statusLabel, statusTone, statusWord, TYPE_LABELS } from '../../environment-canvas.js';
+  import NodeIcon from './NodeIcon.svelte';
+  import StatusDot from './StatusDot.svelte';
+
+  let { node, position, selected, dropTarget, movable, port, linkCount, zoneNames, serverDown = false, statusText = false, onpress, onconnect, onselect, onhover } = $props();
+  let card;
+  let portDot = $state();
+  // Same as the deploy canvas drop target: accent border and a soft 4px ring.
+  const DROP_TARGET = 'border-coollabs! dark:border-warning! ring-4 ring-coollabs/15 dark:ring-warning/15';
+
+  const extra = $derived(node.extra_zones?.length || 0);
+  const children = $derived(node.children || []);
+  const chip = 'inline-flex h-5 max-w-[9rem] items-center truncate rounded-full border border-neutral-200 bg-neutral-50 px-1.5 text-[10px] font-medium text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim';
+  const stop = e => e.stopPropagation();
+  // The server is not reachable, so the saved status is stale: show it as unknown, not as a failure.
+  const DOWN = 'Unknown (server not reachable)';
+  const status = $derived(serverDown ? 'unknown' : node.status);
+  const TONE_TEXT = {
+    ok: 'text-emerald-600 dark:text-emerald-400',
+    warn: 'text-warning-700 dark:text-warning',
+    busy: 'text-warning-700 dark:text-warning',
+    bad: 'text-red-600 dark:text-red-400',
+    idle: 'text-neutral-500 dark:text-fg-faint',
+  };
+</script>
+
+<!-- data-ec-open: its page opens on double-click (see the root's pointerdown capture listener). -->
+<div
+  bind:this={card}
+  class="group absolute flex w-[260px] flex-col rounded-xl border bg-white p-3 shadow-sm transition-shadow hover:shadow-md dark:bg-raised {selected
+    ? 'border-coollabs ring-2 ring-coollabs/25 dark:border-warning dark:ring-warning/25'
+    : node.missing
+      ? 'border-dashed border-red-300 dark:border-red-500/40'
+      : 'border-neutral-200 hover:border-neutral-300 dark:border-white/[0.08] dark:hover:border-white/[0.16]'} {movable ? 'cursor-grab active:cursor-grabbing' : 'cursor-pointer'} {dropTarget ? DROP_TARGET : ''}"
+  style:left={position ? `${position.x}px` : null}
+  style:top={position ? `${position.y}px` : null}
+  data-ec-card
+  data-id={node.id}
+  data-ec-open={node.link || undefined}
+  title={node.link ? 'Double-click to open' : undefined}
+  role="button"
+  tabindex="0"
+  aria-label={isSource(node)
+    ? `${node.name} (${node.missing ? 'deleted ' : ''}${TYPE_LABELS[node.type].toLowerCase()})`
+    : `${node.name} (${TYPE_LABELS[node.type] || node.type}), ${serverDown ? DOWN : statusLabel(node.status)}`}
+  onpointerdown={e => onpress(e, card)}
+  onkeydown={e => {
+    if (e.key === 'Enter' || e.key === ' ') {
+      e.preventDefault();
+      onselect();
+    }
+  }}
+  onpointerenter={() => onhover(true)}
+  onpointerleave={() => onhover(false)}
+>
+  <div class="flex items-start gap-2.5">
+    <div class="flex size-8 shrink-0 items-center justify-center overflow-hidden rounded-lg border {node.missing
+      ? 'border-red-200 bg-red-50 text-red-500 dark:border-red-500/30 dark:bg-red-500/10 dark:text-red-400'
+      : 'border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim'}">
+      <NodeIcon {node} />
+    </div>
+    <div class="min-w-0 flex-1">
+      <div class="truncate text-[13px] leading-4 font-semibold text-black dark:text-fg {node.type === 'variable' ? 'font-mono' : ''} {node.link ? 'underline-offset-2 group-hover:underline' : ''}">{node.name}</div>
+      <div class="mt-0.5 truncate text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">{node.subtitle || TYPE_LABELS[node.type] || ''}</div>
+    </div>
+    {#if isSource(node)}
+      <span
+        class="mt-0.5 shrink-0 rounded-full border px-1.5 text-[10px] leading-4 font-medium {node.missing
+          ? 'border-red-200 bg-red-50 text-red-600 dark:border-red-500/30 dark:bg-red-500/10 dark:text-red-400'
+          : 'border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim'}"
+        title={node.missing ? 'This shared variable was deleted, but resources still reference it' : `Used by ${linkCount} ${linkCount === 1 ? 'resource' : 'resources'}`}
+      >{node.missing ? 'Deleted' : String(linkCount)}</span>
+    {:else}
+      {#if node.deployment}
+        <!-- Dashboard canvas: the running or queued deployment of the application. -->
+        <a
+          class="relative mt-0.5 inline-flex shrink-0 items-center gap-1 rounded-full border border-neutral-200 bg-neutral-50 px-1.5 text-[10px] leading-4 font-medium text-neutral-600 hover:border-neutral-300 hover:text-black dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim dark:hover:border-white/[0.2] dark:hover:text-fg"
+          href={node.deployment.link}
+          title={node.deployment.pull_request_id ? `Pull request #${node.deployment.pull_request_id}` : 'Open the deployment'}
+          onpointerdown={stop}
+          onclick={stop}
+        >
+          <StatusDot status={node.deployment.status} size="size-1.5" />
+          {node.deployment.status === 'queued' ? 'Queued' : 'Deploying'}
+        </a>
+      {/if}
+      {#if statusText}
+        <!-- Server view: the status in words, so a stopped resource reads as stopped at a glance. -->
+        <span class="mt-0.5 inline-flex shrink-0 items-center gap-1.5 text-[11px] leading-4 font-medium {TONE_TEXT[statusTone(status)]}" title={serverDown ? DOWN : statusLabel(status)}>
+          {statusWord(status)}<StatusDot {status} size="size-1.5" title={serverDown ? DOWN : null} />
+        </span>
+      {:else}
+        <div class="pt-1"><StatusDot {status} title={serverDown ? DOWN : null} /></div>
+      {/if}
+    {/if}
+  </div>
+
+  {#if node.urls?.length}
+    <a
+      class="relative mt-1.5 block max-w-full self-start truncate text-[11px] leading-5 text-neutral-500 hover:text-black hover:underline dark:text-fg-dim dark:hover:text-fg"
+      href={node.urls[0]}
+      target="_blank"
+      rel="noopener noreferrer"
+      title={node.urls[0]}
+      onpointerdown={stop}
+      onclick={stop}
+    >{node.urls[0].replace(/^https?:\/\//, '')}</a>
+  {/if}
+
+  {#if extra}
+    <div class="mt-2 flex min-w-0 flex-wrap gap-1 overflow-hidden h-5">
+      <span class={chip} title={zoneNames.join(', ')}>+{extra} {extra === 1 ? 'server' : 'servers'}</span>
+    </div>
+  {/if}
+
+  {#if children.length}
+    <ul class="mt-2 border-t border-neutral-100 pt-1.5 dark:border-white/[0.06]">
+      {#each children.slice(0, MAX_CHILDREN) as child, i (i)}
+        <li class="flex h-5 items-center gap-2 text-[12px] leading-5">
+          <StatusDot status={serverDown ? 'unknown' : child.status} size="size-1.5" title={serverDown ? DOWN : null} />
+          <span class="min-w-0 truncate">{child.name}</span>
+        </li>
+      {/each}
+      {#if children.length > MAX_CHILDREN}
+        <li class="h-5 text-[11px] leading-5 text-neutral-400 dark:text-fg-faint">+{children.length - MAX_CHILDREN} more</li>
+      {/if}
+    </ul>
+  {/if}
+
+  <!-- Drag dot: shown on hover only. Connected ends always show (link end dots in the root). -->
+  {#if port}
+    <span
+      bind:this={portDot}
+      class="absolute top-1/2 -right-1.5 size-3 -translate-y-1/2 cursor-crosshair rounded-full border-2 border-white bg-neutral-400 opacity-0 shadow transition-[opacity,scale,background-color] group-hover:opacity-100 hover:scale-120 hover:bg-coollabs dark:border-raised dark:bg-neutral-500 dark:hover:bg-warning"
+      data-ec-port
+      role="presentation"
+      title={port}
+      onpointerdown={e => onconnect(e, portDot)}
+    ></span>
+  {/if}
+</div>
diff --git a/resources/js/canvas/environment/Deployments.svelte b/resources/js/canvas/environment/Deployments.svelte
new file mode 100644
index 0000000000..73a2c84845
--- /dev/null
+++ b/resources/js/canvas/environment/Deployments.svelte
@@ -0,0 +1,86 @@
+<script>
+  // Dashboard canvas: running, queued, and recent deployments. A row shows its application card;
+  // the status opens the deployment. Folded or open is remembered in localStorage.
+  import { TONE_DOT } from '../../environment-canvas.js';
+  import Icon from './Icon.svelte';
+
+  let { deployments, nodeById, onshow } = $props();
+
+  const KEY = 'coolify-canvas-deployments-open';
+  const STATUS = {
+    in_progress: ['In progress', 'busy'],
+    queued: ['Queued', 'busy'],
+    finished: ['Success', 'ok'],
+    failed: ['Failed', 'bad'],
+    'cancelled-by-user': ['Cancelled', 'idle'],
+  };
+  const status = value => STATUS[value] || [String(value || 'Unknown').replace(/[-_]/g, ' '), 'idle'];
+
+  let open = $state(readOpen());
+  function readOpen() {
+    try {
+      return localStorage.getItem(KEY) !== 'false';
+    } catch {
+      return true;
+    }
+  }
+  function toggle() {
+    open = !open;
+    try {
+      localStorage.setItem(KEY, String(open));
+    } catch {
+      // Storage blocked: the panel opens next time.
+    }
+  }
+
+  // "3m ago"; re-rendered with each canvas reload.
+  const units = [['d', 86400], ['h', 3600], ['m', 60]];
+  function ago(iso) {
+    const seconds = Math.max(0, (Date.now() - new Date(iso).getTime()) / 1000);
+    for (const [unit, size] of units) {
+      if (seconds >= size) return `${Math.floor(seconds / size)}${unit} ago`;
+    }
+    return 'just now';
+  }
+</script>
+
+<section class="flex max-h-80 w-72 min-w-0 flex-col overflow-hidden rounded-lg border border-neutral-200 bg-white shadow-lg dark:border-white/[0.08] dark:bg-panel" data-ec-deployments>
+  <button type="button" class="flex w-full shrink-0 items-center gap-2 px-3 py-2.5 text-left" aria-expanded={open} onclick={toggle}>
+    <span class="min-w-0 flex-1 text-[12px] font-semibold text-black dark:text-fg">Recent deployments</span>
+    <span class="text-[11px] text-neutral-400 dark:text-fg-faint">{deployments.length}</span>
+    <Icon name="chevron" class="size-3.5 text-neutral-400 transition-transform dark:text-fg-faint {open ? '' : 'rotate-180'}" />
+  </button>
+  {#if open}
+    <ul class="min-h-0 overflow-y-auto border-t border-neutral-100 dark:border-white/[0.06]">
+      {#each deployments as deployment (deployment.id)}
+        {@const [label, tone] = status(deployment.status)}
+        {@const node = deployment.application ? nodeById(deployment.application) : null}
+        <li class="flex items-center gap-2 border-b border-neutral-100 px-3 py-2 last:border-b-0 dark:border-white/[0.06]">
+          <button
+            type="button"
+            class="min-w-0 flex-1 text-left disabled:cursor-default enabled:hover:[&>p:first-child]:underline"
+            disabled={!node}
+            title={node ? 'Show on the canvas' : undefined}
+            onclick={() => onshow(node.id)}
+          >
+            <p class="truncate text-[12px] font-medium text-black underline-offset-2 dark:text-fg">{deployment.name}</p>
+            <p class="truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+              {deployment.pull_request_id ? `PR #${deployment.pull_request_id} · ` : ''}{deployment.created_at ? ago(deployment.created_at) : deployment.server}
+            </p>
+          </button>
+          <a
+            class="inline-flex shrink-0 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-50 px-2 text-[10px] leading-5 font-medium text-neutral-600 hover:border-neutral-300 hover:text-black dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim dark:hover:border-white/[0.2] dark:hover:text-fg"
+            href={deployment.link}
+            title="Open the deployment"
+          >
+            <span class="relative flex size-1.5">
+              {#if tone === 'busy'}<span class="absolute inline-flex size-full rounded-full opacity-75 motion-safe:animate-ping {TONE_DOT.busy}"></span>{/if}
+              <span class="relative inline-flex size-full rounded-full {TONE_DOT[tone]}"></span>
+            </span>
+            {label}
+          </a>
+        </li>
+      {/each}
+    </ul>
+  {/if}
+</section>
diff --git a/resources/js/canvas/environment/EmptyCard.svelte b/resources/js/canvas/environment/EmptyCard.svelte
new file mode 100644
index 0000000000..dc6721258d
--- /dev/null
+++ b/resources/js/canvas/environment/EmptyCard.svelte
@@ -0,0 +1,24 @@
+<script>
+  // Placeholder card of an environment (or project) without resources: opens the deploy canvas (admins) or its page on click.
+  import Icon from './Icon.svelte';
+
+  let { node, position } = $props();
+</script>
+
+<a
+  class="group absolute flex w-[260px] items-center gap-2.5 rounded-xl border border-dashed border-neutral-300 bg-white/60 p-3 hover:border-neutral-400 dark:border-white/[0.12] dark:bg-white/[0.02] dark:hover:border-white/[0.24]"
+  style:left={position ? `${position.x}px` : null}
+  style:top={position ? `${position.y}px` : null}
+  href={node.link}
+  draggable="false"
+  data-ec-card
+  data-id={node.id}
+>
+  <div class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-dashed border-neutral-300 text-neutral-400 dark:border-white/[0.12] dark:text-fg-faint">
+    <Icon name="plus" class="size-3.5" />
+  </div>
+  <div class="min-w-0 flex-1">
+    <div class="truncate text-[13px] leading-4 font-semibold text-neutral-500 underline-offset-2 group-hover:underline dark:text-fg-dim">{node.name}</div>
+    <div class="mt-0.5 truncate text-[11px] leading-4 text-neutral-400 dark:text-fg-faint">{node.subtitle}</div>
+  </div>
+</a>
diff --git a/resources/js/canvas/environment/EnvironmentCanvas.svelte b/resources/js/canvas/environment/EnvironmentCanvas.svelte
new file mode 100644
index 0000000000..f5f70d76ad
--- /dev/null
+++ b/resources/js/canvas/environment/EnvironmentCanvas.svelte
@@ -0,0 +1,1095 @@
+<script>
+  // Environment canvas (Beta): a read-mostly diagram of one environment.
+  // Server zones hold resource cards; admins can move cards and draw
+  // visual-only links. Positions and links are stored through /canvas/api.
+  //
+  // The server canvas (data-endpoint) reuses this view. It saves moves and links on the environment canvas of each card.
+  // The shared variables and tags canvases (data-mode) reuse it too: their links add a variable or a tag to a resource.
+  import { flushSync, onMount, tick } from 'svelte';
+  import { api, BOX_GAP, freeSpot, panZoom } from '../../canvas-core.js';
+  import {
+    canConnect,
+    canLink,
+    cardRect,
+    CONNECT_TEXT,
+    DOUBLE_CLICK_MS,
+    dragRules,
+    filterGraph,
+    filterOptions,
+    fitView,
+    GROUP_GAP,
+    GROUP_HEADER,
+    GROUP_PADDING,
+    groupByUse,
+    groupFrames,
+    groupKey,
+    isSource,
+    layoutGraph,
+    layoutServerView,
+    linkPath,
+    MOBILE_NOTICE_KEY,
+    readView,
+    STATUS_CHANNELS,
+    unreachableZones,
+    zoneBoxes,
+    zoneGroups,
+  } from '../../environment-canvas.js';
+  import Card from './Card.svelte';
+  import Deployments from './Deployments.svelte';
+  import EmptyCard from './EmptyCard.svelte';
+  import Icon from './Icon.svelte';
+  import Panel from './Panel.svelte';
+  import Toolbar from './Toolbar.svelte';
+  import CanvasControls from '../CanvasControls.svelte';
+  import Zone from './Zone.svelte';
+
+  // The page's [data-environment-canvas] element; it does not change while the canvas is mounted.
+  let { container } = $props();
+
+  // svelte-ignore state_referenced_locally
+  const ds = container.dataset;
+  const connectView = ds.mode === 'variables' || ds.mode === 'tags';
+  const text = CONNECT_TEXT[ds.mode] || CONNECT_TEXT.variables;
+  const params = new URLSearchParams(window.location.search);
+  const serverView = !!ds.endpoint && !connectView;
+  const filterView = connectView || serverView;
+  const base = ds.endpoint || `/projects/${encodeURIComponent(ds.project || '')}/environments/${encodeURIComponent(ds.environment || '')}/canvas`;
+  // Table / grid / canvas switcher from the page (Blade), moved into the toolbar.
+  // svelte-ignore state_referenced_locally
+  const views = container.querySelector('[data-ec-views]');
+  const viewOnlyTitle = connectView
+    ? text.viewOnly
+    : ds.viewOnly ? ds.viewOnly
+    : serverView
+      ? 'The server view is read-only. Move cards and edit links on an environment canvas.'
+      : 'You can look around. Only team admins can move cards and edit links.';
+
+  // ── State ──
+  let full = $state.raw(null); // the loaded graph; graph is it after the project / environment filter
+  let graph = $state.raw(null);
+  let positions = $state({});
+  let sizes = $state.raw({});
+  let selected = $state.raw(null); // { kind: 'node' | 'link', id }
+  let filter = $state.raw(filterView ? { project: params.get('project') || '', environment: params.get('environment') || '' } : {});
+  let hover = $state(null);
+  let pending = $state.raw([]); // links being saved: { source, target }, drawn as moving dashes until the request ends
+  let temp = $state.raw(null); // the link being drawn: { from, to }
+  let dropTarget = $state(null);
+  let loading = $state(false);
+  let error = $state(null);
+  let toastMessage = $state.raw(null);
+  let zoom = $state(1);
+  let panelTop = $state('');
+  let showNotice = $state(noticeOpen());
+
+  // Plain bookkeeping (not rendered).
+  let view = { x: 40, y: 40, z: 1 };
+  const interactions = new Set(); // active drags; refetches wait until they end
+  let deferred = null;
+  const unsaved = {};
+  // Saved moves stay on the canvas until a load that started after the save returns them, so an older
+  // response (a poll or status refresh during the drag or the request) cannot put the cards back for a moment.
+  const settling = { positions: {}, saved: {} }; // id -> { at, after: load number the save finished at }
+  let loads = 0;
+  let reloadQueued = false;
+  let fitted = false;
+  let destroyed = false;
+  let containers = null; // server canvas: unmanaged container cards, loaded after the canvas renders
+  let usage = $state({}); // server canvas: latest CPU, memory and disk usage per server zone
+  const USAGE_POLL_MS = 30000;
+  const timers = { save: 0, refresh: 0, toast: 0, view: 0 };
+  // Zoom and pan are kept per team and page, so a reload opens the canvas where it was.
+  const viewKey = `coolify-canvas-view:${ds.team || ''}:${window.location.pathname}`;
+  let restoredView = readView(viewKey);
+  if (restoredView) view = restoredView;
+
+  let rootEl;
+  let bodyEl;
+  let barSlot;
+  let viewport;
+  let bar;
+  let pz;
+
+  const canEdit = $derived(!!graph?.can_edit);
+  // Only the environment canvas has its own card positions; server and project views save on it (canMoveGroups).
+  const canMove = $derived(canEdit && graph?.can_move !== false);
+  // Server canvas: admins drag whole project / environment groups and their cards; each environment saves them.
+  const canMoveGroups = $derived(canEdit && !!graph?.can_move_groups);
+  /** Server view: key of the card's group when the card can be moved there (it is saved on its environment canvas). */
+  const movableGroupOf = node => (canMoveGroups && node ? groupKey([node], node.zone) : null);
+  let groupMeta = {}; // server view: frame top-left and zone inner top-left per group key (see layoutServerView)
+  // Environment canvas endpoints of a card (the server view has no endpoints of its own for changes).
+  const environmentBase = node => (serverView
+    ? `/projects/${encodeURIComponent(node?.project?.uuid || '')}/environments/${encodeURIComponent(node?.environment?.uuid || '')}/canvas`
+    : base);
+  const nodeById = id => graph?.nodes.find(n => n.id === id);
+  const linkById = id => graph?.links.find(l => l.id === id);
+  const rectOf = id => {
+    const node = nodeById(id);
+    return node ? cardRect(node, positions, sizes) : null;
+  };
+  const zoneNames = node => {
+    const names = new Map((graph?.zones || []).map(z => [z.id, z.name]));
+    return [node.zone, ...(node.extra_zones || [])].filter(Boolean).map(id => names.get(id) || id);
+  };
+  const toBox = r => ({ x: r.x, y: r.y, w: r.width, h: r.height });
+
+  // ── Derived view data ──
+  const projects = $derived(filterView ? filterOptions(full) : []);
+  const environments = $derived(projects
+    .filter(p => !filter.project || p.uuid === filter.project)
+    .flatMap(p => p.environments.map(e => ({ uuid: e.uuid, name: filter.project ? e.name : `${p.name} / ${e.name}` }))));
+  const boxes = $derived(graph ? zoneBoxes(graph, positions, sizes) : []);
+  const downZones = $derived(unreachableZones(graph));
+  // Server and connect views: project / environment frames inside the zones.
+  const frames = $derived(graph?.layout === 'server' || graph?.layout === 'connect'
+    ? zoneGroups(graph).flatMap(zone => groupFrames(zone.nodes.filter(n => n.context), positions, sizes))
+    : []);
+  // Connect view: links per source card (its "used by" badge).
+  const linkCounts = $derived.by(() => {
+    const counts = {};
+    for (const l of graph?.links || []) counts[l.source] = (counts[l.source] || 0) + 1;
+    return counts;
+  });
+  const shapes = $derived.by(() => {
+    const out = [];
+    for (const link of graph?.links || []) {
+      const a = rectOf(link.source);
+      const b = rectOf(link.target);
+      if (!a || !b) continue;
+      const isSelected = selected?.kind === 'link' && selected.id === link.id;
+      const related = hover && (link.source === hover || link.target === hover);
+      out.push({
+        link,
+        ...linkPath(a, b),
+        selected: isSelected,
+        faded: hover && !related,
+        stroke: isSelected ? 'fill-none stroke-coollabs dark:stroke-warning'
+          : link.missing ? `ec-missing fill-none stroke-red-400 dark:stroke-red-400/70 ${hover && !related ? 'opacity-20' : ''}`
+          : related ? 'fill-none stroke-neutral-700 dark:stroke-white/80'
+          : hover ? 'fill-none stroke-neutral-400 opacity-20 dark:stroke-white/40'
+          : 'fill-none stroke-neutral-400 dark:stroke-white/35',
+        title: connectView
+          ? `${nodeById(link.source)?.name || ''} → ${nodeById(link.target)?.name || ''} (click to open)`
+          : link.label ? `${link.label} (click to open)` : 'Click to open this link',
+      });
+    }
+    return out;
+  });
+  const pendingPaths = $derived(pending.map(p => [rectOf(p.source), rectOf(p.target)]).filter(([a, b]) => a && b).map(([a, b]) => linkPath(a, b).d));
+  const tempPath = $derived.by(() => {
+    if (!temp) return null;
+    const { from, to } = temp;
+    const dx = Math.max(40, Math.abs(to.x - from.x) / 2);
+    return `M ${from.x} ${from.y} C ${from.x + dx} ${from.y}, ${to.x - dx} ${to.y}, ${to.x} ${to.y}`;
+  });
+  const panelNode = $derived(selected?.kind === 'node' ? nodeById(selected.id) : null);
+  const panelLink = $derived(selected?.kind === 'link' ? linkById(selected.id) : null);
+  const empty = $derived(!!graph && !graph.nodes.length);
+
+  // ── Mobile notice ──
+  // Small screens: a notice that the canvas is not optimized for mobile. Shown below 768px (md);
+  // closed once, it stays closed on every canvas (same key as the deploy canvas notice).
+  function noticeOpen() {
+    try {
+      return !JSON.parse(localStorage.getItem(MOBILE_NOTICE_KEY));
+    } catch {
+      return true; // Storage blocked: show the notice.
+    }
+  }
+  function closeNotice() {
+    try {
+      localStorage.setItem(MOBILE_NOTICE_KEY, 'true');
+    } catch {
+      // Storage blocked: closed until the next page load.
+    }
+    showNotice = false;
+  }
+
+  // ── Toolbar placement ──
+  const desktop = window.matchMedia('(min-width: 1024px)');
+  // Floating nav on desktop: a separate panel in the top bar row, centered over the canvas,
+  // so the top bar keeps only the brand and breadcrumb.
+  const topbar = document.querySelector('.app-topbar');
+  const floatingBar = () => desktop.matches && !!topbar && document.documentElement.dataset.navStyle === 'floating';
+  // Floating nav: the canvas fills the screen behind the top bar and the sidebar (see app.css),
+  // so fit and the side panel use only the part that the floating panels do not cover.
+  function coveredInsets() {
+    const gap = 8;
+    const v = viewport.getBoundingClientRect();
+    // The bottom-left controls and deployments sit below the cards; fit keeps no side space for them.
+    const deploymentsRight = 0;
+    if (!floatingBar()) return { top: 0, left: Math.max(0, deploymentsRight) };
+    // The main sidebar, and a page's fixed settings rail (server canvas) when it is on the left.
+    const rail = document.querySelector('.application-settings-navigation');
+    const panels = [document.querySelector('.app-sidebar > div > nav'), rail && getComputedStyle(rail).position === 'fixed' ? rail : null]
+      .map(el => el?.getBoundingClientRect())
+      .filter(r => r?.width);
+    // The toolbar is in the top bar row, or in a row below it when the top bar has no room (see alignFloatingBar).
+    const barBottom = bar?.isConnected && !inControls() ? bar.getBoundingClientRect().bottom : 0;
+    return {
+      top: Math.max(0, Math.max(topbar.getBoundingClientRect().bottom, barBottom) + gap - v.top),
+      left: Math.max(0, deploymentsRight, ...panels.map(r => r.right + gap - v.left)),
+    };
+  }
+  /** Desktop: the toolbar sits in the zoom controls bar (bottom left), not in its own panel. */
+  const inControls = () => !!bar?.closest('[data-canvas-controls]');
+  function alignFloatingBar() {
+    if (!floatingBar()) {
+      panelTop = '';
+      return;
+    }
+    if (inControls()) {
+      panelTop = `${coveredInsets().top}px`;
+      return;
+    }
+    const gap = 8;
+    const area = bodyEl.getBoundingClientRect();
+    const head = topbar.getBoundingClientRect();
+    const insetLeft = coveredInsets().left;
+    // Measure the full toolbar width, then use the top bar row only when it fits next to the top bar
+    // (a page can dock wide actions in the top bar, e.g. the server canvas).
+    Object.assign(bar.style, { left: '0px', maxWidth: '' });
+    const width = bar.offsetWidth;
+    const besideHead = head.right + gap + width <= window.innerWidth - gap;
+    const left = Math.max(area.left + insetLeft + (area.width - insetLeft - width) / 2, besideHead ? head.right + gap : area.left + insetLeft);
+    const top = besideHead ? head.top : head.bottom + gap;
+    Object.assign(bar.style, { top: `${top}px`, left: `${left}px`, minHeight: `${head.height}px`, maxWidth: `${window.innerWidth - left - gap}px` });
+    panelTop = `${coveredInsets().top}px`;
+  }
+  function placeBar() {
+    // Desktop (every nav style): the toolbar joins the zoom controls bar at the bottom left.
+    // Small screens: a rounded box above the canvas.
+    bar.removeAttribute('style');
+    if (desktop.matches) {
+      bar.className = 'ml-0.5 flex items-center gap-2 border-l border-neutral-200 pr-0.5 pl-2 dark:border-white/[0.08]';
+      rootEl.querySelector('[data-canvas-controls]').append(bar);
+      alignFloatingBar();
+    } else {
+      bar.className = 'flex shrink-0 flex-wrap items-center gap-3 rounded-lg border border-neutral-200 bg-white px-3 py-2.5 dark:border-white/[0.08] dark:bg-panel';
+      barSlot.append(bar);
+      panelTop = '';
+    }
+  }
+  /** Action: the toolbar element; onMount docks it (top bar slot, floating panel, or above the canvas). */
+  function dock(node) {
+    bar = node;
+    // The toolbar can live outside the canvas root (top bar slot), so remove it here.
+    return { destroy: () => node.remove() };
+  }
+  function watchToolbar() {
+    placeBar();
+    desktop.addEventListener('change', placeBar);
+    window.addEventListener('resize', alignFloatingBar);
+    const navStyleObserver = new MutationObserver(placeBar);
+    navStyleObserver.observe(document.documentElement, { attributes: true, attributeFilter: ['data-nav-style'] });
+    // Sidebar collapse, breadcrumb changes and toolbar content change the sizes.
+    const resizeObserver = new ResizeObserver(alignFloatingBar);
+    for (const el of [bodyEl, bar, topbar].filter(Boolean)) resizeObserver.observe(el);
+    return () => {
+      desktop.removeEventListener('change', placeBar);
+      window.removeEventListener('resize', alignFloatingBar);
+      navStyleObserver.disconnect();
+      resizeObserver.disconnect();
+    };
+  }
+
+  // ── Toast ──
+  function toast(message, bad = false) {
+    toastMessage = { text: message, bad };
+    clearTimeout(timers.toast);
+    timers.toast = setTimeout(() => (toastMessage = null), bad ? 5000 : 2600);
+  }
+
+  // ── View ──
+  /** Action: wheel / pinch zoom and drag-to-pan on the viewport (canvas-core panZoom). */
+  function panZoomAction(node) {
+    pz = panZoom({
+      root: node.closest('[data-ec-root]'),
+      viewport: node,
+      world: node.firstElementChild,
+      zoomLabel: {}, // CanvasControls shows `zoom`
+      getView: () => view,
+      onChange: () => {
+        zoom = view.z;
+        clearTimeout(timers.view);
+        timers.view = setTimeout(saveView, 300);
+      },
+      canPan: e => !e.target.closest('[data-ec-card],[data-ec-zone-header],[data-ec-group-header],[data-ec-label],[data-ec-link],a,button,input'),
+      onPanEnd: moved => {
+        if (!moved) closePanel();
+      },
+    });
+  }
+  function saveView() {
+    clearTimeout(timers.view);
+    try {
+      localStorage.setItem(viewKey, JSON.stringify(view));
+    } catch {
+      // Storage full or blocked: the canvas fits to the screen next time.
+    }
+  }
+  /** Shows every card; the first fit of a load keeps them readable (see fitView). */
+  function fit({ readable = false } = {}) {
+    const all = graph ? zoneBoxes(graph, positions, sizes) : [];
+    const r = viewport.getBoundingClientRect();
+    const inset = coveredInsets();
+    if (!all.length || !r.width) {
+      view = { x: inset.left + 40, y: inset.top + 40, z: 1 };
+      pz.apply();
+      return;
+    }
+    const bounds = {
+      minX: Math.min(...all.map(b => b.x)),
+      minY: Math.min(...all.map(b => b.y)),
+      maxX: Math.max(...all.map(b => b.x + b.width)),
+      maxY: Math.max(...all.map(b => b.y + b.height)),
+    };
+    view = fitView(bounds, { left: inset.left, top: inset.top, width: r.width - inset.left, height: r.height - inset.top }, readable);
+    pz.apply();
+  }
+
+  function setFilter(next) {
+    filter = next;
+    const url = new URL(window.location.href);
+    for (const key of ['project', 'environment']) {
+      if (next[key]) url.searchParams.set(key, next[key]);
+      else url.searchParams.delete(key);
+    }
+    window.history.replaceState(window.history.state, '', url);
+    fitted = false;
+    applyGraph(full);
+  }
+
+  function measure() {
+    const next = {};
+    for (const el of rootEl.querySelectorAll('[data-ec-card]')) {
+      if (el.offsetWidth) next[el.dataset.id] = { width: el.offsetWidth, height: el.offsetHeight };
+    }
+    sizes = next;
+  }
+
+  // ── Selection ──
+  function select(selection) {
+    selected = selection;
+  }
+  /** Dashboard deployment panel: centres the card at 100% and selects it. */
+  function showNode(id) {
+    const at = positions[id];
+    if (!at) return;
+    const size = sizes[id] || { width: 260, height: 100 };
+    const r = viewport.getBoundingClientRect();
+    view = { z: 1, x: r.width / 2 - at.x - size.width / 2, y: r.height / 2 - at.y - size.height / 2 };
+    pz.apply();
+    select({ kind: 'node', id });
+  }
+  function closePanel() {
+    if (selected) select(null);
+  }
+
+  /** Changes the shown graph; the loaded graph too when no filter made a copy of it. */
+  function patchGraph(changes) {
+    const same = full === graph;
+    graph = { ...graph, ...changes };
+    if (same) full = graph;
+  }
+
+  function replaceLink(link) {
+    patchGraph({ links: graph.links.map(l => (l.id === link.id ? link : l)) });
+  }
+
+  async function saveLabel(link, value) {
+    try {
+      const updated = await api('PATCH', `${environmentBase(nodeById(link.source))}/links/${encodeURIComponent(link.id)}`, { label: value || null });
+      replaceLink({ ...link, ...(updated?.id ? updated : { label: value || null }) });
+      toast('Label saved.');
+      return true;
+    } catch (e) {
+      toast(e.message, true);
+      return false;
+    }
+  }
+
+  async function deleteLink(link) {
+    try {
+      await api('DELETE', `${environmentBase(nodeById(link.source))}/links/${encodeURIComponent(link.id)}`);
+      patchGraph({ links: graph.links.filter(l => l.id !== link.id) });
+      select(null);
+      toast('Link removed.');
+    } catch (e) {
+      toast(e.message, true);
+    }
+  }
+
+  // Connect view: removes a variable from a resource, or a tag.
+  async function removeLink(link) {
+    const variable = nodeById(link.source);
+    const resource = nodeById(link.target);
+    try {
+      await api('DELETE', `${base}/links/${encodeURIComponent(link.id)}`);
+      if (destroyed) return;
+      if (selected?.kind === 'link') selected = { kind: 'node', id: link.source };
+      setLinks(full.links.filter(l => l.id !== link.id));
+      toast(text.removed(variable?.name, resource?.name));
+      load({ quiet: true });
+    } catch (e) {
+      toast(e.message, true);
+    }
+  }
+
+  // ── Interactions ──
+  function begin(key) {
+    interactions.add(key);
+  }
+  function end(key) {
+    interactions.delete(key);
+    if (!interactions.size && deferred) {
+      const next = deferred;
+      deferred = null;
+      applyGraph(next);
+    }
+  }
+  function capture(el, pointerId) {
+    try {
+      el.setPointerCapture(pointerId);
+    } catch {
+      // Synthetic or already released pointer; window-level fallbacks are not needed for real pointers.
+    }
+  }
+  /** Follows a captured pointer on `el` until it is released. */
+  function track(el, move, up) {
+    const release = () => {
+      el.removeEventListener('pointermove', move);
+      el.removeEventListener('pointerup', release);
+      el.removeEventListener('pointercancel', release);
+      up();
+    };
+    el.addEventListener('pointermove', move);
+    el.addEventListener('pointerup', release);
+    el.addEventListener('pointercancel', release);
+  }
+
+  function hoverCard(id, on) {
+    if (on && !interactions.size) hover = id;
+    else if (!on && hover === id) hover = null;
+  }
+
+  function startCardDrag(id, card, e) {
+    if (e.button !== 0 || e.target.closest('a,button,input,[data-ec-port]')) return;
+    e.stopPropagation();
+    const start = { cx: e.clientX, cy: e.clientY, ...positions[id] };
+    const key = movableGroupOf(nodeById(id));
+    const meta = key ? groupMeta[key] : null;
+    const movable = canMove || !!meta;
+    // The other cards and frames stay put during the drag, so measure them once.
+    const rules = dragRules(graph, positions, sizes, id);
+    // Server view: the group frame stays inside its zone, below the zone header.
+    const fits = meta
+      ? b => b.x >= meta.inner.x + GROUP_PADDING && b.y >= meta.inner.y + GROUP_HEADER + GROUP_PADDING && rules.fits(b)
+      : rules.fits;
+    let moved = false;
+    capture(card, e.pointerId);
+    begin(`card:${id}`);
+    track(card, ev => {
+      if (!moved && Math.hypot(ev.clientX - start.cx, ev.clientY - start.cy) < 4) return;
+      if (!movable) return;
+      const rect = rectOf(id);
+      const wanted = { x: start.x + (ev.clientX - start.cx) / view.z, y: start.y + (ev.clientY - start.cy) / view.z, w: rect.width, h: rect.height };
+      // Cards cannot cover each other or another zone: stop at the edge of what is in the way.
+      const spot = freeSpot(wanted, rules.others, BOX_GAP, fits);
+      if (!spot) return;
+      moved = true;
+      positions[id] = { x: spot.x, y: spot.y };
+    }, () => {
+      // Server view: save the whole group, so its other cards keep the place they have here.
+      if (moved && meta) saveGroup(graph.nodes.filter(n => groupKey([n], n.zone) === key).map(n => n.id), meta.shift);
+      else if (moved) queueSave({ [id]: { ...positions[id] } });
+      else select({ kind: 'node', id });
+      end(`card:${id}`);
+    });
+  }
+
+  function startZoneDrag(box, header, e) {
+    if (e.button !== 0 || !canMove || e.target.closest('a')) return;
+    e.stopPropagation();
+    const ids = box.nodes.filter(id => positions[id]);
+    const starts = Object.fromEntries(ids.map(id => [id, { ...positions[id] }]));
+    const origin = { cx: e.clientX, cy: e.clientY };
+    // Zones cannot cover each other: the frame stops at the edge of another zone.
+    const zone = toBox(box);
+    const others = zoneBoxes(graph, positions, sizes).filter(z => z.id !== box.id).map(toBox);
+    let moved = false;
+    capture(header, e.pointerId);
+    begin('zone');
+    track(header, ev => {
+      if (!moved && Math.hypot(ev.clientX - origin.cx, ev.clientY - origin.cy) < 4) return;
+      const spot = freeSpot({ ...zone, x: zone.x + (ev.clientX - origin.cx) / view.z, y: zone.y + (ev.clientY - origin.cy) / view.z }, others);
+      if (!spot) return;
+      moved = true;
+      const dx = spot.x - zone.x;
+      const dy = spot.y - zone.y;
+      for (const id of ids) positions[id] = { x: starts[id].x + dx, y: starts[id].y + dy };
+    }, () => {
+      if (moved) queueSave(Object.fromEntries(ids.map(id => [id, { ...positions[id] }])));
+      end('zone');
+    });
+  }
+
+  /** Server view: drag a project / environment group inside its server zone; it cannot cover another group. */
+  function startGroupDrag(frame, header, e) {
+    if (e.button !== 0 || !canMoveGroups || !frame.key || !groupMeta[frame.key] || e.target.closest('a')) return;
+    e.stopPropagation();
+    const meta = groupMeta[frame.key];
+    const ids = graph.nodes.filter(n => groupKey([n], n.zone) === frame.key).map(n => n.id);
+    const starts = Object.fromEntries(ids.map(id => [id, { ...positions[id] }]));
+    const box = toBox(frame);
+    const others = frames.filter(f => f !== frame && f.zone === frame.zone).map(toBox);
+    const fits = b => b.x >= meta.inner.x && b.y >= meta.inner.y;
+    const origin = { cx: e.clientX, cy: e.clientY };
+    let moved = false;
+    capture(header, e.pointerId);
+    begin('group');
+    track(header, ev => {
+      if (!moved && Math.hypot(ev.clientX - origin.cx, ev.clientY - origin.cy) < 4) return;
+      const wanted = { ...box, x: Math.max(meta.inner.x, box.x + (ev.clientX - origin.cx) / view.z), y: Math.max(meta.inner.y, box.y + (ev.clientY - origin.cy) / view.z) };
+      // Same gap as layoutServerView, so a reload does not move the group.
+      const spot = freeSpot(wanted, others, GROUP_GAP, fits);
+      if (!spot) return;
+      moved = true;
+      for (const id of ids) positions[id] = { x: starts[id].x + spot.x - box.x, y: starts[id].y + spot.y - box.y };
+    }, () => {
+      if (moved) saveGroup(ids, meta.shift);
+      end('group');
+    });
+  }
+
+  /**
+   * Saves the cards of a moved group on their environment canvas (the server canvas has no positions of its own),
+   * so the group keeps its place here and moves by the same distance on the environment canvas.
+   */
+  async function saveGroup(ids, shift) {
+    const saved = Object.fromEntries(ids.map(id => [id, { x: Math.round(positions[id].x - shift.x), y: Math.round(positions[id].y - shift.y) }]));
+    hold(settling.saved, saved);
+    try {
+      await api('PATCH', `${environmentBase(nodeById(ids[0]))}/positions`, { positions: saved });
+      settle(settling.saved, saved);
+      if (!destroyed) applyGraph(full);
+    } catch (e) {
+      release(settling.saved, saved);
+      if (destroyed) return;
+      toast(e.message, true);
+      load({ quiet: true });
+    }
+  }
+
+  function startConnect(id, port, e) {
+    if (e.button !== 0 || !canEdit) return;
+    e.stopPropagation();
+    e.preventDefault();
+    const a = rectOf(id);
+    if (!a) return;
+    const from = { x: a.x + a.width, y: a.y + a.height / 2 };
+    capture(port, e.pointerId);
+    begin('connect');
+    hover = null;
+    track(port, ev => {
+      temp = { from, to: pz.toWorld(ev.clientX, ev.clientY) };
+      const tid = document.elementFromPoint(ev.clientX, ev.clientY)?.closest?.('[data-ec-card]')?.dataset.id;
+      dropTarget = tid && canConnect(graph, id, tid) ? tid : null;
+    }, async () => {
+      const chosen = dropTarget;
+      dropTarget = null;
+      temp = null;
+      if (chosen) await createLink(id, chosen);
+      end('connect');
+    });
+  }
+
+  async function createLink(source, target) {
+    if (!canLink(graph.links, source, target)) {
+      toast(connectView ? text.already(nodeById(source)?.name, nodeById(target)?.name) : 'These resources are already linked.', true);
+      return;
+    }
+    const entry = { source, target };
+    pending = [...pending, entry];
+    try {
+      const link = await api('POST', `${environmentBase(nodeById(source))}/links`, { source, target });
+      if (destroyed) return;
+      if (connectView) {
+        // Keep the panel of the card the user added from (either end); otherwise open the source.
+        const keep = selected?.kind === 'node' && (selected.id === source || selected.id === target);
+        if (!keep) selected = { kind: 'node', id: source };
+        if (link?.id) setLinks([...full.links.filter(l => l.id !== link.id), link]);
+        else applyGraph(full);
+        toast(text.added(nodeById(source)?.name, nodeById(target)?.name));
+        load({ quiet: true });
+        return;
+      }
+      const created = link?.data?.id ? link.data : link;
+      if (created?.id) {
+        patchGraph({ links: [...graph.links.filter(l => l.id !== created.id), created] });
+        select({ kind: 'link', id: created.id });
+        await tick();
+        rootEl.querySelector('[data-ec-label-input]')?.focus();
+      } else {
+        load({ quiet: true });
+      }
+    } catch (e) {
+      toast(e.message, true);
+    } finally {
+      pending = pending.filter(p => p !== entry);
+    }
+  }
+
+  // Double-click on a card opens its page. Tracked on pointerdown (capture phase, before drags start):
+  // the first click re-renders the card and can open the side panel over it, so the second press can land on
+  // another element. Two presses at the same point open the page of the first one.
+  let lastOpen = null;
+  function openOnDoubleClick(e) {
+    const own = e.button !== 0 || e.target.closest('a,button,input,[data-ec-port]');
+    const again = !own && lastOpen && e.timeStamp - lastOpen.at < DOUBLE_CLICK_MS
+      && Math.hypot(e.clientX - lastOpen.x, e.clientY - lastOpen.y) < 6;
+    if (again) {
+      e.preventDefault();
+      e.stopPropagation();
+      window.location.assign(lastOpen.href);
+      lastOpen = null;
+      return;
+    }
+    const href = own ? null : e.target.closest('[data-ec-open]')?.dataset.ecOpen;
+    lastOpen = href ? { href, at: e.timeStamp, x: e.clientX, y: e.clientY } : null;
+  }
+
+  // ── Persistence ──
+  function queueSave(map) {
+    Object.assign(unsaved, map);
+    clearTimeout(timers.save);
+    timers.save = setTimeout(() => flushSave(), 400);
+  }
+  async function flushSave(options = {}) {
+    clearTimeout(timers.save);
+    const batch = { ...unsaved };
+    const ids = Object.keys(batch);
+    if (!ids.length || !graph) return;
+    const rounded = Object.fromEntries(ids.map(id => [id, { x: Math.round(batch[id].x), y: Math.round(batch[id].y) }]));
+    hold(settling.positions, rounded);
+    for (const id of ids) if (unsaved[id] === batch[id]) delete unsaved[id];
+    try {
+      await api('PATCH', `${base}/positions`, { positions: rounded }, options);
+      settle(settling.positions, rounded);
+      if (graph && !destroyed) patchGraph({ positions: { ...(graph.positions || {}), ...rounded } });
+    } catch (e) {
+      release(settling.positions, rounded);
+      if (destroyed) return;
+      toast(e.message, true);
+      load({ quiet: true });
+    }
+  }
+
+  /** Keeps moves that are being saved on the canvas (see settling). */
+  function hold(map, moves) {
+    for (const [id, at] of Object.entries(moves)) map[id] = { at, after: Infinity };
+  }
+  /** The save is done: loads that start from now on return the moves, so they can replace them. */
+  function settle(map, moves) {
+    for (const id of Object.keys(moves)) if (map[id]?.at === moves[id]) map[id].after = loads;
+  }
+  function release(map, moves) {
+    for (const id of Object.keys(moves)) if (map[id]?.at === moves[id]) delete map[id];
+  }
+  /** A load that started after the save returned the saved moves. */
+  function dropSettled(started) {
+    for (const map of Object.values(settling)) for (const [id, entry] of Object.entries(map)) if (entry.after < started) delete map[id];
+  }
+
+  // ── Data ──
+  /** Shared variables view: a link change moves its resource in or out of the connected zone right away. */
+  function setLinks(links) {
+    applyGraph({ ...full, links });
+  }
+
+  function applyGraph(next) {
+    if (destroyed) return;
+    if (interactions.size) {
+      deferred = next;
+      return;
+    }
+    next.zones ||= [];
+    next.nodes ||= [];
+    next.links ||= [];
+    next.positions = next.positions && !Array.isArray(next.positions) ? next.positions : {};
+    // Local moves that are not saved yet (or not loaded back yet) stay where the user put them.
+    const kept = Object.fromEntries(Object.entries(settling.positions).map(([id, s]) => [id, s.at]));
+    next.positions = { ...next.positions, ...kept, ...Object.fromEntries(Object.entries(unsaved).map(([id, p]) => [id, { x: p.x, y: p.y }])) };
+    if (Object.keys(settling.saved).length) next.nodes = next.nodes.map(n => (settling.saved[n.id] ? { ...n, saved: settling.saved[n.id].at } : n));
+    full = next;
+    const shown = groupByUse(filterGraph(next, filter));
+    groupMeta = {};
+    positions = shown.layout === 'server' ? layoutServerView(shown, groupMeta) : layoutGraph(shown);
+    graph = shown;
+    error = null;
+    if (hover && !nodeById(hover)) hover = null;
+    if (selected && !(selected.kind === 'node' ? nodeById(selected.id) : linkById(selected.id))) selected = null;
+    // Render the cards now and measure them, so frames, links and fit use their real sizes.
+    flushSync();
+    measure();
+    flushSync();
+    if (!fitted) {
+      fitted = true;
+      // The first load keeps a saved view; later refits (filter changes) fit again.
+      if (restoredView) restoredView = null;
+      else fit({ readable: true });
+      // Connect view: ?select=<card id> (from a variable's or tag's connect button) opens that card.
+      const wanted = connectView && params.get('select');
+      if (wanted && !selected && nodeById(wanted)) select({ kind: 'node', id: wanted });
+      params.delete('select');
+    }
+  }
+
+  async function load({ quiet = false } = {}) {
+    if (destroyed) return;
+    if (loading) {
+      reloadQueued = true;
+      return;
+    }
+    loading = true;
+    const started = ++loads;
+    try {
+      const next = await api('GET', base);
+      dropSettled(started);
+      if (next && containers) next.nodes = [...(next.nodes || []), ...containers];
+      applyGraph(next);
+      if (!quiet && fitted && next) toast('Canvas refreshed.');
+      // Status refreshes keep the containers; the first load and the Refresh button read them again.
+      if (next?.containers_endpoint && (!quiet || !containers)) loadContainers(next.containers_endpoint);
+      if (!quiet || !Object.keys(usage).length) loadUsage();
+    } catch (e) {
+      if (destroyed) return;
+      if (graph) toast(e.message, true);
+      else error = e.message;
+    } finally {
+      loading = false;
+      if (!destroyed && reloadQueued) {
+        reloadQueued = false;
+        load({ quiet: true });
+      }
+    }
+  }
+
+  /** Server canvas: adds the unmanaged containers. This runs a command on the server, so the canvas does not wait for it. */
+  async function loadContainers(path) {
+    containers ||= []; // status refreshes during this request do not start another one
+    try {
+      const { nodes = [] } = (await api('GET', path)) || {};
+      if (destroyed || !full) return;
+      containers = nodes;
+      applyGraph({ ...full, nodes: [...full.nodes.filter(n => n.type !== 'container'), ...nodes] });
+    } catch {
+      // The server zone already shows when the server is not reachable.
+    }
+  }
+
+  /** Server canvas: live usage per server, after the canvas renders (Sentinel answers through SSH). */
+  function loadUsage() {
+    for (const zone of full?.zones || []) {
+      const path = zone.details?.usage_endpoint;
+      if (!path) continue;
+      api('GET', path)
+        .then(data => {
+          if (!destroyed && data) usage = { ...usage, [zone.id]: data };
+        })
+        .catch(() => {
+          // Usage is optional; the header shows the other server details.
+        });
+    }
+  }
+
+  function scheduleRefresh(delay = 1000) {
+    clearTimeout(timers.refresh);
+    timers.refresh = setTimeout(() => load({ quiet: true }), delay);
+  }
+
+  function onKeydown(e) {
+    if (e.key === 'Escape' && selected && !e.defaultPrevented) closePanel();
+  }
+  function onVisibility() {
+    if (document.visibilityState === 'visible') scheduleRefresh(300);
+  }
+  function onPageHide() {
+    saveView();
+    if (Object.keys(unsaved).length) flushSave({ keepalive: true });
+  }
+
+  onMount(() => {
+    // Live status: application and service events go to the team channel; database events to the user channel.
+    const onStatus = () => scheduleRefresh();
+    const cleanups = [watchToolbar()];
+    for (const [kind, events] of STATUS_CHANNELS) {
+      if (!window.Echo || !ds[kind]) continue;
+      try {
+        const channel = window.Echo.private(`${kind}.${ds[kind]}`);
+        for (const event of events) channel.listen(event, onStatus);
+        cleanups.push(() => {
+          for (const event of events) channel.stopListening(event, onStatus);
+        });
+      } catch {
+        // Live updates are optional; Refresh still works.
+      }
+    }
+
+    // data-poll (seconds): reload while the page is visible, for changes without a broadcast event (dashboard deployments).
+    if (Number(ds.poll) > 0) {
+      const poll = setInterval(() => {
+        if (document.visibilityState === 'visible') load({ quiet: true });
+      }, Number(ds.poll) * 1000);
+      cleanups.push(() => clearInterval(poll));
+    }
+
+    const usagePoll = setInterval(() => {
+      if (document.visibilityState === 'visible') loadUsage();
+    }, USAGE_POLL_MS);
+    cleanups.push(() => clearInterval(usagePoll));
+
+    pz.apply();
+    load({ quiet: true });
+
+    return () => {
+      saveView();
+      if (Object.keys(unsaved).length) flushSave({ keepalive: true });
+      destroyed = true;
+      clearTimeout(timers.save);
+      clearTimeout(timers.refresh);
+      clearTimeout(timers.toast);
+      clearTimeout(timers.view);
+      for (const cleanup of cleanups) cleanup();
+    };
+  });
+</script>
+
+<svelte:document onkeydown={onKeydown} onvisibilitychange={onVisibility} />
+<svelte:window onpagehide={onPageHide} />
+
+<!-- Same look as the deploy canvas: a rounded top bar box on the backdrop. -->
+<div
+  bind:this={rootEl}
+  class="absolute inset-0 z-0 flex flex-col gap-2 overflow-hidden bg-neutral-50 p-2 text-[13px] text-neutral-700 dark:bg-app dark:text-fg-dim"
+  data-ec-root
+  onpointerdowncapture={openOnDoubleClick}
+>
+  <!-- The toolbar's place above the canvas; use:dock moves it into the top bar when there is room. -->
+  <div bind:this={barSlot} class="contents">
+    <Toolbar
+      viewOnly={!!graph && !canEdit}
+      {viewOnlyTitle}
+      {filter}
+      {projects}
+      {environments}
+      {views}
+      {dock}
+      onfilter={setFilter}
+    />
+  </div>
+
+  {#if showNotice}
+    <div class="flex shrink-0 items-start gap-2 rounded-xl bg-red-600 py-2.5 pr-2 pl-3 text-[12.5px] leading-[1.125rem] text-white md:hidden" data-ec-mobile-notice role="note">
+      <Icon name="info" class="size-4 mt-px" />
+      <p class="min-w-0 flex-1">The canvas is not optimized for mobile yet. It works best on a larger screen.</p>
+      <button type="button" class="grid size-6.5 shrink-0 -mt-0.75 place-items-center rounded-md hover:bg-white/20" title="Close" aria-label="Close this notice" onclick={closeNotice}>
+        <Icon name="x" class="size-4" />
+      </button>
+    </div>
+  {/if}
+
+  <div bind:this={bodyEl} class="relative min-h-0 flex-1">
+    <div
+      bind:this={viewport}
+      use:panZoomAction
+      class="absolute inset-0 cursor-grab touch-none overflow-hidden select-none bg-[radial-gradient(circle,rgb(0_0_0/0.13)_1px,transparent_1px)] active:cursor-grabbing dark:bg-[radial-gradient(circle,rgb(255_255_255/0.09)_1px,transparent_1px)]"
+      data-ec-viewport
+    >
+      <div class="absolute top-0 left-0 origin-top-left">
+        <div class="absolute top-0 left-0">
+          {#each boxes as box (box.id ?? '__none')}
+            <Zone {box} movable={canMove} nodes={box.nodes.map(nodeById).filter(Boolean)} usage={usage[box.id]} onpress={(e, header) => startZoneDrag(box, header, e)} />
+          {/each}
+        </div>
+        <!-- Server view: project / environment frames inside the server zones. -->
+        <div class="pointer-events-none absolute top-0 left-0">
+          {#each frames as frame, i (i)}
+            {@const movableGroup = canMoveGroups && !!frame.key}
+            <div class="absolute rounded-xl border border-dashed border-neutral-300 dark:border-white/[0.12]" style:left="{frame.x}px" style:top="{frame.y}px" style:width="{frame.width}px" style:height="{frame.height}px">
+              <!-- svelte-ignore a11y_no_static_element_interactions -->
+              <div
+                class="flex h-8 items-center gap-1.5 px-3 text-[11px] font-medium text-neutral-500 dark:text-fg-dim {movableGroup ? 'pointer-events-auto cursor-grab active:cursor-grabbing' : ''}"
+                data-ec-group-header
+                title={movableGroup ? 'Drag to move this group' : undefined}
+                onpointerdown={e => startGroupDrag(frame, e.currentTarget, e)}
+              >
+                <Icon name="service" class="size-3 text-neutral-400 dark:text-fg-faint" />
+                <a class="pointer-events-auto truncate hover:text-neutral-700 dark:hover:text-fg [&[href]]:cursor-pointer [&[href]]:underline-offset-2 [&[href]]:hover:underline" href={frame.link || undefined} draggable="false">{frame.name || 'Other'}</a>
+              </div>
+            </div>
+          {/each}
+        </div>
+        <svg class="pointer-events-none absolute top-0 left-0 overflow-visible" width="1" height="1">
+          {#each shapes as shape (shape.link.id)}
+            <path d={shape.d} stroke-width={shape.selected ? '2.5' : '1.75'} stroke-linecap="round" class="{shape.stroke} transition-opacity" />
+            <!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+            <path
+              d={shape.d}
+              fill="none"
+              stroke="transparent"
+              stroke-width="14"
+              pointer-events="stroke"
+              class="cursor-pointer"
+              data-ec-link={shape.link.id}
+              onclick={e => {
+                e.stopPropagation();
+                select({ kind: 'link', id: shape.link.id });
+              }}
+            ><title>{shape.title}</title></path>
+          {/each}
+          {#each pendingPaths as d, i (i)}
+            <path {d} stroke-width="2" stroke-linecap="round" class="ec-temp fill-none stroke-coollabs dark:stroke-warning" />
+          {/each}
+          {#if tempPath}
+            <path d={tempPath} stroke-width="2" stroke-linecap="round" class="ec-temp fill-none stroke-coollabs dark:stroke-warning" />
+          {/if}
+        </svg>
+        <div class="absolute top-0 left-0">
+          {#each shapes.filter(s => s.link.label) as shape (shape.link.id)}
+            <button
+              type="button"
+              class="absolute max-w-48 -translate-x-1/2 -translate-y-1/2 cursor-pointer truncate rounded-full border px-2 py-0.5 text-[11px] font-medium shadow-sm transition-opacity {shape.selected
+                ? 'border-coollabs bg-white text-coollabs dark:border-warning dark:bg-panel dark:text-warning'
+                : 'border-neutral-200 bg-white text-neutral-600 dark:border-white/[0.1] dark:bg-panel dark:text-fg-dim'} {shape.faded ? 'opacity-30' : ''}"
+              style:left="{shape.mid.x}px"
+              style:top="{shape.mid.y}px"
+              data-ec-label
+              onclick={e => {
+                e.stopPropagation();
+                select({ kind: 'link', id: shape.link.id });
+              }}
+            >{shape.link.label}</button>
+          {/each}
+        </div>
+        <div class="absolute top-0 left-0">
+          {#each graph?.nodes || [] as node (node.id)}
+            {#if node.type === 'empty'}
+              <EmptyCard {node} position={positions[node.id]} />
+            {:else}
+              <Card
+                {node}
+                position={positions[node.id]}
+                selected={selected?.kind === 'node' && selected.id === node.id}
+                dropTarget={dropTarget === node.id}
+                movable={canMove || !!movableGroupOf(node)}
+                port={canEdit && (connectView ? isSource(node) && !node.missing : !serverView || !!node.environment)
+                  ? (connectView ? text.port : 'Drag to another card to draw a link')
+                  : null}
+                linkCount={linkCounts[node.id] || 0}
+                zoneNames={zoneNames(node)}
+                serverDown={downZones.has(node.zone)}
+                statusText={graph?.layout === 'server'}
+                onpress={(e, card) => startCardDrag(node.id, card, e)}
+                onconnect={(e, port) => startConnect(node.id, port, e)}
+                onselect={() => select({ kind: 'node', id: node.id })}
+                onhover={on => hoverCard(node.id, on)}
+              />
+            {/if}
+          {/each}
+        </div>
+        <!-- Link end dots sit above the cards, on their edges (like the deploy canvas ports). -->
+        <div class="pointer-events-none absolute top-0 left-0">
+          {#each shapes as shape (shape.link.id)}
+            {#each [shape.from, shape.to] as at, i (i)}
+              <span
+                class="absolute size-3 -translate-x-1/2 -translate-y-1/2 rounded-full border-2 border-white shadow dark:border-raised {shape.selected ? 'bg-coollabs dark:bg-warning' : 'bg-neutral-400 dark:bg-neutral-500'} {shape.faded ? 'opacity-30' : ''}"
+                style:left="{at.x}px"
+                style:top="{at.y}px"
+              ></span>
+            {/each}
+          {/each}
+        </div>
+      </div>
+    </div>
+
+    {#if error || empty}
+      <div class="pointer-events-none absolute inset-0 flex items-center justify-center p-6">
+        <div class="pointer-events-auto flex max-w-sm flex-col items-center rounded-xl border border-neutral-200 bg-white px-6 py-8 text-center shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
+          <div class="mb-3 flex size-9 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+            <Icon name="service" class="size-4" />
+          </div>
+          {#if error}
+            <p class="text-[13px] font-semibold text-black dark:text-fg">Could not load the canvas</p>
+            <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-faint">{error}</p>
+            <button type="button" class="button mt-4" onclick={() => load()}>Try again</button>
+          {:else}
+            <p class="text-[13px] font-semibold text-black dark:text-fg">
+              {connectView ? text.empty : ds.empty ? ds.empty : serverView ? 'No resources on this server yet' : 'No resources in this environment yet'}
+            </p>
+            {#if ds.new}
+              <a class="button button-highlighted mt-4" href={ds.new}><Icon name="plus" />Add resource</a>
+            {/if}
+          {/if}
+        </div>
+      </div>
+    {/if}
+
+    <!-- Bottom left: zoom controls, then the dashboard's recent deployments next to them. -->
+    <div class="pointer-events-none absolute bottom-3 left-3 right-3 z-20 flex items-end gap-2 *:pointer-events-auto" data-ec-dock>
+      <CanvasControls inline {zoom} {loading} onzoom={z => pz.zoomTo(z)} onfit={() => fit()} onrefresh={() => load()} />
+      {#if graph?.deployments?.length}
+        <Deployments deployments={graph.deployments} {nodeById} onshow={showNode} />
+      {/if}
+    </div>
+
+    {#if graph && (panelNode || panelLink)}
+      {#key `${selected.kind}:${selected.id}`}
+        <Panel
+          {graph}
+          node={panelNode}
+          link={panelLink}
+          {connectView}
+          {text}
+          {canEdit}
+          top={panelTop}
+          {nodeById}
+          {zoneNames}
+          onselect={select}
+          onclose={closePanel}
+          oncreate={createLink}
+          onremove={removeLink}
+          onlabel={saveLabel}
+          ondelete={deleteLink}
+        />
+      {/key}
+    {/if}
+
+    <div class="pointer-events-none absolute bottom-4 left-1/2 z-30 flex -translate-x-1/2 flex-col items-center gap-2">
+      {#if toastMessage}
+        <div
+          class={toastMessage.bad
+            ? 'pointer-events-auto max-w-md rounded-lg border border-red-200 bg-white px-3 py-2 text-[12px] text-red-700 shadow-lg dark:border-red-500/30 dark:bg-panel dark:text-red-300'
+            : 'pointer-events-auto max-w-md rounded-lg border border-neutral-200 bg-white px-3 py-2 text-[12px] text-neutral-700 shadow-lg dark:border-white/[0.08] dark:bg-panel dark:text-fg'}
+          role={toastMessage.bad ? 'alert' : 'status'}
+        >{toastMessage.text}</div>
+      {/if}
+    </div>
+  </div>
+</div>
+
+<style>
+  @keyframes -global-ec-dash {
+    to {
+      stroke-dashoffset: -12;
+    }
+  }
+  :global([data-ec-root] .ec-temp) {
+    stroke-dasharray: 6 6;
+    animation: ec-dash 0.6s linear infinite;
+  }
+  :global([data-ec-root] .ec-missing) {
+    stroke-dasharray: 5 5;
+  }
+</style>
diff --git a/resources/js/canvas/environment/Icon.svelte b/resources/js/canvas/environment/Icon.svelte
new file mode 100644
index 0000000000..8a715697fa
--- /dev/null
+++ b/resources/js/canvas/environment/Icon.svelte
@@ -0,0 +1,10 @@
+<script>
+  // Outline icon drawn from the local paths (environment-canvas.js ICONS).
+  import { ICONS } from '../../environment-canvas.js';
+
+  let { name, class: cls = 'size-3.5' } = $props();
+</script>
+
+<svg class="{cls} shrink-0" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+  {#each ICONS[name] || [] as d (d)}<path {d} />{/each}
+</svg>
diff --git a/resources/js/canvas/environment/NodeIcon.svelte b/resources/js/canvas/environment/NodeIcon.svelte
new file mode 100644
index 0000000000..920d30b42a
--- /dev/null
+++ b/resources/js/canvas/environment/NodeIcon.svelte
@@ -0,0 +1,37 @@
+<script>
+  // The logo of a resource card (database engine, service template, build source), or its type icon
+  // when it has no logo or the logo fails to load. The favicon of an application domain replaces the
+  // logo once it loads.
+  import Icon from './Icon.svelte';
+
+  let { node, class: cls = 'size-4' } = $props();
+  const logo = $derived(node.logo);
+  // Sources that failed to load; a failed logo shows its fallback, a failed fallback shows the type icon.
+  let failed = $state({});
+  // The favicon URL that loaded.
+  let loadedFavicon = $state(null);
+  const shown = src => (failed[src] && logo.fallback ? logo.fallback : src);
+  const broken = $derived(!!logo?.src && [logo.src, logo.dark].filter(Boolean).some(src => failed[src] && (!logo.fallback || failed[logo.fallback])));
+  const faviconShown = $derived(!!logo?.favicon && loadedFavicon === logo.favicon);
+  const onerror = src => () => {
+    failed[shown(src) === src ? src : logo.fallback] = true;
+  };
+</script>
+
+{#if faviconShown}
+  <img class="size-full object-contain p-1" alt="" src={logo.favicon} />
+{:else}
+  {#if !logo?.src || broken}
+    <Icon name={node.type} class={cls} />
+  {:else}
+    <span class="flex size-full items-center justify-center">
+      <img class="size-full object-contain {logo.padded ? 'p-1' : ''} {logo.dark ? 'dark:hidden' : ''}" alt="" src={shown(logo.src)} onerror={onerror(logo.src)} />
+      {#if logo.dark}
+        <img class="size-full object-contain {logo.padded ? 'p-1' : ''} hidden dark:block" alt="" src={shown(logo.dark)} onerror={onerror(logo.dark)} />
+      {/if}
+    </span>
+  {/if}
+  {#if logo?.favicon && !failed[logo.favicon]}
+    <img class="hidden" alt="" src={logo.favicon} onload={() => (loadedFavicon = logo.favicon)} onerror={() => (failed[logo.favicon] = true)} />
+  {/if}
+{/if}
diff --git a/resources/js/canvas/environment/Panel.svelte b/resources/js/canvas/environment/Panel.svelte
new file mode 100644
index 0000000000..b4fd9c549c
--- /dev/null
+++ b/resources/js/canvas/environment/Panel.svelte
@@ -0,0 +1,316 @@
+<script>
+  // Side panel of the selected card or link. Connect view (shared variables, tags): a source card,
+  // a resource with its sources, or a source → resource link; other views: a card or a diagram link.
+  import { isSource, NO_SERVER, statusLabel, TYPE_LABELS } from '../../environment-canvas.js';
+  import AddSection from './AddSection.svelte';
+  import Icon from './Icon.svelte';
+  import NodeIcon from './NodeIcon.svelte';
+  import StatusDot from './StatusDot.svelte';
+
+  let { graph, node, link, connectView, text, canEdit, top, nodeById, zoneNames, onselect, onclose, oncreate, onremove, onlabel, ondelete } = $props();
+
+  // Requests in flight, per link or card id: their buttons stay disabled until the request ends.
+  let busy = $state({});
+  async function run(id, request) {
+    busy[id] = true;
+    try {
+      await request();
+    } finally {
+      busy[id] = false;
+    }
+  }
+
+  // Diagram link label: saved on blur and Enter, Escape restores it. Follows the link while not focused.
+  let labelInput = $state();
+  let label = $state('');
+  let saved = '';
+  $effect(() => {
+    const current = link?.label || '';
+    if (document.activeElement !== labelInput) {
+      label = current;
+      saved = current;
+    }
+  });
+  async function saveLabel() {
+    const value = label.trim();
+    if (value === saved) return;
+    saved = value;
+    if (!(await onlabel(link, value))) saved = link.label || '';
+  }
+
+  const addProps = (title, placeholder, empty, candidates, describe, onadd) => ({ title, placeholder, empty, candidates, describe, onadd });
+
+  const links = $derived(graph.links || []);
+  const removeTitle = l => (l.keys?.length
+    ? `Delete ${l.keys.join(', ')} from ${nodeById(l.target)?.name}`
+    : `Remove ${nodeById(l.source)?.name} from ${nodeById(l.target)?.name}`);
+  const removeHint = l => `${l.keys.join(', ')} uses ${nodeById(l.source)?.reference || 'the variable'} inside a longer value. Edit it on the resource.`;
+
+  // Connect view lists.
+  const usedBy = $derived(node ? links.filter(l => l.source === node.id) : []);
+  const sources = $derived(node ? links.filter(l => l.target === node.id) : []);
+  const nodeLinks = $derived(node ? links.filter(l => l.source === node.id || l.target === node.id) : []);
+  const servers = $derived(node ? zoneNames(node) : []);
+
+  const rowButton = 'flex min-w-0 flex-1 items-center gap-2 rounded-md px-1.5 py-1 text-left text-[12px] transition-colors hover:bg-neutral-100 dark:hover:bg-white/[0.06]';
+  const listButton = 'flex w-full items-center gap-2 rounded-md px-1.5 py-1 text-left text-[12px] transition-colors hover:bg-neutral-100 dark:hover:bg-white/[0.06]';
+  const smallButton = danger => `button h-6! shrink-0 px-2! text-[11px]! ${danger ? 'text-red-600! dark:text-red-400!' : ''}`;
+  const faint = 'text-[12px] text-neutral-400 dark:text-fg-faint';
+  const statusPill = 'inline-flex h-6 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-100 px-2 text-xs font-medium text-neutral-700 dark:border-white/[0.12] dark:bg-white/[0.07] dark:text-white';
+  const titleLink = '[&[href]]:cursor-pointer [&[href]]:underline-offset-2 [&[href]]:hover:underline';
+</script>
+
+{#snippet section(title, content)}
+  <section class="border-t border-neutral-100 px-4 py-3 dark:border-white/[0.06]">
+    <h3 class="mb-1.5 text-[11px]! leading-4! font-medium! text-neutral-400 dark:text-fg-faint">{title}</h3>
+    {@render content()}
+  </section>
+{/snippet}
+
+{#snippet note(content)}
+  <p class="border-t border-neutral-100 px-4 py-3 text-[12px] text-neutral-500 dark:border-white/[0.06] dark:text-fg-faint">{content}</p>
+{/snippet}
+
+{#snippet shell(title, iconSource, body, footer)}
+  <aside class="absolute top-3 right-3 bottom-3 z-20 flex w-80 max-w-[calc(100%-1.5rem)] flex-col overflow-hidden rounded-lg border border-neutral-200 bg-white shadow-lg dark:border-white/[0.08] dark:bg-panel" style:top={top || null} data-ec-panel>
+    <div class="flex items-center gap-2.5 px-4 py-3">
+      <div class="flex size-8 shrink-0 items-center justify-center overflow-hidden rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+        {#if typeof iconSource === 'string'}<Icon name={iconSource} class="size-4" />{:else}<NodeIcon node={iconSource} />{/if}
+      </div>
+      <h2 class="min-w-0 flex-1 truncate text-[14px]! leading-5! font-semibold! text-black dark:text-fg">{title}</h2>
+      <button type="button" class="flex size-7 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-dim dark:hover:bg-white/[0.07] dark:hover:text-fg" title="Close" aria-label="Close panel" onclick={onclose}>
+        <Icon name="x" />
+      </button>
+    </div>
+    <div class="min-h-0 flex-1 overflow-y-auto">{@render body()}</div>
+    {#if footer}<div class="border-t border-neutral-100 p-4 dark:border-white/[0.06]">{@render footer()}</div>{/if}
+  </aside>
+{/snippet}
+
+{#snippet meta(n)}
+  <div class="flex flex-wrap items-center gap-2 px-4 pb-3">
+    <span class="text-[12px] text-neutral-500 dark:text-fg-faint">{TYPE_LABELS[n.type] || n.type}</span>
+    <span class={statusPill}><StatusDot status={n.status} size="size-1.5" />{statusLabel(n.status)}</span>
+  </div>
+{/snippet}
+
+{#snippet openButton(n, cls, label)}
+  <a class="button {cls} w-full" href={n.link}>{label}</a>
+{/snippet}
+
+{#snippet removeButton(l)}
+  {#if canEdit}
+    <button type="button" class={smallButton(true)} title={l.removable ? removeTitle(l) : removeHint(l)} disabled={!l.removable || busy[l.id]} onclick={() => run(l.id, () => onremove(l))}>Remove</button>
+  {/if}
+{/snippet}
+
+{#if connectView && node && isSource(node)}
+  {#snippet body()}
+    <div class="flex flex-wrap items-center gap-2 px-4 pb-3">
+      {#if node.reference}<code class="rounded border border-neutral-200 bg-neutral-50 px-1.5 py-0.5 font-mono text-[11px] text-neutral-600 dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim">{node.reference}</code>{/if}
+      {#if node.missing}<span class="rounded-full border border-red-200 bg-red-50 px-2 py-0.5 text-[11px] font-medium text-red-600 dark:border-red-500/30 dark:bg-red-500/10 dark:text-red-400">Deleted</span>{/if}
+    </div>
+    {#if node.missing}
+      {@render note(`This shared variable was deleted. The resources below still reference it and get the text ${node.reference} instead of a value. Add the variable again, or remove the reference.`)}
+    {:else if node.subtitle}
+      {#snippet description()}<p class="text-[12px] break-words">{node.subtitle}</p>{/snippet}
+      {@render section('Description', description)}
+    {/if}
+    {#snippet used()}
+      <ul class="flex flex-col gap-1.5">
+        {#if !usedBy.length}<li class={faint}>{text.noTargets}</li>{/if}
+        {#each usedBy as l (l.id)}
+          {@const resource = nodeById(l.target)}
+          <li class="flex items-center gap-1">
+            <button type="button" class={rowButton} title={resource?.context || ''} onclick={() => onselect({ kind: 'link', id: l.id })}>
+              <StatusDot status={resource?.status} size="size-1.5" />
+              <span class="min-w-0 flex-1 truncate">{resource?.name || 'Unknown'}</span>
+              {#if l.label}<span class="max-w-24 truncate font-mono text-[11px] text-neutral-400 dark:text-fg-faint">{l.label}</span>{/if}
+            </button>
+            {@render removeButton(l)}
+          </li>
+        {/each}
+      </ul>
+    {/snippet}
+    {@render section(`${text.usedBy} (${usedBy.length})`, used)}
+    {#if canEdit && !node.missing}
+      {@const linked = new Set(usedBy.map(l => l.target))}
+      <AddSection {...addProps('Add to resources', 'Search resources', text.allTargets,
+        graph.nodes.filter(n => !isSource(n) && !linked.has(n.id)),
+        resource => ({ title: `Add ${node.name} to ${resource.name}`, sub: resource.context || '' }),
+        resource => oncreate(node.id, resource.id))} />
+    {/if}
+    {#if !node.missing}{@render note(canEdit ? text.note(node) : text.viewOnly)}{/if}
+  {/snippet}
+  {#snippet footer()}{@render openButton(node, '', `Open ${TYPE_LABELS[node.type].toLowerCase()}`)}{/snippet}
+  {@render shell(node.name, node, body, node.link ? footer : null)}
+{:else if connectView && node}
+  {#snippet body()}
+    {@render meta(node)}
+    {#if node.context}
+      {#snippet context()}<a class="text-[12px] hover:underline {titleLink}" href={node.context_link || undefined} draggable="false">{node.context}</a>{/snippet}
+      {@render section('Project / environment', context)}
+    {/if}
+    {#snippet list()}
+      <ul class="flex flex-col gap-1.5">
+        {#if !sources.length}<li class={faint}>{text.noSources}</li>{/if}
+        {#each sources as l (l.id)}
+          {@const source = nodeById(l.source)}
+          <li class="flex items-center gap-1">
+            <button type="button" class={rowButton} onclick={() => onselect({ kind: 'node', id: l.source })}>
+              <Icon name={source?.type || 'variable'} class="size-3.5 {l.missing ? 'text-red-500' : 'text-neutral-400 dark:text-fg-faint'}" />
+              <span class="min-w-0 flex-1 truncate {source?.type === 'variable' ? 'font-mono' : ''}">{source?.name || 'Unknown'}</span>
+              {#if l.missing}<span class="text-[11px] text-red-500">Deleted</span>{/if}
+            </button>
+            {@render removeButton(l)}
+          </li>
+        {/each}
+      </ul>
+    {/snippet}
+    {@render section(`${text.sources} (${sources.length})`, list)}
+    {#if canEdit}
+      {@const linked = new Set(sources.map(l => l.source))}
+      <AddSection {...addProps(text.addSources, text.searchSources, text.noMoreSources,
+        graph.nodes.filter(n => isSource(n) && !n.missing && !linked.has(n.id)),
+        source => ({ title: `Add ${source.name} to ${node.name}`, sub: source.type === 'variable' ? source.subtitle || '' : '' }),
+        source => oncreate(source.id, node.id))} />
+    {/if}
+  {/snippet}
+  {#snippet footer()}{@render openButton(node, 'button-highlighted', 'Open')}{/snippet}
+  {@render shell(node.name, node, body, node.link ? footer : null)}
+{:else if connectView && link}
+  {@const variable = nodeById(link.source)}
+  {@const resource = nodeById(link.target)}
+  {#snippet body()}
+    {#snippet ends()}
+      <div class="flex flex-col gap-1">
+        {#each [[text.source, variable], ['Resource', resource]] as [endLabel, end] (endLabel)}
+          <button type="button" class={rowButton} onclick={() => end && onselect({ kind: 'node', id: end.id })}>
+            <span class="w-14 text-[11px] text-neutral-400 dark:text-fg-faint">{endLabel}</span>
+            <span class="min-w-0 flex-1 truncate {end?.type === 'variable' ? 'font-mono' : ''}">{end?.name || 'Unknown'}</span>
+          </button>
+        {/each}
+      </div>
+    {/snippet}
+    {@render section('Ends', ends)}
+    {#if link.keys?.length}
+      {#snippet keys()}
+        <div class="flex flex-wrap gap-1">
+          {#each link.keys as key (key)}<code class="rounded border border-neutral-200 bg-neutral-50 px-1.5 py-0.5 font-mono text-[11px] dark:border-white/[0.1] dark:bg-white/[0.05]">{key}</code>{/each}
+        </div>
+      {/snippet}
+      {@render section(`Variables on ${resource?.name || 'the resource'}`, keys)}
+    {/if}
+    {#if link.missing}{@render note(`The shared variable was deleted. ${resource?.name} gets the text ${variable?.reference} instead of a value.`)}{/if}
+    {#if canEdit && !link.removable}{@render note(removeHint(link))}{/if}
+  {/snippet}
+  {#snippet footer()}
+    <button type="button" class="button w-full text-red-600! dark:text-red-400!" title={link.removable ? removeTitle(link) : removeHint(link)} disabled={!link.removable || busy[link.id]} onclick={() => run(link.id, () => onremove(link))}>Remove</button>
+  {/snippet}
+  {@render shell(`${variable?.name || text.source} → ${resource?.name || 'Resource'}`, 'link', body, canEdit ? footer : null)}
+{:else if node}
+  {#snippet body()}
+    {@render meta(node)}
+    {#if node.subtitle}
+      {#snippet details()}<p class="text-[12px] break-words">{node.subtitle}</p>{/snippet}
+      {@render section('Details', details)}
+    {/if}
+    {#if node.urls?.length}
+      {#snippet urls()}
+        <ul class="flex flex-col gap-1">
+          {#each node.urls as u, i (i)}
+            <li class="min-w-0">
+              <a class="inline-flex max-w-full items-center gap-1.5 text-[12px] text-neutral-600 hover:text-black hover:underline dark:text-fg-dim dark:hover:text-fg" href={u} target="_blank" rel="noopener noreferrer">
+                <span class="truncate">{u.replace(/^https?:\/\//, '')}</span>
+                <Icon name="external" class="size-3" />
+              </a>
+            </li>
+          {/each}
+        </ul>
+      {/snippet}
+      {@render section(node.urls.length === 1 ? 'URL' : 'URLs', urls)}
+    {/if}
+    {#snippet serverList()}<p class="text-[12px]">{servers.length ? servers.join(', ') : NO_SERVER}</p>{/snippet}
+    {@render section(servers.length > 1 ? 'Servers' : 'Server', serverList)}
+    {#if node.children?.length}
+      {#snippet containers()}
+        <ul class="flex flex-col">
+          {#each node.children as child, i (i)}
+            <li class="flex h-6 items-center gap-2 text-[12px]" title={statusLabel(child.status)}>
+              <StatusDot status={child.status} size="size-1.5" />
+              <span class="min-w-0 flex-1 truncate">{child.name}</span>
+              <span class="text-[11px] text-neutral-400 dark:text-fg-faint">{TYPE_LABELS[child.type] || child.type || ''}</span>
+            </li>
+          {/each}
+        </ul>
+      {/snippet}
+      {@render section('Containers', containers)}
+    {/if}
+    {#snippet linkList()}
+      <ul class="flex flex-col gap-0.5">
+        {#if !nodeLinks.length}<li class={faint}>{canEdit ? 'No links. Drag the dot on the right edge of a card to another card.' : 'No links.'}</li>{/if}
+        {#each nodeLinks as l (l.id)}
+          <li>
+            <button type="button" class={listButton} onclick={() => onselect({ kind: 'link', id: l.id })}>
+              <Icon name="link" class="size-3.5 text-neutral-400 dark:text-fg-faint" />
+              <span class="min-w-0 flex-1 truncate">{nodeById(l.source === node.id ? l.target : l.source)?.name || 'Unknown'}</span>
+              {#if l.label}<span class="max-w-24 truncate text-[11px] text-neutral-400 dark:text-fg-faint">{l.label}</span>{/if}
+            </button>
+          </li>
+        {/each}
+      </ul>
+    {/snippet}
+    {@render section('Links', linkList)}
+  {/snippet}
+  {#snippet footer()}{@render openButton(node, 'button-highlighted', 'Open')}{/snippet}
+  {@render shell(node.name, node, body, node.link ? footer : null)}
+{:else if link}
+  {#snippet body()}
+    {#snippet ends()}
+      <div class="flex flex-col gap-1">
+        {#each [['From', link.source], ['To', link.target]] as [endLabel, id] (endLabel)}
+          {@const end = nodeById(id)}
+          <button type="button" class={listButton} onclick={() => onselect({ kind: 'node', id })}>
+            <span class="w-9 text-[11px] text-neutral-400 dark:text-fg-faint">{endLabel}</span>
+            <StatusDot status={end?.status} size="size-1.5" />
+            <span class="min-w-0 flex-1 truncate">{end?.name || 'Unknown'}</span>
+          </button>
+        {/each}
+      </div>
+    {/snippet}
+    {@render section('Resources', ends)}
+    {#snippet labelField()}
+      {#if canEdit}
+        <input
+          bind:this={labelInput}
+          bind:value={label}
+          class="input h-8 w-full text-[12px]"
+          type="text"
+          maxlength="255"
+          placeholder="For example: reads from"
+          aria-label="Link label"
+          data-ec-label-input
+          onkeydown={e => {
+            if (e.key === 'Enter') {
+              e.preventDefault();
+              labelInput.blur();
+            } else if (e.key === 'Escape') {
+              e.stopPropagation();
+              label = saved;
+              labelInput.blur();
+            }
+          }}
+          onblur={saveLabel}
+        />
+      {:else}
+        <p class="text-[12px]">{link.label || 'No label'}</p>
+      {/if}
+    {/snippet}
+    {@render section('Label', labelField)}
+    {@render note('Links are for the diagram only. They do not change your resources.')}
+  {/snippet}
+  {#snippet footer()}
+    <button type="button" class="button w-full text-red-600! dark:text-red-400!" disabled={busy[link.id]} onclick={() => run(link.id, () => ondelete(link))}>Remove link</button>
+  {/snippet}
+  {@render shell(link.label || 'Link', 'link', body, canEdit ? footer : null)}
+{/if}
diff --git a/resources/js/canvas/environment/StatusDot.svelte b/resources/js/canvas/environment/StatusDot.svelte
new file mode 100644
index 0000000000..0778c28dbb
--- /dev/null
+++ b/resources/js/canvas/environment/StatusDot.svelte
@@ -0,0 +1,13 @@
+<script>
+  import { statusLabel, statusTone, TONE_DOT } from '../../environment-canvas.js';
+
+  let { status, size = 'size-2', title = null } = $props();
+  const tone = $derived(statusTone(status));
+</script>
+
+<span class="relative flex {size} shrink-0" title={title || statusLabel(status)}>
+  {#if tone === 'busy'}
+    <span class="absolute inline-flex size-full rounded-full opacity-75 motion-safe:animate-ping {TONE_DOT.busy}"></span>
+  {/if}
+  <span class="relative inline-flex size-full rounded-full {TONE_DOT[tone]}"></span>
+</span>
diff --git a/resources/js/canvas/environment/Toolbar.svelte b/resources/js/canvas/environment/Toolbar.svelte
new file mode 100644
index 0000000000..ee53dcb078
--- /dev/null
+++ b/resources/js/canvas/environment/Toolbar.svelte
@@ -0,0 +1,39 @@
+<script>
+  // Filters and view toggles. The root docks it (use:dock) into the zoom controls bar
+  // (CanvasControls, bottom left) on desktop, or in a rounded box above the canvas on small screens.
+
+  let { viewOnly, viewOnlyTitle, filter, projects, environments, views, dock, onfilter } = $props();
+
+  const select = 'select h-8! w-44 py-0! text-[12px]! max-lg:w-auto max-lg:min-w-0 max-lg:flex-1 max-lg:basis-32';
+  const value = (options, wanted) => (options.some(o => o.uuid === wanted) ? wanted : '');
+
+  /** Table / grid / canvas switcher from the page (Blade), when the page has one. */
+  function adopt(node, el) {
+    if (!el) return;
+    el.classList.add('max-lg:flex-wrap');
+    node.append(el);
+  }
+</script>
+
+<div use:dock data-ec-toolbar>
+  <div class="flex min-w-0 items-center gap-2">
+    <span class="inline-flex items-center">
+      <span class="px-2 py-0.5 text-xs font-medium leading-normal rounded-full bg-coollabs/10 text-coollabs border border-coollabs/30 dark:bg-warning/15 dark:text-warning dark:border-warning/30">Beta</span>
+    </span>
+    <span class="rounded-full border border-neutral-200 bg-neutral-100 px-2 py-0.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.12] dark:bg-white/[0.07] dark:text-fg-dim" class:hidden={!viewOnly} title={viewOnlyTitle}>View only</span>
+  </div>
+  <!-- Small screens: the actions wrap onto more rows instead of covering the title. -->
+  <div class="ml-auto flex shrink-0 items-center gap-2 max-lg:min-w-0 max-lg:shrink max-lg:flex-wrap" use:adopt={views}>
+    <!-- Connect and server views: show the resources of one project and / or environment only. -->
+    <select class={select} class:hidden={projects.length < 2} aria-label="Filter by project" title="Filter by project"
+      value={value(projects, filter.project)} onchange={e => onfilter({ project: e.currentTarget.value, environment: '' })}>
+      <option value="">All projects</option>
+      {#each projects as o (o.uuid)}<option value={o.uuid}>{o.name}</option>{/each}
+    </select>
+    <select class={select} class:hidden={environments.length < 2} aria-label="Filter by environment" title="Filter by environment"
+      value={value(environments, filter.environment)} onchange={e => onfilter({ ...filter, environment: e.currentTarget.value })}>
+      <option value="">All environments</option>
+      {#each environments as o (o.uuid)}<option value={o.uuid}>{o.name}</option>{/each}
+    </select>
+  </div>
+</div>
diff --git a/resources/js/canvas/environment/Zone.svelte b/resources/js/canvas/environment/Zone.svelte
new file mode 100644
index 0000000000..a4f65a3b7e
--- /dev/null
+++ b/resources/js/canvas/environment/Zone.svelte
@@ -0,0 +1,100 @@
+<script>
+  // A zone frame (server, or a group of the connect view) with its header; the header drags the zone.
+  // Server canvas zones (zone.details) add a second row: host facts, proxy, live usage and a status summary.
+  import { formatMemory, formatUptime, NO_SERVER, statusSummary, zoneHeader } from '../../environment-canvas.js';
+  import Icon from './Icon.svelte';
+
+  let { box, movable, onpress, nodes = [], usage = null } = $props();
+  let header;
+  // The server IP stays hidden until the user asks for it (screen sharing, screenshots).
+  let showIp = $state(false);
+  const zone = $derived(box.zone);
+  const ok = $derived(zone?.is_reachable && zone?.is_usable);
+  const title = $derived(movable ? 'Drag to move every card in this zone' : !zone ? 'Resources without a server' : undefined);
+  const details = $derived(zone?.details);
+  const host = $derived(details
+    ? [details.os, details.arch, details.cpus ? `${details.cpus} ${details.cpus === 1 ? 'CPU' : 'CPUs'}` : null, formatMemory(details.memory_bytes), details.uptime_since && formatUptime(details.uptime_since) ? `up ${formatUptime(details.uptime_since)}` : null].filter(Boolean)
+    : []);
+  const proxyRunning = $derived(details?.proxy?.status === 'running');
+  const summary = $derived(details && zone?.is_reachable ? statusSummary(nodes) : null);
+  const SUMMARY = [
+    ['ok', 'running', 'bg-emerald-500'],
+    ['busy', 'starting', 'bg-warning'],
+    ['warn', 'degraded', 'bg-warning'],
+    ['bad', 'stopped', 'bg-red-500'],
+    ['idle', 'unknown', 'bg-neutral-400 dark:bg-neutral-500'],
+  ];
+  const USAGE = [['cpu', 'CPU'], ['memory', 'Memory'], ['disk', 'Disk']];
+  const usageTone = value => (value >= 90 ? 'text-red-600 dark:text-red-400' : value >= 75 ? 'text-warning-700 dark:text-warning' : 'text-neutral-600 dark:text-fg-dim');
+  const sep = 'h-3 w-px shrink-0 bg-neutral-200 dark:bg-white/[0.1]';
+</script>
+
+<div
+  class="absolute rounded-2xl border border-neutral-200 bg-[color-mix(in_oklab,var(--color-neutral-50),white_50%)] dark:border-white/[0.07] dark:bg-[color-mix(in_oklab,var(--color-app),var(--color-panel)_35%)]"
+  style:left="{box.x}px"
+  style:top="{box.y}px"
+  style:width="{box.width}px"
+  style:height="{box.height}px"
+>
+  <div bind:this={header} class="px-4 {movable ? 'cursor-grab active:cursor-grabbing' : ''}" style:height="{zoneHeader(zone)}px" data-ec-zone-header {title} role="presentation" onpointerdown={e => onpress(e, header)}>
+    <div class="flex h-10 items-center gap-2 text-[12px]">
+      <Icon name={zone?.icon || 'server'} class="size-3.5 text-neutral-400 dark:text-fg-faint" />
+      <a class="truncate font-semibold text-neutral-700 dark:text-fg [&[href]]:cursor-pointer [&[href]]:underline-offset-2 [&[href]]:hover:underline" href={zone?.link || undefined} draggable="false">{box.name || NO_SERVER}</a>
+      <!-- Zones with an icon are not server zones (connect view). -->
+      {#if zone && !zone.icon}
+        {#if ok}
+          <span class="size-1.5 shrink-0 rounded-full bg-emerald-500" title="Reachable"></span>
+        {:else}
+          <!-- Spelled out: the status of every card on this server is unknown while it is down. -->
+          <span
+            class="inline-flex h-5 shrink-0 items-center gap-1.5 rounded-full border px-2 text-[11px] font-medium {zone.is_reachable
+              ? 'border-warning/40 bg-warning/10 text-warning-700 dark:text-warning'
+              : 'border-red-200 bg-red-50 text-red-600 dark:border-red-500/30 dark:bg-red-500/10 dark:text-red-400'}"
+            title={zone.is_reachable ? 'Coolify can connect to this server, but cannot use it (for example, Docker is missing)' : 'Coolify cannot connect to this server. The status of its resources is unknown.'}
+          >
+            <span class="size-1.5 rounded-full {zone.is_reachable ? 'bg-warning' : 'bg-red-500'}"></span>
+            {zone.is_reachable ? 'Not usable' : 'Unreachable'}
+          </span>
+        {/if}
+        {#if zone.ip}
+          <button
+            type="button"
+            class="shrink-0 font-mono text-[11px] text-neutral-400 hover:text-neutral-600 dark:text-fg-faint dark:hover:text-fg-dim"
+            title={showIp ? 'Hide IP address' : 'Show IP address'}
+            onpointerdown={e => e.stopPropagation()}
+            onclick={() => (showIp = !showIp)}
+          >{showIp ? zone.ip : 'Show IP'}</button>
+        {/if}
+        {#if summary}
+          <span class="ml-auto flex shrink-0 items-center gap-2.5 text-[11px] text-neutral-500 dark:text-fg-dim" title="Resources on this server by status">
+            {#each SUMMARY as [tone, label, dot] (tone)}
+              {#if summary[tone]}
+                <span class="inline-flex items-center gap-1"><span class="size-1.5 rounded-full {dot}"></span>{summary[tone]} {label}</span>
+              {/if}
+            {/each}
+          </span>
+        {/if}
+      {/if}
+    </div>
+    {#if details}
+      <div class="flex h-5 min-w-0 items-center gap-2.5 overflow-hidden text-[11px] whitespace-nowrap text-neutral-500 dark:text-fg-faint">
+        {#if host.length}<span class="truncate" title="Operating system, architecture, CPUs, memory and uptime">{host.join(' · ')}</span>{/if}
+        {#if details.proxy}
+          {#if host.length}<span class={sep}></span>{/if}
+          <span class="inline-flex shrink-0 items-center gap-1.5" title="Proxy: {details.proxy.status || 'unknown'}">
+            <span class="size-1.5 rounded-full {proxyRunning ? 'bg-emerald-500' : details.proxy.status ? 'bg-red-500' : 'bg-neutral-400'}"></span>
+            {details.proxy.type.charAt(0) + details.proxy.type.slice(1).toLowerCase()}{proxyRunning ? '' : ` ${details.proxy.status || ''}`}
+          </span>
+        {/if}
+        {#if usage && USAGE.some(([key]) => usage[key] !== null && usage[key] !== undefined)}
+          <span class={sep}></span>
+          {#each USAGE as [key, label] (key)}
+            {#if usage[key] !== null && usage[key] !== undefined}
+              <span class="shrink-0" title="{label} usage (last minute)">{label} <span class="font-medium tabular-nums {usageTone(usage[key])}">{Math.round(usage[key])}%</span></span>
+            {/if}
+          {/each}
+        {/if}
+      </div>
+    {/if}
+  </div>
+</div>
diff --git a/resources/js/canvas/environment/index.js b/resources/js/canvas/environment/index.js
new file mode 100644
index 0000000000..5cb79c380a
--- /dev/null
+++ b/resources/js/canvas/environment/index.js
@@ -0,0 +1,11 @@
+// Environment canvas page mount (initial load and Livewire SPA navigation).
+import { mount, unmount } from 'svelte';
+import { mountOnPage } from '../../canvas-core.js';
+import EnvironmentCanvas from './EnvironmentCanvas.svelte';
+
+export function initializeEnvironmentCanvas() {
+  mountOnPage('[data-environment-canvas]', '[data-ec-root]', container => {
+    const app = mount(EnvironmentCanvas, { target: container, props: { container } });
+    return { root: container.querySelector('[data-ec-root]'), unmount: () => unmount(app) };
+  });
+}
diff --git a/resources/js/deploy-canvas.js b/resources/js/deploy-canvas.js
new file mode 100644
index 0000000000..82d28ccd52
--- /dev/null
+++ b/resources/js/deploy-canvas.js
@@ -0,0 +1,510 @@
+/**
+ * Deploy canvas: build a deploy workflow (project → server → source →
+ * settings → deploy) from nodes, run it through Coolify's API controllers
+ * (at /canvas/api, with the browser session) and follow the deployment logs.
+ *
+ * Mounted on the /canvas page into [data-deploy-canvas] by
+ * canvas/deploy/index.js (Svelte components). This file keeps the DOM-free
+ * parts: step types, flow rules and storage; `node --test` imports it.
+ */
+
+import { api } from './canvas-core.js';
+
+// ── Settings ───────────────────────────────────────────────────────────
+export const LOG_POLL_MS = 2000;       // Deployment log refresh (Coolify's own log view uses 2 s too).
+export const STORE = 'coolify-canvas';  // localStorage prefix (flow, view).
+
+// ── Small helpers ──────────────────────────────────────────────────────
+// Icons: the app's reicon glyphs (rendered by the page into
+// [data-deploy-canvas-icons]), or a few local paths in the same style.
+export const LOCAL_ICONS = {
+  minus: ['M5 12h14'],
+  fit: ['M4 9V4h5M20 9V4h-5M4 15v5h5M20 15v5h-5'],
+  back: ['M19 12H5', 'M11 6l-6 6 6 6'], // the environment canvas back arrow
+  fold: ['M5 4h14a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2z', 'M9 4v16'], // the sidebar toggle in the navbar
+};
+export const uid = () => Math.random().toString(36).slice(2, 10);
+const b64 = text => btoa(unescape(encodeURIComponent(text)));
+export const load = (key, fallback) => {
+  try { return JSON.parse(localStorage.getItem(`${STORE}:${key}`)) ?? fallback; } catch { return fallback; }
+};
+export const save = (key, value) => localStorage.setItem(`${STORE}:${key}`, JSON.stringify(value));
+export const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+export const ICONS = {
+  start: 'projects',
+  server: 'servers',
+  git: 'sources',
+  image: 'cloud',
+  file: 'file-content',
+  layers: 'layers',
+  db: 'database',
+  sliders: 'sliders',
+  variables: 'variables',
+  globe: 'globe',
+  deploy: 'play-circle',
+  x: 'x',
+  plus: 'plus',
+  minus: 'minus',
+  fit: 'fit',
+  out: 'external-link',
+  fold: 'fold',
+  check: 'check',
+  chevron: 'chevron-down',
+  info: 'info-circle',
+};
+
+// Cached option lists for the node fields (key → array; loading state).
+// onChange runs when a list loads or fails (the canvas redraws its fields).
+export const lists = { cache: {}, pending: {}, errors: {}, onChange: () => {} };
+function options(key, fetcher) {
+  const { cache, pending, errors } = lists;
+  if (cache[key]) return cache[key];
+  if (!pending[key]) {
+    pending[key] = fetcher().then(list => {
+      cache[key] = list;
+      delete errors[key];
+    }).catch(error => {
+      errors[key] = error.message;
+    }).finally(() => {
+      delete pending[key];
+      lists.onChange();
+    });
+  }
+  return null;
+}
+// The cache key a select loads from (to show its error).
+export function loaderKey(f, d) {
+  const map = { project: 'projects', environment: `envs:${d.project}`, server: 'servers', destination: `dest:${d.server}`, ghApp: 'gh', ghRepo: `repos:${d.ghApp}`, ghBranch: `br:${d.ghApp}:${d.ghRepo}`, key: 'keys' };
+  return map[f.key];
+}
+const LOADERS = {
+  projects: () => options('projects', async () => (await api('GET', '/projects')).map(p => [p.uuid, p.name])),
+  envs: project => project && options(`envs:${project}`, async () => (await api('GET', `/projects/${project}/environments`)).map(e => [e.uuid, e.name])),
+  // Build-only servers cannot run resources (as on the New resource page).
+  servers: () => options('servers', async () => (await api('GET', '/servers')).filter(s => s.settings?.server_role !== 'build').map(s => [s.uuid, `${s.name}${s.is_reachable === false ? ' (unreachable)' : ''}`])),
+  destinations: server => server && options(`dest:${server}`, async () => (await api('GET', `/servers/${server}/destinations`)).map(d => [d.uuid, `${d.name} · ${d.network}`])),
+  ghApps: () => options('gh', async () => (await api('GET', '/github-apps')).filter(a => !a.is_public && a.app_id).map(a => [`${a.id}|${a.uuid}`, a.name])),
+  repos: app => app && options(`repos:${app}`, async () => (await api('GET', `/github-apps/${app.split('|')[0]}/repositories`)).repositories.map(r => [r.full_name, r.full_name])),
+  branches: (app, repo) => app && repo && options(`br:${app}:${repo}`, async () => (await api('GET', `/github-apps/${app.split('|')[0]}/repositories/${repo}/branches`)).branches.map(b => [b.name, b.name])),
+  keys: () => options('keys', async () => (await api('GET', '/security/keys')).map(k => [k.uuid, k.name])),
+};
+
+// ── Node types ─────────────────────────────────────────────────────────
+// stage: start → infra → source → config → ship. kind: what a source creates.
+// Select options are [value, label, badge?]; the badge shows next to the label.
+const BUILD_PACKS = [['railpack', 'Railpack'], ['nixpacks', 'Nixpacks', 'Deprecated'], ['static', 'Static'], ['dockerfile', 'Dockerfile'], ['dockercompose', 'Docker Compose']];
+// The PostgreSQL images of the New resource page (project/new/select.blade.php).
+const POSTGRES_IMAGES = [
+  ['postgres:18-alpine', 'PostgreSQL 18'],
+  ['postgres:17-alpine', 'PostgreSQL 17'],
+  ['postgres:16-alpine', 'PostgreSQL 16'],
+  ['supabase/postgres:17.4.1.032', 'Supabase PostgreSQL'],
+  ['postgis/postgis:17-3.5-alpine', 'PostGIS'],
+  ['pgvector/pgvector:pg18', 'PGVector 18'],
+  ['pgvector/pgvector:pg17', 'PGVector 17'],
+];
+const DATABASES = [['postgresql', 'PostgreSQL'], ['mysql', 'MySQL'], ['mariadb', 'MariaDB'], ['mongodb', 'MongoDB'], ['redis', 'Redis'], ['keydb', 'KeyDB'], ['dragonfly', 'Dragonfly'], ['clickhouse', 'ClickHouse']];
+// One-click service templates ([key, name]), from the page (deploy-canvas.blade.php).
+let serviceTemplates = null;
+const templateOptions = () => {
+  if (!serviceTemplates) {
+    try { serviceTemplates = JSON.parse(document.querySelector('[data-deploy-canvas-services]')?.textContent || '[]'); } catch { serviceTemplates = []; }
+  }
+  return serviceTemplates;
+};
+
+// The logo of a source step: the one resource_logo() (bootstrap/helpers/services.php) and the
+// New resource page show for what it creates. Service logos come from the page
+// (deploy-canvas.blade.php). Null keeps the step's glyph.
+// The page gives versioned URLs (resource_logo_url()), so a changed logo is not loaded from the cache.
+let resourceLogos = null;
+const resourceLogoUrl = name => {
+  if (!resourceLogos) {
+    try { resourceLogos = JSON.parse(globalThis.document?.querySelector('[data-deploy-canvas-resource-logos]')?.textContent || '{}'); } catch { resourceLogos = {}; }
+  }
+  return resourceLogos[name] ?? `/svgs/resources/${name}.svg`;
+};
+const resourceLogo = (name, hasDark = false) => ({
+  src: resourceLogoUrl(name), dark: hasDark ? resourceLogoUrl(`${name}-dark`) : null, fallback: null, padded: false,
+});
+const DATABASE_LOGOS = { postgresql: 'postgres' };
+let serviceLogos = null;
+const serviceLogo = key => {
+  if (!serviceLogos) {
+    try { serviceLogos = JSON.parse(document.querySelector('[data-deploy-canvas-service-logos]')?.textContent || '{}'); } catch { serviceLogos = {}; }
+  }
+  const logo = serviceLogos[key];
+  return logo ? { src: logo[0], dark: null, fallback: logo[1], padded: true } : null;
+};
+export function logoOf(n) {
+  const d = n.data || {};
+  switch (n.type) {
+    case 'git':
+      if (d.buildPack === 'dockerfile') return resourceLogo('dockerfile');
+      if (d.buildPack === 'dockercompose') return resourceLogo('docker-compose');
+      if (d.mode === 'github') return resourceLogo('github-app', true);
+      return resourceLogo(d.mode === 'key' ? 'deploy-key' : 'public-repo');
+    case 'image': return resourceLogo('docker-image');
+    case 'dockerfile': return resourceLogo('dockerfile');
+    case 'service': return d.mode === 'compose' ? resourceLogo('docker-compose') : (d.type ? serviceLogo(d.type) : null);
+    case 'database': return d.engine ? resourceLogo(DATABASE_LOGOS[d.engine] ?? d.engine, ['keydb', 'dragonfly'].includes(d.engine)) : null;
+    default: return null;
+  }
+}
+
+export const TYPES = {
+  start: {
+    title: 'Start', sub: 'Which project and environment', stage: 'start', icon: ICONS.start,
+    fields: [
+      // `add`: a "New …" row at the end of the list creates one and selects it.
+      { key: 'project', label: 'Project', kind: 'select', load: () => LOADERS.projects(), rerender: true, required: true,
+        add: { label: 'New project', placeholder: 'Project name', list: () => 'projects', create: async name => (await api('POST', '/projects', { name })).uuid } },
+      { key: 'environment', label: 'Environment', kind: 'select', load: d => LOADERS.envs(d.project), required: true, only: true,
+        add: { label: 'New environment', placeholder: 'Environment name', list: d => `envs:${d.project}`, create: async (name, d) => (await api('POST', `/projects/${d.project}/environments`, { name })).uuid } },
+    ],
+    run: async (ctx, d) => {
+      ctx.project = d.project;
+      ctx.environment = d.environment;
+      return 'Project and environment set.';
+    },
+  },
+  server: {
+    title: 'Server', sub: 'Where it runs', stage: 'infra', icon: ICONS.server,
+    fields: [
+      { key: 'server', label: 'Server', kind: 'select', load: () => LOADERS.servers(), rerender: true, required: true, only: true },
+      { key: 'destination', label: 'Network', kind: 'select', load: d => LOADERS.destinations(d.server), optional: 'Default' },
+    ],
+    run: async (ctx, d) => {
+      ctx.server = d.server;
+      ctx.destination = d.destination || undefined;
+      return 'Server picked.';
+    },
+  },
+  git: {
+    title: 'Git repository', sub: 'Build from source', stage: 'source', kind: 'application', icon: ICONS.git,
+    fields: [
+      { key: 'mode', label: 'Access', kind: 'segmented', options: [['public', 'Public'], ['github', 'GitHub app'], ['key', 'Deploy key']], rerender: true, value: 'public' },
+      { key: 'repository', label: 'Repository URL', kind: 'text', placeholder: 'https://github.com/coollabsio/coolify-examples', show: d => d.mode !== 'github', required: true, secret: v => /^\w+:\/\/[^/]*@/.test(v) },
+      { key: 'ghApp', label: 'GitHub app', kind: 'select', load: () => LOADERS.ghApps(), show: d => d.mode === 'github', rerender: true, required: true },
+      { key: 'ghRepo', label: 'Repository', kind: 'select', load: d => LOADERS.repos(d.ghApp), show: d => d.mode === 'github', rerender: true, required: true },
+      { key: 'key', label: 'Deploy key', kind: 'select', load: () => LOADERS.keys(), show: d => d.mode === 'key', required: true },
+      { key: 'branch', label: 'Branch', kind: 'text', placeholder: 'main', value: 'main', show: d => d.mode !== 'github', required: true },
+      { key: 'ghBranch', label: 'Branch', kind: 'select', load: d => LOADERS.branches(d.ghApp, d.ghRepo), show: d => d.mode === 'github', required: true },
+      { key: 'buildPack', label: 'Build pack', kind: 'select', options: BUILD_PACKS, value: 'railpack', required: true },
+      { key: 'ports', label: 'Port', kind: 'text', placeholder: '3000', value: '3000' },
+      { key: 'name', label: 'Name', kind: 'text', placeholder: 'Optional' },
+    ],
+    run: async (ctx, d) => {
+      ctx.applicationSource = true;
+      const base = common(ctx, d);
+      Object.assign(base, { build_pack: d.buildPack, ports_exposes: d.ports || undefined });
+      let res;
+      if (d.mode === 'github') {
+        res = await api('POST', '/applications/private-github-app', { ...base, github_app_uuid: d.ghApp.split('|')[1], git_repository: d.ghRepo, git_branch: d.ghBranch });
+      } else if (d.mode === 'key') {
+        res = await api('POST', '/applications/private-deploy-key', { ...base, private_key_uuid: d.key, git_repository: d.repository, git_branch: d.branch });
+      } else {
+        res = await api('POST', '/applications/public', { ...base, git_repository: d.repository, git_branch: d.branch });
+      }
+      ctx.resource = { kind: 'application', sub: 'git', uuid: res.uuid };
+      ctx.createdDomains = res.domains && domainList(res.domains);
+      return 'Application created.';
+    },
+  },
+  image: {
+    title: 'Docker image', sub: 'Run a prebuilt image', stage: 'source', kind: 'application', icon: ICONS.image,
+    fields: [
+      { key: 'image', label: 'Image', kind: 'text', placeholder: 'nginx', required: true },
+      { key: 'tag', label: 'Tag', kind: 'text', placeholder: 'latest, or the tag in the image' },
+      { key: 'ports', label: 'Port', kind: 'text', placeholder: '80', value: '80' },
+      { key: 'name', label: 'Name', kind: 'text', placeholder: 'Optional' },
+    ],
+    run: async (ctx, d) => {
+      ctx.applicationSource = true;
+      const { name, tag } = splitImage(d.image, d.tag);
+      const res = await api('POST', '/applications/dockerimage', { ...common(ctx, d), docker_registry_image_name: name, docker_registry_image_tag: tag, ports_exposes: d.ports || undefined });
+      ctx.resource = { kind: 'application', sub: 'image', uuid: res.uuid };
+      ctx.createdDomains = res.domains && domainList(res.domains);
+      return 'Application created.';
+    },
+  },
+  dockerfile: {
+    title: 'Dockerfile', sub: 'Build from a Dockerfile', stage: 'source', kind: 'application', icon: ICONS.file,
+    fields: [
+      { key: 'dockerfile', label: 'Dockerfile', kind: 'textarea', placeholder: 'FROM nginx:alpine\nCOPY . /usr/share/nginx/html', required: true },
+      { key: 'ports', label: 'Port', kind: 'text', placeholder: '80', value: '80' },
+      { key: 'name', label: 'Name', kind: 'text', placeholder: 'Optional' },
+    ],
+    run: async (ctx, d) => {
+      ctx.applicationSource = true;
+      const res = await api('POST', '/applications/dockerfile', { ...common(ctx, d), dockerfile: b64(d.dockerfile), ports_exposes: d.ports || undefined });
+      ctx.resource = { kind: 'application', sub: 'dockerfile', uuid: res.uuid };
+      ctx.createdDomains = res.domains && domainList(res.domains);
+      return 'Application created.';
+    },
+  },
+  service: {
+    title: 'Service', sub: 'One-click template or compose', stage: 'source', kind: 'service', icon: ICONS.layers,
+    fields: [
+      { key: 'mode', label: 'From', kind: 'segmented', options: [['template', 'Template'], ['compose', 'Compose']], rerender: true, value: 'template' },
+      { key: 'type', label: 'Template', kind: 'select', load: () => templateOptions(), show: d => d.mode !== 'compose', required: true },
+      { key: 'compose', label: 'docker-compose.yml', kind: 'textarea', placeholder: 'services:\n  app:\n    image: nginx', show: d => d.mode === 'compose', required: true, secret: true },
+      { key: 'name', label: 'Name', kind: 'text', placeholder: 'Optional' },
+    ],
+    run: async (ctx, d) => {
+      const body = common(ctx, d);
+      if (d.mode === 'compose') body.docker_compose_raw = b64(d.compose);
+      else body.type = d.type.trim();
+      const res = await api('POST', '/services', body);
+      ctx.resource = { kind: 'service', uuid: res.uuid };
+      return 'Service created.';
+    },
+  },
+  database: {
+    title: 'Database', sub: 'A managed database', stage: 'source', kind: 'database', icon: ICONS.db,
+    fields: [
+      // A new engine starts with its default image (PostgreSQL: PostgreSQL 18).
+      { key: 'engine', label: 'Engine', kind: 'select', options: DATABASES, value: 'postgresql', required: true,
+        after: d => { d.image = d.engine === 'postgresql' ? POSTGRES_IMAGES[0][0] : ''; } },
+      { key: 'image', label: 'Image', kind: 'select', options: POSTGRES_IMAGES, value: POSTGRES_IMAGES[0][0], show: d => d.engine === 'postgresql', required: true },
+      { key: 'image', label: 'Image', kind: 'text', placeholder: 'Default for the engine', show: d => d.engine !== 'postgresql' },
+      { key: 'name', label: 'Name', kind: 'text', placeholder: 'Optional' },
+    ],
+    run: async (ctx, d) => {
+      const body = common(ctx, d);
+      if (d.image) body.image = d.image;
+      const res = await api('POST', `/databases/${d.engine}`, body);
+      ctx.resource = { kind: 'database', uuid: res.uuid };
+      return 'Database created.';
+    },
+  },
+  build: {
+    title: 'Build settings', sub: 'Directories and commands', stage: 'config', icon: ICONS.sliders, for: ['git'],
+    fields: [
+      { key: 'base_directory', label: 'Base directory', kind: 'text', placeholder: '/' },
+      { key: 'publish_directory', label: 'Publish directory', kind: 'text', placeholder: '/dist' },
+      { key: 'install_command', label: 'Install command', kind: 'text', placeholder: 'Detected' },
+      { key: 'build_command', label: 'Build command', kind: 'text', placeholder: 'Detected' },
+      { key: 'start_command', label: 'Start command', kind: 'text', placeholder: 'Detected' },
+    ],
+    run: async (ctx, d) => {
+      const body = Object.fromEntries(['base_directory', 'publish_directory', 'install_command', 'build_command', 'start_command'].filter(k => d[k]).map(k => [k, d[k]]));
+      if (!Object.keys(body).length) return 'Nothing to change.';
+      await api('PATCH', `/applications/${ctx.resource.uuid}`, body);
+      return 'Build settings saved.';
+    },
+  },
+  env: {
+    title: 'Environment variables', sub: 'KEY=value, one per line', stage: 'config', icon: ICONS.variables, for: ['application', 'service'],
+    fields: [
+      { key: 'vars', label: 'Variables', kind: 'textarea', placeholder: 'NODE_ENV=production\nAPI_URL=https://api.example.com', required: true, mono: true, secret: true },
+    ],
+    run: async (ctx, d) => {
+      const data = parseEnvVars(d.vars);
+      if (!data.length) return 'No variables.';
+      const kind = ctx.resource.kind === 'service' ? 'services' : 'applications';
+      await api('PATCH', `/${kind}/${ctx.resource.uuid}/envs/bulk`, { data });
+      return `${data.length} variable${data.length === 1 ? '' : 's'} saved.`;
+    },
+  },
+  domain: {
+    title: 'Domains', sub: 'Your own public addresses', stage: 'config', icon: ICONS.globe, for: ['git', 'image', 'dockerfile'],
+    fields: [
+      { key: 'domains', label: 'Domains', kind: 'textarea', placeholder: 'https://app.example.com', required: true, mono: true, rows: 2 },
+      { key: 'note', kind: 'note', text: 'Without this step, Coolify makes an address from the server’s wildcard domain (or sslip.io).' },
+    ],
+    run: async (ctx, d) => {
+      const domains = domainList(d.domains);
+      if (ctx.createdDomains === domains) return `Set at creation: ${domains.replace(/,/g, ', ')}.`;
+      const res = await api('PATCH', `/applications/${ctx.resource.uuid}`, { domains });
+      return `Domains saved${res?.uuid ? '' : ''}: ${domains.replace(/,/g, ', ')}.`;
+    },
+  },
+  deploy: {
+    title: 'Deploy', sub: 'Save or deploy every resource', stage: 'ship', icon: ICONS.deploy,
+    fields: [],
+  },
+};
+// "nginx:alpine" → nginx + alpine; "ghcr.io:443/a/b@sha256:…" → digest tag
+// (Coolify's "sha256-…" form). A tag in the image wins over the Tag field.
+export function splitImage(image, tagField) {
+  let name = String(image || '').trim();
+  let tag = '';
+  const at = name.indexOf('@sha256:');
+  if (at >= 0) {
+    tag = `sha256-${name.slice(at + 8)}`;
+    name = name.slice(0, at);
+  } else {
+    const colon = name.lastIndexOf(':');
+    if (colon > name.lastIndexOf('/')) {
+      tag = name.slice(colon + 1);
+      name = name.slice(0, colon);
+    }
+  }
+  return { name, tag: tag || String(tagField || '').trim() || 'latest' };
+}
+// Fields common to every create call. Domains from a Domains step later in
+// the chain go in at creation (with no generated domain), as Coolify's
+// create endpoints accept them.
+function common(ctx, d) {
+  const body = { project_uuid: ctx.project, environment_uuid: ctx.environment, server_uuid: ctx.server, instant_deploy: false };
+  if (ctx.destination) body.destination_uuid = ctx.destination;
+  if (d.name) body.name = d.name;
+  if (ctx.domains && ctx.applicationSource) {
+    body.domains = ctx.domains;
+    body.autogenerate_domain = false;
+  }
+  return body;
+}
+// "KEY=value" lines → [{ key, value }]; skips blanks and # comments, strips quotes.
+export function parseEnvVars(text) {
+  return String(text || '').split('\n').map(line => line.trim()).filter(line => line && !line.startsWith('#') && line.includes('=')).map(line => {
+    const i = line.indexOf('=');
+    return { key: line.slice(0, i).trim(), value: line.slice(i + 1).trim().replace(/^(['"])(.*)\1$/, '$2') };
+  });
+}
+export const domainList = text => String(text || '').split(/[\n,]/).map(v => v.trim()).filter(Boolean).join(',');
+export const PALETTE = [
+  ['Infrastructure', ['server']],
+  ['Source', ['git', 'image', 'dockerfile', 'service', 'database']],
+  ['Configure', ['build', 'env', 'domain']],
+];
+
+// ── Flow state ─────────────────────────────────────────────────────────
+// Every deploy needs a server, so a new canvas has one, already connected
+// (id 'server': it cannot be removed, nor its connection to Start).
+export const fresh = () => withDeploy({
+  nodes: [{ id: 'start', type: 'start', x: 80, y: 160, data: {} }, { id: 'server', type: 'server', x: 456, y: 160, data: {} }],
+  edges: [{ from: 'start', to: 'server' }],
+});
+// A select with `only: true` takes its option when it has exactly one.
+export const onlyOption = (list, value) => (!value && list?.length === 1 ? list[0][0] : value);
+// Every flow ends in one Deploy step. Resource lines reach it on their own, so
+// edges into it (from older saved flows) are dropped.
+export function withDeploy(f) {
+  if (!f.nodes.some(n => n.type === 'deploy')) f.nodes.push({ id: 'deploy', type: 'deploy', x: 1240, y: 160, data: {} });
+  const deployIds = new Set(f.nodes.filter(n => n.type === 'deploy').map(n => n.id));
+  f.edges = f.edges.filter(e => !deployIds.has(e.to) && !deployIds.has(e.from));
+  return f;
+}
+// The environment that opened the canvas (?project=…&environment=…, from the
+// New resource page), or null. Both values must look like UUIDs.
+export function targetFrom(search) {
+  const params = new URLSearchParams(search);
+  const project = params.get('project');
+  const environment = params.get('environment');
+  const valid = value => /^[A-Za-z0-9_-]+$/.test(value ?? '');
+  return valid(project) && valid(environment) ? { project, environment } : null;
+}
+// The Start step targets that environment, also in a flow restored from an earlier visit.
+export function withTarget(f, t) {
+  const start = f.nodes.find(n => n.type === 'start');
+  if (t && start) start.data = { project: t.project, environment: t.environment };
+  return f;
+}
+// Secret fields (`secret: true`, or a test on the value) stay in memory only;
+// they are never written to localStorage.
+export function withoutSecrets(f) {
+  const nodes = f.nodes.map(n => {
+    const data = { ...n.data };
+    for (const { key, secret } of TYPES[n.type]?.fields || []) {
+      if (secret === true || (typeof secret === 'function' && data[key] && secret(data[key]))) delete data[key];
+    }
+    return { ...n, data };
+  });
+  return { ...f, nodes };
+}
+// The flow is a tree: Start → Servers → one line per resource (source →
+// settings…), and every line ends in the one Deploy step.
+export const nodeById = (id, f) => f.nodes.find(n => n.id === id);
+export const outsOf = (id, f) => f.edges.filter(e => e.from === id).map(e => e.to);
+export const nextOf = (id, f) => outsOf(id, f)[0];
+export const prevOf = (id, f) => f.edges.find(e => e.to === id)?.from;
+// Start and Server fan out; only Deploy takes more than one line in.
+export const multiOut = n => ['start', 'infra'].includes(TYPES[n.type].stage);
+// The source node above a node in its line (what the settings apply to).
+export function sourceAbove(id, f) {
+  const seen = new Set();
+  for (let cur = id; cur && !seen.has(cur); cur = prevOf(cur, f)) {
+    seen.add(cur);
+    const n = nodeById(cur, f);
+    if (n && TYPES[n.type].stage === 'source') return n;
+  }
+  return null;
+}
+// Can a `type` step come after `prev`? With `target`, also: the link makes no loop.
+export function canFollow(prev, type, target, f) {
+  const t = TYPES[type];
+  const p = TYPES[prev.type];
+  if (type === 'start' || type === 'deploy' || prev.type === 'deploy') return false;
+  if (target) {
+    const seen = new Set();
+    for (let cur = prev.id; cur && !seen.has(cur); cur = prevOf(cur, f)) {
+      if (cur === target.id) return false;
+      seen.add(cur);
+    }
+  }
+  if (p.stage === 'start') return type === 'server';
+  if (p.stage === 'infra') return t.stage === 'source';
+  const src = sourceAbove(prev.id, f);
+  if (!src) return false;
+  if (t.stage === 'ship') return true;
+  if (t.stage !== 'config') return false;
+  const sub = src.type === 'git' || src.type === 'image' || src.type === 'dockerfile' ? src.type : null;
+  return t.for.includes(TYPES[src.type].kind) || (sub !== null && t.for.includes(sub));
+}
+// What a run does: each resource line under each Server under Start.
+export function planOf(f) {
+  const servers = outsOf('start', f).map(id => nodeById(id, f)).filter(n => n?.type === 'server');
+  const lines = [];
+  for (const server of servers) {
+    for (const id of outsOf(server.id, f)) {
+      const source = nodeById(id, f);
+      if (!source || TYPES[source.type].stage !== 'source') continue;
+      const settings = [];
+      const seen = new Set([source.id]);
+      for (let cur = nextOf(source.id, f); cur && !seen.has(cur); cur = nextOf(cur, f)) {
+        seen.add(cur);
+        const n = nodeById(cur, f);
+        if (!n) break;
+        settings.push(n);
+      }
+      lines.push({ server, source, settings, end: settings.at(-1) || source });
+    }
+  }
+  return { start: nodeById('start', f), servers, lines, deploy: f.nodes.find(n => n.type === 'deploy') || null };
+}
+// Source id → label; same labels get a number ("Docker image · nginx #2").
+export function uniqueLabels(sources) {
+  const labels = sources.map(resourceLabel);
+  const seen = {};
+  return new Map(sources.map((src, i) => {
+    const label = labels[i];
+    if (labels.filter(l => l === label).length < 2) return [src.id, label];
+    seen[label] = (seen[label] || 0) + 1;
+    return [src.id, `${label} #${seen[label]}`];
+  }));
+}
+// "Docker image · nginx": what a source step makes, for lists and logs.
+export function resourceLabel(src) {
+  const d = src.data;
+  const detail = d.name || {
+    git: d.mode === 'github' ? d.ghRepo : d.repository,
+    image: d.image,
+    service: d.mode === 'compose' ? 'compose' : d.type,
+    database: d.engine,
+  }[src.type];
+  return detail ? `${TYPES[src.type].title} · ${detail}` : TYPES[src.type].title;
+}
+export function defaults(type) {
+  const data = {};
+  for (const f of TYPES[type].fields) if (f.value !== undefined) data[f.key] = f.value;
+  return data;
+}
+// The Coolify page of a created resource (its deployment, while one runs).
+export function resourceHref(ctx) {
+  const base = `/project/${ctx.project}/environment/${ctx.environment}`;
+  const kind = { application: 'application', service: 'service', database: 'database' }[ctx.resource.kind];
+  return ctx.deployment && kind === 'application' ? `${base}/application/${ctx.resource.uuid}/deployment/${ctx.deployment}` : `${base}/${kind}/${ctx.resource.uuid}`;
+}
diff --git a/resources/js/deploy-canvas.test.js b/resources/js/deploy-canvas.test.js
new file mode 100644
index 0000000000..a8fbecc2d7
--- /dev/null
+++ b/resources/js/deploy-canvas.test.js
@@ -0,0 +1,189 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { freeSpot, zoomShortcut } from './canvas-core.js';
+import { canFollow, domainList, fresh, logoOf, onlyOption, parseEnvVars, planOf, splitImage, targetFrom, uniqueLabels, withDeploy, withoutSecrets, withTarget } from './deploy-canvas.js';
+
+test('splits the tag out of an image name', () => {
+    assert.deepEqual(splitImage('nginx:alpine', 'latest'), { name: 'nginx', tag: 'alpine' });
+    assert.deepEqual(splitImage('ghcr.io:443/org/app', ''), { name: 'ghcr.io:443/org/app', tag: 'latest' });
+    assert.deepEqual(splitImage('ghcr.io:443/org/app', 'v2'), { name: 'ghcr.io:443/org/app', tag: 'v2' });
+});
+
+test('turns an image digest into the sha256- tag form', () => {
+    assert.deepEqual(splitImage('redis@sha256:abc123', 'latest'), { name: 'redis', tag: 'sha256-abc123' });
+});
+
+test('parses KEY=value lines and skips comments and blanks', () => {
+    assert.deepEqual(parseEnvVars('# comment\n\nNODE_ENV=production\nURL="https://a.b/?x=1"\nNOPE\n'), [
+        { key: 'NODE_ENV', value: 'production' },
+        { key: 'URL', value: 'https://a.b/?x=1' },
+    ]);
+});
+
+test('joins domains from lines and commas', () => {
+    assert.equal(domainList(' https://a.com\nhttps://b.com, https://c.com \n'), 'https://a.com,https://b.com,https://c.com');
+});
+
+// Start → Server → (Service, Dockerfile → Env), and the one Deploy step.
+const node = (id, type, data = {}) => ({ id, type, x: 0, y: 0, data });
+const fanOut = () => ({
+    nodes: [
+        node('start', 'start'),
+        node('srv', 'server'),
+        node('svc', 'service', { mode: 'template', type: 'umami' }),
+        node('df', 'dockerfile'),
+        node('env', 'env'),
+        node('dep', 'deploy'),
+    ],
+    edges: [
+        { from: 'start', to: 'srv' },
+        { from: 'srv', to: 'svc' },
+        { from: 'srv', to: 'df' },
+        { from: 'df', to: 'env' },
+    ],
+});
+
+test('plans one line per resource under a server, each ending at its last step', () => {
+    const plan = planOf(fanOut());
+    assert.equal(plan.deploy.id, 'dep');
+    assert.deepEqual(plan.lines.map((l) => [l.server.id, l.source.id, l.settings.map((n) => n.id), l.end.id]), [
+        ['srv', 'svc', [], 'svc'],
+        ['srv', 'df', ['env'], 'env'],
+    ]);
+});
+
+test('adds the deploy step to a flow without one and drops edges into it', () => {
+    const flow = withDeploy({
+        nodes: [node('start', 'start'), node('srv', 'server'), node('img', 'image'), node('old', 'deploy')],
+        edges: [{ from: 'start', to: 'srv' }, { from: 'srv', to: 'img' }, { from: 'img', to: 'old' }],
+    });
+    assert.deepEqual(flow.edges, [{ from: 'start', to: 'srv' }, { from: 'srv', to: 'img' }]);
+    assert.equal(flow.nodes.filter((n) => n.type === 'deploy').length, 1);
+
+    const empty = withDeploy({ nodes: [node('start', 'start')], edges: [] });
+    assert.equal(empty.nodes.filter((n) => n.type === 'deploy').length, 1);
+});
+
+test('allows only steps that fit after a step', () => {
+    const flow = fanOut();
+    const byId = (id) => flow.nodes.find((n) => n.id === id);
+    assert.equal(canFollow(byId('srv'), 'image', null, flow), true);
+    assert.equal(canFollow(byId('start'), 'image', null, flow), false);
+    assert.equal(canFollow(byId('env'), 'deploy', byId('dep'), flow), false); // Deploy is connected on its own
+    assert.equal(canFollow(byId('svc'), 'build', null, flow), false); // build settings are for git only
+    assert.equal(canFollow(byId('dep'), 'env', null, flow), false);
+});
+
+test('refuses a link that would make a loop', () => {
+    const flow = fanOut();
+    flow.nodes.push(node('env2', 'env'));
+    flow.edges.push({ from: 'env', to: 'env2' });
+    const byId = (id) => flow.nodes.find((n) => n.id === id);
+    assert.equal(canFollow(byId('env2'), 'env', byId('env'), flow), false);
+});
+
+test('numbers resources that would have the same name', () => {
+    const names = uniqueLabels([
+        node('a', 'image', { image: 'nginx' }),
+        node('b', 'image', { image: 'nginx' }),
+        node('c', 'service', { mode: 'template', type: 'umami' }),
+    ]);
+    assert.deepEqual([...names.values()], ['Docker image · nginx #1', 'Docker image · nginx #2', 'Service · umami']);
+});
+
+test('keeps secrets out of the stored flow', () => {
+    const flow = {
+        nodes: [
+            node('env', 'env', { vars: 'TOKEN=abc' }),
+            node('svc', 'service', { mode: 'compose', compose: 'services: {}', name: 'web' }),
+            node('git', 'git', { repository: 'https://user:tok@github.com/a/b', branch: 'main' }),
+            node('pub', 'git', { repository: 'https://github.com/a/b' }),
+        ],
+        edges: [],
+    };
+    const stored = withoutSecrets(flow);
+    assert.deepEqual(stored.nodes.map((n) => n.data), [{}, { mode: 'compose', name: 'web' }, { branch: 'main' }, { repository: 'https://github.com/a/b' }]);
+    assert.equal(flow.nodes[0].data.vars, 'TOKEN=abc'); // the open canvas keeps them
+});
+
+test('reads the environment that opened the canvas from the query string', () => {
+    assert.deepEqual(targetFrom('?project=p1a2&environment=e_3-x'), { project: 'p1a2', environment: 'e_3-x' });
+    assert.equal(targetFrom(''), null);
+    assert.equal(targetFrom('?project=p1a2'), null);
+    assert.equal(targetFrom('?project=../servers&environment=e1'), null);
+    assert.equal(targetFrom('?project=p1&environment='), null);
+});
+
+test('points the Start step of a restored flow at the opening environment', () => {
+    const flow = {
+        nodes: [node('start', 'start', { project: 'old', environment: 'old-env' }), node('srv', 'server', { server: 's1' })],
+        edges: [{ from: 'start', to: 'srv' }],
+    };
+    withTarget(flow, { project: 'p1', environment: 'e1' });
+    assert.deepEqual(flow.nodes.map((n) => n.data), [{ project: 'p1', environment: 'e1' }, { server: 's1' }]);
+    assert.deepEqual(withTarget(flow, null).nodes[0].data, { project: 'p1', environment: 'e1' });
+});
+
+test('a new canvas starts with a Server step connected to Start', () => {
+    const plan = planOf(fresh());
+    assert.deepEqual(plan.servers.map((n) => n.id), ['server']);
+    assert.equal(plan.deploy?.type, 'deploy');
+    assert.deepEqual(plan.lines, []);
+});
+
+test('selects the only option, and only when nothing is selected', () => {
+    assert.equal(onlyOption([['srv-1', 'localhost']], ''), 'srv-1');
+    assert.equal(onlyOption([['srv-1', 'localhost']], undefined), 'srv-1');
+    assert.equal(onlyOption([['srv-1', 'localhost']], 'srv-old'), 'srv-old');
+    assert.equal(onlyOption([['srv-1', 'a'], ['srv-2', 'b']], ''), '');
+    assert.equal(onlyOption([], ''), '');
+    assert.equal(onlyOption(null, ''), ''); // still loading
+});
+
+test('keeps a dragged card off the other cards', () => {
+    const other = { x: 0, y: 0, w: 100, h: 100 };
+    const free = { x: 300, y: 0, w: 100, h: 100 };
+    assert.deepEqual(freeSpot(free, [other]), free);
+    // Overlaps from the right: pushed to the right edge, plus the gap.
+    assert.deepEqual(freeSpot({ x: 90, y: 10, w: 100, h: 100 }, [other], 16), { x: 116, y: 10, w: 100, h: 100 });
+    // Overlaps from below: pushed under it.
+    assert.deepEqual(freeSpot({ x: 5, y: 80, w: 100, h: 100 }, [other], 16), { x: 5, y: 116, w: 100, h: 100 });
+});
+
+test('finds a corner spot when two cards block the way', () => {
+    const cards = [{ x: 0, y: 0, w: 100, h: 100 }, { x: 116, y: 0, w: 100, h: 100 }];
+    const spot = freeSpot({ x: 60, y: 20, w: 100, h: 100 }, cards, 16);
+    for (const c of cards) {
+        const apart = spot.x >= c.x + c.w + 16 || spot.x + spot.w + 16 <= c.x || spot.y >= c.y + c.h + 16 || spot.y + spot.h + 16 <= c.y;
+        assert.ok(apart, 'the spot does not touch a card');
+    }
+    assert.deepEqual(spot, { x: 60, y: 116, w: 100, h: 100 });
+});
+
+test('shows the logo of what a source step creates, like the rest of Coolify', () => {
+    const src = (type, data) => logoOf(node('n', type, data))?.src ?? null;
+    assert.equal(src('image', {}), '/svgs/resources/docker-image.svg');
+    assert.equal(src('dockerfile', {}), '/svgs/resources/dockerfile.svg');
+    assert.equal(src('database', { engine: 'postgresql' }), '/svgs/resources/postgres.svg');
+    assert.equal(src('database', { engine: 'mysql' }), '/svgs/resources/mysql.svg');
+    assert.equal(logoOf(node('n', 'database', { engine: 'keydb' })).dark, '/svgs/resources/keydb-dark.svg');
+    assert.equal(src('git', { mode: 'public', buildPack: 'railpack' }), '/svgs/resources/public-repo.svg');
+    assert.equal(src('git', { mode: 'github', buildPack: 'railpack' }), '/svgs/resources/github-app.svg');
+    assert.equal(src('git', { mode: 'key', buildPack: 'railpack' }), '/svgs/resources/deploy-key.svg');
+    assert.equal(src('git', { mode: 'public', buildPack: 'dockerfile' }), '/svgs/resources/dockerfile.svg');
+    assert.equal(src('service', { mode: 'compose' }), '/svgs/resources/docker-compose.svg');
+    // No engine or template yet, or a step that creates nothing: the step keeps its glyph.
+    assert.equal(src('database', {}), null);
+    assert.equal(src('server', {}), null);
+});
+
+test('reads the browser zoom shortcut so the canvas can zoom instead', () => {
+    const key = (key, mods = {}) => zoomShortcut({ key, ctrlKey: false, metaKey: false, altKey: false, ...mods });
+    assert.equal(key('=', { metaKey: true }), 'in');
+    assert.equal(key('+', { ctrlKey: true }), 'in');
+    assert.equal(key('-', { ctrlKey: true }), 'out');
+    assert.equal(key('0', { metaKey: true }), 'reset');
+    assert.equal(key('-'), null);
+    assert.equal(key('-', { ctrlKey: true, altKey: true }), null);
+    assert.equal(key('s', { metaKey: true }), null);
+});
diff --git a/resources/js/environment-canvas.js b/resources/js/environment-canvas.js
new file mode 100644
index 0000000000..3e4311726b
--- /dev/null
+++ b/resources/js/environment-canvas.js
@@ -0,0 +1,727 @@
+// Environment canvas (Beta): pure helpers and constants. The Svelte
+// components live in canvas/environment/.
+//
+// DOM-free: `node --test` imports this file.
+
+import { apart, BOX_GAP, freeSpot, MAX_ZOOM, MIN_ZOOM } from './canvas-core.js';
+
+export const CARD_WIDTH = 260;
+export const COLUMN_GAP = 48;
+export const ROW_GAP = 24;
+export const ZONE_GAP = 72;
+export const ZONE_PADDING = 24;
+export const ZONE_HEADER = 40;
+export const SERVER_ZONE_HEADER = 68; // server canvas: a second header row with host facts, proxy and usage
+export const SERVER_ZONE_MIN_WIDTH = 560; // server canvas: room for the header (name, IP, status, host facts) above one card
+export const MAX_CHILDREN = 5;
+export const MAX_ROWS = 6; // auto placement wraps a type into another column after this many cards
+export const NO_SERVER = 'No server';
+export const DOUBLE_CLICK_MS = 400;
+export const SOURCES_ZONE = 'sources';
+export const CONNECTED_ZONE = 'connected';
+
+const COLUMNS = { application: 0, service: 1, database: 2 };
+/** Connect view: shared variable and tag cards are link sources; every other card is a resource. */
+export const isSource = node => node?.type === 'variable' || node?.type === 'tag';
+const columnOf = node => COLUMNS[node?.type] ?? 0;
+const columnLeft = (originX, column) => originX + column * (CARD_WIDTH + COLUMN_GAP);
+const isPoint = p => !!p && Number.isFinite(Number(p.x)) && Number.isFinite(Number(p.y));
+/** Header height of a zone frame: server canvas zones show a second row of server details. */
+export const zoneHeader = zone => (zone?.details ? SERVER_ZONE_HEADER : ZONE_HEADER);
+const storedPositions = graph => (graph?.positions && !Array.isArray(graph.positions) ? graph.positions : {});
+
+// ── Pure helpers (tested) ─────────────────────────────────────────────
+
+/** Estimated card height in px; matches the rendered card closely enough for auto placement. */
+export function estimateNodeHeight(node) {
+  let height = 58; // padding + icon/name row
+  if (node?.urls?.length) height += 20;
+  if (node?.extra_zones?.length) height += 28;
+  const children = node?.children?.length || 0;
+  if (children) height += 12 + Math.min(children, MAX_CHILDREN) * 20 + (children > MAX_CHILDREN ? 20 : 0);
+  return height;
+}
+
+/** Zones in display order (graph.zones order, then "No server"), each with its nodes. Empty zones are skipped. */
+export function zoneGroups(graph) {
+  const zones = graph?.zones || [];
+  const known = new Set(zones.map(z => z.id));
+  const groups = zones.map(zone => ({ id: zone.id, name: zone.name, zone, nodes: [] }));
+  const none = { id: null, name: NO_SERVER, zone: null, nodes: [] };
+  for (const node of graph?.nodes || []) {
+    if (node.zone !== null && node.zone !== undefined && known.has(node.zone)) {
+      groups.find(g => g.id === node.zone).nodes.push(node);
+    } else {
+      none.nodes.push(node);
+    }
+  }
+  return [...groups, none].filter(g => g.nodes.length);
+}
+
+/**
+ * Card positions (top-left, world px) for every node. Stored positions win;
+ * other nodes are placed in their zone: applications left, services middle,
+ * databases right. Zones without stored cards stack below everything else.
+ */
+export function layoutGraph(graph) {
+  if (graph?.layout === 'server') return layoutServerView(graph);
+  if (graph?.layout === 'connect') return layoutConnectView(graph);
+  const stored = storedPositions(graph);
+  const out = {};
+  const placedBottom = [];
+  const fresh = [];
+  for (const group of zoneGroups(graph)) {
+    const fixed = group.nodes.filter(n => isPoint(stored[n.id]));
+    if (!fixed.length) {
+      fresh.push(group);
+      continue;
+    }
+    for (const n of fixed) out[n.id] = { x: Number(stored[n.id].x), y: Number(stored[n.id].y) };
+    const originX = Math.min(...fixed.map(n => out[n.id].x));
+    const fixedBottom = Math.max(...fixed.map(n => out[n.id].y + estimateNodeHeight(n)));
+    // New cards go in a grid below the saved ones, so they never cover a saved card.
+    const bottom = placeGrid(group.nodes.filter(n => !out[n.id]), originX, fixedBottom + ROW_GAP, out);
+    placedBottom.push(Math.max(fixedBottom, bottom));
+  }
+  let y = placedBottom.length ? Math.max(...placedBottom) + ZONE_PADDING + ZONE_GAP : 0;
+  for (const group of fresh) {
+    y = placeGrid(group.nodes, 0, y + ZONE_HEADER + ZONE_PADDING, out) + ZONE_PADDING + ZONE_GAP;
+  }
+  return out;
+}
+
+/**
+ * Places nodes in a grid from (originX, top): applications, then services, then
+ * databases, each type in its own column(s) that wrap after MAX_ROWS cards.
+ * Returns the bottom of the lowest card (top when there are no nodes).
+ */
+function placeGrid(nodes, originX, top, out) {
+  let firstColumn = 0;
+  let bottom = top;
+  for (const column of [0, 1, 2]) {
+    const ofType = nodes.filter(n => columnOf(n) === column);
+    const nextY = [];
+    ofType.forEach((n, i) => {
+      const sub = Math.floor(i / MAX_ROWS);
+      nextY[sub] ??= top;
+      out[n.id] = { x: columnLeft(originX, firstColumn + sub), y: nextY[sub] };
+      nextY[sub] += estimateNodeHeight(n) + ROW_GAP;
+    });
+    firstColumn += nextY.length;
+    bottom = Math.max(bottom, ...nextY.map(v => v - ROW_GAP));
+  }
+  return bottom;
+}
+
+// ── Server view: project / environment groups, linked cards side by side ──
+
+export const GROUP_PADDING = 16;
+export const GROUP_HEADER = 32;
+export const GROUP_GAP = 32;
+export const GROUPS_PER_ROW = 3;
+export const SINGLE_COLUMNS = 3;
+
+const contextGroups = nodes => {
+  const groups = new Map();
+  for (const n of nodes) {
+    const key = n.context || '';
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(n);
+  }
+  // Server view: the unmanaged containers group comes first, so it is not lost below many projects.
+  const unmanaged = ([, members]) => (members[0]?.type === 'container' ? 0 : 1);
+  return [...groups.entries()].sort((a, b) => unmanaged(a) - unmanaged(b) || a[0].localeCompare(b[0]));
+};
+const byTypeAndName = (a, b) => columnOf(a) - columnOf(b) || String(a.name).localeCompare(String(b.name));
+
+/**
+ * Card positions inside one group, from (0, 0). Cards with a position saved on their environment
+ * canvas (node.saved) keep that arrangement; the other cards follow below them in the grid the environment
+ * canvas uses, so both canvases show the group the same way. Otherwise linked
+ * cards form chains from left to right (source before target, one column per step); every chain
+ * gets its own rows. Cards without links follow in a grid of SINGLE_COLUMNS.
+ */
+export function layoutBlock(nodes, links = []) {
+  const saved = nodes.filter(n => isPoint(n.saved));
+  if (saved.length) {
+    const left = Math.min(...saved.map(n => Number(n.saved.x)));
+    const top = Math.min(...saved.map(n => Number(n.saved.y)));
+    const out = {};
+    for (const n of saved) out[n.id] = { x: Number(n.saved.x) - left, y: Number(n.saved.y) - top };
+    const width = Math.max(...saved.map(n => out[n.id].x)) + CARD_WIDTH;
+    const bottom = Math.max(...saved.map(n => out[n.id].y + estimateNodeHeight(n)));
+    const rest = nodes.filter(n => !out[n.id]);
+    if (!rest.length) return { positions: out, width, height: bottom };
+    // Same grid as the environment canvas (layoutGraph) puts below the saved cards, so both canvases match.
+    const height = placeGrid(rest, 0, bottom + ROW_GAP, out);
+    return { positions: out, width: Math.max(...Object.values(out).map(p => p.x)) + CARD_WIDTH, height };
+  }
+  const ids = new Set(nodes.map(n => n.id));
+  const inside = links.filter(l => ids.has(l.source) && ids.has(l.target) && l.source !== l.target);
+  const parent = new Map(nodes.map(n => [n.id, n.id]));
+  const find = id => (parent.get(id) === id ? id : find(parent.get(id)));
+  for (const l of inside) parent.set(find(l.source), find(l.target));
+  const order = [...nodes].sort(byTypeAndName);
+  const components = new Map();
+  for (const n of order) {
+    const root = find(n.id);
+    if (!components.has(root)) components.set(root, []);
+    components.get(root).push(n);
+  }
+
+  const out = {};
+  const step = CARD_WIDTH + COLUMN_GAP;
+  let top = 0;
+  let columns = 0;
+  const singles = [];
+  for (const members of components.values()) {
+    if (members.length === 1) {
+      singles.push(members[0]);
+      continue;
+    }
+    // Depth: the longest path from a card without incoming links (cycles stop at the size of the chain).
+    const own = new Set(members.map(n => n.id));
+    const edges = inside.filter(l => own.has(l.source));
+    const depth = new Map(members.filter(n => !edges.some(l => l.target === n.id)).map(n => [n.id, 0]));
+    if (!depth.size) depth.set(members[0].id, 0);
+    for (let changed = true, rounds = 0; changed && rounds < members.length; rounds++) {
+      changed = false;
+      for (const l of edges) {
+        const next = (depth.get(l.source) ?? -1) + 1;
+        if (next > 0 && next > (depth.get(l.target) ?? -1)) {
+          depth.set(l.target, next);
+          changed = true;
+        }
+      }
+    }
+    const nextY = [];
+    for (const n of members) {
+      const d = depth.get(n.id) ?? 0;
+      nextY[d] ??= top;
+      out[n.id] = { x: d * step, y: nextY[d] };
+      nextY[d] += estimateNodeHeight(n) + ROW_GAP;
+    }
+    columns = Math.max(columns, nextY.length);
+    top = Math.max(...nextY.filter(v => v !== undefined)) + ROW_GAP;
+  }
+  let rowHeight = 0;
+  singles.forEach((n, i) => {
+    const column = i % SINGLE_COLUMNS;
+    if (column === 0 && i > 0) {
+      top += rowHeight + ROW_GAP;
+      rowHeight = 0;
+    }
+    out[n.id] = { x: column * step, y: top };
+    rowHeight = Math.max(rowHeight, estimateNodeHeight(n));
+  });
+  if (singles.length) columns = Math.max(columns, Math.min(singles.length, SINGLE_COLUMNS));
+  const bottom = singles.length ? top + rowHeight : Math.max(0, top - ROW_GAP);
+  return { positions: out, width: columns * step - COLUMN_GAP, height: bottom };
+}
+
+/**
+ * Server view: key of a project / environment group on one server ("<environment uuid>:<zone id>").
+ * Groups of an empty environment (placeholder card) have none, so they cannot be moved.
+ */
+export const groupKey = (nodes, zoneId) => {
+  const environment = nodes.find(n => n.type !== 'empty' && n.environment?.uuid)?.environment?.uuid;
+  return environment && zoneId ? `${environment}:${zoneId}` : null;
+};
+
+/**
+ * Server view: zones stack downwards. A group with cards saved on its environment canvas (node.saved) sits where
+ * those cards are, so the server canvas and the environment canvas share one position (a group that would
+ * leave the zone or cover another group moves to the nearest free spot). Other groups follow below,
+ * GROUPS_PER_ROW per row. When `groups` is given, it gets per group key its frame top-left, the zone's inner
+ * top-left, and `shift`: environment canvas position = server view position - shift.
+ */
+export function layoutServerView(graph, groups = null, { compact = false } = {}) {
+  const out = {};
+  let y = 0;
+  for (const zone of zoneGroups(graph)) {
+    const inner = { x: 0, y: y + zoneHeader(zone.zone) + ZONE_PADDING };
+    const blocks = contextGroups(zone.nodes).map(([, nodes]) => {
+      const saved = nodes.filter(n => isPoint(n.saved));
+      const block = layoutBlock(nodes, graph.links || []);
+      return {
+        key: groupKey(nodes, zone.id),
+        nodes,
+        block,
+        size: { w: block.width + GROUP_PADDING * 2, h: GROUP_HEADER + GROUP_PADDING * 2 + block.height },
+        at: saved.length ? { x: Math.min(...saved.map(n => Number(n.saved.x))), y: Math.min(...saved.map(n => Number(n.saved.y))) } : null,
+      };
+    });
+    // Empty environments (placeholder cards only) go next to the other groups after these are placed.
+    const isEmpty = b => b.nodes.every(n => n.type === 'empty');
+    const pinned = blocks.filter(b => b.at).sort((a, b) => a.at.y - b.at.y || a.at.x - b.at.x);
+    // The environment canvas puts its first cards below a zone header; those land at the zone's top-left here.
+    const shift = { x: inner.x + GROUP_PADDING, y: inner.y + GROUP_HEADER + GROUP_PADDING - ZONE_HEADER - ZONE_PADDING };
+    const frames = [];
+    const place = ({ key, block, size }, left, top) => {
+      frames.push({ x: left, y: top });
+      for (const [id, p] of Object.entries(block.positions)) {
+        out[id] = { x: left + GROUP_PADDING + p.x, y: top + GROUP_HEADER + GROUP_PADDING + p.y };
+      }
+      if (groups && key) groups[key] = { x: left, y: top, inner, shift };
+      return top + size.h;
+    };
+    const taken = [];
+    const inside = b => b.x >= inner.x && b.y >= inner.y;
+    let bottom = inner.y;
+    for (const b of pinned) {
+      // Environment canvas positions can be left of or above the zone (negative coordinates): keep the group inside.
+      const wanted = {
+        x: Math.max(inner.x, b.at.x + shift.x - GROUP_PADDING),
+        y: Math.max(inner.y, b.at.y + shift.y - GROUP_HEADER - GROUP_PADDING),
+        ...b.size,
+      };
+      const spot = freeSpot(wanted, taken, GROUP_GAP, inside) || wanted;
+      taken.push({ ...spot, project: b.nodes[0]?.project?.uuid });
+      bottom = Math.max(bottom, place(b, spot.x, spot.y));
+    }
+    let x = 0;
+    let rowTop = pinned.length ? bottom + GROUP_GAP : inner.y;
+    let rowBottom = rowTop;
+    blocks.filter(b => !b.at && !isEmpty(b)).forEach((b, i) => {
+      if (i > 0 && i % GROUPS_PER_ROW === 0) {
+        x = 0;
+        rowTop = rowBottom + GROUP_GAP;
+      }
+      taken.push({ x, y: rowTop, ...b.size, project: b.nodes[0]?.project?.uuid });
+      rowBottom = Math.max(rowBottom, place(b, x, rowTop));
+      x += b.size.w + GROUP_GAP;
+    });
+    bottom = Math.max(bottom, rowBottom);
+    // Right of the last group of the same project (or of the zone), at the nearest free spot.
+    for (const b of blocks.filter(b => !b.at && isEmpty(b))) {
+      const project = b.nodes[0]?.project?.uuid;
+      const anchor = taken.filter(t => t.project === project).at(-1) || taken.at(-1);
+      const wanted = anchor ? { x: anchor.x + anchor.w + GROUP_GAP, y: anchor.y, ...b.size } : { ...inner, ...b.size };
+      const spot = freeSpot(wanted, taken, GROUP_GAP, inside) || wanted;
+      taken.push({ ...spot, project });
+      bottom = Math.max(bottom, place(b, spot.x, spot.y));
+    }
+    if (compact && frames.length) {
+      // The groups keep their arrangement, but start at the zone's top-left (no empty space from saved positions).
+      const dx = inner.x - Math.min(...frames.map(f => f.x));
+      const dy = inner.y - Math.min(...frames.map(f => f.y));
+      for (const n of zone.nodes) if (out[n.id]) out[n.id] = { x: out[n.id].x + dx, y: out[n.id].y + dy };
+      bottom += dy;
+    }
+    y = bottom + ZONE_PADDING + ZONE_GAP;
+  }
+  return out;
+}
+
+/**
+ * Shared variables view: variable cards in one column on the left (by name). Resources that use a
+ * variable sit next to them in one column, grouped by project / environment, so every link runs
+ * straight from left to right. Other resources follow below in the server view grid.
+ */
+export function layoutConnectView(graph) {
+  const out = {};
+  const groups = zoneGroups(graph);
+  const variables = groups.find(g => g.id === SOURCES_ZONE);
+  const connected = groups.find(g => g.id === CONNECTED_ZONE);
+  let y = ZONE_HEADER + ZONE_PADDING;
+  for (const n of [...(variables?.nodes || [])].sort((a, b) => String(a.name).localeCompare(String(b.name)))) {
+    out[n.id] = { x: 0, y };
+    y += estimateNodeHeight(n) + ROW_GAP;
+  }
+  const offset = variables ? CARD_WIDTH + ZONE_PADDING * 2 + ZONE_GAP * 2 : 0;
+  let top = 0;
+  if (connected) {
+    y = ZONE_HEADER + ZONE_PADDING;
+    for (const [, nodes] of contextGroups(connected.nodes)) {
+      y += GROUP_HEADER + GROUP_PADDING;
+      for (const n of [...nodes].sort(byTypeAndName)) {
+        out[n.id] = { x: offset + GROUP_PADDING, y };
+        y += estimateNodeHeight(n) + ROW_GAP;
+      }
+      y += GROUP_PADDING - ROW_GAP + GROUP_GAP;
+    }
+    top = y - GROUP_GAP + ZONE_PADDING + ZONE_GAP;
+  }
+  const others = groups.filter(g => g.id !== SOURCES_ZONE && g.id !== CONNECTED_ZONE);
+  // Compact: groups cannot be moved here, so positions saved on the environment canvas must not leave gaps.
+  const placed = layoutServerView({ zones: others.map(g => g.zone || { id: g.id }), nodes: others.flatMap(g => g.nodes) }, null, { compact: true });
+  for (const [id, p] of Object.entries(placed)) out[id] = { x: p.x + offset, y: p.y + top };
+  return out;
+}
+
+/**
+ * Shared variables view: moves the resources that use a shown variable into the "connected" zone,
+ * so they show apart from the other resources. Runs after filterGraph and after every link change.
+ */
+export function groupByUse(graph) {
+  if (graph?.layout !== 'connect') return graph;
+  const used = new Set((graph.links || []).map(l => l.target));
+  return {
+    ...graph,
+    nodes: (graph.nodes || []).map(n => (!isSource(n) && used.has(n.id) ? { ...n, zone: CONNECTED_ZONE } : n)),
+  };
+}
+
+/** Frames of the project / environment groups of the given cards (server view). */
+export function groupFrames(nodes, positions, sizes = {}) {
+  const frames = [];
+  for (const [name, members] of contextGroups(nodes)) {
+    const rects = members.map(n => cardRect(n, positions, sizes)).filter(Boolean);
+    if (!rects.length) continue;
+    const minX = Math.min(...rects.map(r => r.x));
+    const minY = Math.min(...rects.map(r => r.y));
+    frames.push({
+      name,
+      key: groupKey(members, members[0].zone),
+      zone: members[0].zone,
+      link: members[0].context_link,
+      x: minX - GROUP_PADDING,
+      y: minY - GROUP_PADDING - GROUP_HEADER,
+      width: Math.max(...rects.map(r => r.x + r.width)) - minX + GROUP_PADDING * 2,
+      height: Math.max(...rects.map(r => r.y + r.height)) - minY + GROUP_PADDING * 2 + GROUP_HEADER,
+    });
+  }
+  return frames;
+}
+
+/** Card rect from positions and measured sizes (falls back to the estimate). */
+export function cardRect(node, positions, sizes = {}) {
+  const p = positions?.[node.id];
+  if (!p) return null;
+  return {
+    x: p.x,
+    y: p.y,
+    width: sizes[node.id]?.width ?? CARD_WIDTH,
+    height: sizes[node.id]?.height ?? estimateNodeHeight(node),
+  };
+}
+
+/** Frame per zone: bbox of its cards (or of its group frames) + padding, with room for the header on top. */
+export function zoneBoxes(graph, positions, sizes = {}) {
+  const boxes = [];
+  for (const group of zoneGroups(graph)) {
+    const rects = group.nodes.some(n => n.context)
+      ? groupFrames(group.nodes, positions, sizes)
+      : group.nodes.map(n => cardRect(n, positions, sizes)).filter(Boolean);
+    if (!rects.length) continue;
+    const minX = Math.min(...rects.map(r => r.x));
+    const minY = Math.min(...rects.map(r => r.y));
+    const maxX = Math.max(...rects.map(r => r.x + r.width));
+    const maxY = Math.max(...rects.map(r => r.y + r.height));
+    boxes.push({
+      id: group.id,
+      name: group.name,
+      zone: group.zone,
+      nodes: group.nodes.map(n => n.id),
+      x: minX - ZONE_PADDING,
+      y: minY - ZONE_PADDING - zoneHeader(group.zone),
+      width: Math.max(maxX - minX + ZONE_PADDING * 2, group.zone?.details ? SERVER_ZONE_MIN_WIDTH : 0),
+      height: maxY - minY + ZONE_PADDING * 2 + zoneHeader(group.zone),
+    });
+  }
+  return boxes;
+}
+
+const toBox = r => ({ x: r.x, y: r.y, w: r.width, h: r.height });
+// A frame reaches `side` past its cards left, right and below, and `top` above them.
+const grow = (b, side, top) => ({ x: b.x - side, y: b.y - top, w: b.w + side * 2, h: b.h + side + top });
+const frameAround = (boxes, side, top) => {
+  const x = Math.min(...boxes.map(b => b.x));
+  const y = Math.min(...boxes.map(b => b.y));
+  return grow({ x, y, w: Math.max(...boxes.map(b => b.x + b.w)) - x, h: Math.max(...boxes.map(b => b.y + b.h)) - y }, side, top);
+};
+
+/**
+ * What a dragged card must keep clear of, for freeSpot(): `others` are the
+ * other cards and the other zone frames (and, server view, the other project /
+ * environment frames in its zone), grown by the room the card's own frames
+ * take around it. `fits` checks the card's own frames, which also span its
+ * other cards, against those frames.
+ */
+export function dragRules(graph, positions, sizes, id) {
+  const node = graph.nodes.find(n => n.id === id);
+  const own = zoneGroups(graph).find(z => z.nodes.some(n => n.id === id));
+  const grouped = !!own?.nodes.some(n => n.context);
+  const context = n => n.context || '';
+  const rects = nodes => nodes.filter(n => n.id !== id).map(n => cardRect(n, positions, sizes)).filter(Boolean).map(toBox);
+  const groupSide = grouped ? GROUP_PADDING : 0;
+  const groupTop = grouped ? GROUP_PADDING + GROUP_HEADER : 0;
+  const side = ZONE_PADDING + groupSide;
+  const top = ZONE_PADDING + zoneHeader(own?.zone) + groupTop;
+  const zones = zoneBoxes(graph, positions, sizes).filter(z => !z.nodes.includes(id)).map(toBox);
+  const groups = grouped ? groupFrames(own.nodes.filter(n => context(n) !== context(node)), positions, sizes).map(toBox) : [];
+  const zoneMates = rects(own?.nodes || []);
+  const groupMates = grouped ? rects(own.nodes.filter(n => context(n) === context(node))) : [];
+  // The other box must keep the frame's room on the side that faces the card.
+  const room = (b, s, t) => ({ x: b.x - s, y: b.y - s, w: b.w + s * 2, h: b.h + s + t });
+  return {
+    others: [...rects(graph.nodes), ...zones.map(z => room(z, side, top)), ...groups.map(g => room(g, groupSide, groupTop))],
+    fits: box => zones.every(z => apart(frameAround([...zoneMates, box], side, top), z, BOX_GAP))
+      // Same gap between groups as layoutServerView, so a reload does not move the group.
+      && (!grouped || groups.every(g => apart(frameAround([...groupMates, box], groupSide, groupTop), g, GROUP_GAP))),
+  };
+}
+
+/**
+ * SVG path between two card rects. Target right of source: right edge →
+ * left edge; target left of source: left edge → right edge; overlapping
+ * columns (stacked): bottom → top (or top → bottom when the target is above).
+ */
+export function linkPath(a, b) {
+  let side;
+  let from;
+  let to;
+  let c1;
+  let c2;
+  if (b.x >= a.x + a.width) {
+    side = 'right';
+    from = { x: a.x + a.width, y: a.y + a.height / 2 };
+    to = { x: b.x, y: b.y + b.height / 2 };
+  } else if (b.x + b.width <= a.x) {
+    side = 'left';
+    from = { x: a.x, y: a.y + a.height / 2 };
+    to = { x: b.x + b.width, y: b.y + b.height / 2 };
+  } else if (b.y + b.height / 2 >= a.y + a.height / 2) {
+    side = 'down';
+    from = { x: a.x + a.width / 2, y: a.y + a.height };
+    to = { x: b.x + b.width / 2, y: b.y };
+  } else {
+    side = 'up';
+    from = { x: a.x + a.width / 2, y: a.y };
+    to = { x: b.x + b.width / 2, y: b.y + b.height };
+  }
+  if (side === 'right' || side === 'left') {
+    const dx = Math.max(40, Math.abs(to.x - from.x) / 2) * (side === 'right' ? 1 : -1);
+    c1 = { x: from.x + dx, y: from.y };
+    c2 = { x: to.x - dx, y: to.y };
+  } else {
+    const dy = Math.max(40, Math.abs(to.y - from.y) / 2) * (side === 'down' ? 1 : -1);
+    c1 = { x: from.x, y: from.y + dy };
+    c2 = { x: to.x, y: to.y - dy };
+  }
+  const mid = {
+    x: (from.x + 3 * c1.x + 3 * c2.x + to.x) / 8,
+    y: (from.y + 3 * c1.y + 3 * c2.y + to.y) / 8,
+  };
+  const r = v => Math.round(v * 10) / 10;
+  const d = `M ${r(from.x)} ${r(from.y)} C ${r(c1.x)} ${r(c1.y)}, ${r(c2.x)} ${r(c2.y)}, ${r(to.x)} ${r(to.y)}`;
+  return { d, side, from, to, mid };
+}
+
+const BUSY = ['starting', 'restarting', 'created', 'removing', 'in_progress', 'queued', 'deploying', 'building'];
+const BAD = ['exited', 'stopped', 'dead', 'failed', 'error'];
+
+/** Coolify status string → 'ok' | 'warn' | 'bad' | 'idle' | 'busy'. */
+export function statusTone(status) {
+  const value = String(status ?? '').trim().toLowerCase();
+  if (!value) return 'idle';
+  const [state, health = ''] = value.replace(/\)$/, '').split(/\s*[:(]\s*/);
+  if (BUSY.includes(state)) return 'busy';
+  if (BAD.includes(state)) return 'bad';
+  if (state === 'degraded') return 'warn';
+  if (state === 'running' || state === 'healthy') return health === 'unhealthy' ? 'warn' : 'ok';
+  return 'idle';
+}
+
+export const READABLE_ZOOM = 0.6;
+const FIT_PAD = 48;
+
+/**
+ * View ({x, y, z}) that shows the content bounds in the free part of the viewport ({left, top, width, height}).
+ * `readable`: never below READABLE_ZOOM; content that does not fit then starts at its top-left,
+ * so the cards can be read and the user scrolls to the rest.
+ */
+export function fitView(bounds, area, readable = false) {
+  const w = bounds.maxX - bounds.minX;
+  const h = bounds.maxY - bounds.minY;
+  const room = { w: area.width - FIT_PAD * 2, h: area.height - FIT_PAD * 2 };
+  const whole = Math.min(room.w / w, room.h / h);
+  const z = Math.min(1.1, Math.max(readable ? READABLE_ZOOM : MIN_ZOOM, whole));
+  const x = w * z <= room.w ? area.left + (area.width - w * z) / 2 : area.left + FIT_PAD;
+  const y = h * z <= room.h ? area.top + (area.height - h * z) / 2 : area.top + FIT_PAD;
+  return { z, x: x - bounds.minX * z, y: y - bounds.minY * z };
+}
+
+/** Resource cards per status tone ({ok, warn, bad, busy, idle}); unmanaged containers and placeholder cards are not counted. */
+export function statusSummary(nodes) {
+  const out = { ok: 0, warn: 0, bad: 0, busy: 0, idle: 0 };
+  for (const n of nodes || []) if (n.type !== 'container' && n.type !== 'empty' && !isSource(n)) out[statusTone(n.status)]++;
+  return out;
+}
+
+/** "running:healthy" → "Running": the state word for the status text on a card. */
+export function statusWord(status) {
+  return statusLabel(status).replace(/\s*\(.*$/, '');
+}
+
+/** 1007820800 → "1 GB", 17179869184 → "16 GB". */
+export function formatMemory(bytes) {
+  if (!bytes) return null;
+  const gb = bytes / 1024 ** 3;
+  return `${gb < 10 ? Math.round(gb * 10) / 10 : Math.round(gb)} GB`;
+}
+
+/** Time since a "YYYY-MM-DD HH:MM:SS" (UTC) or ISO date, as "45m", "5h", "12d". */
+export function formatUptime(since, now = Date.now()) {
+  const at = Date.parse(String(since || '').replace(' ', 'T') + (/[zZ]|[+-]\d\d:?\d\d$/.test(since || '') ? '' : 'Z'));
+  if (!Number.isFinite(at)) return null;
+  const minutes = Math.max(0, Math.floor((now - at) / 60000));
+  if (minutes < 60) return `${minutes}m`;
+  if (minutes < 60 * 24) return `${Math.floor(minutes / 60)}h`;
+  return `${Math.floor(minutes / 1440)}d`;
+}
+
+/**
+ * Ids of the server zones whose server is not reachable. The saved status of their resources is stale,
+ * so the canvas shows it as unknown. Zones with an icon (projects, connect view) are not servers.
+ */
+export function unreachableZones(graph) {
+  return new Set((graph?.zones || []).filter(z => !z.icon && z.is_reachable === false).map(z => z.id));
+}
+
+/** "running:healthy" → "Running (healthy)". */
+export function statusLabel(status) {
+  const value = String(status ?? '').trim();
+  if (!value) return 'Unknown';
+  const [state, health] = value.replace(/\)$/, '').split(/\s*[:(]\s*/);
+  const word = state.charAt(0).toUpperCase() + state.slice(1).replace(/_/g, ' ');
+  return health ? `${word} (${health})` : word;
+}
+
+/**
+ * Connect and server views: projects of the resources, each with its environments, sorted by name.
+ * @returns {{uuid: string, name: string, environments: {uuid: string, name: string}[]}[]}
+ */
+export function filterOptions(graph) {
+  const projects = new Map();
+  for (const n of graph?.nodes || []) {
+    if (!n.project || !n.environment) continue;
+    if (!projects.has(n.project.uuid)) projects.set(n.project.uuid, { ...n.project, environments: new Map() });
+    projects.get(n.project.uuid).environments.set(n.environment.uuid, n.environment);
+  }
+  const byName = (a, b) => String(a.name).localeCompare(String(b.name));
+  return [...projects.values()]
+    .map(p => ({ uuid: p.uuid, name: p.name, environments: [...p.environments.values()].sort(byName) }))
+    .sort(byName);
+}
+
+/**
+ * Connect and server views: only the resources of the chosen project / environment and their links.
+ * Variables always stay, so they can be added to the shown resources.
+ */
+export function filterGraph(graph, filter = {}) {
+  if (!graph || (!filter.project && !filter.environment)) return graph;
+  const keep = n => isSource(n)
+    || ((!filter.project || n.project?.uuid === filter.project) && (!filter.environment || n.environment?.uuid === filter.environment));
+  const nodes = (graph.nodes || []).filter(keep);
+  const ids = new Set(nodes.map(n => n.id));
+  return { ...graph, nodes, links: (graph.links || []).filter(l => ids.has(l.source) && ids.has(l.target)) };
+}
+
+/**
+ * Connect view: links go from a shared variable (not a deleted one) or a tag to a resource.
+ * Server view: links are saved on an environment canvas, so both cards must be in the same environment.
+ */
+export function canConnect(graph, source, target) {
+  if (graph?.layout === 'server') {
+    const environment = graph.nodes?.find(n => n.id === source)?.environment?.uuid;
+    return !!environment && source !== target && graph.nodes.find(n => n.id === target)?.environment?.uuid === environment;
+  }
+  if (graph?.layout !== 'connect') return !!source && !!target && source !== target;
+  const from = graph.nodes?.find(n => n.id === source);
+  const to = graph.nodes?.find(n => n.id === target);
+  return isSource(from) && !from.missing && !!to && !isSource(to);
+}
+
+/** A link may be drawn between two different nodes that are not linked yet (either direction). */
+export function canLink(links, source, target) {
+  if (!source || !target || source === target) return false;
+  return !(links || []).some(l => (l.source === source && l.target === target) || (l.source === target && l.target === source));
+}
+
+// ── Card and panel constants (used by the Svelte components) ──────────
+
+// Application and service events go to the team channel; database events go to the user channel.
+export const STATUS_CHANNELS = [['team', ['ApplicationStatusChanged', 'ServiceStatusChanged']], ['user', ['DatabaseStatusChanged']]];
+export const TYPE_LABELS = { application: 'Application', service: 'Service', database: 'Database', container: 'Unmanaged container', variable: 'Shared variable', tag: 'Tag' };
+// Wording of the connect view, per data-mode (shared variables or tags).
+export const CONNECT_TEXT = {
+  variables: {
+    source: 'Variable',
+    added: (source, target) => `Added ${source} to ${target}. Redeploy it to use the variable.`,
+    removed: (source, target) => `Removed ${source} from ${target}. Redeploy it to apply.`,
+    already: (source, target) => `${target} already uses ${source}.`,
+    usedBy: 'Used by',
+    noTargets: 'No resource uses this variable.',
+    allTargets: 'Every resource already uses this variable.',
+    port: 'Drag to a resource to add this variable to it',
+    noSources: 'This resource uses no shared variable of this scope.',
+    sources: 'Shared variables',
+    addSources: 'Add shared variables',
+    searchSources: 'Search variables',
+    noMoreSources: 'No other shared variable to add.',
+    note: node => `Adding creates a ${node.name} variable with the value ${node.reference} on the resource. Redeploy or restart the resource to apply changes.`,
+    viewOnly: 'You can look around. Only team admins can add shared variables to resources.',
+    empty: 'No shared variables or resources yet',
+  },
+  tags: {
+    source: 'Tag',
+    added: (source, target) => `Tagged ${target} with ${source}.`,
+    removed: (source, target) => `Removed the ${source} tag from ${target}.`,
+    already: (source, target) => `${target} already has the ${source} tag.`,
+    usedBy: 'Tagged',
+    noTargets: 'No resource has this tag.',
+    allTargets: 'Every resource already has this tag.',
+    port: 'Drag to a resource to tag it',
+    noSources: 'This resource has no tag.',
+    sources: 'Tags',
+    addSources: 'Add tags',
+    searchSources: 'Search tags',
+    noMoreSources: 'No other tag to add. Create tags on the Tags page.',
+    note: () => 'The deploy webhook of a tag deploys every tagged application and service.',
+    viewOnly: 'You can look around. Only team admins can tag resources.',
+    empty: 'No tags or resources yet',
+  },
+};
+export const TONE_DOT = {
+  ok: 'bg-emerald-500',
+  warn: 'bg-warning',
+  bad: 'bg-red-500',
+  idle: 'bg-neutral-400 dark:bg-neutral-500',
+  busy: 'bg-warning',
+};
+// Outline icons, drawn from local paths.
+export const ICONS = {
+  chevron: ['M6 15l6-6 6 6'],
+  application: ['M3 6.5A2.5 2.5 0 0 1 5.5 4h13A2.5 2.5 0 0 1 21 6.5v11a2.5 2.5 0 0 1-2.5 2.5h-13A2.5 2.5 0 0 1 3 17.5z', 'M3 9h18', 'M9.5 13l-2 2 2 2', 'M14.5 13l2 2-2 2'],
+  service: ['M12 4 3 8.5l9 4.5 9-4.5z', 'M3 12.5l9 4.5 9-4.5', 'M3 16.5l9 4.5 9-4.5'],
+  database: ['M5 6c0-1.66 3.13-3 7-3s7 1.34 7 3-3.13 3-7 3-7-1.34-7-3z', 'M5 6v12c0 1.66 3.13 3 7 3s7-1.34 7-3V6', 'M5 12c0 1.66 3.13 3 7 3s7-1.34 7-3'],
+  container: ['M12 3 4 7.5v9L12 21l8-4.5v-9z', 'M4 7.5 12 12l8-4.5', 'M12 12v9'],
+  server: ['M4 4h16v6H4z', 'M4 14h16v6H4z', 'M7.5 7h.01', 'M7.5 17h.01'],
+  refresh: ['M20 11a8 8 0 0 0-14.9-3.9', 'M4 4v4h4', 'M4 13a8 8 0 0 0 14.9 3.9', 'M20 20v-4h-4'],
+  plus: ['M12 5v14', 'M5 12h14'],
+  minus: ['M5 12h14'],
+  fit: ['M4 9V4h5', 'M20 9V4h-5', 'M4 15v5h5', 'M20 15v5h-5'],
+  x: ['M6 6l12 12', 'M18 6 6 18'],
+  external: ['M14 4h6v6', 'M20 4l-9 9', 'M18 14v4a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h4'],
+  link: ['M10 14a4 4 0 0 0 5.66 0l3-3a4 4 0 0 0-5.66-5.66l-1 1', 'M14 10a4 4 0 0 0-5.66 0l-3 3a4 4 0 0 0 5.66 5.66l1-1'],
+  variable: ['M8 4H7a2 2 0 0 0-2 2v4a2 2 0 0 1-2 2 2 2 0 0 1 2 2v4a2 2 0 0 0 2 2h1', 'M16 4h1a2 2 0 0 1 2 2v4a2 2 0 0 0 2 2 2 2 0 0 0-2 2v4a2 2 0 0 1-2 2h-1'],
+  search: ['M11 18a7 7 0 1 0 0-14 7 7 0 0 0 0 14z', 'M20 20l-4-4'],
+  tag: ['M3 12V4a1 1 0 0 1 1-1h8l9 9-9 9z', 'M7.5 7.5h.01'],
+  info: ['M12 21a9 9 0 1 0 0-18 9 9 0 0 0 0 18z', 'M12 11v5', 'M12 8h.01'],
+};
+
+/** A saved { x, y, z } canvas view, or null when it is missing or not valid. */
+export function readView(key, storage = globalThis.localStorage) {
+  try {
+    const v = JSON.parse(storage?.getItem(key) ?? 'null');
+    const ok = v && [v.x, v.y, v.z].every(Number.isFinite) && v.z >= MIN_ZOOM && v.z <= MAX_ZOOM;
+    return ok ? { x: v.x, y: v.y, z: v.z } : null;
+  } catch {
+    return null;
+  }
+}
+
+// Small screens: a notice that the canvas is not optimized for mobile. Shown below 768px (md);
+// closed once, it stays closed on every canvas (same key as the deploy canvas notice).
+export const MOBILE_NOTICE_KEY = 'coolify-canvas:mobile-notice-dismissed';
diff --git a/resources/js/environment-canvas.test.js b/resources/js/environment-canvas.test.js
new file mode 100644
index 0000000000..e88dcd9904
--- /dev/null
+++ b/resources/js/environment-canvas.test.js
@@ -0,0 +1,670 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  CARD_WIDTH,
+  GROUP_GAP,
+  MAX_ROWS,
+  COLUMN_GAP,
+  ROW_GAP,
+  SERVER_ZONE_MIN_WIDTH,
+  ZONE_HEADER,
+  ZONE_PADDING,
+  ZONE_GAP,
+  canConnect,
+  canLink,
+  dragRules,
+  filterGraph,
+  groupByUse,
+  filterOptions,
+  fitView,
+  formatMemory,
+  formatUptime,
+  SERVER_ZONE_HEADER,
+  statusSummary,
+  statusWord,
+  READABLE_ZOOM,
+  groupFrames,
+  groupKey,
+  layoutBlock,
+  estimateNodeHeight,
+  layoutGraph,
+  layoutServerView,
+  linkPath,
+  statusLabel,
+  statusTone,
+  zoneBoxes,
+  readView,
+  unreachableZones,
+} from './environment-canvas.js';
+import { freeSpot } from './canvas-core.js';
+
+const node = (id, type, zone, extra = {}) => ({ id, type, zone, name: id, status: 'running:healthy', extra_zones: [], urls: [], children: [], ...extra });
+const graph = (nodes, extra = {}) => ({
+  zones: [{ id: 's1', name: 'One' }, { id: 's2', name: 'Two' }],
+  nodes,
+  links: [],
+  positions: {},
+  ...extra,
+});
+const column = n => n * (CARD_WIDTH + COLUMN_GAP);
+
+test('places applications, services, and databases in their own columns', () => {
+  const p = layoutGraph(graph([node('db', 'database', 's1'), node('app', 'application', 's1'), node('svc', 'service', 's1')]));
+  assert.equal(p.app.x, column(0));
+  assert.equal(p.svc.x, column(1));
+  assert.equal(p.db.x, column(2));
+  const top = ZONE_HEADER + ZONE_PADDING;
+  assert.deepEqual([p.app.y, p.svc.y, p.db.y], [top, top, top]);
+});
+
+test('stacks rows of the same type inside a column', () => {
+  const first = node('a1', 'application', 's1', { urls: ['https://a.test'] });
+  const p = layoutGraph(graph([first, node('a2', 'application', 's1')]));
+  assert.equal(p.a2.x, p.a1.x);
+  assert.equal(p.a2.y, p.a1.y + estimateNodeHeight(first) + ROW_GAP);
+});
+
+test('wraps a long list into another column and shifts later types right', () => {
+  const apps = Array.from({ length: MAX_ROWS + 1 }, (_, i) => node(`a${i}`, 'application', 's1'));
+  const p = layoutGraph(graph([...apps, node('db', 'database', 's1')]));
+  assert.equal(p[`a${MAX_ROWS - 1}`].x, column(0));
+  assert.deepEqual(p[`a${MAX_ROWS}`], { x: column(1), y: ZONE_HEADER + ZONE_PADDING });
+  assert.equal(p.db.x, column(2));
+});
+
+test('stacks zones in graph order with the "No server" zone last', () => {
+  const p = layoutGraph(graph([node('orphan', 'application', null), node('b', 'application', 's2'), node('a', 'application', 's1')]));
+  assert.ok(p.a.y < p.b.y, 'first server zone on top');
+  assert.ok(p.b.y < p.orphan.y, 'no-server zone at the bottom');
+  const boxes = zoneBoxes(graph([node('orphan', 'application', null), node('b', 'application', 's2'), node('a', 'application', 's1')]), p);
+  assert.deepEqual(boxes.map(b => b.name), ['One', 'Two', 'No server']);
+  for (let i = 1; i < boxes.length; i++) assert.ok(boxes[i].y > boxes[i - 1].y + boxes[i - 1].height, 'zones do not overlap');
+});
+
+test('treats a zone id that is not in the zone list as no server', () => {
+  const g = graph([node('x', 'database', 'gone')]);
+  assert.deepEqual(zoneBoxes(g, layoutGraph(g)).map(b => b.id), [null]);
+});
+
+test('stored positions win over auto placement', () => {
+  const p = layoutGraph(graph([node('app', 'application', 's1')], { positions: { app: { x: 500, y: -40 } } }));
+  assert.deepEqual(p.app, { x: 500, y: -40 });
+});
+
+test('treats an empty positions list from PHP as nothing stored', () => {
+  const p = layoutGraph(graph([node('app', 'application', 's1')], { positions: [] }));
+  assert.equal(p.app.x, 0);
+});
+
+test('places new nodes in a wrapped grid below the stored cards of their zone', () => {
+  const stored = node('a1', 'application', 's1');
+  const apps = Array.from({ length: MAX_ROWS + 1 }, (_, i) => node(`n${i}`, 'application', 's1'));
+  const p = layoutGraph(graph([stored, ...apps, node('d1', 'database', 's1')], { positions: { a1: { x: 100, y: 200 } } }));
+  const top = 200 + estimateNodeHeight(stored) + ROW_GAP;
+  assert.deepEqual(p.n0, { x: 100, y: top });
+  assert.deepEqual(p[`n${MAX_ROWS}`], { x: 100 + column(1), y: top }, 'wraps after MAX_ROWS cards');
+  assert.deepEqual(p.d1, { x: 100 + column(2), y: top }, 'databases go right of the application columns');
+});
+
+test('auto-placed zones go below zones with stored cards', () => {
+  const p = layoutGraph(graph([node('a', 'application', 's1'), node('b', 'application', 's2')], { positions: { a: { x: 0, y: 1000 } } }));
+  assert.ok(p.b.y > 1000 + estimateNodeHeight(node('a', 'application', 's1')) + ZONE_PADDING + ZONE_HEADER);
+});
+
+test('estimates taller cards for urls, chips, and children', () => {
+  const plain = estimateNodeHeight(node('a', 'service', 's1'));
+  const rich = estimateNodeHeight(node('b', 'service', 's1', { urls: ['https://x'], extra_zones: ['s2'], children: [{ name: 'c' }, { name: 'd' }] }));
+  assert.ok(rich > plain);
+  const capped = estimateNodeHeight(node('c', 'service', 's1', { children: Array.from({ length: 20 }, (_, i) => ({ name: `c${i}` })) }));
+  const six = estimateNodeHeight(node('d', 'service', 's1', { children: Array.from({ length: 6 }, (_, i) => ({ name: `c${i}` })) }));
+  assert.equal(capped, six, 'children beyond the cap add one "+N more" row');
+});
+
+test('zone boxes wrap their cards with padding and header', () => {
+  const g = graph([node('a', 'application', 's1'), node('d', 'database', 's1')]);
+  const positions = { a: { x: 0, y: 0 }, d: { x: 400, y: 50 } };
+  const sizes = { a: { width: 260, height: 100 }, d: { width: 260, height: 80 } };
+  const [box] = zoneBoxes(g, positions, sizes);
+  assert.deepEqual(
+    { id: box.id, x: box.x, y: box.y, width: box.width, height: box.height, nodes: box.nodes },
+    { id: 's1', x: -ZONE_PADDING, y: -ZONE_PADDING - ZONE_HEADER, width: 660 + ZONE_PADDING * 2, height: 130 + ZONE_PADDING * 2 + ZONE_HEADER, nodes: ['a', 'd'] },
+  );
+});
+
+test('server canvas zone boxes are wide enough for their header, also with one card', () => {
+  const g = graph([node('a', 'application', 's1')], { zones: [{ id: 's1', name: 'One', details: {} }] });
+  const [box] = zoneBoxes(g, { a: { x: 0, y: 0 } }, { a: { width: 260, height: 100 } });
+  assert.equal(box.x, -ZONE_PADDING);
+  assert.equal(box.width, SERVER_ZONE_MIN_WIDTH);
+});
+
+test('zone boxes skip zones without cards', () => {
+  assert.deepEqual(zoneBoxes(graph([node('a', 'application', 's2')]), { a: { x: 0, y: 0 } }).map(b => b.id), ['s2']);
+});
+
+const rect = (x, y) => ({ x, y, width: 260, height: 100 });
+
+test('links go from the right edge to the left edge when the target is on the right', () => {
+  const path = linkPath(rect(0, 0), rect(400, 200));
+  assert.equal(path.side, 'right');
+  assert.deepEqual(path.from, { x: 260, y: 50 });
+  assert.deepEqual(path.to, { x: 400, y: 250 });
+  assert.match(path.d, /^M 260 50 C /);
+});
+
+test('links go from the left edge to the right edge when the target is on the left', () => {
+  const path = linkPath(rect(400, 0), rect(0, 0));
+  assert.equal(path.side, 'left');
+  assert.deepEqual(path.from, { x: 400, y: 50 });
+  assert.deepEqual(path.to, { x: 260, y: 50 });
+});
+
+test('links run vertically between stacked cards', () => {
+  const down = linkPath(rect(0, 0), rect(40, 300));
+  assert.equal(down.side, 'down');
+  assert.deepEqual([down.from, down.to], [{ x: 130, y: 100 }, { x: 170, y: 300 }]);
+  const up = linkPath(rect(0, 300), rect(0, 0));
+  assert.equal(up.side, 'up');
+  assert.deepEqual([up.from, up.to], [{ x: 130, y: 300 }, { x: 130, y: 100 }]);
+});
+
+test('link midpoint sits between both ends', () => {
+  const { mid } = linkPath(rect(0, 0), rect(600, 0));
+  assert.deepEqual(mid, { x: 430, y: 50 });
+});
+
+test('maps Coolify statuses to tones', () => {
+  const cases = {
+    'running:healthy': 'ok',
+    'running:unknown': 'ok',
+    running: 'ok',
+    'running (healthy)': 'ok',
+    'running:unhealthy': 'warn',
+    'degraded:unhealthy': 'warn',
+    'exited:unhealthy': 'bad',
+    exited: 'bad',
+    stopped: 'bad',
+    restarting: 'busy',
+    'starting:unknown': 'busy',
+    paused: 'idle',
+    '': 'idle',
+    null: 'idle',
+  };
+  for (const [status, tone] of Object.entries(cases)) {
+    assert.equal(statusTone(status === 'null' ? null : status), tone, status);
+  }
+});
+
+test('formats status labels', () => {
+  assert.equal(statusLabel('running:healthy'), 'Running (healthy)');
+  assert.equal(statusLabel('exited'), 'Exited');
+  assert.equal(statusLabel(''), 'Unknown');
+});
+
+test('refuses self links and duplicates in either direction', () => {
+  const links = [{ id: 'l1', source: 'a', target: 'b', label: null }];
+  assert.equal(canLink(links, 'a', 'a'), false);
+  assert.equal(canLink(links, 'a', 'b'), false);
+  assert.equal(canLink(links, 'b', 'a'), false);
+  assert.equal(canLink(links, 'a', 'c'), true);
+});
+
+test('a server view card has the same height as on the environment canvas', () => {
+  const card = { id: 'a', type: 'application' };
+  // The group frame names the project / environment, so the card has no extra line for it.
+  assert.equal(estimateNodeHeight({ ...card, context: 'Acme / production' }), estimateNodeHeight(card));
+});
+
+// ── Server view ──
+const srv = (id, type, context, extra = {}) => ({ id, type, name: id, zone: 'z1', context, ...extra });
+
+test('server view: a chain of linked cards runs left to right, source before target', () => {
+  const nodes = [srv('db', 'database', 'A / prod'), srv('web', 'application', 'A / prod'), srv('api', 'application', 'A / prod')];
+  const { positions } = layoutBlock(nodes, [{ source: 'web', target: 'api' }, { source: 'api', target: 'db' }]);
+  assert.equal(positions.web.y, positions.api.y);
+  assert.equal(positions.api.y, positions.db.y);
+  assert.ok(positions.web.x < positions.api.x && positions.api.x < positions.db.x);
+  assert.equal(positions.api.x - positions.web.x, CARD_WIDTH + COLUMN_GAP);
+});
+
+test('server view: cards without links go below the chains, in a grid', () => {
+  const nodes = [srv('a', 'application', 'g'), srv('b', 'application', 'g'), srv('c', 'service', 'g'), srv('d', 'database', 'g'), srv('e', 'database', 'g')];
+  const { positions } = layoutBlock(nodes, [{ source: 'a', target: 'd' }]);
+  assert.equal(positions.a.y, positions.d.y); // linked pair side by side
+  for (const id of ['b', 'c', 'e']) assert.ok(positions[id].y > positions.a.y, `${id} is below the chain`);
+  assert.equal(positions.b.y, positions.c.y); // one grid row
+});
+
+test('server view: a link cycle still gets every card a position', () => {
+  const nodes = [srv('x', 'application', 'g'), srv('y', 'application', 'g')];
+  const { positions } = layoutBlock(nodes, [{ source: 'x', target: 'y' }, { source: 'y', target: 'x' }]);
+  assert.ok(positions.x && positions.y);
+  assert.notDeepEqual(positions.x, positions.y);
+});
+
+test('server view: one frame per project / environment, and the frames do not overlap', () => {
+  const graph = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [srv('a', 'application', 'Shop / prod'), srv('b', 'database', 'Shop / prod'), srv('c', 'application', 'Blog / prod')],
+    links: [{ id: 'l', source: 'a', target: 'b' }],
+    positions: {},
+  };
+  const positions = layoutGraph(graph);
+  const frames = groupFrames(graph.nodes, positions);
+  assert.deepEqual(frames.map(f => f.name), ['Blog / prod', 'Shop / prod']);
+  const [f1, f2] = frames;
+  assert.ok(f1.x + f1.width <= f2.x || f2.x + f2.width <= f1.x || f1.y + f1.height <= f2.y || f2.y + f2.height <= f1.y);
+  assert.equal(positions.a.y, positions.b.y);
+});
+
+const envNode = (id, type, zone, environment, extra = {}) => srv(id, type, `Shop / ${environment}`, { zone, project: { uuid: 'p' }, environment: { uuid: environment }, ...extra });
+
+test('server view: cards link only to cards of the same environment', () => {
+  const g = {
+    layout: 'server',
+    nodes: [envNode('a', 'application', 'z1', 'prod'), envNode('b', 'database', 'z2', 'prod'), envNode('c', 'application', 'z1', 'dev'), { id: 'container:1', type: 'container', zone: 'z1' }],
+  };
+  assert.equal(canConnect(g, 'a', 'b'), true);
+  assert.equal(canConnect(g, 'a', 'c'), false);
+  assert.equal(canConnect(g, 'a', 'a'), false);
+  assert.equal(canConnect(g, 'a', 'container:1'), false);
+  assert.equal(canConnect(g, 'container:1', 'a'), false);
+});
+
+test('server view: positions saved on an environment canvas are ignored', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [envNode('a', 'application', 'z1', 'prod'), envNode('b', 'database', 'z1', 'prod')],
+    links: [],
+    positions: {},
+  };
+  const auto = layoutServerView(g);
+  assert.deepEqual(layoutServerView({ ...g, positions: { a: { x: 900, y: 700 } } }), auto);
+});
+
+test('server view: cards keep the arrangement saved on their environment canvas, new cards go below', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [
+      envNode('a', 'application', 'z1', 'prod', { saved: { x: 900, y: 700 } }),
+      envNode('b', 'database', 'z1', 'prod', { saved: { x: 600, y: 900 } }),
+      envNode('c', 'service', 'z1', 'prod'),
+    ],
+    links: [],
+  };
+  const p = layoutServerView(g);
+  assert.equal(p.a.x - p.b.x, 300);
+  assert.equal(p.b.y - p.a.y, 200);
+  assert.equal(p.c.x, p.b.x);
+  assert.ok(p.c.y >= p.b.y + estimateNodeHeight(g.nodes[1]) + ROW_GAP);
+});
+
+test('server view: a group with one saved card matches the environment canvas arrangement', () => {
+  const apps = Array.from({ length: MAX_ROWS + 1 }, (_, i) => envNode(`n${i}`, 'application', 'z1', 'prod'));
+  const nodes = [envNode('a', 'application', 'z1', 'prod', { saved: { x: 1000, y: 697 } }), ...apps, envNode('d', 'database', 'z1', 'prod')];
+  const env = layoutGraph({ zones: [{ id: 'z1', name: 'web' }], nodes, links: [], positions: { a: { x: 1000, y: 697 } } });
+  const server = layoutServerView({ layout: 'server', zones: [{ id: 'z1', name: 'web' }], nodes, links: [{ source: 'n0', target: 'd' }] });
+  for (const n of nodes) {
+    assert.deepEqual({ x: server[n.id].x - server.a.x, y: server[n.id].y - server.a.y }, { x: env[n.id].x - env.a.x, y: env[n.id].y - env.a.y }, n.id);
+  }
+});
+
+test('server view: a moved card saved with its group on the environment canvas stays where it was dropped', () => {
+  const nodes = [envNode('a', 'application', 'z1', 'prod'), envNode('b', 'service', 'z1', 'prod'), envNode('d', 'database', 'z1', 'prod')];
+  const g = { layout: 'server', zones: [{ id: 'z1', name: 'web' }], nodes, links: [] };
+  const groups = {};
+  const before = layoutServerView(g, groups);
+  const { shift } = groups['prod:z1'];
+  const dropped = { ...before, b: { x: before.b.x + 120, y: before.b.y + 400 } };
+  const saved = Object.fromEntries(nodes.map(n => [n.id, { x: dropped[n.id].x - shift.x, y: dropped[n.id].y - shift.y }]));
+  const after = layoutServerView({ ...g, nodes: nodes.map(n => ({ ...n, saved: saved[n.id] })) });
+  assert.deepEqual(after, dropped);
+});
+
+test('server view: zones with server details get the taller header', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web', details: { os: 'Ubuntu' } }],
+    nodes: [envNode('a', 'application', 'z1', 'prod')],
+    links: [],
+    positions: {},
+  };
+  const positions = layoutServerView(g);
+  const [box] = zoneBoxes(g, positions);
+  assert.equal(box.y, 0);
+  assert.ok(positions.a.y > SERVER_ZONE_HEADER);
+});
+
+test('server view: groups sit where their cards are saved on the environment canvas', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [
+      envNode('a', 'application', 'z1', 'prod', { saved: { x: 0, y: ZONE_HEADER + ZONE_PADDING } }),
+      envNode('b', 'application', 'z1', 'stage', { saved: { x: 600, y: ZONE_HEADER + ZONE_PADDING } }),
+      envNode('c', 'application', 'z1', 'dev'),
+    ],
+    links: [],
+    positions: {},
+  };
+  const groups = {};
+  const positions = layoutServerView(g, groups);
+  // A card at the start of the environment canvas sits at the zone's top-left.
+  assert.equal(groups['prod:z1'].x, 0);
+  assert.equal(groups['prod:z1'].y, groups['prod:z1'].inner.y);
+  assert.equal(positions.b.x - positions.a.x, 600);
+  // The environment canvas position comes back from the server view position.
+  const { shift } = groups['prod:z1'];
+  assert.deepEqual({ x: positions.b.x - shift.x, y: positions.b.y - shift.y }, { x: 600, y: ZONE_HEADER + ZONE_PADDING });
+  // A group without saved cards goes below.
+  assert.ok(positions.c.y > positions.a.y + estimateNodeHeight(g.nodes[0]));
+});
+
+test('server view: a group saved left of the zone stays inside it', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [envNode('a', 'application', 'z1', 'prod', { saved: { x: -236, y: 251 } })],
+    links: [],
+    positions: {},
+  };
+  const groups = {};
+  layoutServerView(g, groups);
+  assert.equal(groups['prod:z1'].x, groups['prod:z1'].inner.x);
+});
+
+test('server view: saved groups of different environments that would overlap are moved apart', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [
+      envNode('a', 'application', 'z1', 'prod', { saved: { x: 0, y: 0 } }),
+      envNode('b', 'application', 'z1', 'stage', { saved: { x: 0, y: 0 } }),
+    ],
+    links: [],
+    positions: {},
+  };
+  const groups = {};
+  layoutServerView(g, groups);
+  const [p, s] = [groups['prod:z1'], groups['stage:z1']];
+  assert.ok(Math.abs(p.x - s.x) >= CARD_WIDTH || Math.abs(p.y - s.y) >= estimateNodeHeight(g.nodes[0]), 'the groups do not cover each other');
+});
+
+test('status summary counts resources by tone, without unmanaged containers and placeholder cards', () => {
+  const nodes = [
+    node('a', 'application', 'z', { status: 'running:healthy' }),
+    node('b', 'database', 'z', { status: 'exited:unhealthy' }),
+    node('c', 'service', 'z', { status: 'exited' }),
+    node('container:1', 'container', 'z', { status: 'exited' }),
+    node('empty:1', 'empty', 'z', { status: null }),
+  ];
+  assert.deepEqual(statusSummary(nodes), { ok: 1, warn: 0, bad: 2, busy: 0, idle: 0 });
+  assert.equal(statusWord('exited:unhealthy'), 'Exited');
+});
+
+test('server details: memory and uptime formats', () => {
+  assert.equal(formatMemory(1007820800), '0.9 GB');
+  assert.equal(formatMemory(17179869184), '16 GB');
+  assert.equal(formatMemory(null), null);
+  const now = Date.parse('2026-10-14T12:00:00Z');
+  assert.equal(formatUptime('2026-10-14 11:15:00', now), '45m');
+  assert.equal(formatUptime('2026-10-14 07:00:00', now), '5h');
+  assert.equal(formatUptime('2026-10-02T12:00:00+00:00', now), '12d');
+  assert.equal(formatUptime('nonsense', now), null);
+});
+
+test('unreachable server zones: only server zones whose server is not reachable', () => {
+  const zones = [
+    { id: 'up', is_reachable: true },
+    { id: 'down', is_reachable: false },
+    { id: 'project', icon: 'projects' },
+  ];
+  assert.deepEqual([...unreachableZones({ zones })], ['down']);
+  assert.equal(unreachableZones(null).size, 0);
+});
+
+test('fit: shows everything when it stays readable, centered', () => {
+  const v = fitView({ minX: 0, minY: 0, maxX: 400, maxY: 200 }, { left: 0, top: 0, width: 1000, height: 600 }, true);
+  assert.equal(v.z, 1.1);
+  assert.equal(v.x, (1000 - 440) / 2);
+});
+
+test('fit: the first fit of a large canvas keeps the cards readable and starts at the top-left', () => {
+  const bounds = { minX: 100, minY: 50, maxX: 3100, maxY: 4050 };
+  const area = { left: 0, top: 0, width: 1280, height: 520 };
+  assert.ok(fitView(bounds, area).z < READABLE_ZOOM, 'the fit button still shows everything');
+  const v = fitView(bounds, area, true);
+  assert.equal(v.z, READABLE_ZOOM);
+  assert.equal(v.x + bounds.minX * v.z, 48);
+  assert.equal(v.y + bounds.minY * v.z, 48);
+});
+
+test('fit: a tall, narrow canvas keeps its column centered', () => {
+  const v = fitView({ minX: 0, minY: 0, maxX: 300, maxY: 5000 }, { left: 0, top: 0, width: 1280, height: 520 }, true);
+  assert.equal(v.z, READABLE_ZOOM);
+  assert.equal(v.x, (1280 - 300 * READABLE_ZOOM) / 2);
+  assert.equal(v.y, 48);
+});
+
+test('variables view: variables stack on the left by name, resources sit to their right', () => {
+  const g = {
+    layout: 'connect',
+    zones: [{ id: 'sources', name: 'Team variables', icon: 'variable' }, { id: 'resources', name: 'Resources', icon: 'service' }],
+    nodes: [
+      node('variable:2', 'variable', 'sources', { name: 'TOKEN' }),
+      node('variable:1', 'variable', 'sources', { name: 'API_URL' }),
+      node('app', 'application', 'resources', { context: 'Shop / prod' }),
+    ],
+    links: [{ id: 'variable:1|app', source: 'variable:1', target: 'app' }],
+    positions: {},
+  };
+  const p = layoutGraph(g);
+
+  assert.equal(p['variable:1'].x, 0);
+  assert.equal(p['variable:2'].x, 0);
+  assert.ok(p['variable:1'].y < p['variable:2'].y);
+  assert.ok(p.app.x > CARD_WIDTH + ZONE_PADDING * 2);
+  const [variables, resources] = zoneBoxes(g, p);
+  assert.ok(variables.x + variables.width < resources.x, 'zones do not overlap');
+});
+
+test('variables view: links only go from an existing shared variable to a resource', () => {
+  const g = {
+    layout: 'connect',
+    nodes: [
+      node('variable:1', 'variable', 'sources'),
+      node('variable:2', 'variable', 'sources'),
+      node('missing:OLD', 'variable', 'sources', { missing: true }),
+      node('app', 'application', 'resources'),
+    ],
+  };
+
+  assert.equal(canConnect(g, 'variable:1', 'app'), true);
+  assert.equal(canConnect(g, 'app', 'variable:1'), false);
+  assert.equal(canConnect(g, 'variable:1', 'variable:2'), false);
+  assert.equal(canConnect(g, 'missing:OLD', 'app'), false);
+  assert.equal(canConnect({ nodes: g.nodes }, 'app', 'variable:1'), true, 'other canvases link any two cards');
+});
+
+test('variables view: filter resources by project and environment, keep every variable', () => {
+  const shop = { uuid: 'p1', name: 'Shop' };
+  const blog = { uuid: 'p2', name: 'Blog' };
+  const g = {
+    layout: 'connect',
+    nodes: [
+      node('variable:1', 'variable', 'sources'),
+      node('a', 'application', 'resources', { project: shop, environment: { uuid: 'e1', name: 'production' } }),
+      node('b', 'application', 'resources', { project: shop, environment: { uuid: 'e2', name: 'staging' } }),
+      node('c', 'application', 'resources', { project: blog, environment: { uuid: 'e3', name: 'production' } }),
+    ],
+    links: [{ id: 'l1', source: 'variable:1', target: 'a' }, { id: 'l2', source: 'variable:1', target: 'c' }],
+  };
+
+  assert.deepEqual(filterOptions(g).map(p => [p.name, p.environments.map(e => e.name)]), [['Blog', ['production']], ['Shop', ['production', 'staging']]]);
+  assert.equal(filterGraph(g, {}), g);
+  const shopOnly = filterGraph(g, { project: 'p1' });
+  assert.deepEqual(shopOnly.nodes.map(n => n.id), ['variable:1', 'a', 'b']);
+  assert.deepEqual(shopOnly.links.map(l => l.id), ['l1']);
+  assert.deepEqual(filterGraph(g, { environment: 'e2' }).nodes.map(n => n.id), ['variable:1', 'b']);
+  assert.deepEqual(filterGraph(g, { environment: 'e2' }).links, []);
+});
+
+test('variables view: resources that use a variable get their own zone, in one column', () => {
+  const ctx = { context: 'Shop / prod' };
+  const g = groupByUse({
+    layout: 'connect',
+    zones: [{ id: 'sources', icon: 'variable' }, { id: 'connected', icon: 'link' }, { id: 'resources', icon: 'service' }],
+    nodes: [
+      node('variable:1', 'variable', 'sources'),
+      node('app', 'application', 'resources', ctx),
+      node('db', 'database', 'resources', ctx),
+      node('idle', 'application', 'resources', ctx),
+    ],
+    links: [{ id: 'l1', source: 'variable:1', target: 'app' }, { id: 'l2', source: 'variable:1', target: 'db' }],
+  });
+  assert.deepEqual(g.nodes.map(n => n.zone), ['sources', 'connected', 'connected', 'resources']);
+
+  const p = layoutGraph(g);
+  assert.equal(p.app.x, p.db.x, 'connected cards share one column, so no link runs behind a card');
+  assert.ok(p.db.y > p.app.y);
+  const boxes = zoneBoxes(g, p);
+  const connected = boxes.find(b => b.id === 'connected');
+  const others = boxes.find(b => b.id === 'resources');
+  assert.ok(connected.y + connected.height < others.y, 'other resources sit below the connected zone');
+});
+
+test('readView restores a saved zoom and pan, and ignores bad data', () => {
+  const store = values => ({ getItem: key => values[key] ?? null });
+  assert.deepEqual(readView('k', store({ k: '{"x":-120.5,"y":40,"z":0.6}' })), { x: -120.5, y: 40, z: 0.6 });
+  assert.equal(readView('k', store({})), null);
+  assert.equal(readView('k', store({ k: 'not json' })), null);
+  assert.equal(readView('k', store({ k: '{"x":1,"y":2}' })), null);
+  assert.equal(readView('k', store({ k: '{"x":1,"y":2,"z":9}' })), null);
+});
+
+test('server view: the unmanaged containers group comes first in its zone', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [
+      node('a', 'application', 'z1', { context: 'Alpha / prod' }),
+      node('container:1', 'container', 'z1', { context: 'Unmanaged containers' }),
+    ],
+    links: [],
+    positions: {},
+  };
+  const positions = layoutServerView(g);
+  assert.ok(positions['container:1'].x < positions.a.x);
+});
+
+const apart = (a, b) => a.x + a.width <= b.x || b.x + b.width <= a.x || a.y + a.height <= b.y || b.y + b.height <= a.y;
+// Drag card `id` to the top-left of `onto`, as the canvas does: stop at the nearest free spot.
+const dragOnto = (g, positions, id, onto) => {
+  const { others, fits } = dragRules(g, positions, {}, id);
+  const card = g.nodes.find(n => n.id === id);
+  const start = { ...positions[id], w: CARD_WIDTH, h: estimateNodeHeight(card) };
+  assert.deepEqual(freeSpot(start, others, undefined, fits), start, 'the laid out card is already free, so it does not jump');
+  const spot = freeSpot({ ...start, ...positions[onto] }, others, undefined, fits);
+  return { ...positions, [id]: { x: spot.x, y: spot.y } };
+};
+
+test('a dragged card stops before it covers a card or another zone', () => {
+  const g = graph([node('a', 'application', 's1'), node('b', 'database', 's1'), node('c', 'application', 's2')]);
+  const before = layoutGraph(g);
+  for (const [id, onto] of [['a', 'b'], ['a', 'c'], ['c', 'a']]) {
+    const positions = dragOnto(g, before, id, onto);
+    const rects = Object.fromEntries(g.nodes.map(n => [n.id, ({ ...positions[n.id], width: CARD_WIDTH, height: estimateNodeHeight(n) })]));
+    for (const n of g.nodes) if (n.id !== id) assert.ok(apart(rects[id], rects[n.id]), `${id} does not cover ${n.id}`);
+    const [z1, z2] = zoneBoxes(g, positions);
+    assert.ok(apart(z1, z2), 'the zones do not overlap');
+  }
+});
+
+test('server view: a dragged card stops before its group covers another group', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [srv('a', 'application', 'Shop / prod'), srv('b', 'database', 'Shop / prod'), srv('c', 'application', 'Blog / prod')],
+    links: [],
+    positions: {},
+  };
+  const positions = dragOnto(g, layoutGraph(g), 'a', 'c');
+  const [f1, f2] = groupFrames(g.nodes, positions);
+  assert.ok(apart(f1, f2), 'the project / environment frames do not overlap');
+});
+
+test('server view: a group dropped as close to another group as a drag allows stays there after a reload', () => {
+  const nodes = [envNode('a', 'application', 'z1', 'prod'), envNode('b', 'application', 'z1', 'staging')];
+  const g = { layout: 'server', zones: [{ id: 'z1', name: 'web' }], nodes, links: [] };
+  const groups = {};
+  const before = layoutServerView(g, groups);
+  const [prod, staging] = groupFrames(nodes, before);
+  // Drag the staging group to the left of the prod group: it stops at the gap the drag keeps.
+  const box = { x: staging.x, y: staging.y, w: staging.width, h: staging.height };
+  const others = [{ x: prod.x, y: prod.y, w: prod.width, h: prod.height }];
+  const { inner } = groups[groupKey([nodes[1]], 'z1')];
+  const spot = freeSpot({ ...box, x: prod.x + 40 }, others, GROUP_GAP, b => b.x >= inner.x && b.y >= inner.y);
+  const dropped = { ...before, b: { x: before.b.x + spot.x - box.x, y: before.b.y + spot.y - box.y } };
+  const shift = id => groups[groupKey([nodes.find(n => n.id === id)], 'z1')].shift;
+  const saved = Object.fromEntries(nodes.map(n => [n.id, { x: dropped[n.id].x - shift(n.id).x, y: dropped[n.id].y - shift(n.id).y }]));
+  const after = layoutServerView({ ...g, nodes: nodes.map(n => ({ ...n, saved: saved[n.id] })) });
+  assert.deepEqual(after, dropped);
+});
+
+test('server view: a dragged card keeps its group as far from another group as the layout does', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [srv('a', 'application', 'Shop / prod'), srv('c', 'application', 'Blog / prod')],
+    links: [],
+    positions: {},
+  };
+  const before = layoutServerView(g);
+  const { others, fits } = dragRules(g, before, {}, 'a');
+  const start = { ...before.a, w: CARD_WIDTH, h: estimateNodeHeight(g.nodes[0]) };
+  // The layout puts the groups GROUP_GAP apart: a card cannot move its group closer to the other one.
+  assert.equal(freeSpot({ ...start, x: start.x - 10 }, others, undefined, fits), null);
+});
+
+test('groupKey: a group with only an empty-environment placeholder has no key, so it cannot be moved', () => {
+  const environment = { uuid: 'env', name: 'production' };
+  assert.equal(groupKey([{ id: 'empty:env', type: 'empty', environment }], 'empty'), null);
+  assert.equal(groupKey([{ id: 'a', type: 'application', environment }], 'srv'), 'env:srv');
+});
+
+test('layoutServerView: an empty environment sits right of the other groups of its project, not below them', () => {
+  const shop = { uuid: 'shop', name: 'Shop' };
+  const node = (id, context, extra = {}) => ({ id, type: 'application', zone: 'srv', context, project: shop, environment: { uuid: context }, ...extra });
+  const graph = {
+    layout: 'server',
+    zones: [{ id: 'srv', name: 'srv' }],
+    nodes: [
+      node('a', 'Shop / staging', { saved: { x: 0, y: 0 } }),
+      node('empty:prod', 'Shop / production', { type: 'empty' }),
+    ],
+    links: [],
+  };
+  const out = layoutServerView(graph);
+  assert.equal(out['empty:prod'].y, out.a.y);
+  assert.ok(out['empty:prod'].x >= out.a.x + CARD_WIDTH);
+});
+
+test('variables view: saved environment canvas positions do not push resources away from the variables', () => {
+  const g = {
+    layout: 'connect',
+    zones: [{ id: 'sources', name: 'Server variables', icon: 'variable' }, { id: 'resources', name: 'Other resources', icon: 'service' }],
+    nodes: [
+      node('variable:1', 'variable', 'sources', { name: 'COOLIFY_SERVER_NAME' }),
+      node('app', 'application', 'resources', { context: 'Shop / prod', environment: { uuid: 'e1' }, saved: { x: 900, y: 1200 } }),
+    ],
+    links: [],
+    positions: {},
+  };
+  const [variables, resources] = zoneBoxes(g, layoutGraph(g));
+
+  assert.equal(resources.y, variables.y, 'both zones start at the top');
+  assert.ok(resources.x - (variables.x + variables.width) <= ZONE_GAP * 2, 'resources sit next to the variables');
+});
diff --git a/resources/js/passkeys.js b/resources/js/passkeys.js
new file mode 100644
index 0000000000..060e1ad00d
--- /dev/null
+++ b/resources/js/passkeys.js
@@ -0,0 +1,22 @@
+import { Passkeys } from '@laravel/passkeys';
+
+window.Passkeys = Passkeys;
+
+window.passkeyDeviceName = () => {
+    const ua = navigator.userAgent;
+    const browser = /Edg\//.test(ua) ? 'Edge'
+        : /Firefox\//.test(ua) ? 'Firefox'
+        : /Chrome\//.test(ua) ? 'Chrome'
+        : /Safari\//.test(ua) ? 'Safari'
+        : 'Browser';
+    const os = /iPhone|iPad/.test(ua) ? 'iOS'
+        : /Android/.test(ua) ? 'Android'
+        : /Mac/.test(ua) ? 'Mac'
+        : /Windows/.test(ua) ? 'Windows'
+        : /Linux/.test(ua) ? 'Linux'
+        : 'device';
+
+    return `${browser} on ${os}`;
+};
+
+window.dispatchEvent(new CustomEvent('passkeys:ready'));
diff --git a/resources/js/runtime-logs.js b/resources/js/runtime-logs.js
index 0dad173ada..3b34fce197 100644
--- a/resources/js/runtime-logs.js
+++ b/resources/js/runtime-logs.js
@@ -348,9 +348,9 @@ export function initializeRuntimeLogsComponent() {
                 });
             },
 
-            visibleText() {
+            visibleText(source = filtered) {
                 const withTime = this.$wire.showTimeStamps;
-                return filtered
+                return source
                     .map((line) => (withTime && line.ts ? `${formatTimestamp(line.ts)} ${line.text}` : line.text))
                     .join('\n');
             },
@@ -406,9 +406,21 @@ export function initializeRuntimeLogsComponent() {
                 });
             },
 
-            downloadLogs() {
+            // The browser holds unredacted lines, so fetch the redacted copy from the server
+            // and apply the same level and search filters before downloading it.
+            async downloadLogs() {
+                let logs;
+                try {
+                    logs = await this.$wire.copyLogs();
+                } catch {
+                    window.Livewire.dispatch('error', ['Failed to prepare logs for download.']);
+                    return;
+                }
+                if (!logs) return;
+                let id = 0;
+                const exported = filterLogLines(parseLogLines(logs, () => ++id), this.logFilters, this.searchQuery);
                 const timestamp = new Date().toISOString().slice(0, 19).replace(/[T:]/g, '-');
-                downloadText(this.visibleText() + '\n', `${this.containerName}-logs-${timestamp}.txt`);
+                downloadText(this.visibleText(exported) + '\n', `${this.containerName}-logs-${timestamp}.txt`);
             },
 
             makeFullscreen() {
diff --git a/resources/js/settings-sidebar-accordion.js b/resources/js/settings-sidebar-accordion.js
deleted file mode 100644
index 11dec0c320..0000000000
--- a/resources/js/settings-sidebar-accordion.js
+++ /dev/null
@@ -1,42 +0,0 @@
-// Alpine data provider for the collapsible resource settings sidebar
-// (x-data="settingsSidebarAccordion({ activeGroup, storageKey })").
-//
-// Every group is open by default; each group can be collapsed/expanded and the
-// choice is remembered per resource type. The active group is always forced open
-// on load so the current page stays reachable.
-export function initializeSettingsSidebarAccordionComponent() {
-    window.Alpine.data('settingsSidebarAccordion', (config = {}) => ({
-        activeGroup: config.activeGroup || '',
-        storageKey: config.storageKey || 'coolify.settings-sidebar',
-        groups: {},
-        init() {
-            let stored = {};
-            try {
-                stored = JSON.parse(localStorage.getItem(this.storageKey)) || {};
-            } catch (e) {
-                stored = {};
-            }
-            this.groups = stored && typeof stored === 'object' ? stored : {};
-        },
-        isOpen(group) {
-            // The current page must stay visible, even when this group was
-            // previously stored as collapsed on another page.
-            if (group === this.activeGroup) {
-                return true;
-            }
-
-            if (Object.prototype.hasOwnProperty.call(this.groups, group)) {
-                return this.groups[group];
-            }
-            return true;
-        },
-        toggle(group) {
-            this.groups = { ...this.groups, [group]: !this.isOpen(group) };
-            try {
-                localStorage.setItem(this.storageKey, JSON.stringify(this.groups));
-            } catch (e) {
-                // ignore storage errors (private mode, quota, etc.)
-            }
-        },
-    }));
-}
diff --git a/resources/js/terminal.browser.test.js b/resources/js/terminal.browser.test.js
new file mode 100644
index 0000000000..29f607e82e
--- /dev/null
+++ b/resources/js/terminal.browser.test.js
@@ -0,0 +1,45 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { chromium } from 'playwright';
+
+test('pty-ready keeps the console input focused after the 500 ms retry', async () => {
+    const browser = await chromium.launch({ headless: true });
+    try {
+        const page = await browser.newPage();
+        await page.route('http://terminal.test/', route => route.fulfill({ contentType: 'text/html', body: '<div class="xterm-viewport" tabindex="0">Container output</div><input id="consoleInput" placeholder="Console command">' }));
+        await page.goto('http://terminal.test/');
+        const source = readFileSync(new URL('./terminal.js', import.meta.url), 'utf8')
+            .split('export function initializeTerminalComponent')[1];
+        // terminal.js imports these helpers; load them as plain declarations.
+        const connectionSource = readFileSync(new URL('./terminal-connection.js', import.meta.url), 'utf8')
+            .replace(/^export /gm, '');
+        await page.evaluate(([connectionSource, source]) => {
+            window.Alpine = { data: (_name, factory) => { window.terminalFactory = factory; } };
+            window.applicationTerminalThemes = { system: {} };
+            window.MAX_TERMINAL_SESSION_SECONDS = 28800;
+            window.logTerminal = () => {};
+            // Register the actual Alpine component, without its Vite imports.
+            new Function(`${connectionSource}\nfunction initializeTerminalComponent${source}\ninitializeTerminalComponent();`)();
+            const component = window.terminalFactory();
+            component.$wire = { terminalMode: 'attach', dispatch() {} };
+            component.$refs = { consoleInput: document.querySelector('#consoleInput') };
+            component.term = { _initialized: true, focus: () => document.querySelector('.xterm-viewport').focus() };
+            component.startTerminalSessionCountdown = () => {};
+            component.resizeTerminal = () => {};
+            component.handleSocketMessage({ data: 'pty-ready' });
+            window.terminalComponent = component;
+        }, [connectionSource, source]);
+        await page.waitForTimeout(650);
+        assert.equal(await page.locator('#consoleInput').evaluate((input) => document.activeElement === input), true);
+        await page.screenshot({ path: '/tmp/pr11538-console-focus.png' });
+        await page.evaluate(() => {
+            window.terminalComponent.$wire.terminalMode = 'shell';
+            window.terminalComponent.handleSocketMessage({ data: 'pty-ready' });
+        });
+        await page.waitForTimeout(650);
+        assert.equal(await page.locator('.xterm-viewport').evaluate((terminal) => document.activeElement === terminal), true);
+    } finally {
+        await browser.close();
+    }
+});
diff --git a/resources/js/terminal.js b/resources/js/terminal.js
index 420e20fb11..93d196286b 100644
--- a/resources/js/terminal.js
+++ b/resources/js/terminal.js
@@ -205,6 +205,15 @@ export function initializeTerminalComponent() {
             wasConnectedBeforeHidden: false,
             mobileToolbarCollapsed: false,
             terminalModifier: null,
+            // Console (attach) mode — line-oriented command input, like a game-server panel.
+            consoleCommand: '',
+            consoleHistory: [],
+            consoleHistoryIndex: -1,
+            // Lines from a multi-line paste, waiting for the user to confirm with Enter.
+            consolePendingLines: [],
+            consoleSentFlash: false,
+            consoleSentFlashTimeout: null,
+            consoleForegroundColor: '#ffffff',
             keyboardInset: 0,
             keyboardAnchorTop: 0,
             keyboardViewportHeight: 0,
@@ -312,6 +321,7 @@ export function initializeTerminalComponent() {
                         logTerminal('warn', '[Terminal] Ignoring terminal token after authentication was rejected.');
                         return;
                     }
+                    this.applyConsoleMode();
                     this.beginTerminalSessionStart();
                     this.sendCommandWhenReady({ terminalToken: token });
                 });
@@ -330,7 +340,7 @@ export function initializeTerminalComponent() {
                     // Wait for terminal to be ready, then focus
                     const focusWhenReady = () => {
                         if (this.terminalActive && this.term) {
-                            this.term.focus();
+                            this.focusActiveInput();
                         } else {
                             setTimeout(focusWhenReady, 100);
                         }
@@ -515,6 +525,7 @@ export function initializeTerminalComponent() {
                     const cursorBlink = this.term.options.cursorBlink;
                     this.term.options.cursorBlink = false;
                     this.term.options.theme = { ...applicationTerminalThemes[themeName] };
+                    this.syncConsoleForeground();
                     this.term.refresh(0, Math.max(0, this.term.rows - 1));
 
                     requestAnimationFrame(() => {
@@ -524,7 +535,7 @@ export function initializeTerminalComponent() {
 
                         this.term.options.cursorBlink = cursorBlink;
                         this.term.refresh(0, Math.max(0, this.term.rows - 1));
-                        this.term.focus();
+                        this.focusActiveInput();
                         logTerminal('log', '[Terminal Theme] Theme applied', this.terminalThemeDebugSnapshot(themeName));
                     });
                 }
@@ -580,7 +591,7 @@ export function initializeTerminalComponent() {
                     // Force a refresh
                     this.$nextTick(() => {
                         this.resizeTerminal();
-                        this.term.focus();
+                        this.focusActiveInput();
                     });
                 }
             },
@@ -607,6 +618,7 @@ export function initializeTerminalComponent() {
                             ? applicationTerminalThemes[this.selectedTheme] ?? applicationTerminalThemes.system
                             : undefined
                     });
+                    this.syncConsoleForeground();
                     this.fitAddon = new FitAddon();
                     this.term.loadAddon(this.fitAddon);
                     this.$nextTick(() => {
@@ -851,6 +863,169 @@ export function initializeTerminalComponent() {
                 }
             },
 
+            isConsoleMode() {
+                return this.$wire?.terminalMode === 'attach';
+            },
+
+            // Focus the console command box in attach mode, otherwise the xterm.
+            focusActiveInput() {
+                if (this.isConsoleMode()) {
+                    this.$refs.consoleInput?.focus();
+                } else {
+                    this.term?.focus();
+                }
+            },
+
+            // Keep the xterm read-only while in console mode and load its command history.
+            applyConsoleMode() {
+                const consoleMode = this.isConsoleMode();
+                if (this.term) {
+                    this.term.options.disableStdin = consoleMode;
+                    this.term.options.cursorBlink = !consoleMode;
+                    // The output cannot take input, so do not draw a cursor in it.
+                    this.term.options.cursorInactiveStyle = consoleMode ? 'none' : 'outline';
+                }
+                if (consoleMode) {
+                    this.loadConsoleHistory();
+                    this.$nextTick(() => this.$refs.consoleInput?.focus());
+                }
+                // Let the header mode selector reflect the container's current state.
+                window.dispatchEvent(new CustomEvent('terminal-mode-updated', {
+                    detail: {
+                        attachAvailable: Boolean(this.$wire?.attachAvailable),
+                        hasShell: this.$wire?.hasShell ?? true,
+                        mode: this.$wire?.terminalMode ?? 'shell',
+                    },
+                }));
+            },
+
+            loadConsoleHistory() {
+                // Keep commands in this connection only: names can be reused, and
+                // localStorage is shared by users and teams on the same browser.
+                this.consoleHistory = [];
+                this.consoleHistoryIndex = -1;
+                this.consoleCommand = '';
+                this.consolePendingLines = [];
+                try {
+                    for (let index = localStorage.length - 1; index >= 0; index--) {
+                        const key = localStorage.key(index);
+                        if (key?.startsWith('coolify-console-history:')) {
+                            localStorage.removeItem(key);
+                        }
+                    }
+                } catch (_) {
+                    // History does not depend on browser storage being available.
+                }
+            },
+
+            // Text colour for the command box: the active terminal theme's foreground.
+            syncConsoleForeground() {
+                this.consoleForegroundColor = this.term?.options.theme?.foreground || '#ffffff';
+            },
+
+            canSubmitConsoleCommand() {
+                return this.consolePendingLines.length > 0 || this.consoleCommand.trim() !== '';
+            },
+
+            // Send one printable command line to the process stdin, never terminal control bytes.
+            sendConsoleLine(command) {
+                if (command.trim() === '' || /[\x00-\x1f\x7f]/.test(command)) {
+                    return false;
+                }
+                // Send the whole line plus a newline to the process stdin.
+                this.sendMessage({ message: `${command}\n` });
+
+                if (this.consoleHistory[this.consoleHistory.length - 1] !== command) {
+                    this.consoleHistory.push(command);
+                    this.consoleHistory = this.consoleHistory.slice(-50);
+                }
+
+                return true;
+            },
+
+            submitConsoleCommand() {
+                if (!this.terminalActive || !this.isConsoleMode()) {
+                    return;
+                }
+
+                const lines = this.consolePendingLines.length > 0 ? this.consolePendingLines : [this.consoleCommand];
+                const sent = lines.filter((line) => this.sendConsoleLine(line)).length;
+
+                this.consolePendingLines = [];
+                this.consoleHistoryIndex = -1;
+                if (sent > 0) {
+                    this.consoleCommand = '';
+                    this.flashConsoleSent();
+                    // Show the response even when the user scrolled up to read older output.
+                    this.term?.scrollToBottom();
+                }
+                // Clicking Send moves focus to the button; return it to the input.
+                this.$refs.consoleInput?.focus();
+            },
+
+            flashConsoleSent() {
+                clearTimeout(this.consoleSentFlashTimeout);
+                this.consoleSentFlash = true;
+                this.consoleSentFlashTimeout = setTimeout(() => {
+                    this.consoleSentFlash = false;
+                }, 300);
+            },
+
+            // A multi-line paste waits for confirmation, so pasted logs are not sent to the process by mistake.
+            pasteConsoleText(event) {
+                const text = event.clipboardData?.getData('text') ?? '';
+                if (!/[\r\n]/.test(text)) {
+                    return;
+                }
+                event.preventDefault();
+
+                const lines = text.split(/\r?\n|\r/).filter((line) => line.trim() !== '');
+                if (lines.length === 1) {
+                    this.consoleCommand += lines[0];
+                    return;
+                }
+                if (this.consoleCommand.trim() !== '') {
+                    lines[0] = this.consoleCommand + lines[0];
+                }
+                this.consolePendingLines = lines;
+                this.consoleCommand = '';
+            },
+
+            // Esc cancels a pending paste first, then clears the input.
+            cancelConsoleInput() {
+                if (this.consolePendingLines.length > 0) {
+                    this.consolePendingLines = [];
+                    return;
+                }
+                this.consoleCommand = '';
+                this.consoleHistoryIndex = -1;
+            },
+
+            // Ctrl+L clears the visible output only; nothing is sent to the process.
+            clearConsoleOutput() {
+                this.term?.clear();
+            },
+
+            // Clicking the read-only output moves focus to the command box, unless the user is selecting text.
+            focusConsoleFromOutput() {
+                if (this.isConsoleMode() && !this.term?.hasSelection()) {
+                    this.$refs.consoleInput?.focus();
+                }
+            },
+
+            recallConsoleCommand(direction) {
+                if (this.consoleHistory.length === 0) {
+                    return;
+                }
+                if (this.consoleHistoryIndex === -1) {
+                    this.consoleHistoryIndex = this.consoleHistory.length;
+                }
+                let index = this.consoleHistoryIndex + direction;
+                index = Math.max(0, Math.min(this.consoleHistory.length, index));
+                this.consoleHistoryIndex = index;
+                this.consoleCommand = index >= this.consoleHistory.length ? '' : this.consoleHistory[index];
+            },
+
             handleSocketMessage(event) {
                 // Handle pong responses
                 if (event.data === 'pong') {
@@ -882,7 +1057,9 @@ export function initializeTerminalComponent() {
                     }
                     this.terminalActive = true;
                     this.startTerminalSessionCountdown();
-                    this.term.focus();
+                    // In console (attach) mode the user types into the command box, not the
+                    // read-only xterm, so keep focus on that input instead of the terminal.
+                    this.focusActiveInput();
                     document.querySelector('.xterm-viewport').classList.add('scrollbar', 'rounded-sm');
 
                     // Initial resize after terminal is ready
@@ -893,13 +1070,13 @@ export function initializeTerminalComponent() {
                         this.resizeTerminal();
                     }, 200);
 
-                    // Ensure terminal gets focus after connection with multiple attempts
+                    // Ensure focus after connection with multiple attempts
                     setTimeout(() => {
-                        this.term.focus();
+                        this.focusActiveInput();
                     }, 100);
-                    
+
                     setTimeout(() => {
-                        this.term.focus();
+                        this.focusActiveInput();
                     }, 500);
 
                     // Notify parent component that terminal is connected
@@ -972,6 +1149,11 @@ export function initializeTerminalComponent() {
                 if (!this.term) return;
 
                 this.term.onData((data) => {
+                    // Console (attach) mode is read-only: commands go through the input box,
+                    // so raw keystrokes (including Ctrl-C) are never sent to the process.
+                    if (this.isConsoleMode()) {
+                        return;
+                    }
                     this.sendMessage({ message: data });
                     if (data === '\r') {
                         this.commandBuffer = '';
@@ -982,6 +1164,14 @@ export function initializeTerminalComponent() {
 
                 // Copy and paste functionality
                 this.term.attachCustomKeyEventHandler((arg) => {
+                    // The console output is read-only: move typed characters to the command box.
+                    if (this.isConsoleMode() && arg.type === 'keydown' && arg.key.length === 1
+                        && !arg.ctrlKey && !arg.metaKey && !arg.altKey) {
+                        // Moving focus during keydown makes the browser type this key into the input.
+                        this.$refs.consoleInput?.focus();
+                        return false;
+                    }
+
                     if (arg.ctrlKey && arg.code === "KeyV" && arg.type === "keydown") {
                         return false;
                     }
@@ -1012,6 +1202,11 @@ export function initializeTerminalComponent() {
                     return;
                 }
 
+                // Console (attach) mode only accepts commands from the input box.
+                if (this.isConsoleMode()) {
+                    return;
+                }
+
                 this.sendMessage({ message: data });
             },
 
diff --git a/resources/js/terminal.test.js b/resources/js/terminal.test.js
index e0a4fb852d..ed6f9a696d 100644
--- a/resources/js/terminal.test.js
+++ b/resources/js/terminal.test.js
@@ -1,9 +1,12 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import vm from 'node:vm';
 import {
     MAX_TERMINAL_SESSION_SECONDS,
     formatTerminalSessionRemainingTime,
 } from './terminal-session-timer.js';
+import * as terminalConnection from './terminal-connection.js';
 
 test('formatTerminalSessionRemainingTime formats the eight hour terminal limit countdown', () => {
     assert.equal(MAX_TERMINAL_SESSION_SECONDS, 8 * 60 * 60);
@@ -13,3 +16,78 @@ test('formatTerminalSessionRemainingTime formats the eight hour terminal limit c
     assert.equal(formatTerminalSessionRemainingTime(59), '0m 59s');
     assert.equal(formatTerminalSessionRemainingTime(0), 'expired');
 });
+
+function terminalComponent() {
+    let factory;
+    const storage = new Map([['coolify-console-history:server:container', '["secret"]']]);
+    const localStorage = {
+        get length() { return storage.size; },
+        key: (index) => [...storage.keys()][index],
+        getItem: (key) => storage.get(key) ?? null,
+        setItem: (key, value) => storage.set(key, value),
+        removeItem: (key) => storage.delete(key),
+    };
+    const source = readFileSync(new URL('./terminal.js', import.meta.url), 'utf8')
+        .split('export function initializeTerminalComponent')[1];
+    const componentSource = `function initializeTerminalComponent${source}`;
+    vm.runInNewContext(`${componentSource}\ninitializeTerminalComponent();`, {
+        window: { Alpine: { data: (_name, value) => { factory = value; } } },
+        localStorage, console,
+        setTimeout, clearTimeout,
+        MAX_TERMINAL_SESSION_SECONDS, applicationTerminalThemes: { system: {} },
+        ...terminalConnection,
+    });
+    const component = factory();
+    component.$wire = { terminalMode: 'attach', currentIdentifier: 'container', currentServerUuid: 'server', dispatch() {} };
+    component.$refs = { consoleInput: { focus() {} } };
+    component.$nextTick = (callback) => callback();
+    component.term = { options: {}, focus() {} };
+    component.terminalActive = true;
+    return { component, storage };
+}
+
+test('console history does not persist sensitive commands or load previous users history', (t) => {
+    const { component, storage } = terminalComponent();
+    component.loadConsoleHistory();
+    assert.equal(component.consoleHistory.length, 0);
+    component.consoleCommand = 'secret command';
+    const messages = [];
+    component.sendMessage = (message) => messages.push(message.message);
+    component.submitConsoleCommand();
+    assert.deepEqual(messages, ['secret command\n']);
+    assert.equal(component.consoleHistory.length, 1);
+    assert.equal(storage.size, 0);
+    component.loadConsoleHistory();
+    assert.equal(component.consoleHistory.length, 0);
+});
+
+test('console startup and theme focus stay on the command input', (t) => {
+    const { component } = terminalComponent();
+    let consoleFocus = 0;
+    let terminalFocus = 0;
+    component.$refs.consoleInput.focus = () => { consoleFocus++; };
+    component.term.focus = () => { terminalFocus++; };
+    component.focusActiveInput();
+    assert.equal(consoleFocus, 1);
+    assert.equal(terminalFocus, 0);
+    component.$wire.terminalMode = 'shell';
+    component.focusActiveInput();
+    assert.equal(terminalFocus, 1);
+});
+
+test('console input cannot forward control sequences or send into a shell session', () => {
+    const { component } = terminalComponent();
+    const messages = [];
+    component.sendMessage = (message) => messages.push(message.message);
+    for (const command of ['\x03', 'list\nstop', '\x10\x11']) {
+        component.consoleCommand = command;
+        component.submitConsoleCommand();
+    }
+    component.$wire.terminalMode = 'shell';
+    component.consoleCommand = 'stop';
+    component.submitConsoleCommand();
+    component.$wire.terminalMode = 'attach';
+    component.terminalActive = false;
+    component.submitConsoleCommand();
+    assert.equal(messages.length, 0);
+});
diff --git a/resources/js/traffic-globe.js b/resources/js/traffic-globe.js
index 49f52ac9ac..ca8fd6a175 100644
--- a/resources/js/traffic-globe.js
+++ b/resources/js/traffic-globe.js
@@ -24,16 +24,26 @@ const THEMES = {
 };
 
 /**
- * Turn country-breakdown rows into cobe markers. Marker size scales with the
- * square root of request volume so a single dominant country doesn't dwarf the rest.
+ * Turn marker rows into cobe markers. A row is placed at its own `lat`/`lon`
+ * (a city) or at the centroid of its ISO-A2 `code` (a country). Marker size
+ * scales with the square root of request volume so one dominant place doesn't
+ * dwarf the rest. City markers are smaller, because cities are close together.
  *
- * @param {Array<{code: string, requests: number}>} data
+ * @param {Array<{code?: string, lat?: number, lon?: number, requests: number}>} data
  * @returns {Array<{location: [number, number], size: number}>}
  */
 function buildMarkers(data) {
     const rows = (data || [])
-        .map((r) => ({ code: String(r.code || '').toUpperCase(), requests: Number(r.requests || 0) }))
-        .filter((r) => r.requests > 0 && CENTROIDS[r.code]);
+        .map((r) => {
+            const city = Number.isFinite(r.lat) && Number.isFinite(r.lon);
+
+            return {
+                city,
+                location: city ? [r.lat, r.lon] : CENTROIDS[String(r.code || '').toUpperCase()],
+                requests: Number(r.requests || 0),
+            };
+        })
+        .filter((r) => r.requests > 0 && r.location);
 
     if (rows.length === 0) {
         return [];
@@ -41,14 +51,29 @@ function buildMarkers(data) {
 
     const max = Math.max(...rows.map((r) => r.requests));
 
-    return rows.map((r) => ({
-        location: CENTROIDS[r.code],
-        size: Math.max(0.03, Math.min(0.11, Math.sqrt(r.requests / max) * 0.11)),
-    }));
+    return rows.map((r) => {
+        const [min, cap] = r.city ? [0.02, 0.07] : [0.03, 0.11];
+
+        return {
+            location: r.location,
+            size: Math.max(min, Math.min(cap, Math.sqrt(r.requests / max) * cap)),
+        };
+    });
 }
 
 const TWO_PI = Math.PI * 2;
 
+const SPIN_SPEED = 0.15; // rad/s
+// Ambient spin is drawn at 30fps. A little under two 60Hz frames, so timestamp
+// jitter does not skip to the third frame.
+const SPIN_FRAME_MS = 1000 / 30 - 4;
+const SETTLE_EPSILON = 0.0005;
+
+// Signed shortest angular distance from `current` to `target`.
+function angleDelta(current, target) {
+    return ((target - current + Math.PI) % TWO_PI + TWO_PI) % TWO_PI - Math.PI;
+}
+
 // cobe orientation for a lat/lng so the point faces the viewer (cobe's own
 // focus example formula). Returns [phi, theta].
 function locationToAngles(lat, lng) {
@@ -58,23 +83,21 @@ function locationToAngles(lat, lng) {
 // Shortest-path angular interpolation, so easing across the 0/2π seam never
 // spins the long way around.
 function lerpAngle(current, target, t) {
-    let delta = ((target - current + Math.PI) % TWO_PI + TWO_PI) % TWO_PI - Math.PI;
-
-    return current + delta * t;
+    return current + angleDelta(current, target) * t;
 }
 
 /**
  * Mount an interactive, drag-to-rotate dotted globe onto a canvas. Returns a
- * controller with `update(data, dark)`, `focus(code)`, `resume()` and
+ * controller with `update(data, dark)`, `focus(target)`, `resume()` and
  * `destroy()`. The globe auto-rotates, pauses while grabbed or while a country
  * is hover-focused, and eases smoothly toward whatever it's pointed at.
  *
  * cobe v2 has no internal render loop or `onRender` callback: createGlobe draws
  * a single frame and returns `{ update, destroy }`. We drive our own rAF loop,
- * calling `globe.update({...})` each frame for rotation and to swap markers/theme.
+ * which draws only while something moves and stops when the canvas is off-screen.
  *
  * @param {HTMLCanvasElement} canvas
- * @param {Array<{code: string, requests: number}>} data
+ * @param {Array<{code?: string, lat?: number, lon?: number, requests: number}>} data
  * @param {boolean} dark
  */
 function mountTrafficGlobe(canvas, data, dark) {
@@ -82,6 +105,9 @@ function mountTrafficGlobe(canvas, data, dark) {
     let width = 0;
     let destroyed = false;
     let rafId = 0;
+    let lastDraw = 0;
+    let dirty = true;
+    let visible = true;
     let markers = buildMarkers(data);
 
     // Ambient spin is decorative; honor reduced-motion by not auto-rotating
@@ -103,6 +129,7 @@ function mountTrafficGlobe(canvas, data, dark) {
         dragStartPhi = targetPhi;
         autoRotate = false;
         canvas.style.cursor = 'grabbing';
+        wake();
     };
     const onPointerUp = () => {
         if (dragging === null) {
@@ -111,10 +138,12 @@ function mountTrafficGlobe(canvas, data, dark) {
         dragging = null;
         autoRotate = ! prefersReduced;
         canvas.style.cursor = 'grab';
+        wake();
     };
     const onPointerMove = (e) => {
         if (dragging !== null) {
             targetPhi = dragStartPhi + (e.clientX - dragging) / 150;
+            wake();
         }
     };
 
@@ -127,7 +156,7 @@ function mountTrafficGlobe(canvas, data, dark) {
         const theme = isDark ? THEMES.dark : THEMES.light;
 
         globe = createGlobe(canvas, {
-            devicePixelRatio: 2,
+            devicePixelRatio: Math.min(window.devicePixelRatio || 1, 2),
             width: width,
             height: width,
             phi: currentPhi,
@@ -144,20 +173,45 @@ function mountTrafficGlobe(canvas, data, dark) {
         });
     };
 
-    // Self-driven animation loop (cobe v2 draws only when we call update()).
-    const tick = () => {
-        if (destroyed) {
+    const schedule = () => {
+        if (! rafId && ! destroyed && globe && visible) {
+            rafId = requestAnimationFrame(tick);
+        }
+    };
+
+    // Request a draw; a no-op while one is already queued.
+    function wake() {
+        dirty = true;
+        schedule();
+    }
+
+    // Draws only while the globe spins or eases toward a target, then goes idle.
+    const tick = (now) => {
+        rafId = 0;
+        if (destroyed || ! globe || width === 0) {
             return;
         }
-        if (globe && width > 0) {
-            if (autoRotate && dragging === null) {
-                targetPhi += 0.0025;
-            }
-            currentPhi = lerpAngle(currentPhi, targetPhi, 0.12);
-            currentTheta += (targetTheta - currentTheta) * 0.12;
-            globe.update({ phi: currentPhi, theta: currentTheta, width: width, height: width, markers });
+        const spinning = autoRotate && dragging === null;
+        const elapsed = now - lastDraw;
+        if (spinning && ! dirty && elapsed < SPIN_FRAME_MS) {
+            schedule();
+
+            return;
+        }
+        if (spinning) {
+            targetPhi += (SPIN_SPEED * Math.min(elapsed, 100)) / 1000;
+        }
+        currentPhi = lerpAngle(currentPhi, targetPhi, 0.12);
+        currentTheta += (targetTheta - currentTheta) * 0.12;
+        globe.update({ phi: currentPhi, theta: currentTheta, width: width, height: width, markers });
+        lastDraw = now;
+        dirty = false;
+
+        const settled = Math.abs(angleDelta(currentPhi, targetPhi)) < SETTLE_EPSILON
+            && Math.abs(targetTheta - currentTheta) < SETTLE_EPSILON;
+        if (spinning || ! settled) {
+            schedule();
         }
-        rafId = requestAnimationFrame(tick);
     };
 
     // cobe needs a non-zero canvas width at creation; inside a freshly-rendered
@@ -170,17 +224,26 @@ function mountTrafficGlobe(canvas, data, dark) {
         }
         width = next;
         create(dark);
-        rafId = requestAnimationFrame(tick);
+        wake();
     };
 
     const resizeObserver = new ResizeObserver(() => {
         if (globe) {
             width = canvas.offsetWidth || width;
+            wake();
         } else {
             ensure();
         }
     });
     resizeObserver.observe(canvas);
+
+    const intersectionObserver = new IntersectionObserver((entries) => {
+        visible = entries[entries.length - 1].isIntersecting;
+        if (visible) {
+            wake();
+        }
+    });
+    intersectionObserver.observe(canvas);
     requestAnimationFrame(ensure);
 
     return {
@@ -203,19 +266,22 @@ function mountTrafficGlobe(canvas, data, dark) {
                 });
             }
         },
-        focus(code) {
-            const c = CENTROIDS[String(code || '').toUpperCase()];
-            if (!c) {
+        // `target` is an ISO-A2 code or a [lat, lon] pair.
+        focus(target) {
+            const c = Array.isArray(target) ? target : CENTROIDS[String(target || '').toUpperCase()];
+            if (!c || !Number.isFinite(c[0]) || !Number.isFinite(c[1])) {
                 return;
             }
             const [phi, theta] = locationToAngles(c[0], c[1]);
             targetPhi = phi;
             targetTheta = theta;
             autoRotate = false;
+            wake();
         },
         resume() {
             if (dragging === null) {
                 autoRotate = ! prefersReduced;
+                wake();
             }
         },
         destroy() {
@@ -225,6 +291,7 @@ function mountTrafficGlobe(canvas, data, dark) {
                 rafId = 0;
             }
             resizeObserver.disconnect();
+            intersectionObserver.disconnect();
             canvas.removeEventListener('pointerdown', onPointerDown);
             window.removeEventListener('pointerup', onPointerUp);
             window.removeEventListener('pointermove', onPointerMove);
diff --git a/resources/js/traffic-table.js b/resources/js/traffic-table.js
new file mode 100644
index 0000000000..0012b65d52
--- /dev/null
+++ b/resources/js/traffic-table.js
@@ -0,0 +1,112 @@
+// Client-side sort and paging for the traffic analytics lists. Each row carries
+// its sort values as JSON in `data-row`. Rows are moved in the DOM, so keyboard
+// and screen-reader order match the visual order. A Livewire morph puts the rows
+// back in server order (they are keyed) and can add or remove rows, so the rows
+// are sorted again after it.
+function compareValues(a, b) {
+    if (typeof a === 'number' && typeof b === 'number') {
+        return a - b;
+    }
+
+    return String(a).localeCompare(String(b), undefined, { numeric: true, sensitivity: 'base' });
+}
+
+function trafficTable({ per = 10, key = 'requests', dir = 'desc' } = {}) {
+    const ranks = new WeakMap();
+    let observer = null;
+    let removeMorphHook = null;
+
+    return {
+        page: 0,
+        per,
+        total: 0,
+        key,
+        dir,
+        tick: 0,
+
+        init() {
+            this.resort();
+            observer = new MutationObserver(() => this.resort());
+            observer.observe(this.$root, {
+                childList: true,
+                subtree: true,
+                attributes: true,
+                attributeFilter: ['data-row'],
+            });
+            if (window.Livewire) {
+                removeMorphHook = window.Livewire.hook('morphed', ({ el }) => {
+                    if (el.contains(this.$root)) {
+                        this.resort();
+                    }
+                });
+            }
+        },
+
+        destroy() {
+            if (observer) {
+                observer.disconnect();
+                observer = null;
+            }
+            if (removeMorphHook) {
+                removeMorphHook();
+                removeMorphHook = null;
+            }
+        },
+
+        // Text columns start ascending, number columns descending.
+        sortBy(next, firstDir = 'desc') {
+            if (this.key === next) {
+                this.dir = this.dir === 'desc' ? 'asc' : 'desc';
+            } else {
+                this.key = next;
+                this.dir = firstDir;
+            }
+            this.page = 0;
+            this.resort();
+        },
+
+        resort() {
+            const sign = this.dir === 'asc' ? 1 : -1;
+            const rows = [...this.$root.querySelectorAll('[data-row]')].map((el, index) => {
+                let values = {};
+                try {
+                    values = JSON.parse(el.dataset.row) || {};
+                } catch {
+                    values = {};
+                }
+
+                const value = values[this.key] ?? null;
+
+                return { el, index, pinned: 'pinned' in el.dataset ? 1 : 0, missing: value === null ? 1 : 0, value };
+            });
+
+            // Pinned rows (the "Other" remainder) stay last in each sort, then rows without a value.
+            rows.sort((a, b) => a.pinned - b.pinned || a.missing - b.missing || compareValues(a.value, b.value) * sign || a.index - b.index);
+            rows.forEach((row, rank) => ranks.set(row.el, rank));
+            // All rows share one parent. Move them only when the order changed: the mutation
+            // that the move causes then finds them sorted, and a focused link is not blurred.
+            if (rows.some((row, rank) => row.index !== rank)) {
+                rows.forEach((row) => row.el.parentElement.appendChild(row.el));
+                observer?.takeRecords();
+            }
+
+            this.total = rows.length;
+            this.page = Math.min(this.page, Math.max(0, Math.ceil(this.total / this.per) - 1));
+            this.tick++;
+        },
+
+        shown(el) {
+            this.tick;
+            const rank = ranks.get(el) ?? 0;
+
+            return rank >= this.page * this.per && rank < (this.page + 1) * this.per;
+        },
+
+        // 'asc', 'desc', or null when the list is sorted by another column.
+        sorted(column) {
+            return this.key === column ? this.dir : null;
+        },
+    };
+}
+
+window.trafficTable = trafficTable;
diff --git a/resources/views/auth/confirm-password.blade.php b/resources/views/auth/confirm-password.blade.php
index 9d2bc7be54..ee5cbb0858 100644
--- a/resources/views/auth/confirm-password.blade.php
+++ b/resources/views/auth/confirm-password.blade.php
@@ -28,6 +28,11 @@
                     {{ __('auth.confirm_password') }}
                 </x-forms.button>
             </form>
+
+            @if ($can_confirm_with_passkey)
+                <x-auth.passkey-verify options-route="passkey.confirm-options" submit-route="passkey.confirm"
+                    label="Confirm with a passkey" />
+            @endif
         </div>
     </x-auth.shell>
 </x-layout-simple>
diff --git a/resources/views/auth/login.blade.php b/resources/views/auth/login.blade.php
index 476b153985..0788e43f13 100644
--- a/resources/views/auth/login.blade.php
+++ b/resources/views/auth/login.blade.php
@@ -22,12 +22,14 @@
             <form action="/login" method="POST" class="flex flex-col gap-4">
                 @csrf
                 @env('local')
-                    <x-forms.input value="test@example.com" type="email" autocomplete="email" name="email" required
+                    <x-forms.input value="test@example.com" type="email"
+                        autocomplete="{{ $passkeys_available ? 'email webauthn' : 'email' }}" name="email" required
                         autofocus label="{{ __('input.email') }}" />
                     <x-forms.input value="password" type="password" autocomplete="current-password" name="password"
                         required label="{{ __('input.password') }}" />
                 @else
-                    <x-forms.input type="email" name="email" autocomplete="email" required autofocus
+                    <x-forms.input type="email" name="email"
+                        autocomplete="{{ $passkeys_available ? 'email webauthn' : 'email' }}" required autofocus
                         label="{{ __('input.email') }}" />
                     <x-forms.input type="password" name="password" autocomplete="current-password" required
                         label="{{ __('input.password') }}" />
@@ -78,6 +80,10 @@
                 </x-forms.button>
             </form>
 
+            @if ($passkeys_available)
+                <x-auth.passkey-verify autofill />
+            @endif
+
             @if ($enabled_oauth_providers->isNotEmpty())
                 <div class="auth-divider"><span>Or continue with</span></div>
                 <div class="flex flex-col gap-2">
diff --git a/resources/views/components/application/configuration-sidebar.blade.php b/resources/views/components/application/configuration-sidebar.blade.php
index 6924f0198d..29f56af40d 100644
--- a/resources/views/components/application/configuration-sidebar.blade.php
+++ b/resources/views/components/application/configuration-sidebar.blade.php
@@ -1,4 +1,4 @@
-@props(['application', 'currentRoute', 'flush' => false])
+@props(['application', 'currentRoute', 'flush' => false, 'navOnly' => false])
 
 @php
         $applicationRouteParameters = [
@@ -51,6 +51,12 @@
                 'navigate' => false,
                 'visible' => ! $application->destination->server->isSwarm() && auth()->user()?->can('canAccessTerminal'),
             ],
+            [
+                'label' => 'Files',
+                'route' => 'project.application.files',
+                'active' => $currentRoute === 'project.application.files',
+                'visible' => ! $application->destination->server->isSwarm() && auth()->user()?->can('canAccessTerminal'),
+            ],
             [
                 'label' => 'Deployment Logs',
                 'route' => 'project.application.deployment.index',
@@ -147,12 +153,13 @@
             'Persistent Storage' => 'storages',
             'Backups' => 'database',
             'Terminal' => 'browser-terminal',
+            'Files' => 'folder',
             'Deployment Logs' => 'time-back',
             'Runtime Logs' => 'unordered-list',
             'Git Source' => 'sources',
             'Servers' => 'servers',
             'Scheduled Tasks' => 'calendar',
-            'Webhooks' => 'notifications',
+            'Webhooks' => 'webhook',
             'Preview Deployments' => 'eye',
             'Healthcheck' => 'feedback',
             'Rollback' => 'time-back',
@@ -161,16 +168,17 @@
             'Metrics' => 'graph',
             'Analytics' => 'analytics',
             'Tags' => 'tags',
-            'Danger Zone' => 'shield-alert',
+            'Danger Zone' => 'danger',
         ];
 
         // Discord-style groups for the settings sidebar
         $menuGroups = [
             'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage', 'Advanced', 'Swarm', 'Healthcheck'],
-            'Observe & troubleshoot' => ['Runtime Logs', 'Deployment Logs', 'Terminal', 'Metrics', 'Analytics'],
+            'Observe & troubleshoot' => ['Runtime Logs', 'Deployment Logs', 'Terminal', 'Files', 'Metrics', 'Analytics'],
             'Deploy' => ['Git Source', 'Servers', 'Preview Deployments'],
             'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups'],
-            'Operations' => ['Resource Operations', 'Resource Limits', 'Rollback', 'Tags', 'Danger Zone'],
+            'Operations' => ['Resource Operations', 'Resource Limits', 'Rollback', 'Tags'],
+            'Danger Zone' => ['Danger Zone'],
         ];
         $groupedMenuItems = collect($menuGroups)
             ->map(fn (array $labels) => collect($labels)
@@ -179,9 +187,6 @@
                 ->values())
             ->filter(fn ($items) => $items->isNotEmpty());
 
-        // Group that holds the current page — always kept open, even if collapsed before.
-        $activeGroup = (string) $groupedMenuItems->search(fn ($items) => $items->contains(fn ($item) => $item['active'] ?? false));
-
         // In-page sections (cards) shown as sub-items under the active page
         $isComposeApp = $application->build_pack === 'dockercompose';
         $pageSections = [
@@ -247,32 +252,38 @@
         $settingsSearchItems = settingsSearchItems($groupedMenuItems, $applicationRouteParameters, $pageSections);
     @endphp
 
+@php
+    // The main sidebar shows this menu on wide screens (see components/navbar.blade.php).
+    registerMainNavContext(0, 'Dashboard', 'Back to the main menu');
+@endphp
+
+{{-- Rendered twice: in the page (below xl), and teleported into the main sidebar (xl and up).
+     navOnly renders only the sidebar copy, as the parent menu of a deeper page (e.g. a backup). --}}
+@foreach ($navOnly ? ['main-nav'] : ['page', 'main-nav'] as $placement)
+@if ($placement === 'main-nav')
+@teleport('#main-nav-context-0')
+<div class="nav-context-menu">
+@else
 <aside @class([
-    'application-settings-navigation min-w-0 xl:self-start',
+    'application-settings-navigation in-main-nav min-w-0 xl:self-start',
     'is-flush' => $flush,
 ]) data-settings-search-items="{{ json_encode($settingsSearchItems) }}">
+@endif
                 <nav aria-label="Configuration sections"
-                    x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.application' })"
-                    class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
+                    @class([
+                        'grid gap-0.5',
+                        'grid-cols-2 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]' => $placement === 'page',
+                        'grid-cols-1' => $placement === 'main-nav',
+                    ])>
                     @foreach ($groupedMenuItems as $groupLabel => $groupItems)
                         @unless ($loop->first)
                             <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]"
                                 aria-hidden="true"></div>
                         @endunless
-                        <button type="button" class="nav-section-toggle hidden xl:flex"
-                            @click="toggle(@js($groupLabel))" :aria-expanded="isOpen(@js($groupLabel))">
-                            <span>{{ $groupLabel }}</span>
-                            <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                                :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                                stroke="currentColor" stroke-width="2" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                            </svg>
-                        </button>
-                        <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
                         @foreach ($groupItems as $menuItem)
                             @php $sections = $pageSections[$menuItem['route']] ?? []; @endphp
-                            <div wire:key="application-settings-group-{{ str($menuItem['label'])->slug() }}">
-                                <a wire:key="application-settings-link-{{ str($menuItem['label'])->slug() }}"
+                            <div wire:key="{{ $placement }}-application-settings-group-{{ str($menuItem['label'])->slug() }}">
+                                <a wire:key="{{ $placement }}-application-settings-link-{{ str($menuItem['label'])->slug() }}"
                                     @class([
                                         'menu-item',
                                         'menu-item-active' => $menuItem['active'],
@@ -282,10 +293,13 @@
                                     >
                                     <x-reicon :name="$menuIcons[$menuItem['label']] ?? 'settings'" class="menu-item-icon" />
                                     <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                                    @if ($menuItem['label'] === 'Files')
+                                        <x-beta-badge class="ml-auto shrink-0" />
+                                    @endif
                                     @if ($menuItem['badge'] ?? false)
                                         <span class="shrink-0">
                                             <livewire:project.application.server-status-badge :application="$application"
-                                                :key="'application-server-status-'.$application->uuid" />
+                                                :key="$placement.'-application-server-status-'.$application->uuid" />
                                         </span>
                                     @endif
                                 </a>
@@ -305,7 +319,12 @@
                                 @endif
                             </div>
                         @endforeach
-                        </div>
                     @endforeach
                 </nav>
-            </aside>
+            @if ($placement === 'main-nav')
+</div>
+@endteleport
+@else
+</aside>
+@endif
+@endforeach
diff --git a/resources/views/components/auth/passkey-verify.blade.php b/resources/views/components/auth/passkey-verify.blade.php
new file mode 100644
index 0000000000..793e5998b6
--- /dev/null
+++ b/resources/views/components/auth/passkey-verify.blade.php
@@ -0,0 +1,55 @@
+@props([
+    'optionsRoute' => 'passkey.login-options',
+    'submitRoute' => 'passkey.login',
+    'label' => 'Sign in with a passkey',
+    'autofill' => false,
+])
+
+@vite('resources/js/passkeys.js')
+<div x-cloak x-show="supported" class="flex flex-col gap-2" x-data="{
+        supported: false,
+        loading: false,
+        error: null,
+        routes: { options: @js(route($optionsRoute)), submit: @js(route($submitRoute)) },
+        init() {
+            const ready = () => {
+                this.supported = Boolean(window.Passkeys?.isSupported());
+                if (this.supported && @js($autofill)) {
+                    this.autofill();
+                }
+            };
+            window.Passkeys ? ready() : window.addEventListener('passkeys:ready', ready, { once: true });
+        },
+        done(response) {
+            if (response) {
+                window.location.href = response.redirect || '/';
+            }
+        },
+        async autofill() {
+            try {
+                this.done(await window.Passkeys.autofill({ routes: this.routes }));
+            } catch (e) {
+                this.error = e.message;
+            }
+        },
+        async verify() {
+            this.loading = true;
+            this.error = null;
+            try {
+                this.done(await window.Passkeys.verify({ routes: this.routes }));
+            } catch (e) {
+                if (e.name !== 'UserCancelledError') {
+                    this.error = e.message;
+                }
+            } finally {
+                this.loading = false;
+            }
+        },
+    }">
+    <x-forms.button class="w-full justify-center" type="button" x-on:click="verify()" x-bind:disabled="loading">
+        {{ $label }}
+    </x-forms.button>
+    <template x-if="error">
+        <x-auth.alert type="error"><span x-text="error"></span></x-auth.alert>
+    </template>
+</div>
diff --git a/resources/views/components/backup-sidebar.blade.php b/resources/views/components/backup-sidebar.blade.php
index be7148c98e..900a0be0b6 100644
--- a/resources/views/components/backup-sidebar.blade.php
+++ b/resources/views/components/backup-sidebar.blade.php
@@ -9,32 +9,24 @@
         'application' => [
             'back' => 'project.application.backup.index',
             'general' => 'project.application.backup.show',
-            's3' => 'project.application.backup.s3',
-            'retention' => 'project.application.backup.retention',
             'executions' => 'project.application.backup.executions',
             'danger' => 'project.application.backup.danger',
         ],
         'service' => [
             'back' => 'project.service.volume-backups.index',
             'general' => 'project.service.database.backup.show',
-            's3' => 'project.service.database.backup.s3',
-            'retention' => 'project.service.database.backup.retention',
             'executions' => 'project.service.database.backup.executions',
             'danger' => 'project.service.database.backup.danger',
         ],
         'service-volume' => [
             'back' => 'project.service.volume-backups.index',
             'general' => 'project.service.volume-backups.show',
-            's3' => 'project.service.volume-backups.s3',
-            'retention' => 'project.service.volume-backups.retention',
             'executions' => 'project.service.volume-backups.executions',
             'danger' => 'project.service.volume-backups.danger',
         ],
         default => [
             'back' => 'project.database.configuration',
             'general' => 'project.database.backup.execution',
-            's3' => 'project.database.backup.s3',
-            'retention' => 'project.database.backup.retention',
             'executions' => 'project.database.backup.executions',
             'danger' => 'project.database.backup.danger',
         ],
@@ -42,12 +34,16 @@
 
     $items = [
         ['key' => 'general', 'label' => 'General', 'icon' => 'settings'],
-        ['key' => 's3', 'label' => 'S3 storage', 'icon' => 'storages'],
-        ['key' => 'retention', 'label' => 'Retention', 'icon' => 'unordered-list'],
         ['key' => 'executions', 'label' => 'Executions', 'icon' => 'browser-terminal'],
-        ['key' => 'danger', 'label' => 'Danger Zone', 'icon' => 'shield-alert'],
+        ['key' => 'danger', 'label' => 'Danger Zone', 'icon' => 'danger'],
     ];
     $backLabel = $context === 'database' ? 'Back to database' : 'Back to backups';
+    // The resource menu that the page renders one Back away in the main sidebar.
+    $parentMenu = match ($context) {
+        'application' => 'Application',
+        'database' => 'Database',
+        default => 'Service',
+    };
     $backParameters = match ($context) {
         'database' => collect($parameters)->except('backup_uuid')->all(),
         'service' => collect($parameters)->except(['stack_service_uuid', 'backup_uuid'])->all(),
@@ -55,17 +51,19 @@
     };
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+<x-main-nav-menu :depth="1" :back-label="$parentMenu" :back-title="'Back to the '.strtolower($parentMenu).' menu'"
     data-settings-search-items="{{ json_encode(settingsSearchItems(['Backup' => collect($items)->map(fn (array $item): array => [...$item, 'route' => $routes[$item['key']]])], $parameters)) }}">
     <nav aria-label="Backup settings"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-        <div class="nav-section hidden xl:block">Backup</div>
-        <a class="menu-item" {{ wireNavigate() }} href="{{ route($routes['back'], $backParameters) }}">
+        <a class="menu-item" data-page-only {{ wireNavigate() }} href="{{ route($routes['back'], $backParameters) }}">
             <x-reicon name="logout" class="menu-item-icon rotate-180" />
             <span class="menu-item-label">{{ $backLabel }}</span>
         </a>
 
         @foreach ($items as $item)
+            @if ($item['key'] === 'danger')
+                <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
+            @endif
             <a @class([
                 'menu-item',
                 'menu-item-active' => $section === $item['key'],
@@ -76,4 +74,4 @@
             </a>
         @endforeach
     </nav>
-</aside>
+</x-main-nav-menu>
diff --git a/resources/views/components/backup-tabs.blade.php b/resources/views/components/backup-tabs.blade.php
index 4898a29ed5..d1c436e09b 100644
--- a/resources/views/components/backup-tabs.blade.php
+++ b/resources/views/components/backup-tabs.blade.php
@@ -8,21 +8,15 @@
     $routes = match ($context) {
         'service-schedule' => [
             'general' => true,
-            's3' => true,
-            'retention' => true,
             'danger' => true,
         ],
         'service' => [
             'general' => 'project.service.database.backup.show',
-            's3' => 'project.service.database.backup.s3',
-            'retention' => 'project.service.database.backup.retention',
             'executions' => 'project.service.database.backup.executions',
             'danger' => 'project.service.database.backup.danger',
         ],
         'service-volume' => [
             'general' => 'project.service.volume-backups.show',
-            's3' => 'project.service.volume-backups.s3',
-            'retention' => 'project.service.volume-backups.retention',
             'executions' => 'project.service.volume-backups.executions',
             'danger' => 'project.service.volume-backups.danger',
         ],
@@ -30,8 +24,6 @@
 
     $items = collect([
         ['key' => 'general', 'label' => 'General'],
-        ['key' => 's3', 'label' => 'S3 storage'],
-        ['key' => 'retention', 'label' => 'Retention'],
         ['key' => 'executions', 'label' => 'Executions'],
         ['key' => 'danger', 'label' => 'Danger Zone'],
     ])->filter(fn (array $item): bool => isset($routes[$item['key']]));
diff --git a/resources/views/components/beta-badge.blade.php b/resources/views/components/beta-badge.blade.php
index 56c12a3771..66581433e4 100644
--- a/resources/views/components/beta-badge.blade.php
+++ b/resources/views/components/beta-badge.blade.php
@@ -1,6 +1,10 @@
 <span {{ $attributes->merge(['class' => 'inline-flex items-center']) }}>
-    <span
-        class="px-2 py-0.5 text-xs font-medium leading-normal rounded-full bg-coollabs/10 text-coollabs border border-coollabs/30 dark:bg-warning/15 dark:text-warning dark:border-warning/30">
-        Beta
+    <span role="img" aria-label="Beta" data-tooltip="Beta"
+        class="inline-flex items-center justify-center p-0.5 rounded-full cursor-help text-coollabs dark:text-warning">
+        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"
+            class="size-4" aria-hidden="true">
+            <path stroke-linecap="round" stroke-linejoin="round"
+                d="M9.75 3.104v5.714a2.25 2.25 0 0 1-.659 1.591L5 14.5M9.75 3.104c-.251.023-.501.05-.75.082m.75-.082a24.301 24.301 0 0 1 4.5 0m0 0v5.714c0 .597.237 1.17.659 1.591L19.8 15.3M14.25 3.104c.251.023.501.05.75.082M19.8 15.3l-1.57.393A9.065 9.065 0 0 1 12 15a9.065 9.065 0 0 0-6.23-.693L5 14.5m14.8.8 1.402 1.402c1.232 1.232.65 3.318-1.067 3.611A48.309 48.309 0 0 1 12 21c-2.773 0-5.491-.235-8.135-.687-1.718-.293-2.3-2.379-1.067-3.61L5 14.5" />
+        </svg>
     </span>
 </span>
diff --git a/resources/views/components/canvas-view-toggle.blade.php b/resources/views/components/canvas-view-toggle.blade.php
new file mode 100644
index 0000000000..f27e7bab5a
--- /dev/null
+++ b/resources/views/components/canvas-view-toggle.blade.php
@@ -0,0 +1,49 @@
+@props(['listUrl' => null, 'canvasUrl' => null, 'onCanvas' => false, 'views' => null])
+@php
+    $idle = 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg dark:hover:bg-white/[0.06] dark:hover:text-fg';
+    $canvasItem = 'relative flex h-7.5 shrink-0 items-center gap-1.5 whitespace-nowrap rounded-md px-2.5 text-[12px] font-medium transition-colors';
+    $views ??= ['table' => ['Table view', 'unordered-list'], 'grid' => ['Grid view', 'grid']];
+    // One list view (no table / grid choice): nothing to switch to on the list page.
+    $singleList = count($views) === 1;
+@endphp
+{{-- Table / grid / canvas switcher. On the list page, table and grid switch the
+     parent's Alpine viewMode; the canvas page shows one "List view" link back
+     (?view= makes the list the remembered view again, see RemembersCanvasView).
+     Pages with one list view pass :views="['list' => [...]]". Without a
+     canvasUrl it is only a table / grid switcher. --}}
+@if ($onCanvas || ! $singleList || filled($canvasUrl))
+<div {{ $attributes->merge(['class' => 'view-toggle']) }}>
+    @if ($onCanvas)
+        {{-- On the canvas only the way back: one labelled link to the list (its first view). --}}
+        @php [$label, $icon] = reset($views); @endphp
+        <a href="{{ $listUrl }}?view={{ array_key_first($views) }}" {{ wireNavigate() }} class="{{ $canvasItem }} {{ $idle }}"
+            title="List view">
+            <x-reicon :name="$icon" class="size-3.5" />
+            List view
+        </a>
+    @else
+        {{-- Only the views you can switch to, with their names; the current one is not shown. --}}
+        @unless ($singleList)
+            @foreach ($views as $mode => [$label, $icon])
+                <button type="button" x-on:click="setViewMode(@js($mode))" x-show="viewMode !== @js($mode)" x-cloak
+                    class="{{ $canvasItem }} {{ $idle }}" title="{{ $label }}">
+                    <x-reicon :name="$icon" class="size-3.5" />
+                    {{ $label }}
+                </button>
+            @endforeach
+        @endunless
+        @if (filled($canvasUrl))
+            {{-- A label and a purple "Try it" badge, so people notice the canvas view. --}}
+            <a href="{{ $canvasUrl }}" {{ wireNavigate() }}
+                class="{{ $canvasItem }} {{ $idle }}" title="Canvas view (beta): see everything and how it connects">
+                <x-reicon name="deploy-canvas" class="size-3.5" />
+                Canvas
+                <span
+                    class="ml-0.5 inline-flex items-center rounded-full bg-coollabs px-1.5 py-px text-[10px] leading-4 font-semibold text-white">
+                    Try it
+                </span>
+            </a>
+        @endif
+    @endif
+</div>
+@endif
diff --git a/resources/views/components/dashboard/navbar.blade.php b/resources/views/components/dashboard/navbar.blade.php
index db6242f56a..8e7e390b81 100644
--- a/resources/views/components/dashboard/navbar.blade.php
+++ b/resources/views/components/dashboard/navbar.blade.php
@@ -109,7 +109,7 @@
 
 @if ($showNav)
 <nav class="mb-6 w-full lg:mb-0">
-    <div class="w-full lg:fixed lg:top-12 lg:right-0 lg:z-30 lg:h-12 lg:w-auto lg:border-b lg:border-neutral-200 lg:bg-white/95 lg:pr-4 lg:pl-2 lg:backdrop-blur lg:transition-[left] lg:duration-200 lg:dark:border-white/[0.06] lg:dark:bg-panel/95"
+    <div class="app-tabbar w-full lg:fixed lg:top-12 lg:right-0 lg:z-30 lg:h-12 lg:w-auto lg:border-b lg:border-neutral-200 lg:bg-white/95 lg:pr-4 lg:pl-2 lg:backdrop-blur lg:transition-[left] lg:duration-200 lg:dark:border-white/[0.06] lg:dark:bg-panel/95"
         :class="[typeof collapsed !== 'undefined' && collapsed ? 'lg:left-16' : 'lg:left-56']">
         {{-- Mobile: stack tabs then actions so long buttons never crush the tab strip.
              Desktop: single fixed row with tabs left and actions right. --}}
diff --git a/resources/views/components/database/configuration-sidebar.blade.php b/resources/views/components/database/configuration-sidebar.blade.php
index 3d3eb054bd..9b17308b85 100644
--- a/resources/views/components/database/configuration-sidebar.blade.php
+++ b/resources/views/components/database/configuration-sidebar.blade.php
@@ -1,4 +1,4 @@
-@props(['database', 'currentRoute'])
+@props(['database', 'currentRoute', 'navOnly' => false])
 
 @php
     $databaseRouteParameters = [
@@ -16,13 +16,14 @@
         ['label' => 'Servers', 'route' => 'project.database.servers', 'icon' => 'servers'],
         ['label' => 'Runtime Logs', 'route' => 'project.database.logs', 'icon' => 'unordered-list', 'navigate' => false],
         ['label' => 'Terminal', 'route' => 'project.database.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
-        ['label' => 'Webhooks', 'route' => 'project.database.webhooks', 'icon' => 'notifications'],
+        ['label' => 'Files', 'route' => 'project.database.files', 'icon' => 'folder', 'visible' => auth()->user()?->can('canAccessTerminal')],
+        ['label' => 'Webhooks', 'route' => 'project.database.webhooks', 'icon' => 'webhook'],
         ['label' => 'Healthcheck', 'route' => 'project.database.healthcheck', 'icon' => 'feedback'],
         ['label' => 'Resource Limits', 'route' => 'project.database.resource-limits', 'icon' => 'cpu'],
         ['label' => 'Resource Operations', 'route' => 'project.database.resource-operations', 'icon' => 'server-update'],
         ['label' => 'Metrics', 'route' => 'project.database.metrics', 'icon' => 'graph'],
         ['label' => 'Tags', 'route' => 'project.database.tags', 'icon' => 'tags'],
-        ['label' => 'Danger Zone', 'route' => 'project.database.danger', 'icon' => 'shield-alert'],
+        ['label' => 'Danger Zone', 'route' => 'project.database.danger', 'icon' => 'danger'],
     ])->filter(fn (array $item): bool => $item['visible'] ?? true)
         ->map(fn (array $item): array => [
             ...$item,
@@ -33,10 +34,11 @@
 
     $menuGroups = [
         'Settings' => ['General', 'Environment Variables', 'Persistent Storage', 'Healthcheck'],
-        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Metrics'],
+        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Files', 'Metrics'],
         'Deploy' => ['Servers'],
         'Automation' => ['Webhooks', 'Backups', 'Import Backup'],
-        'Operations' => ['Resource Operations', 'Resource Limits', 'Tags', 'Danger Zone'],
+        'Operations' => ['Resource Operations', 'Resource Limits', 'Tags'],
+        'Danger Zone' => ['Danger Zone'],
     ];
 
     $groupedItems = collect($menuGroups)
@@ -46,9 +48,6 @@
             ->values())
         ->filter(fn ($items) => $items->isNotEmpty());
 
-    // Group that holds the current page — always kept open, even if collapsed before.
-    $activeGroup = (string) $groupedItems->search(fn ($items) => $items->contains(fn ($item) => $item['active'] ?? false));
-
     $pageSections = $database->type() === 'standalone-postgresql'
         ? [
             ['id' => 'database-details-section', 'label' => 'Database details'],
@@ -63,31 +62,40 @@
         : [];
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+@php
+    // The main sidebar shows this menu on wide screens (see components/navbar.blade.php).
+    registerMainNavContext(0, 'Dashboard', 'Back to the main menu');
+@endphp
+
+{{-- Rendered twice: in the page (below xl), and teleported into the main sidebar (xl and up).
+     navOnly renders only the sidebar copy, as the parent menu of a deeper page (e.g. a backup). --}}
+@foreach ($navOnly ? ['main-nav'] : ['page', 'main-nav'] as $placement)
+@if ($placement === 'main-nav')
+@teleport('#main-nav-context-0')
+<div class="nav-context-menu">
+@else
+<aside class="application-settings-navigation in-main-nav min-w-0 xl:self-start"
     data-settings-search-items="{{ json_encode(settingsSearchItems($groupedItems, $databaseRouteParameters, ['project.database.configuration' => $pageSections])) }}">
+@endif
     <nav aria-label="Database settings"
-        x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.database' })"
-        class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
+        @class([
+            'grid gap-0.5',
+            'grid-cols-2 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]' => $placement === 'page',
+            'grid-cols-1' => $placement === 'main-nav',
+        ])>
         @foreach ($groupedItems as $groupLabel => $groupItems)
             @unless ($loop->first)
                 <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
             @endunless
-            <button type="button" class="nav-section-toggle hidden xl:flex" @click="toggle(@js($groupLabel))"
-                :aria-expanded="isOpen(@js($groupLabel))">
-                <span>{{ $groupLabel }}</span>
-                <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                    :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                    stroke="currentColor" stroke-width="2" aria-hidden="true">
-                    <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                </svg>
-            </button>
-            <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
             @foreach ($groupItems as $menuItem)
                 <a @class(['menu-item', 'menu-item-active' => $menuItem['active']])
                     @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
                     href="{{ route($menuItem['route'], $databaseRouteParameters) }}">
                     <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
                     <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                    @if ($menuItem['label'] === 'Files')
+                        <x-beta-badge class="ml-auto shrink-0" />
+                    @endif
                 </a>
                 @if ($menuItem['active'] && $menuItem['route'] === 'project.database.configuration' && $pageSections !== [])
                     <div class="nav-children hidden flex-col gap-0.5 py-1 xl:flex"
@@ -108,7 +116,12 @@
                     </div>
                 @endif
             @endforeach
-            </div>
         @endforeach
     </nav>
+@if ($placement === 'main-nav')
+</div>
+@endteleport
+@else
 </aside>
+@endif
+@endforeach
diff --git a/resources/views/components/emails/deployment-commit.blade.php b/resources/views/components/emails/deployment-commit.blade.php
new file mode 100644
index 0000000000..bf5c23fcf1
--- /dev/null
+++ b/resources/views/components/emails/deployment-commit.blade.php
@@ -0,0 +1,16 @@
+@props(['commit' => null])
+@if ($commit)
+@php
+    $commitLine = null;
+    if ($commit['short_sha']) {
+        $shortSha = e($commit['short_sha']);
+        $commitLine = '**Commit:** '.($commit['url'] ? "[{$shortSha}](".e($commit['url']).')' : $shortSha);
+        if ($commit['branch']) {
+            $commitLine .= ' on '.e($commit['branch']);
+        }
+    }
+    $messageBlock = $commit['message'] ? "**Commit message:**\n\n".e($commit['message']) : null;
+@endphp
+{!! collect([$commitLine, $messageBlock])->filter()->implode("\n\n") !!}
+
+@endif
diff --git a/resources/views/components/empty.blade.php b/resources/views/components/empty.blade.php
index 129ee71d8e..0716014220 100644
--- a/resources/views/components/empty.blade.php
+++ b/resources/views/components/empty.blade.php
@@ -7,9 +7,9 @@
 
 @php
     $minHeight = match ($size) {
-        'sm' => 'min-h-44',
+        'sm' => 'min-h-32',
         'lg' => 'min-h-96',
-        default => 'min-h-80',
+        default => 'min-h-40',
     };
 
     $iconBox = match ($size) {
@@ -24,16 +24,7 @@
         default => 'size-5',
     };
 
-    $titleClass = match ($size) {
-        'sm' => 'text-[14px] font-semibold text-black dark:text-fg',
-        'lg' => 'text-base font-semibold text-black dark:text-fg',
-        default => 'text-[15px] font-semibold text-black dark:text-fg',
-    };
-
-    $descriptionClass = match ($size) {
-        'sm' => 'mt-1 max-w-sm text-[12px] leading-5 text-neutral-500 dark:text-fg-dim',
-        default => 'mt-1 max-w-sm text-[13px] leading-5 text-neutral-500 dark:text-fg-dim',
-    };
+    $descriptionClass = $size === 'sm' ? 'text-[12px]' : 'text-[13px]';
 
     $hasIconSlot = isset($icon) && $icon instanceof \Illuminate\View\ComponentSlot && ! $icon->isEmpty();
     $hasIconName = filled($iconName);
@@ -48,31 +39,30 @@
     }
 @endphp
 
-{{-- Empty state: dashed card, icon badge, title, description, optional actions. --}}
-<div
-    {{ $attributes->merge([
-        'class' => "empty-state flex w-full flex-col items-center justify-center rounded-xl border border-dashed border-neutral-300 px-6 py-10 text-center dark:border-white/[0.1] {$minHeight}",
-    ]) }}>
-    @if ($hasIcon)
-        <div
-            class="{{ $iconBox }} flex items-center justify-center rounded-xl border border-neutral-200 bg-white text-neutral-400 shadow-sm dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-faint">
-            @if ($hasIconSlot)
-                {{ $icon }}
-            @else
-                <x-reicon :name="$iconName" class="{{ $iconSize }}" />
-            @endif
-        </div>
-    @endif
+{{-- Empty state: card frame around an inset well with centered text. Inside a layer card, the card is the frame. --}}
+<div {{ $attributes->merge(['class' => 'empty-state w-full']) }}>
+    <div class="empty-state-well {{ $minHeight }}">
+        @if ($hasIcon)
+            <div
+                class="{{ $iconBox }} flex items-center justify-center rounded-xl border border-neutral-200 bg-white text-neutral-400 shadow-sm dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-faint">
+                @if ($hasIconSlot)
+                    {{ $icon }}
+                @else
+                    <x-reicon :name="$iconName" class="{{ $iconSize }}" />
+                @endif
+            </div>
+        @endif
 
-    <h2 class="{{ $titleClass }}">{{ $title }}</h2>
+        <h2 class="empty-state-title">{{ $title }}</h2>
 
-    @if ($description)
-        <p class="{{ $descriptionClass }}">{{ $description }}</p>
-    @endif
+        @if ($description)
+            <p class="empty-state-description {{ $descriptionClass }}">{{ $description }}</p>
+        @endif
 
-    @if ($footer)
-        <div class="mt-4 flex flex-wrap items-center justify-center gap-2">
-            {{ $footer }}
-        </div>
-    @endif
+        @if ($footer)
+            <div class="mt-4 flex flex-wrap items-center justify-center gap-2">
+                {{ $footer }}
+            </div>
+        @endif
+    </div>
 </div>
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index 2f382fd1c2..58cb9b406b 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -23,6 +23,7 @@
     'searchable' => false, // true = a search field filters the options
     'searchPlaceholder' => 'Search…',
     'searchEmptyText' => 'No matching options',
+    'allowCustom' => false, // true (with searchable) = the search text can be chosen as a custom value
 ])
 
 @php
@@ -92,9 +93,15 @@
             return this.options.filter((option) => !option.header && [option.label, option.value, option.description]
                 .some((text) => String(text ?? '').toLowerCase().includes(query)));
         },
+        get customOption() {
+            const query = this.query.trim();
+            if (!@js($allowCustom) || query === '' || this.options.some((option) => !option.header && String(option.value) === query)) return null;
+            return { value: query, label: query };
+        },
         chooseOnlyMatch() {
             const matches = this.visibleOptions.filter((option) => !option.disabled);
             if (matches.length === 1) this.choose(matches[0]);
+            else if (this.customOption) this.choose(this.customOption);
         },
         @else
         get visibleOptions() {
@@ -126,7 +133,8 @@
         },
         get current() {
             const found = this.options.find((option) => String(option.value) === String(this.value));
-            return found ? found.label : @js($placeholder);
+            if (found) return found.label;
+            return @js($allowCustom) && this.value ? String(this.value) : @js($placeholder);
         },
         get title() {
             return this.current;
@@ -237,7 +245,7 @@
                         </div>
                         <div class="searchable-listbox-options">
                     @endif
-                    <div x-show="visibleOptions.length === 0"
+                    <div x-show="visibleOptions.length === 0{{ $searchable && $allowCustom ? ' && !customOption' : '' }}"
                         class="px-3 py-2 text-[13px] text-neutral-500 dark:text-fg-dim">
                         @if ($searchable)
                             <span x-text="options.length === 0 ? @js($emptyText) : @js($searchEmptyText)"></span>
@@ -272,6 +280,14 @@
                             </template>
                         </div>
                     </template>
+                    @if ($searchable && $allowCustom)
+                        <template x-if="customOption">
+                            <button type="button" class="listbox-option" role="option" aria-selected="false"
+                                @click="choose(customOption)">
+                                <span class="truncate">Use <span class="font-mono" x-text="customOption.label"></span></span>
+                            </button>
+                        </template>
+                    @endif
                     @if ($searchable)
                         </div>
                     @endif
@@ -296,7 +312,7 @@
                     </div>
                     <div class="searchable-listbox-options">
                 @endif
-                <div x-show="visibleOptions.length === 0"
+                <div x-show="visibleOptions.length === 0{{ $searchable && $allowCustom ? ' && !customOption' : '' }}"
                     class="px-3 py-2 text-[13px] text-neutral-500 dark:text-fg-dim">
                     @if ($searchable)
                         <span x-text="options.length === 0 ? @js($emptyText) : @js($searchEmptyText)"></span>
@@ -329,6 +345,14 @@
                         </template>
                     </div>
                 </template>
+                @if ($searchable && $allowCustom)
+                    <template x-if="customOption">
+                        <button type="button" class="listbox-option" role="option" aria-selected="false"
+                            @click="choose(customOption)">
+                            <span class="truncate">Use <span class="font-mono" x-text="customOption.label"></span></span>
+                        </button>
+                    </template>
+                @endif
                 @if ($searchable)
                     </div>
                 @endif
diff --git a/resources/views/components/forms/repository-paths.blade.php b/resources/views/components/forms/repository-paths.blade.php
new file mode 100644
index 0000000000..1b5c6f94f9
--- /dev/null
+++ b/resources/views/components/forms/repository-paths.blade.php
@@ -0,0 +1,47 @@
+@props([
+    'base',
+    'file' => null,
+    'fileLabel' => null,
+    'defaultFile' => null,
+    'disabled' => 'false',
+])
+
+<div wire:key="repository-paths-{{ $file }}" {{ $attributes->class('grid gap-4') }} x-data="{
+    base: $wire.entangle('{{ $base }}'),
+    file: {{ $file ? "\$wire.entangle('{$file}')" : 'null' }},
+    normalize(path) {
+        path = (path ?? '').trim().replace(/\/+$/, '');
+        return path === '' || path.startsWith('/') ? path : '/' + path;
+    },
+    get directory() {
+        return this.normalize(this.base);
+    },
+    get location() {
+        return this.normalize(this.file) || '{{ $defaultFile }}';
+    },
+    get repeatsBase() {
+        return this.directory !== '' && this.location.startsWith(this.directory + '/');
+    },
+    get suggestion() {
+        return this.location.slice(this.directory.length);
+    },
+}">
+    <x-forms.input label="Base directory" placeholder="/"
+        helper="Repository directory used as the build root. Useful for monorepos." x-model="base"
+        x-bind:disabled="{{ $disabled }}" @blur="base = directory || '/'" />
+    @if ($file)
+        <x-forms.input :label="$fileLabel" :placeholder="$defaultFile" helper="Path relative to the base directory."
+            x-model="file" x-bind:disabled="{{ $disabled }}" @blur="file = location" />
+        <p class="col-span-full text-xs text-neutral-500 dark:text-fg-dim">
+            Resolved file:
+            <code class="font-mono text-coollabs dark:text-warning" x-text="directory + location"></code>
+        </p>
+        <x-callout class="col-span-full" x-cloak x-show="repeatsBase" title="Base directory is repeated">
+            {{ $fileLabel }} is relative to the base directory, so it should not start with
+            <code class="rounded bg-black/10 px-1 dark:bg-white/10" x-text="directory"></code> again.
+            <button type="button" class="font-medium underline" x-show="!({{ $disabled }})"
+                @click="file = suggestion">Use <span x-text="suggestion"></span></button>
+        </x-callout>
+    @endif
+    {{ $slot }}
+</div>
diff --git a/resources/views/components/git-icon.blade.php b/resources/views/components/git-icon.blade.php
index 47ae8f8bbe..ca7196b52b 100644
--- a/resources/views/components/git-icon.blade.php
+++ b/resources/views/components/git-icon.blade.php
@@ -15,6 +15,16 @@
         <path stroke="none" d="M0 0h24v24H0z" fill="none" />
         <path d="M21 14l-9 7l-9 -7l3 -11l3 7h6l3 -7z" />
     </svg>
+@elseif($git === 'App\Models\GiteaApp')
+    <svg xmlns="http://www.w3.org/2000/svg" {{ $attributes->merge(['class' => 'w-6 h-6']) }} viewBox="0 0 24 24"
+        stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
+        <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+        <path d="M3 7h14v5a5 5 0 0 1 -5 5h-4a5 5 0 0 1 -5 -5z" />
+        <path d="M17 9h1.5a2.5 2.5 0 0 1 0 5h-1.5" />
+        <path d="M9 9.5v4" />
+        <path d="M9 11.5l2.5 -1.5" />
+        <path d="M5 20h10" />
+    </svg>
 @else
     <svg xmlns="http://www.w3.org/2000/svg" {{ $attributes->merge(['class' => 'w-6 h-6']) }} viewBox="0 0 24 24"
         stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
diff --git a/resources/views/components/hostinger-icon.blade.php b/resources/views/components/hostinger-icon.blade.php
new file mode 100644
index 0000000000..9616c8d965
--- /dev/null
+++ b/resources/views/components/hostinger-icon.blade.php
@@ -0,0 +1,7 @@
+<svg {{ $attributes }} viewBox="0 0 26 30" fill="none" xmlns="http://www.w3.org/2000/svg" role="img"
+    aria-label="Hostinger">
+    <title>Hostinger</title>
+    <path fill-rule="evenodd" clip-rule="evenodd"
+        d="M0.000249566 14.046V0.000497794L6.99464 3.78046V10.1086L16.2538 10.1132L23.3617 14.046H0.000249566ZM18.1472 8.95059V0L25.3302 3.68591V13.1797L18.1472 8.95059ZM18.1472 26.1177V19.8441L8.81663 19.8376C8.82534 19.8793 1.59081 15.8418 1.59081 15.8418L25.3302 15.9547V30L18.1472 26.1177ZM0 26.1177L0.000248849 16.9393L6.99464 21.0683V29.8033L0 26.1177Z"
+        fill="currentColor" />
+</svg>
diff --git a/resources/views/components/main-nav-menu.blade.php b/resources/views/components/main-nav-menu.blade.php
new file mode 100644
index 0000000000..3dc4687d2e
--- /dev/null
+++ b/resources/views/components/main-nav-menu.blade.php
@@ -0,0 +1,18 @@
+@props(['backLabel', 'backTitle' => 'Back to the main menu', 'depth' => 0, 'navOnly' => false])
+@php
+    // The main sidebar replaces its menu with this one on wide screens (see components/navbar.blade.php).
+    registerMainNavContext($depth, $backLabel, $backTitle);
+@endphp
+{{-- A page menu, rendered twice: in the page (below xl, CSS hides it on xl), and teleported into the
+     main sidebar (xl and up). The slot must not contain Livewire components (they would render twice).
+     navOnly renders only the sidebar copy: a deeper page uses it to keep its parent menu one Back away. --}}
+@unless ($navOnly)
+    <aside {{ $attributes->class('application-settings-navigation in-main-nav min-w-0 xl:self-start') }}>
+        {{ $slot }}
+    </aside>
+@endunless
+@teleport('#main-nav-context-'.$depth)
+    <div class="nav-context-menu">
+        {{ $slot }}
+    </div>
+@endteleport
diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index 58f70ab206..b026094ca2 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -60,7 +60,7 @@
                         'sm:h-[40rem]' => $fixedHeight,
                     ])
                     style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
-                    <header class="flex-wrap! sm:flex-nowrap!">
+                    <header class="shrink-0 flex-wrap! sm:flex-nowrap!">
                         <div class="min-w-0 flex-1 py-0.5">
                             <h3 class="truncate">{{ $title }}</h3>
                             @if ($subtitle)
diff --git a/resources/views/components/navbar.blade.php b/resources/views/components/navbar.blade.php
index e60f1246fc..90f281712e 100644
--- a/resources/views/components/navbar.blade.php
+++ b/resources/views/components/navbar.blade.php
@@ -1,6 +1,10 @@
-@props(['deploymentsIndicator' => false])
+@props(['desktop' => false])
 
-<nav class="flex min-h-0 flex-col flex-1 bg-white border-r border-neutral-200 dark:border-white/[0.06] dark:bg-panel pt-2"
+<nav @class([
+    'sidebar-nav flex min-h-0 flex-col flex-1 border-r border-black/[0.06] dark:border-white/[0.04] pt-2',
+    'bg-neutral-50 dark:bg-app' => $desktop,
+    'bg-white dark:bg-panel' => ! $desktop,
+])
     :class="collapsed ? 'px-2 lg:px-3 sidebar-collapsed' : 'px-2 lg:px-3'"
     @mouseover="
         if (!collapsed) return;
@@ -17,6 +21,14 @@
     @mouseleave="tooltip.show = false"
     x-data="{
         tooltip: { text: '', x: 0, y: 0, show: false },
+        // Label of the open submenu ('' = main menu). It starts on the submenu of the current page
+        // ([data-active-submenu], read in init). Back opens the main menu.
+        submenu: '',
+        // Depth of the open resource menu on wide screens (-1 = main menu or submenu). It starts on the
+        // deepest menu of the current page; Back opens the menu one depth lower.
+        navLevel: -1,
+        // Direction of the last menu swap ('forward' or 'back'); it selects the enter animation of every menu.
+        navSwap: '',
         // macOS/iOS use ⌘; Windows/Linux use Ctrl+
         modKeyLabel: (() => {
             const platform = navigator.userAgentData?.platform || navigator.platform || '';
@@ -24,6 +36,19 @@
             return /Mac|iPhone|iPad|iPod/i.test(platform) || /Mac OS X|Macintosh/i.test(ua) ? '⌘' : 'Ctrl+';
         })(),
         init() {
+                this.submenu = this.$root.querySelector('[data-active-submenu]')?.dataset.activeSubmenu || '';
+                this.navLevel = Number([...this.$root.querySelectorAll('[data-nav-level]')].pop()?.dataset.navLevel ?? -1);
+                if (@js($desktop)) {
+                    // The open resource menu depth is kept across page loads: a page that opens a deeper menu
+                    // (e.g. a backup) plays the forward swap, and a page that opens a lower one plays the back swap.
+                    const previousLevel = sessionStorage.getItem('navLevel');
+                    if (previousLevel !== null && window.matchMedia('(min-width: 80rem)').matches) {
+                        const levelChange = this.navLevel - Number(previousLevel);
+                        this.navSwap = levelChange > 0 ? 'forward' : (levelChange < 0 ? 'back' : '');
+                    }
+                    sessionStorage.setItem('navLevel', this.navLevel);
+                    this.$watch('navLevel', level => sessionStorage.setItem('navLevel', level));
+                }
                 window.matchMedia('(prefers-color-scheme: dark)').addEventListener('change', e => {
                     const userSettings = localStorage.getItem('theme');
                     if (userSettings !== 'system') { return; }
@@ -62,7 +87,7 @@
                 :title="hasPageSearch
                     ? 'Search this page and everything (Press / or ' + modKeyLabel + 'K, then Tab to switch)'
                     : 'Search (Press / or ' + modKeyLabel + 'K)'"
-                class="menu-item justify-between !bg-neutral-100 dark:!bg-white/[0.04] hover:!bg-neutral-200 dark:hover:!bg-white/[0.07] !text-fg-faint">
+                class="menu-item menu-search justify-between !bg-neutral-100 dark:!bg-white/[0.04] hover:!bg-neutral-200 dark:hover:!bg-white/[0.07] !text-fg-faint">
                 <span class="flex items-center gap-2.5 min-w-0">
                     <x-reicon name="search" class="menu-item-icon" />
                     <span class="menu-item-label truncate" :class="collapsed && 'lg:hidden'">Search</span>
@@ -73,160 +98,201 @@
         </div>
     @endif
 
-    <ul role="list" class="-mx-1 flex min-h-0 flex-1 flex-col gap-y-0.5 overflow-y-auto px-1 pb-2 scrollbar">
+    <ul role="list" class="sidebar-menu -mx-1 flex min-h-0 flex-1 flex-col gap-y-0.5 overflow-y-auto px-1 pb-2">
         @if (isSubscribed() || !isCloud())
-            {{-- Workspace --}}
-            <li class="nav-section" :class="collapsed && 'lg:hidden'">Workspace</li>
-            <li>
-                <a title="Dashboard" href="/" {{ wireNavigate() }}
-                    class="{{ request()->is('/') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'">
-                    <x-reicon name="dashboard" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Dashboard</span>
-                </a>
-            </li>
-            <li>
-                <a title="Projects" {{ wireNavigate() }}
-                    class="{{ request()->is('project/*') || request()->is('projects') ? 'menu-item menu-item-active' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="/projects">
-                    <x-reicon name="projects" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Projects</span>
-                </a>
-            </li>
-            <li>
-                <a title="Analytics" {{ wireNavigate() }}
-                    class="{{ request()->is('analytics') ? 'menu-item menu-item-active' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('analytics') }}">
-                    <x-reicon name="analytics" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Analytics</span>
-                </a>
-            </li>
-            @can('canAccessTerminal')
-                <li>
-                    <a title="Terminal"
-                        class="{{ request()->is('terminal*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                        :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('terminal') }}">
-                        <x-reicon name="browser-terminal" class="menu-item-icon" />
-                        <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Terminal</span>
-                    </a>
-                </li>
-            @endcan
-            {{-- Infrastructure --}}
-            <li class="nav-section mt-3" aria-hidden="true"
-                :class="collapsed && 'lg:mx-2.5 lg:my-2 lg:h-0 lg:overflow-hidden lg:border-t lg:border-neutral-200 lg:p-0 lg:text-transparent dark:lg:border-white/10'">
-                Infrastructure</li>
-            <li>
-                <a title="Servers" {{ wireNavigate() }}
-                    class="{{ request()->is('server/*') || request()->is('servers') ? 'menu-item menu-item-active' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="/servers">
-                    <x-reicon name="servers" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Servers</span>
-                </a>
-            </li>
-            <li>
-                <a title="Sources" {{ wireNavigate() }}
-                    class="{{ request()->is('source*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('source.all') }}">
-                    <x-reicon name="sources" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Sources</span>
-                </a>
-            </li>
-            <li>
-                <a title="Destinations" {{ wireNavigate() }}
-                    class="{{ request()->is('destination*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('destination.index') }}">
-                    <x-reicon name="destinations" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Destinations</span>
-                </a>
-            </li>
-            @if (auth()->user()?->isAdmin())
-                <li>
-                    <a title="Registries" {{ wireNavigate() }}
-                        class="{{ request()->is('registries*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                        :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('registries.index') }}">
-                        <x-reicon name="layers" class="menu-item-icon" />
-                        <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Registries</span>
-                    </a>
-                </li>
-            @endif
-            <li>
-                <a title="S3 Storage" {{ wireNavigate() }}
-                    class="{{ request()->is('storages*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('storage.index') }}">
-                    <x-reicon name="storages" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">S3 Storage</span>
-                </a>
-            </li>
-            <li>
-                <a title="Shared variables" {{ wireNavigate() }}
-                    class="{{ request()->is('shared-variables*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('shared-variables.index') }}">
-                    <x-reicon name="variables" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Shared Variables</span>
-                </a>
-            </li>
+            @php
+                // An entry with children opens a submenu in place of the main menu (back button + its pages).
+                $navSections = collect([
+                    'Workspace' => [
+                        ['label' => 'Dashboard', 'icon' => 'dashboard', 'href' => '/', 'active' => request()->is('/', 'dashboard/*', 'canvas')],
+                        ['label' => 'Projects', 'icon' => 'projects', 'href' => route('project.index'), 'active' => request()->is('projects', 'projects/*', 'project/*')],
+                        ['label' => 'Monitoring', 'icon' => 'graph', 'children' => [
+                            ['label' => 'Analytics', 'icon' => 'analytics', 'href' => route('analytics'), 'active' => request()->is('analytics')],
+                            ['label' => 'Metrics', 'icon' => 'graph', 'href' => route('metrics'), 'active' => request()->is('metrics')],
+                        ]],
+                        ['label' => 'Terminal', 'icon' => 'browser-terminal', 'href' => route('terminal'), 'active' => request()->is('terminal*'), 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
+                    ],
+                    'Infrastructure' => [
+                        ['label' => 'Servers', 'icon' => 'servers', 'href' => '/servers', 'active' => request()->is('server/*', 'servers', 'servers/*')],
+                        ['label' => 'Integrations', 'icon' => 'link', 'children' => [
+                            ['label' => 'Sources', 'icon' => 'sources', 'href' => route('source.all'), 'active' => request()->is('sources', 'source/*')],
+                            ['label' => 'Destinations', 'icon' => 'destinations', 'href' => route('destination.index'), 'active' => request()->is('destinations', 'destination/*')],
+                            ['label' => 'Registries', 'icon' => 'layers', 'href' => route('registries.index'), 'active' => request()->is('registries'), 'visible' => auth()->user()?->isAdmin()],
+                            ['label' => 'S3 Storage', 'icon' => 'storages', 'href' => route('storage.index'), 'active' => request()->is('storages', 'storages/*')],
+                        ]],
+                        ['label' => 'Shared Variables', 'icon' => 'variables', 'children' => [
+                            ['label' => 'Overview', 'icon' => 'dashboard', 'href' => route('shared-variables.index'), 'active' => request()->is('shared-variables')],
+                            ['label' => 'Team', 'icon' => 'teams', 'href' => route('shared-variables.team.index'), 'active' => request()->is('shared-variables/team*')],
+                            ['label' => 'Projects', 'icon' => 'projects', 'href' => route('shared-variables.project.index'), 'active' => request()->is('shared-variables/projects', 'shared-variables/project/*')],
+                            ['label' => 'Environments', 'icon' => 'layers', 'href' => route('shared-variables.environment.index'), 'active' => request()->is('shared-variables/environments*')],
+                            ['label' => 'Servers', 'icon' => 'servers', 'href' => route('shared-variables.server.index'), 'active' => request()->is('shared-variables/servers', 'shared-variables/server/*')],
+                        ]],
+                    ],
+                    'Manage' => [
+                        ['label' => 'Team', 'icon' => 'teams', 'children' => [
+                            ['label' => 'General', 'icon' => 'settings', 'href' => route('team.index'), 'active' => request()->is('team')],
+                            ['label' => 'Members', 'icon' => 'teams', 'href' => route('team.member.index'), 'active' => request()->is('team/members*')],
+                            ['label' => 'Audit log', 'icon' => 'time-back', 'href' => route('team.audit-log'), 'active' => request()->is('team/audit-log'), 'visible' => auth()->user()?->isAdminOfTeam(currentTeam()->id)],
+                            ['label' => 'Admin View', 'icon' => 'admin', 'href' => route('team.admin-view'), 'active' => request()->is('team/admin'), 'visible' => isInstanceAdmin()],
+                            ['label' => 'Danger Zone', 'icon' => 'danger', 'href' => route('team.danger-zone'), 'active' => request()->is('team/danger'), 'visible' => auth()->user()?->can('delete', currentTeam()), 'sectionStart' => true],
+                        ]],
+                        ['label' => 'Notifications', 'icon' => 'notifications', 'children' => [
+                            ['label' => 'Email', 'icon' => 'mail', 'href' => route('notifications.email'), 'active' => request()->is('notifications/email')],
+                            ['label' => 'Discord', 'brandIcon' => 'discord', 'href' => route('notifications.discord'), 'active' => request()->is('notifications/discord')],
+                            ['label' => 'Telegram', 'brandIcon' => 'telegram', 'href' => route('notifications.telegram'), 'active' => request()->is('notifications/telegram')],
+                            ['label' => 'Slack', 'brandIcon' => 'slack', 'href' => route('notifications.slack'), 'active' => request()->is('notifications/slack')],
+                            ['label' => 'Pushover', 'brandIcon' => 'pushover', 'href' => route('notifications.pushover'), 'active' => request()->is('notifications/pushover')],
+                            ['label' => 'Webhook', 'icon' => 'destinations', 'href' => route('notifications.webhook'), 'active' => request()->is('notifications/webhook')],
+                        ]],
+                        ['label' => 'Keys & Tokens', 'icon' => 'keys', 'children' => [
+                            ['label' => 'Private Keys', 'icon' => 'keys', 'href' => route('security.private-key.index'), 'active' => request()->is('security/private-key*')],
+                            ['label' => 'Cloud Tokens', 'icon' => 'cloud', 'href' => route('security.cloud-tokens'), 'active' => request()->is('security/cloud-tokens*'), 'visible' => auth()->user()?->can('viewAny', App\Models\CloudProviderToken::class)],
+                            ['label' => 'Integration Tokens', 'icon' => 'network', 'href' => route('security.integration-tokens'), 'active' => request()->is('security/integration-tokens'), 'visible' => auth()->user()?->can('viewAny', App\Models\IntegrationToken::class)],
+                            ['label' => 'Cloud-Init Scripts', 'icon' => 'file-content', 'href' => route('security.cloud-init-scripts'), 'active' => request()->is('security/cloud-init-scripts*'), 'visible' => auth()->user()?->can('viewAny', App\Models\CloudInitScript::class)],
+                            ['label' => 'API Tokens', 'icon' => 'code', 'href' => route('security.api-tokens'), 'active' => request()->is('security/api-tokens')],
+                        ]],
+                        ['label' => 'Subscription', 'icon' => 'subscription', 'href' => isCloud() ? route('subscription.show') : '', 'active' => request()->is('subscription*'), 'visible' => isCloud() && auth()->user()->isAdmin()],
+                        ['label' => 'Tags', 'icon' => 'tags', 'href' => route('tags.show'), 'active' => request()->is('tags*', 'canvas/tags')],
+                        ['label' => 'Settings', 'icon' => 'settings', 'visible' => isInstanceAdmin(), 'children' => [
+                            ['label' => 'General', 'icon' => 'settings', 'href' => route('settings.index'), 'active' => request()->is('settings')],
+                            ['label' => 'Advanced', 'icon' => 'grid', 'href' => route('settings.advanced'), 'active' => request()->is('settings/advanced')],
+                            ['label' => 'Updates', 'icon' => 'refresh3', 'href' => route('settings.updates'), 'active' => request()->is('settings/updates')],
+                            ['label' => 'Authentication', 'icon' => 'keys', 'href' => route('settings.oauth'), 'active' => request()->is('settings/oauth*'), 'sectionStart' => true],
+                            ['label' => 'Email', 'icon' => 'mail', 'href' => route('settings.email'), 'active' => request()->is('settings/email')],
+                            ['label' => 'Backup', 'icon' => 'database', 'href' => route('settings.backup'), 'active' => request()->is('settings/backup')],
+                        ]],
+                    ],
+                ])->map(fn (array $items) => collect($items)
+                    ->filter(fn (array $item): bool => (bool) ($item['visible'] ?? true))
+                    ->map(function (array $item): array {
+                        if (! isset($item['children'])) {
+                            return $item;
+                        }
+                        $children = array_values(array_filter($item['children'], fn (array $child): bool => (bool) ($child['visible'] ?? true)));
 
-            {{-- Manage --}}
-            <li class="nav-section mt-3" aria-hidden="true"
-                :class="collapsed && 'lg:mx-2.5 lg:my-2 lg:h-0 lg:overflow-hidden lg:border-t lg:border-neutral-200 lg:p-0 lg:text-transparent dark:lg:border-white/10'">
-                Manage</li>
-            <li>
-                <a title="Team" {{ wireNavigate() }}
-                    class="{{ request()->is('team*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('team.index') }}">
-                    <x-reicon name="teams" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Team</span>
-                </a>
-            </li>
-            <li>
-                <a title="Notifications" {{ wireNavigate() }}
-                    class="{{ request()->is('notifications*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('notifications.email') }}">
-                    <x-reicon name="notifications" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Notifications</span>
-                </a>
-            </li>
-
-            <li>
-                <a title="Keys & Tokens" {{ wireNavigate() }}
-                    class="{{ request()->is('security*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('security.private-key.index') }}">
-                    <x-reicon name="keys" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Keys & Tokens</span>
-                </a>
-            </li>
-            @if (isCloud() && auth()->user()->isAdmin())
-                <li>
-                    <a title="Subscription" {{ wireNavigate() }}
-                        class="{{ request()->is('subscription*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                        :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('subscription.show') }}">
-                        <x-reicon name="subscription" class="menu-item-icon" />
-                        <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Subscription</span>
-                    </a>
+                        return [...$item, 'children' => $children, 'href' => $children[0]['href'], 'active' => collect($children)->contains('active', true)];
+                    })
+                    ->all());
+                $activeSubmenu = $navSections->flatten(1)->first(fn (array $item): bool => isset($item['children']) && $item['active']);
+                // Resource menus by depth, registered by registerMainNavContext() (e.g. from
+                // components/main-nav-menu.blade.php). Each one teleports itself into #main-nav-context-{depth};
+                // only the desktop sidebar has the slots.
+                $navContext = $desktop ? request()->attributes->get('mainNavContext', []) : [];
+            @endphp
+            {{-- Wide screens on a resource page: the deepest resource menu replaces the main menu. Back shows the
+                 menu one depth lower, and then the main menu (or its submenu), without leaving the page. --}}
+            @foreach ($navContext as $depth => $navMenu)
+                @php
+                    $previousDepth = collect($navContext)->keys()->filter(fn (int $key): bool => $key < $depth)->last() ?? -1;
+                @endphp
+                <li x-show="navLevel === {{ $depth }}" data-nav-level="{{ $depth }}" @unless ($loop->last) x-cloak @endunless
+                    class="hidden xl:contents">
+                    <ul role="list" class="flex flex-col gap-y-0.5" :class="navSwap && 'nav-swap-' + navSwap">
+                        <li class="mb-1">
+                            <button type="button" @click="navLevel = {{ $previousDepth }}; navSwap = 'back'"
+                                title="{{ $navMenu['backTitle'] }}" aria-label="{{ $navMenu['backTitle'] }}"
+                                class="menu-item menu-back bg-transparent! hover:bg-neutral-100! dark:hover:bg-white/[0.06]!" :class="collapsed && 'lg:justify-center lg:px-0'">
+                                <span class="menu-back-icon flex shrink-0 items-center justify-center">
+                                    <x-reicon name="chevron-down" class="size-3 rotate-90 text-coollabs dark:text-fg-dim" />
+                                </span>
+                                <span class="flex-1 truncate pr-6 text-center font-medium text-black dark:text-fg"
+                                    :class="collapsed && 'lg:hidden'">{{ $navMenu['label'] }}</span>
+                            </button>
+                        </li>
+                        <li id="main-nav-context-{{ $depth }}" class="nav-context min-w-0"></li>
+                    </ul>
                 </li>
-            @endif
-            <li>
-                <a title="Tags" {{ wireNavigate() }}
-                    class="{{ request()->is('tags*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('tags.show') }}">
-                    <x-reicon name="tags" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Tags</span>
-                </a>
-            </li>
-            @if (isInstanceAdmin())
-                <li>
-                    <a title="Settings" {{ wireNavigate() }}
-                        class="{{ request()->is('settings*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                        :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('settings.index') }}">
-                        <x-reicon name="settings" class="menu-item-icon" />
-                        <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Settings</span>
-                    </a>
+            @endforeach
+            {{-- Submenus: a parent entry opens its submenu in place, and the user picks a page (the mobile
+                 drawer stays open until then). Back shows the main menu without leaving the page. --}}
+            @php
+                $renderedSubmenus = $navSections->flatten(1)->filter(fn (array $item): bool => isset($item['children']));
+            @endphp
+            @foreach ($renderedSubmenus as $submenuItem)
+                <li x-show="submenu === @js($submenuItem['label'])"
+                    @if ($submenuItem['active']) data-active-submenu="{{ $submenuItem['label'] }}" @else x-cloak @endif
+                    @class(['contents', 'xl:hidden' => $navContext]) :class="{ 'xl:hidden': navLevel !== -1 }">
+                    <ul role="list" class="flex flex-col gap-y-0.5" :class="navSwap && 'nav-swap-' + navSwap">
+                        <li class="mb-1">
+                            <button type="button" @click="submenu = ''; navSwap = 'back'" title="Back to the main menu" aria-label="Back to the main menu"
+                                class="menu-item menu-back bg-transparent! hover:bg-neutral-100! dark:hover:bg-white/[0.06]!" :class="collapsed && 'lg:justify-center lg:px-0'">
+                                {{-- As wide as a menu icon (with its tile), so the chevron lines up with the icons below. --}}
+                                <span class="menu-back-icon flex shrink-0 items-center justify-center">
+                                    <x-reicon name="chevron-down" class="size-3 rotate-90 text-coollabs dark:text-fg-dim" />
+                                </span>
+                                <span class="flex-1 truncate pr-6 text-center font-medium text-black dark:text-fg"
+                                    :class="collapsed && 'lg:hidden'">{{ $submenuItem['label'] }}</span>
+                            </button>
+                        </li>
+                        @foreach ($submenuItem['children'] as $child)
+                            @if ($child['sectionStart'] ?? false)
+                                <li class="my-2 border-t border-neutral-200 dark:border-white/[0.06]" aria-hidden="true"></li>
+                            @endif
+                            <li>
+                                <a title="{{ $child['label'] }}" href="{{ $child['href'] }}" {{ wireNavigate() }}
+                                    @if ($child['active']) aria-current="page" @endif
+                                    @class(['menu-item', 'menu-item-active' => $child['active']])
+                                    :class="collapsed && 'lg:justify-center lg:px-0'">
+                                    @isset($child['brandIcon'])
+                                        {{-- The mask is on an inner span, so the outer span keeps the icon tile. --}}
+                                        <span class="menu-item-icon">
+                                            <span class="block size-full bg-current"
+                                                style="mask: url('{{ asset('svgs/'.$child['brandIcon'].'.svg') }}') center / contain no-repeat; -webkit-mask: url('{{ asset('svgs/'.$child['brandIcon'].'.svg') }}') center / contain no-repeat;"></span>
+                                        </span>
+                                    @else
+                                        <x-reicon :name="$child['icon']" class="menu-item-icon" />
+                                    @endisset
+                                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">{{ $child['label'] }}</span>
+                                </a>
+                            </li>
+                            @if ($child['active'] && $desktop)
+                                {{-- A page can teleport its own sub-items here (e.g. the OAuth providers). --}}
+                                <li id="main-nav-active-children" class="empty:hidden ml-5 border-l border-neutral-200 pl-2 dark:border-white/[0.08]" :class="collapsed && 'lg:hidden'"></li>
+                            @endif
+                        @endforeach
+                    </ul>
                 </li>
-            @endif
+            @endforeach
+            <li x-show="!submenu" @if ($activeSubmenu) x-cloak @endif @class(['contents', 'xl:hidden' => $navContext]) :class="{ 'xl:hidden': navLevel !== -1 }">
+                <ul role="list" class="flex flex-col gap-y-0.5" :class="navSwap && 'nav-swap-' + navSwap">
+            @foreach ($navSections as $sectionLabel => $sectionItems)
+                {{-- The first section needs no title. --}}
+                @unless ($loop->first)
+                    <li class="nav-section mt-3" aria-hidden="true"
+                        :class="collapsed && 'lg:mx-2.5 lg:my-2 lg:h-0 lg:overflow-hidden lg:border-t lg:border-neutral-200 lg:p-0 lg:text-transparent dark:lg:border-white/10'">
+                        {{ $sectionLabel }}</li>
+                @endunless
+                @foreach ($sectionItems as $item)
+                    <li>
+                        {{-- A parent entry is a button, not a link: wire:navigate would start a page load on mouse down. --}}
+                        @isset($item['children'])
+                            <button type="button" title="{{ $item['label'] }}" @click="submenu = @js($item['label']); navSwap = 'forward'"
+                                @class(['menu-item w-full', 'menu-item-active' => $item['active']])
+                                :class="collapsed && 'lg:justify-center lg:px-0'">
+                                <x-reicon :name="$item['icon']" class="menu-item-icon" />
+                                <span class="menu-item-label flex-1 text-left" :class="collapsed && 'lg:hidden'">{{ $item['label'] }}</span>
+                                <x-reicon name="chevron-down" class="size-3 -rotate-90 text-coollabs dark:text-fg-faint" ::class="collapsed && 'lg:hidden'" />
+                            </button>
+                        @else
+                            <a title="{{ $item['label'] }}" href="{{ $item['href'] }}"
+                                @if ($item['navigate'] ?? true) {{ wireNavigate() }} @endif
+                                @class(['menu-item', 'menu-item-active' => $item['active']])
+                                :class="collapsed && 'lg:justify-center lg:px-0'">
+                                <x-reicon :name="$item['icon']" class="menu-item-icon" />
+                                <span class="menu-item-label flex-1" :class="collapsed && 'lg:hidden'">{{ $item['label'] }}</span>
+                            </a>
+                        @endisset
+                    </li>
+                @endforeach
+            @endforeach
+                </ul>
+            </li>
             <li class="flex-1" aria-hidden="true"></li>
         @endif
         @if (auth()->id() === 0 && (isCloud() || isDev()))
-            <li>
+            {{-- Part of the main menu: hidden while a submenu or a resource menu shows. --}}
+            <li x-show="!submenu" @if ($activeSubmenu ?? null) x-cloak @endif @class(['xl:hidden' => $navContext ?? []])
+                :class="{ 'xl:hidden': navLevel !== -1 }">
                 <a title="Admin" {{ wireNavigate() }}
                     class="{{ request()->is('admin') ? 'menu-item-active menu-item' : 'menu-item' }}"
                     :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('admin.index') }}">
@@ -256,11 +322,9 @@
             @endif
         @endif
     </ul>
-    {{-- Sticky sidebar footer (desktop only; mobile uses a temporary slide-over) --}}
-    <div class="sticky bottom-0 mt-auto -mx-2 hidden flex-col gap-1 bg-white px-2 py-2 dark:bg-panel lg:-mx-3 lg:flex lg:px-3">
-        @if ($deploymentsIndicator)
-            <livewire:deployments-indicator variant="sidebar" />
-        @endif
+    {{-- Sidebar footer (desktop only; mobile uses a temporary slide-over). It stays visible;
+         only the menu above it scrolls on short or zoomed-in screens. --}}
+    <div class="sidebar-footer shrink-0 -mx-2 hidden flex-col gap-1 bg-neutral-50 px-2 py-2 dark:bg-app lg:-mx-3 lg:flex lg:px-3">
         <div class="flex items-center gap-1" :class="collapsed ? 'flex-col justify-center' : 'justify-between'">
             <x-top-user-menu sidebar />
             <button type="button" @click="toggleSidebar()" title="Toggle sidebar" aria-label="Toggle sidebar"
diff --git a/resources/views/components/notification/settings-layout.blade.php b/resources/views/components/notification/settings-layout.blade.php
index 5e801a1894..ac7ab44d40 100644
--- a/resources/views/components/notification/settings-layout.blade.php
+++ b/resources/views/components/notification/settings-layout.blade.php
@@ -9,35 +9,15 @@
     ];
 @endphp
 
-<section class="application-settings-workspace w-full max-w-none">
+{{-- These pages are in the Notifications submenu of the main sidebar (components/navbar.blade.php). --}}
+<section class="w-full max-w-none">
     <header class="settings-mobile-header xl:hidden">
         <h1 class="settings-mobile-title">Notifications</h1>
         <p class="settings-mobile-description">Configure how your team receives deployment and system alerts.</p>
     </header>
-    <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems(['Notifications' => $notificationMenuItems], [])) }}">
-            <nav aria-label="Notification settings"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                <div class="nav-section hidden xl:block">Notifications</div>
-                @foreach ($notificationMenuItems as $menuItem)
-                    <a wire:key="notification-settings-{{ str($menuItem['label'])->slug() }}"
-                        @class(['menu-item', 'menu-item-active' => request()->routeIs($menuItem['route'])])
-                        {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                        @if (isset($menuItem['brandIcon']))
-                            <span class="menu-item-icon bg-current"
-                                style="mask: url('{{ asset('svgs/' . $menuItem['brandIcon'] . '.svg') }}') center / contain no-repeat; -webkit-mask: url('{{ asset('svgs/' . $menuItem['brandIcon'] . '.svg') }}') center / contain no-repeat;"></span>
-                        @else
-                            <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        @endif
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                    </a>
-                @endforeach
-            </nav>
-        </aside>
-
-        <div class="min-w-0">
-            {{ $slot }}
-        </div>
+    {{-- Feeds the page search with the Notifications pages. --}}
+    <div hidden data-settings-search-items="{{ json_encode(settingsSearchItems(['Notifications' => $notificationMenuItems], [])) }}"></div>
+    <div class="min-w-0">
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/reicon.blade.php b/resources/views/components/reicon.blade.php
index a611869feb..3dd23cb82e 100644
--- a/resources/views/components/reicon.blade.php
+++ b/resources/views/components/reicon.blade.php
@@ -8,8 +8,11 @@
     $icons = [
         'fire' => '<path d="M12.83 2.18a.75.75 0 0 0-1.15.64c0 2.04-.88 3.72-2.31 5.19-.45-1.13-.59-2.31-.42-3.55a.75.75 0 0 0-1.17-.72C4.55 5.96 2.75 9.25 2.75 13a9.25 9.25 0 0 0 18.5 0c0-4.72-3.28-8.6-8.42-10.82ZM12 20.75A7.75 7.75 0 0 1 4.25 13c0-2.67 1.07-5.1 3.05-6.94.08 1.37.46 2.68 1.12 3.93a.75.75 0 0 0 1.18.19c1.85-1.62 3.03-3.48 3.43-5.6 4.13 2.09 6.72 5.13 6.72 8.42A7.75 7.75 0 0 1 12 20.75Z" fill="currentColor"/><path d="M12.38 10.13a.75.75 0 0 0-1.26.32c-.33 1.2-1.06 2.06-1.7 2.82-.69.81-1.17 1.52-1.17 2.73a3.75 3.75 0 0 0 7.5 0c0-2.13-1.2-4.1-3.37-5.87ZM12 18.25A2.25 2.25 0 0 1 9.75 16c0-.65.24-1.03.82-1.72.48-.57 1.03-1.21 1.45-2.06 1.47 1.37 2.23 2.63 2.23 3.78A2.25 2.25 0 0 1 12 18.25Z" fill="currentColor"/>',
         'cloud' => '<path d="M7.5 19.25h9.75a4.5 4.5 0 0 0 .62-8.96A6.25 6.25 0 0 0 5.8 8.65 5.25 5.25 0 0 0 7.5 19.25Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
+        'brain' => '<g stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M12 18V5"/><path d="M15 13a4.17 4.17 0 0 1-3-4 4.17 4.17 0 0 1-3 4"/><path d="M17.598 6.5A3 3 0 1 0 12 5a3 3 0 1 0-5.598 1.5"/><path d="M17.997 5.125a4 4 0 0 1 2.526 5.77"/><path d="M18 18a4 4 0 0 0 2-7.464"/><path d="M19.967 17.483A4 4 0 1 1 12 18a4 4 0 1 1-7.967-.517"/><path d="M6 18a4 4 0 0 1-2-7.464"/><path d="M6.003 5.125a4 4 0 0 0-2.526 5.77"/></g>',
+        'link' => '<path d="M10 14a4 4 0 0 0 5.66 0l3-3a4 4 0 0 0-5.66-5.66l-1 1M14 10a4 4 0 0 0-5.66 0l-3 3a4 4 0 0 0 5.66 5.66l1-1" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
         'code' => '<path d="m8.5 7-5 5 5 5M15.5 7l5 5-5 5M13.5 4l-3 16" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
         'analytics' => '<path d="M5 3v14a2 2 0 0 0 2 2h14" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M9 17v-3.5M13 17v-7M17 17v-10.5" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/>',
+        'deploy-canvas' => '<rect x="3.75" y="3.75" width="16.5" height="16.5" rx="3" stroke="currentColor" stroke-width="1.5"/><g fill="currentColor"><circle cx="8" cy="8" r="1"/><circle cx="12" cy="8" r="1"/><circle cx="16" cy="8" r="1"/><circle cx="8" cy="12" r="1"/><circle cx="12" cy="12" r="1"/><circle cx="16" cy="12" r="1"/><circle cx="8" cy="16" r="1"/><circle cx="12" cy="16" r="1"/><circle cx="16" cy="16" r="1"/></g>',
         'mail' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M5.5 3.25h13A4.25 4.25 0 0 1 22.75 7.5v9a4.25 4.25 0 0 1-4.25 4.25h-13A4.25 4.25 0 0 1 1.25 16.5v-9A4.25 4.25 0 0 1 5.5 3.25Zm-2.75 4.5v8.75a2.75 2.75 0 0 0 2.75 2.75h13a2.75 2.75 0 0 0 2.75-2.75V7.75l-6.6 5.13a4.25 4.25 0 0 1-5.3 0l-6.6-5.13Zm18.4-1.3A2.75 2.75 0 0 0 18.5 4.75h-13a2.75 2.75 0 0 0-2.65 1.7l7.42 5.77a2.75 2.75 0 0 0 3.46 0l7.42-5.77Z" fill="currentColor"/>',
         'dashboard' => '<path d="M9 17.25C8.58579 17.25 8.25 17.5858 8.25 18C8.25 18.4142 8.58579 18.75 9 18.75H15C15.4142 18.75 15.75 18.4142 15.75 18C15.75 17.5858 15.4142 17.25 15 17.25H9Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C11.2919 1.25 10.6485 1.45282 9.95055 1.79224C9.27585 2.12035 8.49642 2.60409 7.52286 3.20832L5.45628 4.4909C4.53509 5.06261 3.79744 5.5204 3.2289 5.95581C2.64015 6.40669 2.18795 6.86589 1.86131 7.46263C1.53535 8.05812 1.38857 8.69174 1.31819 9.4407C1.24999 10.1665 1.24999 11.0541 1.25 12.1672V13.7799C1.24999 15.6837 1.24998 17.1866 1.4027 18.3616C1.55937 19.567 1.88856 20.5401 2.63236 21.3094C3.37958 22.0824 4.33046 22.4277 5.50761 22.5914C6.64849 22.75 8.10556 22.75 9.94185 22.75H14.0581C15.8944 22.75 17.3515 22.75 18.4924 22.5914C19.6695 22.4277 20.6204 22.0824 21.3676 21.3094C22.1114 20.5401 22.4406 19.567 22.5973 18.3616C22.75 17.1866 22.75 15.6838 22.75 13.7799V12.1672C22.75 11.0541 22.75 10.1665 22.6818 9.4407C22.6114 8.69174 22.4646 8.05812 22.1387 7.46263C21.8121 6.86589 21.3599 6.40669 20.7711 5.95581C20.2026 5.5204 19.4649 5.06262 18.5437 4.49091L16.4771 3.20831C15.5036 2.60409 14.7241 2.12034 14.0494 1.79224C13.3515 1.45282 12.7081 1.25 12 1.25ZM8.27953 4.50412C9.29529 3.87371 10.0095 3.43153 10.6065 3.1412C11.1882 2.85833 11.6002 2.75 12 2.75C12.3998 2.75 12.8118 2.85833 13.3935 3.14119C13.9905 3.43153 14.7047 3.87371 15.7205 4.50412L17.7205 5.74537C18.6813 6.34169 19.3559 6.76135 19.8591 7.1467C20.3487 7.52164 20.6303 7.83106 20.8229 8.18285C21.0162 8.53589 21.129 8.94865 21.1884 9.58104C21.2492 10.2286 21.25 11.0458 21.25 12.2039V13.725C21.25 15.6959 21.2485 17.1012 21.1098 18.1683C20.9736 19.2163 20.717 19.8244 20.2892 20.2669C19.8649 20.7058 19.2871 20.9664 18.2858 21.1057C17.2602 21.2483 15.9075 21.25 14 21.25H10C8.09247 21.25 6.73983 21.2483 5.71422 21.1057C4.71286 20.9664 4.13514 20.7058 3.71079 20.2669C3.28301 19.8244 3.02642 19.2163 2.89019 18.1683C2.75149 17.1012 2.75 15.6959 2.75 13.725V12.2039C2.75 11.0458 2.75076 10.2286 2.81161 9.58104C2.87103 8.94865 2.98385 8.53589 3.17709 8.18285C3.36965 7.83106 3.65133 7.52164 4.14092 7.1467C4.6441 6.76135 5.31869 6.34169 6.27953 5.74537L8.27953 4.50412Z" fill="currentColor"/>',
         'projects' => '<path d="M5 10H7C9 10 10 9 10 7V5C10 3 9 2 7 2H5C3 2 2 3 2 5V7C2 9 3 10 5 10Z" stroke="currentColor" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/><path d="M17 10H19C21 10 22 9 22 7V5C22 3 21 2 19 2H17C15 2 14 3 14 5V7C14 9 15 10 17 10Z" stroke="currentColor" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/><path d="M17 22H19C21 22 22 21 22 19V17C22 15 21 14 19 14H17C15 14 14 15 14 17V19C14 21 15 22 17 22Z" stroke="currentColor" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/><path d="M5 22H7C9 22 10 21 10 19V17C10 15 9 14 7 14H5C3 14 2 15 2 17V19C2 21 3 22 5 22Z" stroke="currentColor" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>',
@@ -19,6 +22,7 @@
         'storages' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C11.3953 1.25 10.8384 1.40029 10.2288 1.65242C9.64008 1.89588 8.95633 2.25471 8.1049 2.70153L6.03739 3.78651C4.99242 4.33487 4.15616 4.77371 3.51047 5.20491C2.84154 5.65164 2.32632 6.12201 1.95112 6.75918C1.57718 7.39421 1.40896 8.08184 1.32829 8.90072C1.24999 9.69558 1.24999 10.6731 1.25 11.9026V12.0974C1.24999 13.3268 1.24999 14.3044 1.32829 15.0993C1.40896 15.9182 1.57718 16.6058 1.95112 17.2408C2.32632 17.878 2.84154 18.3484 3.51047 18.7951C4.15616 19.2263 4.99241 19.6651 6.03737 20.2135L8.10481 21.2984C8.95628 21.7453 9.64006 22.1041 10.2288 22.3476C10.8384 22.5997 11.3953 22.75 12 22.75C12.6047 22.75 13.1616 22.5997 13.7712 22.3476C14.3599 22.1041 15.0437 21.7453 15.8951 21.2985L17.9626 20.2135C19.0076 19.6651 19.8438 19.2263 20.4895 18.7951C21.1585 18.3484 21.6737 17.878 22.0489 17.2408C22.4228 16.6058 22.591 15.9182 22.6717 15.0993C22.75 14.3044 22.75 13.3269 22.75 12.0975V11.9025C22.75 10.6731 22.75 9.69557 22.6717 8.90072C22.591 8.08184 22.4228 7.39421 22.0489 6.75918C21.6737 6.12201 21.1585 5.65164 20.4895 5.20491C19.8438 4.77371 19.0076 4.33487 17.9626 3.7865L15.8951 2.70154C15.0437 2.25472 14.3599 1.89589 13.7712 1.65242C13.1616 1.40029 12.6047 1.25 12 1.25ZM8.7708 4.04608C9.66052 3.57917 10.284 3.2528 10.802 3.03856C11.3062 2.83004 11.6605 2.75 12 2.75C12.3395 2.75 12.6938 2.83004 13.198 3.03856C13.716 3.2528 14.3395 3.57917 15.2292 4.04608L17.2292 5.09563C18.3189 5.66748 19.0845 6.07032 19.6565 6.45232C19.9387 6.64078 20.1604 6.81578 20.3395 6.99174L17.0088 8.65708L8.50895 4.18349L8.7708 4.04608ZM6.94466 5.00439L6.7708 5.09563C5.68111 5.66747 4.91553 6.07032 4.34352 6.45232C4.06131 6.64078 3.83956 6.81578 3.66054 6.99174L12 11.1615L15.3572 9.48289L7.15069 5.16369C7.07096 5.12173 7.00191 5.06743 6.94466 5.00439ZM2.93768 8.30737C2.88718 8.52125 2.84901 8.76413 2.82106 9.04778C2.75084 9.7606 2.75 10.6644 2.75 11.9415V12.0585C2.75 13.3356 2.75084 14.2394 2.82106 14.9522C2.88974 15.6494 3.02022 16.1002 3.24367 16.4797C3.46587 16.857 3.78727 17.1762 4.34352 17.5477C4.91553 17.9297 5.68111 18.3325 6.7708 18.9044L8.7708 19.9539C9.66052 20.4208 10.284 20.7472 10.802 20.9614C10.9656 21.0291 11.1134 21.0832 11.25 21.1255V12.4635L2.93768 8.30737ZM12.75 21.1255C12.8866 21.0832 13.0344 21.0291 13.198 20.9614C13.716 20.7472 14.3395 20.4208 15.2292 19.9539L17.2292 18.9044C18.3189 18.3325 19.0845 17.9297 19.6565 17.5477C20.2127 17.1762 20.5341 16.857 20.7563 16.4797C20.9798 16.1002 21.1103 15.6494 21.1789 14.9522C21.2492 14.2394 21.25 13.3356 21.25 12.0585V11.9415C21.25 10.6644 21.2492 9.7606 21.1789 9.04778C21.151 8.76412 21.1128 8.52125 21.0623 8.30736L17.75 9.96352V13C17.75 13.4142 17.4142 13.75 17 13.75C16.5858 13.75 16.25 13.4142 16.25 13V10.7135L12.75 12.4635V21.1255Z" fill="currentColor"/>',
         'variables' => '<path d="M16.96 6.17004C18.96 7.56004 20.34 9.77004 20.62 12.32" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M3.48999 12.37C3.74999 9.82997 5.10999 7.61997 7.08999 6.21997" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M8.19 20.9399C9.35 21.5299 10.67 21.8599 12.06 21.8599C13.4 21.8599 14.66 21.5599 15.79 21.0099" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M12.06 7.70001C13.5954 7.70001 14.84 6.45537 14.84 4.92001C14.84 3.38466 13.5954 2.14001 12.06 2.14001C10.5247 2.14001 9.28003 3.38466 9.28003 4.92001C9.28003 6.45537 10.5247 7.70001 12.06 7.70001Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M4.82999 19.92C6.36534 19.92 7.60999 18.6753 7.60999 17.14C7.60999 15.6046 6.36534 14.36 4.82999 14.36C3.29464 14.36 2.04999 15.6046 2.04999 17.14C2.04999 18.6753 3.29464 19.92 4.82999 19.92Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M19.17 19.92C20.7054 19.92 21.95 18.6753 21.95 17.14C21.95 15.6046 20.7054 14.36 19.17 14.36C17.6347 14.36 16.39 15.6046 16.39 17.14C16.39 18.6753 17.6347 19.92 19.17 19.92Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
         'notifications' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C7.71983 1.25 4.25004 4.71979 4.25004 9V9.7041C4.25004 10.401 4.04375 11.0824 3.65717 11.6622L2.50856 13.3851C1.17547 15.3848 2.19318 18.1028 4.51177 18.7351C5.26738 18.9412 6.02937 19.1155 6.79578 19.2581L6.79768 19.2632C7.56667 21.3151 9.62198 22.75 12 22.75C14.378 22.75 16.4333 21.3151 17.2023 19.2632L17.2042 19.2581C17.9706 19.1155 18.7327 18.9412 19.4883 18.7351C21.8069 18.1028 22.8246 15.3848 21.4915 13.3851L20.3429 11.6622C19.9563 11.0824 19.75 10.401 19.75 9.7041V9C19.75 4.71979 16.2802 1.25 12 1.25ZM15.3764 19.537C13.1335 19.805 10.8664 19.8049 8.62349 19.5369C9.33444 20.5585 10.571 21.25 12 21.25C13.4289 21.25 14.6655 20.5585 15.3764 19.537ZM5.75004 9C5.75004 5.54822 8.54826 2.75 12 2.75C15.4518 2.75 18.25 5.54822 18.25 9V9.7041C18.25 10.6972 18.544 11.668 19.0948 12.4943L20.2434 14.2172C21.0086 15.3649 20.4245 16.925 19.0936 17.288C14.4494 18.5546 9.5507 18.5546 4.90644 17.288C3.57561 16.925 2.99147 15.3649 3.75664 14.2172L4.90524 12.4943C5.45609 11.668 5.75004 10.6972 5.75004 9.7041V9Z" fill="currentColor"/>',
+        'webhook' => '<g stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M18 16.98h-5.99c-1.1 0-1.95.94-2.48 1.9A4 4 0 0 1 2 17c.01-.7.2-1.4.57-2"/><path d="m6 17 3.13-5.78c.53-.97.1-2.18-.5-3.1a4 4 0 1 1 6.89-4.06"/><path d="m12 6 3.13 5.73C15.66 12.7 16.9 13 18 13a4 4 0 0 1 0 8"/></g>',
         'keys' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M15.6809 5.34814C14.0521 5.34814 12.7265 6.66395 12.7265 8.29353C12.7265 9.92311 14.0521 11.2389 15.6809 11.2389C17.3097 11.2389 18.6353 9.92311 18.6353 8.29353C18.6353 6.66395 17.3097 5.34814 15.6809 5.34814ZM14.2265 8.29353C14.2265 7.49816 14.8748 6.84814 15.6809 6.84814C16.487 6.84814 17.1353 7.49816 17.1353 8.29353C17.1353 9.0889 16.487 9.73891 15.6809 9.73891C14.8748 9.73891 14.2265 9.0889 14.2265 8.29353Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M9.52998 20.8783C9.86298 20.414 9.97017 19.9429 9.96222 19.5233C10.3544 19.6387 10.7424 19.6533 11.1141 19.5828C11.8825 19.437 12.4511 18.9512 12.7527 18.5507L12.758 18.5437L12.7631 18.5366C13.2883 17.8043 13.2872 17.0543 13.1586 16.5164C13.0956 16.2528 13.0021 16.0361 12.9245 15.8846C12.8853 15.8081 12.849 15.746 12.8207 15.7005C12.8132 15.6885 12.8063 15.6775 12.7999 15.6677C12.7112 15.5021 12.6111 15.3719 12.5269 15.2737L12.5359 15.2647L13.0001 14.8024C13.3817 14.9849 13.7957 15.0999 14.1583 15.1749C14.744 15.2962 15.3171 15.3369 15.6807 15.3369C19.582 15.3369 22.75 12.1863 22.75 8.29344C22.75 4.40056 19.582 1.25 15.6807 1.25C11.7794 1.25 8.61144 4.40056 8.61144 8.29344C8.61144 9.2105 8.82018 9.99588 9.02588 10.549C9.07825 10.6898 9.13081 10.8166 9.18035 10.9279L1.92511 18.1535C1.66869 18.4089 1.36789 18.853 1.27697 19.4092C1.17837 20.0124 1.34031 20.6829 1.92511 21.2654L2.80687 22.1435C2.82046 22.1571 2.83457 22.1701 2.84916 22.1825C3.10385 22.3999 3.53164 22.6513 4.04572 22.7273C4.59712 22.8088 5.23527 22.6818 5.77579 22.1435L6.34232 21.5793C6.87523 21.8849 7.43853 21.9545 7.95941 21.8548C8.63497 21.7254 9.19686 21.321 9.51964 20.8924L9.5249 20.8854L9.52998 20.8783ZM10.1114 8.29344C10.1114 5.23477 12.602 2.75 15.6807 2.75C18.7594 2.75 21.25 5.23477 21.25 8.29344C21.25 11.3521 18.7594 13.8369 15.6807 13.8369C15.4075 13.8369 14.9372 13.8044 14.4623 13.7061C13.9654 13.6032 13.5752 13.4504 13.3674 13.2779C13.0699 13.031 12.6332 13.0508 12.3592 13.3237L11.4774 14.2019C11.2757 14.4028 11.0818 14.6305 10.9794 14.8933C10.8499 15.2261 10.8912 15.5463 11.0394 15.8121C11.1273 15.9697 11.2689 16.1202 11.3278 16.183L11.3476 16.2042C11.4173 16.2811 11.4555 16.3314 11.4834 16.387L11.5098 16.4397L11.54 16.4817L11.5468 16.4924C11.5558 16.507 11.5712 16.533 11.5895 16.5685C11.6267 16.6412 11.6709 16.7445 11.6997 16.8652C11.7544 17.0937 11.7538 17.3656 11.5494 17.6551C11.4087 17.8384 11.1424 18.0506 10.8345 18.1091C10.5769 18.1579 10.1571 18.1261 9.59673 17.5681C9.30409 17.2766 8.83089 17.2766 8.53825 17.5681L8.24433 17.8608C7.96748 18.1365 7.94891 18.5782 8.20054 18.8761C8.20194 18.8778 8.2058 18.8826 8.2116 18.8903C8.22363 18.9062 8.24339 18.9336 8.2668 18.9704C8.31483 19.0461 8.37128 19.1508 8.41138 19.2706C8.48694 19.4963 8.49882 19.7374 8.31639 19.9966C8.19643 20.1519 7.95303 20.3287 7.67726 20.3815C7.4429 20.4264 7.14284 20.3931 6.8045 20.0562C6.51186 19.7647 6.03866 19.7647 5.74602 20.0562L4.7173 21.0807C4.55241 21.2449 4.4068 21.2643 4.26505 21.2434C4.09729 21.2186 3.93333 21.1293 3.84077 21.0562L2.9836 20.2025C2.74543 19.9653 2.73591 19.7821 2.75733 19.6511C2.78643 19.4731 2.89711 19.3025 2.9836 19.2163L10.6279 11.6033C10.8747 11.3575 10.9185 10.9735 10.7333 10.6784L10.7311 10.6748C10.7284 10.6703 10.7232 10.6615 10.7158 10.6487C10.7012 10.6231 10.6781 10.5814 10.6494 10.5251C10.5918 10.4123 10.5122 10.2423 10.4318 10.0262C10.2701 9.59135 10.1114 8.98632 10.1114 8.29344ZM8.20054 18.8761C8.20192 18.8777 8.2033 18.8793 8.20469 18.881L8.20354 18.8796L8.20054 18.8761Z" fill="currentColor"/>',
         'tags' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M11.2383 2.79888C10.6243 2.88003 9.86602 3.0542 8.7874 3.30311L7.55922 3.58654C6.6482 3.79677 6.02082 3.94252 5.54162 4.10698C5.07899 4.26576 4.81727 4.42228 4.61978 4.61978C4.42228 4.81727 4.26576 5.07899 4.10698 5.54162C3.94252 6.02082 3.79677 6.6482 3.58654 7.55922L3.30311 8.7874C3.0542 9.86602 2.88003 10.6243 2.79888 11.2383C2.71982 11.8365 2.73805 12.2413 2.84358 12.6092C2.94911 12.9772 3.14817 13.3301 3.53226 13.7954C3.92651 14.2731 4.47607 14.8238 5.25882 15.6066L7.08845 17.4362C8.44794 18.7957 9.41533 19.7608 10.247 20.3954C11.0614 21.0167 11.6569 21.25 12.2623 21.25C12.8678 21.25 13.4633 21.0167 14.2776 20.3954C15.1093 19.7608 16.0767 18.7957 17.4362 17.4362C18.7957 16.0767 19.7608 15.1093 20.3954 14.2776C21.0167 13.4633 21.25 12.8678 21.25 12.2623C21.25 11.6569 21.0167 11.0614 20.3954 10.247C19.7608 9.41533 18.7957 8.44794 17.4362 7.08845L15.6066 5.25882C14.8238 4.47607 14.2731 3.92651 13.7954 3.53226C13.3301 3.14817 12.9772 2.94911 12.6092 2.84358C12.2413 2.73805 11.8365 2.71982 11.2383 2.79888ZM11.0418 1.31181C11.7591 1.21701 12.3881 1.21969 13.0227 1.4017C13.6574 1.58372 14.1922 1.91482 14.7502 2.37538C15.2897 2.82061 15.8905 3.4214 16.641 4.17197L18.5368 6.06774C19.8474 7.37835 20.8851 8.41598 21.5879 9.33714C22.311 10.2849 22.75 11.197 22.75 12.2623C22.75 13.3276 22.311 14.2397 21.5879 15.1875C20.8851 16.1087 19.8474 17.1463 18.5368 18.4569L18.4569 18.5368C17.1463 19.8474 16.1087 20.8851 15.1875 21.5879C14.2397 22.311 13.3276 22.75 12.2623 22.75C11.197 22.75 10.2849 22.311 9.33714 21.5879C8.41598 20.8851 7.37833 19.8474 6.06771 18.5368L4.17196 16.641C3.4214 15.8905 2.82061 15.2897 2.37538 14.7502C1.91482 14.1922 1.58372 13.6574 1.4017 13.0227C1.21969 12.3881 1.21701 11.7591 1.31181 11.0418C1.40345 10.3484 1.59451 9.52048 1.83319 8.48622L2.13385 7.18334C2.33302 6.32023 2.49543 5.61639 2.68821 5.05469C2.88955 4.46806 3.14313 3.9751 3.55912 3.55912C3.9751 3.14313 4.46806 2.88955 5.05469 2.68821C5.61639 2.49543 6.32023 2.33302 7.18335 2.13385L8.48622 1.83319C9.52047 1.59451 10.3484 1.40345 11.0418 1.31181ZM9.49094 7.99514C9.00278 7.50699 8.21133 7.50699 7.72317 7.99514C7.23502 8.4833 7.23502 9.27476 7.72317 9.76291C8.21133 10.2511 9.00278 10.2511 9.49094 9.76291C9.97909 9.27476 9.97909 8.4833 9.49094 7.99514ZM6.66251 6.93448C7.73645 5.86054 9.47766 5.86054 10.5516 6.93448C11.6255 8.00843 11.6255 9.74963 10.5516 10.8236C9.47766 11.8975 7.73645 11.8975 6.66251 10.8236C5.58857 9.74963 5.58857 8.00843 6.66251 6.93448ZM19.0511 10.9902C19.344 11.2831 19.344 11.7579 19.0511 12.0508L12.0721 19.0301C11.7792 19.323 11.3043 19.323 11.0114 19.0301C10.7185 18.7372 10.7185 18.2623 11.0114 17.9694L17.9904 10.9902C18.2833 10.6973 18.7582 10.6973 19.0511 10.9902Z" fill="currentColor"/>',
         'time-back' => '<path d="M12 2.75C9.91677 2.75 7.99633 3.43778 6.45042 4.59896C5.82246 5.07064 5.11166 5.77778 4.48433 6.50232C4.26205 6.75904 4.0557 7.01164 3.87142 7.25H7.5C7.91421 7.25 8.25 7.58579 8.25 8C8.25 8.41421 7.91421 8.75 7.5 8.75H2.47183C2.46206 8.75019 2.45227 8.75019 2.44247 8.75H2C1.58579 8.75 1.25 8.41421 1.25 8V2.5C1.25 2.08579 1.58579 1.75 2 1.75C2.41421 1.75 2.75 2.08579 2.75 2.5L2.75 6.24861C2.93794 6.00859 3.14013 5.76324 3.35033 5.52046C4.01529 4.75246 4.80449 3.95925 5.54955 3.39961C7.3463 2.05002 9.58081 1.25 12 1.25C17.9371 1.25 22.75 6.06294 22.75 12C22.75 17.9371 17.9371 22.75 12 22.75C7.18541 22.75 3.11189 19.5854 1.74227 15.2247C1.61816 14.8296 1.83789 14.4086 2.23307 14.2845C2.62825 14.1603 3.04923 14.3801 3.17335 14.7753C4.35226 18.5288 7.85932 21.25 12 21.25C17.1086 21.25 21.25 17.1086 21.25 12C21.25 6.89137 17.1086 2.75 12 2.75Z" fill="currentColor"/><path d="M12.75 7C12.75 6.58579 12.4142 6.25 12 6.25C11.5858 6.25 11.25 6.58579 11.25 7V12C11.25 12.2586 11.3832 12.4989 11.6025 12.636L14.8025 14.636C15.1538 14.8555 15.6165 14.7488 15.836 14.3975C16.0555 14.0462 15.9488 13.5835 15.5975 13.364L12.75 11.5843V7Z" fill="currentColor"/>',
@@ -55,17 +59,21 @@
         'unordered-list' => '<g transform="scale(1.33333)"><circle cx="3.75" cy="5.25" r="2" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></circle><circle cx="3.75" cy="12.75" r="2" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></circle><line x1="8.75" y1="5.25" x2="16.25" y2="5.25" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line><line x1="8.75" y1="12.75" x2="16.25" y2="12.75" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line></g>',
         'file' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M12.25 2.83422C11.7896 2.75598 11.162 2.75005 10.0298 2.75005C8.11311 2.75005 6.75075 2.75163 5.71785 2.88987C4.70596 3.0253 4.12453 3.27933 3.7019 3.70195C3.27869 4.12516 3.02502 4.70481 2.88976 5.7109C2.75159 6.73856 2.75 8.09323 2.75 10.0001V14.0001C2.75 15.9069 2.75159 17.2615 2.88976 18.2892C3.02502 19.2953 3.27869 19.8749 3.7019 20.2981C4.12511 20.7214 4.70476 20.975 5.71085 21.1103C6.73851 21.2485 8.09318 21.2501 10 21.2501H14C15.9068 21.2501 17.2615 21.2485 18.2892 21.1103C19.2952 20.975 19.8749 20.7214 20.2981 20.2981C20.7213 19.8749 20.975 19.2953 21.1102 18.2892C21.2484 17.2615 21.25 15.9069 21.25 14.0001V13.5629C21.25 12.0269 21.2392 11.2988 21.0762 10.7501H17.9463C16.8135 10.7501 15.8877 10.7501 15.1569 10.6518C14.3929 10.5491 13.7306 10.3268 13.2019 9.79815C12.6732 9.26945 12.4509 8.60712 12.3482 7.84317C12.25 7.1123 12.25 6.18657 12.25 5.05374V2.83422ZM13.75 3.6095V5.00005C13.75 6.19976 13.7516 7.0241 13.8348 7.64329C13.9152 8.24091 14.059 8.53395 14.2626 8.73749C14.4661 8.94103 14.7591 9.08486 15.3568 9.16521C15.976 9.24846 16.8003 9.25005 18 9.25005H20.0195C19.723 8.9625 19.3432 8.61797 18.85 8.17407L14.8912 4.61117C14.4058 4.17433 14.0446 3.85187 13.75 3.6095ZM10.1755 1.25002C11.5601 1.24965 12.4546 1.24942 13.2779 1.56535C14.1012 1.88129 14.7632 2.47735 15.7873 3.39955C15.8226 3.43139 15.8584 3.46361 15.8947 3.49623L19.8534 7.05912C19.8956 7.09705 19.9372 7.1345 19.9783 7.17149C21.162 8.23614 21.9274 8.92458 22.3391 9.84902C22.7508 10.7734 22.7505 11.8029 22.75 13.3949C22.75 13.4502 22.75 13.5062 22.75 13.5629V14.0565C22.75 15.8942 22.75 17.3499 22.5969 18.4891C22.4392 19.6615 22.1071 20.6104 21.3588 21.3588C20.6104 22.1072 19.6614 22.4393 18.489 22.5969C17.3498 22.7501 15.8942 22.7501 14.0564 22.7501H9.94359C8.10583 22.7501 6.65019 22.7501 5.51098 22.5969C4.33856 22.4393 3.38961 22.1072 2.64124 21.3588C1.89288 20.6104 1.56076 19.6615 1.40314 18.4891C1.24997 17.3499 1.24998 15.8942 1.25 14.0565V9.94363C1.24998 8.10587 1.24997 6.65024 1.40314 5.51103C1.56076 4.33861 1.89288 3.38966 2.64124 2.64129C3.39019 1.89235 4.34232 1.56059 5.51887 1.40313C6.66283 1.25002 8.1257 1.25003 9.97352 1.25005L10.0298 1.25005C10.0789 1.25005 10.1275 1.25004 10.1755 1.25002Z" fill="currentColor"/>',
         'file-content' => '<g transform="scale(1.33333)"><line x1="5.75" y1="6.75" x2="7.75" y2="6.75" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line><line x1="5.75" y1="9.75" x2="12.25" y2="9.75" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line><line x1="5.75" y1="12.75" x2="12.25" y2="12.75" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line><path d="M2.75,14.25V3.75c0-1.105,.895-2,2-2h5.586c.265,0,.52,.105,.707,.293l3.914,3.914c.188,.188,.293,.442,.293,.707v7.586c0,1.105-.895,2-2,2H4.75c-1.105,0-2-.895-2-2Z" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></path><path d="M15.16,6.25h-3.41c-.552,0-1-.448-1-1V1.852" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></path></g>',
+        'folder-filled' => '<path d="M2 6.5A2.5 2.5 0 0 1 4.5 4h4.38c.53 0 1.04.21 1.42.59L11.7 6h7.8A2.5 2.5 0 0 1 22 8.5v9a2.5 2.5 0 0 1-2.5 2.5h-15A2.5 2.5 0 0 1 2 17.5v-11Z" fill="currentColor"/>',
         'folder' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M6.85929 1.25001C6.88904 1.25001 6.91919 1.25002 6.94976 1.25002L6.98675 1.25001C7.33818 1.24999 7.56433 1.24998 7.78542 1.27065C8.7367 1.35961 9.63905 1.73337 10.3746 2.34313C10.5456 2.48485 10.7055 2.64477 10.954 2.89329L11.5303 3.46969C12.3761 4.3154 12.7012 4.6311 13.0768 4.84005C13.2948 4.96134 13.526 5.05713 13.766 5.12552C14.1793 5.24333 14.6324 5.25002 15.8284 5.25002L16.253 5.25002C17.526 5.25 18.5521 5.24998 19.364 5.35206C20.2054 5.45784 20.9204 5.68358 21.5077 6.21185C21.6061 6.30032 21.6997 6.39394 21.7882 6.49231C22.3165 7.07965 22.5422 7.79459 22.648 8.63601C22.75 9.4479 22.75 10.4741 22.75 11.747V14.0564C22.75 15.8942 22.75 17.3498 22.5969 18.489C22.4393 19.6615 22.1071 20.6104 21.3588 21.3588C20.6104 22.1071 19.6615 22.4393 18.489 22.5969C17.3498 22.75 15.8942 22.75 14.0564 22.75H9.94361C8.10584 22.75 6.65021 22.75 5.51099 22.5969C4.33857 22.4393 3.38962 22.1071 2.64126 21.3588C1.8929 20.6104 1.56078 19.6615 1.40315 18.489C1.24999 17.3498 1.25 15.8942 1.25002 14.0564L1.25002 6.94976C1.25002 6.91919 1.25001 6.88904 1.25001 6.85929C1.2499 6.06338 1.24982 5.55685 1.33237 5.11935C1.6949 3.19788 3.19788 1.6949 5.11935 1.33237C5.55685 1.24982 6.06338 1.2499 6.85929 1.25001ZM6.94976 2.75002C6.03312 2.75002 5.67873 2.75329 5.39746 2.80636C4.08277 3.05441 3.05441 4.08277 2.80636 5.39746C2.75329 5.67873 2.75002 6.03312 2.75002 6.94976V14C2.75002 15.9068 2.75161 17.2615 2.88978 18.2892C3.02504 19.2953 3.27871 19.8749 3.70192 20.2981C4.12513 20.7213 4.70478 20.975 5.71087 21.1103C6.73853 21.2484 8.0932 21.25 10 21.25H14C15.9068 21.25 17.2615 21.2484 18.2892 21.1103C19.2953 20.975 19.8749 20.7213 20.2981 20.2981C20.7213 19.8749 20.975 19.2953 21.1103 18.2892C21.2484 17.2615 21.25 15.9068 21.25 14V11.7979C21.25 10.4621 21.2486 9.5305 21.1597 8.82312C21.0731 8.13448 20.9141 7.76356 20.6729 7.49539C20.6198 7.43637 20.5637 7.3802 20.5046 7.32712C20.2365 7.08592 19.8656 6.92692 19.1769 6.84034C18.4695 6.75141 17.538 6.75002 16.2021 6.75002H15.8284C15.7912 6.75002 15.7545 6.75002 15.7182 6.75003C14.6702 6.75025 13.9944 6.75038 13.3548 6.56806C13.0041 6.46811 12.6661 6.32811 12.3475 6.15083C11.7663 5.82747 11.2885 5.3495 10.5476 4.60833C10.522 4.58265 10.496 4.55666 10.4697 4.53035L9.91943 3.98009C9.63616 3.69682 9.52778 3.58951 9.41731 3.49793C8.91403 3.08073 8.29664 2.825 7.64576 2.76413C7.50289 2.75077 7.35038 2.75002 6.94976 2.75002ZM12.25 10C12.25 9.5858 12.5858 9.25002 13 9.25002H18C18.4142 9.25002 18.75 9.5858 18.75 10C18.75 10.4142 18.4142 10.75 18 10.75H13C12.5858 10.75 12.25 10.4142 12.25 10Z" fill="currentColor"/>',
         'alert-triangle' => '<path d="M12 7.25C12.4142 7.25 12.75 7.58579 12.75 8V13C12.75 13.4142 12.4142 13.75 12 13.75C11.5858 13.75 11.25 13.4142 11.25 13V8C11.25 7.58579 11.5858 7.25 12 7.25Z" fill="currentColor"/><path d="M12 17C12.5523 17 13 16.5523 13 16C13 15.4477 12.5523 15 12 15C11.4477 15 11 15.4477 11 16C11 16.5523 11.4477 17 12 17Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M8.2944 4.47643C9.36631 3.11493 10.5018 2.25 12 2.25C13.4981 2.25 14.6336 3.11493 15.7056 4.47643C16.7598 5.81544 17.8769 7.79622 19.3063 10.3305L19.7418 11.1027C20.9234 13.1976 21.8566 14.8523 22.3468 16.1804C22.8478 17.5376 22.9668 18.7699 22.209 19.8569C21.4736 20.9118 20.2466 21.3434 18.6991 21.5471C17.1576 21.75 15.0845 21.75 12.4248 21.75H11.5752C8.91552 21.75 6.84239 21.75 5.30082 21.5471C3.75331 21.3434 2.52637 20.9118 1.79099 19.8569C1.03318 18.7699 1.15218 17.5376 1.65314 16.1804C2.14334 14.8523 3.07658 13.1977 4.25818 11.1027L4.69361 10.3307C6.123 7.79629 7.24019 5.81547 8.2944 4.47643ZM9.47297 5.40432C8.49896 6.64148 7.43704 8.51988 5.96495 11.1299L5.60129 11.7747C4.37507 13.9488 3.50368 15.4986 3.06034 16.6998C2.6227 17.8855 2.68338 18.5141 3.02148 18.9991C3.38202 19.5163 4.05873 19.8706 5.49659 20.0599C6.92858 20.2484 8.9026 20.25 11.6363 20.25H12.3636C15.0974 20.25 17.0714 20.2484 18.5034 20.0599C19.9412 19.8706 20.6179 19.5163 20.9785 18.9991C21.3166 18.5141 21.3773 17.8855 20.9396 16.6998C20.4963 15.4986 19.6249 13.9488 18.3987 11.7747L18.035 11.1299C16.5629 8.51987 15.501 6.64148 14.527 5.40431C13.562 4.17865 12.8126 3.75 12 3.75C11.1874 3.75 10.4379 4.17865 9.47297 5.40432Z" fill="currentColor"/>',
         'alert-circle' => '<path d="M12 6.25C12.4142 6.25 12.75 6.58579 12.75 7V13C12.75 13.4142 12.4142 13.75 12 13.75C11.5858 13.75 11.25 13.4142 11.25 13V7C11.25 6.58579 11.5858 6.25 12 6.25Z" fill="currentColor"/><path d="M12 17C12.5523 17 13 16.5523 13 16C13 15.4477 12.5523 15 12 15C11.4477 15 11 15.4477 11 16C11 16.5523 11.4477 17 12 17Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M1.25 12C1.25 6.06294 6.06294 1.25 12 1.25C17.9371 1.25 22.75 6.06294 22.75 12C22.75 17.9371 17.9371 22.75 12 22.75C6.06294 22.75 1.25 17.9371 1.25 12ZM12 2.75C6.89137 2.75 2.75 6.89137 2.75 12C2.75 17.1086 6.89137 21.25 12 21.25C17.1086 21.25 21.25 17.1086 21.25 12C21.25 6.89137 17.1086 2.75 12 2.75Z" fill="currentColor"/>',
         'check-circle' => '<path d="M16.0303 10.0303C16.3232 9.73744 16.3232 9.26256 16.0303 8.96967C15.7374 8.67678 15.2626 8.67678 14.9697 8.96967L10.5 13.4393L9.03033 11.9697C8.73744 11.6768 8.26256 11.6768 7.96967 11.9697C7.67678 12.2626 7.67678 12.7374 7.96967 13.0303L9.96967 15.0303C10.2626 15.3232 10.7374 15.3232 11.0303 15.0303L16.0303 10.0303Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C6.06294 1.25 1.25 6.06294 1.25 12C1.25 17.9371 6.06294 22.75 12 22.75C17.9371 22.75 22.75 17.9371 22.75 12C22.75 6.06294 17.9371 1.25 12 1.25ZM2.75 12C2.75 6.89137 6.89137 2.75 12 2.75C17.1086 2.75 21.25 6.89137 21.25 12C21.25 17.1086 17.1086 21.25 12 21.25C6.89137 21.25 2.75 17.1086 2.75 12Z" fill="currentColor"/>',
         'info-circle' => '<path d="M12 17.75C12.4142 17.75 12.75 17.4142 12.75 17V11C12.75 10.5858 12.4142 10.25 12 10.25C11.5858 10.25 11.25 10.5858 11.25 11V17C11.25 17.4142 11.5858 17.75 12 17.75Z" fill="currentColor"/><path d="M12 7C12.5523 7 13 7.44772 13 8C13 8.55228 12.5523 9 12 9C11.4477 9 11 8.55228 11 8C11 7.44772 11.4477 7 12 7Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M1.25 12C1.25 6.06294 6.06294 1.25 12 1.25C17.9371 1.25 22.75 6.06294 22.75 12C22.75 17.9371 17.9371 22.75 12 22.75C6.06294 22.75 1.25 17.9371 1.25 12ZM12 2.75C6.89137 2.75 2.75 6.89137 2.75 12C2.75 17.1086 6.89137 21.25 12 21.25C17.1086 21.25 21.25 17.1086 21.25 12C21.25 6.89137 17.1086 2.75 12 2.75Z" fill="currentColor"/>',
         'arrow-right' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M13.4697 5.46967C13.7626 5.17678 14.2374 5.17678 14.5303 5.46967L20.5303 11.4697C20.8232 11.7626 20.8232 12.2374 20.5303 12.5303L14.5303 18.5303C14.2374 18.8232 13.7626 18.8232 13.4697 18.5303C13.1768 18.2374 13.1768 17.7626 13.4697 17.4697L18.1893 12.75H4C3.58579 12.75 3.25 12.4142 3.25 12C3.25 11.5858 3.58579 11.25 4 11.25H18.1893L13.4697 6.53033C13.1768 6.23744 13.1768 5.76256 13.4697 5.46967Z" fill="currentColor"/>',
+        'edit' => '<path d="M11 2H9C4 2 2 4 2 9V15C2 20 4 22 9 22H15C20 22 22 20 22 15V13" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M16.04 3.02001L8.16 10.9C7.86 11.2 7.56 11.79 7.5 12.22L7.07 15.23C6.91 16.32 7.68 17.08 8.77 16.93L11.78 16.5C12.2 16.44 12.79 16.14 13.1 15.84L20.98 7.96001C22.34 6.60001 22.98 5.02001 20.98 3.02001C18.98 1.02001 17.4 1.66001 16.04 3.02001Z" stroke="currentColor" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/><path d="M14.91 4.1499C15.58 6.5399 17.45 8.4099 19.85 9.0899" stroke="currentColor" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>',
+        'download' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C12.4142 1.25 12.75 1.58579 12.75 2V12.9726L14.4306 11.0119C14.7001 10.6974 15.1736 10.661 15.4881 10.9306C15.8026 11.2001 15.839 11.6736 15.5694 11.9881L12.5694 15.4881C12.427 15.6543 12.2189 15.75 12 15.75C11.7811 15.75 11.573 15.6543 11.4306 15.4881L8.43056 11.9881C8.16099 11.6736 8.19741 11.2001 8.51191 10.9306C8.8264 10.661 9.29988 10.6974 9.56944 11.0119L11.25 12.9726V2C11.25 1.58579 11.5858 1.25 12 1.25ZM6.99583 8.25196C7.41003 8.24966 7.74768 8.58357 7.74999 8.99778C7.7523 9.41199 7.41838 9.74964 7.00418 9.75194C5.91068 9.75803 5.1356 9.78643 4.54735 9.89448C3.98054 9.99859 3.65246 10.1658 3.40901 10.4092C3.13225 10.686 2.9518 11.0746 2.85315 11.8083C2.75159 12.5637 2.75 13.5648 2.75 15.0002V16.0002C2.75 17.4356 2.75159 18.4367 2.85315 19.1921C2.9518 19.9259 3.13225 20.3144 3.40901 20.5912C3.68577 20.868 4.07435 21.0484 4.80812 21.1471C5.56347 21.2486 6.56458 21.2502 8 21.2502H16C17.4354 21.2502 18.4365 21.2486 19.1919 21.1471C19.9257 21.0484 20.3142 20.868 20.591 20.5912C20.8678 20.3144 21.0482 19.9259 21.1469 19.1921C21.2484 18.4367 21.25 17.4356 21.25 16.0002V15.0002C21.25 13.5648 21.2484 12.5637 21.1469 11.8083C21.0482 11.0746 20.8678 10.686 20.591 10.4092C20.3475 10.1658 20.0195 9.99859 19.4527 9.89448C18.8644 9.78643 18.0893 9.75803 16.9958 9.75194C16.5816 9.74964 16.2477 9.41199 16.25 8.99778C16.2523 8.58357 16.59 8.24966 17.0042 8.25196C18.0857 8.25799 18.9871 8.28387 19.7236 8.41916C20.4816 8.55839 21.1267 8.82364 21.6517 9.34857C22.2536 9.95048 22.5125 10.7084 22.6335 11.6085C22.75 12.4754 22.75 13.5778 22.75 14.9453V16.0551C22.75 17.4227 22.75 18.525 22.6335 19.392C22.5125 20.2921 22.2536 21.0499 21.6517 21.6519C21.0497 22.2538 20.2919 22.5127 19.3918 22.6337C18.5248 22.7503 17.4225 22.7502 16.0549 22.7502H7.94513C6.57754 22.7502 5.47522 22.7503 4.60825 22.6337C3.70814 22.5127 2.95027 22.2538 2.34835 21.6519C1.74643 21.0499 1.48754 20.2921 1.36652 19.392C1.24996 18.525 1.24998 17.4227 1.25 16.0551V14.9453C1.24998 13.5778 1.24996 12.4754 1.36652 11.6085C1.48754 10.7084 1.74643 9.95048 2.34835 9.34857C2.87328 8.82363 3.51835 8.55839 4.27635 8.41916C5.01291 8.28387 5.9143 8.25798 6.99583 8.25196Z" fill="currentColor"/>',
         'upload' => '<path d="M11.4697 3.46967C11.7626 3.17678 12.2374 3.17678 12.5303 3.46967L16.5303 7.46967C16.8232 7.76256 16.8232 8.23744 16.5303 8.53033C16.2374 8.82322 15.7626 8.82322 15.4697 8.53033L12.75 5.81066V14C12.75 14.4142 12.4142 14.75 12 14.75C11.5858 14.75 11.25 14.4142 11.25 14V5.81066L8.53033 8.53033C8.23744 8.82322 7.76256 8.82322 7.46967 8.53033C7.17678 8.23744 7.17678 7.76256 7.46967 7.46967L11.4697 3.46967Z" fill="currentColor"/><path d="M4 14.25C4.41421 14.25 4.75 14.5858 4.75 15V17C4.75 18.5188 5.98122 19.75 7.5 19.75H16.5C18.0188 19.75 19.25 18.5188 19.25 17V15C19.25 14.5858 19.5858 14.25 20 14.25C20.4142 14.25 20.75 14.5858 20.75 15V17C20.75 19.3472 18.8472 21.25 16.5 21.25H7.5C5.15279 21.25 3.25 19.3472 3.25 17V15C3.25 14.5858 3.58579 14.25 4 14.25Z" fill="currentColor"/>',
         'x' => '<path d="M18.4697 19.5303C18.7626 19.8232 19.2374 19.8232 19.5303 19.5303C19.8232 19.2374 19.8232 18.7626 19.5303 18.4697L13.0607 12L19.5303 5.53033C19.8232 5.23744 19.8232 4.76256 19.5303 4.46967C19.2374 4.17678 18.7626 4.17678 18.4697 4.46967L12 10.9393L5.53033 4.46967C5.23744 4.17678 4.76256 4.17678 4.46967 4.46967C4.17678 4.76256 4.17678 5.23744 4.46967 5.53033L10.9393 12L4.46967 18.4697C4.17678 18.7626 4.17678 19.2374 4.46967 19.5303C4.76256 19.8232 5.23744 19.8232 5.53033 19.5303L12 13.0607L18.4697 19.5303Z" fill="currentColor"/>',
         'check' => '<path d="M21.5303 5.46967C21.8232 5.76256 21.8232 6.23744 21.5303 6.53033L9.53033 18.5303C9.23744 18.8232 8.76256 18.8232 8.46967 18.5303L2.46967 12.5303C2.17678 12.2374 2.17678 11.7626 2.46967 11.4697C2.76256 11.1768 3.23744 11.1768 3.53033 11.4697L9 16.9393L20.4697 5.46967C20.7626 5.17678 21.2374 5.17678 21.5303 5.46967Z" fill="currentColor"/>',
         'copy' => '<path d="M8 8.75H6.5A2.25 2.25 0 0 0 4.25 11v6.5a2.25 2.25 0 0 0 2.25 2.25H13a2.25 2.25 0 0 0 2.25-2.25V16" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/><rect x="8.75" y="4.25" width="11" height="11" rx="2.25" stroke="currentColor" stroke-width="1.5"/>',
         'chevron-down' => '<polyline points="5 9 12 16 19 9" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></polyline>',
+        'dots-horizontal' => '<circle cx="5" cy="12" r="1.6" fill="currentColor"/><circle cx="12" cy="12" r="1.6" fill="currentColor"/><circle cx="19" cy="12" r="1.6" fill="currentColor"/>',
         'trash' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M15.0924 1.25H8.90788C7.33861 1.24998 6.08032 1.24996 5.10577 1.38767C4.09802 1.53007 3.25979 1.83575 2.64218 2.55292C2.02457 3.27008 1.84661 4.14438 1.85528 5.1621C1.86366 6.1463 2.05033 7.39066 2.28314 8.94256L3.49937 17.0508C3.67587 18.2275 3.81878 19.1804 4.02849 19.9262C4.24683 20.7027 4.56045 21.3453 5.13662 21.8415C5.71279 22.3377 6.39485 22.5525 7.19513 22.6533C7.96377 22.75 8.92732 22.75 10.1173 22.75H13.883C15.073 22.75 16.0365 22.75 16.8052 22.6533C17.6054 22.5525 18.2875 22.3377 18.8637 21.8415C19.4398 21.3453 19.7535 20.7027 19.9718 19.9262C20.1815 19.1805 20.3244 18.2276 20.5009 17.0509L21.7172 8.94253C21.95 7.39065 22.1366 6.14629 22.145 5.1621C22.1537 4.14438 21.9757 3.27008 21.3581 2.55292C20.7405 1.83575 19.9023 1.53007 18.8945 1.38767C17.92 1.24996 16.6617 1.24998 15.0924 1.25ZM3.77879 3.53175C4.05882 3.20658 4.47927 2.9911 5.31565 2.87292C6.17295 2.75177 7.32479 2.75 8.96727 2.75H15.033C16.6755 2.75 17.8273 2.75177 18.6846 2.87292C19.521 2.9911 19.9415 3.20658 20.2215 3.53175C20.5015 3.85692 20.6523 4.30468 20.6451 5.14933C20.6448 5.18248 20.6443 5.21604 20.6435 5.25H20.5005C20.5003 5.25 20.5007 5.25 20.5005 5.25H7.00045C7.00025 5.25 7.00065 5.25 7.00045 5.25H3.35678C3.35603 5.21603 3.35551 5.18248 3.35522 5.14933C3.34803 4.30468 3.49876 3.85692 3.77879 3.53175ZM5.18949 6.75H3.48546C3.53687 7.15852 3.60161 7.61096 3.67631 8.1155L3.75015 8.18934L5.18949 6.75ZM4.05013 10.6106L4.6686 14.7338L6.37599 12.9365L4.05013 10.6106ZM5.15659 17.9593C5.17275 18.0594 5.18872 18.1563 5.20463 18.25H5.39887L5.15659 17.9593ZM6.99527 19.75C6.99879 19.75 7.00232 19.75 7.00584 19.75H13.9972C13.9991 19.75 14.0009 19.75 14.0027 19.75H18.4577C18.299 20.2287 18.1176 20.5044 17.8848 20.7049C17.6171 20.9355 17.261 21.0841 16.6178 21.165C15.9538 21.2486 15.0849 21.25 13.833 21.25H10.1673C8.91538 21.25 8.04651 21.2486 7.38247 21.165C6.73934 21.0841 6.38321 20.9355 6.11546 20.7049C5.88266 20.5044 5.70127 20.2287 5.54256 19.75H6.99527ZM15.7131 18.25H18.1895L16.9018 16.9623L15.7131 18.25ZM19.0007 16.9399C19.0087 16.8869 19.0168 16.8332 19.0249 16.7788L19.404 14.2515L17.92 15.8592L19.0007 16.9399ZM19.856 11.2381L20.2249 8.77879C20.3197 8.14673 20.4033 7.5881 20.4704 7.09045L18.16 9.40079L19.856 11.2381ZM18.6895 6.75H15.7131L17.1418 8.2977L18.6895 6.75ZM12.2532 6.75H8.81081L10.5761 8.51531L12.2532 6.75ZM11.6895 18.25H9.31081L10.5002 17.0607L11.6895 18.25ZM7.40946 11.8486L4.81081 9.25L7.00015 7.06066L9.54266 9.60317L7.40946 11.8486ZM8.47047 12.9097L10.6037 10.6642L12.6895 12.75L10.5002 14.9393L8.47047 12.9097ZM11.5608 16L13.7502 13.8107L15.8403 15.9008L13.7385 18.1777L11.5608 16ZM14.8108 12.75L16.8585 14.7977L18.9795 12.5L17.0985 10.4623L14.8108 12.75ZM13.7502 11.6893L16.0803 9.35921L13.9923 7.09721L11.6371 9.57632L13.7502 11.6893ZM7.437 13.9975L9.43949 16L7.27782 18.1617L5.50363 16.0326L7.437 13.9975Z" fill="currentColor"/>',
         'external-link' => '<path d="M13 11L21.2 2.80005" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M22 6.8V2H17.2" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M11 2H9C4 2 2 4 2 9V15C2 20 4 22 9 22H15C20 22 22 20 22 15V13" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
         'server-update' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M9.94358 2.25H14.0564C15.8942 2.24998 17.3498 2.24997 18.489 2.40314C19.6614 2.56076 20.6104 2.89288 21.3588 3.64124C22.1071 4.38961 22.4392 5.33856 22.5969 6.51098C22.75 7.65019 22.75 9.10583 22.75 10.9436V13C22.75 13.4142 22.4142 13.75 22 13.75C21.5858 13.75 21.25 13.4142 21.25 13V12.75H2.75V13C2.75 14.9068 2.75159 16.2615 2.88976 17.2892C3.02502 18.2952 3.27869 18.8749 3.7019 19.2981C4.12511 19.7213 4.70476 19.975 5.71085 20.1102C6.73851 20.2484 8.09318 20.25 10 20.25H13C13.4142 20.25 13.75 20.5858 13.75 21C13.75 21.4142 13.4142 21.75 13 21.75H9.94359C8.10583 21.75 6.65019 21.75 5.51098 21.5969C4.33856 21.4392 3.38961 21.1071 2.64124 20.3588C1.89288 19.6104 1.56076 18.6614 1.40314 17.489C1.24997 16.3498 1.24998 14.8942 1.25 13.0564V10.9436C1.24998 9.10582 1.24997 7.65019 1.40314 6.51098C1.56076 5.33856 1.89288 4.38961 2.64124 3.64124C3.38961 2.89288 4.33856 2.56076 5.51098 2.40314C6.65019 2.24997 8.10582 2.24998 9.94358 2.25ZM2.75 11.25H21.25V11C21.25 9.09318 21.2484 7.73851 21.1102 6.71085C20.975 5.70476 20.7213 5.12511 20.2981 4.7019C19.8749 4.27869 19.2952 4.02502 18.2892 3.88976C17.2615 3.75159 15.9068 3.75 14 3.75H10C8.09318 3.75 6.73851 3.75159 5.71085 3.88976C4.70476 4.02502 4.12511 4.27869 3.7019 4.7019C3.27869 5.12511 3.02502 5.70476 2.88976 6.71085C2.75159 7.73851 2.75 9.09318 2.75 11V11.25ZM6 5.75C6.41421 5.75 6.75 6.08579 6.75 6.5V8.5C6.75 8.91421 6.41421 9.25 6 9.25C5.58579 9.25 5.25 8.91421 5.25 8.5V6.5C5.25 6.08579 5.58579 5.75 6 5.75ZM9 5.75C9.41421 5.75 9.75 6.08579 9.75 6.5V8.5C9.75 8.91421 9.41421 9.25 9 9.25C8.58579 9.25 8.25 8.91421 8.25 8.5V6.5C8.25 6.08579 8.58579 5.75 9 5.75ZM12.75 7.5C12.75 7.08579 13.0858 6.75 13.5 6.75H18C18.4142 6.75 18.75 7.08579 18.75 7.5C18.75 7.91421 18.4142 8.25 18 8.25H13.5C13.0858 8.25 12.75 7.91421 12.75 7.5ZM14.9286 16.7534C15.3176 15.2559 16.8529 14.25 18.5048 14.25C19.782 14.25 20.945 14.8304 21.6108 15.7648C21.8512 16.1021 21.7726 16.5704 21.4352 16.8108C21.0979 17.0512 20.6296 16.9726 20.3892 16.6352C20.0295 16.1304 19.3411 15.75 18.5048 15.75C17.5383 15.75 16.8181 16.2319 16.5056 16.8299C16.592 16.8734 16.6713 16.9343 16.738 17.0123C17.0074 17.327 16.9706 17.8004 16.656 18.0698L16.0718 18.5698C15.7911 18.8101 15.3772 18.8101 15.0964 18.5698L14.5123 18.0698C14.1976 17.8004 14.1609 17.327 14.4302 17.0123C14.5618 16.8586 14.742 16.7712 14.9286 16.7534ZM6 14.75C6.41421 14.75 6.75 15.0858 6.75 15.5V17.5C6.75 17.9142 6.41421 18.25 6 18.25C5.58579 18.25 5.25 17.9142 5.25 17.5V15.5C5.25 15.0858 5.58579 14.75 6 14.75ZM9 14.75C9.41421 14.75 9.75 15.0858 9.75 15.5V17.5C9.75 17.9142 9.41421 18.25 9 18.25C8.58579 18.25 8.25 17.9142 8.25 17.5V15.5C8.25 15.0858 8.58579 14.75 9 14.75ZM20.9282 17.4302C21.2089 17.1899 21.6228 17.1899 21.9036 17.4302L22.4877 17.9302C22.8024 18.1996 22.8391 18.673 22.5698 18.9877C22.4382 19.1414 22.258 19.2288 22.0714 19.2466C21.6824 20.7441 20.1471 21.75 18.4952 21.75C17.218 21.75 16.055 21.1696 15.3892 20.2352C15.1488 19.8979 15.2274 19.4296 15.5648 19.1892C15.9021 18.9488 16.3704 19.0274 16.6108 19.3648C16.9705 19.8696 17.6589 20.25 18.4952 20.25C19.4617 20.25 20.1819 19.7681 20.4944 19.1701C20.408 19.1266 20.3287 19.0657 20.262 18.9877C19.9926 18.673 20.0294 18.1996 20.344 17.9302L20.9282 17.4302Z" fill="currentColor"/>',
@@ -76,13 +84,17 @@
         'bandage' => '<path d="M9.34458 8.23084C9.03703 7.92329 8.53839 7.92329 8.23084 8.23084C7.92329 8.53839 7.92329 9.03703 8.23084 9.34458C8.53839 9.65213 9.03703 9.65213 9.34458 9.34458C9.65213 9.03703 9.65213 8.53839 9.34458 8.23084Z" fill="currentColor"/><path d="M12.1289 9.15895C11.8214 8.8514 11.3227 8.8514 11.0152 9.15895C10.7076 9.4665 10.7076 9.96514 11.0152 10.2727C11.3227 10.5802 11.8214 10.5802 12.1289 10.2727C12.4365 9.96514 12.4365 9.4665 12.1289 9.15895Z" fill="currentColor"/><path d="M15.8414 12.8714C16.1489 13.179 16.1489 13.6776 15.8414 13.9852C15.5338 14.2927 15.0352 14.2927 14.7277 13.9852C14.4201 13.6776 14.4201 13.179 14.7277 12.8714C15.0352 12.5639 15.5338 12.5639 15.8414 12.8714Z" fill="currentColor"/><path d="M16.7695 16.7695C17.0771 16.462 17.0771 15.9633 16.7695 15.6558C16.462 15.3482 15.9633 15.3482 15.6558 15.6558C15.3482 15.9633 15.3482 16.462 15.6558 16.7695C15.9633 17.0771 16.462 17.0771 16.7695 16.7695Z" fill="currentColor"/><path d="M13.057 13.057C13.3646 12.7495 13.3646 12.2509 13.057 11.9433C12.7495 11.6358 12.2509 11.6358 11.9433 11.9433C11.6358 12.2509 11.6358 12.7495 11.9433 13.057C12.2509 13.3646 12.7495 13.3646 13.057 13.057Z" fill="currentColor"/><path d="M13.9852 14.7277C14.2927 15.0352 14.2927 15.5338 13.9852 15.8414C13.6776 16.1489 13.179 16.1489 12.8714 15.8414C12.5639 15.5338 12.5639 15.0352 12.8714 14.7277C13.179 14.4201 13.6776 14.4201 13.9852 14.7277Z" fill="currentColor"/><path d="M9.15895 11.0152C9.4665 10.7076 9.96514 10.7076 10.2727 11.0152C10.5802 11.3227 10.5802 11.8214 10.2727 12.1289C9.96514 12.4365 9.4665 12.4365 9.15895 12.1289C8.8514 11.8214 8.8514 11.3227 9.15895 11.0152Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M14.3986 2.68287C16.3091 0.772375 19.4066 0.772376 21.3171 2.68287C23.2276 4.59337 23.2276 7.6909 21.3171 9.6014L18.9185 12L21.3171 14.3986C23.2276 16.3091 23.2276 19.4066 21.3171 21.3171C19.4066 23.2276 16.3091 23.2276 14.3986 21.3171L12 18.9185L9.6014 21.3171C7.6909 23.2276 4.59337 23.2276 2.68287 21.3171C0.772376 19.4066 0.772376 16.3091 2.68287 14.3986L5.08148 12L2.68287 9.6014C0.772376 7.6909 0.772375 4.59337 2.68287 2.68287C4.59337 0.772376 7.6909 0.772376 9.6014 2.68287L12 5.08148L14.3986 2.68287ZM20.2565 15.4593C21.5812 16.784 21.5812 18.9318 20.2565 20.2565C18.9318 21.5812 16.784 21.5812 15.4593 20.2565L3.74353 8.54074C2.41882 7.21603 2.41882 5.06824 3.74353 3.74353C5.06824 2.41882 7.21603 2.41882 8.54074 3.74353L20.2565 15.4593ZM20.2565 8.54074L17.8579 10.9393L13.0607 6.14214L15.4593 3.74353C16.784 2.41882 18.9318 2.41882 20.2565 3.74353C21.5812 5.06825 21.5812 7.21603 20.2565 8.54074ZM3.74353 15.4593L6.14214 13.0607L10.9393 17.8579L8.54074 20.2565C7.21603 21.5812 5.06825 21.5812 3.74353 20.2565C2.41882 18.9318 2.41882 16.784 3.74353 15.4593Z" fill="currentColor"/>',
         'broom' => '<g transform="scale(0.09375)"><path d="M235.29,216.7C212.86,205.69,200,182.12,200,152V134.69a15.94,15.94,0,0,0-10.09-14.87l-28.65-11.46A8,8,0,0,1,156.79,98l22.32-56.67C184,28.79,178,14.21,165.34,9.51a24,24,0,0,0-30.7,13.71L112.25,80.08a8,8,0,0,1-10.41,4.5L73.11,73.08a15.91,15.91,0,0,0-17.38,3.66C34.68,98.4,24,123.71,24,152a111.53,111.53,0,0,0,31.15,77.53A8.06,8.06,0,0,0,61,232H232a8,8,0,0,0,8-7.51A8.21,8.21,0,0,0,235.29,216.7ZM115.11,216a87.52,87.52,0,0,1-24.26-41.71,8.21,8.21,0,0,0-9.25-6.18A8,8,0,0,0,75.28,178a105.33,105.33,0,0,0,18.36,38H64.44A95.62,95.62,0,0,1,40,152a85.92,85.92,0,0,1,7.73-36.3l137.8,55.13c3,18.06,10.55,33.5,21.89,45.19Z" fill="currentColor"/></g>',
         'shield-star' => '<g transform="scale(0.09375)"><path d="M80.57,117A8,8,0,0,1,91,112.57l29,11.61V96a8,8,0,0,1,16,0v28.18l29-11.61A8,8,0,1,1,171,127.43l-30.31,12.12L158.4,163.2a8,8,0,1,1-12.8,9.6L128,149.33,110.4,172.8a8,8,0,1,1-12.8-9.6l17.74-23.65L85,127.43A8,8,0,0,1,80.57,117ZM224,56v56c0,52.72-25.52,84.67-46.93,102.19-23.06,18.86-46,25.27-47,25.53a8,8,0,0,1-4.2,0c-1-.26-23.91-6.67-47-25.53C57.52,196.67,32,164.72,32,112V56A16,16,0,0,1,48,40H208A16,16,0,0,1,224,56Zm-16,0L48,56l0,56c0,37.3,13.82,67.51,41.07,89.81A128.25,128.25,0,0,0,128,223.62a129.3,129.3,0,0,0,39.41-22.2C194.34,179.16,208,149.07,208,112Z" fill="currentColor"/></g>',
+        'cloudflare' => '<g transform="translate(0 8.24) scale(0.498) translate(-51 -6.7)" fill="currentColor"><path d="M84.2,20.4a2.85546,2.85546,0,0,0-.3-2.6,3.09428,3.09428,0,0,0-2.1-1.1l-17.4-.2c-.1,0-.2-.1-.3-.1a.1875.1875,0,0,1,0-.3c.1-.2.2-.3.4-.3L82,15.6a6.29223,6.29223,0,0,0,5.1-3.8l1-2.6c0-.1.1-.2,0-.3A11.39646,11.39646,0,0,0,66.2,7.7a5.45941,5.45941,0,0,0-3.6-1A5.20936,5.20936,0,0,0,58,11.3a5.46262,5.46262,0,0,0,.1,1.8A7.30177,7.30177,0,0,0,51,20.4a4.102,4.102,0,0,0,.1,1.1.3193.3193,0,0,0,.3.3H83.5c.2,0,.4-.1.4-.3Z"/><path d="M89.7,9.2h-.5c-.1,0-.2.1-.3.2l-.7,2.4a2.85546,2.85546,0,0,0,.3,2.6,3.09428,3.09428,0,0,0,2.1,1.1l3.7.2c.1,0,.2.1.3.1a.1875.1875,0,0,1,0,.3c-.1.2-.2.3-.4.3l-3.8.2a6.29223,6.29223,0,0,0-5.1,3.8l-.2.9c-.1.1,0,.3.2.3H98.5a.26517.26517,0,0,0,.3-.3,10.87184,10.87184,0,0,0,.4-2.6,9.56045,9.56045,0,0,0-9.5-9.5"/></g>',
         'network' => '<g transform="scale(0.09375)"><path d="M240,120a8,8,0,0,1-8,8H200v32h8a16,16,0,0,1,16,16v32a16,16,0,0,1-16,16H176a16,16,0,0,1-16-16V176a16,16,0,0,1,16-16h8V128H72v32h8a16,16,0,0,1,16,16v32a16,16,0,0,1-16,16H48a16,16,0,0,1-16-16V176a16,16,0,0,1,16-16h8V128H24a8,8,0,0,1,0-16h96V88h-8A16,16,0,0,1,96,72V40a16,16,0,0,1,16-16h32a16,16,0,0,1,16,16V72a16,16,0,0,1-16,16h-8v24h96A8,8,0,0,1,240,120Z" fill="currentColor"/></g>',
     ];
 
-    $svg = $icons[$name] ?? '';
+    // 'cloudflare' is the Cloudflare cloud from public/svgs/cloudflared.svg in one color.
+    // 'danger' is the shield-alert glyph in the error color, for Danger Zone menu items.
+    $isDanger = $name === 'danger';
+    $svg = $icons[$isDanger ? 'shield-alert' : $name] ?? '';
 @endphp
 
-<svg {{ $attributes->merge(['class' => 'size-4']) }} viewBox="0 0 24 24" fill="none"
+<svg {{ $attributes->class(['size-4', 'text-error' => $isDanger]) }} viewBox="0 0 24 24" fill="none"
     xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
     {!! $svg !!}
 </svg>
diff --git a/resources/views/components/resource-logo.blade.php b/resources/views/components/resource-logo.blade.php
new file mode 100644
index 0000000000..5ecd3bc542
--- /dev/null
+++ b/resources/views/components/resource-logo.blade.php
@@ -0,0 +1,31 @@
+@props(['resource', 'iconClass' => 'size-4'])
+
+{{-- The resource logo (see resource_logo()). Shows the favicon once it loads, and the resource type icon when there is no logo or it fails to load. --}}
+@php
+    $logo = resource_logo($resource);
+    $icon = match (true) {
+        $resource instanceof \App\Models\Application => 'browser-code',
+        $resource instanceof \App\Models\Service => 'layers',
+        default => 'database',
+    };
+@endphp
+
+<span class="contents" data-resource-logo>
+    @if ($logo)
+        <span class="flex size-full items-center justify-center" data-resource-logo-image>
+            <img src="{{ $logo['src'] }}" alt="" data-fallback="{{ $logo['fallback'] }}"
+                onerror="resourceLogoError(this)"
+                @class(['size-full object-contain', 'p-1' => $logo['padded'], 'dark:hidden' => $logo['dark']]) />
+            @if ($logo['dark'])
+                <img src="{{ $logo['dark'] }}" alt="" onerror="resourceLogoError(this)"
+                    class="hidden size-full object-contain dark:block" />
+            @endif
+        </span>
+        @if ($logo['favicon'])
+            <img src="{{ $logo['favicon'] }}" alt="" hidden data-resource-logo-favicon
+                onload="resourceLogoLoaded(this)" onerror="resourceLogoError(this)"
+                class="size-full object-contain p-1" />
+        @endif
+    @endif
+    <x-reicon :name="$icon" :class="$iconClass" data-resource-logo-icon :hidden="(bool) $logo" />
+</span>
diff --git a/resources/views/components/section-heading-link.blade.php b/resources/views/components/section-heading-link.blade.php
new file mode 100644
index 0000000000..ce5bdbfebe
--- /dev/null
+++ b/resources/views/components/section-heading-link.blade.php
@@ -0,0 +1,8 @@
+{{-- The "View all" link of x-section-heading (uses its $href, $actionLabel, and $icon). --}}
+<a href="{{ $href }}" {{ wireNavigate() }}
+    class="group inline-flex shrink-0 items-center gap-0.5 text-[11px] text-neutral-500 hover:text-black hover:underline dark:text-fg-faint dark:hover:text-fg">
+    {{ $actionLabel }}
+    @if ($icon)
+        <x-reicon :name="$icon" class="size-3 transition-transform duration-150 ease-out group-hover:translate-x-0.5" />
+    @endif
+</a>
diff --git a/resources/views/components/section-heading.blade.php b/resources/views/components/section-heading.blade.php
index 6872dc1a30..c96b40a7c7 100644
--- a/resources/views/components/section-heading.blade.php
+++ b/resources/views/components/section-heading.blade.php
@@ -3,29 +3,38 @@
     'subtitle' => null,
     'href' => null,
     'actionLabel' => 'View all',
-    'icon' => 'arrow-right',
+    'icon' => null,
 ])
 
 {{--
     Shared section heading: a 14px title, an optional 11px muted subtitle, and an
-    optional right-aligned action. Pass `href` for the default "View all"
-    button, or an `<x-slot:actions>` for a custom control.
+    optional action. Pass `href` for a small "View all" link and an
+    `<x-slot:actions>` for a right-aligned control; with both, the link sits
+    before the control, otherwise next to the title. `<x-slot:titleAction>`
+    puts a small control (such as a + button) right after the title.
 --}}
 <div {{ $attributes->merge(['class' => 'mb-3 min-w-0']) }}>
-    <div class="flex items-center justify-between gap-4">
-        <h2 class="min-w-0 truncate text-[14px]! leading-5! font-semibold! text-black dark:text-fg">
-            {{ $title }}
-        </h2>
+    <div class="flex flex-wrap items-center justify-between gap-x-4 gap-y-2">
+        <div class="flex min-w-0 items-baseline gap-2">
+            <div class="flex min-w-0 items-center gap-1">
+                <h2 class="min-w-0 truncate text-[14px]! leading-5! font-semibold! text-black dark:text-fg">
+                    {{ $title }}
+                </h2>
+                @isset($titleAction)
+                    {{ $titleAction }}
+                @endisset
+            </div>
+            @if (filled($href) && ! isset($actions))
+                @include('components.section-heading-link')
+            @endif
+        </div>
         @isset($actions)
-            <div class="shrink-0">{{ $actions }}</div>
-        @elseif (filled($href))
-            <a href="{{ $href }}" {{ wireNavigate() }}
-                class="button group">
-                {{ $actionLabel }}
-                @if ($icon)
-                    <x-reicon :name="$icon" class="size-3 opacity-70 transition-transform duration-150 ease-out group-hover:translate-x-0.5" />
+            <div class="ml-auto flex shrink-0 items-center gap-3">
+                @if (filled($href))
+                    @include('components.section-heading-link')
                 @endif
-            </a>
+                {{ $actions }}
+            </div>
         @endisset
     </div>
     @if (filled($subtitle))
diff --git a/resources/views/components/security/settings-layout.blade.php b/resources/views/components/security/settings-layout.blade.php
index 809a8d32a1..3985e6b413 100644
--- a/resources/views/components/security/settings-layout.blade.php
+++ b/resources/views/components/security/settings-layout.blade.php
@@ -33,35 +33,20 @@
     ])->filter();
 @endphp
 
-<section class="application-settings-workspace w-full max-w-none">
+{{-- These pages are in the Keys & Tokens submenu of the main sidebar (components/navbar.blade.php). --}}
+<section class="w-full max-w-none">
     <header class="settings-mobile-header xl:hidden">
         <h1 class="settings-mobile-title">Keys & Tokens</h1>
         <p class="settings-mobile-description">Manage SSH keys, cloud credentials, and API access tokens.</p>
     </header>
-    <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems(['Keys & Tokens' => $securityMenuItems], [])) }}">
-            <nav aria-label="Keys and tokens"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                <div class="nav-section hidden xl:block">Keys & Tokens</div>
-                @foreach ($securityMenuItems as $menuItem)
-                    <a wire:key="security-settings-{{ str($menuItem['label'])->slug() }}"
-                        @class(['menu-item', 'menu-item-active' => $menuItem['active']])
-                        {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                        <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                    </a>
-                @endforeach
-            </nav>
-        </aside>
-
-        <div class="min-w-0">
-            @isset($actions)
-                <div class="mb-3 flex min-h-8 flex-wrap items-center justify-end gap-2">
-                    {{ $actions }}
-                </div>
-            @endisset
-            {{ $slot }}
-        </div>
+    {{-- Feeds the page search with the Keys & Tokens pages. --}}
+    <div hidden data-settings-search-items="{{ json_encode(settingsSearchItems(['Keys & Tokens' => $securityMenuItems], [])) }}"></div>
+    <div class="min-w-0">
+        @isset($actions)
+            <div class="mb-3 flex min-h-8 flex-wrap items-center justify-end gap-2">
+                {{ $actions }}
+            </div>
+        @endisset
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/server-timing-hud.blade.php b/resources/views/components/server-timing-hud.blade.php
index 35fad6a372..b220182b45 100644
--- a/resources/views/components/server-timing-hud.blade.php
+++ b/resources/views/components/server-timing-hud.blade.php
@@ -186,10 +186,11 @@
 
         const panel = qs(root, '[data-sth-panel]');
         if (panel) {
-            // Dropdown below the pill inside the top bar.
+            // Dropdown below the pill inside the top bar. The desktop pill sits after the
+            // breadcrumb (left side), so its panel opens to the right; the mobile pill is on the right.
             panel.style.position = 'absolute';
-            panel.style.right = '0';
-            panel.style.left = 'auto';
+            panel.style.right = isMobileSlot ? '0' : 'auto';
+            panel.style.left = isMobileSlot ? 'auto' : '0';
             panel.style.top = 'calc(100% + 8px)';
             panel.style.bottom = 'auto';
             panel.style.zIndex = '2147483001';
diff --git a/resources/views/components/server/gpu-list.blade.php b/resources/views/components/server/gpu-list.blade.php
new file mode 100644
index 0000000000..93c084dec5
--- /dev/null
+++ b/resources/views/components/server/gpu-list.blade.php
@@ -0,0 +1,28 @@
+@props(['server'])
+
+@php($gpus = $server->detectedGpus())
+
+<div {{ $attributes->merge(['class' => 'text-[12px] leading-5 text-neutral-600 dark:text-fg-dim']) }}>
+    @if ($gpus === null)
+        <p>Not checked yet. Refresh to find GPUs.</p>
+    @elseif ($gpus === [])
+        <p>No NVIDIA GPU found (<span class="font-mono">nvidia-smi</span> is not installed or shows no GPU).</p>
+    @else
+        <ul>
+            @foreach ($gpus as $gpu)
+                <li wire:key="server-{{ $server->id }}-gpu-{{ $gpu['uuid'] }}">
+                    <span class="font-mono font-medium text-neutral-950 dark:text-fg">{{ $gpu['index'] }}</span>
+                    · {{ $gpu['name'] }} · {{ round($gpu['memory_mb'] / 1024, 1) }} GB ·
+                    <span class="font-mono">{{ $gpu['uuid'] }}</span>
+                </li>
+            @endforeach
+        </ul>
+        @unless (data_get($server->server_metadata, 'nvidia_container_toolkit'))
+            <p class="mt-1 text-warning-900 dark:text-warning">
+                NVIDIA Container Toolkit not found. Containers cannot use these GPUs until you
+                <a href="https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html"
+                    class="underline" target="_blank">install it</a> and restart Docker.
+            </p>
+        @endunless
+    @endif
+</div>
diff --git a/resources/views/components/server/sidebar.blade.php b/resources/views/components/server/sidebar.blade.php
index 5380e6f647..663a0ef06f 100644
--- a/resources/views/components/server/sidebar.blade.php
+++ b/resources/views/components/server/sidebar.blade.php
@@ -26,7 +26,7 @@
             'active' => $activeMenu === 'advanced',
             'icon' => 'grid',
             'group' => 'Settings',
-            'visible' => $server->isFunctional(),
+            'disabled' => ! $server->isFunctional(),
         ],
         [
             'label' => 'Private Key',
@@ -41,7 +41,7 @@
             'active' => $activeMenu === 'cloud-provider-token',
             'icon' => 'subscription',
             'group' => 'Settings',
-            'visible' => (bool) ($server->hetzner_server_id || $server->vultr_instance_id),
+            'visible' => (bool) ($server->hetzner_server_id || $server->vultr_instance_id || $server->digitalocean_droplet_id || $server->hostinger_virtual_machine_id),
         ],
         [
             'label' => 'CA Certificate',
@@ -54,7 +54,7 @@
             'label' => 'Cloudflare Tunnel',
             'route' => 'server.cloudflare-tunnel',
             'active' => $activeMenu === 'cloudflare-tunnel',
-            'icon' => 'globe',
+            'icon' => 'cloudflare',
             'group' => 'Networking',
             'visible' => ! $server->isLocalhost(),
         ],
@@ -77,15 +77,16 @@
         [
             'label' => 'Sentinel',
             'route' => 'server.sentinel',
-            'active' => request()->routeIs('server.sentinel', 'server.sentinel.*'),
+            'active' => $activeMenu === 'sentinel',
             'icon' => 'shield-star',
             'group' => 'Platform',
-            'visible' => $server->isFunctional() && ! $server->isSwarm() && $server->canHostResources() && auth()->user()?->can('viewSentinel', $server),
+            'visible' => ! $server->isSwarm() && $server->canHostResources() && auth()->user()?->can('viewSentinel', $server),
+            'disabled' => ! $server->isFunctional(),
             'warning' => $server->isSentinelEnabled() && $sentinelStatus === 'out_of_sync',
             'tracks_sentinel_status' => true,
             'children' => [
-                ['label' => 'Configuration', 'route' => 'server.sentinel', 'active' => request()->routeIs('server.sentinel'), 'icon' => 'settings'],
-                ['label' => 'Logs', 'route' => 'server.sentinel.logs', 'active' => request()->routeIs('server.sentinel.logs'), 'icon' => 'file-content'],
+                ['label' => 'Configuration', 'route' => 'server.sentinel', 'active' => $activeSubMenu === 'configuration', 'icon' => 'settings'],
+                ['label' => 'Logs', 'route' => 'server.sentinel.logs', 'active' => $activeSubMenu === 'logs', 'icon' => 'file-content'],
             ],
         ],
         [
@@ -110,7 +111,7 @@
             'active' => $activeMenu === 'destinations',
             'icon' => 'destinations',
             'group' => 'Networking',
-            'visible' => $server->isFunctional(),
+            'disabled' => ! $server->isFunctional(),
         ],
         [
             'label' => 'Swarm',
@@ -126,7 +127,7 @@
             'active' => $activeMenu === 'docker-images',
             'icon' => 'layers',
             'group' => 'Operations',
-            'visible' => $server->isFunctional(),
+            'disabled' => ! $server->isFunctional(),
         ],
         [
             'label' => 'Docker Cleanup',
@@ -134,7 +135,7 @@
             'active' => $activeMenu === 'docker-cleanup',
             'icon' => 'broom',
             'group' => 'Operations',
-            'visible' => $server->isFunctional(),
+            'disabled' => ! $server->isFunctional(),
         ],
         [
             'label' => 'GitHub Runners',
@@ -159,7 +160,7 @@
             'active' => $activeMenu === 'log-drains',
             'icon' => 'notifications',
             'group' => 'Operations',
-            'visible' => $server->isFunctional(),
+            'disabled' => ! $server->isFunctional(),
         ],
         [
             'label' => 'Metrics',
@@ -167,7 +168,7 @@
             'active' => $activeMenu === 'metrics',
             'icon' => 'graph',
             'group' => 'Operations',
-            'visible' => $server->isFunctional(),
+            'disabled' => ! $server->isFunctional(),
         ],
         [
             'label' => 'Analytics',
@@ -175,18 +176,19 @@
             'active' => $activeMenu === 'analytics',
             'icon' => 'analytics',
             'group' => 'Operations',
-            'visible' => $server->isFunctional() && ! $server->isSwarm() && ! $server->isBuildServer(),
+            'visible' => ! $server->isSwarm() && ! $server->isBuildServer(),
+            'disabled' => ! $server->isFunctional(),
         ],
         [
             'label' => 'Security',
             'route' => 'server.security.patches',
-            'active' => request()->routeIs('server.security.*'),
+            'active' => $activeMenu === 'security',
             'icon' => 'shield-alert',
             'group' => 'Security',
             'visible' => auth()->user()?->can('update', $server),
             'children' => [
-                ['label' => 'Server Patching', 'route' => 'server.security.patches', 'active' => request()->routeIs('server.security.patches'), 'icon' => 'bandage'],
-                ['label' => 'Terminal Access', 'route' => 'server.security.terminal-access', 'active' => request()->routeIs('server.security.terminal-access'), 'icon' => 'browser-terminal', 'navigate' => false],
+                ['label' => 'Patching', 'route' => 'server.security.patches', 'active' => $activeSubMenu === 'patches', 'icon' => 'bandage', 'beta' => true],
+                ['label' => 'Terminal Access', 'route' => 'server.security.terminal-access', 'active' => $activeSubMenu === 'terminal-access', 'icon' => 'browser-terminal', 'navigate' => false],
             ],
         ],
         [
@@ -194,15 +196,16 @@
             'route' => 'server.transfer',
             'active' => $activeMenu === 'transfer',
             'icon' => 'arrow-right',
+            'beta' => true,
             'group' => 'Operations',
-            'visible' => isDev() && ! $server->isLocalhost() && auth()->user()?->can('view', $server),
+            'visible' => ! $server->isLocalhost() && auth()->user()?->can('update', $server),
         ],
         [
-            'label' => 'Danger',
+            'label' => 'Danger Zone',
             'route' => 'server.delete',
             'active' => $activeMenu === 'danger',
-            'icon' => 'shield-alert',
-            'group' => 'Danger zone',
+            'icon' => 'danger',
+            'group' => 'Danger Zone',
             // Coolify host (id 0) cannot be deleted. Other servers may still use
             // host.docker.internal (e.g. Lima VMs) and must keep the Danger menu.
             'visible' => ! $server->is_coolify_host,
@@ -213,16 +216,44 @@
         ->filter(fn (array $item): bool => $item['visible'] ?? true)
         ->values();
     $groupedServerMenuItems = $serverMenuItems->groupBy('group');
-
-    // Group that holds the current page (item or nested child) — always kept
-    // open, even if collapsed before.
-    $activeGroup = (string) $groupedServerMenuItems->search(fn ($items) => $items->contains(
-        fn ($item) => ($item['active'] ?? false)
-            || collect($item['children'] ?? [])->contains(fn ($child) => $child['active'] ?? false)
-    ));
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+@php
+    // The main sidebar shows this menu on wide screens (see components/navbar.blade.php).
+    registerMainNavContext(0, 'Servers', 'Back to the main menu');
+@endphp
+
+{{-- Rendered twice: in the page (below xl), and teleported into the main sidebar (xl and up).
+     Both copies keep their own warning state (proxy, Sentinel). --}}
+@foreach (['page', 'main-nav'] as $placement)
+@if ($placement === 'main-nav')
+@teleport('#main-nav-context-0')
+<div class="nav-context-menu"
+    x-data="{
+        proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),
+        traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo()),
+        proxyNotRunning: @js($proxyNotRunning),
+        sentinelOutOfSync: @js($server->isSentinelEnabled() && $sentinelStatus === 'out_of_sync'),
+        sentinelExpiryTimer: null,
+        scheduleSentinelExpiry(delay) {
+            clearTimeout(this.sentinelExpiryTimer);
+            if (!this.sentinelOutOfSync) {
+                this.sentinelExpiryTimer = setTimeout(() => this.sentinelOutOfSync = true, delay);
+            }
+        }
+    }"
+    x-init="scheduleSentinelExpiry(@js($sentinelExpiresInMilliseconds))"
+    @proxy-configuration-state-changed.window="
+        proxyConfigurationPending = $event.detail.pending;
+        traefikOutdated = $event.detail.traefikOutdated;
+        proxyNotRunning = $event.detail.proxyNotRunning;
+    "
+    @sentinel-status-changed.window="
+        sentinelOutOfSync = $event.detail.outOfSync;
+        scheduleSentinelExpiry($event.detail.expiresInMilliseconds);
+    ">
+@else
+<aside class="application-settings-navigation in-main-nav min-w-0 xl:self-start"
     data-settings-search-items="{{ json_encode(settingsSearchItems($groupedServerMenuItems, $serverRouteParameters)) }}"
     x-data="{
         proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),
@@ -247,26 +278,29 @@
         sentinelOutOfSync = $event.detail.outOfSync;
         scheduleSentinelExpiry($event.detail.expiresInMilliseconds);
     ">
+@endif
     <nav aria-label="Server configuration sections"
-        x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.server' })"
-        class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
+        @class([
+            'grid gap-0.5',
+            'grid-cols-2 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]' => $placement === 'page',
+            'grid-cols-1' => $placement === 'main-nav',
+        ])>
         @foreach ($groupedServerMenuItems as $groupLabel => $groupItems)
             @unless ($loop->first)
                 <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]"
                     aria-hidden="true"></div>
             @endunless
-            <button type="button" class="nav-section-toggle hidden xl:flex" @click="toggle(@js($groupLabel))"
-                :aria-expanded="isOpen(@js($groupLabel))">
-                <span>{{ $groupLabel }}</span>
-                <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                    :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                    stroke="currentColor" stroke-width="2" aria-hidden="true">
-                    <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                </svg>
-            </button>
-            <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
             @foreach ($groupItems as $menuItem)
-                <a wire:key="server-settings-link-{{ str($menuItem['label'])->slug() }}"
+                @if ($menuItem['disabled'] ?? false)
+                    <span wire:key="{{ $placement }}-server-settings-link-{{ str($menuItem['label'])->slug() }}"
+                        class="menu-item cursor-not-allowed opacity-40" aria-disabled="true"
+                        title="Validate the server connection first.">
+                        <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
+                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                    </span>
+                    @continue
+                @endif
+                <a wire:key="{{ $placement }}-server-settings-link-{{ str($menuItem['label'])->slug() }}"
                     @class([
                         'menu-item',
                         'menu-item-active' => $menuItem['active'],
@@ -292,18 +326,26 @@
                 @if ($menuItem['active'] && isset($menuItem['children']))
                     <div class="col-span-full grid grid-cols-2 gap-0.5 border-l border-neutral-200 pl-2 sm:grid-cols-3 xl:grid-cols-1 dark:border-white/[0.08]">
                         @foreach (collect($menuItem['children'])->filter(fn (array $child): bool => $child['visible'] ?? true) as $child)
-                            <a wire:key="server-settings-child-{{ str($menuItem['label'].'-'.$child['label'])->slug() }}"
+                            <a wire:key="{{ $placement }}-server-settings-child-{{ str($menuItem['label'].'-'.$child['label'])->slug() }}"
                                 @class(['menu-item', 'menu-item-active' => $child['active']])
                                 @if ($child['navigate'] ?? true) {{ wireNavigate() }} @endif
                                 href="{{ route($child['route'], $serverRouteParameters) }}">
                                 <x-reicon :name="$child['icon']" class="menu-item-icon" />
                                 <span class="menu-item-label">{{ $child['label'] }}</span>
+                                @if ($child['beta'] ?? false)
+                                    <x-beta-badge class="ml-auto shrink-0" />
+                                @endif
                             </a>
                         @endforeach
                     </div>
                 @endif
             @endforeach
-            </div>
         @endforeach
     </nav>
+@if ($placement === 'main-nav')
+</div>
+@endteleport
+@else
 </aside>
+@endif
+@endforeach
diff --git a/resources/views/components/service-database/sidebar.blade.php b/resources/views/components/service-database/sidebar.blade.php
index c101619109..b3af548d0b 100644
--- a/resources/views/components/service-database/sidebar.blade.php
+++ b/resources/views/components/service-database/sidebar.blade.php
@@ -3,11 +3,10 @@
     'serviceDatabase',
 ])
 
-<aside class="application-settings-navigation min-w-0 xl:self-start">
+<x-main-nav-menu :depth="1" back-label="Service" back-title="Back to the service menu">
     <nav aria-label="Compose resource settings"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-        <div class="nav-section hidden xl:block">Compose resource</div>
-        <a class="menu-item" {{ wireNavigate() }}
+        <a class="menu-item" data-page-only {{ wireNavigate() }}
             href="{{ route('project.service.configuration', [...$parameters, 'stack_service_uuid' => null]) }}">
             <x-reicon name="logout" class="menu-item-icon rotate-180" />
             <span class="menu-item-label">Back to service</span>
@@ -19,4 +18,4 @@
             <span class="menu-item-label">General</span>
         </a>
     </nav>
-</aside>
+</x-main-nav-menu>
diff --git a/resources/views/components/service/configuration-sidebar.blade.php b/resources/views/components/service/configuration-sidebar.blade.php
index 24918e5315..5682c8c282 100644
--- a/resources/views/components/service/configuration-sidebar.blade.php
+++ b/resources/views/components/service/configuration-sidebar.blade.php
@@ -1,4 +1,4 @@
-@props(['service', 'currentRoute'])
+@props(['service', 'currentRoute', 'navOnly' => false, 'storageSections' => collect()])
 
 @php
     $serviceRouteParameters = [
@@ -16,12 +16,13 @@
         ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
         ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
         ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
+        ['label' => 'Files', 'route' => 'project.service.files', 'icon' => 'folder', 'visible' => auth()->user()?->can('canAccessTerminal')],
         ['label' => 'Analytics', 'route' => 'project.service.analytics', 'icon' => 'analytics'],
         ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
-        ['label' => 'Webhooks', 'route' => 'project.service.webhooks', 'icon' => 'notifications'],
+        ['label' => 'Webhooks', 'route' => 'project.service.webhooks', 'icon' => 'webhook'],
         ['label' => 'Resource Operations', 'route' => 'project.service.resource-operations', 'icon' => 'server-update'],
         ['label' => 'Tags', 'route' => 'project.service.tags', 'icon' => 'tags'],
-        ['label' => 'Danger Zone', 'route' => 'project.service.danger', 'icon' => 'shield-alert'],
+        ['label' => 'Danger Zone', 'route' => 'project.service.danger', 'icon' => 'danger'],
     ])->filter(fn (array $item): bool => $item['visible'] ?? true)
         ->map(fn (array $item): array => [
             ...$item,
@@ -36,9 +37,10 @@
 
     $menuGroups = [
         'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
-        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Analytics'],
+        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Files', 'Analytics'],
         'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
-        'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
+        'Operations' => ['Resource Operations', 'Tags'],
+        'Danger Zone' => ['Danger Zone'],
     ];
 
     $groupedItems = collect($menuGroups)
@@ -47,42 +49,43 @@
             ->filter()
             ->values())
         ->filter(fn ($items) => $items->isNotEmpty());
-
-    // Group that holds the current page — always kept open, even if collapsed before.
-    $activeGroup = (string) $groupedItems->search(fn ($items) => $items->contains(fn ($item) => $item['active'] ?? false));
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+<x-main-nav-menu back-label="Dashboard" :nav-only="$navOnly"
     data-settings-search-items="{{ json_encode(settingsSearchItems($groupedItems, $serviceRouteParameters)) }}">
     <nav aria-label="Service settings"
-        x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.service' })"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
         @foreach ($groupedItems as $groupLabel => $groupItems)
             @unless ($loop->first)
                 <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
             @endunless
-            <button type="button" class="nav-section-toggle hidden xl:flex" @click="toggle(@js($groupLabel))"
-                :aria-expanded="isOpen(@js($groupLabel))">
-                <span>{{ $groupLabel }}</span>
-                <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                    :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                    stroke="currentColor" stroke-width="2" aria-hidden="true">
-                    <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                </svg>
-            </button>
-            <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
-                @foreach ($groupItems as $menuItem)
-                    <a @class(['menu-item', 'menu-item-active' => $menuItem['active']])
-                        @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
-                        href="{{ route($menuItem['route'], $serviceRouteParameters) }}">
-                        <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                        @if ($menuItem['hasWarning'] ?? false)
-                            <span class="ml-auto size-2 shrink-0 rounded-full bg-error" title="Required environment variables missing"></span>
-                        @endif
-                    </a>
-                @endforeach
-            </div>
+            @foreach ($groupItems as $menuItem)
+                <a @class(['menu-item', 'menu-item-active' => $menuItem['active']])
+                    @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
+                    href="{{ route($menuItem['route'], $serviceRouteParameters) }}">
+                    <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
+                    <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                    @if ($menuItem['label'] === 'Files')
+                        <x-beta-badge class="ml-auto shrink-0" />
+                    @endif
+                    @if ($menuItem['hasWarning'] ?? false)
+                        <span class="ml-auto size-2 shrink-0 rounded-full bg-error" title="Required environment variables missing"></span>
+                    @endif
+                </a>
+                @if ($menuItem['active'] && $menuItem['route'] === 'project.service.storages' && $storageSections->isNotEmpty())
+                    <div class="nav-children hidden flex-col gap-0.5 py-1 xl:flex"
+                        x-data="{ activeSection: '' }">
+                        @foreach ($storageSections as $section)
+                            <button type="button" class="menu-subitem"
+                                :class="activeSection === '{{ $section['id'] }}' && 'menu-subitem-active'"
+                                @click="activeSection = '{{ $section['id'] }}'; window.scrollToSettingsSection?.('{{ $section['id'] }}')">
+                                <span class="menu-item-label truncate text-left"
+                                    title="{{ $section['label'] }}">{{ $section['label'] }}</span>
+                            </button>
+                        @endforeach
+                    </div>
+                @endif
+            @endforeach
         @endforeach
     </nav>
-</aside>
+</x-main-nav-menu>
diff --git a/resources/views/components/settings/layout.blade.php b/resources/views/components/settings/layout.blade.php
index 72aec39bb0..d8e4ae9f28 100644
--- a/resources/views/components/settings/layout.blade.php
+++ b/resources/views/components/settings/layout.blade.php
@@ -6,47 +6,28 @@
             ['label' => 'Updates', 'route' => 'settings.updates', 'icon' => 'refresh3'],
         ],
         'Instance' => [
-            ['label' => 'Backup', 'route' => 'settings.backup', 'icon' => 'database'],
-            ['label' => 'Email', 'route' => 'settings.email', 'icon' => 'mail'],
             ['label' => 'Authentication', 'route' => 'settings.oauth', 'icon' => 'keys'],
+            ['label' => 'Email', 'route' => 'settings.email', 'icon' => 'mail'],
+            ['label' => 'Backup', 'route' => 'settings.backup', 'icon' => 'database'],
         ],
     ];
 @endphp
 
+{{-- The pages are in the Settings submenu of the main sidebar (components/navbar.blade.php). --}}
 <section class="application-settings-workspace w-full max-w-none">
     <header class="settings-mobile-header xl:hidden">
         <h1 class="settings-mobile-title">Instance Settings</h1>
         <p class="settings-mobile-description">Configure global settings for this Coolify instance.</p>
     </header>
-    <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems($settingsMenuSections, [])) }}">
-            <nav aria-label="Instance settings"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                @foreach ($settingsMenuSections as $section => $menuItems)
-                    <div @class([
-                        'nav-section col-span-full hidden xl:block',
-                        'mt-5 border-t border-neutral-200 pt-4 dark:border-white/[0.06]' => !$loop->first,
-                    ])>{{ $section }}</div>
-                    @foreach ($menuItems as $menuItem)
-                        <a wire:key="instance-settings-{{ str($menuItem['label'])->slug() }}"
-                            @class(['menu-item', 'menu-item-active' => request()->routeIs($menuItem['route'])])
-                            {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                            <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                            <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                        </a>
-                        @if ($menuItem['route'] === 'settings.oauth' && isset($submenu))
-                            <div class="col-span-full ml-5 border-l border-neutral-200 pl-2 dark:border-white/[0.08]">
-                                {{ $submenu }}
-                            </div>
-                        @endif
-                    @endforeach
-                @endforeach
-            </nav>
-        </aside>
-
-        <div class="min-w-0">
-            {{ $slot }}
-        </div>
+    {{-- Feeds the page search with the settings pages. --}}
+    <div hidden data-settings-search-items="{{ json_encode(settingsSearchItems($settingsMenuSections, [])) }}"></div>
+    @isset($submenu)
+        {{-- Sub-items of the current page, under its entry in the main sidebar. --}}
+        @teleport('#main-nav-active-children')
+            <div>{{ $submenu }}</div>
+        @endteleport
+    @endisset
+    <div class="min-w-0">
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/shared-variables/editor.blade.php b/resources/views/components/shared-variables/editor.blade.php
index 883d79cb68..2b2c13cb30 100644
--- a/resources/views/components/shared-variables/editor.blade.php
+++ b/resources/views/components/shared-variables/editor.blade.php
@@ -17,6 +17,12 @@
             'scope' => mb_strtolower(str($type)->headline()),
         ])
         ->values();
+    $canvasUrl = match ($type) {
+        'team' => route('shared-variables.team.canvas'),
+        'project' => route('shared-variables.project.canvas', ['project_uuid' => $resource->uuid]),
+        'environment' => route('shared-variables.environment.canvas', ['project_uuid' => $resource->project->uuid, 'environment_uuid' => $resource->uuid]),
+        'server' => route('shared-variables.server.canvas', ['server_uuid' => $resource->uuid]),
+    };
 @endphp
 
 <x-shared-variables.layout>
@@ -38,6 +44,8 @@
                 <span class="max-sm:hidden">{{ $view === 'normal' ? 'Developer view' : 'Normal view' }}</span>
                 <span class="sm:hidden">{{ $view === 'normal' ? 'Developer' : 'Normal' }}</span>
             </x-forms.button>
+            <x-canvas-view-toggle :views="['list' => ['List view', 'unordered-list']]" :list-url="url()->current()"
+                :canvas-url="$canvasUrl" />
         </x-slot:actions>
         @if ($view === 'normal')
             <div
diff --git a/resources/views/components/shared-variables/layout.blade.php b/resources/views/components/shared-variables/layout.blade.php
index e25ba9848e..85e287f82c 100644
--- a/resources/views/components/shared-variables/layout.blade.php
+++ b/resources/views/components/shared-variables/layout.blade.php
@@ -1,37 +1,11 @@
-@php
-    $sharedVariablesMenuItems = [
-        ['label' => 'Overview', 'route' => 'shared-variables.index', 'icon' => 'dashboard', 'active' => request()->routeIs('shared-variables.index')],
-        ['label' => 'Team', 'route' => 'shared-variables.team.index', 'icon' => 'teams', 'active' => request()->routeIs('shared-variables.team.*')],
-        ['label' => 'Projects', 'route' => 'shared-variables.project.index', 'icon' => 'projects', 'active' => request()->routeIs('shared-variables.project.*')],
-        ['label' => 'Environments', 'route' => 'shared-variables.environment.index', 'icon' => 'layers', 'active' => request()->routeIs('shared-variables.environment.*')],
-        ['label' => 'Servers', 'route' => 'shared-variables.server.index', 'icon' => 'servers', 'active' => request()->routeIs('shared-variables.server.*')],
-    ];
-@endphp
-
 <section class="application-settings-workspace w-full max-w-none">
     <header class="mb-6 xl:hidden">
         <h1 class="text-[24px]! leading-7! font-semibold! tracking-tight!">Shared variables</h1>
         <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">Reusable environment variables across resources</p>
     </header>
 
-    <div class="grid min-w-0 gap-8 xl:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-10">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems(['Shared variables' => $sharedVariablesMenuItems], [])) }}">
-            <nav aria-label="Shared variables"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-5 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                @foreach ($sharedVariablesMenuItems as $menuItem)
-                    <a wire:key="shared-variables-{{ str($menuItem['label'])->slug() }}"
-                        @class(['menu-item', 'menu-item-active' => $menuItem['active']])
-                        {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                        <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                    </a>
-                @endforeach
-            </nav>
-        </aside>
-
-        <div class="min-w-0 xl:mt-3">
-            {{ $slot }}
-        </div>
+    <x-shared-variables.sidebar />
+    <div class="min-w-0">
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/shared-variables/sidebar.blade.php b/resources/views/components/shared-variables/sidebar.blade.php
new file mode 100644
index 0000000000..4b36d07411
--- /dev/null
+++ b/resources/views/components/shared-variables/sidebar.blade.php
@@ -0,0 +1,13 @@
+@php
+    $sharedVariablesMenuItems = [
+        ['label' => 'Overview', 'route' => 'shared-variables.index', 'icon' => 'dashboard', 'active' => request()->routeIs('shared-variables.index')],
+        ['label' => 'Team', 'route' => 'shared-variables.team.index', 'icon' => 'teams', 'active' => request()->routeIs('shared-variables.team.*')],
+        ['label' => 'Projects', 'route' => 'shared-variables.project.index', 'icon' => 'projects', 'active' => request()->routeIs('shared-variables.project.*')],
+        ['label' => 'Environments', 'route' => 'shared-variables.environment.index', 'icon' => 'layers', 'active' => request()->routeIs('shared-variables.environment.*')],
+        ['label' => 'Servers', 'route' => 'shared-variables.server.index', 'icon' => 'servers', 'active' => request()->routeIs('shared-variables.server.*')],
+    ];
+@endphp
+
+{{-- The pages are in the Shared Variables submenu of the main sidebar (components/navbar.blade.php);
+     this only feeds the page search. --}}
+<div hidden data-settings-search-items="{{ json_encode(settingsSearchItems(['Shared variables' => $sharedVariablesMenuItems], [])) }}"></div>
diff --git a/resources/views/components/shared-variables/view-controls.blade.php b/resources/views/components/shared-variables/view-controls.blade.php
index 4a1dcbc0a0..c0d7fe1445 100644
--- a/resources/views/components/shared-variables/view-controls.blade.php
+++ b/resources/views/components/shared-variables/view-controls.blade.php
@@ -13,19 +13,15 @@
         </button>
     </div>
 
-    <div
-        class="view-toggle w-fit">
-        <button type="button" @click="viewMode = 'list'; localStorage.setItem('{{ $storageKey }}', 'list')"
-            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-            :class="viewMode === 'list' ? 'control-selected' : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-            aria-label="List view" title="List view">
-            <x-reicon name="unordered-list" class="size-3.5" />
-        </button>
-        <button type="button" @click="viewMode = 'grid'; localStorage.setItem('{{ $storageKey }}', 'grid')"
-            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-            :class="viewMode === 'grid' ? 'control-selected' : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-            aria-label="Grid view" title="Grid view">
-            <x-reicon name="grid" class="size-3.5" />
-        </button>
+    {{-- Only the view you can switch to, with its name (as components/canvas-view-toggle.blade.php). --}}
+    <div class="view-toggle w-fit">
+        @foreach (['list' => ['List view', 'unordered-list'], 'grid' => ['Grid view', 'grid']] as $mode => [$viewLabel, $icon])
+            <button type="button" @click="viewMode = '{{ $mode }}'; localStorage.setItem('{{ $storageKey }}', '{{ $mode }}')"
+                x-show="viewMode !== '{{ $mode }}'" x-cloak title="{{ $viewLabel }}"
+                class="relative flex h-7.5 items-center gap-1.5 rounded-md px-2.5 text-[12px] font-medium text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                <x-reicon :name="$icon" class="size-3.5" />
+                {{ $viewLabel }}
+            </button>
+        @endforeach
     </div>
 </div>
diff --git a/resources/views/components/status-badge.blade.php b/resources/views/components/status-badge.blade.php
index 5aa02454bd..a8f49e8bf5 100644
--- a/resources/views/components/status-badge.blade.php
+++ b/resources/views/components/status-badge.blade.php
@@ -4,6 +4,7 @@
     'type' => 'neutral',
     'as' => 'span',
     'dynamic' => false,
+    'pulse' => false, // ping the dot for a state that is still in progress
 ])
 
 @php
@@ -22,7 +23,12 @@
         @if ($dynamic)
             {{ $slot }}
         @else
-            <span class="size-1.5 shrink-0 rounded-full {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+            <span class="relative flex size-1.5 shrink-0">
+                @if ($pulse)
+                    <span class="absolute inline-flex size-full rounded-full opacity-75 motion-safe:animate-ping {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+                @endif
+                <span class="relative inline-flex size-1.5 rounded-full {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+            </span>
             <span class="truncate">{{ collect([$label, $status])->filter()->join(' ') }}</span>
         @endif
     </button>
@@ -31,7 +37,12 @@
         @if ($dynamic)
             {{ $slot }}
         @else
-            <span class="size-1.5 shrink-0 rounded-full {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+            <span class="relative flex size-1.5 shrink-0">
+                @if ($pulse)
+                    <span class="absolute inline-flex size-full rounded-full opacity-75 motion-safe:animate-ping {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+                @endif
+                <span class="relative inline-flex size-1.5 rounded-full {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+            </span>
             <span class="truncate">{{ collect([$label, $status])->filter()->join(' ') }}</span>
         @endif
     </a>
@@ -40,7 +51,12 @@
         @if ($dynamic)
             {{ $slot }}
         @else
-            <span class="size-1.5 shrink-0 rounded-full {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+            <span class="relative flex size-1.5 shrink-0">
+                @if ($pulse)
+                    <span class="absolute inline-flex size-full rounded-full opacity-75 motion-safe:animate-ping {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+                @endif
+                <span class="relative inline-flex size-1.5 rounded-full {{ $dotClasses[$type] ?? $dotClasses['neutral'] }}"></span>
+            </span>
             <span class="truncate">{{ collect([$label, $status])->filter()->join(' ') }}</span>
         @endif
     </span>
diff --git a/resources/views/components/team/avatar.blade.php b/resources/views/components/team/avatar.blade.php
new file mode 100644
index 0000000000..809e1dbd1a
--- /dev/null
+++ b/resources/views/components/team/avatar.blade.php
@@ -0,0 +1,10 @@
+@props(['team'])
+
+@if ($team->avatar_path)
+    <img src="{{ team_avatar_url($team) }}" alt="{{ $team->name }}"
+        {{ $attributes->class('shrink-0 rounded-md object-cover') }}>
+@else
+    <span {{ $attributes->class('flex shrink-0 items-center justify-center rounded-md bg-neutral-200 font-semibold text-neutral-700 dark:bg-white/[0.1] dark:text-fg') }}>
+        {{ strtoupper(mb_substr($team->name, 0, 1)) }}
+    </span>
+@endif
diff --git a/resources/views/components/team/settings-layout.blade.php b/resources/views/components/team/settings-layout.blade.php
index 8ea7232ae6..af6e103489 100644
--- a/resources/views/components/team/settings-layout.blade.php
+++ b/resources/views/components/team/settings-layout.blade.php
@@ -28,41 +28,21 @@
             'label' => 'Danger Zone',
             'route' => 'team.danger-zone',
             'active' => request()->routeIs('team.danger-zone'),
-            'icon' => 'shield-alert',
+            'icon' => 'danger',
             'sectionStart' => true,
         ] : null,
     ])->filter();
 @endphp
 
-<section class="application-settings-workspace w-full max-w-none">
+{{-- The team pages are in the Team submenu of the main sidebar (components/navbar.blade.php). --}}
+<section class="w-full max-w-none">
     <header class="settings-mobile-header xl:hidden">
         <h1 class="settings-mobile-title">Team</h1>
         <p class="settings-mobile-description">Manage your team, members, and access settings.</p>
     </header>
-    <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems(['Team' => $teamMenuItems], [])) }}">
-            <nav aria-label="Team settings"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                <div class="nav-section hidden xl:block">Team</div>
-                @foreach ($teamMenuItems as $menuItem)
-                    @if ($menuItem['sectionStart'] ?? false)
-                        <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]"
-                            aria-hidden="true"></div>
-                    @endif
-                    <a wire:key="team-settings-{{ str($menuItem['label'])->slug() }}"
-                        @class(['menu-item', 'menu-item-active' => $menuItem['active']])
-                        {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                        <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                    </a>
-                @endforeach
-
-            </nav>
-        </aside>
-
-        <div class="min-w-0">
-            {{ $slot }}
-        </div>
+    {{-- Feeds the page search with the team pages. --}}
+    <div hidden data-settings-search-items="{{ json_encode(settingsSearchItems(['Team' => $teamMenuItems], [])) }}"></div>
+    <div class="min-w-0">
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/terminal/mode-selector.blade.php b/resources/views/components/terminal/mode-selector.blade.php
new file mode 100644
index 0000000000..72513c4e07
--- /dev/null
+++ b/resources/views/components/terminal/mode-selector.blade.php
@@ -0,0 +1,49 @@
+@php
+    // Shell (docker exec) vs Console (docker attach). Shown only when the container is
+    // interactive (keeps stdin open). Alpine state lives on the parent terminal section:
+    // attachAvailable, terminalMode, modeOpen, setTerminalMode().
+    $modes = [
+        ['key' => 'shell', 'name' => 'Shell', 'description' => 'Interactive shell (docker exec)'],
+        ['key' => 'attach', 'name' => 'Console', 'description' => 'Attach to the app process (docker attach)'],
+    ];
+    $modeNames = collect($modes)->pluck('name', 'key');
+@endphp
+
+<div x-cloak x-show="attachAvailable" class="relative shrink-0" @click.outside="modeOpen = false"
+    @keydown.escape.window="modeOpen = false">
+    <button type="button"
+        class="terminal-theme-trigger flex h-8 items-center gap-1.5 rounded-md px-2.5 text-xs font-medium text-white/70 transition-colors hover:bg-white/[0.08] hover:text-white"
+        @click="modeOpen = !modeOpen" aria-label="Choose terminal mode" aria-haspopup="menu" :aria-expanded="modeOpen">
+        <svg class="size-3.5 text-white/45" viewBox="0 0 24 24" fill="none" aria-hidden="true">
+            <path d="m5 8 3 3-3 3M12 16h6" stroke="currentColor" stroke-width="1.6" stroke-linecap="round"
+                stroke-linejoin="round" />
+        </svg>
+        <span x-text="@js($modeNames)[terminalMode]"></span>
+        <svg class="size-2.5 text-white/35" viewBox="0 0 12 12" fill="none" aria-hidden="true">
+            <path d="m3.5 4.75 2.5 2.5 2.5-2.5" stroke="currentColor" stroke-width="1.25" stroke-linecap="round"
+                stroke-linejoin="round" />
+        </svg>
+    </button>
+
+    <div x-cloak x-show="modeOpen" x-transition.origin.top.right role="menu"
+        class="console-theme-selector absolute top-11 right-0 z-50 w-64 overflow-y-auto rounded-lg border border-neutral-200 bg-white p-1 shadow-[0_18px_50px_rgba(0,0,0,0.18)] dark:border-white/[0.1] dark:bg-[#111113] dark:shadow-[0_18px_50px_rgba(0,0,0,0.55)]">
+        @foreach ($modes as $mode)
+            {{-- Shell (docker exec) needs a shell in the image; hide it when none is available. --}}
+            <button type="button" role="menuitemradio" :aria-checked="terminalMode === '{{ $mode['key'] }}'"
+                @if ($mode['key'] === 'shell') x-show="hasShell" @endif
+                class="flex w-full items-start gap-2 rounded-md px-2 py-1.5 text-left text-neutral-600 transition-colors hover:bg-neutral-100 hover:text-neutral-950 dark:text-white/65 dark:hover:bg-white/[0.07] dark:hover:text-white"
+                @click="setTerminalMode('{{ $mode['key'] }}')">
+                <span class="min-w-0 flex-1">
+                    <span class="block text-[12px] font-medium">{{ $mode['name'] }}</span>
+                    <span
+                        class="mt-0.5 block text-[10px] text-neutral-400 dark:text-white/35">{{ $mode['description'] }}</span>
+                </span>
+                <svg x-show="terminalMode === '{{ $mode['key'] }}'" class="mt-0.5 size-3 shrink-0 text-[#fcd452]"
+                    viewBox="0 0 12 12" fill="none" aria-hidden="true">
+                    <path d="m2.5 6.25 2.1 2.1 4.9-5" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"
+                        stroke-linejoin="round" />
+                </svg>
+            </button>
+        @endforeach
+    </div>
+</div>
diff --git a/resources/views/components/theme-controls.blade.php b/resources/views/components/theme-controls.blade.php
index d44de4178e..f69e0bbc8f 100644
--- a/resources/views/components/theme-controls.blade.php
+++ b/resources/views/components/theme-controls.blade.php
@@ -61,6 +61,44 @@
                 </svg>
             </button>
         @endforeach
+        <div class="my-1 h-px bg-neutral-200 dark:bg-white/[0.07]"></div>
+        <div class="px-2 pt-1 pb-0.5 text-[10px] font-medium tracking-wide text-neutral-400 uppercase dark:text-fg-faint">
+            Navigation
+        </div>
+        @foreach ([
+            ['value' => 'default', 'label' => 'Default'],
+            ['value' => 'floating', 'label' => 'Floating'],
+        ] as $option)
+            <button type="button" @click="setNavStyle('{{ $option['value'] }}')"
+                class="flex h-8 w-full items-center justify-between rounded-md px-2 text-left text-xs text-neutral-600 transition-colors hover:bg-neutral-200 hover:text-neutral-950 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                <span>{{ $option['label'] }}</span>
+                <svg x-show="navStyle === '{{ $option['value'] }}'"
+                    class="size-3.5 text-black dark:text-fg" viewBox="0 0 12 12" fill="none"
+                    aria-hidden="true">
+                    <path d="{{ $checkPath }}" stroke="currentColor" stroke-width="1.4"
+                        stroke-linecap="round" stroke-linejoin="round" />
+                </svg>
+            </button>
+        @endforeach
+        <div class="my-1 h-px bg-neutral-200 dark:bg-white/[0.07]"></div>
+        <div class="px-2 pt-1 pb-0.5 text-[10px] font-medium tracking-wide text-neutral-400 uppercase dark:text-fg-faint">
+            Navigation items
+        </div>
+        @foreach ([
+            ['value' => '3d', 'label' => '3D'],
+            ['value' => 'flat', 'label' => 'Flat'],
+        ] as $option)
+            <button type="button" @click="setNavItems('{{ $option['value'] }}')"
+                class="flex h-8 w-full items-center justify-between rounded-md px-2 text-left text-xs text-neutral-600 transition-colors hover:bg-neutral-200 hover:text-neutral-950 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                <span>{{ $option['label'] }}</span>
+                <svg x-show="navItems === '{{ $option['value'] }}'"
+                    class="size-3.5 text-black dark:text-fg" viewBox="0 0 12 12" fill="none"
+                    aria-hidden="true">
+                    <path d="{{ $checkPath }}" stroke="currentColor" stroke-width="1.4"
+                        stroke-linecap="round" stroke-linejoin="round" />
+                </svg>
+            </button>
+        @endforeach
     </div>
 @else
     {{-- Full card grid for the Appearance settings page. --}}
@@ -181,5 +219,105 @@
                 @endforeach
             </div>
         </section>
+
+        <section class="application-settings-section">
+            <div class="application-settings-section-header">
+                <div>
+                    <h2>Navigation style</h2>
+                    <p>Choose how the top bar and sidebars sit on the page.</p>
+                </div>
+            </div>
+            <div class="application-settings-section-body grid gap-3 sm:grid-cols-2">
+                @foreach ([
+                    ['value' => 'default', 'label' => 'Default', 'description' => 'Top bar and sidebars run edge to edge.'],
+                    ['value' => 'floating', 'label' => 'Floating', 'description' => 'Framed panels float on a dotted backdrop, like the canvas.'],
+                ] as $option)
+                    <button type="button" @click="setNavStyle('{{ $option['value'] }}')"
+                        class="group overflow-hidden rounded-[10px] border border-neutral-200 bg-white text-left transition-[border-color,box-shadow] hover:border-neutral-300 hover:shadow-sm dark:border-white/[0.07] dark:bg-white/[0.05] dark:hover:border-white/[0.12]"
+                        :class="navStyle === '{{ $option['value'] }}'
+                            ? 'ring-1 ring-coollabs/30 border-coollabs/40 dark:ring-warning/30 dark:border-warning/40'
+                            : ''">
+                        @php($floating = $option['value'] === 'floating')
+                        <div @class([
+                            'flex h-20 border-b border-neutral-200 bg-neutral-50 dark:border-white/[0.07] dark:bg-black/15',
+                            'gap-1.5 p-1.5' => $floating,
+                        ])>
+                            <div @class([
+                                'flex flex-col items-center gap-1.5 bg-white px-2 py-2 dark:bg-white/[0.04]',
+                                'rounded-lg border border-neutral-200 dark:border-white/[0.08]' => $floating,
+                                'border-r border-neutral-200 dark:border-white/[0.07]' => ! $floating,
+                            ])>
+                                @foreach (['servers', 'projects'] as $icon)
+                                    <span class="flex size-6 items-center justify-center rounded-md border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+                                        <x-reicon :name="$icon" class="size-3.5" />
+                                    </span>
+                                @endforeach
+                            </div>
+                            <div @class([
+                                'h-5 flex-1 bg-white dark:bg-white/[0.04]',
+                                'rounded-lg border border-neutral-200 dark:border-white/[0.08]' => $floating,
+                                'border-b border-neutral-200 dark:border-white/[0.07]' => ! $floating,
+                            ])></div>
+                        </div>
+                        <div class="p-3">
+                            <div class="flex items-center justify-between gap-2">
+                                <span class="text-sm font-semibold text-black dark:text-fg">{{ $option['label'] }}</span>
+                                <x-reicon name="check-circle" class="size-4 text-black dark:text-fg"
+                                    x-show="navStyle === '{{ $option['value'] }}'" x-cloak />
+                            </div>
+                            <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">{{ $option['description'] }}</p>
+                        </div>
+                    </button>
+                @endforeach
+            </div>
+        </section>
+
+        <section class="application-settings-section">
+            <div class="application-settings-section-header">
+                <div>
+                    <h2>Navigation items</h2>
+                    <p>Choose how the main sidebar shows its items.</p>
+                </div>
+            </div>
+            <div class="application-settings-section-body grid gap-3 sm:grid-cols-2">
+                @foreach ([
+                    ['value' => '3d', 'label' => '3D', 'description' => 'Each icon sits in a raised tile that lifts on hover.'],
+                    ['value' => 'flat', 'label' => 'Flat', 'description' => 'Plain rows with a highlight for the current page.'],
+                ] as $option)
+                    <button type="button" @click="setNavItems('{{ $option['value'] }}')"
+                        class="group overflow-hidden rounded-[10px] border border-neutral-200 bg-white text-left transition-[border-color,box-shadow] hover:border-neutral-300 hover:shadow-sm dark:border-white/[0.07] dark:bg-white/[0.05] dark:hover:border-white/[0.12]"
+                        :class="navItems === '{{ $option['value'] }}'
+                            ? 'ring-1 ring-coollabs/30 border-coollabs/40 dark:ring-warning/30 dark:border-warning/40'
+                            : ''">
+                        @php($tiles = $option['value'] === '3d')
+                        <div class="flex h-20 flex-col justify-center gap-1.5 border-b border-neutral-200 bg-neutral-50 px-4 dark:border-white/[0.07] dark:bg-black/15">
+                            @foreach (['servers', 'projects'] as $icon)
+                                <div @class([
+                                    'flex items-center gap-2 rounded-md text-neutral-500 dark:text-fg-dim',
+                                    'px-1.5 py-1' => ! $tiles,
+                                    'bg-neutral-200/70 dark:bg-white/[0.08]' => ! $tiles && $loop->first,
+                                ])>
+                                    <span @class([
+                                        'flex items-center justify-center',
+                                        'size-6 rounded-md border border-neutral-200 bg-white shadow-[0_2px_0_rgb(0_0_0/0.22)] dark:border-white/[0.09] dark:bg-white/[0.04] dark:shadow-[0_2px_0_rgb(255_255_255/0.08)]' => $tiles,
+                                    ])>
+                                        <x-reicon :name="$icon" class="size-3.5" />
+                                    </span>
+                                    <span class="h-1.5 w-16 rounded-full bg-neutral-200 dark:bg-white/10"></span>
+                                </div>
+                            @endforeach
+                        </div>
+                        <div class="p-3">
+                            <div class="flex items-center justify-between gap-2">
+                                <span class="text-sm font-semibold text-black dark:text-fg">{{ $option['label'] }}</span>
+                                <x-reicon name="check-circle" class="size-4 text-black dark:text-fg"
+                                    x-show="navItems === '{{ $option['value'] }}'" x-cloak />
+                            </div>
+                            <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">{{ $option['description'] }}</p>
+                        </div>
+                    </button>
+                @endforeach
+            </div>
+        </section>
     </div>
 @endif
diff --git a/resources/views/components/top-breadcrumb.blade.php b/resources/views/components/top-breadcrumb.blade.php
index 8a5fba1e2b..6acaab08ae 100644
--- a/resources/views/components/top-breadcrumb.blade.php
+++ b/resources/views/components/top-breadcrumb.blade.php
@@ -65,7 +65,8 @@
     $currentStorage = $storages->firstWhere('uuid', $storageUuid);
     $githubAppUuid = request()->route('github_app_uuid');
     $gitlabAppUuid = request()->route('gitlab_app_uuid');
-    $sourceUuid = $githubAppUuid ?? $gitlabAppUuid;
+    $giteaAppUuid = request()->route('gitea_app_uuid');
+    $sourceUuid = $githubAppUuid ?? $gitlabAppUuid ?? $giteaAppUuid;
     $sources = $sourceUuid && $team ? $team->sources()->sortBy('name')->values() : collect();
     $currentSource = $sources->firstWhere('uuid', $sourceUuid);
     $destinationUuid = request()->route('destination_uuid');
@@ -85,7 +86,7 @@
     $currentTag = $tags->firstWhere('name', $tagName);
     $dashboardContext = match (true) {
         request()->routeIs('dashboard') => 'Dashboard',
-        request()->routeIs('project.index') => 'Projects',
+        request()->routeIs('project.index', 'project.canvas.index') => 'Projects',
         request()->routeIs('terminal') => 'Terminal',
         request()->routeIs('server.*') => 'Servers',
         request()->routeIs('source.*') => 'Sources',
@@ -102,33 +103,6 @@
         request()->routeIs('admin.*') => 'Admin',
         default => null,
     };
-    // Workspace destinations require an active plan on cloud; unsubscribed users
-    // only keep profile/appearance and must not see this switcher.
-    $canUseWorkspaceNav = isSubscribed() || ! isCloud();
-    $pageDestinations = $canUseWorkspaceNav
-        ? collect([
-            ['label' => 'Dashboard', 'href' => url('/')],
-            ['label' => 'Projects', 'href' => url('/projects')],
-            auth()->user()?->can('canAccessTerminal')
-                ? ['label' => 'Terminal', 'href' => route('terminal')]
-                : null,
-            ['label' => 'Servers', 'href' => url('/servers')],
-            ['label' => 'Sources', 'href' => route('source.all')],
-            ['label' => 'Destinations', 'href' => route('destination.index')],
-            auth()->user()?->isAdmin()
-                ? ['label' => 'Registries', 'href' => route('registries.index')]
-                : null,
-            ['label' => 'S3 Storage', 'href' => route('storage.index')],
-            ['label' => 'Shared Variables', 'href' => route('shared-variables.index')],
-            ['label' => 'Team', 'href' => route('team.index')],
-            ['label' => 'Notifications', 'href' => route('notifications.email')],
-            ['label' => 'Keys & Tokens', 'href' => route('security.private-key.index')],
-            ['label' => 'Tags', 'href' => route('tags.show')],
-            isInstanceAdmin()
-                ? ['label' => 'Settings', 'href' => route('settings.index')]
-                : null,
-        ])->filter()
-        : collect();
 @endphp
 <div class="flex min-w-0 items-center gap-0.5 text-[13px]">
     {{-- Team --}}
@@ -136,33 +110,7 @@
         <livewire:switch-team />
     </div>
 
-    @if (!$currentProject && $dashboardContext && $canUseWorkspaceNav)
-        <span class="shrink-0 px-0.5 text-neutral-300 dark:text-fg-faint">/</span>
-        <div class="relative min-w-0 shrink" x-data="{ open: false }" @keydown.escape.window="open = false">
-            <button type="button" @click="open = !open" @click.outside="open = false" title="Switch page"
-                class="flex h-8 min-w-0 items-center gap-1.5 rounded-md px-2 opacity-70 transition-[background-color,opacity] hover:bg-neutral-100 hover:opacity-100 dark:hover:bg-white/[0.05]">
-                <span class="min-w-0 truncate font-semibold text-black dark:text-fg">{{ $dashboardContext }}</span>
-                <svg class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" viewBox="0 0 24 24"
-                    fill="none">
-                    <path d="M8 9l4-4 4 4M8 15l4 4 4-4" stroke="currentColor" stroke-width="1.6"
-                        stroke-linecap="round" stroke-linejoin="round" />
-                </svg>
-            </button>
-            <div x-show="open" x-cloak x-transition.opacity.duration.120ms
-                class="listbox-panel scrollbar left-0! z-[90]! max-h-80! min-w-52">
-                <div class="px-2 py-1 text-[10px] font-semibold uppercase tracking-wide text-neutral-400 dark:text-fg-faint">
-                    Pages
-                </div>
-                @foreach ($pageDestinations as $destination)
-                    <a href="{{ $destination['href'] }}" {{ wireNavigate() }} @click="open = false"
-                        class="listbox-option {{ $destination['label'] === $dashboardContext ? 'bg-neutral-100 font-medium text-black dark:bg-white/[0.07] dark:text-fg' : '' }}">
-                        <span class="min-w-0 flex-1 truncate">{{ $destination['label'] }}</span>
-                    </a>
-                @endforeach
-            </div>
-        </div>
-    @elseif (!$currentProject && $dashboardContext)
-        {{-- Static context label only — no links to paid workspace pages. --}}
+    @if (!$currentProject && $dashboardContext)
         <span class="shrink-0 px-0.5 text-neutral-300 dark:text-fg-faint">/</span>
         <span
             class="flex h-8 min-w-0 items-center truncate px-2 font-semibold text-black opacity-70 dark:text-fg">{{ $dashboardContext }}</span>
@@ -193,9 +141,11 @@
         @endphp
         <x-breadcrumb-switcher title="Sources" :label="$currentSource->name ?: 'Source'" :items="$sources->map(fn ($source) => [
             'label' => $source->name ?: class_basename($source),
-            'href' => $source instanceof \App\Models\GithubApp
-                ? route('source.github.show', ['github_app_uuid' => $source->uuid])
-                : route('source.gitlab.show', ['gitlab_app_uuid' => $source->uuid]),
+            'href' => match (true) {
+                $source instanceof \App\Models\GithubApp => route('source.github.show', ['github_app_uuid' => $source->uuid]),
+                $source instanceof \App\Models\GiteaApp => route('source.gitea.show', ['gitea_app_uuid' => $source->uuid]),
+                default => route('source.gitlab.show', ['gitlab_app_uuid' => $source->uuid]),
+            },
             'active' => $source->getMorphClass() === $currentSource->getMorphClass() && $source->uuid === $currentSource->uuid,
         ])">
             <x-slot:meta>
@@ -247,7 +197,7 @@
         {{-- Project switcher --}}
         <div class="relative min-w-0 shrink" x-data="{ open: false }" @keydown.escape.window="open = false">
             <button type="button" @click="open = !open" @click.outside="open = false" title="Switch project"
-                class="flex items-center gap-1.5 min-w-0 h-8 px-2 rounded-md opacity-70 transition-[background-color,opacity] hover:opacity-100 hover:bg-neutral-100 dark:hover:bg-white/[0.05]">
+                class="flex items-center gap-1.5 min-w-0 max-w-full h-8 px-2 rounded-md opacity-70 transition-[background-color,opacity] hover:opacity-100 hover:bg-neutral-100 dark:hover:bg-white/[0.05]">
                 <span class="min-w-0 truncate font-semibold text-black dark:text-fg">{{ $currentProject->name }}</span>
                 <svg class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" viewBox="0 0 24 24" fill="none">
                     <path d="M8 9l4-4 4 4M8 15l4 4 4-4" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" />
@@ -273,7 +223,7 @@
         {{-- Environment switcher --}}
         <div class="relative min-w-0 shrink" x-data="{ open: false }" @keydown.escape.window="open = false">
             <button type="button" @click="open = !open" @click.outside="open = false" title="Switch environment"
-                class="flex items-center gap-1.5 min-w-0 h-8 px-2 rounded-md opacity-70 transition-[background-color,opacity] hover:opacity-100 hover:bg-neutral-100 dark:hover:bg-white/[0.05]">
+                class="flex items-center gap-1.5 min-w-0 max-w-full h-8 px-2 rounded-md opacity-70 transition-[background-color,opacity] hover:opacity-100 hover:bg-neutral-100 dark:hover:bg-white/[0.05]">
                 <span class="min-w-0 truncate font-semibold text-black dark:text-fg">{{ $currentEnvironment->name }}</span>
                 <svg class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" viewBox="0 0 24 24" fill="none">
                     <path d="M8 9l4-4 4 4M8 15l4 4 4-4" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" />
diff --git a/resources/views/components/top-user-menu.blade.php b/resources/views/components/top-user-menu.blade.php
index 1e1770a251..49f79e7b6a 100644
--- a/resources/views/components/top-user-menu.blade.php
+++ b/resources/views/components/top-user-menu.blade.php
@@ -21,7 +21,7 @@
     },
 }" @avatar-updated.window="avatarUrl = $event.detail.url" @keydown.escape.window="closePanel()"
     @click.outside="closePanel()">
-    <button type="button" @click="open ? closePanel() : openPanel()"
+    <button type="button" x-ref="userMenuButton" @click="open ? closePanel() : openPanel()"
         title="{{ $userName }}" aria-label="Account menu for {{ $userName }}"
         @if ($sidebar) :class="collapsed ? 'w-8 px-0' : 'w-full'" @endif
         @class([
@@ -44,7 +44,9 @@
         </svg>
     </button>
 
+    {{-- In the sidebar the panel is fixed to the button, so the scrolling sidebar does not clip it. --}}
     <div x-show="open" x-cloak
+        @if ($sidebar) x-anchor.top-start.fixed.offset.4="$refs.userMenuButton" @endif
         x-transition:enter="transition ease-out duration-150"
         x-transition:enter-start="opacity-0 scale-95" x-transition:enter-end="opacity-100 scale-100"
         x-transition:leave="transition ease-in duration-100"
@@ -52,7 +54,6 @@
         @class([
             'top-user-menu-panel listbox-panel z-[90]! max-h-none! w-52! min-w-0! overflow-visible!',
             'right-0! left-auto!' => ! $sidebar,
-            'bottom-full! left-0! right-auto! top-auto! mb-1!' => $sidebar,
             'origin-bottom-left' => $sidebar,
             'origin-top-right' => ! $sidebar,
         ])>
@@ -84,22 +85,6 @@
             <x-theme-controls variant="menu" />
         </div>
 
-        <button type="button" class="listbox-option w-full" @click="toggleAutoCollapse()"
-            :aria-pressed="autoCollapse" title="Collapse the sidebar on pages that have a settings menu">
-            <span class="flex items-center gap-2">
-                <svg class="size-4 opacity-80" viewBox="0 0 24 24" fill="none" aria-hidden="true">
-                    <rect x="3" y="5" width="18" height="14" rx="4" stroke="currentColor" stroke-width="1.6" />
-                    <path d="M16 9v6" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" />
-                </svg>
-                Auto-collapse sidebar
-            </span>
-            <svg x-show="autoCollapse" x-cloak class="size-4 shrink-0 text-black dark:text-fg" viewBox="0 0 24 24"
-                fill="none" aria-hidden="true">
-                <path d="M5 12l5 5L20 7" stroke="currentColor" stroke-width="2" stroke-linecap="round"
-                    stroke-linejoin="round" />
-            </svg>
-        </button>
-
         <div class="my-1 h-px bg-neutral-200 dark:bg-white/[0.07]"></div>
 
         <livewire:settings-dropdown trigger="account-menu" />
diff --git a/resources/views/emails/application-deployment-failed.blade.php b/resources/views/emails/application-deployment-failed.blade.php
index a97c650b2a..937c8cdb8e 100644
--- a/resources/views/emails/application-deployment-failed.blade.php
+++ b/resources/views/emails/application-deployment-failed.blade.php
@@ -6,5 +6,6 @@ Failed to deploy a pull request #{{ $pull_request_id }} of {{ $name }} at
 [{{ $fqdn }}]({{ $fqdn }}).
 @endif
 
+<x-emails.deployment-commit :commit="$commit ?? null" />
 [View Deployment Logs]({{ $deployment_url }})
 </x-emails.layout>
diff --git a/resources/views/emails/application-deployment-success.blade.php b/resources/views/emails/application-deployment-success.blade.php
index bc09a24796..2a1b6321d8 100644
--- a/resources/views/emails/application-deployment-success.blade.php
+++ b/resources/views/emails/application-deployment-success.blade.php
@@ -6,6 +6,7 @@ Pull request #{{ $pull_request_id }} of {{ $name }} deployed successfully
 [{{ $fqdn }}]({{ $fqdn }}).
 @endif
 
+<x-emails.deployment-commit :commit="$commit ?? null" />
 [View Deployment Logs]({{ $deployment_url }})
 
 </x-emails.layout>
diff --git a/resources/views/emails/server-patches.blade.php b/resources/views/emails/server-patches.blade.php
index 37644eaa2e..21e455e6d8 100644
--- a/resources/views/emails/server-patches.blade.php
+++ b/resources/views/emails/server-patches.blade.php
@@ -6,13 +6,19 @@
 - Operating System: {{ ucfirst($osId) }}
 - Package Manager: {{ $package_manager }}
 - Total Updates: {{ $total_updates }}
+@if (isset($security_updates))
+- Security Updates: {{ $security_updates }}
+@endif
+@if ($reboot_required ?? false)
+- A reboot is required to apply installed updates.
+@endif
 
 ## Available Updates
 
 @if ($total_updates > 0)
 @foreach ($updates as $update)
 
-Package: {{ $update['package'] }} ({{ $update['architecture'] }}), from version {{ $update['current_version'] }} to {{ $update['new_version'] }} at repository {{ $update['repository'] ?? 'Unknown' }}
+Package: {{ $update['package'] }}{{ ($update['security'] ?? false) ? ' [security]' : '' }} ({{ $update['architecture'] ?? 'unknown' }}), from version {{ $update['current_version'] }} to {{ $update['new_version'] }} at repository {{ $update['repository'] ?? 'Unknown' }}
 @endforeach
 
 ## Security Considerations
@@ -21,12 +27,7 @@ Some of these updates may include important security patches. We recommend revie
 
 ### Critical packages that may require container/server/service restarts:
 @php
-$criticalPackages = collect($updates)->filter(function ($update) {
-                return str_contains(strtolower($update['package']), 'docker') ||
-                    str_contains(strtolower($update['package']), 'kernel') ||
-                    str_contains(strtolower($update['package']), 'openssh') ||
-                    str_contains(strtolower($update['package']), 'ssl');
-            });
+$criticalPackages = collect($updates)->filter(fn ($update) => filled($update['risk'] ?? null));
 @endphp
 
 @if ($criticalPackages->count() > 0)
diff --git a/resources/views/layouts/app.blade.php b/resources/views/layouts/app.blade.php
index 51bc6a8640..ed88a038f7 100644
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@@ -9,60 +9,36 @@
     @auth
         <div x-data="{
             open: false,
-            hasSidebarPreference: localStorage.getItem('sidebarCollapsed') !== null,
-            userCollapsed: localStorage.getItem('sidebarCollapsed') === 'true',
-            autoCollapse: localStorage.getItem('sidebarAutoCollapse') !== 'false',
-            hasSecondBar: false,
-            collapsed: false,
-            pageWidth: localStorage.getItem('pageWidth') || 'full',
+            // New users start expanded.
+            collapsed: localStorage.getItem('sidebarCollapsed') === 'true',
+            pageWidth: localStorage.getItem('pageWidth') || 'centered',
             sidebarReady: false,
             init() {
-                this.applyCollapsed(false);
                 this.$nextTick(() => {
                     requestAnimationFrame(() => {
                         this.sidebarReady = true;
                     });
                 });
             },
-            targetCollapsed() {
-                this.hasSecondBar = !!document.querySelector('.application-settings-navigation');
-                return this.hasSidebarPreference ? this.userCollapsed : (this.autoCollapse && this.hasSecondBar);
-            },
-            applyCollapsed(animate) {
-                const target = this.targetCollapsed();
-                if (target === this.collapsed) return;
-                if (animate) {
-                    // Let the new page paint at the current width, then animate the
-                    // slide a frame later so the auto-collapse reads as a motion.
-                    this.sidebarReady = true;
-                    requestAnimationFrame(() => requestAnimationFrame(() => { this.collapsed = target; }));
-                } else {
-                    this.collapsed = target;
-                }
-            },
             toggleSidebar() {
                 this.collapsed = !this.collapsed;
-                this.hasSidebarPreference = true;
-                this.userCollapsed = this.collapsed;
-                localStorage.setItem('sidebarCollapsed', this.userCollapsed);
-            },
-            toggleAutoCollapse() {
-                this.autoCollapse = !this.autoCollapse;
-                localStorage.setItem('sidebarAutoCollapse', this.autoCollapse);
-                this.applyCollapsed(true);
+                localStorage.setItem('sidebarCollapsed', this.collapsed);
             }
-        }" @open-global-search.window="open = false" @page-width-changed.window="pageWidth = $event.detail" x-on:livewire:navigated.window="applyCollapsed(true)"
+        }" @open-global-search.window="open = false" @page-width-changed.window="pageWidth = $event.detail"
             :style="{ '--sidebar-w': collapsed ? '4rem' : '14rem' }" x-cloak
-            class="dark:text-inherit text-black">
+            @class(['app-shell dark:text-inherit text-black', 'flex h-dvh flex-col' => $fullBleed ?? false])>
             {{-- ============ DESKTOP TOP BAR ============ --}}
             <header
                 x-data="{ resourceActionsOpen: false }"
+                {{-- Floating style: the resource actions are a separate panel at the top right.
+                     Publish its width so the top bar panel stops before it. --}}
+                x-init="new ResizeObserver(([entry]) => $el.style.setProperty('--resource-actions-w', entry.borderBoxSize[0].inlineSize + 'px')).observe($refs.resourceActions)"
                 @resource-actions-toggled.window="resourceActionsOpen = $event.detail.open"
                 :class="{ 'z-[1000]': resourceActionsOpen }"
-                class="hidden lg:flex fixed top-0 inset-x-0 z-50 h-12 items-center bg-white/95 dark:bg-panel/95 backdrop-blur">
+                class="app-topbar hidden lg:flex fixed top-0 inset-x-0 z-50 h-12 items-center bg-white/95 dark:bg-panel/95 backdrop-blur">
                 {{-- Brand (width tracks sidebar) --}}
-                <div class="flex items-center gap-2 h-full shrink-0 border-r border-neutral-200 dark:border-white/[0.06] transition-[width] duration-200"
-                    :class="collapsed ? 'w-16 justify-center px-0' : 'w-56 px-4'">
+                <div class="app-topbar-brand flex items-center gap-2 h-full shrink-0 border-r border-black/[0.06] bg-neutral-50 dark:border-white/[0.04] dark:bg-app transition-[width] duration-200"
+                    :class="collapsed ? 'w-16 justify-center px-0 border-b' : 'w-56 px-4'">
                     <div class="flex items-baseline gap-1.5 min-w-0">
                         <a href="/" {{ wireNavigate() }} title="Coolify"
                             class="flex shrink-0 items-center hover:opacity-80 transition-opacity">
@@ -83,16 +59,19 @@
                 </div>
                 {{-- Collapse toggle + team switcher --}}
                 <div
-                    class="flex h-full items-center gap-0.5 min-w-0 flex-1 border-b border-neutral-200 pl-3 pr-4 dark:border-white/[0.06]">
+                    class="flex h-full items-center gap-0.5 min-w-0 flex-1 border-b border-black/[0.06] pl-3 pr-4 dark:border-white/[0.04]">
                     <div class="relative flex min-w-0 flex-1 items-center">
                         <x-top-breadcrumb />
                         <div id="server-topbar-context" class="min-w-0"></div>
+                        {{-- Dev Server-Timing HUD docks here, after the breadcrumb (local only; empty in production) --}}
+                        <div id="server-timing-hud-slot" data-server-timing-hud-slot class="ml-2 hidden shrink-0 items-center"></div>
                     </div>
-                    {{-- Dev Server-Timing HUD docks here (local only; empty in production) --}}
-                    <div id="server-timing-hud-slot" data-server-timing-hud-slot class="hidden shrink-0 items-center"></div>
+                    {{-- Page toolbars (the canvases) dock here on desktop. --}}
+                    <div id="page-toolbar-slot" class="flex shrink-0 items-center empty:hidden"></div>
                     <div id="configuration-warning-hud-slot" class="relative shrink-0"></div>
+                    <livewire:deployments-indicator variant="topbar" />
                     {{-- Resource actions dock here on desktop. --}}
-                    <div id="resource-action-hud-slot" class="hidden shrink-0 items-center xl:flex"></div>
+                    <div id="resource-action-hud-slot" x-ref="resourceActions" class="hidden shrink-0 items-center xl:flex"></div>
                 </div>
             </header>
 
@@ -140,10 +119,10 @@
             </div>
 
             {{-- ============ DESKTOP SIDEBAR (below top bar) ============ --}}
-            <div class="hidden lg:fixed lg:top-12 lg:bottom-0 lg:left-0 lg:z-40 lg:flex lg:flex-col min-w-0"
+            <div class="app-sidebar hidden lg:fixed lg:top-12 lg:bottom-0 lg:left-0 lg:z-40 lg:flex lg:flex-col min-w-0"
                 :class="[collapsed ? 'lg:w-16' : 'lg:w-56', sidebarReady ? 'transition-[width] duration-200' : '']">
                 <div class="flex min-h-0 grow min-w-0 flex-col overflow-visible">
-                    <x-navbar deployments-indicator />
+                    <x-navbar desktop />
                 </div>
             </div>
 
@@ -181,13 +160,23 @@
             </div>
 
             {{-- ============ MAIN ============ --}}
-            <main
-                class="min-h-screen bg-neutral-50 dark:bg-app px-5 py-6 sm:px-8 lg:px-10 lg:pt-[calc(3rem+1.75rem)] lg:pb-10"
-                :class="[collapsed ? 'lg:ml-16' : 'lg:ml-56', sidebarReady ? 'transition-[margin] duration-200' : '']">
-                <div class="w-full" :class="pageWidth === 'centered' ? 'mx-auto max-w-[1400px]' : 'max-w-none'">
-                    {{ $slot }}
-                </div>
-            </main>
+            @if ($fullBleed ?? false)
+                {{-- Full-bleed pages (canvases) fill the space between the top bar and the sidebar. --}}
+                <main class="app-main app-main-full relative min-h-0 flex-1 bg-neutral-50 dark:bg-app lg:pt-12"
+                    :class="[collapsed ? 'lg:ml-16' : 'lg:ml-56', sidebarReady ? 'transition-[margin] duration-200' : '']">
+                    <div class="relative h-full">
+                        {{ $slot }}
+                    </div>
+                </main>
+            @else
+                <main
+                    class="app-main min-h-screen bg-neutral-50 dark:bg-app px-5 py-6 sm:px-8 lg:px-10 lg:pt-[calc(3rem+1.75rem)] lg:pb-10"
+                    :class="[collapsed ? 'lg:ml-16' : 'lg:ml-56', sidebarReady ? 'transition-[margin] duration-200' : '', pageWidth === 'centered' ? '' : 'app-main-wide']">
+                    <div class="w-full" :class="pageWidth === 'centered' ? 'mx-auto max-w-[1400px]' : 'max-w-none'">
+                        {{ $slot }}
+                    </div>
+                </main>
+            @endif
         </div>
     @endauth
 @endsection
diff --git a/resources/views/layouts/base.blade.php b/resources/views/layouts/base.blade.php
index f1f303ad61..4ff572da81 100644
--- a/resources/views/layouts/base.blade.php
+++ b/resources/views/layouts/base.blade.php
@@ -32,6 +32,8 @@
             const theme = localStorage.theme === 'purple' ? 'custom' : (localStorage.theme || 'dark');
             const themeColor = localStorage.themeColor || '#6b16ed';
             const customMode = localStorage.customMode || 'dark';
+            document.documentElement.dataset.navStyle = localStorage.navStyle === 'floating' ? 'floating' : 'default';
+            document.documentElement.dataset.navItems = localStorage.navItems === 'flat' ? 'flat' : '3d';
             const isDark = theme === 'dark'
                 || (theme === 'custom' && customMode === 'dark')
                 || (theme === 'system' && matchMedia('(prefers-color-scheme: dark)').matches);
@@ -49,7 +51,9 @@
             theme: localStorage.getItem('theme') === 'purple' ? 'custom' : (localStorage.getItem('theme') || 'dark'),
             themeColor: localStorage.getItem('themeColor') || '#6b16ed',
             customMode: localStorage.getItem('customMode') || 'dark',
-            pageWidth: localStorage.getItem('pageWidth') || 'full',
+            pageWidth: localStorage.getItem('pageWidth') || 'centered',
+            navStyle: localStorage.getItem('navStyle') === 'floating' ? 'floating' : 'default',
+            navItems: localStorage.getItem('navItems') === 'flat' ? 'flat' : '3d',
             themeColorFrame: null,
             pickerOpen: false,
             init() {
@@ -79,6 +83,16 @@
                 localStorage.setItem('pageWidth', width);
                 window.dispatchEvent(new CustomEvent('page-width-changed', { detail: width }));
             },
+            setNavStyle(style) {
+                this.navStyle = style;
+                localStorage.setItem('navStyle', style);
+                document.documentElement.dataset.navStyle = style;
+            },
+            setNavItems(style) {
+                this.navItems = style;
+                localStorage.setItem('navItems', style);
+                document.documentElement.dataset.navItems = style;
+            },
             previewThemeColor(color) {
                 this.themeColor = color;
                 if (this.theme !== 'custom') {
diff --git a/resources/views/livewire/analytics-placeholder.blade.php b/resources/views/livewire/analytics-placeholder.blade.php
index 767f0f46ac..e33bf19353 100644
--- a/resources/views/livewire/analytics-placeholder.blade.php
+++ b/resources/views/livewire/analytics-placeholder.blade.php
@@ -52,8 +52,16 @@
         <x-skeleton.table :rows="6" flush />
     </x-application.settings-section>
 
-    <x-application.settings-section id="analytics-country-section" title="Countries" flush>
-        <x-skeleton class="h-64 w-full" />
+    <x-application.settings-section id="analytics-country-section" title="Locations" flush>
+        <x-slot:actions>
+            <x-skeleton class="h-9 w-36 rounded-lg" />
+        </x-slot:actions>
+        <div class="grid grid-cols-1 items-start gap-4 p-4 lg:grid-cols-[2fr_3fr]">
+            <div class="flex items-center justify-center">
+                <x-skeleton class="aspect-square w-full max-w-[320px] rounded-full" />
+            </div>
+            <x-skeleton.table :rows="7" flush />
+        </div>
     </x-application.settings-section>
     @endif
 </div>
diff --git a/resources/views/livewire/analytics.blade.php b/resources/views/livewire/analytics.blade.php
index c326ac29d5..f383f56506 100644
--- a/resources/views/livewire/analytics.blade.php
+++ b/resources/views/livewire/analytics.blade.php
@@ -254,14 +254,15 @@ $appListboxOptions = array_merge(
                             icon-name="unordered-list" />
                     @else
                         @php $maxAppRequests = max(1, (int) collect($topApps)->max('requests')); @endphp
-                        <div x-data="{ page: 0, per: 10, total: {{ count($topApps) }} }">
-                            <div class="flex items-center gap-3 border-b border-neutral-200 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:border-white/[0.07] dark:text-fg-dim">
-                                <span class="min-w-0 flex-1">Application / service</span>
-                                <span class="hidden w-16 shrink-0 text-right sm:inline" title="Request volume relative to the busiest row in this list">Volume</span>
-                                <span class="w-16 shrink-0 text-right">Requests</span>
-                                <span class="hidden w-16 shrink-0 text-right sm:inline" title="Total response data sent">Bandwidth</span>
+                        <div x-data="trafficTable()">
+                            <div class="flex items-center gap-3 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+                                @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Application / service', 'text' => true, 'class' => 'min-w-0 flex-1'])
+                                <span class="hidden w-16 shrink-0 sm:inline" aria-hidden="true"></span>
+                                @include('livewire.traffic._sort-header', ['column' => 'requests', 'label' => 'Requests', 'class' => 'w-16 shrink-0'])
+                                @include('livewire.traffic._sort-header', ['column' => 'bytesOut', 'label' => 'Bandwidth', 'class' => 'hidden w-16 shrink-0 sm:inline-flex', 'title' => 'Total response data sent'])
                                 <span class="size-3.5 shrink-0" aria-hidden="true"></span>
                             </div>
+                            <div class="flex flex-col">
                             @foreach ($topApps as $row)
                                 @php
                                     $appHref = $row['link'] ?? null;
@@ -269,11 +270,9 @@ $appListboxOptions = array_merge(
                                 @endphp
                                 <{{ $appHref ? 'a' : 'div' }} wire:key="analytics-app-{{ $row['uuid'] }}"
                                     @if ($appHref) href="{{ $appHref }}" {{ wireNavigate() }} @endif
-                                    x-show="{{ $loop->index }} >= page * per && {{ $loop->index }} < (page + 1) * per"
-                                    @class([
-                                        'flex min-h-11 items-center gap-3 border-b border-neutral-200 px-4 py-2 last:border-b-0 dark:border-white/[0.07]',
-                                        'transition-colors hover:bg-neutral-50 dark:hover:bg-white/[0.03]' => $appHref,
-                                    ])>
+                                    data-row="{{ json_encode(['name' => (string) $row['name'], 'requests' => (int) $row['requests'], 'bytesOut' => (int) $row['bandwidth']]) }}"
+                                    x-show="shown($el)"
+                                    class="flex min-h-11 items-center gap-3 border-t border-neutral-200 px-4 py-2 transition-colors hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.03]">
                                     <span class="flex min-w-0 flex-1 items-baseline gap-1.5">
                                         <span class="truncate text-[12px] text-black dark:text-fg">{{ $row['name'] }}</span>
                                         @if (! empty($row['isService']))
@@ -299,6 +298,7 @@ $appListboxOptions = array_merge(
                                     @endif
                                 </{{ $appHref ? 'a' : 'div' }}>
                             @endforeach
+                            </div>
                             @include('livewire.traffic._pager')
                         </div>
                     @endif
@@ -312,14 +312,12 @@ $appListboxOptions = array_merge(
             @include('livewire.traffic._paths-list', ['paths' => $topPaths])
         </x-application.settings-section>
 
-        {{-- Countries --}}
-        <x-application.settings-section id="analytics-country-section" title="Countries"
-            helper="Request volume by visitor country for the selected range." flush>
-            @include('livewire.traffic._geo', [
-                'countries' => data_get($breakdowns, 'country', []),
-                'attribution' => $attribution,
-            ])
-        </x-application.settings-section>
+        {{-- Locations (countries and cities) --}}
+        @include('livewire.traffic._geo', [
+            'countries' => data_get($breakdowns, 'country', []),
+            'cities' => trafficCityRows(data_get($breakdowns, 'city', [])),
+            'attribution' => $attribution,
+        ])
 
         {{-- Requests by device type (donut) + HTTP versions / cache / status. --}}
         <div class="grid grid-cols-1 gap-6 lg:grid-cols-2">
diff --git a/resources/views/livewire/boarding/index.blade.php b/resources/views/livewire/boarding/index.blade.php
index bc22715931..71c065dac3 100644
--- a/resources/views/livewire/boarding/index.blade.php
+++ b/resources/views/livewire/boarding/index.blade.php
@@ -207,6 +207,23 @@
                                         </x-slot:content>
                                         <livewire:server.new.by-digital-ocean :limit_reached="false" :from_onboarding="true" />
                                     </x-modal-input>
+                                    <x-modal-input title="Connect a Hostinger Server" isFullWidth>
+                                        <x-slot:content>
+                                            <div
+                                                class="group relative cursor-pointer flex h-full min-h-36 flex-col rounded-[10px] border border-neutral-200 bg-white p-4 text-left shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
+                                                <div class="flex h-full flex-col gap-4 text-left">
+                                                    <x-hostinger-icon class="size-10 shrink-0 text-[#673de6]" />
+                                                    <div class="min-h-0 flex-1">
+                                                        <h3 class="mb-1 text-[14px] font-semibold">Hostinger</h3>
+                                                        <p class="text-sm dark:text-neutral-400">
+                                                            Deploy servers directly from your Hostinger account.
+                                                        </p>
+                                                    </div>
+                                                </div>
+                                            </div>
+                                        </x-slot:content>
+                                        <livewire:server.new.by-hostinger :limit_reached="false" :from_onboarding="true" />
+                                    </x-modal-input>
                                 @endif
                                     </div>
                                 </section>
diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index 5de545df33..352060701a 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -12,6 +12,38 @@
         $dashboardProjects = $projects->sortBy('name', SORT_NATURAL)->take($dashboardItemLimit);
         $dashboardServers = $servers->sortBy('name', SORT_NATURAL)->take($dashboardItemLimit);
         $hasTrafficAnalytics = $servers->contains(fn ($server) => $server->isTrafficAnalyticsEnabled());
+        $projectResourceCounts = $dashboardProjects->mapWithKeys(fn ($project) => [$project->id => collect([
+            $project->applications_count,
+            $project->services_count,
+            $project->postgresqls_count,
+            $project->redis_count,
+            $project->keydbs_count,
+            $project->dragonflies_count,
+            $project->clickhouses_count,
+            $project->mongodbs_count,
+            $project->mysqls_count,
+            $project->mariadbs_count,
+            $project->sqlites_count,
+        ])->sum()]);
+        $serverStatuses = $dashboardServers->mapWithKeys(function ($server) {
+            $proxyNeedsAttention = $server->proxySet() && ($server->proxy->status !== 'running' || $server->hasCurrentTraefikOutdatedInfo());
+            $sentinelNeedsAttention = $server->isSentinelEnabled() && $server->sentinelStatus() === 'out_of_sync';
+
+            return [$server->id => match (true) {
+                $server->settings->force_disabled => ['Disabled', 'error'],
+                ! $server->settings->is_reachable && ! $server->settings->is_usable => ['Unavailable', 'error'],
+                ! $server->settings->is_reachable => ['Unreachable', 'error'],
+                ! $server->settings->is_usable => ['Not ready', 'warning'],
+                $proxyNeedsAttention || $sentinelNeedsAttention => ['Attention required', 'warning'],
+                default => ['Ready', 'success'],
+            }];
+        });
+        $iconButton = 'flex size-6.5 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg';
+        // Same look as $iconButton, sized to the 20px section title it sits next to.
+        $titleIconButton = 'flex size-5 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg';
+        $tableShell = 'overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]';
+        $tableHead = 'border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint';
+        $tableRow = 'min-h-14 items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.025]';
     @endphp
 
     <div class="flex min-w-0 flex-col gap-8">
@@ -32,38 +64,59 @@
             </div>
         @endif
 
+        {{-- Wide screens: activity takes the left third, projects and servers the other two thirds.
+             It stays one column while the left side has no section (no deployments, no traffic). --}}
+        <div class="grid min-w-0 gap-8 xl:items-start xl:has-[.dashboard-activity_section]:grid-cols-[minmax(0,1fr)_minmax(0,2fr)]">
+        <div class="dashboard-activity hidden min-w-0 has-[section]:flex flex-col gap-8">
         <livewire:dashboard.active-deployments />
 
         @if ($hasTrafficAnalytics)
             <livewire:dashboard.traffic-analytics />
         @endif
+        </div>
 
-        <section class="mb-0! min-w-0">
-            <x-section-heading title="Projects" subtitle="Your deployment workspaces"
-                :href="route('project.index')" />
+        <div class="flex min-w-0 flex-col gap-8">
+        <section class="@container mb-0! min-w-0" x-data="{
+            viewMode: @js($this->listView('dashboard_projects', 'table')),
+            setViewMode(mode) {
+                this.viewMode = mode;
+                $wire.saveListView('dashboard_projects', mode);
+            }
+        }">
+            <x-section-heading title="Projects"
+                :href="$projects->count() > $dashboardItemLimit ? route('project.index') : null">
+                {{-- Projects has no sidebar entry, so the dashboard is where new projects start. --}}
+                @can('createAnyResource')
+                    <x-slot:titleAction>
+                        <x-modal-input title="New Project">
+                            <x-slot:content>
+                                <button type="button" class="{{ $titleIconButton }}" title="New project"
+                                    aria-label="New project">
+                                    <x-reicon name="plus" class="size-3" />
+                                </button>
+                            </x-slot:content>
+                            <livewire:project.add-empty />
+                        </x-modal-input>
+                    </x-slot:titleAction>
+                @endcan
+                {{-- The dashboard canvas link lives here, so it never adds a row above the page. --}}
+                <x-slot:actions>
+                    <x-canvas-view-toggle :views="$dashboardProjects->isNotEmpty() ? null : []"
+                        :list-url="route('dashboard')" :canvas-url="route('dashboard.canvas')" />
+                </x-slot:actions>
+            </x-section-heading>
 
             @if ($dashboardProjects->isEmpty())
                 <x-empty title="No projects yet"
-                    description="Create your first deployment workspace from Projects."
+                    description="Create your first deployment workspace."
                     icon-name="projects" size="sm" />
             @else
-                <div class="grid min-w-0 grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
+                <div x-cloak x-show="viewMode === 'grid'"
+                    class="grid min-w-0 grid-cols-1 gap-3 @lg:grid-cols-2 @4xl:grid-cols-4">
                     @foreach ($dashboardProjects as $project)
                         @php
                             $firstEnvironment = $project->environments->first();
-                            $resourceCount = collect([
-                                $project->applications_count,
-                                $project->services_count,
-                                $project->postgresqls_count,
-                                $project->redis_count,
-                                $project->keydbs_count,
-                                $project->dragonflies_count,
-                                $project->clickhouses_count,
-                                $project->mongodbs_count,
-                                $project->mysqls_count,
-                                $project->mariadbs_count,
-                                $project->sqlites_count,
-                            ])->sum();
+                            $resourceCount = $projectResourceCounts[$project->id];
                         @endphp
 
                         <article
@@ -118,7 +171,7 @@
                                                 'environment_uuid' => $firstEnvironment->uuid,
                                             ]) }}"
                                                 {{ wireNavigate() }}
-                                                class="flex size-6.5 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg"
+                                                class="{{ $iconButton }}"
                                                 title="Add resource"
                                                 aria-label="Add resource to {{ $project->name }}">
                                                 <x-reicon name="plus" class="size-3" />
@@ -128,7 +181,7 @@
                                     @can('update', $project)
                                         <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}"
                                             {{ wireNavigate() }}
-                                            class="flex size-6.5 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg"
+                                            class="{{ $iconButton }}"
                                             title="Project settings"
                                             aria-label="Open settings for {{ $project->name }}">
                                             <x-reicon name="settings" class="size-3" />
@@ -139,12 +192,101 @@
                         </article>
                     @endforeach
                 </div>
+
+                <div x-show="viewMode === 'table'" class="{{ $tableShell }}">
+                    <div class="grid grid-cols-[minmax(0,1fr)_7rem_4rem] gap-4 @2xl:min-w-[560px] @2xl:grid-cols-[minmax(0,1.2fr)_7rem_minmax(0,1.5fr)_4rem] {{ $tableHead }}">
+                        <div>Project</div>
+                        <div>Contents</div>
+                        <div class="hidden @2xl:block">Description</div>
+                        <div></div>
+                    </div>
+                    @foreach ($dashboardProjects as $project)
+                        @php
+                            $firstEnvironment = $project->environments->first();
+                        @endphp
+                        <div wire:key="dashboard-project-row-{{ $project->uuid }}"
+                            class="relative grid grid-cols-[minmax(0,1fr)_7rem_4rem] gap-4 @2xl:min-w-[560px] @2xl:grid-cols-[minmax(0,1.2fr)_7rem_minmax(0,1.5fr)_4rem] {{ $tableRow }}">
+                            <a href="{{ $project->navigateTo() }}" {{ wireNavigate() }}
+                                class="absolute inset-0" aria-label="Open {{ $project->name }}"></a>
+                            <div class="flex min-w-0 items-center gap-3">
+                                <div
+                                    class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
+                                    @if ($project->icon_path)
+                                        <img src="{{ project_icon_url($project) }}" alt="{{ $project->name }} icon"
+                                            class="h-full w-full rounded-lg object-cover">
+                                    @else
+                                        <x-reicon name="projects" class="size-4" />
+                                    @endif
+                                </div>
+                                <p class="truncate text-[13px] font-semibold text-black dark:text-fg">
+                                    {{ $project->name }}
+                                </p>
+                            </div>
+                            <div class="relative z-10 flex w-fit items-center gap-3 font-medium text-neutral-600 dark:text-fg-dim">
+                                <span class="inline-flex items-center gap-1" data-tooltip="Environments"
+                                    aria-label="Environments">
+                                    <x-reicon name="layers" class="size-3.5 text-neutral-400 dark:text-fg-faint" />
+                                    {{ $project->environments->count() }}
+                                </span>
+                                <span class="inline-flex items-center gap-1" data-tooltip="Resources"
+                                    aria-label="Resources">
+                                    <x-reicon name="grid" class="size-3.5 text-neutral-400 dark:text-fg-faint" />
+                                    {{ $projectResourceCounts[$project->id] }}
+                                </span>
+                            </div>
+                            <p class="hidden truncate text-neutral-500 @2xl:block dark:text-fg-dim">
+                                {{ filled($project->description) ? $project->description : '-' }}
+                            </p>
+                            <div class="relative z-10 flex items-center justify-end gap-0.5">
+                                @if ($firstEnvironment)
+                                    @can('createAnyResource')
+                                        <a href="{{ route('project.resource.create', [
+                                            'project_uuid' => $project->uuid,
+                                            'environment_uuid' => $firstEnvironment->uuid,
+                                        ]) }}"
+                                            {{ wireNavigate() }} class="{{ $iconButton }}" title="Add resource"
+                                            aria-label="Add resource to {{ $project->name }}">
+                                            <x-reicon name="plus" class="size-3" />
+                                        </a>
+                                    @endcan
+                                @endif
+                                @can('update', $project)
+                                    <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}"
+                                        {{ wireNavigate() }} class="{{ $iconButton }}" title="Project settings"
+                                        aria-label="Open settings for {{ $project->name }}">
+                                        <x-reicon name="settings" class="size-3" />
+                                    </a>
+                                @endcan
+                            </div>
+                        </div>
+                    @endforeach
+                </div>
             @endif
         </section>
 
-        <section class="mb-0! min-w-0">
-            <x-section-heading title="Servers" subtitle="Infrastructure available for deployments"
-                :href="route('server.index')" />
+        <section class="@container mb-0! min-w-0" x-data="{
+            viewMode: @js($this->listView('dashboard_servers', 'table')),
+            setViewMode(mode) {
+                this.viewMode = mode;
+                $wire.saveListView('dashboard_servers', mode);
+            }
+        }">
+            <x-section-heading title="Servers"
+                :href="$servers->count() > $dashboardItemLimit ? route('server.index') : null">
+                @can('createAnyResource')
+                    <x-slot:titleAction>
+                        <a href="{{ route('server.create') }}" {{ wireNavigate() }} class="{{ $titleIconButton }}"
+                            title="New server" aria-label="New server">
+                            <x-reicon name="plus" class="size-3" />
+                        </a>
+                    </x-slot:titleAction>
+                @endcan
+                @if ($dashboardServers->isNotEmpty())
+                    <x-slot:actions>
+                        <x-canvas-view-toggle />
+                    </x-slot:actions>
+                @endif
+            </x-section-heading>
 
             @if ($dashboardServers->isEmpty())
                 @if ($privateKeys->isEmpty())
@@ -177,20 +319,11 @@
                     </x-empty>
                 @endif
             @else
-                <div class="grid min-w-0 grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
+                <div x-cloak x-show="viewMode === 'grid'"
+                    class="grid min-w-0 grid-cols-1 gap-3 @lg:grid-cols-2 @4xl:grid-cols-4">
                     @foreach ($dashboardServers as $server)
                         @php
-                            $proxyNeedsAttention = $server->proxySet() && ($server->proxy->status !== 'running' || $server->hasCurrentTraefikOutdatedInfo());
-                            $sentinelNeedsAttention = $server->isSentinelEnabled() && $server->sentinelStatus() === 'out_of_sync';
-
-                            [$serverStatus, $serverStatusType] = match (true) {
-                                $server->settings->force_disabled => ['Disabled', 'error'],
-                                ! $server->settings->is_reachable && ! $server->settings->is_usable => ['Unavailable', 'error'],
-                                ! $server->settings->is_reachable => ['Unreachable', 'error'],
-                                ! $server->settings->is_usable => ['Not ready', 'warning'],
-                                $proxyNeedsAttention || $sentinelNeedsAttention => ['Attention required', 'warning'],
-                                default => ['Ready', 'success'],
-                            };
+                            [$serverStatus, $serverStatusType] = $serverStatuses[$server->id];
                         @endphp
 
                         <a href="{{ route('server.show', ['server_uuid' => $server->uuid]) }}"
@@ -232,7 +365,46 @@
                         </a>
                     @endforeach
                 </div>
+                <div x-show="viewMode === 'table'" class="{{ $tableShell }}">
+                    <div class="grid grid-cols-[minmax(0,1fr)_9.5rem] gap-4 @2xl:min-w-[480px] @2xl:grid-cols-[minmax(0,1fr)_minmax(0,1.5fr)_9.5rem] {{ $tableHead }}">
+                        <div>Server</div>
+                        <div class="hidden @2xl:block">Description</div>
+                        <div>Status</div>
+                    </div>
+                    @foreach ($dashboardServers as $server)
+                        @php
+                            [$serverStatus, $serverStatusType] = $serverStatuses[$server->id];
+                        @endphp
+                        <a href="{{ route('server.show', ['server_uuid' => $server->uuid]) }}" {{ wireNavigate() }}
+                            wire:key="dashboard-server-row-{{ $server->uuid }}"
+                            class="grid grid-cols-[minmax(0,1fr)_9.5rem] gap-4 @2xl:min-w-[480px] @2xl:grid-cols-[minmax(0,1fr)_minmax(0,1.5fr)_9.5rem] hover:no-underline {{ $tableRow }}">
+                            <div class="flex min-w-0 items-center gap-3">
+                                <div
+                                    class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.035] dark:text-fg-dim">
+                                    <x-reicon name="servers" class="size-4" />
+                                </div>
+                                <p class="truncate text-[13px] font-semibold text-black dark:text-fg">
+                                    {{ $server->name }}
+                                </p>
+                            </div>
+                            <p class="hidden truncate text-neutral-500 @2xl:block dark:text-fg-dim">
+                                {{ filled($server->description) ? $server->description : '-' }}
+                            </p>
+                            <div class="flex items-center gap-2 text-[11px] font-medium text-neutral-600 dark:text-fg-dim">
+                                <span @class([
+                                    'size-2 shrink-0 rounded-full',
+                                    'bg-green-500 dark:bg-green-400' => $serverStatusType === 'success',
+                                    'bg-orange-500 dark:bg-warning' => $serverStatusType === 'warning',
+                                    'bg-red-500 dark:bg-red-400' => $serverStatusType === 'error',
+                                ])></span>
+                                {{ $serverStatus }}
+                            </div>
+                        </a>
+                    @endforeach
+                </div>
             @endif
         </section>
+        </div>
+        </div>
     </div>
 </div>
diff --git a/resources/views/livewire/dashboard/active-deployments.blade.php b/resources/views/livewire/dashboard/active-deployments.blade.php
index cea0489a20..ff7897b42a 100644
--- a/resources/views/livewire/dashboard/active-deployments.blade.php
+++ b/resources/views/livewire/dashboard/active-deployments.blade.php
@@ -24,17 +24,18 @@
     $hasAnyDeployments = $hasActiveDeployments || $hasRecentDeployments;
 @endphp
 
-<div wire:poll.3000ms="refreshDeployments" @class(['mb-0! min-w-0' => $hasAnyDeployments, 'hidden' => ! $hasAnyDeployments])>
+<div wire:poll.3000ms="refreshDeployments" @class(['min-w-0', 'mb-0!' => $hasAnyDeployments, 'hidden' => ! $hasAnyDeployments])>
     @if ($hasAnyDeployments)
-        <section class="mb-0! min-w-0">
-            <x-section-heading title="Deployments" subtitle="Active and recent deployment activity" />
+        {{-- Container breakpoints: the table needs room, which the dashboard column may not have. --}}
+        <section class="@container mb-0! min-w-0">
+            <x-section-heading title="Deployments" class="py-1.5" />
 
             <div class="flex min-w-0 flex-col gap-4">
                 @if ($hasActiveDeployments)
                     <div
                         class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                         <div class="border-b border-neutral-200 px-4 py-2.5 dark:border-white/[0.08]">
-                            <h3 class="text-[12px]! leading-4! font-semibold! text-black dark:text-fg">
+                            <h3 class="text-[11px]! leading-4! font-medium! text-neutral-500! dark:text-fg-faint!">
                                 Active
                             </h3>
                             <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint">
@@ -43,7 +44,7 @@
                         </div>
 
                         <div
-                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
+                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 @2xl:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                             <span>Application</span>
                             <span>Environment</span>
                             <span>Server</span>
@@ -61,7 +62,7 @@
 
                             <a wire:key="dashboard-active-deployment-{{ $deployment->deployment_uuid }}"
                                 href="{{ $deployment->deployment_url }}" {{ wireNavigate() }}
-                                class="dashboard-deployment-table-grid group block border-b border-neutral-200 px-4 py-3 transition-colors last:border-b-0 hover:bg-neutral-50 focus-visible:z-10 focus-visible:bg-warning/10 focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-warning focus-visible:ring-offset-0 md:grid md:items-center md:gap-4 dark:border-white/[0.08] dark:hover:bg-white/[0.025] dark:focus-visible:bg-warning/10">
+                                class="dashboard-deployment-table-grid group block border-b border-neutral-200 px-4 py-3 transition-colors last:border-b-0 hover:bg-neutral-50 focus-visible:z-10 focus-visible:bg-warning/10 focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-warning focus-visible:ring-offset-0 @2xl:grid @2xl:items-center @2xl:gap-4 dark:border-white/[0.08] dark:hover:bg-white/[0.025] dark:focus-visible:bg-warning/10">
                                 <div class="min-w-0">
                                     <p class="truncate text-[13px] font-semibold text-black dark:text-fg">
                                         {{ $deployment->application_name }}
@@ -73,20 +74,20 @@
                                     @endif
                                 </div>
 
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $environmentPath ?: '-' }}
                                 </p>
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $deployment->server_name ?: '-' }}
                                 </p>
-                                <span class="hidden md:block">
+                                <span class="hidden @2xl:block">
                                     <x-status-badge :status="$deploymentStatus" :type="$deploymentStatusType" />
                                 </span>
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $deployment->created_at?->diffForHumans() ?? '-' }}
                                 </p>
 
-                                <div class="mt-3 flex min-w-0 items-center gap-3 md:hidden">
+                                <div class="mt-3 flex min-w-0 items-center gap-3 @2xl:hidden">
                                     <x-status-badge :status="$deploymentStatus" :type="$deploymentStatusType" />
                                     <p class="min-w-0 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
                                         {{ $environmentPath ?: '-' }}
@@ -103,16 +104,13 @@
                     <div
                         class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
                         <div class="border-b border-neutral-200 px-4 py-2.5 dark:border-white/[0.08]">
-                            <h3 class="text-[12px]! leading-4! font-semibold! text-black dark:text-fg">
-                                Recent
+                            <h3 class="text-[11px]! leading-4! font-medium! text-neutral-500! dark:text-fg-faint!">
+                                Recent deployments
                             </h3>
-                            <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint">
-                                Latest completed deployments
-                            </p>
                         </div>
 
                         <div
-                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
+                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 @2xl:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                             <span>Application</span>
                             <span>Environment</span>
                             <span>Server</span>
@@ -130,7 +128,7 @@
 
                             <a wire:key="dashboard-recent-deployment-{{ $deployment->deployment_uuid }}"
                                 href="{{ $deployment->deployment_url }}" {{ wireNavigate() }}
-                                class="dashboard-deployment-table-grid group block border-b border-neutral-200 px-4 py-3 transition-colors last:border-b-0 hover:bg-neutral-50 focus-visible:z-10 focus-visible:bg-warning/10 focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-warning focus-visible:ring-offset-0 md:grid md:items-center md:gap-4 dark:border-white/[0.08] dark:hover:bg-white/[0.025] dark:focus-visible:bg-warning/10">
+                                class="dashboard-deployment-table-grid group block border-b border-neutral-200 px-4 py-3 transition-colors last:border-b-0 hover:bg-neutral-50 focus-visible:z-10 focus-visible:bg-warning/10 focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-warning focus-visible:ring-offset-0 @2xl:grid @2xl:items-center @2xl:gap-4 dark:border-white/[0.08] dark:hover:bg-white/[0.025] dark:focus-visible:bg-warning/10">
                                 <div class="min-w-0">
                                     <p class="truncate text-[13px] font-semibold text-black dark:text-fg">
                                         {{ $deployment->application_name }}
@@ -142,20 +140,20 @@
                                     @endif
                                 </div>
 
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $environmentPath ?: '-' }}
                                 </p>
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $deployment->server_name ?: '-' }}
                                 </p>
-                                <span class="hidden md:block">
+                                <span class="hidden @2xl:block">
                                     <x-status-badge :status="$deploymentStatus" :type="$deploymentStatusType" />
                                 </span>
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $deployment->created_at?->diffForHumans() ?? '-' }}
                                 </p>
 
-                                <div class="mt-3 flex min-w-0 items-center gap-3 md:hidden">
+                                <div class="mt-3 flex min-w-0 items-center gap-3 @2xl:hidden">
                                     <x-status-badge :status="$deploymentStatus" :type="$deploymentStatusType" />
                                     <p class="min-w-0 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
                                         {{ $environmentPath ?: '-' }}
diff --git a/resources/views/livewire/dashboard/canvas.blade.php b/resources/views/livewire/dashboard/canvas.blade.php
new file mode 100644
index 0000000000..f943859ecc
--- /dev/null
+++ b/resources/views/livewire/dashboard/canvas.blade.php
@@ -0,0 +1,14 @@
+<div class="flex h-full flex-col">
+    <x-slot:title>
+        Dashboard > Canvas | Coolify
+    </x-slot>
+    {{-- data-poll: deployments start without a broadcast event, so the canvas reloads while it is open. --}}
+    <div data-environment-canvas data-endpoint="/dashboard/canvas" data-poll="5"
+        data-team="{{ $teamId }}" data-user="{{ auth()->id() }}" class="relative min-h-0 flex-1" wire:ignore>
+        {{-- The canvas moves this group into its toolbar. --}}
+        <div data-ec-views class="flex items-center gap-2">
+            <x-canvas-view-toggle on-canvas :views="['list' => ['List view', 'unordered-list']]"
+                :list-url="route('dashboard')" :canvas-url="route('dashboard.canvas')" />
+        </div>
+    </div>
+</div>
diff --git a/resources/views/livewire/deploy-canvas.blade.php b/resources/views/livewire/deploy-canvas.blade.php
new file mode 100644
index 0000000000..accde0600e
--- /dev/null
+++ b/resources/views/livewire/deploy-canvas.blade.php
@@ -0,0 +1,31 @@
+<div class="h-full">
+    <x-slot:title>
+        Deploy canvas | Coolify
+    </x-slot>
+    {{-- The app's icons, cloned by resources/js/canvas/deploy/Icon.svelte. --}}
+    <template data-deploy-canvas-icons>
+        @foreach (['projects', 'servers', 'sources', 'cloud', 'file-content', 'layers', 'database', 'sliders', 'variables', 'globe', 'play-circle', 'check', 'x', 'plus', 'external-link', 'chevron-down', 'info-circle'] as $iconName)
+            <x-reicon :name="$iconName" data-icon="{{ $iconName }}" />
+        @endforeach
+    </template>
+    {{-- One-click service templates for the Service step: [key, name]. --}}
+    <script type="application/json" data-deploy-canvas-services>@json($serviceTemplates)</script>
+    {{-- The logos of the other source steps: name => versioned URL. --}}
+    <script type="application/json" data-deploy-canvas-resource-logos>@json($resourceLogos)</script>
+    {{-- Their logos for the Service step icon: key => [logo, CDN fallback]. --}}
+    <script type="application/json" data-deploy-canvas-service-logos>@json($serviceLogos)</script>
+    <div data-deploy-canvas class="relative h-full" data-team="{{ $teamId }}" data-can-add="{{ $canAddProjects ? '1' : '0' }}" wire:ignore></div>
+    {{-- Opened by the canvas Reset button in resources/js/canvas/deploy/DeployCanvas.svelte.
+         Out of the page flow: its empty trigger line under the full-height canvas
+         made the page scroll, which moved the canvas panels up. --}}
+    <div class="absolute">
+        <x-modal-confirmation title="Reset the canvas?" submitAction="deploy-canvas-reset" dispatchAction
+            :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Reset"
+            warningMessage="Your steps and their settings are removed from the canvas. Resources that you already deployed stay in Coolify."
+            :actions="['Remove every step from the canvas.']">
+            <x-slot:trigger>
+                <button id="deploy-canvas-reset-trigger" type="button" class="hidden" aria-hidden="true"></button>
+            </x-slot:trigger>
+        </x-modal-confirmation>
+    </div>
+</div>
diff --git a/resources/views/livewire/deployments-indicator.blade.php b/resources/views/livewire/deployments-indicator.blade.php
index 95967096ba..ff1927e6aa 100644
--- a/resources/views/livewire/deployments-indicator.blade.php
+++ b/resources/views/livewire/deployments-indicator.blade.php
@@ -1,18 +1,19 @@
-{{-- Rendered twice: in the desktop sidebar footer and in the mobile top bar. `.visible` pauses
+{{-- Rendered twice: in the desktop top bar and in the mobile top bar. `.visible` pauses
      polling for the copy hidden by the current breakpoint (a display:none element has no box). --}}
 <div wire:poll.3000ms.visible x-data="{ expanded: false }" x-on:click.outside="expanded = false"
-    x-on:keydown.escape.window="expanded = false" @class(['relative' => $variant === 'sidebar'])>
-    @if ($this->deploymentCount > 0)
+    x-on:keydown.escape.window="expanded = false" @class(['relative' => $variant === 'topbar'])>
+    @if ($this->deploymentCount > 0 && ! $this->isOnlyCurrentApplicationDeploying)
         @php
             $deploymentLabel = $this->deploymentCount.' '.Str::plural('deployment', $this->deploymentCount);
         @endphp
-        {{-- Deployment list: opens beside the sidebar on desktop. On mobile the root is not positioned,
-             so the list anchors to the sticky top bar and spans its width. --}}
+        {{-- Deployment list: on desktop it opens below the button, aligned to its right edge.
+             On mobile the root is not positioned, so the list anchors to the sticky top bar
+             and spans its width. --}}
         <div x-show="expanded" x-cloak x-transition.opacity.duration.150ms
             @class([
-                'surface-popover absolute z-60 overflow-hidden rounded-xl',
-                'bottom-0 left-full ml-5 w-[22rem]' => $variant === 'sidebar',
-                'inset-x-4 top-full mt-2' => $variant === 'mobile',
+                'surface-popover absolute top-full z-60 mt-2 overflow-hidden rounded-xl',
+                'right-0 w-[22rem]' => $variant === 'topbar',
+                'inset-x-4' => $variant === 'mobile',
             ])>
             <div class="max-h-96 space-y-1 overflow-y-auto p-2 scrollbar">
                 @foreach ($this->deployments as $deployment)
@@ -69,38 +70,18 @@
                 @endforeach
             </div>
         </div>
-
-        @if ($variant === 'sidebar')
-            <button type="button" x-on:click="expanded = !expanded" title="{{ $deploymentLabel }}"
-                aria-label="Active deployments" :aria-expanded="expanded.toString()"
-                class="menu-item w-full text-left text-coollabs dark:text-warning"
-                :class="[collapsed && 'lg:justify-center lg:px-0', expanded && 'menu-item-active']">
-                <span class="relative inline-flex">
-                    <svg class="menu-item-icon animate-spin" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                        aria-hidden="true">
-                        <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-                        <path class="opacity-75" fill="currentColor"
-                            d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z">
-                        </path>
-                    </svg>
-                    <span x-show="collapsed" x-cloak
-                        class="absolute -right-1.5 -top-1.5 flex min-w-3.5 items-center justify-center rounded-full bg-coollabs px-1 text-[9px] font-semibold leading-3.5 text-white dark:bg-warning dark:text-black">{{ $this->deploymentCount }}</span>
-                </span>
-                <span class="menu-item-label" :class="collapsed && 'lg:hidden'">{{ $deploymentLabel }}</span>
-            </button>
-        @else
-            <button type="button" x-on:click="expanded = !expanded" title="{{ $deploymentLabel }}"
-                aria-label="Active deployments" :aria-expanded="expanded.toString()"
-                class="flex h-9 items-center gap-1.5 rounded-md px-2 text-[13px] font-medium text-coollabs transition-colors hover:bg-neutral-100 dark:text-warning dark:hover:bg-white/[0.06]">
-                <svg class="size-3.5 shrink-0 animate-spin" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                    aria-hidden="true">
-                    <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-                    <path class="opacity-75" fill="currentColor"
-                        d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z">
-                    </path>
-                </svg>
-                <span>{{ $this->deploymentCount }}</span>
-            </button>
-        @endif
+        <button type="button" x-on:click="expanded = !expanded" title="{{ $deploymentLabel }}"
+            aria-label="Active deployments" :aria-expanded="expanded.toString()"
+            :class="expanded && 'bg-neutral-100 dark:bg-white/[0.06]'"
+            class="flex h-9 items-center gap-1.5 rounded-md px-2 text-[13px] font-medium text-coollabs transition-colors hover:bg-neutral-100 dark:text-warning dark:hover:bg-white/[0.06]">
+            <svg class="size-3.5 shrink-0 animate-spin" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
+                aria-hidden="true">
+                <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+                <path class="opacity-75" fill="currentColor"
+                    d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z">
+                </path>
+            </svg>
+            <span>{{ $this->deploymentCount }}</span>
+        </button>
     @endif
 </div>
diff --git a/resources/views/livewire/destination/index.blade.php b/resources/views/livewire/destination/index.blade.php
index c5c97a4d0e..e9d1a46341 100644
--- a/resources/views/livewire/destination/index.blade.php
+++ b/resources/views/livewire/destination/index.blade.php
@@ -58,7 +58,7 @@
                 localStorage.setItem('coolify-destinations-view', mode);
             }
         }">
-            @include('livewire.shared.list-search-controls', ['placeholder' => 'Search destinations', 'singular' => 'destination', 'plural' => 'destinations'])
+            @include('livewire.shared.list-search-controls', ['placeholder' => 'Search destinations'])
 
         <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
             @foreach ($destinations as $destination)
diff --git a/resources/views/livewire/destination/sidebar.blade.php b/resources/views/livewire/destination/sidebar.blade.php
index b48717e247..2185785061 100644
--- a/resources/views/livewire/destination/sidebar.blade.php
+++ b/resources/views/livewire/destination/sidebar.blade.php
@@ -17,17 +17,19 @@
             'label' => 'Danger Zone',
             'route' => 'destination.danger',
             'active' => request()->routeIs('destination.danger'),
-            'icon' => 'shield-alert',
+            'icon' => 'danger',
         ],
     ])->filter();
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+<x-main-nav-menu back-label="Destinations" back-title="Back to Integrations"
     data-settings-search-items="{{ json_encode(settingsSearchItems(['Destination' => $destinationMenuItems], $destinationRouteParameters)) }}">
     <nav aria-label="Destination settings"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-        <div class="nav-section hidden xl:block">Settings</div>
         @foreach ($destinationMenuItems as $menuItem)
+            @if ($menuItem['label'] === 'Danger Zone')
+                <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
+            @endif
             <a wire:key="destination-settings-{{ str($menuItem['label'])->slug() }}"
                 @class(['menu-item', 'menu-item-active' => $menuItem['active']])
                 {{ wireNavigate() }} href="{{ route($menuItem['route'], $destinationRouteParameters) }}">
@@ -36,4 +38,4 @@
             </a>
         @endforeach
     </nav>
-</aside>
+</x-main-nav-menu>
diff --git a/resources/views/livewire/fleet/_usage-cell.blade.php b/resources/views/livewire/fleet/_usage-cell.blade.php
new file mode 100644
index 0000000000..4ef75c08be
--- /dev/null
+++ b/resources/views/livewire/fleet/_usage-cell.blade.php
@@ -0,0 +1,12 @@
+@php
+    $level = \App\Support\Metrics\PressureLevel::for($percent, $kind);
+    $width = $percent === null ? 0 : min(100, round($percent, 1));
+@endphp
+<div class="flex items-center gap-2">
+    <span class="tabular-nums {{ \App\Support\Metrics\PressureLevel::textClass($level) }}">
+        {{ $percent === null ? '-' : round($percent).'%' }}
+    </span>
+    <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
+        <div class="h-full rounded-full transition-[width] duration-700 ease-out {{ \App\Support\Metrics\PressureLevel::barClass($level) }}" style="width: {{ $width }}%;"></div>
+    </div>
+</div>
diff --git a/resources/views/livewire/fleet/metrics-placeholder.blade.php b/resources/views/livewire/fleet/metrics-placeholder.blade.php
new file mode 100644
index 0000000000..0ff339a199
--- /dev/null
+++ b/resources/views/livewire/fleet/metrics-placeholder.blade.php
@@ -0,0 +1,38 @@
+<div class="flex w-full min-w-0 flex-col gap-6">
+    {{-- Header (real chrome; only the data below is a skeleton) --}}
+    <div class="flex flex-col gap-4">
+        <div class="min-w-0">
+            <h1 class="min-w-0 text-[24px]! leading-7! font-semibold! tracking-tight!">Metrics</h1>
+            <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                Resource usage across every server, reported by Sentinel.
+            </p>
+        </div>
+
+        {{-- Filter bar --}}
+        <div class="flex flex-wrap items-center gap-2">
+            <x-skeleton class="h-9 w-full rounded-lg sm:w-52" />
+            <x-skeleton class="h-9 w-52 rounded-lg sm:ml-auto" />
+        </div>
+    </div>
+
+    <x-application.settings-section id="metrics-overview-section" title="Overview">
+        <x-skeleton.tiles :count="6" grid="grid-cols-2 sm:grid-cols-3 lg:grid-cols-6"
+            :labels="['Servers online', 'Fleet CPU', 'Fleet memory', 'Fleet disk', 'Fleet network', 'Containers']" />
+    </x-application.settings-section>
+
+    <div class="grid gap-6 lg:grid-cols-2">
+        @foreach (['CPU', 'Memory used', 'Network throughput', 'Load average', 'Disk usage'] as $label)
+            <x-application.settings-section :title="$label" @class(['lg:col-span-2' => $label === 'CPU'])>
+                <x-skeleton class="h-[240px] w-full rounded-lg" />
+            </x-application.settings-section>
+        @endforeach
+    </div>
+
+    <x-application.settings-section title="Servers" flush>
+        <x-skeleton.table :rows="4" flush />
+    </x-application.settings-section>
+
+    <x-application.settings-section title="Hottest containers" flush>
+        <x-skeleton.table :rows="6" flush />
+    </x-application.settings-section>
+</div>
diff --git a/resources/views/livewire/fleet/metrics.blade.php b/resources/views/livewire/fleet/metrics.blade.php
new file mode 100644
index 0000000000..79103f6de2
--- /dev/null
+++ b/resources/views/livewire/fleet/metrics.blade.php
@@ -0,0 +1,458 @@
+<?php
+$tabButtonBase = 'relative inline-flex h-7 items-center justify-center rounded-md px-2.5 text-[12px] font-medium transition-colors disabled:cursor-not-allowed disabled:opacity-40';
+$tabButtonActive = 'bg-white text-black shadow-sm ring-1 ring-neutral-200 dark:bg-white/[0.09] dark:text-fg dark:ring-white/[0.08]';
+$tabButtonInactive = 'text-neutral-500 hover:text-black dark:text-fg-faint dark:hover:text-fg';
+
+// Tiles read "Fleet …" across all servers, but just "CPU / Memory / …" when scoped to one.
+$scoped = $serverUuid !== '';
+
+$serverListboxOptions = array_merge(
+    [['value' => '', 'label' => 'All servers']],
+    collect($serverOptions)->map(fn ($name, $uuid) => ['value' => $uuid, 'label' => $name])->values()->all(),
+);
+?>
+<div class="flex w-full min-w-0 flex-col gap-6">
+    <x-slot:title>
+        Metrics | Coolify
+    </x-slot>
+
+    {{-- Header --}}
+    <div class="flex flex-col gap-4">
+        <div class="min-w-0">
+            <h1 class="min-w-0 text-[24px]! leading-7! font-semibold! tracking-tight!">Metrics</h1>
+            <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                Resource usage across every server, reported by Sentinel.
+            </p>
+        </div>
+
+        @if ($servers->isNotEmpty())
+            <div class="flex flex-wrap items-center gap-2">
+                <div class="relative w-full transition-opacity sm:w-52"
+                    wire:loading.class="pointer-events-none opacity-60" wire:target="serverUuid">
+                    <x-forms.listbox id="serverUuid" live :options="$serverListboxOptions" placeholder="All servers"
+                        canGate="view" :canResource="$servers->first()" />
+                    <div class="absolute inset-0 hidden items-center justify-center rounded-lg bg-white/70 dark:bg-base/70"
+                        wire:loading.flex wire:target="serverUuid">
+                        <x-loading compact aria-label="Loading metrics" />
+                    </div>
+                </div>
+
+                <div class="flex items-center gap-2 sm:ml-auto">
+                    @if ($range === '24h')
+                        <div x-data="{ live: $wire.entangle('live').live }"
+                            x-init="
+                                const stored = localStorage.getItem('metrics-live');
+                                if (stored === '0') { live = false; }
+                                if (stored === '1') { live = true; }
+                                $watch('live', value => localStorage.setItem('metrics-live', value ? '1' : '0'));
+                            ">
+                            <button type="button" @click="live = !live" :aria-pressed="live ? 'true' : 'false'"
+                                title="Toggle realtime refresh (updates every 60s)"
+                                class="inline-flex h-7 items-center gap-1.5 rounded-md px-2.5 text-[12px] font-medium ring-1 transition-colors"
+                                :class="live
+                                    ? 'bg-white text-black shadow-sm ring-neutral-200 dark:bg-white/[0.09] dark:text-fg dark:ring-white/[0.08]'
+                                    : 'text-neutral-500 ring-neutral-200 hover:text-black dark:text-fg-faint dark:ring-white/[0.08] dark:hover:text-fg'">
+                                <span class="relative flex h-1.5 w-1.5 shrink-0" aria-hidden="true">
+                                    <span x-show="live" class="absolute inline-flex h-full w-full rounded-full bg-emerald-500 opacity-75 motion-safe:animate-ping"></span>
+                                    <span class="relative inline-flex h-1.5 w-1.5 rounded-full" :class="live ? 'bg-emerald-500' : 'bg-neutral-400 dark:bg-white/40'"></span>
+                                </span>
+                                <span>Live Refresh</span>
+                            </button>
+                        </div>
+                    @endif
+                    <div class="inline-flex items-center gap-0.5 rounded-lg bg-neutral-100 p-1 dark:bg-white/[0.04]">
+                        @foreach (['24h' => '24 hours', '7d' => '7 days', '30d' => '30 days'] as $value => $label)
+                            <button type="button" wire:click="setRange('{{ $value }}')"
+                                wire:loading.attr="disabled" wire:target="setRange"
+                                @class([$tabButtonBase, $range === $value ? $tabButtonActive : $tabButtonInactive])>
+                                <span wire:loading.class="invisible" wire:target="setRange('{{ $value }}')">{{ $label }}</span>
+                                <x-loading compact class="absolute" wire:loading wire:target="setRange('{{ $value }}')" aria-label="Loading metrics" />
+                            </button>
+                        @endforeach
+                    </div>
+                </div>
+            </div>
+        @endif
+    </div>
+
+    @if ($this->isLivePollable())
+        <div wire:poll.60s="loadData" class="hidden"></div>
+    @endif
+
+    @if ($servers->isEmpty())
+        <x-empty size="sm" title="No server metrics yet"
+            description="{{ empty($enableableServers) ? 'Enable metrics on a server to see fleet resource usage here.' : 'Enable metrics to collect CPU, memory, disk, and network history. This starts Sentinel; your applications keep running.' }}"
+            icon-name="graph">
+            <x-slot:contents>
+                <div class="flex flex-wrap items-center justify-center gap-3">
+                    @if (! empty($enableableServers))
+                        <x-forms.button isHighlighted wire:click="enableMetrics">
+                            {{ count($enableableServers) === 1
+                                ? 'Enable metrics on '.\Illuminate\Support\Str::limit($enableableServers[0], 24)
+                                : 'Enable metrics on '.count($enableableServers).' servers' }}
+                        </x-forms.button>
+                    @endif
+                    <a class="button" href="{{ route('server.index') }}" {{ wireNavigate() }}>
+                        View servers
+                    </a>
+                </div>
+            </x-slot:contents>
+        </x-empty>
+    @else
+        {{-- Overview KPIs --}}
+        <x-application.settings-section id="metrics-overview-section" title="Overview"
+            helper="{{ $scoped ? 'Current resource usage for the selected server.' : 'Current resource usage across the selected servers.' }}">
+            <div class="grid grid-cols-2 gap-px overflow-hidden rounded-lg bg-neutral-200 sm:grid-cols-3 lg:grid-cols-6 dark:bg-white/[0.07]">
+                <div class="flex flex-col bg-[var(--coollabs-base)] px-4 py-3">
+                    <span class="text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">Servers online</span>
+                    <span class="mt-1 text-xl font-semibold tabular-nums text-black dark:text-fg">{{ $kpis['serversOnline'] ?? 0 }}<span class="text-neutral-400 dark:text-fg-faint">/{{ $kpis['serversTotal'] ?? 0 }}</span></span>
+                    @php
+                        $sTotal = max(1, (int) ($kpis['serversTotal'] ?? 0));
+                        $sOnline = (int) ($kpis['serversOnline'] ?? 0);
+                        $sAttention = min($sOnline, (int) ($kpis['needsAttention'] ?? 0));
+                        $sHealthy = max(0, $sOnline - $sAttention);
+                        $sOffline = max(0, $sTotal - $sOnline);
+                    @endphp
+                    <div class="mt-auto pt-3">
+                        <div class="flex h-9 flex-col justify-center gap-1.5">
+                            <div class="flex h-2 overflow-hidden rounded-full bg-neutral-200 dark:bg-white/[0.08] [&>div]:transition-[width] [&>div]:duration-700 [&>div]:ease-out">
+                                @if ($sHealthy > 0)<div class="bg-emerald-500" style="width: {{ $sHealthy / $sTotal * 100 }}%"></div>@endif
+                                @if ($sAttention > 0)<div class="bg-orange-400 dark:bg-warning" style="width: {{ $sAttention / $sTotal * 100 }}%"></div>@endif
+                                @if ($sOffline > 0)<div class="bg-red-500 dark:bg-red-400" style="width: {{ $sOffline / $sTotal * 100 }}%"></div>@endif
+                            </div>
+                            <div class="flex flex-wrap items-center gap-x-2 text-[10px] text-neutral-500 dark:text-fg-dim">
+                                <span>{{ $sHealthy }} healthy</span>
+                                @if ($sAttention > 0)<span class="text-orange-500 dark:text-warning">{{ $sAttention }} attention</span>@endif
+                                @if ($sOffline > 0)<span class="text-red-500 dark:text-red-400">{{ $sOffline }} offline</span>@endif
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="flex flex-col bg-[var(--coollabs-base)] px-4 py-3">
+                    <span class="flex items-center text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">
+                        {{ $scoped ? 'CPU' : 'Fleet CPU' }}
+                        @if ($kpis['cpuApproximate'] ?? false)
+                            <span class="ml-1.5 cursor-help text-neutral-400 dark:text-fg-faint" title="Averaged across servers; not core-weighted">~</span>
+                        @endif
+                    </span>
+                    <span class="mt-1 text-xl font-semibold tabular-nums text-black dark:text-fg">{{ round($kpis['cpuAvg'] ?? 0) }}%</span>
+                    <div class="mt-auto pt-3">
+                        @include('livewire.traffic._sparkline', [
+                            'id' => $chartId.'-spark-cpu',
+                            'initial' => $chartData['cpuSpark'] ?? [],
+                            'color' => '#3b82f6',
+                            'categories' => $chartData['sparkCategories'] ?? [],
+                            'event' => 'refreshChartData-'.$chartId,
+                            'key' => 'cpuSpark',
+                            'label' => $scoped ? 'CPU' : 'Fleet CPU',
+                            'format' => 'percent',
+                        ])
+                    </div>
+                </div>
+                <div class="flex flex-col bg-[var(--coollabs-base)] px-4 py-3">
+                    <span class="text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">{{ $scoped ? 'Memory' : 'Fleet memory' }}</span>
+                    <span class="mt-1 text-xl font-semibold tabular-nums text-black dark:text-fg">{{ round($kpis['memPercent'] ?? 0) }}%</span>
+                    <div class="mt-auto pt-3">
+                        @include('livewire.traffic._sparkline', [
+                            'id' => $chartId.'-spark-memory',
+                            'initial' => $chartData['memSpark'] ?? [],
+                            'color' => '#8b5cf6',
+                            'categories' => $chartData['sparkCategories'] ?? [],
+                            'event' => 'refreshChartData-'.$chartId,
+                            'key' => 'memSpark',
+                            'label' => 'Memory used',
+                            'format' => 'bytes',
+                        ])
+                    </div>
+                </div>
+                <div class="flex flex-col bg-[var(--coollabs-base)] px-4 py-3">
+                    <span class="text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">{{ $scoped ? 'Disk' : 'Fleet disk' }}</span>
+                    <span class="mt-1 text-xl font-semibold tabular-nums text-black dark:text-fg">{{ round($kpis['diskPercent'] ?? 0) }}%</span>
+                    <div class="mt-auto pt-3">
+                        @include('livewire.traffic._sparkline', [
+                            'id' => $chartId.'-spark-disk',
+                            'initial' => $chartData['diskSpark'] ?? [],
+                            'color' => '#ef4444',
+                            'categories' => $chartData['sparkCategories'] ?? [],
+                            'event' => 'refreshChartData-'.$chartId,
+                            'key' => 'diskSpark',
+                            'label' => $scoped ? 'Disk' : 'Fleet disk',
+                            'format' => 'percent',
+                        ])
+                    </div>
+                </div>
+                <div class="flex flex-col bg-[var(--coollabs-base)] px-4 py-3">
+                    <span class="text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">{{ $scoped ? 'Network' : 'Fleet network' }}</span>
+                    <span class="mt-1 text-xl font-semibold tabular-nums text-black dark:text-fg">{{ formatBytes(($kpis['netRx'] ?? 0) + ($kpis['netTx'] ?? 0)) }}/s</span>
+                    <div class="mt-auto pt-3">
+                        @include('livewire.traffic._sparkline', [
+                            'id' => $chartId.'-spark-network',
+                            'initial' => $chartData['netSpark'] ?? [],
+                            'color' => '#10b981',
+                            'categories' => $chartData['sparkCategories'] ?? [],
+                            'event' => 'refreshChartData-'.$chartId,
+                            'key' => 'netSpark',
+                            'label' => 'Network',
+                            'format' => 'bytes',
+                        ])
+                    </div>
+                </div>
+                <div class="col-span-2 flex flex-col bg-[var(--coollabs-base)] px-4 py-3 sm:col-span-1">
+                    <span class="text-[11px] font-medium tracking-wide text-neutral-500 uppercase dark:text-fg-dim">Containers</span>
+                    <span class="mt-1 text-xl font-semibold tabular-nums text-black dark:text-fg">{{ compactNumber($kpis['containers'] ?? 0) }}</span>
+                    <div class="mt-auto pt-3">
+                        <div class="flex h-9 flex-col justify-center">
+                            @if (! empty($topContainers))
+                                @php
+                                    $hottest = $this->containerMeta($topContainers[0]['id']);
+                                    $hottestValue = match ($containerMetric) {
+                                        'memory' => formatBytes($topContainers[0]['memUsed'] ?? 0),
+                                        'disk' => formatBytes($topContainers[0]['diskBytes'] ?? 0),
+                                        'network' => formatBytes($topContainers[0]['net'] ?? 0).'/s',
+                                        default => round($topContainers[0]['cpu'] ?? 0).'%',
+                                    };
+                                @endphp
+                                <span class="truncate text-[13px] font-medium text-black dark:text-fg">{{ $hottest['name'] }}</span>
+                                <span class="text-[10px] text-neutral-500 dark:text-fg-dim">hottest, {{ $hottestValue }}</span>
+                            @endif
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </x-application.settings-section>
+
+        {{-- Trend charts --}}
+        {{-- CPU is the primary triage signal, so it spans full width; the other four
+             fleet series fall into a clean 2x2 below (no orphaned cell). --}}
+        <div class="grid gap-6 lg:grid-cols-2">
+            @foreach (['cpu' => 'CPU', 'memory' => 'Memory used', 'network' => 'Network throughput', 'load' => 'Load average', 'disk' => 'Disk usage'] as $key => $label)
+                <x-application.settings-section :title="$label" @class(['lg:col-span-2' => $key === 'cpu'])>
+                    <div wire:ignore>
+                        <div id="fleet-chart-{{ $key }}" class="min-h-[240px] w-full"></div>
+                    </div>
+                </x-application.settings-section>
+            @endforeach
+        </div>
+
+        {{-- Servers table --}}
+        <x-application.settings-section id="metrics-servers-section" title="Servers" flush
+            helper="Per-server resource pressure. Select a column header to sort.">
+            <div class="data-table" x-data="trafficTable({ per: Number.MAX_SAFE_INTEGER, key: 'cpu' })">
+                <div class="data-table-header fleet-servers-table-grid border-b-0!">
+                    @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Server', 'text' => true, 'class' => 'justify-self-start'])
+                    @foreach (['cpu' => 'CPU', 'memory' => 'Memory', 'disk' => 'Disk', 'load' => 'Load', 'network' => 'Network'] as $column => $label)
+                        @include('livewire.traffic._sort-header', ['column' => $column, 'label' => $label, 'text' => true, 'dir' => 'desc', 'class' => 'justify-self-start'])
+                    @endforeach
+                    @include('livewire.traffic._sort-header', ['column' => 'containers', 'label' => 'Containers', 'class' => 'justify-self-end'])
+                </div>
+                <div class="flex flex-col">
+                    @foreach (collect($serverRows)->sortByDesc(fn ($r) => $r['cpu'] ?? -1) as $row)
+                        @php
+                            $memPercent = ($row['memTotal'] ?? 0) ? round($row['memUsed'] / $row['memTotal'] * 100, 1) : null;
+                            $sortValues = [
+                                'name' => $row['name'],
+                                'cpu' => $row['cpu'],
+                                'memory' => $memPercent,
+                                'disk' => $row['diskPercent'],
+                                'load' => $row['load1'],
+                                'network' => $row['netRx'] === null ? null : $row['netRx'] + $row['netTx'],
+                                'containers' => $row['containers'],
+                            ];
+                        @endphp
+                        {{-- Offline servers have no values, so they stay last in each sort. --}}
+                        <div wire:key="fleet-server-{{ $row['uuid'] }}" data-row="{{ json_encode($sortValues) }}" @unless ($row['online']) data-pinned @endunless
+                            x-show="shown($el)"
+                            class="data-table-row fleet-servers-table-grid border-t border-neutral-200 dark:border-white/[0.07]">
+                            <div class="flex min-w-0 items-center gap-2">
+                                <a href="{{ route('server.metrics', ['server_uuid' => $row['uuid']]) }}"
+                                    class="min-w-0 truncate text-[13px] font-medium text-black hover:underline dark:text-fg" {{ wireNavigate() }}>{{ $row['name'] }}</a>
+                                @unless ($row['online'])
+                                    <span class="table-badge table-badge-warning shrink-0">Offline</span>
+                                @endunless
+                            </div>
+                            <div>@include('livewire.fleet._usage-cell', ['percent' => $row['cpu'], 'kind' => 'cpu'])</div>
+                            <div>@include('livewire.fleet._usage-cell', ['percent' => $memPercent, 'kind' => 'memory'])</div>
+                            <div>@include('livewire.fleet._usage-cell', ['percent' => $row['diskPercent'], 'kind' => 'disk'])</div>
+                            <div class="text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['load1'] === null ? '-' : number_format($row['load1'], 2) }}</div>
+                            <div class="text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['netRx'] === null ? '-' : formatBytes($row['netRx'] + $row['netTx']).'/s' }}</div>
+                            <div class="text-right text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['containers'] ?? '-' }}</div>
+                        </div>
+                    @endforeach
+                </div>
+            </div>
+        </x-application.settings-section>
+
+        {{-- Hottest containers --}}
+        <x-application.settings-section id="metrics-containers-section" title="Hottest containers" flush
+            helper="{{ $scoped ? 'Busiest containers on this server, ranked by the selected metric.' : 'Busiest containers across the fleet, ranked by the selected metric.' }}">
+            <x-slot:actions>
+                <div class="flex items-center gap-2">
+                    <x-loading compact class="text-neutral-400 dark:text-fg-faint"
+                        wire:loading.flex wire:target="containerMetric" />
+                    <div class="inline-flex items-center gap-0.5 rounded-lg bg-neutral-100 p-1 dark:bg-white/[0.04]">
+                        @foreach (['cpu' => 'CPU', 'memory' => 'Memory', 'disk' => 'Disk', 'network' => 'Network'] as $m => $mlabel)
+                            <button type="button" wire:click="$set('containerMetric', '{{ $m }}')"
+                                wire:loading.attr="disabled" wire:target="containerMetric"
+                                @class([$tabButtonBase, $containerMetric === $m ? $tabButtonActive : $tabButtonInactive])>
+                                {{ $mlabel }}
+                            </button>
+                        @endforeach
+                    </div>
+                </div>
+            </x-slot:actions>
+            @if (empty($topContainers))
+                <div class="p-4">
+                    <x-empty size="sm" title="No container metrics"
+                        description="Container metrics need a Sentinel build with the bulk endpoints." />
+                </div>
+            @else
+                @php
+                    $metricOf = fn ($c) => match ($containerMetric) {
+                        'memory' => $c['memUsed'] ?? 0,
+                        'disk' => $c['diskBytes'] ?? 0,
+                        'network' => $c['net'] ?? 0,
+                        default => $c['cpu'] ?? 0,
+                    };
+                    // Bars are scaled to the leader so the row length reads as "share of the hottest".
+                    $maxMetric = max(1, collect($topContainers)->map($metricOf)->max());
+                @endphp
+                <div class="data-table transition-opacity" wire:loading.class="pointer-events-none opacity-50"
+                    wire:target="containerMetric" x-data="trafficTable({ per: Number.MAX_SAFE_INTEGER, key: 'value' })">
+                    <div class="data-table-header fleet-containers-table-grid border-b-0!">
+                        <span class="text-center">#</span>
+                        @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Container', 'text' => true, 'class' => 'justify-self-start'])
+                        @include('livewire.traffic._sort-header', ['column' => 'server', 'label' => 'Server', 'text' => true, 'class' => 'justify-self-start'])
+                        @include('livewire.traffic._sort-header', ['column' => 'value', 'label' => ['cpu' => 'CPU', 'memory' => 'Memory', 'disk' => 'Disk', 'network' => 'Network'][$containerMetric], 'class' => 'justify-self-end'])
+                    </div>
+                    <div class="flex flex-col">
+                        @foreach ($topContainers as $c)
+                            @php
+                                $meta = $this->containerMeta($c['id']);
+                                $pct = min(100, round($metricOf($c) / $maxMetric * 100, 1));
+                                $display = match ($containerMetric) {
+                                    'memory' => formatBytes($c['memUsed'] ?? 0),
+                                    'disk' => formatBytes($c['diskBytes'] ?? 0),
+                                    'network' => formatBytes($c['net'] ?? 0).'/s',
+                                    default => round($c['cpu'] ?? 0).'%',
+                                };
+                            @endphp
+                            <div wire:key="fleet-container-{{ $c['serverUuid'] ?? $c['server'] }}-{{ $c['id'] }}"
+                                data-row="{{ json_encode(['name' => $meta['name'], 'server' => $c['server'], 'value' => $metricOf($c)]) }}"
+                                x-show="shown($el)"
+                                class="data-table-row fleet-containers-table-grid border-t border-neutral-200 dark:border-white/[0.07]">
+                                <div class="self-center text-center text-[12px] tabular-nums text-neutral-400 dark:text-fg-faint">{{ $loop->iteration }}</div>
+                                <div class="flex min-w-0 flex-col">
+                                    @if ($meta['link'])
+                                        <a href="{{ $meta['link'] }}" class="truncate text-[13px] font-medium text-black hover:underline dark:text-fg" {{ wireNavigate() }}>{{ $meta['name'] }}</a>
+                                    @else
+                                        <span class="truncate text-[13px] font-medium text-black dark:text-fg">{{ $meta['name'] }}</span>
+                                    @endif
+                                    @if ($meta['image'])
+                                        <span class="truncate font-mono text-[11px] text-neutral-400 dark:text-fg-faint">{{ $meta['image'] }}</span>
+                                    @endif
+                                </div>
+                                <div class="min-w-0 self-center truncate text-[12px] text-neutral-500 dark:text-fg-dim">{{ $c['server'] }}</div>
+                                <div class="flex items-center justify-end gap-2.5 self-center">
+                                    <div class="hidden h-1.5 w-full max-w-[6rem] overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]"
+                                        title="{{ $pct }}% of the busiest">
+                                        <div class="h-full rounded-full bg-[var(--chart-status-3xx)] transition-[width] duration-700 ease-out" style="width: {{ $pct }}%"></div>
+                                    </div>
+                                    <span class="w-20 shrink-0 whitespace-nowrap text-right text-[13px] tabular-nums text-black dark:text-fg">{{ $display }}</span>
+                                </div>
+                            </div>
+                        @endforeach
+                    </div>
+                </div>
+            @endif
+        </x-application.settings-section>
+    @endif
+
+    @script
+        <script>
+            (() => {
+                // Defer to the next frame so the wire:ignore chart containers are laid out
+                // before ApexCharts measures them (a zero-size container renders blank).
+                requestAnimationFrame(() => {
+                if (typeof ApexCharts === 'undefined') { return; }
+                if (typeof checkTheme === 'function') { checkTheme(); }
+                const axisColor = (typeof textColor !== 'undefined') ? textColor : 'rgba(128,128,128,0.7)';
+
+                const fmtPercent = v => `${Number(Number(v).toFixed(1))}%`;
+                const fmtNumber = v => Number(Number(v).toFixed(2)).toLocaleString();
+                const fmtBytes = v => {
+                    const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+                    let amount = Number(v) || 0;
+                    let unit = 0;
+                    while (amount >= 1024 && unit < units.length - 1) { amount /= 1024; unit++; }
+                    return `${Number(amount.toFixed(unit === 0 ? 0 : 2))} ${units[unit]}`;
+                };
+                const fmtRate = v => `${fmtBytes(v)}/s`;
+
+                const fmtLocalTime = ts => new Date(ts).toLocaleString(undefined, { hour12: false, timeZoneName: 'short' });
+                const fmtUtcTime = ts => new Date(ts).toLocaleString(undefined, { hour12: false, timeZone: 'UTC', timeZoneName: 'short' });
+
+                // The app strips the default ApexCharts tooltip background (utilities.css), so
+                // every chart must render its own `apexcharts-tooltip-custom` markup.
+                const customTooltip = formatter => ({ series, dataPointIndex, w }) => {
+                    const timestamp = w.globals.seriesX[0]?.[dataPointIndex];
+                    let rows = '';
+                    series.forEach((s, i) => {
+                        const value = s[dataPointIndex];
+                        if (value === null || value === undefined) { return; }
+                        rows += `<div class="apexcharts-tooltip-custom-value">${w.globals.seriesNames[i]}: <span class="apexcharts-tooltip-value-bold">${formatter(value)}</span></div>`;
+                    });
+                    return `<div class="apexcharts-tooltip-custom">${rows}
+                        <div class="apexcharts-tooltip-custom-title">Your time: ${fmtLocalTime(timestamp)}</div>
+                        <div class="apexcharts-tooltip-custom-title">UTC: ${fmtUtcTime(timestamp)}</div>
+                    </div>`;
+                };
+
+                const baseOptions = (series, colors, formatter) => ({
+                    chart: { height: 240, type: 'area', toolbar: { show: false }, zoom: { enabled: false }, background: 'transparent', animations: { enabled: true } },
+                    series,
+                    colors,
+                    stroke: { curve: 'smooth', width: 2 },
+                    fill: { type: 'gradient', gradient: { opacityFrom: 0.28, opacityTo: 0.02, stops: [0, 90, 100] } },
+                    dataLabels: { enabled: false },
+                    grid: { borderColor: 'rgba(128, 128, 128, 0.14)', strokeDashArray: 4 },
+                    legend: { show: series.length > 1, labels: { colors: axisColor } },
+                    xaxis: { type: 'datetime', labels: { datetimeUTC: true, style: { colors: axisColor } } },
+                    yaxis: { min: 0, max: max => max > 0 ? max * 1.2 : 1, forceNiceScale: true, tickAmount: 4, labels: { style: { colors: axisColor }, formatter } },
+                    noData: { text: 'No data for this range', style: { color: axisColor } },
+                    tooltip: { shared: true, intersect: false, marker: { show: false }, custom: customTooltip(formatter) },
+                });
+
+                const initial = @js($chartData);
+
+                const build = data => ({
+                    cpu: { series: [{ name: 'CPU %', data: data.cpu || [] }], colors: ['#3b82f6'], formatter: fmtPercent },
+                    memory: { series: [{ name: 'Memory', data: data.memory || [] }], colors: ['#8b5cf6'], formatter: fmtBytes },
+                    network: { series: [{ name: 'RX', data: data.networkRx || [] }, { name: 'TX', data: data.networkTx || [] }], colors: ['#10b981', '#f59e0b'], formatter: fmtRate },
+                    load: { series: [{ name: 'Load', data: data.load || [] }], colors: ['#14b8a6'], formatter: fmtNumber },
+                    disk: { series: [{ name: 'Disk %', data: data.disk || [] }], colors: ['#ef4444'], formatter: fmtPercent },
+                });
+
+                const charts = {};
+                const specs = build(initial || {});
+                for (const [key, spec] of Object.entries(specs)) {
+                    const el = document.getElementById(`fleet-chart-${key}`);
+                    if (! el) { continue; }
+                    const chart = new ApexCharts(el, baseOptions(spec.series, spec.colors, spec.formatter));
+                    chart.render();
+                    charts[key] = chart;
+                }
+
+                Livewire.on('refreshChartData-{!! $chartId !!}', payload => {
+                    if (typeof checkTheme === 'function') { checkTheme(); }
+                    const data = Array.isArray(payload) ? payload[0] : payload;
+                    if (! data) { return; }
+                    const next = build(data);
+                    for (const [key, chart] of Object.entries(charts)) {
+                        chart.updateSeries(next[key].series);
+                    }
+                });
+                });
+            })();
+        </script>
+    @endscript
+</div>
diff --git a/resources/views/livewire/global-search.blade.php b/resources/views/livewire/global-search.blade.php
index a38380f603..e429177bb9 100644
--- a/resources/views/livewire/global-search.blade.php
+++ b/resources/views/livewire/global-search.blade.php
@@ -252,7 +252,7 @@
             const exactMatchCommands = [
                 'new project', 'new server', 'new team', 'new storage', 'new s3',
                 'new private key', 'new privatekey', 'new key',
-                'new github app', 'new github', 'new source',
+                'new github app', 'new github', 'new source', 'new canvas',
                 'new public', 'new public git', 'new public repo', 'new public repository',
                 'new private github', 'new private gh', 'new private deploy', 'new deploy key',
                 'new dockerfile', 'new docker compose', 'new compose', 'new docker image', 'new image',
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index fdc2ac672a..81302b1806 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -176,6 +176,12 @@
                             ['property' => 'traefikOutdatedEmailNotifications', 'label' => 'Traefik proxy outdated', 'enabled' => $traefikOutdatedEmailNotifications],
                         ]" />
                 </div>
+                <div class="mt-4">
+                    <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSaveDeploymentCommitDetails"
+                        id="deploymentCommitDetailsEmailNotifications"
+                        label="Include commit details in deployment emails"
+                        helper="Adds the commit SHA, branch, and commit message to deployment success and failure emails." />
+                </div>
             </x-application.settings-section>
         </div>
     </div>
diff --git a/resources/views/livewire/profile/index.blade.php b/resources/views/livewire/profile/index.blade.php
index 1c77a2d70e..33a072a6af 100644
--- a/resources/views/livewire/profile/index.blade.php
+++ b/resources/views/livewire/profile/index.blade.php
@@ -8,117 +8,6 @@
     @close-email-change-modal.window="emailModalOpen = false">
     <x-slot:title>Profile | Coolify</x-slot>
     <div class="mt-8 flex w-full max-w-none flex-col gap-6 lg:mt-3">
-        <section class="application-settings-section" x-data="{
-            preview: null,
-            processing: false,
-            uploadError: null,
-            async prepareAvatar(event) {
-                const file = event.target.files?.[0];
-                if (!file) return;
-                this.processing = true;
-                this.uploadError = null;
-
-                try {
-                    const dataUrl = await new Promise((resolve, reject) => {
-                        const reader = new FileReader();
-                        reader.onload = () => resolve(reader.result);
-                        reader.onerror = reject;
-                        reader.readAsDataURL(file);
-                    });
-                    const image = await new Promise((resolve, reject) => {
-                        const element = new Image();
-                        element.onload = () => resolve(element);
-                        element.onerror = reject;
-                        element.src = dataUrl;
-                    });
-                    const cropSize = Math.min(image.naturalWidth, image.naturalHeight);
-                    const canvas = document.createElement('canvas');
-                    canvas.width = 256;
-                    canvas.height = 256;
-                    const context = canvas.getContext('2d');
-                    context.fillStyle = '#ffffff';
-                    context.fillRect(0, 0, 256, 256);
-                    context.drawImage(
-                        image,
-                        (image.naturalWidth - cropSize) / 2,
-                        (image.naturalHeight - cropSize) / 2,
-                        cropSize,
-                        cropSize,
-                        0,
-                        0,
-                        256,
-                        256,
-                    );
-                    const blob = await new Promise((resolve, reject) => {
-                        canvas.toBlob(value => value ? resolve(value) : reject(new Error('JPEG compression failed')), 'image/jpeg', 0.8);
-                    });
-                    const previewUrl = URL.createObjectURL(blob);
-                    const compressed = new File([blob], 'avatar.jpg', { type: 'image/jpeg' });
-                    this.$wire.upload('avatar', compressed, async () => {
-                        try {
-                            const uploaded = await this.$wire.uploadAvatar();
-                            if (uploaded) {
-                                if (this.preview) URL.revokeObjectURL(this.preview);
-                                this.preview = previewUrl;
-                            } else {
-                                URL.revokeObjectURL(previewUrl);
-                            }
-                        } catch (error) {
-                            URL.revokeObjectURL(previewUrl);
-                            this.uploadError = 'The image could not be uploaded.';
-                        } finally {
-                            this.processing = false;
-                        }
-                    }, () => {
-                        URL.revokeObjectURL(previewUrl);
-                        this.processing = false;
-                        this.uploadError = 'The image could not be uploaded.';
-                    });
-                } catch (error) {
-                    this.processing = false;
-                    this.uploadError = 'The image could not be processed in this browser.';
-                }
-            },
-        }">
-            <div class="application-settings-section-header">
-                <div>
-                    <h2>Profile picture</h2>
-                    <p>Upload a JPG, PNG, or WebP image.</p>
-                </div>
-            </div>
-            <div class="application-settings-section-body flex flex-col gap-4 sm:flex-row sm:items-center">
-                <div class="flex size-20 shrink-0 items-center justify-center overflow-hidden rounded-full bg-neutral-200 text-2xl font-semibold text-neutral-700 dark:bg-white/[0.1] dark:text-fg">
-                    <img x-cloak x-show="preview" :src="preview" alt="Profile picture preview"
-                        class="h-full w-full object-cover">
-                    @if (auth()->user()->avatar_path)
-                        <img src="{{ profile_avatar_url(auth()->user()) }}"
-                            x-show="!preview" alt="{{ auth()->user()->name }}" class="h-full w-full object-cover">
-                    @else
-                        <span x-show="!preview">
-                            {{ strtoupper(mb_substr(auth()->user()->name ?: auth()->user()->email, 0, 1)) }}
-                        </span>
-                    @endif
-                </div>
-                <div class="flex min-w-0 flex-1 flex-col gap-3">
-                    <div class="flex flex-wrap items-center gap-2">
-                        <input x-ref="avatarInput" type="file" x-on:change="prepareAvatar($event)"
-                            accept="image/jpeg,image/png,image/webp" class="hidden">
-                        <x-forms.button type="button" x-on:click="$refs.avatarInput.click()"
-                            x-bind:disabled="processing">
-                            <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
-                        </x-forms.button>
-                        @if (auth()->user()->avatar_path)
-                            <x-forms.button type="button" wire:click="removeAvatar" x-bind:disabled="processing"
-                                isError>Remove</x-forms.button>
-                        @endif
-                    </div>
-                    <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
-                    @error('avatar')
-                        <p class="text-xs text-red-500">{{ $message }}</p>
-                    @enderror
-                </div>
-            </div>
-        </section>
 
         <form wire:submit="submit">
             <x-unsaved-bar action="submit" />
@@ -126,10 +15,117 @@
                 <div class="application-settings-section-header">
                     <div>
                         <h2>Profile details</h2>
-                        <p>Your display name and verified sign-in address.</p>
+                        <p>Your avatar, display name, and verified sign-in address.</p>
                     </div>
                 </div>
                 <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
+                    <div class="sm:col-span-2" x-data="{
+                        preview: null,
+                        processing: false,
+                        uploadError: null,
+                        async prepareAvatar(event) {
+                            const file = event.target.files?.[0];
+                            if (!file) return;
+                            this.processing = true;
+                            this.uploadError = null;
+
+                            try {
+                                const dataUrl = await new Promise((resolve, reject) => {
+                                    const reader = new FileReader();
+                                    reader.onload = () => resolve(reader.result);
+                                    reader.onerror = reject;
+                                    reader.readAsDataURL(file);
+                                });
+                                const image = await new Promise((resolve, reject) => {
+                                    const element = new Image();
+                                    element.onload = () => resolve(element);
+                                    element.onerror = reject;
+                                    element.src = dataUrl;
+                                });
+                                const cropSize = Math.min(image.naturalWidth, image.naturalHeight);
+                                const canvas = document.createElement('canvas');
+                                canvas.width = 256;
+                                canvas.height = 256;
+                                const context = canvas.getContext('2d');
+                                context.fillStyle = '#ffffff';
+                                context.fillRect(0, 0, 256, 256);
+                                context.drawImage(
+                                    image,
+                                    (image.naturalWidth - cropSize) / 2,
+                                    (image.naturalHeight - cropSize) / 2,
+                                    cropSize,
+                                    cropSize,
+                                    0,
+                                    0,
+                                    256,
+                                    256,
+                                );
+                                const blob = await new Promise((resolve, reject) => {
+                                    canvas.toBlob(value => value ? resolve(value) : reject(new Error('JPEG compression failed')), 'image/jpeg', 0.8);
+                                });
+                                const previewUrl = URL.createObjectURL(blob);
+                                const compressed = new File([blob], 'avatar.jpg', { type: 'image/jpeg' });
+                                this.$wire.upload('avatar', compressed, async () => {
+                                    try {
+                                        const uploaded = await this.$wire.uploadAvatar();
+                                        if (uploaded) {
+                                            if (this.preview) URL.revokeObjectURL(this.preview);
+                                            this.preview = previewUrl;
+                                        } else {
+                                            URL.revokeObjectURL(previewUrl);
+                                        }
+                                    } catch (error) {
+                                        URL.revokeObjectURL(previewUrl);
+                                        this.uploadError = 'The image could not be uploaded.';
+                                    } finally {
+                                        this.processing = false;
+                                    }
+                                }, () => {
+                                    URL.revokeObjectURL(previewUrl);
+                                    this.processing = false;
+                                    this.uploadError = 'The image could not be uploaded.';
+                                });
+                            } catch (error) {
+                                this.processing = false;
+                                this.uploadError = 'The image could not be processed in this browser.';
+                            }
+                        },
+                    }">
+                        <div class="mb-2 text-sm font-medium leading-4">Avatar</div>
+                        <div class="flex items-center gap-4">
+                            <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl bg-neutral-200 text-2xl font-semibold text-neutral-700 dark:bg-white/[0.1] dark:text-fg">
+                                <img x-cloak x-show="preview" :src="preview" alt="Profile picture preview"
+                                    class="h-full w-full object-cover">
+                                @if (auth()->user()->avatar_path)
+                                    <img src="{{ profile_avatar_url(auth()->user()) }}"
+                                        x-show="!preview" alt="{{ auth()->user()->name }}" class="h-full w-full object-cover">
+                                @else
+                                    <span x-show="!preview">
+                                        {{ strtoupper(mb_substr(auth()->user()->name ?: auth()->user()->email, 0, 1)) }}
+                                    </span>
+                                @endif
+                            </div>
+                            <div class="flex min-w-0 flex-1 flex-col gap-2">
+                                <div class="flex flex-wrap gap-2">
+                                    <input x-ref="avatarInput" type="file" x-on:change="prepareAvatar($event)"
+                                        accept="image/jpeg,image/png,image/webp" class="hidden">
+                                    <x-forms.button type="button" x-on:click="$refs.avatarInput.click()"
+                                        x-bind:disabled="processing">
+                                        <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
+                                    </x-forms.button>
+                                    @if (auth()->user()->avatar_path)
+                                        <x-forms.button type="button" wire:click="removeAvatar" x-bind:disabled="processing"
+                                            isError>Remove</x-forms.button>
+                                    @endif
+                                </div>
+                                <p class="text-xs text-neutral-500 dark:text-fg-dim">JPG, PNG, or WebP. Shown in the user menu and team member lists.</p>
+                                <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
+                                @error('avatar')
+                                    <p class="text-xs text-red-500">{{ $message }}</p>
+                                @enderror
+                            </div>
+                        </div>
+                    </div>
                     <x-forms.input id="name" label="Name" required />
                     <div class="flex items-end gap-2">
                         <x-forms.input id="email" label="Email" readonly />
@@ -300,6 +296,8 @@
             </div>
         </section>
 
+        <livewire:profile.passkeys />
+
         <section class="application-settings-section">
             <div class="application-settings-section-header">
                 <div>
diff --git a/resources/views/livewire/profile/passkeys.blade.php b/resources/views/livewire/profile/passkeys.blade.php
new file mode 100644
index 0000000000..86df71597d
--- /dev/null
+++ b/resources/views/livewire/profile/passkeys.blade.php
@@ -0,0 +1,104 @@
+<div>
+    @if ($enabled)
+        @assets
+            @vite('resources/js/passkeys.js')
+        @endassets
+        <section class="application-settings-section">
+            <div class="application-settings-section-header">
+                <div>
+                    <h2>Passkeys</h2>
+                    <p>Sign in with your fingerprint, face, or a security key. A passkey sign-in skips two-factor authentication.</p>
+                </div>
+                @if ($available && ! $show_form)
+                    <a class="button" href="{{ route('profile.passkeys.confirm') }}">Add passkey</a>
+                @endif
+            </div>
+            <div class="application-settings-section-body flex flex-col gap-4">
+                @unless ($available)
+                    <x-callout type="info" title="Passkeys are not available on this address">
+                        Passkeys need HTTPS on the instance domain, or <code>localhost</code>. An IP address does not work.
+                    </x-callout>
+                @endunless
+
+                @if ($available && $show_form)
+                    <form class="flex flex-col gap-2" x-data="{
+                            name: '',
+                            loading: false,
+                            error: null,
+                            init() {
+                                const ready = () => { this.name = this.name || window.passkeyDeviceName(); };
+                                window.Passkeys ? ready() : window.addEventListener('passkeys:ready', ready, { once: true });
+                            },
+                            async register() {
+                                this.loading = true;
+                                this.error = null;
+                                try {
+                                    if (!window.Passkeys?.isSupported()) {
+                                        throw new Error('This browser does not support passkeys.');
+                                    }
+                                    await window.Passkeys.register({ name: this.name });
+                                    await $wire.registered();
+                                } catch (e) {
+                                    if (e.name !== 'UserCancelledError') {
+                                        this.error = e.message;
+                                    }
+                                } finally {
+                                    this.loading = false;
+                                }
+                            },
+                        }" x-on:submit.prevent="register()">
+                        <div class="flex items-end gap-2">
+                            <x-forms.input x-model="name" label="Passkey name" required maxlength="255" />
+                            <x-forms.button type="submit" isHighlighted x-bind:disabled="loading">Create passkey</x-forms.button>
+                            <x-forms.button type="button" wire:click="$set('show_form', false)">Cancel</x-forms.button>
+                        </div>
+                        <p x-cloak x-show="error" x-text="error" class="text-sm text-error"></p>
+                    </form>
+                @endif
+
+                @forelse ($passkeys as $passkey)
+                    <div wire:key="passkey-{{ $passkey->id }}"
+                        class="flex flex-wrap items-center justify-between gap-3 rounded-lg border border-neutral-200 p-3 dark:border-white/[0.07]"
+                        x-data="{ editing: false, name: @js($passkey->name), saved: @js($passkey->name) }">
+                        <div class="min-w-0">
+                            <div x-show="!editing" class="text-sm font-semibold text-black dark:text-fg">{{ $passkey->name }}</div>
+                            <form x-cloak x-show="editing" class="flex items-end gap-2"
+                                x-on:submit.prevent="$wire.rename({{ $passkey->id }}, name).then(ok => { if (ok) { saved = name; editing = false; } })">
+                                <x-forms.input x-model="name" required maxlength="255" aria-label="Passkey name" />
+                                <x-forms.button type="submit">Save</x-forms.button>
+                            </form>
+                            <p class="mt-1 text-xs text-neutral-500 dark:text-fg-dim">
+                                {{ $passkey->authenticator ?? 'Passkey' }}
+                                · Added {{ $passkey->created_at->diffForHumans() }}
+                                · {{ $passkey->last_used_at ? 'Last used '.$passkey->last_used_at->diffForHumans() : 'Not used yet' }}
+                            </p>
+                        </div>
+                        <div class="flex items-center gap-2">
+                            <x-forms.button type="button" x-on:click="editing = !editing; name = saved">
+                                <span x-text="editing ? 'Cancel' : 'Rename'"></span>
+                            </x-forms.button>
+                            <div wire:key="passkey-delete-{{ $passkey->id }}-{{ md5($passkey->name) }}">
+                                <x-modal-confirmation title="Delete passkey?" buttonTitle="Delete" isErrorButton
+                                    submitAction="delete({{ $passkey->id }})"
+                                    :actions="['You cannot sign in with this passkey after it is deleted.']"
+                                    confirmationText="{{ $passkey->name }}"
+                                    confirmationLabel="Enter the passkey name to confirm"
+                                    shortConfirmationLabel="Passkey name" step3ButtonText="Delete passkey" />
+                            </div>
+                        </div>
+                    </div>
+                @empty
+                    @if ($available && ! $show_form)
+                        <x-empty size="sm" title="No passkeys"
+                            description="Add a passkey to sign in without your password."
+                            icon-name="keys" />
+                    @endif
+                @endforelse
+
+                @error('name')
+                    <p class="text-sm text-error">{{ $message }}</p>
+                @enderror
+            </div>
+        </section>
+    @endif
+</div>
diff --git a/resources/views/livewire/project/application/advanced.blade.php b/resources/views/livewire/project/application/advanced.blade.php
index c5e5aa89c3..9ce4bc1ae9 100644
--- a/resources/views/livewire/project/application/advanced.blade.php
+++ b/resources/views/livewire/project/application/advanced.blade.php
@@ -203,6 +203,30 @@
         @if ($application->build_pack !== 'dockercompose')
             <x-application.settings-section id="advanced-gpu-section" title="GPU"
                 helper="Give this application access to the host's GPUs. More info <a href='https://docs.docker.com/compose/gpu-support/' class='underline dark:text-white' target='_blank'>here</a>.">
+                <x-slot:actions>
+                    @php($canRefreshGpus = $gpuServers->contains(fn ($gpuServer) => $gpuServer->isFunctional()))
+                    <x-forms.button type="button" wire:click="refreshGpus" canGate="update"
+                        :canResource="$gpuServers->first()" :disabled="! $canRefreshGpus"
+                        :tooltip="$canRefreshGpus ? null : 'Validate the server connection first.'">
+                        <x-reicon name="refresh" class="size-3.5" />
+                        Refresh GPUs
+                    </x-forms.button>
+                </x-slot:actions>
+                <x-callout type="info" title="Detected GPUs" class="mb-5">
+                    @foreach ($gpuServers as $gpuServer)
+                        <div wire:key="gpu-server-{{ $gpuServer->id }}" @class(['mt-2' => ! $loop->first])>
+                            <p class="font-medium text-neutral-700 dark:text-fg">
+                                <a href="{{ route('server.show', ['server_uuid' => $gpuServer->uuid]) }}"
+                                    class="underline">{{ $gpuServer->name }}</a>
+                                @if (data_get($gpuServer->server_metadata, 'collected_at'))
+                                    <span class="font-normal text-neutral-500 dark:text-fg-dim">· checked
+                                        {{ \Illuminate\Support\Carbon::parse(data_get($gpuServer->server_metadata, 'collected_at'))->diffForHumans() }}</span>
+                                @endif
+                            </p>
+                            <x-server.gpu-list :server="$gpuServer" />
+                        </div>
+                    @endforeach
+                </x-callout>
                 <div class="grid w-full gap-4 sm:grid-cols-2">
                     <x-forms.listbox id="isGpuEnabled" label="GPU access" onChange="instantSave"
                         :options="[
@@ -218,13 +242,14 @@
                             targets="gpuDriver,gpuCount,gpuDeviceIds,gpuOptions" />
                         <div class="grid gap-4 sm:grid-cols-2">
                             <x-forms.input label="GPU driver" id="gpuDriver" canGate="update" :canResource="$application" />
-                            <x-forms.input label="GPU count" placeholder="Empty means use all GPUs" id="gpuCount"
+                            <x-forms.input label="GPU count" placeholder="Empty means use all GPUs" helper="A number, or all." id="gpuCount"
                                 canGate="update" :canResource="$application" />
                         </div>
                         <x-forms.input label="GPU device ids" placeholder="0,2"
                             helper="Comma separated list of device ids. More info <a href='https://docs.docker.com/compose/gpu-support/#access-specific-devices' class='underline dark:text-white' target='_blank'>here</a>."
                             id="gpuDeviceIds" canGate="update" :canResource="$application" />
-                        <x-forms.textarea rows="6" label="GPU options" id="gpuOptions" canGate="update"
+                        <x-forms.textarea rows="6" label="GPU options" id="gpuOptions" placeholder="key=value"
+                            helper="Driver options. Use one key=value pair per line, or a YAML mapping." canGate="update"
                             :canResource="$application" />
                     </form>
                 @endif
diff --git a/resources/views/livewire/project/application/analytics-placeholder.blade.php b/resources/views/livewire/project/application/analytics-placeholder.blade.php
index 1cb6cffc70..6c8df5d82c 100644
--- a/resources/views/livewire/project/application/analytics-placeholder.blade.php
+++ b/resources/views/livewire/project/application/analytics-placeholder.blade.php
@@ -25,8 +25,16 @@
         <x-skeleton.table :rows="6" flush />
     </x-application.settings-section>
 
-    <x-application.settings-section id="analytics-country-section" title="Countries" flush>
-        <x-skeleton class="h-64 w-full" />
+    <x-application.settings-section id="analytics-country-section" title="Locations" flush>
+        <x-slot:actions>
+            <x-skeleton class="h-9 w-36 rounded-lg" />
+        </x-slot:actions>
+        <div class="grid grid-cols-1 items-start gap-4 p-4 lg:grid-cols-[2fr_3fr]">
+            <div class="flex items-center justify-center">
+                <x-skeleton class="aspect-square w-full max-w-[320px] rounded-full" />
+            </div>
+            <x-skeleton.table :rows="7" flush />
+        </div>
     </x-application.settings-section>
 
     <div class="grid grid-cols-1 gap-6 lg:grid-cols-2">
diff --git a/resources/views/livewire/project/application/analytics.blade.php b/resources/views/livewire/project/application/analytics.blade.php
index b2458f4cf8..53c09e5629 100644
--- a/resources/views/livewire/project/application/analytics.blade.php
+++ b/resources/views/livewire/project/application/analytics.blade.php
@@ -157,13 +157,11 @@ $approxBadge = fn (string $tooltip) => '<span title="'.e($tooltip).'" class="ml-
             @include('livewire.traffic._paths-list', ['paths' => $topPaths])
         </x-application.settings-section>
 
-        <x-application.settings-section id="analytics-country-section" title="Countries"
-            helper="Request volume by visitor country for the selected range." flush>
-            @include('livewire.traffic._geo', [
-                'countries' => data_get($breakdowns, 'country', []),
-                'attribution' => $attribution,
-            ])
-        </x-application.settings-section>
+        @include('livewire.traffic._geo', [
+            'countries' => data_get($breakdowns, 'country', []),
+            'cities' => trafficCityRows(data_get($breakdowns, 'city', [])),
+            'attribution' => $attribution,
+        ])
 
         {{-- Requests by device type (donut) + HTTP versions / cache / status. --}}
         <div class="grid grid-cols-1 gap-6 lg:grid-cols-2">
diff --git a/resources/views/livewire/project/application/backup/index.blade.php b/resources/views/livewire/project/application/backup/index.blade.php
index f842ce95d0..bab72d8ec4 100644
--- a/resources/views/livewire/project/application/backup/index.blade.php
+++ b/resources/views/livewire/project/application/backup/index.blade.php
@@ -181,6 +181,7 @@
                         @foreach ($backups as $backup)
                             @php
                                 $latestExecution = $backup->latestExecution;
+                                $s3StorageNames = ($backup->s3Storages->isNotEmpty() ? $backup->s3Storages : collect([$backup->s3])->filter())->pluck('name');
                                 $status = $latestExecution?->status;
                                 $statusLabel = match ($status) {
                                     'running' => 'In progress',
@@ -208,9 +209,9 @@
                                 <span>{{ $backup->targetType() }}</span>
                                 <span>{{ $backup->frequency }}</span>
                                 <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
-                                <span title="{{ $backup->save_s3 ? ($backup->s3?->name ?? 'S3 storage unavailable') : 'S3 storage is not configured' }}">
-                                    <x-status-badge :status="$backup->save_s3 ? ($backup->s3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                        :type="$backup->save_s3 ? ($backup->s3 ? 'success' : 'error') : 'neutral'" />
+                                <span title="{{ $backup->save_s3 ? ($s3StorageNames->isNotEmpty() ? $s3StorageNames->join(', ') : 'S3 storage unavailable') : 'S3 storage is not configured' }}">
+                                    <x-status-badge :status="$backup->save_s3 ? match ($s3StorageNames->count()) { 0 => 'Unavailable', 1 => 'Configured', default => $s3StorageNames->count().' storages' } : 'Not set'"
+                                        :type="$backup->save_s3 ? ($s3StorageNames->isNotEmpty() ? 'success' : 'error') : 'neutral'" />
                                 </span>
                                 <span>
                                     {{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}
diff --git a/resources/views/livewire/project/application/backup/show.blade.php b/resources/views/livewire/project/application/backup/show.blade.php
index 982160794d..0b9b31bfb6 100644
--- a/resources/views/livewire/project/application/backup/show.blade.php
+++ b/resources/views/livewire/project/application/backup/show.blade.php
@@ -7,11 +7,14 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            {{-- The application menu, one Back away from the backup menu in the main sidebar. --}}
+            <x-application.configuration-sidebar :application="$application"
+                current-route="project.application.backup.index" nav-only />
             <x-backup-sidebar context="application" :parameters="$parameters" :section="$section" />
 
             <div class="min-w-0">
                 <livewire:project.shared.storages.volume-backups :storage="$backup->backupable"
-                    :resource="$application" :section="$section"
+                    :resource="$application" :section="$section" :actions-in-header="true"
                     wire:key="volume-backup-{{ $backup->uuid }}-{{ $section }}" />
             </div>
         </div>
diff --git a/resources/views/livewire/project/application/configuration.blade.php b/resources/views/livewire/project/application/configuration.blade.php
index 11d6400bf6..e223ed8123 100644
--- a/resources/views/livewire/project/application/configuration.blade.php
+++ b/resources/views/livewire/project/application/configuration.blade.php
@@ -14,6 +14,7 @@
                 <livewire:project.application.general :application="$application" />
             @elseif ($currentRoute === 'project.application.domains')
                 <livewire:project.application.domains :application="$application" />
+                <livewire:project.shared.maintenance :resource="$application" />
             @elseif ($currentRoute === 'project.application.swarm' && $application->destination->server->isSwarm())
                 <livewire:project.application.swarm :application="$application" />
             @elseif ($currentRoute === 'project.application.advanced')
@@ -29,8 +30,6 @@
                 <livewire:project.shared.destination :resource="$application" />
             @elseif ($currentRoute === 'project.application.scheduled-tasks.show')
                 <livewire:project.shared.scheduled-task.all :resource="$application" />
-            @elseif ($currentRoute === 'project.application.scheduled-tasks')
-                <livewire:project.shared.scheduled-task.show />
             @elseif ($currentRoute === 'project.application.webhooks')
                 <livewire:project.shared.webhooks :resource="$application" />
             @elseif ($currentRoute === 'project.application.preview-deployments')
diff --git a/resources/views/livewire/project/application/deployment/index.blade.php b/resources/views/livewire/project/application/deployment/index.blade.php
index bfee536891..049bc21cb6 100644
--- a/resources/views/livewire/project/application/deployment/index.blade.php
+++ b/resources/views/livewire/project/application/deployment/index.blade.php
@@ -169,7 +169,7 @@
                     <x-table.loading id="deployment-table-filter-loading"
                         target="toggleDeploymentFilter,clearFilter,setPullRequestFilter"
                         text="Filtering deployments..." class="rounded-lg" />
-                    <div class="deployment-table-scroll">
+                    <div @class(['deployment-table-scroll', 'deployment-table-embedded' => $embedded])>
                         <div class="data-table-header deployment-table-grid rounded-none!">
                             <span>Status</span>
                             <span>Source</span>
diff --git a/resources/views/livewire/project/application/deployment/show.blade.php b/resources/views/livewire/project/application/deployment/show.blade.php
index a10e0b6640..29d5cb7b42 100644
--- a/resources/views/livewire/project/application/deployment/show.blade.php
+++ b/resources/views/livewire/project/application/deployment/show.blade.php
@@ -8,7 +8,7 @@
             <div class="grid min-h-0 min-w-0 flex-1 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
                 <x-application.configuration-sidebar :application="$application"
                     current-route="project.application.deployment.show" />
-                <div class="flex min-h-0 min-w-0 flex-col gap-4 xl:h-full xl:pt-px">
+                <div class="flex min-h-0 min-w-0 flex-col gap-4 xl:h-full xl:pt-px 2xl:grid 2xl:grid-cols-[24rem_minmax(0,1fr)] 2xl:items-start">
                     <livewire:project.application.deployment.index :embedded="true"
                         :selected-deployment-uuid="$deployment_uuid"
                         wire:key="embedded-deployment-history-{{ $deployment_uuid }}" />
@@ -273,7 +273,7 @@
                 this.deploymentFinishedCleanup = null;
             }
         }
-    }" class="flex h-[calc(100dvh-8rem)] min-h-[32rem] w-full flex-col overflow-hidden xl:h-[32rem] xl:min-h-0 xl:flex-none">
+    }" class="flex h-[calc(100dvh-8rem)] min-h-[32rem] w-full min-w-0 flex-col overflow-hidden xl:h-[32rem] xl:min-h-0 xl:flex-none 2xl:sticky 2xl:top-4 2xl:h-[calc(100dvh-10rem)] 2xl:min-h-[32rem]">
             <div id="screen" :class="fullscreen ? 'fullscreen flex flex-col' : 'mt-2 flex flex-1 min-h-0 flex-col overflow-hidden lg:mt-0'">
                 <div @if ($isKeepAliveOn) wire:poll.2000ms="polling" @endif
                     class="logs-viewer flex min-h-0 w-full flex-col overflow-hidden bg-white text-neutral-800 dark:bg-log dark:text-neutral-100"
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index db316c36f1..f900c57506 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -1,6 +1,4 @@
 @php
-    $configuredCount = collect($domainRows)->where('is_suggested', false)->count();
-    $suggestedCount = collect($domainRows)->where('is_suggested', true)->count();
     $hasRows = count($domainRows) > 0;
     $hasDnsChecksInProgress = collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking');
     $composeDomainGroups = collect($domainRows)
@@ -81,25 +79,16 @@
     @endcannot
 
     {{-- Toolbar --}}
-    <div class="flex flex-wrap items-center gap-2">
-        <div class="min-w-0 flex-1">
-            <h2 id="domains-section">Domains</h2>
-            <p class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }}
-                @if ($suggestedCount > 0)
-                    · {{ $suggestedCount }} not added
-                @endif
-            </p>
-        </div>
+    <div id="domains-section" class="flex flex-wrap items-center gap-2">
+        @if ($hasRows)
+            <div class="relative w-full sm:w-64">
+                <x-reicon name="search"
+                    class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                <input type="search" x-model="domainSearch" aria-label="Search services or domains"
+                    class="input h-8! w-full pl-8! text-[13px]!" placeholder="Search services or domains" />
+            </div>
+        @endif
         <div class="ml-auto flex flex-wrap items-center gap-2">
-            @if ($hasRows)
-                <div class="relative w-full sm:w-64">
-                    <x-reicon name="search"
-                        class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
-                    <input type="search" x-model="domainSearch" aria-label="Search services or domains"
-                        class="input h-8! w-full pl-8! text-[13px]!" placeholder="Search services or domains" />
-                </div>
-            @endif
             @can('update', $application)
                 <x-forms.button wire:click="checkAllDns" :showLoadingIndicator="false" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
                     <x-reicon name="refresh" class="size-3.5" />
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index c2e9f500d5..8d6c6e22ef 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -1,3 +1,4 @@
+@php use App\Enums\HttpBasicAuthHashAlgorithm; use App\Enums\ProxyTypes; @endphp
 <div x-data="{
     initLoadingCompose: $wire.entangle('initLoadingCompose'),
     canUpdate: @js(auth()->user()->can('update', $application)),
@@ -146,35 +147,9 @@
                     <div class="flex flex-col gap-5">
                         @if ($buildPack === 'dockercompose')
                             <div class="flex flex-col gap-2">
-                                <div x-data="{
-                                    baseDir: @entangle('baseDirectory'),
-                                    composeLocation: @entangle('dockerComposeLocation'),
-                                    normalizePath(path) {
-                                        if (!path || path.trim() === '') return '/';
-                                        path = path.trim();
-                                        path = path.replace(/\/+$/, '');
-                                        if (!path.startsWith('/')) {
-                                            path = '/' + path;
-                                        }
-                                        return path;
-                                    },
-                                    normalizeBaseDir() {
-                                        this.baseDir = this.normalizePath(this.baseDir);
-                                    },
-                                    normalizeComposeLocation() {
-                                        this.composeLocation = this.normalizePath(this.composeLocation);
-                                    }
-                                }" class="grid gap-4 lg:grid-cols-2">
-                                    <x-forms.input x-bind:disabled="shouldDisable()" placeholder="/"
-                                        label="Base directory"
-                                        helper="Directory to use as root. Useful for monorepos." x-model="baseDir"
-                                        @blur="normalizeBaseDir()" />
-                                    <x-forms.input x-bind:disabled="shouldDisable()"
-                                        placeholder="/docker-compose.yaml"
-                                        label="Docker compose location"
-                                        helper="It is calculated together with the Base Directory:<br><span class='dark:text-warning'>{{ Str::start($baseDirectory . $dockerComposeLocation, '/') }}</span>"
-                                        x-model="composeLocation" @blur="normalizeComposeLocation()" />
-                                </div>
+                                <x-forms.repository-paths class="lg:grid-cols-2" base="baseDirectory"
+                                    file="dockerComposeLocation" fileLabel="Docker compose location"
+                                    defaultFile="/docker-compose.yaml" disabled="shouldDisable()" />
                                 <div class="w-full sm:w-96">
                                     <x-forms.checkbox instantSave id="isPreserveRepositoryEnabled"
                                         label="Preserve repository during deployment"
@@ -217,41 +192,9 @@
                                 @endif
                             </div>
                         @else
-                            <div x-data="{
-                                baseDir: @entangle('baseDirectory'),
-                                dockerfileLocation: @entangle('dockerfileLocation'),
-                                normalizePath(path) {
-                                    if (!path || path.trim() === '') return '/';
-                                    path = path.trim();
-                                    path = path.replace(/\/+$/, '');
-                                    if (!path.startsWith('/')) {
-                                        path = '/' + path;
-                                    }
-                                    return path;
-                                },
-                                normalizeBaseDir() {
-                                    this.baseDir = this.normalizePath(this.baseDir);
-                                },
-                                normalizeDockerfileLocation() {
-                                    this.dockerfileLocation = this.normalizePath(this.dockerfileLocation);
-                                }
-                            }" class="grid gap-4 lg:grid-cols-2">
-                                <x-forms.input placeholder="/"
-                                    label="Base directory" helper="Directory to use as root. Useful for monorepos."
-                                    x-bind:disabled="!canUpdate" x-model="baseDir" @blur="normalizeBaseDir()" />
-                                @if ($buildPack === 'dockerfile' && !$application->dockerfile)
-                                    <x-forms.input placeholder="/Dockerfile"
-                                        label="Dockerfile location"
-                                        helper="It is calculated together with the Base Directory:<br><span class='dark:text-warning'>{{ Str::start($application->base_directory . $application->dockerfile_location, '/') }}</span>"
-                                        x-bind:disabled="!canUpdate" x-model="dockerfileLocation"
-                                        @blur="normalizeDockerfileLocation()" />
-                                @endif
-
-                                @if ($buildPack === 'dockerfile')
-                                    <x-forms.input id="dockerfileTargetBuild" label="Docker build stage target"
-                                        helper="Useful if you have multi-staged dockerfile."
-                                        x-bind:disabled="!canUpdate" />
-                                @endif
+                            <x-forms.repository-paths class="lg:grid-cols-2" base="baseDirectory"
+                                :file="$buildPack === 'dockerfile' && !$application->dockerfile ? 'dockerfileLocation' : null"
+                                fileLabel="Dockerfile location" defaultFile="/Dockerfile" disabled="!canUpdate">
                                 @if ($application->could_set_build_commands())
                                     @if ($application->settings->is_static)
                                         <x-forms.input placeholder="/dist" id="publishDirectory"
@@ -261,8 +204,7 @@
                                             label="Publish directory" x-bind:disabled="!canUpdate" />
                                     @endif
                                 @endif
-
-                            </div>
+                            </x-forms.repository-paths>
                             @if ($this->application->is_github_based() && !$this->application->is_public_repository())
                                 <div class="pb-4">
                                     <x-forms.textarea
@@ -295,6 +237,11 @@
                                         : 'If no usable build server is available, the deployment fails.';
                                 @endphp
                                 <div class="grid gap-4 pt-2 sm:grid-cols-2">
+                                    @if ($buildPack === 'dockerfile')
+                                        <x-forms.input id="dockerfileTargetBuild" label="Docker build stage target"
+                                            helper="Useful if you have multi-staged dockerfile."
+                                            x-bind:disabled="!canUpdate" />
+                                    @endif
                                     <x-forms.listbox id="isBuildServerEnabled" label="Builder selection"
                                         onChange="instantSave" :options="$buildServerOptions"
                                         helper="Build your application on a dedicated build server. If several build servers are connected, Coolify picks an available one automatically. {{ $buildServerFallbackPolicy }} More info in the <a href='https://coolify.io/docs/knowledge-base/server/build-server' class='underline' target='_blank'>documentation</a>."
@@ -575,6 +522,44 @@
                             <x-forms.input id="httpBasicAuthPassword" type="password" label="Password" required
                                 x-bind:disabled="!canUpdate" />
                         </div>
+                        @php
+                            $server = $application->destination->server;
+                            $supportsArgon2id = $server->caddySupportsArgon2idBasicAuth();
+                            $usesArgon2id = $httpBasicAuthHashAlgorithm === HttpBasicAuthHashAlgorithm::ARGON2ID->value;
+                        @endphp
+                        <div class="mt-5 border-t border-neutral-200 pt-5 dark:border-white/[0.07]">
+                            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Password hashing</h3>
+                            <div class="grid w-full gap-4 {{ $usesArgon2id ? 'sm:grid-cols-3' : 'sm:grid-cols-2' }}">
+                                <x-forms.listbox id="httpBasicAuthHashAlgorithm" label="Algorithm" onChange="instantSave"
+                                    helper="Algorithm that hashes the password for the proxy labels.<br><br>Traefik supports only bcrypt. Argon2id needs the Caddy proxy, version 2.11 or newer. With Argon2id, labels generated for Traefik use bcrypt."
+                                    :options="[
+                                        ['value' => HttpBasicAuthHashAlgorithm::BCRYPT->value, 'label' => 'bcrypt', 'description' => 'Works with every proxy'],
+                                        ['value' => HttpBasicAuthHashAlgorithm::ARGON2ID->value, 'label' => 'Argon2id', 'disabled' => ! $supportsArgon2id, 'description' => match (true) {
+                                            $supportsArgon2id => 'Memory-hard, more resistant to cracking',
+                                            $server->proxyType() === ProxyTypes::CADDY->value => 'Needs Caddy 2.11 or newer on this server',
+                                            default => 'Only supported by the Caddy proxy',
+                                        }],
+                                    ]" x-bind:disabled="!canUpdate" />
+                                @if ($usesArgon2id)
+                                    <div wire:key="http-basic-auth-argon2id-memory-cost" class="min-w-0">
+                                        <x-forms.listbox id="httpBasicAuthArgon2idMemoryCost" label="Memory" onChange="instantSave"
+                                            helper="Memory that the proxy needs to check a password. More memory makes the hash harder to crack, but every login attempt that the proxy has not seen before uses this much memory on the server."
+                                            :options="collect([8, 16, 32, 64, 128, 256])->map(fn (int $mebibytes) => ['value' => $mebibytes * 1024, 'label' => $mebibytes.' MiB'])->all()" x-bind:disabled="!canUpdate" />
+                                    </div>
+                                    <div wire:key="http-basic-auth-argon2id-time-cost" class="min-w-0">
+                                        <x-forms.listbox id="httpBasicAuthArgon2idTimeCost" label="Iterations" onChange="instantSave"
+                                            helper="Number of passes over the memory. More iterations make the hash harder to crack and a password check slower."
+                                            :options="collect(range(1, 12))->map(fn (int $iterations) => ['value' => $iterations, 'label' => (string) $iterations])->all()" x-bind:disabled="!canUpdate" />
+                                    </div>
+                                @else
+                                    <div wire:key="http-basic-auth-bcrypt-cost" class="min-w-0">
+                                        <x-forms.listbox id="httpBasicAuthBcryptCost" label="Cost factor" onChange="instantSave"
+                                            helper="Each step doubles the work to check or crack the password. Traefik checks the password on every request, so a higher cost makes every request slower."
+                                            :options="collect(range(4, 14))->map(fn (int $cost) => ['value' => $cost, 'label' => (string) $cost])->all()" x-bind:disabled="!canUpdate" />
+                                    </div>
+                                @endif
+                            </div>
+                        </div>
                     @endif
                     @endif
                 </x-application.settings-section>
diff --git a/resources/views/livewire/project/application/rollback.blade.php b/resources/views/livewire/project/application/rollback.blade.php
index c159af392c..9a32c1a411 100644
--- a/resources/views/livewire/project/application/rollback.blade.php
+++ b/resources/views/livewire/project/application/rollback.blade.php
@@ -22,7 +22,7 @@
     </form>
 
     <x-application.settings-section id="rollback-images-section" title="Available images"
-        helper="Rollback uses an existing local image without rebuilding the application." flush>
+        helper="Rollback uses an existing image without rebuilding the application. Images in the Docker registry are pulled to the server first." flush>
         <x-slot:actions>
             @can('view', $application)
                 <x-forms.button wire:click="loadImages(true)">
@@ -41,6 +41,7 @@
                     $isPrTag = preg_match('/^pr-\d+$/', $tag);
                     $isRollbackable = $isCommitSha || $isPrTag;
                     $isCurrent = data_get($image, 'is_current');
+                    $isRegistryImage = data_get($image, 'source') === 'registry';
                 @endphp
                 <div
                     class="flex flex-col gap-3 border-b border-neutral-200 px-4 py-3.5 last:border-b-0 sm:flex-row sm:items-center dark:border-white/[0.07]">
@@ -58,9 +59,12 @@
                             @elseif (!$isRollbackable)
                                 <x-status-badge status="Rollback unavailable" type="neutral" />
                             @endif
+                            @if ($isRegistryImage)
+                                <x-status-badge status="In registry" type="neutral" />
+                            @endif
                         </div>
                         <p class="mt-1 text-xs text-neutral-500 dark:text-fg-dim">
-                            Built {{ $createdAt->diffForHumans() }}
+                            {{ $isRegistryImage ? 'Deployed' : 'Built' }} {{ $createdAt->diffForHumans() }}
                             <span class="mx-1 text-neutral-300 dark:text-fg-faint">·</span>
                             {{ $date }}
                         </p>
@@ -84,7 +88,7 @@
                 </div>
             @empty
                 <x-empty title="No rollback images"
-                    description="No previous application images are currently stored on this server."
+                    description="No previous application images are stored on this server or in the Docker registry."
                     icon-name="layers" />
             @endforelse
         </div>
diff --git a/resources/views/livewire/project/application/source.blade.php b/resources/views/livewire/project/application/source.blade.php
index bf1b4bdccc..c2dbc5836b 100644
--- a/resources/views/livewire/project/application/source.blade.php
+++ b/resources/views/livewire/project/application/source.blade.php
@@ -74,11 +74,14 @@
                 $currentSourceMorph = $currentSource?->getMorphClass();
                 $currentSourceIsGithub = $currentSourceMorph === \App\Models\GithubApp::class;
                 $currentSourceIsGitlab = $currentSourceMorph === \App\Models\GitlabApp::class;
+                $currentSourceIsGitea = $currentSourceMorph === \App\Models\GiteaApp::class;
                 $currentSourceSubtitle = match (true) {
                     $currentSourceIsGithub && filled(data_get($currentSource, 'organization')) => 'GitHub · '.$currentSource->organization,
                     $currentSourceIsGithub => data_get($currentSource, 'is_public') ? 'Public GitHub' : 'GitHub · Personal account',
                     $currentSourceIsGitlab && filled(data_get($currentSource, 'group_name')) => 'GitLab · '.$currentSource->group_name,
                     $currentSourceIsGitlab => 'GitLab · Personal account',
+                    $currentSourceIsGitea && filled(data_get($currentSource, 'organization')) => 'Gitea · '.$currentSource->organization,
+                    $currentSourceIsGitea => 'Gitea · Personal account',
                     default => 'Connected source',
                 };
             @endphp
@@ -113,11 +116,14 @@
                             $sourceMorph = $source->getMorphClass();
                             $sourceIsGithub = $sourceMorph === \App\Models\GithubApp::class;
                             $sourceIsGitlab = $sourceMorph === \App\Models\GitlabApp::class;
+                            $sourceIsGitea = $sourceMorph === \App\Models\GiteaApp::class;
                             $sourceSubtitle = match (true) {
                                 $sourceIsGithub && filled($source->organization) => 'GitHub · '.$source->organization,
                                 $sourceIsGithub => data_get($source, 'is_public') ? 'Public GitHub' : 'GitHub · Personal account',
                                 $sourceIsGitlab && filled($source->group_name) => 'GitLab · '.$source->group_name,
                                 $sourceIsGitlab => 'GitLab · Personal account',
+                                $sourceIsGitea && filled($source->organization) => 'Gitea · '.$source->organization,
+                                $sourceIsGitea => 'Gitea · Personal account',
                                 default => 'Git source',
                             };
                         @endphp
diff --git a/resources/views/livewire/project/database/backup-edit.blade.php b/resources/views/livewire/project/database/backup-edit.blade.php
index d85d506a0b..90543e817b 100644
--- a/resources/views/livewire/project/database/backup-edit.blade.php
+++ b/resources/views/livewire/project/database/backup-edit.blade.php
@@ -1,13 +1,5 @@
 <div class="flex flex-col gap-6">
-    @if ($backup->database_id === 0)
-        @include('livewire.project.database.backup-edit.general')
-        @include('livewire.project.database.backup-edit.s3')
-        @include('livewire.project.database.backup-edit.retention')
-    @elseif ($section === 'retention')
-        @include('livewire.project.database.backup-edit.retention')
-    @elseif ($section === 's3')
-        @include('livewire.project.database.backup-edit.s3')
-    @elseif ($section === 'danger')
+    @if ($section === 'danger' && $backup->database_id !== 0)
         @include('livewire.project.database.backup-edit.danger')
     @else
         @include('livewire.project.database.backup-edit.general')
diff --git a/resources/views/livewire/project/database/backup-edit/general.blade.php b/resources/views/livewire/project/database/backup-edit/general.blade.php
index 49385b0258..dfe465e07a 100644
--- a/resources/views/livewire/project/database/backup-edit/general.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/general.blade.php
@@ -1,10 +1,11 @@
-<form wire:submit="submit">
+<form wire:submit="submit" class="flex flex-col gap-6">
     <x-unsaved-bar action="submit" />
 
     <x-application.settings-section title="Backup schedule"
         description="Choose what to back up, when it runs, and how long it may run.">
         <x-slot:actions>
-            <div class="flex items-center gap-2">
+            {{-- Below xl the header bar is hidden, so keep the buttons here. --}}
+            <div @class(['flex items-center gap-2', 'xl:hidden' => $actionsInHeader])>
                 @if (! $backupEnabled)
                     <x-forms.button type="button" wire:click="toggleEnabled" wire:loading.attr="disabled"
                         wire:target="toggleEnabled" isHighlighted>
@@ -98,4 +99,7 @@
             </div>
         </div>
     </x-application.settings-section>
+
+    @include('livewire.project.database.backup-edit.s3')
+    @include('livewire.project.database.backup-edit.retention')
 </form>
diff --git a/resources/views/livewire/project/database/backup-edit/retention.blade.php b/resources/views/livewire/project/database/backup-edit/retention.blade.php
index 8825b3c26d..d340216537 100644
--- a/resources/views/livewire/project/database/backup-edit/retention.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/retention.blade.php
@@ -1,34 +1,30 @@
-<form wire:submit="submit">
-    <x-unsaved-bar action="submit" />
-
-    <x-application.settings-section title="Retention"
-        description="The first reached limit removes the oldest backup. Use 0 for unlimited retention.">
-        <div class="space-y-6">
-            <div>
-                <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Local backups</h3>
-                <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-                    <x-forms.input label="Backups to keep" id="databaseBackupRetentionAmountLocally"
-                        type="number" min="0" helper="Maximum number of recent local backups." required />
-                    <x-forms.input label="Days to keep" id="databaseBackupRetentionDaysLocally"
-                        type="number" min="0" helper="Remove local backups older than this many days." required />
-                    <x-forms.input label="Maximum storage (GB)"
-                        id="databaseBackupRetentionMaxStorageLocally" type="number" min="0" step="any"
-                        helper="Remove oldest local backups after this total size is reached." required />
-                </div>
-            </div>
-
-            <div class="border-t border-neutral-200 pt-6 dark:border-white/[0.06]">
-                <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">S3 backups</h3>
-                <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-                    <x-forms.input label="Backups to keep" id="databaseBackupRetentionAmountS3"
-                        type="number" min="0" helper="Maximum number of recent S3 backups." required />
-                    <x-forms.input label="Days to keep" id="databaseBackupRetentionDaysS3"
-                        type="number" min="0" helper="Remove S3 backups older than this many days." required />
-                    <x-forms.input label="Maximum storage (GB)" id="databaseBackupRetentionMaxStorageS3"
-                        type="number" min="0" step="any"
-                        helper="Remove oldest S3 backups after this total size is reached." required />
-                </div>
+<x-application.settings-section title="Retention"
+    description="The first reached limit removes the oldest backup. Use 0 for unlimited retention.">
+    <div class="space-y-6">
+        <div>
+            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Local backups</h3>
+            <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+                <x-forms.input label="Backups to keep" id="databaseBackupRetentionAmountLocally"
+                    type="number" min="0" helper="Maximum number of recent local backups." required />
+                <x-forms.input label="Days to keep" id="databaseBackupRetentionDaysLocally"
+                    type="number" min="0" helper="Remove local backups older than this many days." required />
+                <x-forms.input label="Maximum storage (GB)"
+                    id="databaseBackupRetentionMaxStorageLocally" type="number" min="0" step="any"
+                    helper="Remove oldest local backups after this total size is reached." required />
             </div>
         </div>
-    </x-application.settings-section>
-</form>
+
+        <div class="border-t border-neutral-200 pt-6 dark:border-white/[0.06]">
+            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">S3 backups</h3>
+            <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+                <x-forms.input label="Backups to keep" id="databaseBackupRetentionAmountS3"
+                    type="number" min="0" helper="Maximum number of recent S3 backups." required />
+                <x-forms.input label="Days to keep" id="databaseBackupRetentionDaysS3"
+                    type="number" min="0" helper="Remove S3 backups older than this many days." required />
+                <x-forms.input label="Maximum storage (GB)" id="databaseBackupRetentionMaxStorageS3"
+                    type="number" min="0" step="any"
+                    helper="Remove oldest S3 backups after this total size is reached." required />
+            </div>
+        </div>
+    </div>
+</x-application.settings-section>
diff --git a/resources/views/livewire/project/database/backup-edit/s3.blade.php b/resources/views/livewire/project/database/backup-edit/s3.blade.php
index dcfb7c3815..586c3617cf 100644
--- a/resources/views/livewire/project/database/backup-edit/s3.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/s3.blade.php
@@ -10,32 +10,29 @@
         </x-empty>
     </x-application.settings-section>
 @else
-    <form wire:submit="submit">
-        <x-unsaved-bar action="submit" />
-
-        <x-application.settings-section title="S3 storage"
-            description="Choose where remote backups are stored and whether local copies are retained.">
-            <x-slot:actions>
-                @if (! $saveS3)
-                    <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
-                        wire:target="toggleS3" isHighlighted>Enable S3</x-forms.button>
-                @else
-                    <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
-                        wire:target="toggleS3">Disable S3</x-forms.button>
-                @endif
-            </x-slot:actions>
-            <div class="grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="s3StorageId" label="S3 storage" portal :required="$saveS3"
-                    :options="$availableS3Storages->map(fn ($s3) => [
-                        'value' => $s3->id,
-                        'label' => $s3->name,
-                    ])->values()->all()" />
-                <x-forms.listbox id="disableLocalBackup" label="Local copy" portal :disabled="! $saveS3"
-                    :options="[
-                        ['value' => false, 'label' => 'Keep local backup'],
-                        ['value' => true, 'label' => 'Delete after S3 upload'],
-                    ]" />
-            </div>
-        </x-application.settings-section>
-    </form>
+    <x-application.settings-section title="S3 storage"
+        description="Choose where remote backups are stored and whether local copies are retained.">
+        <x-slot:actions>
+            @if (! $saveS3)
+                <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
+                    wire:target="toggleS3" isHighlighted>Enable S3</x-forms.button>
+            @else
+                <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
+                    wire:target="toggleS3">Disable S3</x-forms.button>
+            @endif
+        </x-slot:actions>
+        <div class="grid gap-4 sm:grid-cols-2">
+            <x-forms.listbox id="s3StorageIds" label="S3 storages" multiple live portal
+                helper="Each backup is uploaded to every selected storage." placeholder="Select S3 storages"
+                :options="$availableS3Storages->map(fn ($storage) => [
+                    'value' => $storage->id,
+                    'label' => $storage->name.($storage->is_usable ? '' : ' (unavailable)'),
+                ])->all()" />
+            <x-forms.listbox id="disableLocalBackup" label="Local copy" portal :disabled="! $saveS3"
+                :options="[
+                    ['value' => false, 'label' => 'Keep local backup'],
+                    ['value' => true, 'label' => 'Delete after S3 upload'],
+                ]" />
+        </div>
+    </x-application.settings-section>
 @endif
diff --git a/resources/views/livewire/project/database/backup-executions.blade.php b/resources/views/livewire/project/database/backup-executions.blade.php
index f731b005f8..66a9d2c863 100644
--- a/resources/views/livewire/project/database/backup-executions.blade.php
+++ b/resources/views/livewire/project/database/backup-executions.blade.php
@@ -1,10 +1,12 @@
-<div wire:init="refreshBackupExecutions">
+<div wire:init="refreshBackupExecutions" x-on:open-backup-download.window="window.location.href = $event.detail.url">
+    @if (count($pendingDownloads) > 0)
+        <div wire:poll.3s="checkDownloads" class="hidden"></div>
+    @endif
     @isset($backup)
         <section class="application-settings-section overflow-hidden">
             <div class="application-settings-section-header">
                 <div>
                     <h2>Executions</h2>
-                    <p>Review generated archives, storage availability, and backup output.</p>
                 </div>
                 <div class="flex flex-wrap items-center gap-2">
                     <x-forms.button wire:click="cleanupFailed">Clean failed backups</x-forms.button>
@@ -37,9 +39,8 @@
                             class="data-table-header backup-executions-table-grid h-auto rounded-none px-4 py-2.5 text-[11px]">
                             <span>Status</span>
                             <span>Database</span>
-                            <span>Backup path</span>
-                            <span>Finished</span>
-                            <span>Duration</span>
+                            <span>Archive</span>
+                            <span>Time</span>
                             <span>Size</span>
                             <span>Availability</span>
                             <span class="text-right">Actions</span>
@@ -58,6 +59,11 @@
                                     'failed' => ['Failed', 'error'],
                                     default => [str($executionStatus)->headline(), 'neutral'],
                                 };
+                                $finishedAt = \Carbon\Carbon::parse(data_get($execution, 'finished_at') ?? data_get($execution, 'updated_at'));
+                                $s3Replicas = $execution->s3Replicas;
+                                $hasLiveS3Copies = $s3Replicas->isNotEmpty()
+                                    ? $s3Replicas->contains(fn ($replica) => $replica->s3_uploaded === true && ! $replica->s3_storage_deleted)
+                                    : data_get($execution, 's3_uploaded') === true && ! data_get($execution, 's3_storage_deleted', false);
                                 $executionCheckboxes = [];
                                 $deleteActions = [];
 
@@ -65,11 +71,10 @@
                                     $deleteActions[] = 'This backup will be permanently deleted from local storage.';
                                 }
 
-                                if (data_get($execution, 's3_uploaded') === true
-                                    && ! data_get($execution, 's3_storage_deleted', false)) {
+                                if ($hasLiveS3Copies) {
                                     $executionCheckboxes[] = [
                                         'id' => 'delete_backup_s3',
-                                        'label' => 'Delete the selected backup permanently from S3 Storage',
+                                        'label' => 'Delete the selected backup permanently from every S3 storage',
                                     ];
                                 }
 
@@ -82,48 +87,52 @@
                                 <div class="data-table-row backup-executions-table-grid min-h-14 border-b border-neutral-200 px-4 py-2.5 dark:border-white/[0.06]">
                                     <div class="flex items-center gap-2">
                                         <x-status-badge :status="$executionStatusLabel"
-                                            :type="$executionStatusType" />
-                                        @if ($executionStatus === 'running')
-                                            <x-loading />
-                                        @endif
+                                            :type="$executionStatusType" :pulse="$executionStatus === 'running'" />
                                     </div>
                                     <div class="truncate text-[12px] font-medium text-black dark:text-fg">
                                         {{ data_get($execution, 'database_name', 'N/A') }}
                                     </div>
-                                    <div class="flex min-w-0 items-center gap-1">
-                                        <code class="select-all truncate font-mono text-[11px] text-neutral-600 dark:text-fg-dim"
-                                            title="Backup path: {{ data_get($execution, 'filename', 'N/A') }}">{{ data_get($execution, 'filename', 'N/A') }}</code>
-                                        <x-copy-button :value="data_get($execution, 'filename', '')" label="Copy backup path" />
+                                    <div class="min-w-0">
+                                        <x-forms.copy-input :text="data_get($execution, 'filename') ?? 'No archive name'" />
                                     </div>
-                                    <div class="text-[11px] text-neutral-600 dark:text-fg-dim"
+                                    <div class="text-[11px] text-neutral-500 dark:text-fg-faint"
                                         title="Started: {{ formatDateInServerTimezone(data_get($execution, 'created_at'), $server) }}@if ($executionStatus !== 'running')&#10;Ended: {{ formatDateInServerTimezone(data_get($execution, 'finished_at'), $server) }}@endif">
                                         @if ($executionStatus === 'running')
-                                            Running now
+                                            Running for {{ calculateDuration(data_get($execution, 'created_at'), now()) }}
                                         @else
                                             <div class="text-black dark:text-fg">
-                                                {{ formatDateInServerTimezone(data_get($execution, 'finished_at'), $server) }}
+                                                {{ formatDateInServerTimezone($finishedAt, $server) }}
                                             </div>
-                                            <div>{{ \Carbon\Carbon::parse(data_get($execution, 'finished_at'))->diffForHumans() }}</div>
+                                            <div>{{ $finishedAt->diffForHumans() }} · {{ calculateDuration(data_get($execution, 'created_at'), $finishedAt) }}</div>
                                         @endif
                                     </div>
-                                    <div class="text-[11px] text-neutral-600 dark:text-fg-dim">
-                                        {{ calculateDuration(
-                                            data_get($execution, 'created_at'),
-                                            $executionStatus === 'running' ? now() : data_get($execution, 'finished_at'),
-                                        ) }}
-                                    </div>
-                                    <div class="text-[11px] text-neutral-600 dark:text-fg-dim">
+                                    <div class="tabular-nums text-neutral-500 dark:text-fg-dim">
                                         {{ data_get($execution, 'size') ? formatBytes(data_get($execution, 'size')) : '-' }}
                                     </div>
                                     <div class="flex flex-wrap items-center gap-1.5">
-                                        <x-status-badge label="Local"
-                                            :status="data_get($execution, 'local_storage_deleted', false) ? 'Deleted' : 'Available'"
+                                        <x-status-badge
+                                            :status="data_get($execution, 'local_storage_deleted', false) ? 'Local deleted' : 'Local'"
                                             :type="data_get($execution, 'local_storage_deleted', false) ? 'neutral' : 'success'" />
-                                        @if (data_get($execution, 's3_uploaded') !== null)
-                                            <x-status-badge label="S3"
+                                        @foreach ($s3Replicas as $replica)
+                                            <x-status-badge wire:key="database-backup-replica-{{ $replica->id }}"
+                                                :label="$replica->s3?->name ?? 'Removed S3 storage'"
+                                                :status="$replica->s3_storage_deleted
+                                                    ? 'deleted'
+                                                    : match ($replica->s3_uploaded) {
+                                                        true => null,
+                                                        false => 'failed',
+                                                        default => $executionStatus === 'running' ? 'pending' : 'not uploaded',
+                                                    }"
+                                                :type="$replica->s3_storage_deleted || $replica->s3_uploaded === null
+                                                    ? 'neutral'
+                                                    : ($replica->s3_uploaded ? 'success' : 'error')"
+                                                :title="$replica->message" />
+                                        @endforeach
+                                        @if ($s3Replicas->isEmpty() && data_get($execution, 's3_uploaded') !== null)
+                                            <x-status-badge
                                                 :status="data_get($execution, 's3_storage_deleted', false)
-                                                    ? 'Deleted'
-                                                    : (data_get($execution, 's3_uploaded') ? 'Available' : 'Failed')"
+                                                    ? 'S3 deleted'
+                                                    : (data_get($execution, 's3_uploaded') ? 'S3' : 'S3 failed')"
                                                 :type="data_get($execution, 's3_storage_deleted', false)
                                                     ? 'neutral'
                                                     : (data_get($execution, 's3_uploaded') ? 'success' : 'error')" />
@@ -189,7 +198,11 @@
 @script
     <script>
         window.download_file = function(executionId) {
-            window.open('/download/backup/' + executionId, '_blank');
+            @if ($s3Downloads)
+                $wire.download_file(executionId);
+            @else
+                window.open('/download/backup/' + executionId, '_blank');
+            @endif
         }
     </script>
 @endscript
diff --git a/resources/views/livewire/project/database/backup/execution.blade.php b/resources/views/livewire/project/database/backup/execution.blade.php
index 911f403db8..7fc0c715c4 100644
--- a/resources/views/livewire/project/database/backup/execution.blade.php
+++ b/resources/views/livewire/project/database/backup/execution.blade.php
@@ -5,8 +5,27 @@
 
     <livewire:project.database.heading :database="$database" />
 
+    @can('manageBackups', $database)
+        @teleport('#resource-action-hud-slot')
+            <div class="order-first mr-1 hidden items-center gap-1 xl:flex">
+                @php($databaseRunning = str($database->status)->startsWith('running'))
+                @if ($backup->enabled)
+                    <x-forms.button type="button" wire:click="toggleEnabled">Disable backup</x-forms.button>
+                @else
+                    <x-forms.button type="button" wire:click="toggleEnabled" isHighlighted>Enable backup</x-forms.button>
+                @endif
+                <x-forms.button type="button" wire:click="backupNow" :disabled="! $databaseRunning"
+                    :tooltip="! $databaseRunning ? 'The database must be running to start a backup.' : null">
+                    Back up now
+                </x-forms.button>
+            </div>
+        @endteleport
+    @endcan
+
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            {{-- The database menu, one Back away from the backup menu in the main sidebar. --}}
+            <x-database.configuration-sidebar :database="$database" current-route="project.database.backup.index" nav-only />
             <x-backup-sidebar context="database" :parameters="$parameters" :section="$section" />
 
             <div class="min-w-0">
@@ -15,7 +34,7 @@
                 @else
                     <livewire:project.database.backup-edit :backup="$backup" :available-s3-storages="$s3s"
                         :status="data_get($database, 'status')" :section="$section"
-                        wire:key="database-backup-{{ $backup->uuid }}-{{ $section }}" />
+                        :actions-in-header="true" wire:key="database-backup-{{ $backup->uuid }}-{{ $section }}" />
                 @endif
             </div>
         </div>
diff --git a/resources/views/livewire/project/database/scheduled-backups.blade.php b/resources/views/livewire/project/database/scheduled-backups.blade.php
index 793cd2ff47..aba61ec48c 100644
--- a/resources/views/livewire/project/database/scheduled-backups.blade.php
+++ b/resources/views/livewire/project/database/scheduled-backups.blade.php
@@ -3,7 +3,7 @@
     backups: @js($database->scheduledBackups->map(fn ($backup) => [
         'name' => strtolower($database->name),
         'frequency' => strtolower($backup->frequency),
-        's3_storage' => strtolower($backup->s3?->name ?? ''),
+        's3_storage' => strtolower(($backup->s3Storages->isNotEmpty() ? $backup->s3Storages : collect([$backup->s3])->filter())->pluck('name')->join(', ')),
     ])->values()),
     hasMatches() {
         const query = this.search.toLowerCase();
@@ -67,6 +67,7 @@
                 @foreach ($database->scheduledBackups as $backup)
                     @php
                         $latestStatus = data_get($backup->latest_log, 'status');
+                        $s3StorageNames = ($backup->s3Storages->isNotEmpty() ? $backup->s3Storages : collect([$backup->s3])->filter())->pluck('name')->join(', ');
                         [$statusLabel, $statusType] = match ($latestStatus) {
                             'success' => ['Success', 'success'],
                             'running' => ['In progress', 'warning'],
@@ -83,7 +84,7 @@
                     <div x-show="search === ''
                         || @js(strtolower($database->name)).includes(search.toLowerCase())
                         || @js(strtolower($backup->frequency)).includes(search.toLowerCase())
-                        || @js(strtolower($backup->s3?->name ?? '')).includes(search.toLowerCase())"
+                        || @js(strtolower($s3StorageNames)).includes(search.toLowerCase())"
                         class="data-table-row scheduled-backups-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.06]">
                         <div class="min-w-0">
                             <span class="block truncate text-[12px] font-semibold text-black dark:text-fg">
@@ -96,8 +97,8 @@
                                 <x-loading />
                             @endif
                         </div>
-                        <div class="truncate text-[11px] text-neutral-600 dark:text-fg-dim">
-                            {{ $backup->save_s3 ? ($backup->s3?->name ?? 'Unavailable') : 'Local only' }}
+                        <div class="truncate text-[11px] text-neutral-600 dark:text-fg-dim" title="{{ $backup->save_s3 ? $s3StorageNames : '' }}">
+                            {{ $backup->save_s3 ? ($s3StorageNames ?: 'Unavailable') : 'Local only' }}
                         </div>
                         <div class="text-[11px] text-neutral-600 dark:text-fg-dim">
                             <a {{ wireNavigate() }} href="{{ $backupExecutionsRoute }}"
diff --git a/resources/views/livewire/project/edit.blade.php b/resources/views/livewire/project/edit.blade.php
index f3d27997a0..ca4a784b12 100644
--- a/resources/views/livewire/project/edit.blade.php
+++ b/resources/views/livewire/project/edit.blade.php
@@ -7,7 +7,17 @@
         </header>
 
         <div class="flex flex-col gap-6">
-        <section class="application-settings-section" x-data="{
+        <form wire:submit="submit">
+            <x-unsaved-bar action="submit" />
+            <section class="application-settings-section">
+                <div class="application-settings-section-header">
+                    <div>
+                        <h2>Project details</h2>
+                        <p>Icon, name, and description shown across the dashboard.</p>
+                    </div>
+                </div>
+                <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
+                    <div class="sm:col-span-2" x-data="{
             preview: null,
             processing: false,
             uploadError: null,
@@ -55,48 +65,38 @@
                 }
             },
         }">
-            <div class="application-settings-section-header">
-                <div>
-                    <h2>Project icon</h2>
-                    <p>Upload a JPG, PNG, or WebP image. It will appear in the projects list.</p>
-                </div>
-            </div>
-            <div class="application-settings-section-body flex items-center gap-4">
-                <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                    <img x-cloak x-show="preview" :src="preview" alt="Project icon preview" class="h-full w-full object-cover">
-                    @if ($project->icon_path)
-                        <img x-show="!preview" src="{{ project_icon_url($project) }}"
-                            alt="{{ $project->name }} icon" class="h-full w-full object-cover">
-                    @else
-                        <x-reicon x-show="!preview" name="projects" class="size-6" />
-                    @endif
-                </div>
-                <div class="flex min-w-0 flex-1 flex-col gap-3">
-                    <div class="flex flex-wrap gap-2">
-                        <input x-ref="iconInput" type="file" x-on:change="prepareIcon($event)" accept="image/jpeg,image/png,image/webp" class="hidden">
-                        <x-forms.button type="button" x-on:click="$refs.iconInput.click()" x-bind:disabled="processing">
-                            <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
-                        </x-forms.button>
-                        @if ($project->icon_path)
-                            <x-forms.button type="button" wire:click="removeIcon" x-bind:disabled="processing" isError>Remove</x-forms.button>
-                        @endif
+                        <div class="mb-2 text-sm font-medium leading-4">Icon</div>
+                        <div class="flex items-center gap-4">
+                            <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl bg-neutral-200 text-neutral-700 dark:bg-white/[0.1] dark:text-fg">
+                                <img x-cloak x-show="preview" :src="preview" alt="Project icon preview" class="h-full w-full object-cover">
+                                @if ($project->icon_path)
+                                    <img x-show="!preview" src="{{ project_icon_url($project) }}"
+                                        alt="{{ $project->name }} icon" class="h-full w-full object-cover">
+                                @else
+                                    <x-reicon x-show="!preview" name="projects" class="size-6" />
+                                @endif
+                            </div>
+                            <div class="flex min-w-0 flex-1 flex-col gap-2">
+                                <div class="flex flex-wrap gap-2">
+                                    <input x-ref="iconInput" type="file" x-on:change="prepareIcon($event)"
+                                        accept="image/jpeg,image/png,image/webp" class="hidden">
+                                    <x-forms.button type="button" x-on:click="$refs.iconInput.click()"
+                                        x-bind:disabled="processing">
+                                        <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
+                                    </x-forms.button>
+                                    @if ($project->icon_path)
+                                        <x-forms.button type="button" wire:click="removeIcon" x-bind:disabled="processing"
+                                            isError>Remove</x-forms.button>
+                                    @endif
+                                </div>
+                                <p class="text-xs text-neutral-500 dark:text-fg-dim">JPG, PNG, or WebP. Shown in the projects list.</p>
+                                <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
+                                @error('icon')
+                                    <p class="text-xs text-red-500">{{ $message }}</p>
+                                @enderror
+                            </div>
+                        </div>
                     </div>
-                    <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
-                    @error('icon') <p class="text-xs text-red-500">{{ $message }}</p> @enderror
-                </div>
-            </div>
-        </section>
-
-        <form wire:submit="submit">
-            <x-unsaved-bar action="submit" />
-            <section class="application-settings-section">
-                <div class="application-settings-section-header">
-                    <div>
-                        <h2>Project details</h2>
-                        <p>Name and describe this project across the dashboard.</p>
-                    </div>
-                </div>
-                <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
                     <x-forms.input label="Name" id="name" />
                     <x-forms.input label="Description" id="description" />
                 </div>
diff --git a/resources/views/livewire/project/environment-canvas.blade.php b/resources/views/livewire/project/environment-canvas.blade.php
new file mode 100644
index 0000000000..35535969e4
--- /dev/null
+++ b/resources/views/livewire/project/environment-canvas.blade.php
@@ -0,0 +1,38 @@
+<div class="h-full">
+    <x-slot:title>
+        {{ $environment->name }} > Canvas | Coolify
+    </x-slot>
+    <div data-environment-canvas data-project="{{ $project->uuid }}" data-environment="{{ $environment->uuid }}"
+        data-team="{{ $project->team_id }}" data-user="{{ auth()->id() }}"
+        data-new="{{ auth()->user()->can('createAnyResource') ? route('deploy-canvas', ['project' => $project->uuid, 'environment' => $environment->uuid]) : '' }}"
+        class="relative h-full" wire:ignore>
+        {{-- The canvas moves this group into its toolbar; the page actions come last, at the right end. --}}
+        <div data-ec-views class="flex items-center gap-2">
+            <x-canvas-view-toggle on-canvas
+                :list-url="route('project.resource.index', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid])"
+                :canvas-url="route('project.environment.canvas', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid])" />
+            <a href="{{ route('shared-variables.environment.show', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
+                {{ wireNavigate() }} class="button whitespace-nowrap" title="Shared variables for this environment"
+                aria-label="Shared variables for {{ $environment->name }}">
+                <x-reicon name="variables" class="size-3.5" />
+                Shared variables
+            </a>
+            @can('update', $project)
+                <a href="{{ route('project.environment.edit', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
+                    {{ wireNavigate() }} class="button whitespace-nowrap" title="Environment settings"
+                    aria-label="Open settings for {{ $environment->name }}">
+                    <x-reicon name="settings" class="size-3.5" />
+                    Settings
+                </a>
+            @endcan
+            @can('createAnyResource')
+                {{-- A full page load: the deploy canvas uses the minimal layout. --}}
+                <a href="{{ route('deploy-canvas', ['project' => $project->uuid, 'environment' => $environment->uuid]) }}"
+                    class="button button-highlighted whitespace-nowrap">
+                    <x-reicon name="plus" class="size-3.5" />
+                    New resource
+                </a>
+            @endcan
+        </div>
+    </div>
+</div>
diff --git a/resources/views/livewire/project/index.blade.php b/resources/views/livewire/project/index.blade.php
index 1351424f70..7a476c1c0c 100644
--- a/resources/views/livewire/project/index.blade.php
+++ b/resources/views/livewire/project/index.blade.php
@@ -48,7 +48,7 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-2">
+                <div class="flex flex-wrap items-center gap-2">
                     <x-table.dropdown panel-class="w-52!">
                         <x-slot:trigger>
                             <button type="button" class="button" aria-haspopup="listbox" :aria-expanded="open">
@@ -75,27 +75,8 @@
                             </template>
                     </x-table.dropdown>
 
-                    <div
-                        class="view-toggle">
-                        <button type="button" x-on:click="setViewMode('table')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'table'
-                                ?
-                                'control-selected' :
-                                'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Table view" title="Table view">
-                            <x-reicon name="unordered-list" class="size-3.5" />
-                        </button>
-                        <button type="button" x-on:click="setViewMode('grid')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'grid'
-                                ?
-                                'control-selected' :
-                                'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Grid view" title="Grid view">
-                            <x-reicon name="grid" class="size-3.5" />
-                        </button>
-                    </div>
+                    <x-canvas-view-toggle :list-url="route('project.index')"
+                        :canvas-url="route('project.canvas.index')" />
                 </div>
             </div>
 
@@ -244,7 +225,7 @@
             search: '',
             sortBy: 'name-asc',
             sortOpen: false,
-            viewMode: localStorage.getItem('projects-view') || 'grid',
+            viewMode: @js($this->listView('projects', 'grid')),
             page: 1,
             pageSize: 12,
             projects: @js($projectsJs),
@@ -312,7 +293,7 @@
             setViewMode(mode) {
                 this.viewMode = mode;
                 this.page = 1;
-                localStorage.setItem('projects-view', mode);
+                this.$wire.saveListView('projects', mode);
             },
             previousPage() {
                 this.page = Math.max(1, this.page - 1);
diff --git a/resources/views/livewire/project/new/gitea-private-repository.blade.php b/resources/views/livewire/project/new/gitea-private-repository.blade.php
new file mode 100644
index 0000000000..6ed15d6312
--- /dev/null
+++ b/resources/views/livewire/project/new/gitea-private-repository.blade.php
@@ -0,0 +1,146 @@
+<div class="mt-8 flex w-full max-w-none flex-col gap-6 lg:mt-3">
+    @if ($gitea_apps->isEmpty())
+        <section class="application-settings-section">
+            <div class="application-settings-section-header">
+                <div>
+                    <h2>Gitea App</h2>
+                    <p>Connect a Gitea App before selecting a private repository.</p>
+                </div>
+            </div>
+            <div class="application-settings-section-body">
+                <x-empty title="No Gitea Apps"
+                    description="Create an app to grant Coolify access to selected repositories."
+                    icon-name="sources">
+                    <x-slot:contents>
+                        <x-modal-input buttonTitle="+ Add Gitea App" title="New Gitea App" closeOutside="false">
+                            <livewire:source.gitea.create />
+                        </x-modal-input>
+                    </x-slot:contents>
+                </x-empty>
+            </div>
+        </section>
+    @elseif ($current_step === 'gitea_apps')
+        <section class="application-settings-section">
+            <div class="application-settings-section-header">
+                <div>
+                    <h2>Choose Gitea App</h2>
+                    <p>Select the Gitea App that can access the repository you want to deploy.</p>
+                </div>
+                <x-modal-input buttonTitle="+ Add Gitea App" title="New Gitea App" closeOutside="false">
+                    <livewire:source.gitea.create />
+                </x-modal-input>
+            </div>
+            <div class="application-settings-section-body p-0!">
+                @foreach ($gitea_apps as $gtapp)
+                    <button type="button"
+                        class="group flex w-full items-center gap-3 border-b border-neutral-200 px-4 py-3 text-left transition-colors last:border-b-0 hover:bg-neutral-50 dark:border-white/[0.06] dark:hover:bg-white/[0.025]"
+                        wire:click.prevent="loadRepositories({{ $gtapp->id }})"
+                        wire:loading.attr="disabled" wire:target="loadRepositories({{ $gtapp->id }})"
+                        wire:key="{{ $gtapp->id }}">
+                        <div
+                            class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-100 text-neutral-500 dark:bg-white/[0.06] dark:text-fg-dim">
+                            <x-git-icon class="size-4" git="App\Models\GiteaApp" />
+                        </div>
+                        <div class="min-w-0 flex-1">
+                            <div class="truncate text-sm font-semibold text-black dark:text-fg">
+                                {{ data_get($gtapp, 'name') }}
+                            </div>
+                            <p class="mt-0.5 truncate text-xs text-neutral-500 dark:text-fg-dim">
+                                {{ data_get($gtapp, 'html_url') }}
+                            </p>
+                        </div>
+                        <x-loading wire:loading wire:target="loadRepositories({{ $gtapp->id }})" />
+                    </button>
+                @endforeach
+            </div>
+        </section>
+    @elseif ($current_step === 'repository')
+        <section class="application-settings-section">
+            <div class="application-settings-section-header">
+                <div>
+                    <h2>Choose repository</h2>
+                    <p>Search repositories available through the selected Gitea App.</p>
+                </div>
+                @if ($gitea_app_id)
+                    <x-forms.button wire:click.prevent="loadRepositories({{ $gitea_app_id }})">
+                        Refresh
+                    </x-forms.button>
+                @endif
+            </div>
+            <div class="application-settings-section-body">
+                @if ($repositories->isNotEmpty())
+                    <div class="flex items-end gap-2">
+                        <x-forms.listbox id="selected_project_id" label="Repository" searchable live
+                            placeholder="Select a repository" searchPlaceholder="Search repositories…"
+                            :options="$repositories->map(fn ($repository) => [
+                                'value' => data_get($repository, 'id'),
+                                'label' => data_get($repository, 'full_name'),
+                            ])->values()->all()" />
+                        <x-forms.button :showLoadingIndicator="false" wire:click.prevent="loadBranches"
+                            wire:target="loadBranches,selected_project_id">
+                            <x-loading-on-button wire:loading.delay
+                                wire:target="loadBranches,selected_project_id" />
+                            Load repository
+                        </x-forms.button>
+                    </div>
+                @else
+                    <x-empty size="sm" title="No repositories available"
+                        description="Review this Gitea App configuration and grant access to a repository." />
+                @endif
+            </div>
+        </section>
+
+        @if ($branches->isNotEmpty())
+            <form wire:submit="submit">
+                <section class="application-settings-section">
+                    <div class="application-settings-section-header">
+                        <div>
+                            <h2>Build configuration</h2>
+                            <p>Choose the branch and build strategy for this application.</p>
+                        </div>
+                        <x-forms.button type="submit" isHighlighted>Continue</x-forms.button>
+                    </div>
+                    <div class="application-settings-section-body space-y-5">
+                        <div class="grid gap-4 sm:grid-cols-2">
+                            <x-forms.listbox id="selected_branch_name" label="Branch" required
+                                :options="$branches->map(fn ($branch) => [
+                                    'value' => data_get($branch, 'name'),
+                                    'label' => data_get($branch, 'name'),
+                                ])->values()->all()" />
+                            <x-forms.listbox id="build_pack" label="Build pack" required live :options="[
+                                ['value' => 'railpack', 'label' => 'Railpack'],
+                                ['value' => 'nixpacks', 'label' => 'Nixpacks'],
+                                ['value' => 'static', 'label' => 'Static'],
+                                ['value' => 'dockerfile', 'label' => 'Dockerfile'],
+                                ['value' => 'dockercompose', 'label' => 'Docker Compose'],
+                            ]" />
+                            @if ($show_is_static)
+                                <x-forms.listbox id="is_static" label="Output type" onChange="instantSave"
+                                    :options="[
+                                        ['value' => false, 'label' => 'Web application'],
+                                        ['value' => true, 'label' => 'Static site'],
+                                    ]" />
+                                <x-forms.input type="number" id="port" label="Port"
+                                    :readonly="$is_static || $build_pack === 'static'"
+                                    helper="Port the application listens on." />
+                            @endif
+                            @if ($is_static)
+                                <x-forms.input id="publish_directory" label="Publish directory"
+                                    helper="Directory containing the generated static assets." />
+                            @endif
+                        </div>
+
+                        @if ($build_pack === 'dockercompose')
+                            <x-forms.repository-paths class="sm:grid-cols-2" base="base_directory"
+                                file="docker_compose_location" fileLabel="Compose file"
+                                defaultFile="/docker-compose.yaml" />
+                        @else
+                            <x-forms.input wire:model="base_directory" label="Base directory"
+                                helper="Repository directory used as the build root." />
+                        @endif
+                    </div>
+                </section>
+            </form>
+        @endif
+    @endif
+</div>
diff --git a/resources/views/livewire/project/new/github-private-repository-deploy-key.blade.php b/resources/views/livewire/project/new/github-private-repository-deploy-key.blade.php
index 86eb652392..6ee5dfe990 100644
--- a/resources/views/livewire/project/new/github-private-repository-deploy-key.blade.php
+++ b/resources/views/livewire/project/new/github-private-repository-deploy-key.blade.php
@@ -81,32 +81,32 @@
                     @endif
 
                     @if ($build_pack === 'dockercompose')
-                        <div x-data="{
-                            baseDir: @js($base_directory),
-                            composeLocation: @js($docker_compose_location),
-                            normalize(path) {
-                                if (!path || path.trim() === '') return '/';
-                                const normalized = path.trim().replace(/\/+$/, '');
-                                return normalized.startsWith('/') ? normalized : '/' + normalized;
-                            },
-                        }" class="grid gap-4 sm:grid-cols-2">
-                            <x-forms.input placeholder="/" wire:model.defer="base_directory"
-                                label="Base directory" helper="Repository directory used as the build root."
-                                x-model="baseDir" @blur="baseDir = normalize(baseDir)" />
-                            <x-forms.input placeholder="/docker-compose.yaml"
-                                wire:model.defer="docker_compose_location" label="Compose file"
-                                helper="Path relative to the base directory." x-model="composeLocation"
-                                @blur="composeLocation = normalize(composeLocation)" />
-                            <p class="sm:col-span-2 text-xs text-neutral-500 dark:text-fg-dim">
-                                Resolved file:
-                                <code class="font-mono text-coollabs dark:text-warning"
-                                    x-text='(baseDir === "/" ? "" : baseDir) + (composeLocation.startsWith("/") ? composeLocation : "/" + composeLocation)'></code>
-                            </p>
-                        </div>
+                        <x-forms.repository-paths class="sm:grid-cols-2" base="base_directory"
+                            file="docker_compose_location" fileLabel="Compose file"
+                            defaultFile="/docker-compose.yaml" />
                     @else
                         <x-forms.input wire:model="base_directory" label="Base directory"
                             helper="Repository directory used as the build root." />
                     @endif
+
+                    @include('livewire.project.new.partials.smart-scan-summary')
+
+                    {{-- Dockerfile: pick a detected file or type a path --}}
+                    @if ($build_pack === 'dockerfile')
+                        <x-forms.listbox id="selectedDockerfile" label="Dockerfile" live searchable allowCustom placeholder="/Dockerfile"
+                            emptyText="No Dockerfiles detected. Type a path in the search field."
+                            searchPlaceholder="Search or type a path…"
+                            helper="Select a detected Dockerfile, or type a path relative to the base directory."
+                            :options="collect($detectedDockerfiles)->map(fn ($file) => ['value' => $file, 'label' => $file])->all()" />
+                    @endif
+
+                    {{-- Docker Compose file selector: pick a detected file or type a path --}}
+                    @if ($build_pack === 'dockercompose' && count($detectedDockerComposeFiles) > 0)
+                        <x-forms.listbox id="selectedDockerComposeFile" label="Docker Compose File" live searchable allowCustom
+                            searchPlaceholder="Search or type a path…"
+                            helper="Select a detected Docker Compose file, or type a path relative to the base directory."
+                            :options="collect($detectedDockerComposeFiles)->map(fn ($file) => ['value' => $file, 'label' => $file])->all()" />
+                    @endif
                 </div>
             </section>
         </form>
diff --git a/resources/views/livewire/project/new/github-private-repository.blade.php b/resources/views/livewire/project/new/github-private-repository.blade.php
index e2b691f929..c89472dd7a 100644
--- a/resources/views/livewire/project/new/github-private-repository.blade.php
+++ b/resources/views/livewire/project/new/github-private-repository.blade.php
@@ -104,6 +104,8 @@
                         <x-forms.button type="submit" wire:target="submit" isHighlighted>Continue</x-forms.button>
                     </div>
                     <div class="application-settings-section-body space-y-5">
+                        @include('livewire.project.new.partials.smart-scan-summary')
+
                         <div class="grid gap-4 sm:grid-cols-2">
                             <x-forms.listbox searchable id="selected_branch_name" label="Branch" required
                                 searchPlaceholder="Search branches…"
@@ -138,29 +140,27 @@
                             <x-nixpacks-deprecated-callout />
                         @endif
 
+                        {{-- Dockerfile: pick a detected file or type a path --}}
+                        @if ($build_pack === 'dockerfile')
+                            <x-forms.listbox id="selectedDockerfile" label="Dockerfile" live searchable allowCustom placeholder="/Dockerfile"
+                                emptyText="No Dockerfiles detected. Type a path in the search field."
+                                searchPlaceholder="Search or type a path…"
+                                helper="Select a detected Dockerfile, or type a path relative to the base directory."
+                                :options="collect($detectedDockerfiles)->map(fn ($file) => ['value' => $file, 'label' => $file])->all()" />
+                        @endif
+
+                        {{-- Docker Compose file selector: pick a detected file or type a path --}}
+                        @if ($build_pack === 'dockercompose' && count($detectedDockerComposeFiles) > 0)
+                            <x-forms.listbox id="selectedDockerComposeFile" label="Docker Compose File" live searchable allowCustom
+                                searchPlaceholder="Search or type a path…"
+                                helper="Select a detected Docker Compose file, or type a path relative to the base directory."
+                                :options="collect($detectedDockerComposeFiles)->map(fn ($file) => ['value' => $file, 'label' => $file])->all()" />
+                        @endif
+
                         @if ($build_pack === 'dockercompose')
-                            <div x-data="{
-                                baseDir: @js($base_directory),
-                                composeLocation: @js($docker_compose_location),
-                                normalize(path) {
-                                    if (!path || path.trim() === '') return '/';
-                                    const normalized = path.trim().replace(/\/+$/, '');
-                                    return normalized.startsWith('/') ? normalized : '/' + normalized;
-                                },
-                            }" class="grid gap-4 sm:grid-cols-2">
-                                <x-forms.input placeholder="/" wire:model.defer="base_directory"
-                                    label="Base directory" helper="Repository directory used as the build root."
-                                    x-model="baseDir" @blur="baseDir = normalize(baseDir)" />
-                                <x-forms.input placeholder="/docker-compose.yaml"
-                                    wire:model.defer="docker_compose_location" label="Compose file"
-                                    helper="Path relative to the base directory." x-model="composeLocation"
-                                    @blur="composeLocation = normalize(composeLocation)" />
-                                <p class="sm:col-span-2 text-xs text-neutral-500 dark:text-fg-dim">
-                                    Resolved file:
-                                    <code class="font-mono text-coollabs dark:text-warning"
-                                        x-text='(baseDir === "/" ? "" : baseDir) + (composeLocation.startsWith("/") ? composeLocation : "/" + composeLocation)'></code>
-                                </p>
-                            </div>
+                            <x-forms.repository-paths class="sm:grid-cols-2" base="base_directory"
+                                file="docker_compose_location" fileLabel="Compose file"
+                                defaultFile="/docker-compose.yaml" />
                         @else
                             <x-forms.input wire:model="base_directory" label="Base directory"
                                 helper="Repository directory used as the build root." />
diff --git a/resources/views/livewire/project/new/gitlab-private-repository.blade.php b/resources/views/livewire/project/new/gitlab-private-repository.blade.php
index a088844ec0..0a0e7e152d 100644
--- a/resources/views/livewire/project/new/gitlab-private-repository.blade.php
+++ b/resources/views/livewire/project/new/gitlab-private-repository.blade.php
@@ -135,28 +135,9 @@
                         @endif
 
                         @if ($build_pack === 'dockercompose')
-                            <div x-data="{
-                                baseDir: @js($base_directory),
-                                composeLocation: @js($docker_compose_location),
-                                normalize(path) {
-                                    if (!path || path.trim() === '') return '/';
-                                    const normalized = path.trim().replace(/\/+$/, '');
-                                    return normalized.startsWith('/') ? normalized : '/' + normalized;
-                                },
-                            }" class="grid gap-4 sm:grid-cols-2">
-                                <x-forms.input placeholder="/" wire:model.defer="base_directory"
-                                    label="Base directory" helper="Repository directory used as the build root."
-                                    x-model="baseDir" @blur="baseDir = normalize(baseDir)" />
-                                <x-forms.input placeholder="/docker-compose.yaml"
-                                    wire:model.defer="docker_compose_location" label="Compose file"
-                                    helper="Path relative to the base directory." x-model="composeLocation"
-                                    @blur="composeLocation = normalize(composeLocation)" />
-                                <p class="sm:col-span-2 text-xs text-neutral-500 dark:text-fg-dim">
-                                    Resolved file:
-                                    <code class="font-mono text-coollabs dark:text-warning"
-                                        x-text='(baseDir === "/" ? "" : baseDir) + (composeLocation.startsWith("/") ? composeLocation : "/" + composeLocation)'></code>
-                                </p>
-                            </div>
+                            <x-forms.repository-paths class="sm:grid-cols-2" base="base_directory"
+                                file="docker_compose_location" fileLabel="Compose file"
+                                defaultFile="/docker-compose.yaml" />
                         @else
                             <x-forms.input wire:model="base_directory" label="Base directory"
                                 helper="Repository directory used as the build root." />
diff --git a/resources/views/livewire/project/new/partials/env-import-modal.blade.php b/resources/views/livewire/project/new/partials/env-import-modal.blade.php
new file mode 100644
index 0000000000..bb8136e2b4
--- /dev/null
+++ b/resources/views/livewire/project/new/partials/env-import-modal.blade.php
@@ -0,0 +1,31 @@
+<x-modal-input title="Import environment variables" :wireIgnore="false"
+    subtitle="The variables are added to the application when you continue.">
+    <x-slot:content>
+        <x-forms.button type="button">{{ $envImported ? 'Edit' : 'Review' }}</x-forms.button>
+    </x-slot:content>
+
+    <div class="flex flex-col gap-4">
+        @if (count($detectedEnvFiles) > 1)
+            <x-forms.listbox id="selectedEnvFile" label="Env file" live
+                :options="collect($detectedEnvFiles)->map(fn ($file) => ['value' => $file, 'label' => $file])->all()" />
+        @endif
+        <div class="flex flex-col gap-2">
+            @foreach ($envExampleVars as $key => $value)
+                <div wire:key="env-import-{{ $selectedEnvFile }}-{{ $key }}"
+                    class="grid grid-cols-1 items-center gap-1 sm:grid-cols-[minmax(0,1fr)_minmax(0,2fr)] sm:gap-3">
+                    <span class="truncate font-mono text-[13px] text-neutral-600 dark:text-fg-dim" title="{{ $key }}">{{ $key }}</span>
+                    <x-forms.input id="envExampleVars.{{ $key }}" />
+                </div>
+            @endforeach
+        </div>
+    </div>
+
+    <x-slot:footer>
+        @if ($envImported)
+            <x-forms.button type="button" wire:click="clearEnvVars" @click="modalOpen = false">Remove import</x-forms.button>
+        @endif
+        <x-forms.button type="button" isHighlighted wire:click="confirmEnvImport" @click="modalOpen = false">
+            {{ $envImported ? 'Update' : 'Import' }} {{ count($envExampleVars) }} {{ Str::plural('variable', count($envExampleVars)) }}
+        </x-forms.button>
+    </x-slot:footer>
+</x-modal-input>
diff --git a/resources/views/livewire/project/new/partials/smart-scan-summary.blade.php b/resources/views/livewire/project/new/partials/smart-scan-summary.blade.php
new file mode 100644
index 0000000000..690bba4303
--- /dev/null
+++ b/resources/views/livewire/project/new/partials/smart-scan-summary.blade.php
@@ -0,0 +1,73 @@
+{{--
+    Smart Scan result inside the build configuration, as a compact divided list: the build pack,
+    the Dockerfile port, and the env file import. The scan button sends the current base directory,
+    so the user can scan a subdirectory after changing it.
+--}}
+@php
+    $buildPackLabels = ['dockercompose' => 'Docker Compose', 'dockerfile' => 'Dockerfile'];
+    $suggestedFile = match ($suggestedBuildPack) {
+        'dockercompose' => $detectedDockerComposeFiles[0] ?? null,
+        'dockerfile' => $detectedDockerfiles[0] ?? null,
+        default => null,
+    };
+    $nestedFiles = collect([
+        count($detectedDockerfiles) ? count($detectedDockerfiles).' '.Str::plural('Dockerfile', count($detectedDockerfiles)) : null,
+        count($detectedDockerComposeFiles) ? count($detectedDockerComposeFiles).' '.Str::plural('Compose file', count($detectedDockerComposeFiles)) : null,
+    ])->filter()->join(' and ');
+    $showPort = $detectionRan && $build_pack === 'dockerfile' && in_array($selectedDockerfile, $detectedDockerfiles, true);
+@endphp
+
+<div class="overflow-hidden rounded-[10px] border border-neutral-200 dark:border-white/[0.08]">
+    <div class="flex min-h-10 items-center justify-between gap-3 border-b border-neutral-200 py-1.5 pr-1.5 pl-4 dark:border-white/[0.08]">
+        <p class="text-[10px] font-semibold uppercase tracking-[0.08em] text-neutral-400 dark:text-fg-faint">
+            Smart Scan
+        </p>
+        <x-forms.button type="button" wire:click="detectRepository">
+            <x-reicon name="search" class="size-3.5" />
+            {{ $detectionRan ? 'Scan again' : 'Scan repository' }}
+        </x-forms.button>
+    </div>
+
+    <div wire:loading.block wire:target="detectRepository">
+        <x-checkpoint-item status="running" title="Scanning the repository"
+            description="Looking for Dockerfiles, Compose files, and env files." />
+    </div>
+
+    <div wire:loading.remove wire:target="detectRepository" class="divide-y divide-neutral-200 dark:divide-white/[0.07]">
+        @if (! $detectionRan)
+            <x-checkpoint-item icon="search" title="Not scanned yet"
+                description="Scan the repository to find Dockerfiles, Compose files, and env files." />
+        @elseif ($detectionFailed)
+            <x-checkpoint-item status="error" title="Could not read the repository"
+                description="Check the repository access and the branch, or select the build pack manually." />
+        @elseif ($suggestedBuildPack)
+            <x-checkpoint-item status="success"
+                title="{{ $buildPackLabels[$suggestedBuildPack] }} {{ $build_pack === $suggestedBuildPack ? 'selected' : 'suggested' }}"
+                description="Found {{ $suggestedFile }} in the base directory." />
+        @elseif ($nestedFiles !== '')
+            <x-checkpoint-item icon="brain" title="Found {{ $nestedFiles }} in subdirectories" />
+        @else
+            <x-checkpoint-item icon="brain" title="No Dockerfile or Compose file found"
+                description="Select the build pack that fits the repository." />
+        @endif
+
+        @if ($showPort)
+            @if ($detectedPort)
+                <x-checkpoint-item status="success" title="Port {{ $detectedPort }}"
+                    description="From EXPOSE in {{ $selectedDockerfile }}." />
+            @else
+                <x-checkpoint-item icon="globe" title="Port {{ $port }}"
+                    description="{{ $selectedDockerfile }} has no EXPOSE instruction, so the default port is used." />
+            @endif
+        @endif
+
+        @if ($detectionRan && count($envExampleVars) > 0)
+            <div class="flex items-center justify-between gap-3 pr-4">
+                <x-checkpoint-item :status="$envImported ? 'success' : 'idle'" icon="variables"
+                    title="{{ $selectedEnvFile }}"
+                    description="{{ count($envExampleVars) }} {{ Str::plural('variable', count($envExampleVars)) }}{{ $envImported ? ', imported when you continue' : '' }}." />
+                @include('livewire.project.new.partials.env-import-modal')
+            </div>
+        @endif
+    </div>
+</div>
diff --git a/resources/views/livewire/project/new/public-git-repository.blade.php b/resources/views/livewire/project/new/public-git-repository.blade.php
index 8e0b7a1bfe..8825ea3ee5 100644
--- a/resources/views/livewire/project/new/public-git-repository.blade.php
+++ b/resources/views/livewire/project/new/public-git-repository.blade.php
@@ -56,6 +56,8 @@
                         </x-callout>
                     @endif
 
+                    @include('livewire.project.new.partials.smart-scan-summary')
+
                     <div class="grid gap-4 sm:grid-cols-2">
                         <x-forms.input id="git_branch" label="Branch"
                             :disabled="$git_source !== 'other'"
@@ -87,29 +89,27 @@
                         <x-nixpacks-deprecated-callout />
                     @endif
 
+                    {{-- Dockerfile: pick a detected file or type a path --}}
+                    @if ($build_pack === 'dockerfile')
+                        <x-forms.listbox id="selectedDockerfile" label="Dockerfile" live searchable allowCustom placeholder="/Dockerfile"
+                            emptyText="No Dockerfiles detected. Type a path in the search field."
+                            searchPlaceholder="Search or type a path…"
+                            helper="Select a detected Dockerfile, or type a path relative to the base directory."
+                            :options="collect($detectedDockerfiles)->map(fn ($file) => ['value' => $file, 'label' => $file])->all()" />
+                    @endif
+
+                    {{-- Docker Compose file selector: pick a detected file or type a path --}}
+                    @if ($build_pack === 'dockercompose' && count($detectedDockerComposeFiles) > 0)
+                        <x-forms.listbox id="selectedDockerComposeFile" label="Docker Compose File" live searchable allowCustom
+                            searchPlaceholder="Search or type a path…"
+                            helper="Select a detected Docker Compose file, or type a path relative to the base directory."
+                            :options="collect($detectedDockerComposeFiles)->map(fn ($file) => ['value' => $file, 'label' => $file])->all()" />
+                    @endif
+
                     @if ($build_pack === 'dockercompose')
-                        <div x-data="{
-                            baseDir: @js($base_directory),
-                            composeLocation: @js($docker_compose_location),
-                            normalize(path) {
-                                if (!path || path.trim() === '') return '/';
-                                const normalized = path.trim().replace(/\/+$/, '');
-                                return normalized.startsWith('/') ? normalized : '/' + normalized;
-                            },
-                        }" class="grid gap-4 sm:grid-cols-2">
-                            <x-forms.input placeholder="/" wire:model.defer="base_directory"
-                                label="Base directory" helper="Repository directory used as the build root."
-                                x-model="baseDir" @blur="baseDir = normalize(baseDir)" />
-                            <x-forms.input placeholder="/docker-compose.yaml"
-                                wire:model.defer="docker_compose_location" label="Compose file"
-                                helper="Path relative to the base directory." x-model="composeLocation"
-                                @blur="composeLocation = normalize(composeLocation)" />
-                            <p class="sm:col-span-2 text-xs text-neutral-500 dark:text-fg-dim">
-                                Resolved file:
-                                <code class="font-mono text-coollabs dark:text-warning"
-                                    x-text='(baseDir === "/" ? "" : baseDir) + (composeLocation.startsWith("/") ? composeLocation : "/" + composeLocation)'></code>
-                            </p>
-                        </div>
+                        <x-forms.repository-paths class="sm:grid-cols-2" base="base_directory"
+                            file="docker_compose_location" fileLabel="Compose file"
+                            defaultFile="/docker-compose.yaml" />
                     @else
                         <x-forms.input wire:model="base_directory" label="Base directory"
                             helper="Repository directory used as the build root." />
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index 1e33c43d8a..2c20adb3a5 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -35,7 +35,7 @@
                                         :aria-selected="resourceType === option.value"
                                         @click="resourceType = option.value; close()">
                                         <span x-text="option.label"></span>
-                                        <x-reicon name="check-circle" class="size-3.5 text-black dark:text-fg"
+                                        <x-reicon name="check" class="size-3.5 text-black dark:text-fg"
                                             x-show="resourceType === option.value" />
                                     </button>
                                 </template>
@@ -71,7 +71,7 @@
                                         :aria-selected="selectedCategory === ''"
                                         @click="selectedCategory = ''; categorySearch = ''; categoryOpen = false">
                                         <span>All categories</span>
-                                        <x-reicon name="check-circle" class="size-3.5 text-black dark:text-fg"
+                                        <x-reicon name="check" class="size-3.5 text-black dark:text-fg"
                                             x-show="selectedCategory === ''" />
                                     </button>
                                     <template
@@ -81,7 +81,7 @@
                                             :aria-selected="selectedCategory === category"
                                             @click="selectedCategory = category; categorySearch = ''; categoryOpen = false">
                                             <span class="truncate" x-text="category"></span>
-                                            <x-reicon name="check-circle" class="size-3.5 text-black dark:text-fg"
+                                            <x-reicon name="check" class="size-3.5 text-black dark:text-fg"
                                                 x-show="selectedCategory === category" />
                                         </button>
                                     </template>
@@ -92,6 +92,29 @@
                 </div>
             </x-application.settings-section>
 
+            {{-- A full page load: the canvas uses the minimal layout. --}}
+            <a href="{{ route('deploy-canvas', ['project' => data_get($parameters, 'project_uuid'), 'environment' => data_get($parameters, 'environment_uuid')]) }}"
+                x-show="search === ''"
+                class="mt-6 flex items-center gap-4 rounded-lg border border-neutral-200 bg-white p-4 shadow-[0_1px_2px_rgb(0_0_0/0.05)] transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.05] dark:shadow-none dark:hover:border-white/[0.14]">
+                <div
+                    class="flex size-11 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+                    <x-reicon name="deploy-canvas" class="size-5" />
+                </div>
+                <div class="min-w-0 flex-1">
+                    <div class="flex items-center gap-2">
+                        <h2 class="text-[14px]! leading-5! font-semibold! text-black! dark:text-fg!">Deploy canvas</h2>
+                        <x-beta-badge />
+                    </div>
+                    <p class="mt-0.5 text-[12px] leading-5 text-neutral-600 dark:text-fg-dim">
+                        Connect a server, a source, and its settings step by step, then deploy every resource at once.
+                    </p>
+                </div>
+                <span class="button button-highlighted shrink-0 max-sm:hidden">
+                    Try it
+                    <x-reicon name="arrow-right" class="size-3.5" />
+                </span>
+            </a>
+
             <div x-show="loading" class="mt-6">
                 <x-skeleton.cards :count="6" label="Loading resources" />
             </div>
diff --git a/resources/views/livewire/project/partials/new-environment-form.blade.php b/resources/views/livewire/project/partials/new-environment-form.blade.php
new file mode 100644
index 0000000000..b81572efa6
--- /dev/null
+++ b/resources/views/livewire/project/partials/new-environment-form.blade.php
@@ -0,0 +1,11 @@
+<form class="space-y-4" wire:submit="submit">
+    <x-forms.input placeholder="staging" id="name" label="Name" required />
+
+    <footer
+        class="flex justify-end border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+        <x-forms.button type="submit"
+            defaultClass="button button-highlighted">
+            Create environment
+        </x-forms.button>
+    </footer>
+</form>
diff --git a/resources/views/livewire/project/project-canvas.blade.php b/resources/views/livewire/project/project-canvas.blade.php
new file mode 100644
index 0000000000..8083cdc921
--- /dev/null
+++ b/resources/views/livewire/project/project-canvas.blade.php
@@ -0,0 +1,38 @@
+<div class="h-full">
+    <x-slot:title>
+        {{ $project->name }} > Canvas | Coolify
+    </x-slot>
+    <div data-environment-canvas data-endpoint="/projects/{{ $project->uuid }}/canvas"
+        data-empty="No resources in this project yet"
+        data-view-only="Only team admins can move cards and edit links."
+        data-team="{{ $project->team_id }}" data-user="{{ auth()->id() }}"
+        class="relative h-full" wire:ignore>
+        {{-- The canvas moves this group into its toolbar (page actions last, at the right end),
+             which can be outside this component,
+             so buttons open the modals below with a window event. --}}
+        <div data-ec-views class="flex items-center gap-2">
+            <x-canvas-view-toggle on-canvas
+                :list-url="route('project.show', ['project_uuid' => $project->uuid])"
+                :canvas-url="route('project.canvas', ['project_uuid' => $project->uuid])" />
+            @can('update', $project)
+                <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}
+                    class="button whitespace-nowrap" title="Project settings"
+                    aria-label="Open settings for {{ $project->name }}">
+                    <x-reicon name="settings" class="size-3.5" />
+                    Settings
+                </a>
+                <button type="button" x-data x-on:click="$dispatch('open-new-environment')"
+                    class="button button-highlighted whitespace-nowrap">
+                    <x-reicon name="plus" class="size-3.5" />
+                    New environment
+                </button>
+            @endcan
+        </div>
+    </div>
+    @can('update', $project)
+        <x-modal-input title="New Environment" x-on:open-new-environment.window="modalOpen = true">
+            <x-slot:content></x-slot:content>
+            @include('livewire.project.partials.new-environment-form')
+        </x-modal-input>
+    @endcan
+</div>
diff --git a/resources/views/livewire/project/projects-canvas.blade.php b/resources/views/livewire/project/projects-canvas.blade.php
new file mode 100644
index 0000000000..b909d6a39a
--- /dev/null
+++ b/resources/views/livewire/project/projects-canvas.blade.php
@@ -0,0 +1,31 @@
+<div class="h-full">
+    <x-slot:title>
+        Projects > Canvas | Coolify
+    </x-slot>
+    <div data-environment-canvas data-endpoint="/projects/canvas"
+        data-empty="No resources in your projects yet"
+        data-view-only="Only team admins can move cards and edit links."
+        data-team="{{ $teamId }}" data-user="{{ auth()->id() }}"
+        class="relative h-full" wire:ignore>
+        {{-- The canvas moves this group into its toolbar (page actions last, at the right end),
+             which can be outside this component,
+             so buttons open the modals below with a window event. --}}
+        <div data-ec-views class="flex items-center gap-2">
+            <x-canvas-view-toggle on-canvas :list-url="route('project.index')"
+                :canvas-url="route('project.canvas.index')" />
+            @can('createAnyResource')
+                <button type="button" x-data x-on:click="$dispatch('open-new-project')"
+                    class="button button-highlighted whitespace-nowrap">
+                    <x-reicon name="plus" class="size-3.5" />
+                    New project
+                </button>
+            @endcan
+        </div>
+    </div>
+    @can('createAnyResource')
+        <x-modal-input title="New Project" x-on:open-new-project.window="modalOpen = true">
+            <x-slot:content></x-slot:content>
+            <livewire:project.add-empty />
+        </x-modal-input>
+    @endcan
+</div>
diff --git a/resources/views/livewire/project/resource/create.blade.php b/resources/views/livewire/project/resource/create.blade.php
index 2821dbfc25..ec58c27455 100644
--- a/resources/views/livewire/project/resource/create.blade.php
+++ b/resources/views/livewire/project/resource/create.blade.php
@@ -8,6 +8,8 @@
         <livewire:project.new.github-private-repository :type="$type" />
     @elseif ($type === 'private-gitlab-app')
         <livewire:project.new.gitlab-private-repository :type="$type" />
+    @elseif ($type === 'private-gitea-app')
+        <livewire:project.new.gitea-private-repository :type="$type" />
     @elseif ($type === 'private-deploy-key')
         <livewire:project.new.github-private-repository-deploy-key :type="$type" />
     @elseif ($type === 'dockerfile')
diff --git a/resources/views/livewire/project/resource/index.blade.php b/resources/views/livewire/project/resource/index.blade.php
index f2a874527e..57dcd456d6 100644
--- a/resources/views/livewire/project/resource/index.blade.php
+++ b/resources/views/livewire/project/resource/index.blade.php
@@ -5,13 +5,31 @@
     <div x-data="resourceIndex()" class="w-full">
         <header class="mb-5 flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
             <div class="min-w-0">
-                <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">{{ $environment->name }}</h1>
+                <div class="flex min-w-0 items-center gap-1.5">
+                    <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">{{ $environment->name }}</h1>
+                    @can('update', $project)
+                        <a href="{{ route('project.environment.edit', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
+                            {{ wireNavigate() }}
+                            class="flex size-7 shrink-0 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg"
+                            title="Environment settings"
+                            aria-label="Open settings for {{ $environment->name }}">
+                            <x-reicon name="settings" class="size-4" />
+                        </a>
+                    @endcan
+                </div>
                 <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
                     <span x-text="`${resources.length} ${resources.length === 1 ? 'resource' : 'resources'}`"></span>
-                    in {{ $project->name }}
+                    in <a href="{{ route('project.show', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}
+                        class="font-medium text-neutral-700 underline-offset-2 hover:text-black hover:underline dark:text-fg dark:hover:text-white"
+                        title="Show all environments in {{ $project->name }}">{{ $project->name }}</a>
                 </p>
             </div>
-            <div class="flex w-fit shrink-0 items-center gap-2">
+            <div class="flex flex-wrap items-center gap-2 sm:shrink-0">
+                @if ($environment->isEmpty())
+                    {{-- The list toolbar (with its canvas switch) is hidden when there are no resources. --}}
+                    <x-canvas-view-toggle :views="['list' => ['List view', 'unordered-list']]"
+                        :canvas-url="route('project.environment.canvas', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid])" />
+                @endif
                 <a href="{{ route('shared-variables.environment.show', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
                     {{ wireNavigate() }}
                     class="button whitespace-nowrap"
@@ -20,16 +38,6 @@
                     <x-reicon name="variables" class="size-3.5" />
                     Shared variables
                 </a>
-                @can('update', $project)
-                    <a href="{{ route('project.environment.edit', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
-                        {{ wireNavigate() }}
-                        class="button whitespace-nowrap"
-                        title="Environment settings"
-                        aria-label="Open settings for {{ $environment->name }}">
-                        <x-reicon name="settings" class="size-3.5" />
-                        Settings
-                    </a>
-                @endcan
                 @can('createAnyResource')
                     <a href="{{ route('project.resource.create', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
                         {{ wireNavigate() }}
@@ -74,7 +82,7 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-2">
+                <div class="flex flex-wrap items-center gap-2">
                     <x-table.dropdown panel-class="w-64! overflow-hidden! p-0!" :multiselectable="true">
                         <x-slot:trigger>
                             <button type="button" class="button max-w-64"
@@ -149,27 +157,9 @@
                             </template>
                     </x-table.dropdown>
 
-                    <div
-                        class="view-toggle">
-                        <button type="button" x-on:click="setViewMode('table')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'table'
-                                ?
-                                'control-selected' :
-                                'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Table view" title="Table view">
-                            <x-reicon name="unordered-list" class="size-3.5" />
-                        </button>
-                        <button type="button" x-on:click="setViewMode('grid')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'grid'
-                                ?
-                                'control-selected' :
-                                'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Grid view" title="Grid view">
-                            <x-reicon name="grid" class="size-3.5" />
-                        </button>
-                    </div>
+                    <x-canvas-view-toggle
+                        :list-url="route('project.resource.index', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid])"
+                        :canvas-url="route('project.environment.canvas', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid])" />
                 </div>
             </div>
 
@@ -193,16 +183,8 @@
                             {{ wireNavigate() }} class="absolute inset-0" :aria-label="`Open ${item.name}`"></a>
                         <div class="flex min-w-0 items-center gap-3">
                             <div
-                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
-                                <template x-if="item.type === 'application'">
-                                    <x-reicon name="browser-code" class="size-4" />
-                                </template>
-                                <template x-if="item.type === 'database'">
-                                    <x-reicon name="database" class="size-4" />
-                                </template>
-                                <template x-if="item.type === 'service'">
-                                    <x-reicon name="layers" class="size-4" />
-                                </template>
+                                class="flex size-8 shrink-0 items-center justify-center overflow-hidden rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
+                                <span class="contents" x-html="item.logoHtml"></span>
                             </div>
                             <div class="min-w-0">
                                 <div class="flex min-w-0 items-center gap-1.5">
@@ -287,16 +269,8 @@
 
                             <div class="flex items-start gap-3">
                                 <div
-                                    class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                                    <template x-if="item.type === 'application'">
-                                        <x-reicon name="browser-code" class="size-4" />
-                                    </template>
-                                    <template x-if="item.type === 'database'">
-                                        <x-reicon name="database" class="size-4" />
-                                    </template>
-                                    <template x-if="item.type === 'service'">
-                                        <x-reicon name="layers" class="size-4" />
-                                    </template>
+                                    class="flex size-8 shrink-0 items-center justify-center overflow-hidden rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+                                <span class="contents" x-html="item.logoHtml"></span>
                                 </div>
                                 <div class="min-w-0 flex-1">
                                     <div class="flex min-w-0 items-center gap-1.5">
@@ -353,7 +327,7 @@
             serverFilters: [],
             statusFilters: [],
             sortBy: 'name-asc',
-            viewMode: localStorage.getItem('environment-resource-view') || 'table',
+            viewMode: @js($this->listView('environment', 'table')),
             filterOpen: false,
             sortOpen: false,
             page: 1,
@@ -522,7 +496,7 @@
             setViewMode(mode) {
                 this.viewMode = mode;
                 this.page = 1;
-                localStorage.setItem('environment-resource-view', mode);
+                this.$wire.saveListView('environment', mode);
             },
             statusState(item) {
                 if (item.restartLimitReached) {
diff --git a/resources/views/livewire/project/service/backup-executions.blade.php b/resources/views/livewire/project/service/backup-executions.blade.php
index 61fd3e9d0b..761b2e2dce 100644
--- a/resources/views/livewire/project/service/backup-executions.blade.php
+++ b/resources/views/livewire/project/service/backup-executions.blade.php
@@ -1,4 +1,10 @@
-<div>
+<div x-on:open-backup-download.window="window.location.href = $event.detail.url">
+    @if (count($pendingDownloads) > 0)
+        <div wire:poll.3s="checkDownloads" class="hidden"></div>
+    @endif
+    @if ($executions->onFirstPage())
+        <div wire:poll.5000ms class="hidden"></div>
+    @endif
     @php
         $server = $service->server;
     @endphp
@@ -66,7 +72,12 @@
                         </span>
                         <span>{{ $execution['size'] ? formatBytes($execution['size']) : '-' }}</span>
                         <span class="flex justify-end">
-                            @if ($execution['download_url'])
+                            @if ($execution['download_url'] && $s3Downloads)
+                                <button type="button" wire:click.stop="downloadExecution('{{ $execution['uuid'] }}')"
+                                    class="icon-button shrink-0" title="Download backup" aria-label="Download backup">
+                                    <x-reicon name="upload" class="size-3.5 rotate-180" />
+                                </button>
+                            @elseif ($execution['download_url'])
                                 <a href="{{ $execution['download_url'] }}" target="_blank" rel="noopener"
                                     @click.stop class="icon-button shrink-0" title="Download backup"
                                     aria-label="Download backup">
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index 379c6f9f4f..6b33ce5c45 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -6,51 +6,6 @@
     <livewire:project.service.heading :service="$service" :parameters="$parameters" :query="$query" />
 
     @php
-        $serviceRouteParameters = [
-            'project_uuid' => $project->uuid,
-            'environment_uuid' => $environment->uuid,
-            'service_uuid' => $service->uuid,
-        ];
-
-        $configurationItems = collect([
-            ['label' => 'General', 'route' => 'project.service.configuration', 'icon' => 'settings'],
-            ['label' => 'Domains', 'route' => 'project.service.domains', 'icon' => 'globe'],
-            ['label' => 'Environment Variables', 'route' => 'project.service.environment-variables', 'icon' => 'variables', 'hasWarning' => ! $service->isDeployable],
-            ['label' => 'Persistent Storage', 'route' => 'project.service.storages', 'icon' => 'storages'],
-            ['label' => 'Backups', 'route' => 'project.service.volume-backups.index', 'icon' => 'database'],
-            ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
-            ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
-            ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
-            ['label' => 'Analytics', 'route' => 'project.service.analytics', 'icon' => 'analytics'],
-            ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
-            ['label' => 'Webhooks', 'route' => 'project.service.webhooks', 'icon' => 'notifications'],
-            ['label' => 'Resource Operations', 'route' => 'project.service.resource-operations', 'icon' => 'server-update'],
-            ['label' => 'Tags', 'route' => 'project.service.tags', 'icon' => 'tags'],
-            ['label' => 'Danger Zone', 'route' => 'project.service.danger', 'icon' => 'shield-alert'],
-        ])->filter(fn (array $item): bool => $item['visible'] ?? true)->map(fn (array $item): array => [
-            ...$item,
-            'active' => $currentRoute === $item['route']
-                || ($item['route'] === 'project.service.scheduled-tasks.show'
-                    && str($currentRoute)->startsWith('project.service.scheduled-tasks')),
-        ]);
-
-        $menuGroups = [
-            'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
-            'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Analytics'],
-            'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
-            'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
-        ];
-
-        $groupedItems = collect($menuGroups)
-            ->map(fn (array $labels) => collect($labels)
-                ->map(fn (string $label) => $configurationItems->firstWhere('label', $label))
-                ->filter()
-                ->values())
-            ->filter(fn ($items) => $items->isNotEmpty());
-
-        // Group that holds the current page — always kept open, even if collapsed before.
-        $activeGroup = (string) $groupedItems->search(fn ($items) => $items->contains(fn ($item) => $item['active'] ?? false));
-
         $storageSections = $applications
             ->concat($databases)
             ->map(fn ($resource): array => [
@@ -61,57 +16,8 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-            <aside class="application-settings-navigation min-w-0 xl:self-start"
-                data-settings-search-items="{{ json_encode(settingsSearchItems($groupedItems, $serviceRouteParameters)) }}">
-                <nav aria-label="Service settings"
-                    x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.service' })"
-                    class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                    @foreach ($groupedItems as $groupLabel => $groupItems)
-                        @unless ($loop->first)
-                            <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]"
-                                aria-hidden="true"></div>
-                        @endunless
-                        <button type="button" class="nav-section-toggle hidden xl:flex" @click="toggle(@js($groupLabel))"
-                            :aria-expanded="isOpen(@js($groupLabel))">
-                            <span>{{ $groupLabel }}</span>
-                            <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                                :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                                stroke="currentColor" stroke-width="2" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                            </svg>
-                        </button>
-                        <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
-                        @foreach ($groupItems as $menuItem)
-                            <a @class([
-                                'menu-item',
-                                'menu-item-active' => $menuItem['active'],
-                            ])
-                                @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
-                                href="{{ route($menuItem['route'], $serviceRouteParameters) }}">
-                                <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                                <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                                @if ($menuItem['hasWarning'] ?? false)
-                                    <span class="ml-auto size-2 shrink-0 rounded-full bg-error" title="Required environment variables missing"></span>
-                                @endif
-                            </a>
-                            @if ($menuItem['active'] && $menuItem['route'] === 'project.service.storages' && $storageSections->isNotEmpty())
-                                <div class="nav-children hidden flex-col gap-0.5 py-1 xl:flex"
-                                    x-data="{ activeSection: '' }">
-                                    @foreach ($storageSections as $section)
-                                        <button type="button" class="menu-subitem"
-                                            :class="activeSection === '{{ $section['id'] }}' && 'menu-subitem-active'"
-                                            @click="activeSection = '{{ $section['id'] }}'; window.scrollToSettingsSection?.('{{ $section['id'] }}')">
-                                            <span class="menu-item-label truncate text-left"
-                                                title="{{ $section['label'] }}">{{ $section['label'] }}</span>
-                                        </button>
-                                    @endforeach
-                                </div>
-                            @endif
-                        @endforeach
-                        </div>
-                    @endforeach
-                </nav>
-            </aside>
+            <x-service.configuration-sidebar :service="$service" :current-route="$currentRoute"
+                :storage-sections="$storageSections" />
 
             <div class="min-w-0">
                 @if ($currentRoute === 'project.service.configuration')
@@ -124,79 +30,56 @@
                             localStorage.setItem('service-compose-resources-view', mode);
                         }
                     }">
-                        <div class="mb-3 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                            <div>
-                                <h2 class="text-base font-semibold text-black dark:text-fg">Compose resources</h2>
-                                <p class="mt-1 text-sm text-neutral-500 dark:text-fg-dim">
-                                    Applications and databases defined in this service.
-                                </p>
-                            </div>
-                            <div class="flex w-full items-center justify-between gap-2 sm:w-auto sm:justify-start">
-                                <div
-                                    class="view-toggle">
-                                    <button type="button" x-on:click="setViewMode('table')"
-                                        class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                                        :class="viewMode === 'table'
-                                            ? 'control-selected'
-                                            : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                                        aria-label="Table view" title="Table view">
-                                        <x-reicon name="unordered-list" class="size-3.5" />
-                                    </button>
-                                    <button type="button" x-on:click="setViewMode('grid')"
-                                        class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                                        :class="viewMode === 'grid'
-                                            ? 'control-selected'
-                                            : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                                        aria-label="Grid view" title="Grid view">
-                                        <x-reicon name="grid" class="size-3.5" />
-                                    </button>
-                                </div>
+                        <x-application.settings-section id="compose-resources-section" title="Compose resources"
+                            description="Applications and databases defined in this service." flush>
+                            <x-slot:actions>
+                                <x-canvas-view-toggle />
                                 <a class="button" target="_blank" href="{{ $service->documentation() }}">
                                     Documentation
                                     <x-reicon name="external-link" class="size-4" />
                                 </a>
+                            </x-slot:actions>
+
+                            <div :class="viewMode === 'grid'
+                                ? 'grid grid-cols-1 gap-3 p-3 sm:grid-cols-2'
+                                : 'overflow-x-auto rounded-lg'">
+                                @if ($applications->isNotEmpty() || $databases->isNotEmpty())
+                                    <div x-cloak x-show="viewMode === 'table'"
+                                        class="grid min-w-[48rem] grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
+                                        <div>Resource</div>
+                                        <div>Image</div>
+                                        <div class="justify-self-start">Status</div>
+                                        <div></div>
+                                    </div>
+                                @endif
+
+                                @if ($applications->isEmpty() && $databases->isEmpty())
+                                    <div class="p-4 sm:col-span-2">
+                                        <x-empty title="No compose resources"
+                                            description="No applications or databases are defined in this Docker Compose file."
+                                            icon-name="grid" />
+                                    </div>
+                                @endif
+
+                                @foreach ($applications as $application)
+                                    <livewire:project.service.resource-card :service="$service" :resource="$application"
+                                        :parameters="$parameters"
+                                        wire:key="service-application-card-{{ $application->id }}" />
+                                @endforeach
+                                @foreach ($databases as $database)
+                                    <livewire:project.service.resource-card :service="$service" :resource="$database"
+                                        :parameters="$parameters"
+                                        wire:key="service-database-card-{{ $database->id }}" />
+                                @endforeach
                             </div>
-                        </div>
-
-                        <div :class="viewMode === 'grid'
-                            ? 'grid grid-cols-1 gap-3 sm:grid-cols-2'
-                            : 'overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]'">
-                            @if ($applications->isNotEmpty() || $databases->isNotEmpty())
-                                <div x-cloak x-show="viewMode === 'table'"
-                                    class="grid min-w-[48rem] grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
-                                    <div>Resource</div>
-                                    <div>Image</div>
-                                    <div class="justify-self-start">Status</div>
-                                    <div></div>
-                                </div>
-                            @endif
-
-                            @if ($applications->isEmpty() && $databases->isEmpty())
-                                <div
-                                    class="application-settings-section overflow-hidden sm:col-span-2">
-                                    <x-empty title="No compose resources"
-                                        description="No applications or databases are defined in this Docker Compose file."
-                                        icon-name="grid" />
-                                </div>
-                            @endif
-
-                            @foreach ($applications as $application)
-                                <livewire:project.service.resource-card :service="$service" :resource="$application"
-                                    :parameters="$parameters"
-                                    wire:key="service-application-card-{{ $application->id }}" />
-                            @endforeach
-                            @foreach ($databases as $database)
-                                <livewire:project.service.resource-card :service="$service" :resource="$database"
-                                    :parameters="$parameters"
-                                    wire:key="service-database-card-{{ $database->id }}" />
-                            @endforeach
-                        </div>
+                        </x-application.settings-section>
                     </div>
                 @elseif ($currentRoute === 'project.service.analytics')
                     <livewire:project.service.analytics :service="$service"
                         :lazy="(bool) ($service->server ?? $service->destination?->server)?->isTrafficAnalyticsEnabled()" />
                 @elseif ($currentRoute === 'project.service.domains')
                     <livewire:project.service.domains :service="$service" />
+                    <livewire:project.shared.maintenance :resource="$service" />
                 @elseif ($currentRoute === 'project.service.environment-variables')
                     <livewire:project.shared.environment-variable.all :resource="$service" />
                     <livewire:project.shared.secret-manager-links :resource="$service" />
@@ -217,8 +100,6 @@
                     </div>
                 @elseif ($currentRoute === 'project.service.scheduled-tasks.show')
                     <livewire:project.shared.scheduled-task.all :resource="$service" />
-                @elseif ($currentRoute === 'project.service.scheduled-tasks')
-                    <livewire:project.shared.scheduled-task.show />
                 @elseif ($currentRoute === 'project.service.webhooks')
                     <livewire:project.shared.webhooks :resource="$service" />
                 @elseif ($currentRoute === 'project.service.resource-operations')
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index e40ab95145..293ff827d2 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -1,6 +1,5 @@
 @php
     $configuredCount = collect($domainRows)->where('is_suggested', false)->count();
-    $suggestedCount = collect($domainRows)->where('is_suggested', true)->count();
     $hasRows = count($domainRows) > 0;
     $hasDnsChecksInProgress = collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking');
     $serviceAppCount = count($serviceApps);
@@ -69,25 +68,16 @@
     @endcannot
 
     {{-- Toolbar --}}
-    <div class="flex flex-wrap items-center gap-2">
-        <div class="min-w-0 flex-1">
-            <h2 id="domains-section">Domains</h2>
-            <p class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }} across {{ $domainGroups->count() }} service{{ $domainGroups->count() === 1 ? '' : 's' }}
-                @if ($suggestedCount > 0)
-                    · {{ $suggestedCount }} not added
-                @endif
-            </p>
-        </div>
+    <div id="domains-section" class="flex flex-wrap items-center gap-2">
+        @if ($domainGroups->isNotEmpty())
+            <div class="relative w-full sm:w-64">
+                <x-reicon name="search"
+                    class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                <input type="search" x-model="domainSearch" aria-label="Search services or domains"
+                    class="input h-8! w-full pl-8! text-[13px]!" placeholder="Search services or domains" />
+            </div>
+        @endif
         <div class="ml-auto flex flex-wrap items-center gap-2">
-            @if ($domainGroups->isNotEmpty())
-                <div class="relative w-full sm:w-64">
-                    <x-reicon name="search"
-                        class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
-                    <input type="search" x-model="domainSearch" aria-label="Search services or domains"
-                        class="input h-8! w-full pl-8! text-[13px]!" placeholder="Search services or domains" />
-                </div>
-            @endif
             @can('update', $service)
                 @if ($configuredCount > 0)
                     <x-forms.button wire:click="checkAllDns" :showLoadingIndicator="false" wire:loading.attr="disabled"
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 268eaae499..798a4a8eae 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -4,14 +4,17 @@
     @endunless
     <section @class(['application-settings-workspace mt-4 w-full max-w-none lg:mt-0' => ! $embedded])>
         <div @class(['grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8' => ! $embedded])>
+        @unless ($embedded)
+            {{-- The service menu, one Back away from this compose resource menu in the main sidebar. --}}
+            <x-service.configuration-sidebar :service="$service" current-route="project.service.configuration" nav-only />
+        @endunless
         @if (! $embedded && $resourceType === 'database')
             <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase" />
         @elseif (! $embedded)
-            <aside class="application-settings-navigation min-w-0 xl:self-start">
+            <x-main-nav-menu :depth="1" back-label="Service" back-title="Back to the service menu">
                 <nav aria-label="Compose resource settings"
                     class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                    <div class="nav-section hidden xl:block">Compose resource</div>
-                <a class="menu-item" {{ wireNavigate() }}
+                <a class="menu-item" data-page-only {{ wireNavigate() }}
                     href="{{ route('project.service.configuration', [...$parameters, 'stack_service_uuid' => null]) }}">
                     <x-reicon name="logout" class="menu-item-icon rotate-180" />
                     <span class="menu-item-label">Back to service</span>
@@ -22,7 +25,7 @@
                     <span class="menu-item-label">General</span>
                 </a>
                 </nav>
-            </aside>
+            </x-main-nav-menu>
         @endif
         <div class="min-w-0">
             @if ($resourceType === 'application')
diff --git a/resources/views/livewire/project/service/volume-backup/index.blade.php b/resources/views/livewire/project/service/volume-backup/index.blade.php
index 61c4657924..e3605b7a7f 100644
--- a/resources/views/livewire/project/service/volume-backup/index.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/index.blade.php
@@ -76,7 +76,7 @@
 
                 <x-backup-tabs context="service-schedule" :parameters="$parameters" section="general" />
 
-                @foreach (['general', 's3', 'retention', 'danger'] as $modalSection)
+                @foreach (['general', 'danger'] as $modalSection)
                     <div x-show="activeSection === '{{ $modalSection }}'" x-cloak>
                         @if ($selectedDatabaseBackup)
                             <livewire:project.database.backup-edit :backup="$selectedDatabaseBackup"
@@ -268,8 +268,8 @@
                                 default => 'neutral',
                             };
                             $databaseBackupId = 'database:'.$databaseBackup->id;
-                            $databaseS3 = $databaseBackup->s3?->team_id === $serviceTeamId ? $databaseBackup->s3 : null;
-                            $databaseS3Tooltip = ! $databaseBackup->save_s3 ? 'S3 storage: Not configured' : ($databaseS3 ? 'S3 storage: '.$databaseS3->name.' (bucket: '.$databaseS3->bucket.')' : 'S3 storage: Unavailable');
+                            $databaseS3s = ($databaseBackup->s3Storages->isNotEmpty() ? $databaseBackup->s3Storages : collect([$databaseBackup->s3])->filter())->where('team_id', $serviceTeamId);
+                            $databaseS3Tooltip = ! $databaseBackup->save_s3 ? 'S3 storage: Not configured' : ($databaseS3s->isNotEmpty() ? 'S3 storage: '.$databaseS3s->map(fn ($s3) => $s3->name.' (bucket: '.$s3->bucket.')')->join(', ') : 'S3 storage: Unavailable');
                         @endphp
                         <div wire:key="database-backup-{{ $databaseBackup->uuid }}"
                             x-show="isVisible(@js($databaseBackupId))"
@@ -284,8 +284,8 @@
                             <span>{{ $databaseBackup->frequency }}</span>
                             <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
                             <span>
-                                <x-status-badge :status="$databaseBackup->save_s3 ? ($databaseS3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                    :type="$databaseBackup->save_s3 ? ($databaseS3 ? 'success' : 'error') : 'neutral'"
+                                <x-status-badge :status="$databaseBackup->save_s3 ? match ($databaseS3s->count()) { 0 => 'Unavailable', 1 => 'Configured', default => $databaseS3s->count().' storages' } : 'Not set'"
+                                    :type="$databaseBackup->save_s3 ? ($databaseS3s->isNotEmpty() ? 'success' : 'error') : 'neutral'"
                                     :data-tooltip="$databaseS3Tooltip" :aria-label="$databaseS3Tooltip" tabindex="0" />
                             </span>
                             <span>{{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}</span>
@@ -308,8 +308,8 @@
                     @foreach ($backups as $backup)
                         @php
                             $latestExecution = $backup->latestExecution;
-                            $volumeS3 = $backup->s3?->team_id === $serviceTeamId ? $backup->s3 : null;
-                            $volumeS3Tooltip = ! $backup->save_s3 ? 'S3 storage: Not configured' : ($volumeS3 ? 'S3 storage: '.$volumeS3->name.' (bucket: '.$volumeS3->bucket.')' : 'S3 storage: Unavailable');
+                            $volumeS3s = ($backup->s3Storages->isNotEmpty() ? $backup->s3Storages : collect([$backup->s3])->filter())->where('team_id', $serviceTeamId);
+                            $volumeS3Tooltip = ! $backup->save_s3 ? 'S3 storage: Not configured' : ($volumeS3s->isNotEmpty() ? 'S3 storage: '.$volumeS3s->map(fn ($s3) => $s3->name.' (bucket: '.$s3->bucket.')')->join(', ') : 'S3 storage: Unavailable');
                             $status = $latestExecution?->status;
                             $statusLabel = match ($status) {
                                 'running' => 'In progress',
@@ -338,8 +338,8 @@
                             <span>{{ $backup->frequency }}</span>
                             <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
                             <span>
-                                <x-status-badge :status="$backup->save_s3 ? ($volumeS3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                    :type="$backup->save_s3 ? ($volumeS3 ? 'success' : 'error') : 'neutral'"
+                                <x-status-badge :status="$backup->save_s3 ? match ($volumeS3s->count()) { 0 => 'Unavailable', 1 => 'Configured', default => $volumeS3s->count().' storages' } : 'Not set'"
+                                    :type="$backup->save_s3 ? ($volumeS3s->isNotEmpty() ? 'success' : 'error') : 'neutral'"
                                     :data-tooltip="$volumeS3Tooltip" :aria-label="$volumeS3Tooltip" tabindex="0" />
                             </span>
                             <span>
diff --git a/resources/views/livewire/project/shared/danger.blade.php b/resources/views/livewire/project/shared/danger.blade.php
index faeff1aed2..5aaf304ef1 100644
--- a/resources/views/livewire/project/shared/danger.blade.php
+++ b/resources/views/livewire/project/shared/danger.blade.php
@@ -17,6 +17,23 @@
     @endif
     <x-application.settings-section id="danger-zone-section" title="Danger zone"
         helper="Destructive resource actions cannot be undone.">
+        @if (in_array($resource?->type(), ['standalone-redis', 'standalone-keydb', 'standalone-dragonfly']))
+            <x-danger-zone title="Flush all data" class="mb-4">
+                <p>
+                    Permanently remove every key from
+                    <strong class="font-semibold text-black dark:text-fg">{{ $resourceName }}</strong>.
+                    The database keeps running.
+                </p>
+                <x-slot:action>
+                    <x-modal-confirmation title="Flush all data?" buttonTitle="Flush all data" isErrorButton
+                        submitAction="flush" :actions="['Permanently remove every key from every logical database.']"
+                        confirmationText="{{ $resourceName }}"
+                        confirmationLabel="Enter the database name to confirm flushing all data"
+                        shortConfirmationLabel="Database name" :disabled="auth()->user()->cannot('manage', $resource)"
+                        disabledTooltip="You do not have permission to flush this database." />
+                </x-slot:action>
+            </x-danger-zone>
+        @endif
         <x-danger-zone title="Delete {{ $resourceLabel }}">
                     <p>
                         Permanently delete
diff --git a/resources/views/livewire/project/shared/environment-variable/all.blade.php b/resources/views/livewire/project/shared/environment-variable/all.blade.php
index 15731c51fb..6c4dd401dd 100644
--- a/resources/views/livewire/project/shared/environment-variable/all.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/all.blade.php
@@ -28,28 +28,41 @@
             </x-slot:actions>
         @endcan
         @if ($view === 'normal')
-            <div class="grid w-full items-end gap-4 sm:grid-cols-2">
+            <div class="flex w-full flex-col gap-4">
                 @if ($resourceClass === 'App\Models\Application')
-                    @if (data_get($resource, 'build_pack') !== 'dockercompose')
-                        <x-forms.listbox id="is_env_sorting_enabled" label="Environment variable order"
-                            onChange="instantSave"
-                            helper="Controls how environment variables are ordered in the list and written to the generated .env file on deploy."
+                    <div class="grid w-full items-end gap-4 sm:grid-cols-2">
+                        @if (data_get($resource, 'build_pack') !== 'dockercompose')
+                            <x-forms.listbox id="is_env_sorting_enabled" label="Environment variable order"
+                                onChange="instantSave"
+                                helper="Controls how environment variables are ordered in the list and written to the generated .env file on deploy."
+                                :options="[
+                                    ['value' => false, 'label' => 'Creation order'],
+                                    ['value' => true, 'label' => 'Alphabetical'],
+                                ]" :disabled="! auth()->user()->can('manageEnvironment', $resource)" />
+                        @endif
+                        <x-forms.listbox id="use_build_secrets" label="Build secrets" onChange="instantSave"
+                            helper="Docker BuildKit secrets keep values out of the final image for enhanced security during builds. Requires Docker 18.09+ with BuildKit support."
                             :options="[
-                                ['value' => false, 'label' => 'Creation order'],
-                                ['value' => true, 'label' => 'Alphabetical'],
+                                ['value' => false, 'label' => 'Standard build arguments'],
+                                ['value' => true, 'label' => 'Docker BuildKit secrets'],
                             ]" :disabled="! auth()->user()->can('manageEnvironment', $resource)" />
-                    @endif
-                    <x-forms.listbox id="use_build_secrets" label="Build secrets" onChange="instantSave"
-                        helper="Docker BuildKit secrets keep values out of the final image for enhanced security during builds. Requires Docker 18.09+ with BuildKit support."
-                        :options="[
-                            ['value' => false, 'label' => 'Standard build arguments'],
-                            ['value' => true, 'label' => 'Docker BuildKit secrets'],
-                        ]" :disabled="! auth()->user()->can('manageEnvironment', $resource)" />
+                    </div>
                 @endif
                 <x-forms.checkbox instantSave="saveCoolifyDefaultVariables" id="include_coolify_default_variables"
                     label="Include Coolify default variables"
                     helper="Adds COOLIFY_APP_NAME, COOLIFY_PROJECT_NAME, COOLIFY_ENVIRONMENT_NAME and COOLIFY_SERVER_IP to the container at runtime. A variable that you define with the same name wins. Takes effect after the next deploy or restart."
                     :disabled="! auth()->user()->can('manageEnvironment', $resource)" />
+                @if ($this->hasLogRedactionSetting())
+                    <div class="grid w-full items-end gap-4 sm:grid-cols-2">
+                        <x-forms.listbox id="redact_all_env_values_in_logs" label="Environment values in logs"
+                            onChange="saveLogRedactionSetting"
+                            helper="Hide every environment variable value in deployment logs, scheduled task output, copied or downloaded logs, and logs from the API and MCP. Live log streaming is not changed. Locked variables and known secret formats are always hidden."
+                            :options="[
+                                ['value' => true, 'label' => 'Hide all values'],
+                                ['value' => false, 'label' => 'Hide locked values only'],
+                            ]" :disabled="! auth()->user()->can('manageEnvironment', $resource)" />
+                    </div>
+                @endif
             </div>
         @else
             <form wire:submit.prevent='submit' class="flex w-full flex-col gap-4">
diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index b3c5977341..dc4436267e 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -88,6 +88,12 @@
             @endforeach
         @endif
         <div class="flex items-center gap-0.5 justify-self-end">
+            @if ($this->connectLink)
+                <a href="{{ $this->connectLink }}" class="icon-button shrink-0"
+                    title="Connect {{ $key }} to resources" aria-label="Connect {{ $key }} to resources">
+                    <x-reicon name="link" class="size-3.5" />
+                </a>
+            @endif
             @if (! $isLocked && ! $isValueHidden)
                 <x-copy-button resolve="$wire.copyValue()" label="Copy value" />
             @endif
@@ -270,6 +276,12 @@
                                 @endcan
                             </div>
                             <div class="ml-auto flex flex-wrap gap-2" data-environment-variable-update-actions>
+                                @if ($this->connectLink)
+                                    <a href="{{ $this->connectLink }}" class="button" title="Add this variable to resources, and see which resources use it">
+                                        <x-reicon name="link" class="size-3.5" />
+                                        Connect to resources
+                                    </a>
+                                @endif
                                 @if ($canUpdate && !$isLocked && !$isMagicVariable)
                                     <x-forms.button type="button" wire:click="lock">Lock</x-forms.button>
                                 @endif
diff --git a/resources/views/livewire/project/shared/execute-container-command.blade.php b/resources/views/livewire/project/shared/execute-container-command.blade.php
index 2d974c0bb1..166086743c 100644
--- a/resources/views/livewire/project/shared/execute-container-command.blade.php
+++ b/resources/views/livewire/project/shared/execute-container-command.blade.php
@@ -66,11 +66,16 @@
         <section class="mt-8 mb-0! h-[calc(100dvh-8rem)] min-h-[32rem] w-full max-w-none xl:mt-0"
             x-on:terminal-theme-selected="setTheme($event.detail.theme)"
             x-on:terminal-starting.window="syncTheme()"
+            x-on:terminal-mode-updated.window="attachAvailable = $event.detail.attachAvailable; terminalMode = $event.detail.mode; hasShell = $event.detail.hasShell"
             x-data="{
                 themeKeys: @js($consoleThemeKeys),
                 themeAccents: @js($consoleThemeAccents),
                 consoleTheme: 'system',
                 themeOpen: false,
+                attachAvailable: false,
+                hasShell: true,
+                terminalMode: 'shell',
+                modeOpen: false,
                 containerOpen: false,
                 targetChosen: @js($selected_container !== 'default'),
                 selectedContainer: @entangle('selected_container').live,
@@ -86,6 +91,15 @@
                     localStorage.setItem('coolify-console-theme', theme);
                     window.dispatchEvent(new CustomEvent('terminal-theme-change', { detail: { theme } }));
                 },
+                setTerminalMode(mode) {
+                    this.modeOpen = false;
+                    if (this.terminalMode === mode || (mode === 'shell' && !this.hasShell)) {
+                        return;
+                    }
+                    this.terminalMode = mode;
+                    window.dispatchEvent(new CustomEvent('terminal-starting'));
+                    Livewire.dispatch('set-terminal-mode', { mode });
+                },
                 syncTheme() {
                     const savedTheme = localStorage.getItem('coolify-console-theme');
                     this.consoleTheme = this.themeKeys.includes(savedTheme) ? savedTheme : 'system';
@@ -167,8 +181,11 @@
                         </div>
                     @endif
 
-                    <x-terminal.theme-selector :themes="$consoleThemes" :theme-names="$consoleThemeNames"
-                        :theme-accents="$consoleThemeAccents" />
+                    <div class="ml-auto flex items-center gap-2">
+                        <x-terminal.mode-selector />
+                        <x-terminal.theme-selector :themes="$consoleThemes" :theme-names="$consoleThemeNames"
+                            :theme-accents="$consoleThemeAccents" />
+                    </div>
                 </header>
 
                 <div class="terminal-session-panel flex min-h-0 flex-1 flex-col overflow-hidden p-3 sm:p-6">
diff --git a/resources/views/livewire/project/shared/file-browser.blade.php b/resources/views/livewire/project/shared/file-browser.blade.php
new file mode 100644
index 0000000000..7611ac6967
--- /dev/null
+++ b/resources/views/livewire/project/shared/file-browser.blade.php
@@ -0,0 +1,434 @@
+<div wire:init="loadFiles" x-on:open-file-download.window="window.location.href = $event.detail.url">
+    @if (count($pendingDownloads) > 0)
+        <div wire:poll.3s="checkDownloads" class="hidden"></div>
+    @endif
+    <x-slot:title>
+        {{ data_get_str($resource, 'name')->limit(10) }} > Files | Coolify
+    </x-slot>
+
+    @if ($type === 'application')
+        <livewire:project.application.heading :application="$resource" wire:key="application-heading-files" />
+    @elseif ($type === 'service')
+        <livewire:project.service.heading :service="$resource" :parameters="$parameters" title="Files" />
+    @else
+        <livewire:project.database.heading :database="$resource" />
+    @endif
+
+    {{-- Standard resource settings workspace (matches Logs/Configuration) so the
+         heading spacing and sidebar behave identically to every other page. --}}
+    <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0"
+        x-data="{
+            busy: null,
+            {{-- Show a label for the running action over the listing. The short
+                 delay skips the overlay for fast requests. --}}
+            run(label, action) {
+                const timer = setTimeout(() => this.busy = label, 150);
+                return Promise.resolve().then(action).catch(() => {}).finally(() => {
+                    clearTimeout(timer);
+                    this.busy = null;
+                });
+            },
+            uploadFile(file) {
+                return this.run('Uploading file...', () => new Promise((resolve, reject) => {
+                    this.$wire.upload('upload', file, () => this.$wire.uploadFile().then(resolve, reject), reject);
+                }));
+            },
+        }">
+        <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            @if ($type === 'application')
+                <x-application.configuration-sidebar :application="$resource"
+                    current-route="project.application.files" />
+            @elseif ($type === 'service')
+                <x-service.configuration-sidebar :service="$resource"
+                    current-route="project.service.files" />
+            @else
+                <x-database.configuration-sidebar :database="$resource"
+                    current-route="project.database.files" />
+            @endif
+
+            <div class="min-w-0">
+    <x-application.settings-section title="Files"
+        helper="Browse and manage files inside the running container." :flush="true">
+
+        <x-slot:badges>
+            <x-beta-badge />
+        </x-slot:badges>
+
+        <x-slot:actions>
+            @if ($containerRunning && $filesLoaded)
+                <input type="file" class="hidden" x-ref="uploadInput"
+                    @change="if ($event.target.files.length) { uploadFile($event.target.files[0]); $event.target.value = '' }" />
+                <x-forms.button type="button" title="Upload a file to this folder" canGate="canAccessTerminal" :canResource="$resource"
+                    wire:target="uploadFile" @click="$refs.uploadInput.click()">
+                    Upload
+                </x-forms.button>
+
+                <div x-data="{ creationMenuOpen: false }" @keydown.escape.window="creationMenuOpen = false">
+                    <x-forms.button type="button" x-ref="newTrigger"
+                        @click="creationMenuOpen = !creationMenuOpen" x-bind:aria-expanded="creationMenuOpen"
+                        canGate="canAccessTerminal" :canResource="$resource">
+                        New
+                        <x-reicon name="chevron-down" class="size-3.5" />
+                    </x-forms.button>
+                    <template x-teleport="body">
+                        <div x-show="creationMenuOpen" x-cloak x-transition.opacity.duration.120ms
+                            x-anchor.bottom-end.fixed.offset.4="$refs.newTrigger"
+                            @click.outside="creationMenuOpen = false"
+                            class="listbox-panel min-w-36! w-36! z-50!">
+                            <x-modal-input title="New file">
+                                <x-slot:content>
+                                    <button type="button" class="listbox-option" @click="creationMenuOpen = false">
+                                        <x-reicon name="file" class="size-3.5 shrink-0" />
+                                        <span class="flex-1 text-left">New file</span>
+                                    </button>
+                                </x-slot:content>
+                                <form x-data="{ name: '' }"
+                                    @submit.prevent="run('Creating file...', () => $wire.createFile(name)); name=''; $dispatch('close-modal')"
+                                    class="flex flex-col gap-4">
+                                    <x-forms.input id="newFileName" label="File name" x-model="name"
+                                        placeholder="config.yml" required />
+                                    <div class="flex justify-end">
+                                        <x-forms.button type="submit" isHighlighted canGate="canAccessTerminal" :canResource="$resource">Create file</x-forms.button>
+                                    </div>
+                                </form>
+                            </x-modal-input>
+
+                            <x-modal-input title="New folder">
+                                <x-slot:content>
+                                    <button type="button" class="listbox-option" @click="creationMenuOpen = false">
+                                        <x-reicon name="folder" class="size-3.5 shrink-0" />
+                                        <span class="flex-1 text-left">New folder</span>
+                                    </button>
+                                </x-slot:content>
+                                <form x-data="{ name: '' }"
+                                    @submit.prevent="run('Creating folder...', () => $wire.createDirectory(name)); name=''; $dispatch('close-modal')"
+                                    class="flex flex-col gap-4">
+                                    <x-forms.input id="newFolderName" label="Folder name" x-model="name"
+                                        placeholder="plugins" required />
+                                    <div class="flex justify-end">
+                                        <x-forms.button type="submit" isHighlighted canGate="canAccessTerminal" :canResource="$resource">Create folder</x-forms.button>
+                                    </div>
+                                </form>
+                            </x-modal-input>
+                        </div>
+                    </template>
+                </div>
+
+                <x-forms.button type="button" @click="run('Loading files...', () => $wire.refresh())" title="Refresh this folder">
+                    Refresh
+                </x-forms.button>
+            @endif
+        </x-slot:actions>
+
+        @if ($loadFailed)
+            <x-empty title="Could not load files" description="Check the server connection and try again." />
+            <div class="flex justify-center pb-4">
+                <x-forms.button wire:click="loadFiles">Retry</x-forms.button>
+            </div>
+        @elseif (! $filesLoaded)
+            <div class="flex justify-center py-12">
+                <x-loading text="Loading files..." />
+            </div>
+        @elseif (! $containerRunning)
+            <x-empty title="Container is not running"
+                description="Start the container to browse its files.">
+                <x-slot:icon>
+                    <x-reicon name="folder" class="size-8" />
+                </x-slot:icon>
+            </x-empty>
+        @else
+            {{-- Keep the current listing visible while an action runs: blur it
+                 and show the action label (from run()) on top of it. --}}
+            <div class="relative">
+            <div x-show="busy" x-cloak class="absolute inset-0 z-10">
+                <div class="flex h-full items-start justify-center">
+                    <div class="sticky top-[40vh] mt-12 inline-flex items-center gap-2 rounded-md bg-white px-3 py-1.5 text-[13px] text-neutral-500 shadow-sm ring-1 ring-black/5 dark:bg-coolgray-100 dark:text-fg-dim dark:ring-white/10">
+                        <x-loading />
+                        <span x-text="busy"></span>
+                    </div>
+                </div>
+            </div>
+            <div x-bind:class="busy && 'pointer-events-none select-none blur-[2px] opacity-60'"
+                class="transition-[filter,opacity] duration-150 motion-reduce:transition-none">
+            {{-- Container picker (services / multi-container) --}}
+            @if (count($availableContainers) > 1)
+                <div class="flex flex-wrap items-center gap-2 border-b border-coollabs-hairline px-4 py-2">
+                    <span class="text-xs text-coollabs-subtle">Container</span>
+                    @foreach ($availableContainers as $name)
+                        <button type="button" x-on:click="run('Loading files...', () => $wire.selectContainer(@js($name)))"
+                            @class([
+                                'button',
+                                'bg-coollabs/10 text-coollabs ring-coollabs/25 dark:bg-white/[0.08] dark:text-white dark:ring-white/15' => $name === $container,
+                            ])>{{ $name }}</button>
+                    @endforeach
+                </div>
+            @endif
+
+            {{-- Breadcrumb. The root crumb renders as "/" and doubles as the
+                 first separator, so we only draw a slash between named segments
+                 (index >= 2) - avoids the "/ /" duplicate. --}}
+            <div class="flex flex-wrap items-center gap-1 px-4 py-2 text-sm">
+                @foreach ($this->breadcrumbs() as $crumb)
+                    @if ($loop->index > 1)
+                        <span class="text-coollabs-subtle">/</span>
+                    @endif
+                    <button type="button" x-on:click="run('Loading files...', () => $wire.goTo(@js($crumb['path'])))"
+                        @class([
+                            'rounded-md px-1.5 py-0.5 hover:bg-black/5 hover:text-current dark:hover:bg-white/[0.06]',
+                            'text-current font-medium' => $loop->last,
+                            'text-coollabs-subtle' => ! $loop->last,
+                        ])>
+                        {{ $crumb['label'] }}
+                    </button>
+                @endforeach
+            </div>
+
+            {{-- Drag-and-drop file list --}}
+            <div x-data="{ dragging: false }"
+                @dragover.prevent="dragging = true"
+                @dragleave.prevent="dragging = false"
+                @drop.prevent="dragging = false; if ($event.dataTransfer.files.length) { uploadFile($event.dataTransfer.files[0]) }"
+                :class="dragging ? 'ring-2 ring-coollabs/40 dark:ring-white/30' : ''"
+                class="transition-[box-shadow] duration-150 ease-out motion-reduce:transition-none">
+                @if (count($entries) === 0)
+                    <x-empty size="sm" title="This folder is empty"
+                        description="Upload a file to get started.">
+                        <x-slot:icon>
+                            <x-reicon name="folder" class="size-8" />
+                        </x-slot:icon>
+                    </x-empty>
+                @else
+                    <div class="data-table w-full">
+                        <div class="data-table-header file-table-grid">
+                            <span></span>
+                            <span>Name</span>
+                            <span>Perms</span>
+                            <span>Owner</span>
+                            <span>Group</span>
+                            <span class="text-right">Size</span>
+                            <span>Modified</span>
+                            <span class="text-right">Actions</span>
+                        </div>
+                        @foreach ($entries as $entry)
+                            <div wire:key="entry-{{ $entry['name'] }}" class="data-table-row file-table-grid">
+                                <div class="flex items-center">
+                                    <x-reicon :name="$entry['type'] === 'dir' ? 'folder-filled' : 'file'"
+                                        class="size-4 {{ $entry['type'] === 'dir' ? 'text-coollabs dark:text-neutral-200' : 'text-coollabs-subtle opacity-70' }}" />
+                                </div>
+                                <div class="min-w-0">
+                                    @if ($entry['type'] === 'dir')
+                                        <button type="button" x-on:click="run('Loading files...', () => $wire.open(@js($entry['name'])))"
+                                            class="block w-full cursor-pointer truncate text-left font-medium hover:text-coollabs hover:underline dark:hover:text-white">{{ $entry['name'] }}</button>
+                                    @else
+                                        <span class="block truncate">{{ $entry['name'] }}</span>
+                                    @endif
+                                </div>
+                                {{-- Permissions (click to chmod) --}}
+                                <div class="min-w-0">
+                                    <x-modal-input title="Change permissions">
+                                        <x-slot:content>
+                                            <button type="button" title="Edit permissions"
+                                                class="cursor-pointer rounded-md px-1.5 py-0.5 font-mono text-xs text-coollabs-subtle hover:bg-black/5 hover:text-current dark:hover:bg-white/[0.06]">
+                                                {{ $entry['perms'] ?: '-' }}
+                                            </button>
+                                        </x-slot:content>
+                                        <form x-data="{ mode: @js($entry['perms']) }"
+                                            @submit.prevent="run('Updating permissions...', () => $wire.chmodEntry(@js($entry['name']), mode)); $dispatch('close-modal')"
+                                            class="flex flex-col gap-4">
+                                            <p class="text-sm text-coollabs-subtle">
+                                                Set the octal permission mode for
+                                                <span class="font-medium">{{ $entry['name'] }}</span>.
+                                            </p>
+                                            <x-forms.input id="chmodMode-{{ $loop->index }}" label="Octal mode"
+                                                x-model="mode" placeholder="644" required />
+                                            <div class="flex justify-end">
+                                                <x-forms.button type="submit" isHighlighted canGate="canAccessTerminal" :canResource="$resource">Apply</x-forms.button>
+                                            </div>
+                                        </form>
+                                    </x-modal-input>
+                                </div>
+                                <div class="min-w-0 truncate text-coollabs-subtle">
+                                    {{ $entry['owner'] ?: '-' }}
+                                </div>
+                                <div class="min-w-0 truncate text-coollabs-subtle">
+                                    {{ $entry['group'] ?: '-' }}
+                                </div>
+                                <div class="text-right text-coollabs-subtle tabular-nums">
+                                    {{ $entry['type'] === 'dir' ? '-' : formatBytes($entry['size']) }}
+                                </div>
+                                <div class="text-coollabs-subtle tabular-nums">
+                                    {{ $entry['mtime'] ? \Illuminate\Support\Carbon::createFromTimestamp($entry['mtime'])->toDateTimeString() : '-' }}
+                                </div>
+                                {{-- Actions kebab. The entry name lives in this
+                                     row's x-data as a JS string so the menu can
+                                     call $wire.* with it directly - passing @js()
+                                     through a component attribute double-encodes
+                                     the quotes and breaks the handler. --}}
+                                <div class="flex items-center justify-end"
+                                    x-data="{ open: false, name: @js($entry['name']), isDir: @js($entry['type'] === 'dir') }"
+                                    @keydown.escape.window="open = false">
+                                    <div class="relative">
+                                        <button type="button" title="Actions" aria-label="Actions" x-ref="trigger"
+                                            x-on:click="open = !open" x-bind:aria-expanded="open"
+                                            x-bind:class="open && 'bg-black/5 text-current dark:bg-white/[0.08]'"
+                                            class="inline-flex size-7 cursor-pointer items-center justify-center rounded-md text-coollabs-subtle hover:bg-black/5 hover:text-current focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs/40 dark:hover:bg-white/[0.06] dark:focus-visible:ring-white/30">
+                                            <x-reicon name="dots-horizontal" class="size-4" />
+                                        </button>
+                                        <template x-teleport="body">
+                                            <div x-show="open" x-cloak x-transition.opacity.duration.120ms
+                                                x-anchor.bottom-end.fixed.offset.4="$refs.trigger"
+                                                @click.outside="open = false"
+                                                class="listbox-panel min-w-52! w-52! z-50!">
+                                                @if ($entry['type'] !== 'dir')
+                                                    <button type="button" class="listbox-option"
+                                                        x-on:click="open = false; run('Opening file...', () => $wire.openEditor(name))">
+                                                        <x-reicon name="file-content" class="size-3.5 shrink-0" />
+                                                        <span class="min-w-0 flex-1 text-left">Edit</span>
+                                                    </button>
+                                                @endif
+                                                <button type="button" class="listbox-option"
+                                                    x-on:click="open = false; run(isDir ? 'Preparing folder download...' : 'Preparing file download...', () => $wire.download(name))">
+                                                    <x-reicon name="download" class="size-3.5 shrink-0" />
+                                                    <span class="min-w-0 flex-1 text-left">Download</span>
+                                                </button>
+
+                                                {{-- Rename --}}
+                                                <x-modal-input title="Rename">
+                                                    <x-slot:content>
+                                                        <button type="button" class="listbox-option" x-on:click="open = false">
+                                                            <x-reicon name="edit" class="size-3.5 shrink-0" />
+                                                            <span class="min-w-0 flex-1 text-left">Rename</span>
+                                                        </button>
+                                                    </x-slot:content>
+                                                    <form x-data="{ newName: @js($entry['name']) }"
+                                                        @submit.prevent="run('Renaming...', () => $wire.renameEntry(name, newName)); $dispatch('close-modal')"
+                                                        class="flex flex-col gap-4">
+                                                        <x-forms.input id="renameName-{{ $loop->index }}"
+                                                            label="New name" x-model="newName" required />
+                                                        <div class="flex justify-end">
+                                                            <x-forms.button type="submit" isHighlighted canGate="canAccessTerminal" :canResource="$resource">Rename</x-forms.button>
+                                                        </div>
+                                                    </form>
+                                                </x-modal-input>
+
+                                                {{-- Delete --}}
+                                                <x-modal-input title="Delete this item?">
+                                                    <x-slot:content>
+                                                        <button type="button" class="listbox-option" x-on:click="open = false">
+                                                            <x-reicon name="trash" class="size-3.5 shrink-0 text-red-600 dark:text-red-500" />
+                                                            <span class="min-w-0 flex-1 text-left text-red-600 dark:text-red-500">Delete</span>
+                                                        </button>
+                                                    </x-slot:content>
+                                                    <div class="flex flex-col gap-4">
+                                                        <p class="text-sm text-coollabs-subtle">
+                                                            This permanently deletes
+                                                            <span class="font-medium">{{ $entry['name'] }}</span>
+                                                            inside the container. This cannot be undone.
+                                                        </p>
+                                                        <div class="flex justify-end">
+                                                            <x-forms.button isError type="button" canGate="canAccessTerminal" :canResource="$resource"
+                                                                x-on:click="run(isDir ? 'Deleting folder...' : 'Deleting file...', () => $wire.deleteEntry(name)); $dispatch('close-modal')">Delete</x-forms.button>
+                                                        </div>
+                                                    </div>
+                                                </x-modal-input>
+                                            </div>
+                                        </template>
+                                    </div>
+                                </div>
+                            </div>
+                        @endforeach
+                    </div>
+                @endif
+            </div>
+            </div>
+            </div>
+
+            {{-- Editor modal (opens when a text file is loaded) --}}
+            <x-modal-input title="Edit file" :wireOpen="'editorOpen'" :content="true" wireIgnore="false" isLarge>
+                <x-slot:content>
+                    <span class="hidden"></span>
+                </x-slot:content>
+                <form @submit.prevent="run('Saving file...', () => $wire.saveEditor())" class="flex flex-col gap-4">
+                    <div class="flex items-center justify-between gap-2">
+                        <p class="truncate font-mono text-xs text-coollabs-subtle">{{ $editingPath }}</p>
+                        @if ($editorLanguage)
+                            <span class="shrink-0 rounded-md bg-coollabs/10 px-1.5 py-0.5 font-mono text-[11px] text-coollabs dark:bg-white/[0.08] dark:text-neutral-200">{{ $editorLanguage }}</span>
+                        @endif
+                    </div>
+                    {{-- Monaco editor, kept mounted across opens (wire:ignore) and
+                         preloaded on page init so the first Edit click is instant.
+                         openEditor dispatches load-file-editor with the content and
+                         Monaco language id; we setValue + setModelLanguage without
+                         recreating, so highlighting applies and there is no flash.
+                         Inline Alpine (like x-forms.monaco-editor) means this works
+                         without a JS rebuild. --}}
+                    <div wire:ignore class="min-w-0" x-init="loadMonaco()"
+                        x-on:load-file-editor.window="load($event.detail)"
+                        x-data="{
+                            vs: '/js/monaco-editor-0.52.2/min/vs',
+                            base: '/js/monaco-editor-0.52.2/min',
+                            isDark() {
+                                return document.documentElement.classList.contains('dark') || localStorage.theme === 'dark' || (!('theme' in localStorage) && window.matchMedia('(prefers-color-scheme: dark)').matches);
+                            },
+                            loadMonaco() {
+                                if (window.__fileEditorMonaco) return window.__fileEditorMonaco;
+                                const vs = this.vs, base = this.base;
+                                window.__fileEditorMonaco = new Promise((resolve, reject) => {
+                                    const boot = () => {
+                                        window.require.config({ paths: { vs } });
+                                        const proxy = URL.createObjectURL(new Blob([`self.MonacoEnvironment={baseUrl:'${window.location.origin}${base}'};importScripts('${window.location.origin}${vs}/base/worker/workerMain.js');`], { type: 'text/javascript' }));
+                                        window.MonacoEnvironment = { getWorkerUrl: () => proxy };
+                                        window.require(['vs/editor/editor.main'], () => resolve(window.monaco));
+                                    };
+                                    if (typeof window.require !== 'undefined' && window.require.config) { boot(); return; }
+                                    const s = document.createElement('script');
+                                    s.src = `${vs}/loader.js`; s.onload = boot; s.onerror = reject;
+                                    document.head.appendChild(s);
+                                });
+                                return window.__fileEditorMonaco;
+                            },
+                            ensureTheme(monaco) {
+                                if (window.__fileEditorThemeDefined) return;
+                                monaco.editor.defineTheme('coolify-dark', { base: 'vs-dark', inherit: true, rules: [], colors: { 'editor.background': '#0b0b0c', 'editorGutter.background': '#0b0b0c', 'minimap.background': '#0b0b0c' } });
+                                window.__fileEditorThemeDefined = true;
+                            },
+                            async load(detail) {
+                                const monaco = await this.loadMonaco();
+                                this.ensureTheme(monaco);
+                                const el = this.$refs.editor;
+                                const wire = this.$wire;
+                                const content = (detail && detail.content) || '';
+                                const language = (detail && detail.language) || 'plaintext';
+                                // Keep the Monaco instance on the DOM node, NOT in
+                                // Alpine reactive state - proxying its huge object
+                                // graph would hang and crash the tab.
+                                if (!el._monacoEditor) {
+                                    const editor = monaco.editor.create(el, { value: content, language, theme: this.isDark() ? 'coolify-dark' : 'vs', automaticLayout: true, minimap: { enabled: false }, fontSize: 14, lineNumbersMinChars: 3, scrollBeyondLastLine: false, renderLineHighlight: 'all', padding: { top: 12, bottom: 12 }, scrollbar: { verticalScrollbarSize: 8, horizontalScrollbarSize: 8, useShadows: false } });
+                                    el._monacoEditor = editor;
+                                    editor.onDidChangeModelContent(() => { wire.set('editorContent', editor.getValue(), false); });
+                                    new MutationObserver(() => monaco.editor.setTheme(this.isDark() ? 'coolify-dark' : 'vs')).observe(document.documentElement, { attributes: true, attributeFilter: ['class'] });
+                                } else {
+                                    const model = el._monacoEditor.getModel();
+                                    model.setValue(content);
+                                    monaco.editor.setModelLanguage(model, language);
+                                }
+                                const editor = el._monacoEditor;
+                                this.$nextTick(() => { editor.layout(); setTimeout(() => editor.focus(), 40); });
+                            }
+                        }">
+                        <div x-ref="editor" class="file-editor-monaco"></div>
+                    </div>
+                    <div class="flex justify-end gap-2">
+                        <x-forms.button type="button" wire:click="closeEditor"
+                            @click="$dispatch('close-modal')">Cancel</x-forms.button>
+                        <x-forms.button type="submit" isHighlighted
+                            @click="$dispatch('close-modal')">Save changes</x-forms.button>
+                    </div>
+                </form>
+            </x-modal-input>
+        @endif
+    </x-application.settings-section>
+            </div>
+        </div>
+    </section>
+</div>
diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index 3f855abea3..3249e8cf4b 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -194,6 +194,7 @@
                                     <x-reicon name="chevron-down" class="size-3 transition-transform" ::class="open ? 'rotate-180' : ''" />
                                 </button></x-slot:trigger>
                                 <div x-data="{ downloadingAllLogs: false }">
+                                    <p class="px-2 py-1.5 text-xs text-neutral-500 dark:text-fg-dim">Copied and downloaded logs hide secrets. The live view shows the raw output.</p>
                                     <button type="button" role="menuitem" class="listbox-option"
                                         x-on:click="
                                             open = false;
@@ -215,7 +216,7 @@
                                     </button>
                                     <button type="button" role="menuitem" class="listbox-option"
                                         x-on:click="downloadLogs(); open = false">
-                                        <span class="flex-1 text-left">Download displayed logs</span>
+                                        <span class="flex-1 text-left">Download logs</span>
                                     </button>
                                     <button type="button" role="menuitem" x-on:click="
                                         downloadingAllLogs = true;
diff --git a/resources/views/livewire/project/shared/maintenance.blade.php b/resources/views/livewire/project/shared/maintenance.blade.php
new file mode 100644
index 0000000000..822d672f47
--- /dev/null
+++ b/resources/views/livewire/project/shared/maintenance.blade.php
@@ -0,0 +1,30 @@
+<form wire:submit="submit">
+    <x-unsaved-bar action="submit" targets="maintenancePage" />
+    <x-application.settings-section id="maintenance-section" title="Maintenance mode"
+        helper="Show a maintenance page with a 503 status on all domains of this resource. The containers keep running, and the change applies without a redeploy.">
+        @if ($this->isSupported)
+            <div class="flex flex-col gap-4">
+                <div class="grid gap-4 lg:grid-cols-2">
+                    <x-forms.listbox canGate="update" :canResource="$resource" id="isMaintenanceEnabled"
+                        label="Maintenance mode" onChange="instantSaveMaintenance" :options="[
+                            ['value' => false, 'label' => 'Off: serve the resource'],
+                            ['value' => true, 'label' => 'On: show the maintenance page'],
+                        ]" />
+                </div>
+                <x-forms.textarea canGate="update" :canResource="$resource" id="maintenancePage" rows="10" monospace
+                    label="Custom maintenance page (HTML)"
+                    placeholder="Leave empty to use the Coolify default maintenance page."
+                    helper="One self-contained HTML file (max {{ \App\Models\Server::PROXY_ERROR_PAGE_MAX_BYTES / 1024 }} KB) with inline CSS and images." />
+                @can('update', $resource)
+                    <div class="flex gap-2">
+                        <x-forms.button type="button" wire:click="resetMaintenancePage">Reset to
+                            default</x-forms.button>
+                    </div>
+                @endcan
+            </div>
+        @else
+            <p class="text-sm text-neutral-500 dark:text-neutral-400">Maintenance mode needs a Traefik or Caddy proxy on a
+                server that is not part of a Docker Swarm.</p>
+        @endif
+    </x-application.settings-section>
+</form>
diff --git a/resources/views/livewire/project/shared/scheduled-task/all.blade.php b/resources/views/livewire/project/shared/scheduled-task/all.blade.php
index 89741ff9a2..74b962edb6 100644
--- a/resources/views/livewire/project/shared/scheduled-task/all.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/all.blade.php
@@ -1,4 +1,13 @@
 <div>
+    @if ($selectedTask)
+        <x-modal-input title="Edit scheduled task" :subtitle="$selectedTask->name" wireOpen="taskModalOpen" :wireIgnore="false" isLarge fixedHeight>
+            <x-slot:content><span></span></x-slot:content>
+
+            <livewire:project.shared.scheduled-task.show :resource="$resource" :task="$selectedTask"
+                wire:key="scheduled-task-modal-{{ $selectedTask->uuid }}" />
+        </x-modal-input>
+    @endif
+
     <x-application.settings-section id="scheduled-tasks-section" title="Scheduled tasks"
         helper="Run commands inside this resource automatically using a cron schedule." flush>
         <x-slot:actions>
@@ -32,13 +41,10 @@
                     'running' => 'Running',
                     default => 'Not run yet',
                 };
-                $taskRoute = $resource->type() === 'application'
-                    ? 'project.application.scheduled-tasks'
-                    : 'project.service.scheduled-tasks';
             @endphp
-            <a class="group flex items-center gap-3 border-b border-neutral-200 px-4 py-3.5 transition-colors last:border-b-0 hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.025]"
-                {{ wireNavigate() }}
-                href="{{ route($taskRoute, [...$parameters, 'task_uuid' => $task->uuid]) }}">
+            <div wire:key="scheduled-task-{{ $task->uuid }}" wire:click="openTask('{{ $task->uuid }}')"
+                wire:keydown.enter="openTask('{{ $task->uuid }}')" role="button" tabindex="0"
+                class="group flex cursor-pointer items-center gap-3 border-b border-neutral-200 px-4 py-3.5 transition-colors last:border-b-0 hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                 <div
                     class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-100 text-neutral-500 ring-1 ring-neutral-200 dark:bg-white/[0.05] dark:text-fg-dim dark:ring-white/[0.07]">
                     <x-reicon name="browser-terminal" class="size-[18px]" />
@@ -58,7 +64,7 @@
                     </p>
                 </div>
                 <x-status-badge :status="$statusLabel" :type="$statusType" />
-            </a>
+            </div>
         @empty
             <x-empty title="No scheduled tasks"
                 description="Create a task to run maintenance commands, scripts, or recurring jobs automatically."
diff --git a/resources/views/livewire/project/shared/scheduled-task/show.blade.php b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
index c5be9974ba..bff3acb9aa 100644
--- a/resources/views/livewire/project/shared/scheduled-task/show.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
@@ -1,10 +1,22 @@
-<div class="flex flex-col gap-6">
-    <form wire:submit="submit" class="application-settings-form flex flex-col">
+<div x-data="{ activeSection: 'general' }" class="flex min-w-0 flex-col gap-6">
+    <nav aria-label="Scheduled task sections"
+        class="flex min-w-0 flex-wrap gap-1 border-b border-neutral-200 pb-2 dark:border-white/[0.08]">
+        @foreach (['general' => 'General', 'executions' => 'Executions', ...(auth()->user()->can('update', $resource) ? ['danger' => 'Danger Zone'] : [])] as $sectionKey => $sectionLabel)
+            <button type="button" @click="activeSection = '{{ $sectionKey }}'"
+                :class="activeSection === '{{ $sectionKey }}'
+                    ? 'bg-coollabs/10 text-coollabs ring-1 ring-coollabs/25 dark:bg-warning/15 dark:text-warning dark:ring-warning/25'
+                    : 'text-neutral-500 hover:bg-black/5 hover:text-neutral-900 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg'"
+                class="inline-flex h-8 shrink-0 cursor-pointer items-center rounded-md px-3 text-[13px] font-medium transition-colors">
+                {{ $sectionLabel }}
+            </button>
+        @endforeach
+    </nav>
+
+    <form x-show="activeSection === 'general'" wire:submit="submit" class="application-settings-form flex flex-col">
         <x-unsaved-bar action="submit" />
         <x-application.settings-section id="task-configuration-section" title="Task configuration"
             helper="Configure when this task runs and which command Coolify executes.">
             <x-slot:actions>
-                <x-status-badge :status="$isEnabled ? 'Enabled' : 'Disabled'" :type="$isEnabled ? 'success' : 'neutral'" />
                 @if ($resource->isRunning())
                     @can('update', $resource)
                         <x-forms.button type="button" wire:click="executeNow">
@@ -16,13 +28,6 @@
                     <x-forms.button type="button" wire:click="toggleEnabled" :isHighlighted="!$isEnabled">
                         {{ $isEnabled ? 'Disable' : 'Enable' }}
                     </x-forms.button>
-                    <x-modal-confirmation title="Delete scheduled task?" isErrorButton buttonTitle="Delete"
-                        submitAction="delete({{ $task->id }})"
-                        :actions="['The selected scheduled task will be permanently deleted.']"
-                        confirmationText="{{ $task->name }}"
-                        confirmationLabel="Enter the scheduled task name to confirm deletion"
-                        shortConfirmationLabel="Task name" :confirmWithPassword="false"
-                        step2ButtonText="Permanently delete" />
                 @endcan
             </x-slot:actions>
 
@@ -47,8 +52,28 @@
         </x-application.settings-section>
     </form>
 
-    <x-application.settings-section id="task-executions-section" title="Recent executions"
+    <x-application.settings-section x-show="activeSection === 'executions'" x-cloak id="task-executions-section" title="Recent executions"
         helper="Execution history refreshes automatically while a task is running." flush>
         <livewire:project.shared.scheduled-task.executions :taskId="$task->id" />
     </x-application.settings-section>
+
+    @can('update', $resource)
+        <div x-show="activeSection === 'danger'" x-cloak class="application-settings-form">
+            <x-application.settings-section title="Delete scheduled task"
+                description="Permanently remove this task and its execution history.">
+                <x-danger-zone title="This action cannot be undone.">
+                    <p>The task stops running and cannot be restored.</p>
+                    <x-slot:action>
+                        <x-modal-confirmation title="Delete scheduled task?" isErrorButton buttonTitle="Delete task"
+                            submitAction="delete({{ $task->id }})"
+                            :actions="['The selected scheduled task will be permanently deleted.']"
+                            confirmationText="{{ $task->name }}"
+                            confirmationLabel="Enter the scheduled task name to confirm deletion"
+                            shortConfirmationLabel="Task name" :confirmWithPassword="false"
+                            step2ButtonText="Permanently delete" />
+                    </x-slot:action>
+                </x-danger-zone>
+            </x-application.settings-section>
+        </div>
+    @endcan
 </div>
diff --git a/resources/views/livewire/project/shared/secret-manager-links.blade.php b/resources/views/livewire/project/shared/secret-manager-links.blade.php
index 84e21a3054..447184d12e 100644
--- a/resources/views/livewire/project/shared/secret-manager-links.blade.php
+++ b/resources/views/livewire/project/shared/secret-manager-links.blade.php
@@ -7,8 +7,14 @@
 
         @if (! $link && $availableTokens->isEmpty())
             <x-empty title="No secret manager tokens"
-                description="Add a Doppler, Infisical, or HashiCorp Vault token under Keys & Tokens > Integration Tokens first."
-                icon-name="keys" size="sm" />
+                description="Add a Doppler, Infisical, or HashiCorp Vault token first."
+                icon-name="keys" size="sm">
+                <x-slot:actions>
+                    <a class="button" href="{{ route('security.integration-tokens') }}" {{ wireNavigate() }}>
+                        Integration tokens
+                    </a>
+                </x-slot:actions>
+            </x-empty>
         @else
             @can('update', $resource)
                 <div class="application-settings-form flex w-full flex-col gap-4">
diff --git a/resources/views/livewire/project/shared/storages/volume-backups.blade.php b/resources/views/livewire/project/shared/storages/volume-backups.blade.php
index cc354e88d5..0a395fa08e 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups.blade.php
@@ -1,9 +1,25 @@
-<div>
-    @if ($section === 'retention')
-        @include('livewire.project.shared.storages.volume-backups.retention')
-    @elseif ($section === 's3')
-        @include('livewire.project.shared.storages.volume-backups.s3')
-    @elseif ($section === 'executions')
+<div x-on:open-backup-download.window="window.location.href = $event.detail.url">
+    @if (count($pendingDownloads) > 0)
+        <div wire:poll.3s="checkDownloads" class="hidden"></div>
+    @endif
+    @if ($actionsInHeader && $backup)
+        @can('update', $resource)
+            @teleport('#resource-action-hud-slot')
+                <div class="order-first mr-1 hidden items-center gap-1 xl:flex">
+                    @if ($enabled)
+                        <x-forms.button type="button" wire:click="toggleEnabled">Disable backup</x-forms.button>
+                    @else
+                        <x-forms.button type="button" wire:click="toggleEnabled" isHighlighted>Enable backup</x-forms.button>
+                    @endif
+                    <x-forms.button type="button" wire:click="backupNow">Back up now</x-forms.button>
+                </div>
+            @endteleport
+        @endcan
+    @endif
+    @if ($section === 'executions')
+        @if ($backup && $executions->onFirstPage())
+            <div wire:poll.5000ms class="hidden"></div>
+        @endif
         @include('livewire.project.shared.storages.volume-backups.executions')
     @elseif ($section === 'danger')
         @include('livewire.project.shared.storages.volume-backups.danger')
@@ -14,7 +30,11 @@
     @script
     <script>
         window.download_volume_backup_file = function(executionId) {
-            window.open('/download/volume-backup/' + executionId, '_blank');
+            @if ($s3Downloads)
+                $wire.downloadBackup(executionId);
+            @else
+                window.open('/download/volume-backup/' + executionId, '_blank');
+            @endif
         }
     </script>
     @endscript
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
index 46077e4f52..3d29c960e6 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
@@ -49,15 +49,19 @@
                                 'failed' => 'error',
                                 default => 'neutral',
                             };
+                            $s3Replicas = $execution->s3Replicas;
+                            $hasLiveS3Copies = $s3Replicas->isNotEmpty()
+                                ? $s3Replicas->contains(fn ($replica) => $replica->s3_uploaded === true && ! $replica->s3_storage_deleted)
+                                : $execution->s3_uploaded === true && ! $execution->s3_storage_deleted;
                             $executionCheckboxes = [];
                             $deleteActions = [];
                             if (! $execution->local_storage_deleted) {
                                 $deleteActions[] = 'This backup will be permanently deleted from local storage.';
                             }
-                            if ($execution->s3_uploaded === true && ! $execution->s3_storage_deleted) {
+                            if ($hasLiveS3Copies) {
                                 $executionCheckboxes[] = [
                                     'id' => 'delete_backup_s3',
-                                    'label' => 'Delete the selected backup permanently from S3 Storage',
+                                    'label' => 'Delete the selected backup permanently from every S3 storage',
                                 ];
                             }
                             if (empty($deleteActions)) {
@@ -76,7 +80,7 @@
                         <div wire:key="volume-backup-execution-{{ $execution->id }}"
                             class="data-table-row volume-backup-executions-grid min-h-16 items-center gap-x-3 border-b border-neutral-200 text-[12px] last:border-b-0 dark:border-white/[0.07]">
                             <span>
-                                <x-status-badge :status="$statusLabel" :type="$statusType" />
+                                <x-status-badge :status="$statusLabel" :type="$statusType" :pulse="$execution->status === 'running'" />
                             </span>
 
                             <span class="min-w-0">
@@ -100,7 +104,22 @@
                             <span class="flex flex-wrap gap-1">
                                 <x-status-badge :status="$execution->local_storage_deleted ? 'Local deleted' : 'Local'"
                                     :type="$execution->local_storage_deleted ? 'neutral' : 'success'" />
-                                @if ($execution->s3_uploaded !== null)
+                                @foreach ($s3Replicas as $replica)
+                                    <x-status-badge wire:key="volume-backup-replica-{{ $replica->id }}"
+                                        :label="$replica->s3?->name ?? 'Removed S3 storage'"
+                                        :status="$replica->s3_storage_deleted
+                                            ? 'deleted'
+                                            : match ($replica->s3_uploaded) {
+                                                true => null,
+                                                false => 'failed',
+                                                default => $execution->status === 'running' ? 'pending' : 'not uploaded',
+                                            }"
+                                        :type="$replica->s3_storage_deleted || $replica->s3_uploaded === null
+                                            ? 'neutral'
+                                            : ($replica->s3_uploaded ? 'success' : 'error')"
+                                        :title="$replica->message" />
+                                @endforeach
+                                @if ($s3Replicas->isEmpty() && $execution->s3_uploaded !== null)
                                     <x-status-badge
                                         :status="$execution->s3_storage_deleted
                                             ? 'S3 deleted'
@@ -120,7 +139,7 @@
                             </span>
 
                             <span class="flex items-center justify-end gap-1">
-                                @if ($execution->status === 'success' && ! $execution->local_storage_deleted)
+                                @if ($execution->status === 'success' && $execution->isDownloadable())
                                     <button type="button" class="icon-button shrink-0"
                                         x-on:click="download_volume_backup_file('{{ $execution->id }}')"
                                         title="Download backup" aria-label="Download backup">
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
index a48b6cb303..5c83f66f18 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
@@ -1,10 +1,11 @@
-<form wire:submit="save" class="application-settings-form">
+<form wire:submit="save" class="application-settings-form flex flex-col gap-6">
     <x-unsaved-bar action="save" />
 
     <x-application.settings-section title="Backup schedule"
         description="Choose when this storage is archived and how long each backup may run.">
         <x-slot:actions>
-            <div class="flex items-center gap-2">
+            {{-- Below xl the header bar is hidden, so keep the buttons here. --}}
+            <div @class(['flex items-center gap-2', 'xl:hidden' => $actionsInHeader && $backup])>
                 @if (!$enabled)
                     <x-forms.button type="button" wire:click="toggleEnabled" wire:loading.attr="disabled"
                         wire:target="toggleEnabled" isHighlighted>Enable backup</x-forms.button>
@@ -49,4 +50,7 @@
                 helper="Notify through backup failure channels after this many days without an execution. Use 0 to disable." required />
         </div>
     </x-application.settings-section>
+
+    @include('livewire.project.shared.storages.volume-backups.s3')
+    @include('livewire.project.shared.storages.volume-backups.retention')
 </form>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/retention.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/retention.blade.php
index d260d17f1c..d4f91e43da 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/retention.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/retention.blade.php
@@ -1,35 +1,31 @@
-<form wire:submit="save" class="application-settings-form">
-    <x-unsaved-bar action="save" />
-
-    <x-application.settings-section title="Retention"
-        description="The first reached limit removes the oldest archive. Use 0 for unlimited retention.">
-        <div>
-            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Local backups</h3>
-            <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-                <x-forms.input label="Backups to keep" id="retentionAmountLocally" type="number"
-                    min="0" canGate="update" :canResource="$resource"
-                    helper="Maximum number of recent local backups." required />
-                <x-forms.input label="Days to keep" id="retentionDaysLocally" type="number"
-                    min="0" canGate="update" :canResource="$resource"
-                    helper="Remove local backups older than this many days." required />
-                <x-forms.input label="Maximum storage (GB)" id="retentionMaxStorageLocally" type="number"
-                    min="0" step="any" canGate="update" :canResource="$resource"
-                    helper="Remove the oldest local backups after this total size is reached." required />
-            </div>
+<x-application.settings-section title="Retention"
+    description="The first reached limit removes the oldest archive. Use 0 for unlimited retention.">
+    <div>
+        <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Local backups</h3>
+        <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+            <x-forms.input label="Backups to keep" id="retentionAmountLocally" type="number"
+                min="0" canGate="update" :canResource="$resource"
+                helper="Maximum number of recent local backups." required />
+            <x-forms.input label="Days to keep" id="retentionDaysLocally" type="number"
+                min="0" canGate="update" :canResource="$resource"
+                helper="Remove local backups older than this many days." required />
+            <x-forms.input label="Maximum storage (GB)" id="retentionMaxStorageLocally" type="number"
+                min="0" step="any" canGate="update" :canResource="$resource"
+                helper="Remove the oldest local backups after this total size is reached." required />
         </div>
+    </div>
 
-        <div class="mt-6 border-t border-neutral-200 pt-6 dark:border-white/[0.06]">
-            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">S3 backups</h3>
-            <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-                <x-forms.input label="Backups to keep" id="retentionAmountS3" type="number" min="0"
-                    canGate="update" :canResource="$resource" helper="Maximum number of recent S3 backups." required />
-                <x-forms.input label="Days to keep" id="retentionDaysS3" type="number" min="0"
-                    canGate="update" :canResource="$resource"
-                    helper="Remove S3 backups older than this many days." required />
-                <x-forms.input label="Maximum storage (GB)" id="retentionMaxStorageS3" type="number"
-                    min="0" step="any" canGate="update" :canResource="$resource"
-                    helper="Remove the oldest S3 backups after this total size is reached." required />
-            </div>
+    <div class="mt-6 border-t border-neutral-200 pt-6 dark:border-white/[0.06]">
+        <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">S3 backups</h3>
+        <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+            <x-forms.input label="Backups to keep" id="retentionAmountS3" type="number" min="0"
+                canGate="update" :canResource="$resource" helper="Maximum number of recent S3 backups." required />
+            <x-forms.input label="Days to keep" id="retentionDaysS3" type="number" min="0"
+                canGate="update" :canResource="$resource"
+                helper="Remove S3 backups older than this many days." required />
+            <x-forms.input label="Maximum storage (GB)" id="retentionMaxStorageS3" type="number"
+                min="0" step="any" canGate="update" :canResource="$resource"
+                helper="Remove the oldest S3 backups after this total size is reached." required />
         </div>
-    </x-application.settings-section>
-</form>
+    </div>
+</x-application.settings-section>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
index 7c3f471bfa..a1c1056a23 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
@@ -10,37 +10,33 @@
         </x-empty>
     </x-application.settings-section>
 @else
-    <form wire:submit="save">
-        <x-unsaved-bar action="save" />
-
-        <x-application.settings-section title="S3 storage"
-            description="Choose where remote copies are stored and whether local archives are retained.">
-            <x-slot:actions>
-                @if (! $saveToS3)
-                    <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
-                        wire:target="toggleS3" isHighlighted canGate="update" :canResource="$resource">
-                        Enable S3
-                    </x-forms.button>
-                @else
-                    <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
-                        wire:target="toggleS3" canGate="update" :canResource="$resource">
-                        Disable S3
-                    </x-forms.button>
-                @endif
-            </x-slot:actions>
-            <div class="grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox canGate="update" :canResource="$resource" id="s3StorageId" label="S3 storage" :required="$saveToS3"
-                    :disabled="! auth()->user()?->can('update', $resource)"
-                    :options="$availableS3Storages->map(fn ($s3Storage) => [
-                        'value' => $s3Storage->id,
-                        'label' => $s3Storage->name,
-                    ])->values()->all()" />
-                <x-forms.listbox canGate="update" :canResource="$resource" id="disableLocalBackup" label="Local copy"
-                    :disabled="! $saveToS3 || ! auth()->user()?->can('update', $resource)" :options="[
-                        ['value' => false, 'label' => 'Keep local backup'],
-                        ['value' => true, 'label' => 'Delete after S3 upload'],
-                    ]" />
-            </div>
-        </x-application.settings-section>
-    </form>
+    <x-application.settings-section title="S3 storage"
+        description="Choose where remote copies are stored and whether local archives are retained.">
+        <x-slot:actions>
+            @if (! $saveToS3)
+                <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
+                    wire:target="toggleS3" isHighlighted canGate="update" :canResource="$resource">
+                    Enable S3
+                </x-forms.button>
+            @else
+                <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
+                    wire:target="toggleS3" canGate="update" :canResource="$resource">
+                    Disable S3
+                </x-forms.button>
+            @endif
+        </x-slot:actions>
+        <div class="grid gap-4 sm:grid-cols-2">
+            <x-forms.listbox canGate="update" :canResource="$resource" id="s3StorageIds" label="S3 storages" multiple live portal
+                helper="Each backup is uploaded to every selected storage." placeholder="Select S3 storages"
+                :options="$availableS3Storages->map(fn ($storage) => [
+                    'value' => $storage->id,
+                    'label' => $storage->name.($storage->is_usable ? '' : ' (unavailable)'),
+                ])->all()" />
+            <x-forms.listbox canGate="update" :canResource="$resource" id="disableLocalBackup" label="Local copy"
+                :disabled="! $saveToS3 || ! auth()->user()?->can('update', $resource)" :options="[
+                    ['value' => false, 'label' => 'Keep local backup'],
+                    ['value' => true, 'label' => 'Delete after S3 upload'],
+                ]" />
+        </div>
+    </x-application.settings-section>
 @endif
diff --git a/resources/views/livewire/project/shared/terminal.blade.php b/resources/views/livewire/project/shared/terminal.blade.php
index 8c5bd50767..4332896e0b 100644
--- a/resources/views/livewire/project/shared/terminal.blade.php
+++ b/resources/views/livewire/project/shared/terminal.blade.php
@@ -12,7 +12,8 @@
         <div class="hidden" aria-hidden="true" wire:poll.keep-alive.30s="keepTerminalPageAlive"></div>
     @endif
 
-    @if (!$hasShell)
+    {{-- Attach (console) mode does not need a shell, so only warn while Shell mode is active. --}}
+    @if (!$hasShell && $terminalMode === 'shell')
         @if ($isApplicationConsole)
             <div class="flex h-full min-h-[32rem] items-center justify-center">
                 <x-empty size="lg" title="Shell unavailable"
@@ -79,7 +80,7 @@
             </div>
         @endif
 
-        <div id="terminal" wire:ignore data-terminal-style="{{ $isApplicationConsole ? 'application' : 'default' }}"
+        <div id="terminal" wire:ignore @mouseup="focusConsoleFromOutput()" data-terminal-style="{{ $isApplicationConsole ? 'application' : 'default' }}"
             :class="fullscreen
                 ? 'terminal-host relative z-[1] min-h-0 flex-1 overflow-hidden px-1 py-[5px] bg-transparent'
                 : @js($isApplicationConsole
@@ -87,7 +88,40 @@
                     : 'terminal-host h-[510px] max-h-[calc(100dvh-10rem)] overflow-hidden px-2 py-1 rounded-sm bg-black')">
         </div>
 
-        <div x-show="terminalActive" x-cloak class="sm:hidden"
+        {{-- Command box for console (attach) mode — a terminal input line, never raw keystrokes. --}}
+        <div x-cloak x-show="terminalActive && $wire.terminalMode === 'attach'"
+            class="terminal-console-input relative z-[2] mt-2 shrink-0 border-t pt-2"
+            :class="fullscreen ? 'mx-1 mb-1' : ''"
+            :style="`--console-fg: ${consoleForegroundColor}`">
+            <div x-show="consolePendingLines.length > 0" x-cloak
+                class="console-command-pending mb-1 flex items-center gap-2 pl-2 text-xs">
+                <span x-text="`${consolePendingLines.length} pasted lines ready to send`"></span>
+                <span class="opacity-60">· Enter to send · Esc to cancel</span>
+            </div>
+            <div class="console-command-row flex min-h-9 cursor-text items-center gap-3 rounded-md pr-1 pl-2"
+                @click="$refs.consoleInput?.focus()">
+                <span class="console-command-prompt shrink-0 font-mono text-sm leading-none select-none"
+                    :data-sent="consoleSentFlash ? '' : null" aria-hidden="true">&gt;</span>
+                <input type="text" x-ref="consoleInput" x-model="consoleCommand"
+                    @keydown.enter.prevent="submitConsoleCommand()"
+                    @keydown.escape.prevent.stop="cancelConsoleInput()"
+                    @keydown.ctrl.l.prevent="clearConsoleOutput()"
+                    @keydown.arrow-up.prevent="recallConsoleCommand(-1)"
+                    @keydown.arrow-down.prevent="recallConsoleCommand(1)"
+                    @paste="pasteConsoleText($event)"
+                    autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false" enterkeyhint="send"
+                    aria-label="Console command" placeholder="Send a command to the process…"
+                    class="console-command-field min-w-0 flex-1 border-0! bg-transparent! px-0! py-1.5! font-mono text-[16px]! shadow-none! ring-0! outline-none! focus:border-0! focus:shadow-none! focus:ring-0! focus:outline-none! sm:text-[13px]!" />
+                <button type="button" @click.stop="submitConsoleCommand()" :disabled="!canSubmitConsoleCommand()"
+                    title="Send (Enter) · Clear input (Esc) · Clear output (Ctrl+L)"
+                    class="console-command-send inline-flex h-7 shrink-0 items-center gap-2 rounded px-2 text-xs font-medium transition-colors focus-visible:outline-2 focus-visible:outline-offset-2 disabled:pointer-events-none disabled:opacity-40">
+                    Send
+                    <span class="font-mono text-sm opacity-60" aria-hidden="true">↵</span>
+                </button>
+            </div>
+        </div>
+
+        <div x-show="terminalActive && $wire.terminalMode !== 'attach'" x-cloak class="sm:hidden"
             :class="fullscreen ? 'relative z-[2] shrink-0 px-2 pb-2' : (keyboardInset > 0 ? 'fixed inset-x-0 z-[100002] px-2 pb-2' : 'relative z-[2] mt-2 shrink-0')"
             :style="!fullscreen && keyboardInset > 0 ? `top: ${keyboardAnchorTop}px; transform: translateY(-100%)` : ''"
             data-terminal-mobile-toolbar>
diff --git a/resources/views/livewire/project/show.blade.php b/resources/views/livewire/project/show.blade.php
index 20eb67595e..d682ee0033 100644
--- a/resources/views/livewire/project/show.blade.php
+++ b/resources/views/livewire/project/show.blade.php
@@ -5,7 +5,18 @@
     <div x-data="projectEnvironments()" class="w-full">
         <header class="mb-5 flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
             <div class="min-w-0">
-                <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">{{ $project->name }}</h1>
+                <div class="flex min-w-0 items-center gap-1.5">
+                    <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">{{ $project->name }}</h1>
+                    @can('update', $project)
+                        <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}"
+                            {{ wireNavigate() }}
+                            class="flex size-7 shrink-0 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg"
+                            title="Project settings"
+                            aria-label="Open settings for {{ $project->name }}">
+                            <x-reicon name="settings" class="size-4" />
+                        </a>
+                    @endcan
+                </div>
                 <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
                     <span
                         x-text="`${environments.length} ${environments.length === 1 ? 'environment' : 'environments'}`"></span>
@@ -15,15 +26,6 @@
 
             @can('update', $project)
                 <div class="flex w-fit shrink-0 items-center gap-2">
-                    <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}"
-                        {{ wireNavigate() }}
-                        class="button"
-                        title="Project settings"
-                        aria-label="Open settings for {{ $project->name }}">
-                        <x-reicon name="settings" class="size-3.5" />
-                        Settings
-                    </a>
-
                     <x-modal-input title="New Environment">
                         <x-slot:content>
                             <button type="button"
@@ -33,17 +35,7 @@
                             </button>
                         </x-slot:content>
 
-                        <form class="space-y-4" wire:submit="submit">
-                            <x-forms.input placeholder="staging" id="name" label="Name" required />
-
-                            <footer
-                                class="flex justify-end border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
-                                <x-forms.button type="submit"
-                                    defaultClass="button button-highlighted">
-                                    Create environment
-                                </x-forms.button>
-                            </footer>
-                        </form>
+                        @include('livewire.project.partials.new-environment-form')
                     </x-modal-input>
                 </div>
             @endcan
@@ -68,7 +60,7 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-2">
+                <div class="flex flex-wrap items-center gap-2">
                     <x-table.dropdown panel-class="w-48!">
                         <x-slot:trigger>
                             <button type="button" class="button" aria-haspopup="listbox" :aria-expanded="open">
@@ -95,27 +87,9 @@
                             </template>
                     </x-table.dropdown>
 
-                    <div
-                        class="view-toggle">
-                        <button type="button" x-on:click="setViewMode('table')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'table'
-                                ?
-                                'control-selected' :
-                                'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Table view" title="Table view">
-                            <x-reicon name="unordered-list" class="size-3.5" />
-                        </button>
-                        <button type="button" x-on:click="setViewMode('grid')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'grid'
-                                ?
-                                'control-selected' :
-                                'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Grid view" title="Grid view">
-                            <x-reicon name="grid" class="size-3.5" />
-                        </button>
-                    </div>
+                    <x-canvas-view-toggle
+                        :list-url="route('project.show', ['project_uuid' => $project->uuid])"
+                        :canvas-url="route('project.canvas', ['project_uuid' => $project->uuid])" />
                 </div>
             </div>
 
@@ -239,7 +213,7 @@
             search: '',
             sortBy: 'name-asc',
             sortOpen: false,
-            viewMode: localStorage.getItem('project-environments-view') || 'grid',
+            viewMode: @js($this->listView('project', 'grid')),
             page: 1,
             pageSize: 12,
             environments: @js($environmentsJs),
@@ -299,7 +273,7 @@
             setViewMode(mode) {
                 this.viewMode = mode;
                 this.page = 1;
-                localStorage.setItem('project-environments-view', mode);
+                this.$wire.saveListView('project', mode);
             },
             previousPage() {
                 this.page = Math.max(1, this.page - 1);
diff --git a/resources/views/livewire/security/cloud-provider-token-form.blade.php b/resources/views/livewire/security/cloud-provider-token-form.blade.php
index 271ad7367d..d6f14e188d 100644
--- a/resources/views/livewire/security/cloud-provider-token-form.blade.php
+++ b/resources/views/livewire/security/cloud-provider-token-form.blade.php
@@ -9,6 +9,7 @@
             get providerConsoleUrl() {
                 if (this.selectedProvider === 'hetzner') return 'https://console.hetzner.com/projects';
                 if (this.selectedProvider === 'vultr') return 'https://console.vultr.com/user/apiaccess/';
+                if (this.selectedProvider === 'hostinger') return 'https://hpanel.hostinger.com/profile/api';
                 return 'https://cloud.digitalocean.com/account/api/tokens';
             }
         }">
@@ -18,6 +19,7 @@
                 ['value' => 'hetzner', 'label' => 'Hetzner'],
                 ['value' => 'digitalocean', 'label' => 'DigitalOcean'],
                 ['value' => 'vultr', 'label' => 'Vultr'],
+                ['value' => 'hostinger', 'label' => 'Hostinger'],
             ]" />
         @else
             <input type="hidden" wire:model="provider" />
diff --git a/resources/views/livewire/security/integration-token-editor.blade.php b/resources/views/livewire/security/integration-token-editor.blade.php
index ed7d108aed..46882ba513 100644
--- a/resources/views/livewire/security/integration-token-editor.blade.php
+++ b/resources/views/livewire/security/integration-token-editor.blade.php
@@ -34,10 +34,15 @@
                 <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
                 <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
                     <x-forms.checkbox id="edit-dns-capability" label="DNS" domValue="dns" fullWidth
-                        wire:model.live="capabilities" />
+                        :disabled="in_array('tunnel', $capabilities, true)" wire:model.live="capabilities" />
                     <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
                         Manage Cloudflare DNS records.
                     </p>
+                    <x-forms.checkbox id="edit-tunnel-capability" label="Cloudflare Tunnel" domValue="tunnel" fullWidth
+                        wire:model.live="capabilities" />
+                    <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
+                        Create and manage tunnels for server SSH. Needs DNS.
+                    </p>
                 </div>
                 @error('capabilities')
                     <span class="text-xs text-red-500">{{ $message }}</span>
@@ -71,8 +76,11 @@
                 <ul class="list-inside list-disc">
                     <li>Zone - DNS - Edit</li>
                     <li>Zone - Zone - Read</li>
+                    @if (in_array('tunnel', $capabilities, true))
+                        <li>Account - Cloudflare Tunnel - Edit</li>
+                    @endif
                 </ul>
-                <a href="https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management"
+                <a href="{{ \App\Models\IntegrationToken::cloudflareTokenTemplateUrl($capabilities) }}"
                     target="_blank" rel="noopener noreferrer"
                     class="font-medium text-coollabs hover:underline dark:text-warning">
                     Create a replacement token in Cloudflare
diff --git a/resources/views/livewire/security/integration-token-form.blade.php b/resources/views/livewire/security/integration-token-form.blade.php
index a085ebbe1a..004c642f03 100644
--- a/resources/views/livewire/security/integration-token-form.blade.php
+++ b/resources/views/livewire/security/integration-token-form.blade.php
@@ -42,10 +42,15 @@
                 <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
                 <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
                     <x-forms.checkbox id="dns-capability" label="DNS" domValue="dns" fullWidth
-                        wire:model.live="capabilities" />
+                        :disabled="in_array('tunnel', $capabilities, true)" wire:model.live="capabilities" />
                     <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
                         Manage Cloudflare DNS records.
                     </p>
+                    <x-forms.checkbox id="tunnel-capability" label="Cloudflare Tunnel" domValue="tunnel" fullWidth
+                        wire:model.live="capabilities" />
+                    <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
+                        Create and manage tunnels for server SSH. Needs DNS.
+                    </p>
                 </div>
                 @error('capabilities')
                     <span class="text-xs text-red-500">{{ $message }}</span>
@@ -79,9 +84,12 @@
                 <ul class="list-inside list-disc">
                     <li>Zone - DNS - Edit</li>
                     <li>Zone - Zone - Read</li>
+                    @if (in_array('tunnel', $capabilities, true))
+                        <li>Account - Cloudflare Tunnel - Edit</li>
+                    @endif
                 </ul>
                 <p>Limit zone resources to the zones Coolify should manage.</p>
-                <a href="https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management"
+                <a href="{{ \App\Models\IntegrationToken::cloudflareTokenTemplateUrl($capabilities) }}"
                     target="_blank" rel="noopener noreferrer"
                     class="button mt-2">
                     Create token at Cloudflare
diff --git a/resources/views/livewire/server/canvas.blade.php b/resources/views/livewire/server/canvas.blade.php
new file mode 100644
index 0000000000..f8e236770c
--- /dev/null
+++ b/resources/views/livewire/server/canvas.blade.php
@@ -0,0 +1,34 @@
+<div class="flex h-full flex-col">
+    <x-slot:title>
+        {{ $server ? $server->name.' > Canvas' : 'Servers > Canvas' }} | Coolify
+    </x-slot>
+    @if ($server)
+        {{-- Status, proxy actions and the server name dock in the top bar. --}}
+        <livewire:server.navbar :server="$server" />
+        {{-- Its menu shows in the main sidebar on xl (components/server/sidebar.blade.php); below xl a canvas has no room for it. --}}
+        <x-server.sidebar :server="$server" activeMenu="resources" />
+    @endif
+    <div data-environment-canvas
+        data-endpoint="{{ $server ? '/servers/'.$server->uuid.'/canvas' : '/servers/canvas' }}"
+        data-team="{{ $teamId }}" data-user="{{ auth()->id() }}"
+        class="relative min-h-0 flex-1" wire:ignore>
+        @if ($server)
+            <x-canvas-view-toggle data-ec-views on-canvas :views="['list' => ['List view', 'unordered-list']]"
+                :list-url="route('server.resources', ['server_uuid' => $server->uuid])"
+                :canvas-url="route('server.canvas', ['server_uuid' => $server->uuid])" />
+        @else
+            {{-- The canvas moves this group into its toolbar; the page actions come last, at the right end. --}}
+            <div data-ec-views class="flex items-center gap-2">
+                <x-canvas-view-toggle on-canvas
+                    :list-url="route('server.index')" :canvas-url="route('server.canvas.index')" />
+                @can('createAnyResource')
+                    <a href="{{ route('server.create') }}" {{ wireNavigate() }}
+                        class="button button-highlighted whitespace-nowrap">
+                        <x-reicon name="plus" class="size-3.5" />
+                        New server
+                    </a>
+                @endcan
+            </div>
+        @endif
+    </div>
+</div>
diff --git a/resources/views/livewire/server/charts.blade.php b/resources/views/livewire/server/charts.blade.php
index 442fc1979f..1d889a2ac6 100644
--- a/resources/views/livewire/server/charts.blade.php
+++ b/resources/views/livewire/server/charts.blade.php
@@ -59,15 +59,34 @@
                     </x-application.settings-section>
                 </form>
 
-                <x-application.settings-section id="server-cpu-metrics-section" title="CPU usage"
-                    helper="Percentage of available CPU capacity used by this server.">
-                    <div wire:ignore id="{!! $chartId !!}-cpu" class="min-h-[240px] w-full"></div>
-                </x-application.settings-section>
+                {{-- CPU is the primary signal, so it spans full width; the other four
+                     charts fall into a 2x2 below (mirrors the fleet /metrics layout). --}}
+                <div class="grid gap-6 lg:grid-cols-2">
+                    <x-application.settings-section id="server-cpu-metrics-section" title="CPU usage" class="lg:col-span-2"
+                        helper="Percentage of available CPU capacity used by this server.">
+                        <div wire:ignore id="{!! $chartId !!}-cpu" class="min-h-[240px] w-full"></div>
+                    </x-application.settings-section>
 
-                <x-application.settings-section id="server-memory-metrics-section" title="Memory usage"
-                    helper="Percentage of physical memory currently used by this server.">
-                    <div wire:ignore id="{!! $chartId !!}-memory" class="min-h-[240px] w-full"></div>
-                </x-application.settings-section>
+                    <x-application.settings-section id="server-memory-metrics-section" title="Memory usage"
+                        helper="Percentage of physical memory currently used by this server.">
+                        <div wire:ignore id="{!! $chartId !!}-memory" class="min-h-[240px] w-full"></div>
+                    </x-application.settings-section>
+
+                    <x-application.settings-section id="server-network-metrics-section" title="Network throughput"
+                        helper="Receive and transmit rate across the server's network interfaces.">
+                        <div wire:ignore id="{!! $chartId !!}-network" class="min-h-[240px] w-full"></div>
+                    </x-application.settings-section>
+
+                    <x-application.settings-section id="server-load-metrics-section" title="Load average"
+                        helper="One minute load average reported by the server.">
+                        <div wire:ignore id="{!! $chartId !!}-load" class="min-h-[240px] w-full"></div>
+                    </x-application.settings-section>
+
+                    <x-application.settings-section id="server-disk-metrics-section" title="Disk usage"
+                        helper="Percentage of the root filesystem used by this server.">
+                        <div wire:ignore id="{!! $chartId !!}-disk" class="min-h-[240px] w-full"></div>
+                    </x-application.settings-section>
+                </div>
 
                 @script
                     <script>
@@ -81,6 +100,16 @@
                                 return `${Number(number.toFixed(precision))}%`;
                             };
 
+                            const formatNumber = value => Number(Number(value).toFixed(2)).toLocaleString();
+                            const formatBytes = value => {
+                                const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+                                let amount = Number(value) || 0;
+                                let unit = 0;
+                                while (amount >= 1024 && unit < units.length - 1) { amount /= 1024; unit++; }
+                                return `${Number(amount.toFixed(unit === 0 ? 0 : 2))} ${units[unit]}`;
+                            };
+                            const formatRate = value => `${formatBytes(value)}/s`;
+
                             const formatLocalTimestamp = timestamp => new Date(timestamp).toLocaleString(undefined, {
                                 hour12: false,
                                 timeZoneName: 'short',
@@ -91,7 +120,7 @@
                                 timeZoneName: 'short',
                             });
 
-                            const chartOptions = (name, color, loadingText) => ({
+                            const chartOptions = (name, color, loadingText, formatter = formatPercent) => ({
                                 chart: {
                                     height: 240,
                                     type: 'area',
@@ -151,7 +180,7 @@
                                         style: {
                                             colors: textColor,
                                         },
-                                        formatter: formatPercent,
+                                        formatter,
                                     },
                                 },
                                 noData: {
@@ -180,7 +209,7 @@
                                         const timestamp = w.globals.seriesX[seriesIndex][dataPointIndex];
 
                                         return `<div class="apexcharts-tooltip-custom">
-                                            <div class="apexcharts-tooltip-custom-value">${name}: <span class="apexcharts-tooltip-value-bold">${formatPercent(value)}</span></div>
+                                            <div class="apexcharts-tooltip-custom-value">${w.globals.seriesNames?.[seriesIndex] ?? name}: <span class="apexcharts-tooltip-value-bold">${formatter(value)}</span></div>
                                             <div class="apexcharts-tooltip-custom-title">Your time: ${formatLocalTimestamp(timestamp)}</div>
                                             <div class="apexcharts-tooltip-custom-title">UTC: ${formatUtcTimestamp(timestamp)}</div>
                                         </div>`;
@@ -197,8 +226,32 @@
                                 chartOptions('Memory', ramColor, 'Loading memory metrics…'),
                             );
 
-                            cpuChart.render();
-                            memoryChart.render();
+                            const diskChart = new ApexCharts(
+                                document.getElementById('{!! $chartId !!}-disk'),
+                                chartOptions('Disk', '#ef4444', 'Loading disk metrics…', formatPercent),
+                            );
+                            const networkChart = new ApexCharts(
+                                document.getElementById('{!! $chartId !!}-network'),
+                                {
+                                    ...chartOptions('Network', '#10b981', 'Loading network metrics…', formatRate),
+                                    colors: ['#10b981', '#f59e0b'],
+                                    legend: { show: true, labels: { colors: textColor } },
+                                },
+                            );
+                            const loadChart = new ApexCharts(
+                                document.getElementById('{!! $chartId !!}-load'),
+                                chartOptions('Load', '#14b8a6', 'Loading load metrics…', formatNumber),
+                            );
+
+                            // Defer to the next frame so the 2x2 grid cells are laid out
+                            // before ApexCharts measures them (a zero-width cell renders blank).
+                            requestAnimationFrame(() => {
+                                cpuChart.render();
+                                memoryChart.render();
+                                diskChart.render();
+                                networkChart.render();
+                                loadChart.render();
+                            });
 
                             Livewire.on('refreshChartData-{!! $chartId !!}-metrics', chartData => {
                                 checkTheme();
@@ -272,6 +325,12 @@
                                         },
                                     },
                                 });
+                                diskChart.updateSeries([{ name: 'Disk', data: data.diskSeries || [] }]);
+                                networkChart.updateSeries([
+                                    { name: 'RX', data: data.networkRxSeries || [] },
+                                    { name: 'TX', data: data.networkTxSeries || [] },
+                                ]);
+                                loadChart.updateSeries([{ name: 'Load', data: data.loadSeries || [] }]);
                             });
                         })();
                     </script>
diff --git a/resources/views/livewire/server/cloud-provider-token/show.blade.php b/resources/views/livewire/server/cloud-provider-token/show.blade.php
index 5c4fe5d98f..e4fe7c19d1 100644
--- a/resources/views/livewire/server/cloud-provider-token/show.blade.php
+++ b/resources/views/livewire/server/cloud-provider-token/show.blade.php
@@ -10,7 +10,7 @@
         <x-server.sidebar :server="$server" activeMenu="cloud-provider-token" />
 
         <div class="application-settings-form w-full">
-            @if ($server->hetzner_server_id || $server->vultr_instance_id)
+            @if ($server->hetzner_server_id || $server->vultr_instance_id || $server->digitalocean_droplet_id || $server->hostinger_virtual_machine_id)
                 <x-application.settings-section id="server-cloud-token-section"
                     title="{{ $providerName }} token"
                     helper="Choose the cloud credential used to manage this server." flush>
@@ -67,7 +67,7 @@
                 <x-application.settings-section title="Cloud token"
                     helper="Cloud credentials are available for servers created through a supported provider.">
                     <x-empty size="sm" title="No cloud provider integration"
-                        description="This server was not created through Hetzner or Vultr, so it does not require a managed cloud token."
+                        description="This server was not created through a supported cloud provider, so it does not require a managed cloud token."
                         icon-name="keys" />
                 </x-application.settings-section>
             @endif
diff --git a/resources/views/livewire/server/cloudflare-tunnel.blade.php b/resources/views/livewire/server/cloudflare-tunnel.blade.php
index 255260ca18..7ae00efde6 100644
--- a/resources/views/livewire/server/cloudflare-tunnel.blade.php
+++ b/resources/views/livewire/server/cloudflare-tunnel.blade.php
@@ -22,31 +22,60 @@
                                 <livewire:activity-monitor header="Logs" fullHeight />
                             </x-slot:content>
                         </x-process-dialog>
-                        <x-modal-confirmation title="Disable Cloudflare Tunnel?"
-                            buttonTitle="Disable Cloudflare Tunnel" isErrorButton
-                            submitAction="toggleCloudflareTunnels" :actions="$server->ip_previous
-                                ? [
-                                    'Cloudflare Tunnel will be disabled for this server.',
-                                    'The server IP address will be restored to its previous value.',
-                                ]
-                                : [
-                                    'Cloudflare Tunnel will be disabled for this server.',
-                                    'You must manually restore the direct server IP address.',
-                                    'The server may become inaccessible until the IP is corrected.',
-                                ]"
-                            confirmationText="DISABLE CLOUDFLARE TUNNEL"
-                            confirmationLabel="Type the confirmation text to disable Cloudflare Tunnel."
+                    @endif
+                    @if (!$isCloudflareTunnelsEnabled)
+                        <a class="button" href="https://coolify.io/docs/knowledge-base/cloudflare/tunnels/server-ssh"
+                            target="_blank">
+                            Documentation
+                            <x-external-link />
+                        </a>
+                    @endif
+                    @if (!$isCloudflareTunnelsEnabled && $server->isFunctional() && auth()->user()->can('update', $server))
+                        <x-modal-confirmation title="Confirm manual Cloudflare Tunnel configuration"
+                            buttonTitle="I configured the tunnel manually"
+                            submitAction="manualCloudflareConfig" :actions="[
+                                'Cloudflare and cloudflared have already been configured.',
+                                'An incomplete setup can make the server unreachable.',
+                            ]" confirmationText="I manually configured Cloudflare Tunnel"
+                            confirmationLabel="Type the confirmation text to continue."
                             shortConfirmationLabel="Confirmation text" />
-                    @else
-                        <x-status-badge :status="$isCloudflareTunnelsEnabled ? 'Enabled' : 'Disabled'"
-                            :type="$isCloudflareTunnelsEnabled ? 'success' : 'neutral'" />
+                    @endif
+                    @if ($isCloudflareTunnelsEnabled)
+                        <x-status-badge status="Enabled" type="success" />
                     @endif
                 </x-slot:actions>
 
                 @if ($isCloudflareTunnelsEnabled)
+                    @if (filled($server->settings->cloudflare_tunnel_id))
+                        <p class="mb-4 text-sm leading-6 text-neutral-600 dark:text-fg-dim">
+                            Coolify manages this tunnel through the Cloudflare API (tunnel
+                            <code>{{ \App\Services\CloudflareTunnelService::tunnelName($server) }}</code>).
+                        </p>
+                    @endif
                     <x-callout type="warning" title="Disabling the tunnel can interrupt server access">
                         The server IP must be restored to its direct address after disabling the tunnel.
                     </x-callout>
+                    @can('update', $server)
+                        <div class="mt-4">
+                            <x-modal-confirmation title="Disable Cloudflare Tunnel?"
+                                buttonTitle="Disable Cloudflare Tunnel" isErrorButton
+                                submitAction="toggleCloudflareTunnels" :actions="array_merge(
+                                    ['Cloudflare Tunnel will be disabled for this server.'],
+                                    filled($server->settings->cloudflare_tunnel_id)
+                                        ? ['The Cloudflare tunnel and the DNS record that Coolify created will be deleted.']
+                                        : [],
+                                    $server->ip_previous
+                                        ? ['The server IP address will be restored to its previous value.']
+                                        : [
+                                            'You must manually restore the direct server IP address.',
+                                            'The server may become inaccessible until the IP is corrected.',
+                                        ],
+                                )"
+                                confirmationText="DISABLE CLOUDFLARE TUNNEL"
+                                confirmationLabel="Type the confirmation text to disable Cloudflare Tunnel."
+                                shortConfirmationLabel="Confirmation text" />
+                        </div>
+                    @endcan
                 @elseif (!$server->isFunctional())
                     <x-callout type="info" title="Validate the server for automated setup">
                         Automated configuration requires a validated server, a Cloudflare token, and an SSH domain.
@@ -56,25 +85,6 @@
                         </button>.
                     </x-callout>
                 @else
-                    <p class="text-sm leading-6 text-neutral-600 dark:text-fg-dim">
-                        Choose automated setup to install and configure cloudflared, or confirm that you already
-                        configured the tunnel manually.
-                    </p>
-                @endif
-            </x-application.settings-section>
-
-            @if (!$isCloudflareTunnelsEnabled && $server->isFunctional())
-                <x-application.settings-section id="server-cloudflare-automated-section" title="Automated setup"
-                    helper="Let Coolify configure the Cloudflare SSH tunnel on this server.">
-                    <x-slot:actions>
-                        <a class="button"
-                            href="https://coolify.io/docs/knowledge-base/cloudflare/tunnels/server-ssh"
-                            target="_blank">
-                            Documentation
-                            <x-external-link />
-                        </a>
-                    </x-slot:actions>
-
                     @cannot('update', $server)
                         <x-callout type="danger" title="Insufficient permissions">
                             You do not have permission to configure Cloudflare Tunnel for this server.
@@ -86,34 +96,88 @@
                                 <livewire:activity-monitor header="Logs" fullHeight />
                             </x-slot:content>
                         </x-process-dialog>
-                        <form @submit.prevent="$wire.dispatch('automatedCloudflareConfig')">
-                            <div class="grid gap-4 lg:grid-cols-2">
-                                <x-forms.input id="cloudflare_token" required label="Cloudflare token"
-                                    type="password" />
-                                <x-forms.input id="ssh_domain" label="SSH domain" required
-                                    helper="Enter the hostname configured in Cloudflare without a protocol." />
-                            </div>
-                            <div class="mt-4 flex justify-end">
-                                <x-forms.button type="submit" isHighlighted>Configure tunnel</x-forms.button>
-                            </div>
-                        </form>
+
+                        @if ($tunnelTokens->isEmpty())
+                            <x-callout type="info" title="No Cloudflare token can manage tunnels">
+                                @if ($hasCloudflareTokens)
+                                    Enable the Cloudflare Tunnel capability on a Cloudflare token
+                                @else
+                                    Add a Cloudflare token with the DNS and Cloudflare Tunnel capabilities
+                                @endif
+                                in
+                                <a href="{{ route('security.integration-tokens') }}" class="font-medium underline"
+                                    {{ wireNavigate() }}>Integration tokens</a>.
+                                The token needs Account - Cloudflare Tunnel - Edit, Zone - DNS - Edit, and Zone - Zone - Read.
+                            </x-callout>
+                            @can('create', App\Models\IntegrationToken::class)
+                                <div class="mt-4">
+                                    <x-modal-input title="New Integration Token">
+                                        <x-slot:content>
+                                            <button type="button" class="button button-highlighted">
+                                                <x-reicon name="plus" class="size-3.5" />
+                                                Add Cloudflare token
+                                            </button>
+                                        </x-slot:content>
+                                        <livewire:security.integration-token-form :modal_mode="true"
+                                            :capabilities="['dns', 'tunnel']" wire:key="new-cloudflare-tunnel-token" />
+                                    </x-modal-input>
+                                </div>
+                            @endcan
+                        @else
+                            <form wire:submit="apiCloudflareConfig">
+                                <div class="grid gap-4 lg:grid-cols-2">
+                                    <x-forms.listbox id="cloudflare_integration_token_id" label="Cloudflare token"
+                                        required placeholder="Select a token"
+                                        :options="$tunnelTokens->map(fn ($token) => ['value' => $token->id, 'label' => $token->name])->all()" />
+                                    <x-forms.input id="api_ssh_domain" label="SSH hostname" required
+                                        placeholder="ssh.example.com"
+                                        helper="A hostname in a zone of the selected token. Cloudflare routes it to SSH port {{ $server->port }} of this server." />
+                                </div>
+                                <div class="mt-4 flex justify-end">
+                                    <x-forms.button type="submit" isHighlighted>Set up tunnel</x-forms.button>
+                                </div>
+                            </form>
+                            @if ($dnsConflict)
+                                <div class="mt-4">
+                                    <x-callout type="warning" title="A DNS record already exists">
+                                        {{ $dnsConflict['hostname'] }} already points to {{ $dnsConflict['current'] }}.
+                                        Replace it with the tunnel record to continue.
+                                    </x-callout>
+                                    <div class="mt-4">
+                                        <x-modal-confirmation title="Replace DNS record?" buttonTitle="Replace DNS record"
+                                            submitAction="replaceDnsAndConfigure" :actions="[
+                                                'The DNS record of '.$dnsConflict['hostname'].' will point to the Cloudflare tunnel.',
+                                                'Traffic that uses the current record value will stop.',
+                                            ]" :confirmWithText="false" :confirmWithPassword="false" />
+                                    </div>
+                                </div>
+                            @endif
+                        @endif
+
+                        <div class="mt-4 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                            <x-forms.collapsible title="Use an existing tunnel with its tunnel token">
+                                <p class="text-sm leading-6 text-neutral-600 dark:text-fg-dim">
+                                    For a tunnel you created in the Cloudflare dashboard. Coolify does not need a
+                                    Cloudflare API token for this.
+                                </p>
+                                <form class="mt-4" @submit.prevent="$wire.dispatch('automatedCloudflareConfig')">
+                                    <div class="grid gap-4 lg:grid-cols-2">
+                                        <x-forms.input id="cloudflare_token" required label="Tunnel token" type="password"
+                                            helper="The token of the tunnel connector, from the Cloudflare dashboard." />
+                                        <x-forms.input id="ssh_domain" label="SSH domain" required
+                                            helper="The public hostname of the tunnel that routes to SSH on this server, without a protocol." />
+                                    </div>
+                                    <div class="mt-4 flex justify-end">
+                                        <x-forms.button type="submit">Configure tunnel</x-forms.button>
+                                    </div>
+                                </form>
+                            </x-forms.collapsible>
+                        </div>
                     @endcannot
-                </x-application.settings-section>
-
-                <x-application.settings-section id="server-cloudflare-manual-section" title="Manual setup"
-                    helper="Use this only after cloudflared and the Cloudflare tunnel are already configured.">
-                    @can('update', $server)
-                        <x-modal-confirmation title="Confirm manual Cloudflare Tunnel configuration"
-                            buttonTitle="I configured the tunnel manually"
-                            submitAction="manualCloudflareConfig" :actions="[
-                                'Cloudflare and cloudflared have already been configured.',
-                                'An incomplete setup can make the server unreachable.',
-                            ]" confirmationText="I manually configured Cloudflare Tunnel"
-                            confirmationLabel="Type the confirmation text to continue."
-                            shortConfirmationLabel="Confirmation text" />
-                    @endcan
-                </x-application.settings-section>
+                @endif
+            </x-application.settings-section>
 
+            @if (!$isCloudflareTunnelsEnabled && $server->isFunctional())
                 @script
                     <script>
                         $wire.$on('automatedCloudflareConfig', () => {
diff --git a/resources/views/livewire/server/create.blade.php b/resources/views/livewire/server/create.blade.php
index d1530985e5..3bed1f90d0 100644
--- a/resources/views/livewire/server/create.blade.php
+++ b/resources/views/livewire/server/create.blade.php
@@ -50,7 +50,7 @@
                         <p class="application-settings-section-description">Create a server with a cloud provider.</p>
                     </div>
                     <div class="application-settings-section-body is-flush">
-                        <div class="grid grid-cols-1 gap-3 p-3 sm:grid-cols-2 lg:grid-cols-3">
+                        <div class="grid grid-cols-1 gap-3 p-3 sm:grid-cols-2 lg:grid-cols-4">
                             <a href="{{ route('server.create.type', ['type' => 'hetzner']) }}"
                                 class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
                                 {{ wireNavigate() }}>
@@ -94,6 +94,20 @@
                                 </div>
                             </a>
 
+                            <a href="{{ route('server.create.type', ['type' => 'hostinger']) }}"
+                                class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]"
+                                {{ wireNavigate() }}>
+                                <div class="flex items-start">
+                                    <x-hostinger-icon class="size-8 text-[#673de6]" />
+                                </div>
+                                <div class="mt-auto pt-5">
+                                    <h3 class="text-[13px]! font-semibold! text-black dark:text-fg">Hostinger</h3>
+                                    <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
+                                        Purchase and provision a new VPS.
+                                    </p>
+                                </div>
+                            </a>
+
                         </div>
                     </div>
                 </section>
@@ -113,6 +127,10 @@
                 <livewire:server.new.by-digital-ocean :private_keys="$private_keys" :limit_reached="$limit_reached"
                     :selected-token-uuid="$selectedTokenUuid"
                     wire:key="new-server-digital-ocean-{{ $selectedTokenUuid ?? 'select' }}" />
+            @elseif ($selectedType === 'hostinger')
+                <livewire:server.new.by-hostinger :private_keys="$private_keys" :limit_reached="$limit_reached"
+                    :selected-token-uuid="$selectedTokenUuid"
+                    wire:key="new-server-hostinger-{{ $selectedTokenUuid ?? 'select' }}" />
             @else
                 <livewire:server.new.by-ip :private_keys="$private_keys" :limit_reached="$limit_reached"
                     key="new-server-manual" />
diff --git a/resources/views/livewire/server/delete.blade.php b/resources/views/livewire/server/delete.blade.php
index fb5e9c3172..5c13c0b9fd 100644
--- a/resources/views/livewire/server/delete.blade.php
+++ b/resources/views/livewire/server/delete.blade.php
@@ -17,16 +17,43 @@
                     <x-danger-zone title="This action cannot be undone">
                         <p>
                         The server will be removed from Coolify.
-                        @if ($server->definedResources()->count() > 0)
+                        @if ($server->isTransferredAway())
+                            This server was transferred to another Coolify instance. Only the records on this instance
+                            are deleted, also the records of its resources. The server, its containers, and its data
+                            stay as they are.
+                        @elseif ($server->definedResources()->count() > 0)
                             It currently contains managed resources. Enable force deletion in the confirmation only
                             if those resources should also be removed.
                         @endif
+                        @if ($server->hostinger_virtual_machine_id && ! $server->isTransferredAway())
+                            Hostinger deletes the VPS only at the end of its paid period, and only if you select this in the confirmation dialog.
+                            <a class="underline" href="https://hpanel.hostinger.com/" target="_blank"
+                                rel="noopener noreferrer">Manage the VPS and billing in hPanel.</a>
+                        @endif
                         </p>
                         <p>Type the server name in the confirmation dialog to continue.</p>
                         <x-slot:action>
+                        @php
+                            $deleteActions = $server->isTransferredAway()
+                                ? ['This server and the records of its resources will be permanently deleted from this Coolify instance. Nothing on the server changes.']
+                                : ['This server will be permanently deleted from Coolify.'];
+                            $deleteWarningMessage = null;
+                            if ($server->isTransferredAway()) {
+                                $deleteWarningMessage = '<strong>This removes the option to undo the transfer.</strong><br>'
+                                    .'This archive is the copy that "Transfer back" and "Take back" use. '
+                                    .'Delete it only when the transfer works and you do not need to undo it.';
+                            }
+                            if ($server->hostinger_virtual_machine_id && ! $server->isTransferredAway()) {
+                                $deleteWarningMessage = '<strong>Hostinger deletes a VPS only at the end of its paid period.</strong><br>'
+                                    .'If you select to delete the VPS from Hostinger, Coolify turns off its auto-renewal. '
+                                    .'The VPS keeps running until the paid period ends. Then Hostinger deletes it with all its data. '
+                                    .'To delete it now or to request a refund, '
+                                    .'<a class="underline font-semibold" href="https://hpanel.hostinger.com/" target="_blank" rel="noopener noreferrer">cancel the VPS in hPanel</a>.';
+                            }
+                        @endphp
                         <x-modal-confirmation title="Confirm Server Deletion?" isErrorButton
                             buttonTitle="Delete server" submitAction="delete"
-                            :actions="['This server will be permanently deleted from Coolify.']"
+                            :actions="$deleteActions" :warningMessage="$deleteWarningMessage"
                             :checkboxes="$checkboxes" confirmationText="{{ $server->name }}"
                             confirmationLabel="Please confirm by entering the Server Name below"
                             shortConfirmationLabel="Server Name" />
diff --git a/resources/views/livewire/server/docker-registries/server-registries-placeholder.blade.php b/resources/views/livewire/server/docker-registries/server-registries-placeholder.blade.php
new file mode 100644
index 0000000000..1db4dc43cc
--- /dev/null
+++ b/resources/views/livewire/server/docker-registries/server-registries-placeholder.blade.php
@@ -0,0 +1,12 @@
+<div class="overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
+    <div aria-hidden="true"
+        class="flex items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 dark:border-white/[0.08] dark:bg-white/[0.05]">
+        <x-skeleton class="size-4 shrink-0 rounded" />
+        <x-skeleton class="h-3 w-32 rounded-full" />
+        <div class="ml-auto flex shrink-0 items-center gap-2">
+            <x-skeleton class="h-8 w-20 rounded-lg" />
+            <x-skeleton class="h-8 w-16 rounded-lg" />
+        </div>
+    </div>
+    <x-skeleton.list :rows="2" label="Loading registries" />
+</div>
diff --git a/resources/views/livewire/server/index.blade.php b/resources/views/livewire/server/index.blade.php
index 30eca6ac13..0b9469dc08 100644
--- a/resources/views/livewire/server/index.blade.php
+++ b/resources/views/livewire/server/index.blade.php
@@ -6,16 +6,6 @@
     <div class="mb-5 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
         <h1 class="min-w-0 text-[24px]! leading-7! font-semibold! tracking-tight!">Servers</h1>
         <div class="flex flex-wrap items-center gap-2">
-            @if (isDev())
-                @can('create', App\Models\Server::class)
-                    <a href="{{ route('server.transfer.import') }}" {{ wireNavigate() }}
-                        class="button w-fit shrink-0 whitespace-nowrap">
-                        <x-reicon name="upload" class="size-3.5" />
-                        Import server
-                        <x-status-badge label="Dev" />
-                    </a>
-                @endcan
-            @endif
             @can('createAnyResource')
                 <a href="{{ route('server.create') }}" {{ wireNavigate() }}
                     class="button w-fit shrink-0 whitespace-nowrap button-highlighted">
@@ -28,7 +18,7 @@
 
     @php
         $serverRows = $servers->map(function ($server) {
-            $isTransferredAway = isDev() && $server->isTransferredAway();
+            $isTransferredAway = $server->isTransferredAway();
             $isReady = $server->settings->is_reachable
                 && $server->settings->is_usable
                 && ! $server->settings->force_disabled
@@ -38,7 +28,6 @@
             $sentinelNeedsAttention = $isReady && $server->isSentinelEnabled() && $server->sentinelStatus() === 'out_of_sync';
 
             $status = match (true) {
-                $isTransferredAway && $server->isManagementDisabled() => 'Transferable',
                 $isTransferredAway => 'Transferred away',
                 $server->settings->force_disabled => 'Disabled',
                 $proxyNeedsAttention || $sentinelNeedsAttention => 'Attention required',
@@ -53,6 +42,20 @@
                 default => 'error',
             };
 
+            $patchStatus = auth()->user()?->can('viewSecurity', $server) ? $server->settings->patchStatus() : null;
+            $patchBadges = [];
+            if ($patchStatus !== null) {
+                $patchBadges[] = match (true) {
+                    $patchStatus['error'] !== null => ['label' => 'Patch check failed', 'type' => 'error'],
+                    $patchStatus['security'] > 0 => ['label' => $patchStatus['security'].' security '.str('update')->plural($patchStatus['security']), 'type' => 'error'],
+                    $patchStatus['updates'] > 0 => ['label' => $patchStatus['updates'].' '.str('update')->plural($patchStatus['updates']), 'type' => 'warning'],
+                    default => ['label' => 'Up to date', 'type' => 'success'],
+                };
+                if ($patchStatus['error'] === null && $patchStatus['reboot_required']) {
+                    $patchBadges[] = ['label' => 'Reboot required', 'type' => 'warning'];
+                }
+            }
+
             return [
                 'uuid' => $server->uuid,
                 'name' => $server->name,
@@ -61,25 +64,36 @@
                 'status' => $status,
                 'statusType' => $statusType,
                 'resourceCount' => $server->definedResources()->count(),
+                'patchStatus' => $patchStatus === null ? null : [
+                    'failed' => $patchStatus['error'] !== null,
+                    'updates' => $patchStatus['error'] === null ? $patchStatus['updates'] : 0,
+                    'security' => $patchStatus['error'] === null ? $patchStatus['security'] : 0,
+                    'rebootRequired' => $patchStatus['error'] === null && $patchStatus['reboot_required'],
+                ],
+                'patchBadges' => $patchBadges,
+                'patchCheckedAt' => $patchStatus === null ? null : 'Patches checked '.$patchStatus['checked_at']->diffForHumans(),
             ];
         })->values();
+
+        $patchStatuses = $serverRows->pluck('patchStatus')->filter();
+        $showPatches = $patchStatuses->isNotEmpty();
     @endphp
 
     <div x-data="{
         search: '',
-        viewMode: localStorage.getItem('coolify-servers-view') || 'table',
+        viewMode: @js($this->listView('servers', 'table')),
         servers: @js($serverRows),
         get filteredServers() {
             const query = this.search.trim().toLowerCase();
             if (!query) return this.servers;
             return this.servers.filter(server =>
-                [server.name, server.description, server.status]
+                [server.name, server.description, server.status, ...server.patchBadges.map(badge => badge.label)]
                     .some(value => String(value || '').toLowerCase().includes(query))
             );
         },
         setViewMode(mode) {
             this.viewMode = mode;
-            localStorage.setItem('coolify-servers-view', mode);
+            this.$wire.saveListView('servers', mode);
         }
     }">
         @if ($servers->isEmpty())
@@ -100,30 +114,9 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-3">
-                    <span class="text-[11px] text-neutral-500 dark:text-fg-faint">
-                        <span x-text="filteredServers.length"></span>
-                        <span x-text="filteredServers.length === 1 ? 'server' : 'servers'"></span>
-                    </span>
-                    <div
-                        class="view-toggle">
-                        <button type="button" x-on:click="setViewMode('table')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'table'
-                                ? 'control-selected'
-                                : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Table view">
-                            <x-reicon name="unordered-list" class="size-3.5" />
-                        </button>
-                        <button type="button" x-on:click="setViewMode('grid')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'grid'
-                                ? 'control-selected'
-                                : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Grid view">
-                            <x-reicon name="grid" class="size-3.5" />
-                        </button>
-                    </div>
+                <div class="flex flex-wrap items-center gap-3 sm:justify-end">
+                    <x-canvas-view-toggle :list-url="route('server.index')"
+                        :canvas-url="route('server.canvas.index')" />
                 </div>
             </div>
 
@@ -169,21 +162,41 @@
                                 </span>
                             @endif
                         </div>
+
+                        @php
+                            $cardPatchBadges = array_filter($serverRow['patchBadges'], fn ($badge) => $badge['type'] !== 'success');
+                        @endphp
+                        @if ($cardPatchBadges !== [])
+                            <div class="relative z-10 mt-auto flex flex-wrap gap-1.5 pt-3"
+                                data-tooltip="{{ $serverRow['patchCheckedAt'] }}">
+                                @foreach ($cardPatchBadges as $badge)
+                                    <x-status-badge :status="$badge['label']" :type="$badge['type']" />
+                                @endforeach
+                            </div>
+                        @endif
                     </a>
                 @endforeach
             </div>
 
             <div x-show="viewMode === 'table'"
                 class="overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]">
-                <div
-                    class="grid min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:min-w-[560px] md:grid-cols-[minmax(0,1fr)_6rem_9.5rem] dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
+                <div @class([
+                    'grid min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:min-w-[560px] md:grid-cols-[minmax(0,1fr)_6rem_9.5rem] dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint',
+                    'lg:min-w-[760px] lg:grid-cols-[minmax(0,1fr)_6rem_12rem_9.5rem]' => $showPatches,
+                ])>
                     <div>Server</div>
                     <div class="hidden md:block">Resources</div>
+                    @if ($showPatches)
+                        <div class="hidden lg:block">Patches</div>
+                    @endif
                     <div>Status</div>
                 </div>
                 <template x-for="server in filteredServers" :key="server.uuid">
                     <a :href="server.href" {{ wireNavigate() }}
-                        class="grid min-h-14 min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 hover:no-underline md:min-w-[560px] md:grid-cols-[minmax(0,1fr)_6rem_9.5rem] dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
+                        @class([
+                            'grid min-h-14 min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 hover:no-underline md:min-w-[560px] md:grid-cols-[minmax(0,1fr)_6rem_9.5rem] dark:border-white/[0.07] dark:hover:bg-white/[0.025]',
+                            'lg:min-w-[760px] lg:grid-cols-[minmax(0,1fr)_6rem_12rem_9.5rem]' => $showPatches,
+                        ])>
                         <div class="flex min-w-0 items-center gap-3">
                             <div
                                 class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.035] dark:text-fg-dim">
@@ -208,6 +221,21 @@
                                 <span x-text="server.resourceCount"></span>
                             </span>
                         </div>
+                        @if ($showPatches)
+                            <div class="hidden flex-wrap gap-1 lg:flex" :data-tooltip="server.patchCheckedAt">
+                                <template x-for="badge in server.patchBadges" :key="badge.label">
+                                    <x-status-badge :dynamic="true">
+                                        <span class="relative inline-flex size-1.5 shrink-0 rounded-full"
+                                            :class="{
+                                                'bg-emerald-500': badge.type === 'success',
+                                                'bg-warning': badge.type === 'warning',
+                                                'bg-red-500': badge.type === 'error',
+                                            }"></span>
+                                        <span class="truncate" x-text="badge.label"></span>
+                                    </x-status-badge>
+                                </template>
+                            </div>
+                        @endif
                         <div class="flex items-center gap-2 text-[11px] font-medium text-neutral-600 dark:text-fg-dim">
                             <span x-show="server.statusType !== 'success'"
                                 class="hidden size-2 shrink-0 rounded-full md:inline-block"
diff --git a/resources/views/livewire/server/log-drains.blade.php b/resources/views/livewire/server/log-drains.blade.php
index 425b4a2bdd..3f72f8609d 100644
--- a/resources/views/livewire/server/log-drains.blade.php
+++ b/resources/views/livewire/server/log-drains.blade.php
@@ -34,7 +34,7 @@
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
                                 ]"
-                                :disabled="$isLogDrainAxiomEnabled || $isLogDrainCustomEnabled || !auth()->user()->can('update', $server)" />
+                                :disabled="$isLogDrainAxiomEnabled || $isLogDrainCustomEnabled || $isLogDrainCloudwatchEnabled || !auth()->user()->can('update', $server)" />
                             <x-forms.input canGate="update" :canResource="$server" type="password" :required="$isLogDrainNewRelicEnabled"
                                 id="logDrainNewRelicLicenseKey" label="License key"
                                 :disabled="$server->isLogDrainEnabled()" />
@@ -53,7 +53,7 @@
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
                                 ]"
-                                :disabled="$isLogDrainNewRelicEnabled || $isLogDrainCustomEnabled || !auth()->user()->can('update', $server)" />
+                                :disabled="$isLogDrainNewRelicEnabled || $isLogDrainCustomEnabled || $isLogDrainCloudwatchEnabled || !auth()->user()->can('update', $server)" />
                             <x-forms.input canGate="update" :canResource="$server" type="password" :required="$isLogDrainAxiomEnabled"
                                 id="logDrainAxiomApiKey" label="API key"
                                 :disabled="$server->isLogDrainEnabled()" />
@@ -62,6 +62,29 @@
                                 :disabled="$server->isLogDrainEnabled()" />
                         </div>
                     </x-application.settings-section>
+                    <x-application.settings-section id="server-cloudwatch-drain-section" title="Amazon CloudWatch Logs"
+                        helper="Send container logs directly to CloudWatch Logs using the Docker awslogs logging driver.<br><br>AWS credentials are read by the Docker daemon on this server, not by Coolify. Attach an IAM instance role, or configure <code>AWS_ACCESS_KEY_ID</code> and <code>AWS_SECRET_ACCESS_KEY</code> for the Docker service or in <code>/root/.aws/credentials</code>.<br><br>The credentials need <code>logs:CreateLogStream</code> and <code>logs:PutLogEvents</code>, plus <code>logs:CreateLogGroup</code> if the log group does not exist yet.<br><br>Delivery errors do not stop containers; they appear in the Docker daemon logs (<code>journalctl -u docker</code>). Redeploy or restart resources to apply the logging driver.">
+                        <div class="mb-4 max-w-sm">
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainCloudwatchEnabled" label="Status"
+                                onChange="instantSave" :options="[
+                                    ['value' => false, 'label' => 'Disabled'],
+                                    ['value' => true, 'label' => 'Enabled'],
+                                ]"
+                                :disabled="$isLogDrainNewRelicEnabled || $isLogDrainAxiomEnabled || $isLogDrainCustomEnabled || !auth()->user()->can('update', $server)" />
+                        </div>
+                        <div class="grid gap-4 lg:grid-cols-3">
+                            <x-forms.input canGate="update" :canResource="$server" :required="$isLogDrainCloudwatchEnabled"
+                                id="logDrainCloudwatchGroup" label="Log group" placeholder="/coolify/production"
+                                :disabled="$server->isLogDrainEnabled()" />
+                            <x-forms.input canGate="update" :canResource="$server"
+                                id="logDrainCloudwatchStreamPrefix" label="Log stream prefix" placeholder="docker/"
+                                helper="Optional. Log streams are named after the container, prefixed with this value (e.g. docker/&lt;container name&gt;)."
+                                :disabled="$server->isLogDrainEnabled()" />
+                            <x-forms.input canGate="update" :canResource="$server" :required="$isLogDrainCloudwatchEnabled"
+                                id="logDrainCloudwatchRegion" label="Region" placeholder="us-east-1"
+                                :disabled="$server->isLogDrainEnabled()" />
+                        </div>
+                    </x-application.settings-section>
                     <x-application.settings-section id="server-custom-drain-section" title="Custom Fluent Bit"
                         helper="Provide a custom Fluent Bit output and optional parser configuration.">
                         <div class="mb-4 max-w-sm">
@@ -70,7 +93,7 @@
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
                                 ]"
-                                :disabled="$isLogDrainNewRelicEnabled || $isLogDrainAxiomEnabled || !auth()->user()->can('update', $server)" />
+                                :disabled="$isLogDrainNewRelicEnabled || $isLogDrainAxiomEnabled || $isLogDrainCloudwatchEnabled || !auth()->user()->can('update', $server)" />
                         </div>
                         <div class="grid gap-4 lg:grid-cols-2">
                             <x-forms.textarea canGate="update" :canResource="$server" rows="8" :required="$isLogDrainCustomEnabled"
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index be2414fbe8..8172da75ea 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -141,7 +141,7 @@
                             <span class="size-1.5 shrink-0 rounded-full"
                                 :class="option.functional ? 'bg-success' : 'bg-error'"></span>
                             <span class="min-w-0 flex-1 truncate" x-text="option.name"></span>
-                            <x-reicon name="check-circle"
+                            <x-reicon name="check"
                                 class="size-3.5 shrink-0 text-black dark:text-fg"
                                 x-show="option.uuid === '{{ $server->uuid }}'" />
                         </a>
@@ -254,70 +254,55 @@
             </div>
         </div>
 
+        @php
+            $canManageProxy = auth()->user()?->can('manageProxy', $server) ?? false;
+        @endphp
+        @if ($server->proxySet() && ($canManageProxy || $traefikDashboardAvailable))
+        {{-- Teleport only with content: a filled slot renders as a floating panel. --}}
         @teleport('#resource-action-hud-slot')
         <div class="hidden xl:flex xl:w-auto xl:items-center">
             <div
                 class="resource-heading-navbar application-heading-actions flex w-auto min-w-0 items-center justify-end gap-1 overflow-visible">
-                <x-resource-heading-tabs class="hidden" aria-hidden="true">
-                    @foreach ($serverMenuItems as $menuItem)
-                        <a wire:key="server-primary-nav-{{ str($menuItem['label'])->slug() }}"
-                            @class([
-                                'app-tab shrink-0 gap-1',
-                                'app-tab-active' => $menuItem['active'],
-                            ])
-                            @if ($menuItem['active']) aria-current="page" @endif
-                            @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
-                            href="{{ route($menuItem['route'], $serverRouteParameters) }}">
-                            {{ $menuItem['label'] }}
-                            @if ($menuItem['warning'] ?? false)
-                                <x-reicon name="alert-triangle"
-                                    class="size-3.5 text-orange-500 dark:text-warning" />
-                            @endif
+                @if ($traefikDashboardAvailable)
+                    <div class="resource-heading-menus shrink-0">
+                        <a class="app-tab shrink-0 gap-1" target="_blank" title="Open Traefik dashboard"
+                            href="http://{{ formatHostForUrl((string) $serverIp) }}:8080">
+                            <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
+                            Traefik Dashboard
                         </a>
-                    @endforeach
-                </x-resource-heading-tabs>
-
-                @if ($server->proxySet())
-                    @can('manageProxy', $server)
-                        @if ($traefikDashboardAvailable)
-                            <div class="resource-heading-menus shrink-0">
-                                <a class="app-tab shrink-0 gap-1" target="_blank" title="Open Traefik dashboard"
-                                    href="http://{{ formatHostForUrl((string) $serverIp) }}:8080">
-                                    <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
-                                    Traefik Dashboard
-                                </a>
-                            </div>
-                        @endif
-                        <x-split-action id="server-desktop-actions" class="resource-heading-actions shrink-0">
-                            @if ($proxyCanBeStopped)
-                                <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy"
-                                    @click="document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
-                                    <x-reicon name="restart" class="size-3.5" />
-                                    Restart Proxy
-                                </x-slot:main>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                    Stop Proxy
-                                </button>
-                            @else
-                                <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy" @click="$wire.dispatch('checkProxyEvent')">
-                                    <x-reicon name="play-circle" class="size-3.5" />
-                                    Start Proxy
-                                </x-slot:main>
-                            @endif
-                            <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="checkProxyStatus"
-                                wire:loading.attr="disabled" @click="open = false" role="menuitem">
-                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                Refresh Proxy Status
+                    </div>
+                @endif
+                @if ($canManageProxy)
+                    <x-split-action id="server-desktop-actions" class="resource-heading-actions shrink-0">
+                        @if ($proxyCanBeStopped)
+                            <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy"
+                                @click="document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                                <x-reicon name="restart" class="size-3.5" />
+                                Restart Proxy
+                            </x-slot:main>
+                            <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
+                                role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                Stop Proxy
                             </button>
-                        </x-split-action>
-                    @endcan
+                        @else
+                            <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy" @click="$wire.dispatch('checkProxyEvent')">
+                                <x-reicon name="play-circle" class="size-3.5" />
+                                Start Proxy
+                            </x-slot:main>
+                        @endif
+                        <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="checkProxyStatus"
+                            wire:loading.attr="disabled" @click="open = false" role="menuitem">
+                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                            Refresh Proxy Status
+                        </button>
+                    </x-split-action>
                 @endif
             </div>
         </div>
         @endteleport
+        @endif
     </div>
 
     @script
diff --git a/resources/views/livewire/server/new/by-hostinger.blade.php b/resources/views/livewire/server/new/by-hostinger.blade.php
new file mode 100644
index 0000000000..d33e2e4cb4
--- /dev/null
+++ b/resources/views/livewire/server/new/by-hostinger.blade.php
@@ -0,0 +1,144 @@
+<div class="w-full">
+    @if ($limit_reached)
+        <x-limit-reached name="servers" />
+    @elseif ($current_step === 1)
+        <div class="flex flex-col gap-6">
+            <x-server.provider-token-picker provider="hostinger" providerLabel="Hostinger"
+                :tokens="$available_tokens" />
+            <p class="text-[11px] text-neutral-500 dark:text-fg-faint">
+                New to Hostinger?
+                <a href="https://www.hostinger.com/vps/coolify-hosting?ref=coolify.io" target="_blank"
+                    rel="noopener noreferrer"
+                    class="font-medium text-coollabs hover:underline dark:text-warning">Create an account</a>
+                through Coolify's affiliate link.
+            </p>
+        </div>
+    @elseif ($current_step === 2)
+        <div wire:init="loadHostingerData">
+            @if ($loading_data)
+                <x-application.settings-section title="Loading Hostinger"
+                    description="Fetching data centers, plans, billing periods, and operating systems.">
+                    <div class="flex min-h-40 items-center justify-center">
+                        <x-loading text="Loading Hostinger data..." />
+                    </div>
+                </x-application.settings-section>
+            @elseif ($provider_data_error)
+                <x-application.settings-section title="Unable to load Hostinger"
+                    description="The selected token could not access the provider API.">
+                    <x-callout type="error" title="Provider request failed">
+                        <pre class="mt-2 whitespace-pre-wrap break-words text-[11px]">{{ $provider_data_error }}</pre>
+                    </x-callout>
+                    <div class="mt-4">
+                        <a class="button" href="{{ route('server.create.type', ['type' => 'hostinger']) }}"
+                            {{ wireNavigate() }}>Select another token</a>
+                    </div>
+                </x-application.settings-section>
+            @else
+                @php
+                    $dataCenterOptions = collect($data_centers)->map(fn ($dataCenter) => [
+                        'value' => $dataCenter['id'],
+                        'label' => ($dataCenter['city'] ?? $dataCenter['name'] ?? $dataCenter['id'])
+                            . (!empty($dataCenter['location']) ? ' · ' . strtoupper($dataCenter['location']) : ''),
+                    ])->values()->all();
+                    $priceOptions = collect($this->priceOptions)->map(fn ($price) => [
+                        'value' => $price['id'],
+                        'label' => $this->priceLabel($price),
+                    ])->values()->all();
+                    $templateOption = fn ($template) => [
+                        'value' => $template['id'],
+                        'label' => $template['name'] ?? $template['description'] ?? $template['id'],
+                    ];
+                    $osTemplateOptions = collect($this->osTemplates)->map($templateOption)->values()->all();
+                    $appTemplateOptions = collect($this->appTemplates)->map($templateOption)->values()->all();
+                    $privateKeyOptions = $private_keys->map(fn ($key) => [
+                        'value' => $key->id,
+                        'label' => $key->name,
+                    ])->values()->all();
+                    $postInstallScriptOptions = collect($post_install_scripts)->map(fn ($script) => [
+                        'value' => $script['id'],
+                        'label' => $script['name'],
+                    ])->values()->all();
+                @endphp
+
+                <form wire:submit="submit" class="flex flex-col gap-6">
+                    <x-application.settings-section title="Hostinger server"
+                        description="Choose the data center, plan, operating system, and Coolify SSH key.">
+                        <x-slot:actions>
+                            <button type="submit" class="button button-highlighted"
+                                wire:loading.attr="disabled" wire:target="submit"
+                                @disabled(!$private_key_id)>
+                                Buy and create
+                                <x-loading-on-button wire:loading wire:target="submit" />
+                            </button>
+                        </x-slot:actions>
+
+                        <div class="grid gap-4 lg:grid-cols-2">
+                            <div class="lg:col-span-2">
+                                <x-forms.input id="server_name" label="Server name"
+                                    helper="A friendly name shown in Coolify and used as the VPS hostname." />
+                            </div>
+                            <x-forms.listbox id="selected_data_center_id" label="Data center" required live
+                                placeholder="Select a data center" :options="$dataCenterOptions" />
+                            <x-forms.listbox id="selected_price_id" label="Plan and billing period" required live
+                                :disabled="!$selected_data_center_id" placeholder="Select a plan"
+                                :options="$priceOptions" />
+                            <x-forms.listbox id="selected_os_template_id" label="Operating system" required live
+                                :disabled="!$selected_price_id" placeholder="Select an operating system"
+                                :options="$osTemplateOptions" />
+                            <x-forms.listbox id="selected_app_template_id" label="Operating system with application"
+                                live :disabled="!$selected_price_id" placeholder="Or select an operating system with an application"
+                                :options="$appTemplateOptions"
+                                helper="Replaces the operating system selected above. Applications and panels, such as another Coolify or CyberPanel, can conflict with the Coolify proxy on ports 80 and 443." />
+                            @if ($private_keys->isEmpty())
+                                <div>
+                                    <label class="mb-1.5 flex w-fit items-center gap-1.5">Private key
+                                        <x-highlighted text="*" />
+                                    </label>
+                                    <div
+                                        class="flex min-h-8 items-center justify-between gap-3 rounded-lg border border-warning/30 bg-warning/5 px-3 py-2">
+                                        <span class="text-[11px] text-neutral-600 dark:text-fg-dim">A private key is required.</span>
+                                        <x-modal-input title="New Private Key">
+                                            <x-slot:content>
+                                                <button type="button" class="button">Create key</button>
+                                            </x-slot:content>
+                                            <livewire:security.private-key.create :modal_mode="true" from="server" />
+                                        </x-modal-input>
+                                    </div>
+                                </div>
+                            @else
+                                <x-forms.listbox id="private_key_id" label="Private key" required
+                                    placeholder="Select a private key" :options="$privateKeyOptions"
+                                    helper="This key is added to the Hostinger VPS automatically." />
+                            @endif
+                        </div>
+                    </x-application.settings-section>
+
+                    <x-application.settings-section title="Advanced options"
+                        description="Provider backups, account SSH keys, and post-install automation.">
+                        <div class="flex flex-col gap-4">
+                            <div class="-mx-2.5 grid gap-3 lg:grid-cols-2">
+                                <x-forms.checkbox id="enable_backups" label="Enable weekly Hostinger backups (extra cost)" fullWidth
+                                    helper="Hostinger charges extra for backups. Check the price in hPanel before you enable them." />
+                            </div>
+                            <x-forms.listbox label="Extra SSH keys" id="selected_public_key_ids"
+                                helper="Existing keys from the Hostinger account." multiple searchable
+                                :disabled="count($hostinger_public_keys) === 0" searchPlaceholder="Search SSH keys…"
+                                :placeholder="count($hostinger_public_keys) ? 'Select SSH keys' : 'No account keys found'"
+                                :options="collect($hostinger_public_keys)->map(fn ($publicKey) => ['value' => $publicKey['id'], 'label' => $publicKey['name']])->values()->all()" />
+                            @if ($post_install_scripts)
+                                <x-forms.listbox id="selected_post_install_script_id"
+                                    label="Hostinger post-install script"
+                                    placeholder="No post-install script" :options="$postInstallScriptOptions"
+                                    helper="Hostinger runs this as /post_install after setup and writes output to /post_install.log." />
+                            @endif
+                            <x-callout type="warning" title="This purchase is billed by Hostinger">
+                                The VPS is purchased with your Hostinger account's default payment method. Review the
+                                selected plan and billing period before continuing.
+                            </x-callout>
+                        </div>
+                    </x-application.settings-section>
+                </form>
+            @endif
+        </div>
+    @endif
+</div>
diff --git a/resources/views/livewire/server/partials/localhost-general.blade.php b/resources/views/livewire/server/partials/localhost-general.blade.php
index a88698b066..cdbd3ab93b 100644
--- a/resources/views/livewire/server/partials/localhost-general.blade.php
+++ b/resources/views/livewire/server/partials/localhost-general.blade.php
@@ -3,14 +3,17 @@
                     <x-application.settings-section id="server-overview-section" title="Server overview"
                         helper="Operating system and hardware details for the server running this Coolify instance.">
                         <x-slot:actions>
-                            @if ($server->server_metadata)
-                                <x-forms.button type="button" class="size-8! px-0!"
-                                    wire:click="refreshServerMetadata" title="Refresh server details">
-                                    <x-reicon name="refresh" class="size-3.5" />
-                                </x-forms.button>
-                            @endif
-                            <x-status-badge :status="$server->isFunctional() ? 'Ready' : 'Validation required'"
-                                :type="$server->isFunctional() ? 'success' : 'warning'" />
+                            <x-forms.button type="button" wire:click="refreshServerMetadata"
+                                :disabled="! $server->isFunctional()"
+                                :tooltip="$server->isFunctional() ? null : 'Validate the connection first.'">
+                                <x-reicon name="refresh" class="size-3.5" />
+                                {{ $server->server_metadata ? 'Refresh details' : 'Fetch server details' }}
+                            </x-forms.button>
+                            <x-forms.button type="button" wire:click.prevent="checkLocalhostConnection"
+                                :isHighlighted="! $server->isFunctional()" canGate="update" :canResource="$server">
+                                <x-reicon :name="$server->isFunctional() ? 'refresh' : 'alert-circle'" class="size-3.5" />
+                                {{ $server->isFunctional() ? 'Revalidate connection' : 'Validate connection' }}
+                            </x-forms.button>
                         </x-slot:actions>
 
                         @if ($this->limaStartCommand)
@@ -39,13 +42,6 @@
 
                         @if ($server->server_metadata)
                             @include('livewire.server.partials.server-details', ['server' => $server])
-                        @else
-                            <div class="mt-4 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
-                                <x-forms.button type="button" wire:click="refreshServerMetadata">
-                                    <x-reicon name="refresh" class="size-3.5" />
-                                    Fetch server details
-                                </x-forms.button>
-                            </div>
                         @endif
                     </x-application.settings-section>
 
@@ -61,14 +57,6 @@
 
                     <x-application.settings-section id="server-connection-section" title="Connection"
                         helper="Configure how Coolify identifies and connects to this server.">
-                        <x-slot:actions>
-                            <x-forms.button type="button" wire:click.prevent="checkLocalhostConnection"
-                                canGate="update" :canResource="$server">
-                                <x-reicon name="refresh" class="size-3.5" />
-                                Validate connection
-                            </x-forms.button>
-                        </x-slot:actions>
-
                         <div class="grid gap-4 sm:grid-cols-2">
                             <x-forms.input canGate="update" :canResource="$server" id="name" label="Name"
                                 required :disabled="$isValidating" />
diff --git a/resources/views/livewire/server/partials/server-details.blade.php b/resources/views/livewire/server/partials/server-details.blade.php
index be8d0236a0..0e2afa2543 100644
--- a/resources/views/livewire/server/partials/server-details.blade.php
+++ b/resources/views/livewire/server/partials/server-details.blade.php
@@ -21,3 +21,9 @@
         </div>
     @endforeach
 </dl>
+@if ($server->detectedGpus() !== [])
+    <div class="mt-5">
+        <p class="text-xs font-medium text-neutral-500 dark:text-fg-dim">GPUs</p>
+        <x-server.gpu-list :server="$server" class="mt-2" />
+    </div>
+@endif
diff --git a/resources/views/livewire/server/proxy.blade.php b/resources/views/livewire/server/proxy.blade.php
index d83ab48f9b..40daa6c48b 100644
--- a/resources/views/livewire/server/proxy.blade.php
+++ b/resources/views/livewire/server/proxy.blade.php
@@ -69,7 +69,7 @@
                                 ['value' => true, 'label' => 'Labels for the active proxy only'],
                             ]" />
                         <x-forms.listbox id="redirectEnabled" label="Unknown requests"
-                            helper="Override the default 503 response for unknown hosts and stopped services."
+                            helper="Control the 503 response for unknown hosts and stopped services. Custom request handling shows an error page or redirects to a URL."
                             onChange="instantSaveRedirect" :options="[
                                 ['value' => false, 'label' => 'Return the default 503 response'],
                                 ['value' => true, 'label' => 'Use custom request handling'],
@@ -78,7 +78,7 @@
                             <x-forms.input canGate="update" :canResource="$server"
                                 placeholder="https://app.coolify.io" id="redirectUrl"
                                 label="Redirect URL"
-                                helper="Leave empty to keep a custom 503 response without redirecting." />
+                                helper="Leave empty to return a 503 response instead of redirecting." />
                         @endif
                         @if ($server->proxyType() === ProxyTypes::TRAEFIK->value)
                             <x-forms.input canGate="update" :canResource="$server" placeholder="letsencrypt"
@@ -86,6 +86,20 @@
                                 helper="Traefik certificate resolver for generated HTTPS routes. Leave empty if Traefik uses your own certificates (for example Cloudflare Origin CA certificates in a dynamic configuration). Redeploy resources to apply the change." />
                         @endif
                     </div>
+                    @if ($redirectEnabled && ! $server->isSwarm())
+                        <div class="mt-4 flex flex-col gap-2">
+                            <x-forms.textarea canGate="update" :canResource="$server" id="customErrorPage" rows="10"
+                                monospace label="Custom error page (HTML)"
+                                placeholder="Leave empty to use the Coolify default error page."
+                                helper="One self-contained HTML file (max {{ \App\Models\Server::PROXY_ERROR_PAGE_MAX_BYTES / 1024 }} KB) with inline CSS and images. Visitors see it with a 503 status for unknown domains and for stopped, deploying or unhealthy resources. A Redirect URL takes priority over this page." />
+                            @can('update', $server)
+                                <div class="flex gap-2">
+                                    <x-forms.button type="button" wire:click="resetCustomErrorPage">Reset to
+                                        default</x-forms.button>
+                                </div>
+                            @endcan
+                        </div>
+                    @endif
                 </x-application.settings-section>
 
                 @php
diff --git a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
index 2bd50eb4e0..dca864b241 100644
--- a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
+++ b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
@@ -11,15 +11,7 @@
 
         <div class="application-settings-form flex w-full flex-col gap-6">
             @if ($server->isFunctional())
-                <div class="flex flex-wrap items-start justify-between gap-3 px-1">
-                    <div>
-                        <h2 class="text-sm! font-medium text-neutral-950 dark:text-fg">
-                            Dynamic configurations
-                        </h2>
-                        <p class="mt-1 text-xs text-neutral-500 dark:text-fg-dim">
-                            Manage additional proxy routes, middleware, and services loaded at runtime.
-                        </p>
-                    </div>
+                <div class="flex flex-wrap items-center justify-end gap-3 px-1">
                     <div class="flex items-center gap-2">
                         <x-forms.button wire:click="loadDynamicConfigurations">
                             <x-reicon name="refresh" class="size-3.5" />
diff --git a/resources/views/livewire/server/resources.blade.php b/resources/views/livewire/server/resources.blade.php
index 78ed0eb01a..59c57f3d2b 100644
--- a/resources/views/livewire/server/resources.blade.php
+++ b/resources/views/livewire/server/resources.blade.php
@@ -28,6 +28,9 @@
                     <x-reicon name="refresh" class="size-3.5" />
                     Refresh
                 </x-forms.button>
+                <x-canvas-view-toggle :views="['list' => ['List view', 'unordered-list']]"
+                    :list-url="route('server.resources', ['server_uuid' => $server->uuid])"
+                    :canvas-url="route('server.canvas', ['server_uuid' => $server->uuid])" />
             </x-slot:actions>
 
             <div class="border-b border-neutral-200 p-3 dark:border-white/[0.08]">
@@ -63,8 +66,12 @@
                             @php($resourceStatus = (string) data_get($resource, 'status', 'unknown'))
                             <div wire:key="managed-{{ $resource->type() }}-{{ $resource->uuid }}"
                                 class="data-table-row server-resources-managed-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
-                                <div class="min-w-0">
-                                    <a class="block max-w-full truncate text-[12px] font-medium text-neutral-950 hover:underline dark:text-fg"
+                                <div class="flex min-w-0 items-center gap-2">
+                                    <span
+                                        class="flex size-5 shrink-0 items-center justify-center overflow-hidden rounded text-neutral-500 dark:text-fg-dim">
+                                        <x-resource-logo :resource="$resource" icon-class="size-3.5" />
+                                    </span>
+                                    <a class="block min-w-0 truncate text-[12px] font-medium text-neutral-950 hover:underline dark:text-fg"
                                         {{ wireNavigate() }} href="{{ $resource->link() }}">
                                         {{ $resource->name }}
                                     </a>
diff --git a/resources/views/livewire/server/security/patches.blade.php b/resources/views/livewire/server/security/patches.blade.php
index f1e4fc3f7a..d392f89de2 100644
--- a/resources/views/livewire/server/security/patches.blade.php
+++ b/resources/views/livewire/server/security/patches.blade.php
@@ -14,134 +14,263 @@
         </x-slot:content>
     </x-process-dialog>
 
+    @php
+        $updates = collect(data_get($result, 'updates', []))
+            ->sortBy(fn ($update) => [data_get($update, 'security') ? 0 : 1, filled(data_get($update, 'risk')) ? 0 : 1, data_get($update, 'package')])
+            ->values()
+            ->all();
+        $totalUpdates = count($updates);
+        $packageManager = data_get($result, 'package_manager');
+        $checkedAt = $server->settings->patch_checked_at;
+        $fullUpgradeOnly = in_array($packageManager, \App\Actions\Server\CheckUpdates::FULL_UPGRADE_ONLY, true);
+        $securityUpdates = data_get($result, 'security_updates');
+        $rebootRequired = data_get($result, 'reboot_required') === true;
+        $riskyUpdates = collect($updates)->filter(fn ($update) => filled(data_get($update, 'risk')))->count();
+    @endphp
+
     <div
         class="server-settings-workspace application-settings-workspace mt-4 grid w-full max-w-none min-w-0 gap-8 lg:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <x-server.sidebar :server="$server" activeMenu="security" />
+        <x-server.sidebar :server="$server" activeMenu="security" activeSubMenu="patches" />
 
         <div class="application-settings-form flex w-full flex-col gap-6">
-            <x-application.settings-section id="server-patching-overview-section" title="Server patching"
-                helper="Discover and apply operating system package updates.">
-                <x-slot:actions>
-                    <x-status-badge status="Experimental" type="warning" />
-                    @if (isDev())
-                        <x-forms.button type="button" wire:click="sendTestEmail">
-                            Send test email
-                        </x-forms.button>
-                    @endif
-                    <x-forms.button type="button" wire:click="$dispatch('checkForUpdates')">
-                        <x-reicon name="refresh" class="size-3.5" />
-                        Check for updates
-                    </x-forms.button>
-                </x-slot:actions>
+            <form wire:submit="submit">
+                <x-unsaved-bar action="submit" />
 
-                <x-callout type="info" title="Supported package managers">
-                    Automated package discovery currently supports apk, apt, dnf, pacman, and zypper. Weekly status
-                    notifications can be managed from
-                    <a class="font-medium underline" href="{{ route('notifications.email') }}"
-                        {{ wireNavigate() }}>notification settings</a>.
-                </x-callout>
-            </x-application.settings-section>
+                <x-application.settings-section id="server-patching-overview-section" title="Server patching"
+                    helper="Discover and apply operating system package updates.">
+                    <x-slot:actions>
+                        <x-beta-badge />
+                        @if (isDev())
+                            <x-forms.button type="button" wire:click="sendTestEmail">
+                                Send test email
+                            </x-forms.button>
+                        @endif
+                        @can('update', $server)
+                            @if ($rebootRequired)
+                                <x-modal-confirmation title="Reboot server?" buttonTitle="Reboot server" isErrorButton
+                                    submitAction="rebootServer" :actions="[
+                                        'The server reboots in a few seconds.',
+                                        'All containers on this server stop, and the containers with a restart policy start again after the reboot.',
+                                        'The server is not reachable for a few minutes.',
+                                    ]"
+                                    confirmationText="{{ $server->name }}"
+                                    confirmationLabel="Enter the server name to confirm"
+                                    shortConfirmationLabel="Server name" :confirmWithPassword="false"
+                                    step2ButtonText="Reboot server" />
+                            @endif
+                            <x-forms.button type="button" wire:click="checkForUpdates" :disabled="$checking">
+                                <x-reicon name="refresh" class="size-3.5" />
+                                Check for updates
+                            </x-forms.button>
+                        @endcan
+                    </x-slot:actions>
 
-            <div wire:loading wire:target="checkForUpdates">
-                <x-application.settings-section title="Checking for updates"
-                    helper="Package discovery can take several minutes.">
-                    <div class="flex items-center gap-3 py-4 text-sm text-neutral-600 dark:text-fg-dim">
-                        <x-loading />
-                        Inspecting installed packages…
+                    <div class="flex flex-col gap-4">
+
+                        <div class="flex flex-wrap items-center gap-2 text-sm text-neutral-600 dark:text-fg-dim">
+                            <span>
+                                Last checked:
+                                @if ($checkedAt)
+                                    <span title="{{ $checkedAt->toDateTimeString() }}">{{ $checkedAt->diffForHumans() }}</span>
+                                @else
+                                    never
+                                @endif
+                            </span>
+                            @if ($checkedAt && ! $error)
+                                @if ($totalUpdates === 0)
+                                    <x-status-badge status="Up to date" type="success" />
+                                @endif
+                                @if ($securityUpdates > 0)
+                                    <x-status-badge :status="$securityUpdates . ' ' . Str::plural('security update', $securityUpdates)" type="error" />
+                                @endif
+                                @if ($rebootRequired)
+                                    <x-status-badge status="Reboot required" type="warning" />
+                                @endif
+                            @endif
+                        </div>
+
+                        @php
+                            $autoUpdatesSupported = \App\Actions\Server\ConfigureAutomaticSecurityUpdates::supportFor($packageManager);
+                        @endphp
+                        <div @class(['grid gap-4', 'lg:grid-cols-3' => $autoUpdatesSupported])>
+                            <x-forms.input canGate="update" :canResource="$server" id="patchCheckFrequency"
+                                label="Check frequency" placeholder="weekly (default, on Sunday)"
+                                helper="Cron expression or preset such as daily, weekly, or monthly. Leave empty for the default: weekly, at a fixed time on Sunday. Coolify notifies your team when updates are available and when a check starts to fail." />
+                            @if ($autoUpdatesSupported)
+                                <div class="w-full">
+                                <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
+                                    <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Automatic security updates</label>
+                                    <x-helper helper="{{ $packageManager === 'apt' ? 'Uses unattended-upgrades for the security origins only.' : 'Uses dnf-automatic with upgrade_type = security.' }} Turning it off removes the Coolify configuration and keeps the operating system default." />
+                                </div>
+                                <div class="input flex items-center justify-between gap-2 pr-1!">
+                                    <span class="flex min-w-0 items-center gap-2 truncate text-neutral-700 dark:text-fg-dim">
+                                        <span @class(['size-1.5 shrink-0 rounded-full', 'bg-emerald-500' => $autoSecurityUpdates, 'bg-neutral-400 dark:bg-neutral-500' => ! $autoSecurityUpdates])></span>
+                                        {{ $autoSecurityUpdates ? 'On, every day' : 'Off' }}
+                                    </span>
+                                    @can('update', $server)
+                                        <div class="flex shrink-0" wire:key="auto-security-updates-{{ $autoSecurityUpdates ? 'on' : 'off' }}">
+                                            @if ($autoSecurityUpdates)
+                                                <x-modal-confirmation title="Turn off automatic security updates?"
+                                                    submitAction="toggleAutomaticSecurityUpdates"
+                                                    warningMessage="Security fixes are then not installed automatically by Coolify."
+                                                    temporaryDisableTwoStepConfirmation :confirmWithText="false"
+                                                    :confirmWithPassword="false" :actions="[
+                                                        'Coolify removes its configuration from the server.',
+                                                        'The server uses the default of the operating system again. Check it if you want no automatic updates at all.',
+                                                    ]"
+                                                    step2ButtonText="Turn off">
+                                                    <x-slot:trigger>
+                                                        <button type="button"
+                                                            class="h-6 shrink-0 rounded-md border border-neutral-200 bg-white px-2 text-[12px] font-medium text-neutral-800 hover:bg-neutral-50 dark:border-white/[0.1] dark:bg-white/[0.06] dark:text-fg dark:hover:bg-white/[0.1]">
+                                                            Turn off
+                                                        </button>
+                                                    </x-slot:trigger>
+                                                </x-modal-confirmation>
+                                            @else
+                                                <x-modal-confirmation title="Turn on automatic security updates?"
+                                                    warningMessage="Updates run without you. Your resources can stop for a short time during an update. You can turn this off at any time."
+                                                    submitAction="toggleAutomaticSecurityUpdates"
+                                                    temporaryDisableTwoStepConfirmation :confirmWithText="false"
+                                                    :confirmWithPassword="false" :actions="[
+                                                        'Every day at the time in Maintenance window (time zone of the server), the server installs security updates without asking.',
+                                                        'If Docker comes from the operating system packages (for example docker.io or moby-engine), a security update of Docker restarts it, and all containers on this server stop and start again. Docker from the Docker repository (docker-ce, as Coolify installs it) has no security updates there and is not updated.',
+                                                        'Services that use an updated library (for example OpenSSL or glibc) can restart.',
+                                                        'A new kernel is installed, but the server is not rebooted. Coolify then shows Reboot required.',
+                                                    ]"
+                                                    step2ButtonText="Turn on">
+                                                    <x-slot:trigger>
+                                                        <button type="button" isHighlighted
+                                                            class="h-6 shrink-0 rounded-md border px-2 text-[12px] font-medium">
+                                                            Turn on
+                                                        </button>
+                                                    </x-slot:trigger>
+                                                </x-modal-confirmation>
+                                            @endif
+                                        </div>
+                                    @endcan
+                                </div>
+                            </div>
+                            <x-forms.input canGate="update" :canResource="$server" id="autoSecurityUpdatesTime"
+                                    label="Maintenance window" placeholder="03:00"
+                                    helper="Daily start time (24-hour HH:MM) in the time zone of the server. Updates that need a reboot are installed, but the server is not rebooted." />
+                            @endif
+                        </div>
+
+                        <x-callout type="info" title="Supported package managers">
+                            Automated package discovery currently supports apk, apt, dnf, pacman, and zypper. Automatic
+                            security updates are available for apt and dnf (Debian, Ubuntu, and RHEL family)@if ($packageManager && ! $autoUpdatesSupported); this server uses {{ $packageManager }}@endif.
+                            Status notifications can be managed from
+                            <a class="font-medium underline" href="{{ route('notifications.email') }}"
+                                {{ wireNavigate() }}>notification settings</a>.
+                        </x-callout>
                     </div>
                 </x-application.settings-section>
-            </div>
+            </form>
 
-            <div wire:loading.remove wire:target="checkForUpdates">
-                @if ($error)
-                    <x-application.settings-section title="Package updates"
-                        helper="Available operating system updates for this server.">
-                        <x-callout type="danger" title="Could not check for updates">
-                            {{ $error }}
-                        </x-callout>
+            @if ($checking)
+                <div wire:poll.10s="loadResult">
+                    <x-application.settings-section title="Checking for updates"
+                        helper="Package discovery runs in the background and can take several minutes.">
+                        <div class="flex items-center gap-3 py-4 text-sm text-neutral-600 dark:text-fg-dim">
+                            <x-loading />
+                            Inspecting installed packages…
+                        </div>
                     </x-application.settings-section>
-                @elseif ($totalUpdates === 0)
-                    <x-application.settings-section title="Package updates"
-                        helper="Available operating system updates for this server.">
-                        <x-empty size="sm" title="Server is up to date"
-                            description="No package updates are currently available."
-                            icon-name="check-circle" />
-                    </x-application.settings-section>
-                @elseif (isset($updates) && count($updates) > 0)
-                    <x-application.settings-section id="server-package-updates-section" title="Package updates"
-                        helper="{{ $totalUpdates }} update{{ $totalUpdates === 1 ? '' : 's' }} available."
-                        flush>
+                </div>
+            @elseif ($error)
+                <x-application.settings-section title="Package updates"
+                    helper="Available operating system updates for this server.">
+                    <x-callout type="danger" title="Could not check for updates">
+                        {{ $error }}
+                    </x-callout>
+                </x-application.settings-section>
+            @elseif ($checkedAt && $totalUpdates === 0)
+                <x-application.settings-section title="Package updates"
+                    helper="Available operating system updates for this server.">
+                    <x-empty size="sm" title="Server is up to date"
+                        description="No package updates are currently available." icon-name="check-circle" />
+                </x-application.settings-section>
+            @elseif ($totalUpdates > 0)
+                <x-application.settings-section id="server-package-updates-section" title="Package updates"
+                    helper="{{ $totalUpdates }} {{ Str::plural('update', $totalUpdates) }} available{{ $securityUpdates !== null ? ', ' . $securityUpdates . ' of them security ' . Str::plural('update', $securityUpdates) : '' }}."
+                    flush>
+                    @can('update', $server)
                         <x-slot:actions>
-                            <x-modal-confirmation title="Confirm package update?"
-                                buttonTitle="Update all packages" isHighlightedButton
-                                submitAction="updateAllPackages" dispatchAction :actions="[
+                            <x-modal-confirmation title="Confirm package update?" buttonTitle="Update all packages"
+                                isHighlightedButton submitAction="updateAllPackages" :actions="[
                                     'All packages will be updated to their latest available versions.',
-                                    'Docker or kernel updates may restart running containers.',
-                                ]" confirmationText="Update All Packages"
+                                    $riskyUpdates > 0
+                                        ? $riskyUpdates . ' ' . Str::plural('update', $riskyUpdates) . ' can restart Docker, the running containers, or core system services, or need a reboot.'
+                                        : 'Some services on the server can restart.',
+                                ]"
+                                confirmationText="Update All Packages"
                                 confirmationLabel="Confirm by entering the text below"
                                 shortConfirmationLabel="Confirmation" :confirmWithPassword="false"
                                 step2ButtonText="Update All Packages" />
                         </x-slot:actions>
+                    @endcan
 
-                        <div class="data-table">
-                            <div class="data-table-header package-updates-table-grid">
-                                <span>Package</span>
-                                <span>New version</span>
-                                <span class="text-right">Action</span>
-                            </div>
-                            @foreach ($updates as $update)
-                                <div
-                                    class="data-table-row package-updates-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
-                                    <div class="flex min-w-0 items-center gap-2">
-                                        @if (data_get_str($update, 'package')->contains('docker') || data_get_str($update, 'package')->contains('kernel'))
-                                            <x-reicon name="alert-triangle"
-                                                class="size-4 shrink-0 text-red-500" />
-                                        @endif
-                                        <span class="min-w-0 truncate font-mono text-[12px] text-neutral-950 dark:text-fg">
-                                            {{ data_get($update, 'package') }}
-                                        </span>
-                                    </div>
-                                    <div class="min-w-0">
-                                        <p class="truncate font-mono text-[12px] text-neutral-700 dark:text-fg-dim">
-                                            {{ data_get($update, 'new_version') }}
-                                        </p>
-                                        @if ($packageManager !== 'dnf' && data_get($update, 'current_version'))
-                                            <p class="mt-0.5 truncate text-[10px] text-neutral-500 dark:text-fg-faint">
-                                                Current: {{ data_get($update, 'current_version') }}
-                                            </p>
-                                        @endif
-                                    </div>
-                                    <div class="flex justify-end">
-                                        <x-forms.button type="button"
-                                            wire:click="$dispatch('updatePackage', { package: '{{ data_get($update, 'package') }}' })">
-                                            Update
-                                        </x-forms.button>
-                                    </div>
-                                </div>
-                            @endforeach
-                            <div
-                                class="flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
-                                {{ count($updates) }} {{ Str::plural('package update', count($updates)) }}
-                            </div>
+                    @if ($fullUpgradeOnly)
+                        <div class="px-4 pt-4">
+                            <x-callout type="info" title="Full system upgrade only">
+                                Arch Linux does not support partial upgrades, so packages cannot be updated one by one.
+                            </x-callout>
                         </div>
-                    </x-application.settings-section>
-                @endif
-            </div>
+                    @endif
+
+                    <div class="data-table">
+                        <div class="data-table-header package-updates-table-grid">
+                            <span>Package</span>
+                            <span>New version</span>
+                            <span class="text-right">Action</span>
+                        </div>
+                        @foreach ($updates as $update)
+                            <div wire:key="package-update-{{ data_get($update, 'package') }}-{{ data_get($update, 'architecture') }}"
+                                class="data-table-row package-updates-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
+                                <div class="flex min-w-0 items-center gap-2">
+                                    @if (filled(data_get($update, 'risk')))
+                                        <span class="shrink-0" data-tooltip="{{ \App\Actions\Server\CheckUpdates::RISK_LABELS[data_get($update, 'risk')] ?? '' }}">
+                                            <x-reicon name="alert-triangle" class="size-4 text-red-500" />
+                                            <span class="sr-only">{{ \App\Actions\Server\CheckUpdates::RISK_LABELS[data_get($update, 'risk')] ?? '' }}</span>
+                                        </span>
+                                    @endif
+                                    <span class="min-w-0 truncate font-mono text-[12px] text-neutral-950 dark:text-fg">
+                                        {{ data_get($update, 'package') }}
+                                    </span>
+                                    @if (data_get($update, 'security'))
+                                        <x-status-badge status="Security" type="error" />
+                                    @endif
+                                </div>
+                                <div class="min-w-0">
+                                    <p class="truncate font-mono text-[12px] text-neutral-700 dark:text-fg-dim">
+                                        {{ data_get($update, 'new_version') }}
+                                    </p>
+                                    @if (data_get($update, 'current_version') && data_get($update, 'current_version') !== 'unknown')
+                                        <p class="mt-0.5 truncate text-[10px] text-neutral-500 dark:text-fg-faint">
+                                            Current: {{ data_get($update, 'current_version') }}
+                                        </p>
+                                    @endif
+                                </div>
+                                <div class="flex justify-end">
+                                    @if (! $fullUpgradeOnly)
+                                        @can('update', $server)
+                                            <x-forms.button type="button"
+                                                wire:click="updatePackage({{ Js::from(data_get($update, 'package')) }})">
+                                                Update
+                                            </x-forms.button>
+                                        @endcan
+                                    @endif
+                                </div>
+                            </div>
+                        @endforeach
+                        <div
+                            class="flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
+                            {{ $totalUpdates }} {{ Str::plural('package update', $totalUpdates) }}
+                        </div>
+                    </div>
+                </x-application.settings-section>
+            @endif
+
         </div>
     </div>
-
-    @script
-        <script>
-            $wire.on('checkForUpdates', () => $wire.$call('checkForUpdatesDispatch'));
-            $wire.on('updateAllPackages', () => {
-                window.dispatchEvent(new CustomEvent('startupdate'));
-                $wire.$call('updateAllPackages');
-            });
-            $wire.on('updatePackage', data => {
-                window.dispatchEvent(new CustomEvent('startupdate'));
-                $wire.$call('updatePackage', data.package);
-            });
-            $wire.on('checkForUpdatesDispatch', () => $wire.$call('checkForUpdates'));
-        </script>
-    @endscript
 </div>
diff --git a/resources/views/livewire/server/security/terminal-access.blade.php b/resources/views/livewire/server/security/terminal-access.blade.php
index 88d46e6469..88f80276b7 100644
--- a/resources/views/livewire/server/security/terminal-access.blade.php
+++ b/resources/views/livewire/server/security/terminal-access.blade.php
@@ -7,16 +7,11 @@
 
     <div
         class="server-settings-workspace application-settings-workspace mt-4 grid w-full max-w-none min-w-0 gap-8 lg:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <x-server.sidebar :server="$server" activeMenu="security" />
+        <x-server.sidebar :server="$server" activeMenu="security" activeSubMenu="terminal-access" />
 
         <div class="application-settings-form w-full">
             <x-application.settings-section id="server-terminal-access-section" title="Terminal access"
                 helper="Control dashboard terminal access for this server and its containers.">
-                <x-slot:actions>
-                    <x-status-badge :status="$isTerminalEnabled ? 'Enabled' : 'Disabled'"
-                        :type="$isTerminalEnabled ? 'success' : 'error'" />
-                </x-slot:actions>
-
                 <div class="flex flex-col justify-between gap-4 sm:flex-row sm:items-center">
                     <div class="flex items-start gap-3">
                         <div
diff --git a/resources/views/livewire/server/sentinel/logs.blade.php b/resources/views/livewire/server/sentinel/logs.blade.php
index ed2f350c66..3e25983b32 100644
--- a/resources/views/livewire/server/sentinel/logs.blade.php
+++ b/resources/views/livewire/server/sentinel/logs.blade.php
@@ -5,7 +5,7 @@
     <livewire:server.navbar :server="$server" />
     <div
         class="server-settings-workspace application-settings-workspace mt-4 grid w-full max-w-none min-w-0 gap-8 lg:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <x-server.sidebar :server="$server" activeMenu="sentinel" />
+        <x-server.sidebar :server="$server" activeMenu="sentinel" activeSubMenu="logs" />
         <div class="application-settings-form w-full">
             <x-application.settings-section title="Sentinel logs"
                 helper="Search, filter, follow, copy, or download recent output from the Sentinel container."
diff --git a/resources/views/livewire/server/sentinel/show.blade.php b/resources/views/livewire/server/sentinel/show.blade.php
index 139ad9d29b..6f7d9236fa 100644
--- a/resources/views/livewire/server/sentinel/show.blade.php
+++ b/resources/views/livewire/server/sentinel/show.blade.php
@@ -5,7 +5,7 @@
     <livewire:server.navbar :server="$server" />
     <div
         class="server-settings-workspace application-settings-workspace mt-4 grid w-full max-w-none min-w-0 gap-8 lg:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <x-server.sidebar :server="$server" activeMenu="sentinel" />
+        <x-server.sidebar :server="$server" activeMenu="sentinel" activeSubMenu="configuration" />
         @if ($server->isFunctional())
             <div class="w-full">
                 <livewire:server.sentinel :server="$server" />
diff --git a/resources/views/livewire/server/show.blade.php b/resources/views/livewire/server/show.blade.php
index acfd8cec6a..cfbad137c9 100644
--- a/resources/views/livewire/server/show.blade.php
+++ b/resources/views/livewire/server/show.blade.php
@@ -1,5 +1,5 @@
 <div x-data
-    x-init="@if ($server->hetzner_server_id && $server->cloudProviderToken && !$hetznerServerStatus) $wire.checkHetznerServerStatus(); @endif @if ($server->vultr_instance_id && $server->cloudProviderToken) $wire.checkVultrInstanceStatus(); @endif @if ($server->digitalocean_droplet_id && $server->cloudProviderToken && !$digitalOceanDropletStatus) $wire.checkDigitalOceanDropletStatus(); @endif">
+    x-init="@if ($server->hetzner_server_id && $server->cloudProviderToken && !$hetznerServerStatus) $wire.checkHetznerServerStatus(); @endif @if ($server->vultr_instance_id && $server->cloudProviderToken) $wire.checkVultrInstanceStatus(); @endif @if ($server->digitalocean_droplet_id && $server->cloudProviderToken && !$digitalOceanDropletStatus) $wire.checkDigitalOceanDropletStatus(); @endif @if ($server->hostinger_virtual_machine_id && $server->cloudProviderToken && !$hostingerVirtualMachineStatus) $wire.checkHostingerVirtualMachineStatus(); @endif">
     <x-slot:title>
         {{ data_get_str($server, 'name')->limit(24) }} | Server | Coolify
     </x-slot>
@@ -18,23 +18,26 @@
                         filled($server->hetzner_server_id) => 'Hetzner',
                         filled($server->digitalocean_droplet_id) => 'DigitalOcean',
                         filled($server->vultr_instance_id) => 'Vultr',
+                        filled($server->hostinger_virtual_machine_id) => 'Hostinger',
                         default => null,
                     };
                     $providerStatus = match ($provider) {
                         'Hetzner' => $hetznerServerStatus,
                         'DigitalOcean' => $digitalOceanDropletStatus,
                         'Vultr' => $vultrInstanceStatus,
+                        'Hostinger' => $hostingerVirtualMachineStatus,
                         default => null,
                     };
                     $providerStatusType = match (true) {
                         in_array($providerStatus, ['running', 'active']) => 'success',
-                        in_array($providerStatus, ['starting', 'initializing', 'pending', 'new']) => 'warning',
-                        in_array($providerStatus, ['off', 'stopped', 'suspended', 'archive', 'deleted']) => 'error',
+                        in_array($providerStatus, ['starting', 'initializing', 'pending', 'new', 'initial', 'creating', 'unsuspending', 'recreating', 'restoring']) => 'warning',
+                        in_array($providerStatus, ['off', 'stopped', 'suspended', 'archive', 'deleted', 'destroyed', 'error']) => 'error',
                         default => 'neutral',
                     };
                     $hasLinkableCloudProviders = (!$server->hetzner_server_id && $availableHetznerTokens->isNotEmpty())
                         || (!$server->vultr_instance_id && $availableVultrTokens->isNotEmpty())
-                        || (!$server->digitalocean_droplet_id && $availableDigitalOceanTokens->isNotEmpty());
+                        || (!$server->digitalocean_droplet_id && $availableDigitalOceanTokens->isNotEmpty())
+                        || (!$server->hostinger_virtual_machine_id && $availableHostingerTokens->isNotEmpty());
                     $hetznerMatch = $matchedHetznerServer
                         ? [
                             'name' => $matchedHetznerServer['name'] ?? 'Hetzner server',
@@ -56,6 +59,13 @@
                             'status' => $matchedVultrInstance['status'] ?? null,
                         ]
                         : null;
+                    $hostingerMatch = $matchedHostingerVirtualMachine
+                        ? [
+                            'name' => $matchedHostingerVirtualMachine['hostname'] ?? 'Hostinger VPS',
+                            'id' => $matchedHostingerVirtualMachine['id'] ?? null,
+                            'status' => $matchedHostingerVirtualMachine['state'] ?? null,
+                        ]
+                        : null;
                 @endphp
 
                 <form wire:submit.prevent="submit" class="application-settings-form flex flex-col gap-6">
@@ -65,6 +75,14 @@
 
                     <x-application.settings-section id="server-connection-section" title="Connection"
                         helper="Configure how Coolify identifies, reaches, and validates this server.">
+                        <x-slot:badges>
+                            @if ($server->isTransferredAway())
+                                <x-status-badge label="Transferred away" type="warning" />
+                            @else
+                                <x-status-badge :label="$server->isFunctional() ? 'Ready' : 'Validation required'"
+                                    :type="$server->isFunctional() ? 'success' : 'warning'" />
+                            @endif
+                        </x-slot:badges>
                         <x-slot:actions>
                             @if ($hasLinkableCloudProviders)
                                 <div x-data="{ open: false }" class="relative" @click.outside="open = false">
@@ -107,6 +125,18 @@
                                                 :searchError="$vultrSearchError" :noMatch="$vultrNoMatchFound"
                                                 :matched="$vultrMatch" />
                                         @endif
+                                        @if (!$server->hostinger_virtual_machine_id && $availableHostingerTokens->isNotEmpty())
+                                            <x-server.provider-link-modal :server="$server" provider="hostinger"
+                                                providerLabel="Hostinger" tokenModel="selectedHostingerTokenId"
+                                                :tokens="$availableHostingerTokens"
+                                                manualModel="manualHostingerVirtualMachineId"
+                                                manualLabel="Virtual Machine ID" manualPlaceholder="17923"
+                                                searchByIdMethod="searchHostingerVirtualMachineById"
+                                                searchByIpMethod="searchHostingerVirtualMachine"
+                                                linkMethod="linkToHostinger"
+                                                :searchError="$hostingerSearchError" :noMatch="$hostingerNoMatchFound"
+                                                :matched="$hostingerMatch" />
+                                        @endif
                                     </div>
                                 </div>
                             @endif
@@ -125,64 +155,49 @@
                                     </x-forms.button>
                                 </x-process-dialog>
                             @endif
-                            @if (isDev())
-                                <div wire:key="server-management-{{ $server->isTransferredAway() ? 'enable' : 'disable' }}">
-                                    @if ($server->isTransferredAway())
-                                        <x-modal-confirmation title="Enable management on this instance?"
-                                            submitAction="toggleManagement" :confirmWithText="false"
-                                            :confirmWithPassword="false" step2ButtonText="Enable management"
-                                            warningMessage="Before you continue, disable this server on every other Coolify instance. Two active instances can cause conflicting deployments, proxy changes, backups, and restarts."
-                                            :actions="['This instance will run deployments, webhooks, scheduled tasks, backups, proxy updates, and monitoring for this server.']">
-                                            <x-slot:trigger>
-                                                <x-forms.button type="button" canGate="update" :canResource="$server">
-                                                    <x-reicon name="play-circle" class="size-3.5" />
-                                                    Enable management
-                                                </x-forms.button>
-                                            </x-slot:trigger>
-                                        </x-modal-confirmation>
-                                    @else
-                                        <x-modal-confirmation title="Disable management on this instance?"
-                                            submitAction="toggleManagement" :confirmWithText="false"
-                                            :confirmWithPassword="false" step2ButtonText="Disable management"
-                                            :actions="[
-                                                'Deployments, webhooks, scheduled tasks, backups, proxy updates, and monitoring will stop on this instance for this server.',
-                                                'Existing workloads continue to run on the server.',
-                                            ]">
-                                            <x-slot:trigger>
-                                                <x-forms.button type="button" canGate="update" :canResource="$server">
-                                                    <x-reicon name="stop-circle" class="size-3.5" />
-                                                    Disable management
-                                                </x-forms.button>
-                                            </x-slot:trigger>
-                                        </x-modal-confirmation>
-                                    @endif
-                                </div>
-                            @endif
-                            @if (isDev() && $server->isTransferredAway())
-                                @unless ($server->isManagementDisabled())
-                                    <x-status-badge label="Transferred away" type="warning" />
-                                @endunless
-                            @else
-                                <x-status-badge :label="$server->isFunctional() ? 'Ready' : 'Validation required'"
-                                    :type="$server->isFunctional() ? 'success' : 'warning'" />
+                            @if ($server->isTransferredAway() && ! $server->isLocalhost())
+                                @php
+                                    $transferTarget = data_get($server->server_metadata, 'transfer.target_instance_url') ?: 'another Coolify instance';
+                                    $transferredAt = data_get($server->server_metadata, 'transfer.transferred_at');
+                                    $transferredAt = $transferredAt ? \Illuminate\Support\Carbon::parse($transferredAt)->toDayDateTimeString().' UTC' : 'the transfer';
+                                @endphp
+                                <x-modal-confirmation title="Take back a transferred server?"
+                                    submitAction="enableManagement" :confirmWithPassword="false"
+                                    temporaryDisableTwoStepConfirmation
+                                    step2ButtonText="I understand, enable management"
+                                    :confirmationText="$server->name"
+                                    confirmationLabel="Enter the server name to take the server back."
+                                    shortConfirmationLabel="Server name"
+                                    :warningMessage="'<strong>Changes made on '.e($transferTarget).' after '.e($transferredAt).' are lost.</strong> This instance uses its copy of the settings and resources from the time of the transfer. Use this only when '.e($transferTarget).' is lost or cannot transfer the server back. Otherwise use Transfer back, which keeps those changes.'"
+                                    :actions="[
+                                        'This instance starts to run deployments, webhooks, scheduled tasks, backups, proxy updates, and monitoring for this server again.',
+                                        'The server records that this instance owns it. The next time the other instance connects to the server, it stops managing it automatically.',
+                                        'Sentinel on the server is reconfigured to send its data to this instance.',
+                                        'This instance takes back its DNS records and shows the steps that finish the take back: webhooks, DNS, Sentinel, backups, and runners.',
+                                    ]">
+                                    <x-slot:trigger>
+                                        <x-forms.button type="button" isError canGate="update" :canResource="$server">
+                                            <x-reicon name="alert-triangle" class="size-3.5" />
+                                            Enable management
+                                        </x-forms.button>
+                                    </x-slot:trigger>
+                                </x-modal-confirmation>
                             @endif
                         </x-slot:actions>
 
-                        @if (isDev() && $server->isManagementDisabled())
-                            <x-callout type="warning" title="Transferable to another instance" class="mb-4">
-                                Management of this server is disabled on this Coolify instance. You can now
-                                <a href="{{ route('server.transfer', ['server_uuid' => $server->uuid]) }}"
-                                    {{ wireNavigate() }} class="underline">transfer it to another instance</a>, or enable
-                                management again to manage it here.
-                            </x-callout>
-                        @elseif (isDev() && $server->isTransferredAway())
-                            <x-callout type="warning" title="Transferred to another instance" class="mb-4">
-                                This server was migrated away from this Coolify instance. It cannot be revalidated or
-                                managed here. Use the target instance, or delete this server when you no longer need the
-                                archive.
+                        @if ($server->isTransferredAway())
+                            <x-callout type="danger" title="Transferred to another instance" class="mb-4">
+                                This server was transferred to
+                                <strong>{{ data_get($server->server_metadata, 'transfer.target_instance_url') ?: 'another Coolify instance' }}</strong>,
+                                which manages it now. Use that instance. To undo the transfer, use
+                                <a href="{{ route('server.transfer', ['server_uuid' => $server->uuid]) }}" {{ wireNavigate() }}
+                                    class="underline">Transfer back</a>. Keep this archive until you are sure: it is the copy
+                                that an undo uses.
                             </x-callout>
                         @endif
 
+                        <livewire:server.transfer-finish :server="$server" :key="'transfer-finish-'.$server->uuid" />
+
                         @if ($this->limaStartCommand)
                             <x-callout type="info" title="Start this Lima VM locally" class="mb-4">
                                 <code
@@ -272,6 +287,12 @@
                                         title="Refresh provider status">
                                         <x-reicon name="refresh" class="size-3.5" />
                                     </x-forms.button>
+                                @elseif ($provider === 'Hostinger')
+                                    <x-forms.button type="button" class="size-8! px-0!"
+                                        wire:click.prevent="checkHostingerVirtualMachineStatus(true)"
+                                        title="Refresh provider status">
+                                        <x-reicon name="refresh" class="size-3.5" />
+                                    </x-forms.button>
                                 @endif
                                 @if ($server->cloudProviderToken)
                                     @if ($provider === 'Hetzner' && !$server->isFunctional() && $hetznerServerStatus === 'off')
@@ -292,12 +313,12 @@
                                     @endif
                                 @endif
                             @endif
-                            @if ($server->server_metadata)
-                                <x-forms.button type="button" class="size-8! px-0!"
-                                    wire:click="refreshServerMetadata" title="Refresh server details">
-                                    <x-reicon name="refresh" class="size-3.5" />
-                                </x-forms.button>
-                            @endif
+                            <x-forms.button type="button" wire:click="refreshServerMetadata"
+                                :disabled="! $server->isFunctional()"
+                                :tooltip="$server->isFunctional() ? null : 'Validate the connection first.'">
+                                <x-reicon name="refresh" class="size-3.5" />
+                                {{ $server->server_metadata ? 'Refresh details' : 'Fetch server details' }}
+                            </x-forms.button>
                         </x-slot:actions>
 
                         <div class="flex items-start gap-3">
@@ -310,9 +331,7 @@
                                     {{ $server->name }}
                                 </p>
                                 <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
-                                    @if (isDev() && $server->isManagementDisabled())
-                                        Management is disabled on this Coolify instance. You can transfer this server to another instance.
-                                    @elseif (isDev() && $server->isTransferredAway())
+                                    @if ($server->isTransferredAway())
                                         This server was migrated away from this Coolify instance and cannot be managed here.
                                     @elseif ($server->isFunctional())
                                         The server is reachable, validated, and ready to host resources.
@@ -325,13 +344,6 @@
 
                         @if ($server->server_metadata)
                             @include('livewire.server.partials.server-details', ['server' => $server])
-                        @else
-                            <div class="mt-4 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
-                                <x-forms.button type="button" wire:click="refreshServerMetadata">
-                                    <x-reicon name="refresh" class="size-3.5" />
-                                    Fetch server details
-                                </x-forms.button>
-                            </div>
                         @endif
                     </x-application.settings-section>
 
diff --git a/resources/views/livewire/server/traffic-analytics-settings.blade.php b/resources/views/livewire/server/traffic-analytics-settings.blade.php
index 09ee724eeb..177bb1a59a 100644
--- a/resources/views/livewire/server/traffic-analytics-settings.blade.php
+++ b/resources/views/livewire/server/traffic-analytics-settings.blade.php
@@ -61,7 +61,7 @@
                             ['value' => 'anonymized', 'label' => 'Anonymized (/24 IPv4, /48 IPv6)'],
                             ['value' => 'off', 'label' => 'Disabled'],
                         ]"
-                        helper="How Sentinel stores visitor IPs for the Top IPs list. Anonymized keeps only the network. Disabled does not store IPs. When you change this setting, Sentinel deletes the stored IPs that the new setting does not allow." />
+                        helper="How Sentinel stores visitor IPs for the Top IPs list. Anonymized keeps only the network. Disabled does not store IPs or visitor cities. When you change this setting, Sentinel deletes the stored IPs that the new setting does not allow." />
                     <x-forms.input canGate="update" :canResource="$server" type="number" min="1"
                         id="geoipRefreshDays" label="GeoIP refresh interval" required
                         helper="Days between GeoIP database update checks." />
diff --git a/resources/views/livewire/server/transfer-finish.blade.php b/resources/views/livewire/server/transfer-finish.blade.php
new file mode 100644
index 0000000000..aaeb37869a
--- /dev/null
+++ b/resources/views/livewire/server/transfer-finish.blade.php
@@ -0,0 +1,171 @@
+<div>
+    @if ($finish && $openCount > 0)
+        {{-- Not on the root element: Livewire starts a poll that a later render adds only on a new element. --}}
+        <div wire:key="transfer-finish-poll" wire:init="refreshSteps" wire:poll.15s="refreshSteps" hidden></div>
+    @endif
+    @if ($finish)
+        @php
+            $doneCount = $totalCount - $openCount;
+            $lastCheckedAt = data_get($finish, 'last_checked_at');
+            $badges = [
+                'action' => ['Needs action', 'warning'],
+                'unchecked' => ['Cannot check', 'neutral'],
+                'pending' => ['Not checked yet', 'neutral'],
+            ];
+        @endphp
+        <div class="mb-4 rounded-lg p-4 ring-1 ring-neutral-200 dark:ring-white/[0.08]" data-testid="transfer-finish">
+            <div class="flex flex-wrap items-start justify-between gap-3">
+                <div class="min-w-0">
+                    <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Finish the transfer</h3>
+                    <p class="mt-1 text-xs text-neutral-500 dark:text-fg-dim">
+                        {{ $doneCount }} of {{ $totalCount }} done.
+                        @if ($openCount > 0)
+                            Coolify checks the open steps every 30 seconds.
+                        @endif
+                    </p>
+                </div>
+                <div class="flex items-center gap-2">
+                    @if ($openCount > 0)
+                        <span class="text-xs text-neutral-500 dark:text-fg-dim">
+                            {{ $lastCheckedAt ? 'Checked '.\Illuminate\Support\Carbon::parse($lastCheckedAt)->format('H:i') : 'Checking…' }}
+                        </span>
+                        @can('update', $server)
+                            <button type="button" class="icon-button" title="Check now" wire:click="checkAllNow"
+                                wire:loading.attr="disabled" wire:target="checkAllNow">
+                                <x-reicon name="refresh" class="size-4" />
+                            </button>
+                        @endcan
+                    @else
+                        <x-forms.button isHighlighted wire:click="finishTransfer" canGate="update" :canResource="$server">
+                            Finish the transfer
+                        </x-forms.button>
+                    @endif
+                </div>
+            </div>
+            <div class="mt-3 h-1 overflow-hidden rounded-full bg-neutral-200 dark:bg-white/[0.08]">
+                <div class="h-full rounded-full bg-success transition-all"
+                    style="width: {{ $totalCount > 0 ? round($doneCount / $totalCount * 100) : 0 }}%"></div>
+            </div>
+
+            @foreach ($openGroups as $group)
+                <div class="mt-4" wire:key="transfer-group-{{ $loop->index }}-{{ $group['label'] }}">
+                    <p class="text-xs font-medium text-neutral-500 dark:text-fg-dim">{{ $group['label'] }}</p>
+                    <ul class="mt-1 flex flex-col divide-y divide-neutral-200 dark:divide-white/[0.06]">
+                        @foreach ($group['items'] as $step)
+                            @php
+                                $fixLabel = $checklist->fixLabel($step);
+                                $manualOnly = ! $checklist->canCheck($step);
+                                [$link, $linkLabel] = $checklist->linkOf($step) ?? [null, null];
+                                $linkAttributes = $link && str_starts_with($link, 'http') ? 'target="_blank" rel="noopener noreferrer"' : wireNavigate();
+                                $hasMenu = ! $manualOnly || $link;
+                                $hasDetails = filled($step['hint'] ?? null) || count($step['details'] ?? []) > 0 || filled($step['error'] ?? null);
+                                [$badgeLabel, $badgeType] = $badges[$step['status']] ?? ['Not checked yet', 'neutral'];
+                            @endphp
+                            <li wire:key="transfer-step-{{ $step['key'] }}" class="py-2" x-data="{ details: false, menu: false }">
+                                <div class="flex items-center gap-3">
+                                    <span class="size-2 shrink-0 rounded-full {{ $badgeType === 'warning' ? 'bg-warning' : 'bg-neutral-400 dark:bg-neutral-500' }}"
+                                        title="{{ $badgeLabel }}" role="img" aria-label="{{ $badgeLabel }}"></span>
+                                    <div class="min-w-0 flex-1">
+                                        <p class="truncate text-sm text-neutral-950 dark:text-fg">{{ $step['label'] }}</p>
+                                        <p class="truncate text-xs text-neutral-500 dark:text-fg-dim">
+                                            {{ $step['message'] ?? $step['hint'] }}
+                                            @if ($hasDetails)
+                                                <button type="button" class="ml-1 underline" @click="details = !details"
+                                                    x-text="details ? 'Hide details' : 'Details'"></button>
+                                            @endif
+                                        </p>
+                                    </div>
+                                    @can('update', $server)
+                                        <div class="flex shrink-0 items-center gap-1">
+                                            @if ($hasMenu)
+                                            <div class="relative" @click.outside="menu = false" @keydown.escape.window="menu = false">
+                                                <button type="button" class="icon-button" title="More actions" aria-haspopup="menu"
+                                                    :aria-expanded="menu" @click="menu = !menu">
+                                                    <x-reicon name="dots-horizontal" class="size-4" />
+                                                </button>
+                                                <div x-cloak x-show="menu" x-transition.origin.top.right role="menu"
+                                                    class="listbox-panel top-full! right-0! left-auto! z-[90]! mt-1! w-40! min-w-40!">
+                                                    @unless ($manualOnly)
+                                                        <button type="button" class="listbox-option justify-start!" role="menuitem"
+                                                            wire:click="checkStep('{{ $step['key'] }}')" @click="menu = false">Check now</button>
+                                                    @endunless
+                                                    @if (! $manualOnly || $link)
+                                                        <button type="button" class="listbox-option justify-start!" role="menuitem"
+                                                            wire:click="markStepDone('{{ $step['key'] }}')" @click="menu = false">Mark as done</button>
+                                                    @endif
+                                                    @if ($fixLabel && $link)
+                                                        <a href="{{ $link }}" {!! $linkAttributes !!} class="listbox-option justify-start!"
+                                                            role="menuitem">{{ $linkLabel }}</a>
+                                                    @endif
+                                                </div>
+                                            </div>
+                                            @endif
+                                            @if ($fixLabel)
+                                                <x-forms.button wire:click="fixStep('{{ $step['key'] }}')">{{ $fixLabel }}</x-forms.button>
+                                            @elseif ($link)
+                                                <a href="{{ $link }}" {!! $linkAttributes !!} class="button">{{ $linkLabel }}</a>
+                                            @elseif ($manualOnly)
+                                                <x-forms.button wire:click="markStepDone('{{ $step['key'] }}')">Mark as done</x-forms.button>
+                                            @endif
+                                        </div>
+                                    @endcan
+                                </div>
+                                @if ($hasDetails)
+                                    <div x-cloak x-show="details" class="mt-2 ml-1 flex flex-col gap-1.5 text-xs text-neutral-600 dark:text-fg-dim">
+                                        @if (filled($step['hint'] ?? null) && filled($step['message'] ?? null))
+                                            <p>{{ $step['hint'] }}</p>
+                                        @endif
+                                        @foreach ($step['details'] ?? [] as $detail)
+                                            <div class="flex min-w-0 items-center gap-2" wire:key="transfer-detail-{{ $step['key'] }}-{{ $detail['label'] }}">
+                                                <span class="shrink-0">{{ $detail['label'] }}</span>
+                                                <code class="min-w-0 truncate rounded bg-neutral-100 px-1.5 py-0.5 dark:bg-white/[0.06]">{{ $detail['value'] }}</code>
+                                                <x-copy-button :value="$detail['value']" />
+                                            </div>
+                                        @endforeach
+                                        @if (filled($step['error'] ?? null))
+                                            <p class="break-words">{{ $step['error'] }}</p>
+                                        @endif
+                                    </div>
+                                @endif
+                            </li>
+                        @endforeach
+                    </ul>
+                </div>
+            @endforeach
+
+            @if ($doneCount > 0)
+                <div class="mt-4" x-data="{ showDone: false }">
+                    <button type="button" class="flex items-center gap-1 text-xs text-neutral-500 dark:text-fg-dim"
+                        @click="showDone = !showDone">
+                        <x-reicon name="chevron-down" class="size-3 transition-transform" ::class="showDone ? '' : '-rotate-90'" />
+                        {{ $doneCount }} {{ $doneCount === 1 ? 'step is' : 'steps are' }} OK or done
+                    </button>
+                    <ul x-cloak x-show="showDone" class="mt-1 flex flex-col gap-1">
+                        @foreach ($doneItems as $step)
+                            <li wire:key="transfer-done-{{ $step['key'] }}" class="flex items-center gap-2 text-xs text-neutral-500 dark:text-fg-dim">
+                                <x-reicon name="check-circle" class="size-3.5 text-success" />
+                                <span class="text-neutral-700 dark:text-fg">{{ $step['label'] }}</span>
+                                <span class="truncate">{{ $step['message'] }}</span>
+                            </li>
+                        @endforeach
+                    </ul>
+                </div>
+            @endif
+
+            @if ($openCount > 0)
+                @can('update', $server)
+                    <div class="mt-4 flex justify-end">
+                        <x-modal-confirmation title="Finish with open steps?" submitAction="finishTransfer"
+                            :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Finish the transfer"
+                            :warningMessage="'<strong>'.$openCount.' steps are not OK or done.</strong> Coolify does not check them again. Webhooks, DNS records, or runners can still point to the other instance.'"
+                            :actions="collect($openGroups)->flatMap(fn ($group) => $group['items'])->map(fn ($step) => 'Skipped: '.$step['label'])->all()">
+                            <x-slot:trigger>
+                                <button type="button" class="text-xs text-neutral-500 underline dark:text-fg-dim">Finish with open steps…</button>
+                            </x-slot:trigger>
+                        </x-modal-confirmation>
+                    </div>
+                @endcan
+            @endif
+        </div>
+    @endif
+</div>
diff --git a/resources/views/livewire/server/transfer-import.blade.php b/resources/views/livewire/server/transfer-import.blade.php
deleted file mode 100644
index d55a4d320b..0000000000
--- a/resources/views/livewire/server/transfer-import.blade.php
+++ /dev/null
@@ -1,128 +0,0 @@
-<div class="w-full">
-    <x-slot:title>
-        Import server | Coolify
-    </x-slot>
-
-    <div class="mb-5 flex min-h-9 flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-        <div class="min-w-0">
-            <div class="flex flex-wrap items-center gap-2">
-                <h1 class="min-w-0 text-[24px]! leading-7! font-semibold! tracking-tight!">Import server</h1>
-                <x-status-badge label="Dev" />
-            </div>
-            <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
-                Import a server that you downloaded from another Coolify instance. This instance then manages it.
-            </p>
-        </div>
-        <a href="{{ route('server.index') }}" class="button w-fit shrink-0" {{ wireNavigate() }}>
-            Back to servers
-        </a>
-    </div>
-
-    <div class="application-settings-form flex flex-col gap-6">
-        <x-application.settings-section id="server-import-file-section" title="Transfer file"
-            helper="On the source instance, open the server, go to Transfer, and click Download JSON in Manual transfer. The server data on the machine does not change.">
-            <x-slot:actions>
-                <x-forms.button wire:click="dryRun" wire:loading.attr="disabled" wire:target="dryRun,importBundle">
-                    <x-reicon name="search" class="size-3.5" />
-                    <span wire:loading.remove wire:target="dryRun">Dry run</span>
-                    <span wire:loading wire:target="dryRun">Checking…</span>
-                </x-forms.button>
-                <x-modal-confirmation title="Import this server?" submitAction="importBundle"
-                    :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Import server"
-                    :actions="[
-                        'The server and its resources will be added to the current team.',
-                        'This instance will manage the server. Disable management of it on the source instance.',
-                    ]">
-                    <x-slot:trigger>
-                        <x-forms.button isHighlighted wire:loading.attr="disabled" wire:target="dryRun,importBundle">
-                            <x-reicon name="upload" class="size-3.5" />
-                            <span wire:loading.remove wire:target="importBundle">Import server</span>
-                            <span wire:loading wire:target="importBundle">Importing…</span>
-                        </x-forms.button>
-                    </x-slot:trigger>
-                </x-modal-confirmation>
-            </x-slot:actions>
-
-            <div class="flex flex-col gap-4">
-                <x-forms.input type="file" id="bundleFile" label="Upload file"
-                    accept=".json,application/json" />
-                <x-forms.textarea id="bundleJson" label="Or paste the file content" rows="10"
-                    placeholder='{"schema_version":1,...}' />
-                <div class="md:max-w-xl">
-                    <x-forms.input id="passphrase" type="password" label="Passphrase"
-                        placeholder="Only for encrypted files" autocomplete="off" />
-                </div>
-            </div>
-        </x-application.settings-section>
-
-        <x-application.settings-section id="server-import-options-section" title="Options">
-            <div class="flex flex-col gap-1 md:max-w-xl">
-                <x-forms.checkbox id="preserveUuids" label="Keep UUIDs from the source instance"
-                    helper="Resources keep the same UUIDs, so their names, containers, and webhook URLs stay the same." />
-                <x-forms.checkbox id="adoptMode" label="Adopt running resources"
-                    helper="Keep the current status of each resource and do not redeploy stopped resources." />
-            </div>
-        </x-application.settings-section>
-
-        @if (count($lastWarnings) > 0)
-            <x-callout type="warning" title="Warnings">
-                <ul class="mt-1 list-disc space-y-1 pl-5">
-                    @foreach ($lastWarnings as $warning)
-                        <li>{{ $warning }}</li>
-                    @endforeach
-                </ul>
-            </x-callout>
-        @endif
-
-        @if ($lastResult)
-            @php
-                $createdCounts = collect(data_get($lastResult, 'created', []))
-                    ->filter(fn ($count) => (int) $count > 0);
-            @endphp
-            <x-application.settings-section id="server-import-result-section"
-                :title="data_get($lastResult, 'dry_run') ? 'Dry run result' : 'Import result'">
-                <x-slot:actions>
-                    @if (data_get($lastResult, 'dry_run'))
-                        <x-status-badge label="Nothing written" type="neutral" />
-                    @elseif (data_get($lastResult, 'claimed'))
-                        <x-status-badge label="Managed here" type="success" />
-                    @else
-                        <x-status-badge label="Management not enabled" type="warning" />
-                    @endif
-                    @if ($importedServerUuid)
-                        <a href="{{ route('server.show', ['server_uuid' => $importedServerUuid]) }}" class="button"
-                            {{ wireNavigate() }}>
-                            Open server
-                            <x-reicon name="arrow-right" class="size-3.5" />
-                        </a>
-                    @endif
-                </x-slot:actions>
-
-                <div class="flex flex-col gap-4">
-                    @if (filled(data_get($lastResult, 'server_uuid')))
-                        <p class="text-xs text-neutral-500 dark:text-fg-dim">
-                            Server UUID
-                            <code class="ml-1 font-mono text-neutral-700 dark:text-fg">{{ data_get($lastResult, 'server_uuid') }}</code>
-                        </p>
-                    @endif
-
-                    @if ($createdCounts->isNotEmpty())
-                        <div class="grid grid-cols-2 gap-2 sm:grid-cols-3 lg:grid-cols-4">
-                            @foreach ($createdCounts as $type => $count)
-                                <div
-                                    class="rounded-lg border border-neutral-200 px-3 py-2 dark:border-white/[0.08]">
-                                    <div class="text-[15px] font-semibold text-neutral-950 dark:text-fg">
-                                        {{ $count }}</div>
-                                    <div class="text-[11px] text-neutral-500 dark:text-fg-faint">
-                                        {{ str($type)->replace('_', ' ')->ucfirst() }}</div>
-                                </div>
-                            @endforeach
-                        </div>
-                    @else
-                        <p class="text-xs text-neutral-500 dark:text-fg-dim">No resources in this file.</p>
-                    @endif
-                </div>
-            </x-application.settings-section>
-        @endif
-    </div>
-</div>
diff --git a/resources/views/livewire/server/transfer.blade.php b/resources/views/livewire/server/transfer.blade.php
index 0b322fc6ca..900e04f8be 100644
--- a/resources/views/livewire/server/transfer.blade.php
+++ b/resources/views/livewire/server/transfer.blade.php
@@ -11,29 +11,74 @@
 
         <div class="application-settings-form flex w-full flex-col gap-6">
             @if ($this->isLocalhost)
-                <x-application.settings-section id="server-transfer-section" title="Transfer server (Dev)"
+                <x-application.settings-section id="server-transfer-section" title="Transfer server"
                     helper="Move this server’s control-plane config to another Coolify instance (same physical host).">
                     <x-callout type="warning" title="Localhost cannot be transferred">
                         The Coolify host (localhost) cannot be transferred between instances.
                     </x-callout>
                 </x-application.settings-section>
             @else
-                <x-application.settings-section id="server-transfer-section" title="Transfer server (Dev)"
+                <x-application.settings-section id="server-transfer-section" title="Transfer server"
                     helper="Move this server’s control-plane config to another Coolify instance (same physical host).">
                     <x-slot:actions>
-                        @if ($server->isManagementDisabled())
-                            <x-status-badge label="Transferable" type="warning" />
+                        @php
+                            $exportTooltip = $exportId ? "Export ID: {$exportId}" : null;
+                        @endphp
+                        @if (data_get($this->migration, 'status') === 'running')
+                            <x-status-badge label="Transferring" type="warning" :data-tooltip="$exportTooltip" />
                         @elseif ($server->isTransferredAway())
-                            <x-status-badge label="Transferred away" type="warning" />
+                            <x-status-badge label="Transferred away" type="warning" :data-tooltip="$exportTooltip" />
                         @else
-                            <x-status-badge label="Managed here" type="success" />
-                        @endif
-                        @if ($exportId)
-                            <span class="text-[11px] text-neutral-500 dark:text-fg-faint">export {{ $exportId }}</span>
+                            <x-status-badge label="Managed here" type="success" :data-tooltip="$exportTooltip" />
                         @endif
                     </x-slot:actions>
 
                     <div class="flex flex-col gap-4">
+                        @if ($server->isTransferredAway())
+                            <div>
+                                <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Transfer back</h3>
+                                <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
+                                    Undo the transfer. The instance that manages the server now transfers it back here,
+                                    with all changes made there. This archive is replaced only when the import here
+                                    succeeds. If the other instance is lost, use Enable management on the server page.
+                                </p>
+                            </div>
+                            <div class="flex flex-col gap-3 md:max-w-xl">
+                                <x-forms.input id="managerUrl" label="Instance that manages the server now" required
+                                    placeholder="https://coolify.example.com"
+                                    helper="The Coolify instance that this server was transferred to." />
+                                <x-forms.input id="managerToken" type="password" label="API token of that instance" required
+                                    placeholder="Paste token from that instance" autocomplete="off"
+                                    helper="A token with root, or with read:sensitive and write, from an admin or owner of that instance." />
+                                <x-forms.input id="thisInstanceUrl" label="URL of this instance" required
+                                    helper="The URL at which the other instance reaches this instance. This instance gives it a token that expires in 3 hours." />
+                            </div>
+                            <div>
+                                <x-modal-confirmation title="Transfer this server back?" submitAction="transferBack"
+                                    :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Transfer back"
+                                    :actions="[
+                                        'The other instance checks the server, this instance, and the tokens. If a check fails, nothing changes.',
+                                        'The other instance transfers the server, its resources, and its credentials back here.',
+                                        'This archive is replaced by the transferred server, and the other instance keeps an archive.',
+                                    ]">
+                                    <x-slot:trigger>
+                                        <x-forms.button canGate="update" :canResource="$server" wire:loading.attr="disabled"
+                                            wire:target="transferBack">
+                                            <span wire:loading.remove wire:target="transferBack">Transfer back</span>
+                                            <span wire:loading wire:target="transferBack">Running checks…</span>
+                                        </x-forms.button>
+                                    </x-slot:trigger>
+                                </x-modal-confirmation>
+                            </div>
+                            @if ($transferBackAt = data_get($server->server_metadata, 'transfer.transfer_back.requested_at'))
+                                <x-callout type="info" title="Transfer back started">
+                                    {{ data_get($server->server_metadata, 'transfer.transfer_back.from') }} started the transfer back at
+                                    {{ \Illuminate\Support\Carbon::parse($transferBackAt)->format('H:i') }}. Reload this page in a minute.
+                                    When the transfer finishes, this instance manages the server again. If it does not, read
+                                    the transfer log of the server on the other instance.
+                                </x-callout>
+                            @endif
+                        @else
                         <div>
                             <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Transfer to another instance
                             </h3>
@@ -45,16 +90,17 @@
                         </div>
                         <div class="flex flex-col gap-3 md:max-w-xl">
                             <x-forms.input id="targetUrl" label="Target instance URL" required
-                                placeholder="http://localhost:8001"
-                                helper="Base URL of the other Coolify instance (no trailing path)." />
+                                placeholder="https://coolify.example.com"
+                                helper="Base URL of the other Coolify instance (no trailing path). It must use https." />
                             <x-forms.input id="targetToken" type="password" label="Target API token" required
                                 placeholder="Paste token from target instance" autocomplete="off"
-                                helper="Create a token on the target with root (or write + create servers). It is only used for this request." />
+                                helper="Create a token on the target with root (or write + deploy). It is only used for this request." />
                         </div>
                         <div>
                             <x-modal-confirmation title="Transfer this server?" submitAction="migrateServer"
                                 :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Transfer server"
                                 :actions="[
+                                    'Coolify first checks this server, the target instance, and the token. If a check fails, nothing is changed.',
                                     'The server will be transferred to the target instance.',
                                     'Automations for this server will be disabled on this instance.',
                                 ]">
@@ -62,11 +108,83 @@
                                     <x-forms.button canGate="update" :canResource="$server" wire:loading.attr="disabled"
                                         wire:target="migrateServer">
                                         <span wire:loading.remove wire:target="migrateServer">Transfer server</span>
-                                        <span wire:loading wire:target="migrateServer">Transferring…</span>
+                                        <span wire:loading wire:target="migrateServer">Running checks…</span>
                                     </x-forms.button>
                                 </x-slot:trigger>
                             </x-modal-confirmation>
                         </div>
+                        @endif
+                        @php $migration = $this->migration; @endphp
+                        @if (data_get($migration, 'status') === 'running')
+                            <div wire:poll.5s="refreshMigration">
+                                <x-callout type="info" title="Transfer in progress">
+                                    The server is being transferred to {{ data_get($migration, 'target_url') }}. You can
+                                    leave this page; the transfer continues in the background.
+                                </x-callout>
+                            </div>
+                        @elseif (data_get($migration, 'status') === 'failed')
+                            <x-callout type="danger"
+                                :title="data_get($migration, 'phase') === 'checks' ? 'A check failed. The transfer did not start.' : 'Transfer failed'">
+                                @if (count((array) data_get($migration, 'log', [])) > 0)
+                                    See the transfer log below for details.
+                                @else
+                                    {{ data_get($migration, 'error') }}
+                                @endif
+                            </x-callout>
+                        @elseif (data_get($migration, 'status') === 'unknown')
+                            <x-callout type="warning" title="Transfer result unknown">
+                                The transfer stopped before this instance could confirm the result. Check whether
+                                {{ data_get($migration, 'target_url') }} manages this server. If it does, call
+                                <code>POST /api/v1/servers/{{ $server->uuid }}/transfer/complete</code> on this instance.
+                                If it does not, transfer again.
+                            </x-callout>
+                        @elseif (data_get($migration, 'status') === 'succeeded')
+                            <x-callout type="success" title="Transfer finished">
+                                {{ data_get($migration, 'target_url') }} now manages this server. Automations are
+                                disabled on this instance.
+                            </x-callout>
+                            @php $checklist = $this->postTransferChecklist; @endphp
+                            @if (count($checklist) > 0 || data_get($migration, 'target_server_url'))
+                                <div data-testid="post-transfer-checklist">
+                                    <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Finish the transfer on the target</h3>
+                                    <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
+                                        The target shows these steps on the server page, checks them where it can, and keeps
+                                        their state.
+                                        @if ($targetServerUrl = data_get($migration, 'target_server_url'))
+                                            <a href="{{ $targetServerUrl }}" target="_blank" rel="noopener noreferrer"
+                                                class="underline">Open the server on the target</a>.
+                                        @endif
+                                    </p>
+                                    @if (count($checklist) > 0)
+                                        <ul class="mt-2 list-disc space-y-1 pl-5 text-xs leading-5 text-neutral-600 dark:text-fg-dim">
+                                            @foreach ($checklist as $step)
+                                                <li wire:key="post-transfer-step-{{ hash('xxh128', $step) }}">{{ $step }}</li>
+                                            @endforeach
+                                        </ul>
+                                    @endif
+                                </div>
+                            @endif
+                        @endif
+                        @if (count((array) data_get($migration, 'log', [])) > 0)
+                            <div>
+                                <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Transfer log</h3>
+                                <ol class="mt-2 flex flex-col gap-1 rounded-lg border border-neutral-200 bg-neutral-50 p-3 font-mono text-xs dark:border-coolgray-300 dark:bg-coolgray-100"
+                                    data-testid="transfer-log">
+                                    @foreach ((array) data_get($migration, 'log', []) as $entry)
+                                        <li wire:key="transfer-log-{{ $loop->index }}-{{ data_get($entry, 'at') }}" @class([
+                                            'flex gap-3',
+                                            'text-success' => data_get($entry, 'level') === 'success',
+                                            'text-error' => data_get($entry, 'level') === 'error',
+                                            'text-warning' => data_get($entry, 'level') === 'warning',
+                                            'text-neutral-600 dark:text-fg-dim' => data_get($entry, 'level') === 'info',
+                                        ])>
+                                            <span class="shrink-0 text-neutral-400">{{ \Illuminate\Support\Carbon::parse(data_get($entry, 'at'))->format('H:i:s') }}</span>
+                                            <span class="break-words">{{ data_get($entry, 'message') }}</span>
+                                        </li>
+                                    @endforeach
+                                </ol>
+                            </div>
+                        @endif
                         @if (count($lastWarnings) > 0)
                             <x-callout type="warning" title="Warnings">
                                 <ul class="mt-2 list-disc space-y-1 pl-5 text-sm">
@@ -76,41 +194,9 @@
                                 </ul>
                             </x-callout>
                         @endif
-                        @if ($lastResultJson)
-                            <div>
-                                <div class="mb-1 text-sm font-semibold">Result</div>
-                                <pre
-                                    class="max-h-64 overflow-auto rounded-lg bg-neutral-100 p-3 text-xs dark:bg-coolgray-100">{{ $lastResultJson }}</pre>
-                            </div>
-                        @endif
                     </div>
                 </x-application.settings-section>
 
-                <x-application.settings-section id="server-transfer-manual-section" title="Manual transfer"
-                    helper="Download the server as a file, for example when the instances cannot reach each other.">
-                    <div class="flex flex-col gap-4">
-                        <p class="text-xs leading-5 text-neutral-500 dark:text-fg-dim">
-                            Import the file on the target via Servers → Import server, then click Disable management
-                            on this server.
-                        </p>
-                        <div class="flex flex-col gap-3 md:max-w-xl">
-                            <x-forms.input id="passphrase" type="password" label="Passphrase"
-                                placeholder="Optional"
-                                helper="If you set a passphrase, the file is encrypted with it. You need the same passphrase to import the file."
-                                autocomplete="new-password" />
-                        </div>
-                        <div class="flex flex-wrap gap-2">
-                            <x-forms.button canGate="view" :canResource="$server" wire:click="exportBundle"
-                                wire:loading.attr="disabled">
-                                <span wire:loading.remove wire:target="exportBundle">Download JSON</span>
-                                <span wire:loading wire:target="exportBundle">Exporting…</span>
-                            </x-forms.button>
-                            <a href="{{ route('server.transfer.import') }}" {{ wireNavigate() }} class="button">
-                                Import page (this instance)
-                            </a>
-                        </div>
-                    </div>
-                </x-application.settings-section>
             @endif
         </div>
     </div>
diff --git a/resources/views/livewire/settings-backup.blade.php b/resources/views/livewire/settings-backup.blade.php
index 1d4bc85e13..93c2269d65 100644
--- a/resources/views/livewire/settings-backup.blade.php
+++ b/resources/views/livewire/settings-backup.blade.php
@@ -8,7 +8,8 @@
         @if ($server->isFunctional())
             @if (isset($database) && isset($backup))
                 <form wire:submit="submit">
-                    <x-unsaved-bar action="submit" />
+                    {{-- Exclude is_backup_before_update_enabled (instantSave) so the bar does not flash. --}}
+                    <x-unsaved-bar action="submit" targets="description" />
 
                     <x-application.settings-section title="Instance database">
                         <div class="grid gap-4 lg:grid-cols-2">
@@ -25,6 +26,18 @@
                 <livewire:project.database.backup-edit :backup="$backup" :available-s3-storages="$s3s"
                     :status="data_get($database, 'status')" />
 
+                <x-application.settings-section title="Backup before update"
+                    description="Back up the Coolify database before an update is installed. If the backup fails, the update is not installed.">
+                    <div class="max-w-md">
+                        <x-forms.listbox id="is_backup_before_update_enabled" label="Database backup"
+                            onChange="instantSave" :options="[
+                                ['value' => true, 'label' => 'Enabled'],
+                                ['value' => false, 'label' => 'Disabled'],
+                            ]"
+                            helper="Runs this backup once before every manual or automatic update, in addition to the schedule." />
+                    </div>
+                </x-application.settings-section>
+
                 <livewire:project.database.backup-executions :backup="$backup" />
             @else
                 <x-application.settings-section title="Instance backup">
diff --git a/resources/views/livewire/settings-oauth.blade.php b/resources/views/livewire/settings-oauth.blade.php
index 1f35c83555..ee957bd461 100644
--- a/resources/views/livewire/settings-oauth.blade.php
+++ b/resources/views/livewire/settings-oauth.blade.php
@@ -13,8 +13,10 @@
                         <a href="#{{ $provider }}-oauth-section" class="menu-item min-h-8! py-1! text-[12px]!"
                             :class="{ 'menu-item-active': activeProvider === '{{ $provider }}' }"
                             @click.prevent="activeProvider = '{{ $provider }}'; history.replaceState(null, '', '#{{ $provider }}-oauth-section'); window.scrollToSettingsSection?.('{{ $provider }}-oauth-section')">
-                            <span class="menu-item-icon bg-current"
-                                style="mask: url('{{ asset('svgs/' . $provider . '.svg') }}') center / contain no-repeat; -webkit-mask: url('{{ asset('svgs/' . $provider . '.svg') }}') center / contain no-repeat;"></span>
+                            <span class="menu-item-icon shrink-0">
+                                <span class="block size-4 bg-current"
+                                    style="mask: url('{{ asset('svgs/' . $provider . '.svg') }}') center / contain no-repeat; -webkit-mask: url('{{ asset('svgs/' . $provider . '.svg') }}') center / contain no-repeat;"></span>
+                            </span>
                             <span class="menu-item-label">{{ $oauth_setting['label'] }}</span>
                         </a>
                     @endforeach
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index dc18b41010..52e26ce9a9 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -32,6 +32,12 @@
                             ['value' => false, 'label' => 'Require two-step confirmation'],
                             ['value' => true, 'label' => 'Skip two-step confirmation'],
                         ]" />
+                    <x-forms.listbox canGate="update" :canResource="$settings" id="is_passkey_enabled" label="Passkeys"
+                        helper="Let users sign in with a passkey. Passkeys need an HTTPS instance URL. Stored passkeys are kept when this is disabled."
+                        onChange="instantSave" :options="[
+                            ['value' => true, 'label' => 'Enabled'],
+                            ['value' => false, 'label' => 'Disabled'],
+                        ]" />
                 </div>
             </x-application.settings-section>
 
@@ -168,6 +174,22 @@
                     </x-callout>
                 @endif
             </x-application.settings-section>
+
+            <x-application.settings-section id="file-download-storage-section" title="File downloads"
+                helper="Choose how files from the container file browser and backups are downloaded. Streaming sends each file through this Coolify instance (file browser: up to 1 GB). With S3, the server uploads the file to the bucket and the browser downloads it from S3, up to 5 GB; larger backups are streamed. S3 download links expire after 15 minutes, and the files are deleted after 6 hours.">
+                <div class="flex max-w-md flex-col gap-4">
+                    <x-forms.listbox id="file_download_storage" label="Download method" onChange="instantSave"
+                        :options="[
+                            ['value' => 'stream', 'label' => 'Stream through Coolify'],
+                            ...array_values(array_filter($avatar_storage_options, fn ($option) => $option['value'] !== 'local')),
+                        ]" />
+                </div>
+                <x-callout type="info" title="Bucket auto-delete rule" class="mt-4">
+                    When you select an S3 storage, Coolify adds a lifecycle rule that deletes objects under
+                    <span class="font-mono">coolify-file-downloads/</span> after 1 day, as a safety net. The selected
+                    storage must be reachable from your servers, and the S3 provider must support lifecycle rules.
+                </x-callout>
+            </x-application.settings-section>
         </form>
     </x-settings.layout>
 </div>
diff --git a/resources/views/livewire/settings/index.blade.php b/resources/views/livewire/settings/index.blade.php
index 6815fb9ee9..963c8d1070 100644
--- a/resources/views/livewire/settings/index.blade.php
+++ b/resources/views/livewire/settings/index.blade.php
@@ -15,7 +15,7 @@
                         'lg:col-span-2' => !str_starts_with(strtolower($fqdn ?? ''), 'https://'),
                     ])>
                         <x-forms.input canGate="update" :canResource="$settings" id="fqdn" label="URL"
-                            helper="Enter the full URL of the instance (for example, https://dashboard.example.com).<br><br><span class='text-coollabs dark:text-warning'>Important:</span> Include <b>https://</b> to secure the dashboard with HTTPS."
+                            helper="Enter the full URL of the instance (for example, https://dashboard.example.com).<br><br><span class='text-coollabs dark:text-warning'>Important:</span> Include <b>https://</b> to secure the dashboard with HTTPS.<br><br>Passkeys are tied to this domain. If you change it, users must add their passkeys again."
                             placeholder="https://coolify.yourdomain.com" />
                     </div>
 
diff --git a/resources/views/livewire/settings/updates.blade.php b/resources/views/livewire/settings/updates.blade.php
index aaea04e655..73ebedac72 100644
--- a/resources/views/livewire/settings/updates.blade.php
+++ b/resources/views/livewire/settings/updates.blade.php
@@ -8,25 +8,26 @@
             {{-- Exclude is_auto_update_enabled (instantSave) so the bar does not flash. --}}
             <x-unsaved-bar action="submit" targets="update_check_frequency,auto_update_frequency" />
 
-            <x-application.settings-section title="Update Coolify"
+            <x-application.settings-section title="Updates"
                 helper="Install the latest Coolify version manually when an update is available.">
-                <livewire:upgrade :full-button="true" key="settings-upgrade" />
-            </x-application.settings-section>
-
-            <x-application.settings-section title="Update checks">
                 <x-slot:actions>
+                    <livewire:upgrade :full-button="true" key="settings-upgrade" />
                     <x-forms.button type="button" wire:click="checkManually">
                         <x-reicon name="refresh" class="size-3.5" />
                         Check now
                     </x-forms.button>
                 </x-slot:actions>
-                <x-forms.input required id="update_check_frequency" label="Check frequency"
-                    placeholder="0 * * * *"
-                    helper="A cron expression or preset such as hourly, daily, weekly, monthly, or yearly." />
-            </x-application.settings-section>
-
-            <x-application.settings-section title="Automatic updates">
                 <div class="grid gap-4 lg:grid-cols-2">
+                    <x-forms.input required id="update_check_frequency" label="Check frequency"
+                        placeholder="0 * * * *"
+                        helper="A cron expression or preset such as hourly, daily, weekly, monthly, or yearly." />
+
+                    <x-forms.listbox id="docker_registry_url" label="Docker registry" :options="[
+                        ['value' => 'docker.io', 'label' => 'Docker Hub'],
+                        ['value' => 'ghcr.io', 'label' => 'GitHub Container Registry'],
+                    ]"
+                        helper="Switch registries if the current source is rate limited." />
+
                     @if (!is_null(config('constants.coolify.autoupdate', null)))
                         <x-forms.listbox disabled id="is_auto_update_enabled" label="Automatic updates"
                             helper="Controlled by the AUTOUPDATE environment variable." :options="[
@@ -50,16 +51,6 @@
                     @endif
                 </div>
             </x-application.settings-section>
-
-            <x-application.settings-section title="Image registry">
-                <div class="max-w-md">
-                    <x-forms.listbox id="docker_registry_url" label="Docker registry" :options="[
-                        ['value' => 'docker.io', 'label' => 'Docker Hub'],
-                        ['value' => 'ghcr.io', 'label' => 'GitHub Container Registry'],
-                    ]"
-                        helper="Switch registries if the current source is rate limited." />
-                </div>
-            </x-application.settings-section>
         </form>
     </x-settings.layout>
 </div>
diff --git a/resources/views/livewire/shared-variables/canvas.blade.php b/resources/views/livewire/shared-variables/canvas.blade.php
new file mode 100644
index 0000000000..d01113327e
--- /dev/null
+++ b/resources/views/livewire/shared-variables/canvas.blade.php
@@ -0,0 +1,31 @@
+<div class="flex h-full flex-col">
+    <x-slot:title>
+        {{ str($scope)->headline() }} Variables > Canvas | Coolify
+    </x-slot>
+    {{-- Page search items; the menu is in the main sidebar. --}}
+    <x-shared-variables.sidebar />
+    <div data-environment-canvas data-mode="variables" data-endpoint="{{ $endpoint }}"
+        data-team="{{ $teamId }}" data-user="{{ auth()->id() }}"
+        class="relative min-h-0 flex-1" wire:ignore>
+        {{-- The canvas moves this group into its toolbar (page actions last, at the right end),
+             which can be outside this component,
+             so the button opens the modal below with a window event. --}}
+        <div data-ec-views class="flex items-center gap-2">
+            <x-canvas-view-toggle on-canvas :views="['list' => ['List view', 'unordered-list']]"
+                :list-url="$listUrl" :canvas-url="url()->current()" />
+            @if ($canAddVariables)
+                <button type="button" x-data x-on:click="$dispatch('open-new-shared-variable')"
+                    class="button button-highlighted whitespace-nowrap">
+                    <x-reicon name="plus" class="size-3.5" />
+                    Add variable
+                </button>
+            @endif
+        </div>
+    </div>
+    @if ($canAddVariables)
+        <x-modal-input title="New Shared Variable" x-on:open-new-shared-variable.window="modalOpen = true">
+            <x-slot:content></x-slot:content>
+            <livewire:project.shared.environment-variable.add :shared="true" />
+        </x-modal-input>
+    @endif
+</div>
diff --git a/resources/views/livewire/shared-variables/index.blade.php b/resources/views/livewire/shared-variables/index.blade.php
index 4cf74d6c8a..25baec1002 100644
--- a/resources/views/livewire/shared-variables/index.blade.php
+++ b/resources/views/livewire/shared-variables/index.blade.php
@@ -3,66 +3,114 @@
         Shared Variables | Coolify
     </x-slot>
 
+    @php
+        $scopeCards = [
+            'team' => ['Team wide', 'teams', route('shared-variables.team.index'), 'Every resource of this team.', null],
+            'project' => ['Project wide', 'projects', route('shared-variables.project.index'), 'Every environment of a project.', 'project'],
+            'environment' => ['Environment wide', 'layers', route('shared-variables.environment.index'), 'Resources in one environment.', 'environment'],
+            'server' => ['Server wide', 'servers', route('shared-variables.server.index'), 'Resources deployed on one server.', 'server'],
+        ];
+        $panel = 'rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]';
+        $panelTitle = 'flex items-center justify-between gap-2 border-b border-neutral-200 px-3 py-2.5 text-[12px] font-semibold text-black dark:border-white/[0.06] dark:text-fg';
+        $row = 'flex items-center gap-2 border-b border-neutral-100 px-3 py-2 last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.04] dark:hover:bg-white/[0.03]';
+        $scopeBadge = 'shrink-0 rounded-full border border-neutral-200 bg-neutral-50 px-1.5 text-[10px] leading-4 font-medium text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim';
+    @endphp
+
     <x-shared-variables.layout>
+        <div class="flex w-full flex-col gap-4">
+            {{-- Scopes, with how many variables each has and on how many owners. --}}
+            <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
+                @foreach ($scopeCards as $scope => [$label, $icon, $href, $description, $ownerNoun])
+                    @php $counts = $overview['scopes'][$scope]; @endphp
+                    <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
+                        href="{{ $href }}" {{ wireNavigate() }}>
+                        <div class="flex items-start justify-between gap-2">
+                            <div
+                                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+                                <x-reicon :name="$icon" class="size-4" />
+                            </div>
+                            <span class="text-[22px] leading-7 font-semibold tabular-nums text-black dark:text-fg">{{ $counts['variables'] }}</span>
+                        </div>
+                        <div class="mt-auto pt-5">
+                            <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">{{ $label }}</h2>
+                            <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
+                                @if ($ownerNoun && $counts['variables'] > 0)
+                                    {{ str('variable')->plural($counts['variables']) }} on {{ $counts['owners'] }} {{ str($ownerNoun)->plural($counts['owners']) }}.
+                                @else
+                                    {{ $description }}
+                                @endif
+                            </p>
+                        </div>
+                    </a>
+                @endforeach
+            </div>
 
-    <div class="w-full">
-    <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
-            href="{{ route('shared-variables.team.index') }}" {{ wireNavigate() }}>
-            <div
-                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                <x-reicon name="teams" class="size-4" />
-            </div>
-            <div class="mt-auto pt-5">
-                <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">Team wide</h2>
-                <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
-                    Available to every resource owned by this team.
-                </p>
-            </div>
-        </a>
+            @if ($overview['missing'] > 0)
+                <div class="flex items-start gap-2 rounded-xl border border-warning/30 bg-warning/10 px-3 py-2.5 text-[12px] text-neutral-700 dark:text-fg-dim" role="note">
+                    <x-reicon name="alert-triangle" class="mt-px size-4 shrink-0 text-warning" />
+                    <p>
+                        {{ $overview['missing'] }} {{ str('reference')->plural($overview['missing']) }} in resource variables
+                        {{ $overview['missing'] === 1 ? 'points' : 'point' }} to a shared variable that does not exist. Open a scope canvas to find
+                        {{ $overview['missing'] === 1 ? 'it' : 'them' }}.
+                    </p>
+                </div>
+            @endif
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
-            href="{{ route('shared-variables.project.index') }}" {{ wireNavigate() }}>
-            <div
-                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                <x-reicon name="projects" class="size-4" />
-            </div>
-            <div class="mt-auto pt-5">
-                <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">Project wide</h2>
-                <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
-                    Shared by every environment inside a project.
-                </p>
-            </div>
-        </a>
+            <div class="grid grid-cols-1 gap-3 lg:grid-cols-3">
+                {{-- Most used: links open the variable on its scope canvas. --}}
+                <section class="{{ $panel }}">
+                    <h2 class="{{ $panelTitle }}">Most used</h2>
+                    @forelse ($overview['used'] as $variable)
+                        <a class="{{ $row }}" href="{{ $variable['link'] }}" {{ wireNavigate() }}>
+                            <span class="min-w-0 flex-1">
+                                <span class="block truncate font-mono text-[12px] text-black dark:text-fg">{{ $variable['key'] }}</span>
+                                <span class="block truncate text-[11px] text-neutral-500 dark:text-fg-faint">{{ $variable['owner'] }}</span>
+                            </span>
+                            <span class="shrink-0 text-[11px] text-neutral-500 tabular-nums dark:text-fg-dim">
+                                {{ $variable['resources'] }} {{ str('resource')->plural($variable['resources']) }}
+                            </span>
+                        </a>
+                    @empty
+                        <p class="px-3 py-4 text-[12px] text-neutral-500 dark:text-fg-faint">No resource uses a shared variable yet.</p>
+                    @endforelse
+                </section>
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
-            href="{{ route('shared-variables.environment.index') }}" {{ wireNavigate() }}>
-            <div
-                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                <x-reicon name="layers" class="size-4" />
-            </div>
-            <div class="mt-auto pt-5">
-                <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">Environment wide</h2>
-                <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
-                    Reused by resources in one environment.
-                </p>
-            </div>
-        </a>
+                <section class="{{ $panel }}">
+                    <h2 class="{{ $panelTitle }}">Recently changed</h2>
+                    @forelse ($overview['recent'] as $variable)
+                        <a class="{{ $row }}" href="{{ $variable['link'] }}" {{ wireNavigate() }}>
+                            <span class="min-w-0 flex-1">
+                                <span class="block truncate font-mono text-[12px] text-black dark:text-fg">{{ $variable['key'] }}</span>
+                                <span class="block truncate text-[11px] text-neutral-500 dark:text-fg-faint">{{ $variable['owner'] }}</span>
+                            </span>
+                            <span class="shrink-0 text-[11px] text-neutral-500 dark:text-fg-dim">{{ $variable['updated_at']?->diffForHumans(short: true) }}</span>
+                        </a>
+                    @empty
+                        <p class="px-3 py-4 text-[12px] text-neutral-500 dark:text-fg-faint">No shared variables yet.</p>
+                    @endforelse
+                </section>
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
-            href="{{ route('shared-variables.server.index') }}" {{ wireNavigate() }}>
-            <div
-                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                <x-reicon name="servers" class="size-4" />
+                {{-- Not referenced by any resource: candidates to use or to clean up. --}}
+                <section class="{{ $panel }}">
+                    <h2 class="{{ $panelTitle }}">
+                        Not used
+                        <span class="text-[11px] font-normal text-neutral-400 tabular-nums dark:text-fg-faint">{{ $overview['unused']->count() }}</span>
+                    </h2>
+                    <div class="max-h-72 overflow-y-auto">
+                        @forelse ($overview['unused'] as $variable)
+                            <a class="{{ $row }}" href="{{ $variable['link'] }}" {{ wireNavigate() }}>
+                                <span class="min-w-0 flex-1">
+                                    <span class="block truncate font-mono text-[12px] text-black dark:text-fg">{{ $variable['key'] }}</span>
+                                    <span class="block truncate text-[11px] text-neutral-500 dark:text-fg-faint">{{ $variable['owner'] }}</span>
+                                </span>
+                                <span class="{{ $scopeBadge }}">{{ str($variable['scope'])->headline() }}</span>
+                            </a>
+                        @empty
+                            <p class="px-3 py-4 text-[12px] text-neutral-500 dark:text-fg-faint">Every shared variable is in use.</p>
+                        @endforelse
+                    </div>
+                </section>
             </div>
-            <div class="mt-auto pt-5">
-                <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">Server wide</h2>
-                <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
-                    Available to resources deployed on one server.
-                </p>
-            </div>
-        </a>
-    </div>
-    </div>
+        </div>
     </x-shared-variables.layout>
 </div>
diff --git a/resources/views/livewire/shared/list-search-controls.blade.php b/resources/views/livewire/shared/list-search-controls.blade.php
index d14ddc8f4b..1a99c6352e 100644
--- a/resources/views/livewire/shared/list-search-controls.blade.php
+++ b/resources/views/livewire/shared/list-search-controls.blade.php
@@ -4,11 +4,5 @@
             clear-when="search" clear-action="search = ''"
             class="h-8! rounded-lg! border-neutral-200! bg-white! py-0! pr-8! text-[12px]! shadow-none! placeholder:text-neutral-400 focus:border-accent! focus:ring-0! dark:border-white/[0.08]! dark:bg-white/[0.035]! dark:text-fg! dark:placeholder:text-fg-faint" />
     </div>
-    <div class="flex items-center gap-3">
-        <span class="text-[11px] text-neutral-500 dark:text-fg-faint"><span x-text="filteredItems.length"></span> <span x-text="filteredItems.length === 1 ? '{{ $singular }}' : '{{ $plural }}'"></span></span>
-        <div class="view-toggle">
-            <button type="button" x-on:click="setViewMode('table')" class="flex size-7.5 items-center justify-center rounded-md transition-colors" :class="viewMode === 'table' ? 'control-selected' : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'" aria-label="Table view"><x-reicon name="unordered-list" class="size-3.5" /></button>
-            <button type="button" x-on:click="setViewMode('grid')" class="flex size-7.5 items-center justify-center rounded-md transition-colors" :class="viewMode === 'grid' ? 'control-selected' : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'" aria-label="Grid view"><x-reicon name="grid" class="size-3.5" /></button>
-        </div>
-    </div>
+    <x-canvas-view-toggle />
 </div>
diff --git a/resources/views/livewire/source/gitea/change.blade.php b/resources/views/livewire/source/gitea/change.blade.php
new file mode 100644
index 0000000000..a59fb7abf4
--- /dev/null
+++ b/resources/views/livewire/source/gitea/change.blade.php
@@ -0,0 +1,306 @@
+<div>
+    <x-slot:title>
+        {{ $name ?: 'Gitea App' }} | Sources | Coolify
+    </x-slot>
+
+    @if ($isConnected)
+        <header class="mb-5 flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between">
+            <div class="min-w-0">
+                <div class="flex flex-wrap items-center gap-2">
+                    <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">
+                        {{ $name ?: 'Gitea App' }}
+                    </h1>
+                    <x-status-badge label="Connected" type="success" />
+                </div>
+                <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                    {{ filled($organization) ? 'Gitea App for '.$organization : 'Private Gitea source' }}
+                </p>
+            </div>
+            <div class="flex shrink-0 flex-wrap items-center gap-2 sm:ml-auto">
+                @can('view', $gitea_app)
+                    <x-forms.button type="button" wire:click.prevent="testConnection">
+                        Test connection
+                    </x-forms.button>
+                @endcan
+                @can('delete', $gitea_app)
+                    <x-modal-confirmation title="Confirm Gitea App Deletion?" isErrorButton buttonTitle="Delete"
+                        submitAction="delete" :actions="['The selected Gitea App will be permanently deleted.']"
+                        confirmationText="{{ data_get($gitea_app, 'name') }}"
+                        confirmationLabel="Please confirm by entering the Gitea App Name below"
+                        shortConfirmationLabel="Gitea App Name" :confirmWithPassword="false"
+                        step2ButtonText="Permanently Delete" />
+                @endcan
+            </div>
+        </header>
+
+        <form wire:submit="submit" class="application-settings-form">
+            <x-unsaved-bar action="submit" />
+
+            <x-application.settings-section title="General"
+                description="Connection and authentication settings for this private Gitea source.">
+                <div class="grid gap-4 lg:grid-cols-2">
+                    <x-forms.input canGate="update" :canResource="$gitea_app" id="name" label="Name" />
+
+                    @if (! isCloud())
+                        <div class="lg:col-span-2 max-w-xs">
+                            <x-forms.checkbox canGate="update" :canResource="$gitea_app" label="System wide"
+                                helper="If checked, this Gitea App will be available for everyone in this Coolify instance."
+                                instantSave id="isSystemWide" />
+                        </div>
+                        @if ($isSystemWide)
+                            <div class="lg:col-span-2">
+                                <x-callout type="warning" title="Shared with every team">
+                                    System-wide Gitea Apps are shared across all teams on this Coolify instance. Prefer team-specific apps when you need repository isolation.
+                                </x-callout>
+                            </div>
+                        @endif
+                    @endif
+                </div>
+            </x-application.settings-section>
+
+            <x-application.settings-section title="OAuth credentials"
+                description="Client credentials from your Gitea OAuth2 application.">
+                <div class="grid gap-4 lg:grid-cols-2">
+                    <x-forms.input canGate="update" :canResource="$gitea_app" id="clientId"
+                        label="Client ID" />
+                    <x-forms.input canGate="update" :canResource="$gitea_app" id="clientSecretInput"
+                        label="Client secret" type="password"
+                        helper="Stored encrypted. Leave empty to keep the existing secret." />
+                    <x-forms.input canGate="update" :canResource="$gitea_app" id="organization" label="Organization"
+                        helper="Comma-separated organization or user names to filter visible repositories." />
+                </div>
+            </x-application.settings-section>
+
+            <x-application.settings-section title="Self-hosted / advanced"
+                description="Override endpoints and SSH settings for self-hosted Gitea.">
+                <div class="grid gap-4 lg:grid-cols-2">
+                    <x-forms.input canGate="update" :canResource="$gitea_app" id="htmlUrl"
+                        label="Gitea URL" />
+                    <x-forms.input canGate="update" :canResource="$gitea_app" id="apiUrl" label="API URL" />
+                    <x-forms.input canGate="update" :canResource="$gitea_app" id="customUser"
+                        label="SSH user" />
+                    <x-forms.input canGate="update" :canResource="$gitea_app" type="number" id="customPort"
+                        label="SSH port" />
+                    <div class="lg:col-span-2">
+                        <x-forms.listbox canGate="update" :canResource="$gitea_app" id="privateKeyId" label="SSH private key (optional)"
+                            :options="collect($privateKeys)->map(fn ($key) => [
+                                'value' => $key->id,
+                                'label' => $key->name,
+                            ])->prepend(['value' => null, 'label' => 'None'])->values()->all()"
+                            :disabled="! auth()->user()->can('update', $gitea_app)" />
+                    </div>
+                </div>
+            </x-application.settings-section>
+
+            <x-application.settings-section title="Webhook"
+                description="Configure this webhook URL in Gitea (user, organization, or repository settings → Webhooks → Add webhook → Gitea).">
+                <div class="grid gap-4 lg:grid-cols-2">
+                    <div class="lg:col-span-2">
+                        <x-forms.input readonly label="Webhook URL"
+                            value="{{ rtrim($this->resolvePublicBaseUrl(), '/') }}/webhooks/source/gitea/events" />
+                    </div>
+                    <x-forms.input canGate="update" :canResource="$gitea_app" id="webhookSecret"
+                        label="Webhook secret" type="password"
+                        helper="Set this as the Secret in a Gitea webhook (user, organization, or repository settings → Webhooks → Add webhook → Gitea), content type application/json, trigger on Push and Pull Request events. Stored encrypted." />
+                </div>
+            </x-application.settings-section>
+        </form>
+
+        <div x-data="{ search: '' }" class="application-settings-form mt-6">
+            <x-application.settings-section title="Resources"
+                description="Applications currently using this Gitea App." flush>
+                @if ($applications->isEmpty())
+                    <x-empty title="No resources use this source"
+                        description="Applications will appear here after this Gitea App is selected as their source."
+                        icon-name="sources" size="sm" />
+                @else
+                    <div class="border-b border-neutral-200 p-3 dark:border-white/[0.08]">
+                        <div class="relative w-full max-w-sm">
+                            <x-reicon name="search"
+                                class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                            <input x-model.debounce.150ms="search" type="search" placeholder="Search resources"
+                                class="h-8! w-full rounded-lg! border-neutral-200! bg-white! py-0! pr-3! pl-8! text-[12px]! shadow-none! placeholder:text-neutral-400 focus:border-accent! focus:ring-0! dark:border-white/[0.08]! dark:bg-white/[0.035]! dark:text-fg! dark:placeholder:text-fg-faint">
+                        </div>
+                    </div>
+                    <div class="overflow-x-auto">
+                        <div
+                            class="grid min-w-[680px] grid-cols-[minmax(10rem,.8fr)_minmax(10rem,.8fr)_minmax(12rem,1fr)_8rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
+                            <div>Project</div>
+                            <div>Environment</div>
+                            <div>Resource</div>
+                            <div>Repository</div>
+                        </div>
+                        @foreach ($applications->sortBy('name', SORT_NATURAL) as $application)
+                            @php
+                                $projectName = (string) data_get($application, 'environment.project.name');
+                                $environmentName = (string) data_get($application, 'environment.name');
+                                $resourceName = (string) $application->name;
+                                $repoLabel = $application->git_repository.':'.$application->git_branch;
+                                $searchValue = strtolower(
+                                    $projectName.' '.$environmentName.' '.$resourceName.' '.$repoLabel,
+                                );
+                            @endphp
+                            <a {{ wireNavigate() }}
+                                href="{{ route('project.application.configuration', [
+                                    'project_uuid' => data_get($application, 'environment.project.uuid'),
+                                    'environment_uuid' => data_get($application, 'environment.uuid'),
+                                    'application_uuid' => data_get($application, 'uuid'),
+                                ]) }}"
+                                x-show="search === '' || '{{ addslashes($searchValue) }}'.includes(search.toLowerCase())"
+                                class="grid min-h-13 min-w-[680px] grid-cols-[minmax(10rem,.8fr)_minmax(10rem,.8fr)_minmax(12rem,1fr)_8rem] items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
+                                <span class="truncate text-neutral-500 dark:text-fg-dim">{{ $projectName }}</span>
+                                <span class="truncate text-neutral-500 dark:text-fg-dim">{{ $environmentName }}</span>
+                                <span class="truncate font-medium text-black dark:text-fg">{{ $resourceName }}</span>
+                                <span class="truncate text-neutral-500 dark:text-fg-dim">{{ $repoLabel }}</span>
+                            </a>
+                        @endforeach
+                    </div>
+                @endif
+            </x-application.settings-section>
+        </div>
+    @else
+        <header class="mb-8 flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between">
+            <div class="min-w-0">
+                <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">
+                    {{ $name ?: 'Gitea App' }}
+                </h1>
+                <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                    Finish connecting this Gitea App before using it as a source
+                </p>
+            </div>
+            @can('delete', $gitea_app)
+                <div class="shrink-0 sm:ml-auto">
+                    <x-modal-confirmation title="Confirm Gitea App Deletion?" isErrorButton buttonTitle="Delete"
+                        submitAction="delete" :actions="['The selected Gitea App will be permanently deleted.']"
+                        confirmationText="{{ data_get($gitea_app, 'name') }}"
+                        confirmationLabel="Please confirm by entering the Gitea App Name below"
+                        shortConfirmationLabel="Gitea App Name" :confirmWithPassword="false"
+                        step2ButtonText="Permanently Delete" />
+                </div>
+            @endcan
+        </header>
+
+        <div class="application-settings-form flex flex-col gap-6"
+            x-data="{
+                webhookEndpoint: $wire.entangle('webhook_endpoint').live,
+                useCustomWebhookEndpoint: $wire.entangle('use_custom_webhook_endpoint').live,
+                customWebhookEndpoint: $wire.entangle('custom_webhook_endpoint').live,
+                redirectPath: '/webhooks/source/gitea/redirect',
+                get redirectUri() {
+                    const base = (this.useCustomWebhookEndpoint ? this.customWebhookEndpoint : this.webhookEndpoint) || '';
+                    return base ? base.replace(/\/+$/, '') + this.redirectPath : '';
+                }
+            }">
+            <x-application.settings-section title="Step 1 · Create an OAuth application"
+                description="In Gitea, open Manage OAuth2 Applications and create a new application with the redirect URI below.">
+                <div class="flex flex-col gap-3 text-[12px] leading-5 text-neutral-600 dark:text-fg-dim">
+                    <a href="{{ rtrim($htmlUrl, '/') }}/user/settings/applications" target="_blank"
+                        class="inline-flex w-fit items-center gap-1 font-medium text-black underline-offset-2 hover:underline dark:text-fg">
+                        {{ rtrim($htmlUrl, '/') }}/user/settings/applications
+                        <x-external-link />
+                    </a>
+                    <ul class="list-inside list-disc space-y-1.5">
+                        <li>
+                            Set <strong class="text-black dark:text-fg">Redirect URI</strong> to:
+                            <code class="rounded bg-neutral-100 px-1.5 py-0.5 text-[11px] dark:bg-white/[0.06]"
+                                x-text="redirectUri || @js($redirectUri)">{{ $redirectUri }}</code>
+                        </li>
+                        <li>
+                            Keep <strong class="text-black dark:text-fg">Confidential client</strong> checked
+                        </li>
+                    </ul>
+                </div>
+            </x-application.settings-section>
+
+            <form wire:submit="submit" class="contents">
+                <x-application.settings-section title="Step 2 · Enter credentials"
+                    description="Paste the Client ID and Client secret from Gitea, then save.">
+                    <x-slot:actions>
+                        <x-forms.button type="submit">Save</x-forms.button>
+                    </x-slot:actions>
+
+                    <div class="grid gap-4 lg:grid-cols-2">
+                        <x-forms.input id="name" label="Name" />
+                        <x-forms.input id="clientId" label="Client ID" required
+                            helper="The Client ID from your Gitea OAuth2 application." />
+                        <x-forms.input id="clientSecretInput" label="Client secret" type="password"
+                            :required="blank($clientSecretInput) && blank(data_get($gitea_app, 'client_secret'))"
+                            helper="The Client secret from your Gitea OAuth2 application. Saved encrypted." />
+                        <x-forms.input id="organization" label="Organization"
+                            helper="Optional. Comma-separated organization or user names to filter repositories." />
+                    </div>
+
+                    @if (! isCloud() || isDev())
+                        <div class="mt-4 grid gap-4 lg:grid-cols-2">
+                            <div class="lg:col-span-2 text-[12px] text-neutral-500 dark:text-fg-dim">
+                                Gitea will redirect back to this Coolify URL. It must match the Redirect URI on your Gitea OAuth2 application exactly.
+                            </div>
+                            <div class="lg:col-span-2 max-w-md">
+                                <x-forms.listbox id="use_custom_webhook_endpoint" label="Webhook endpoint"
+                                    :live="true" :options="[
+                                        ['value' => false, 'label' => 'Use an instance endpoint'],
+                                        ['value' => true, 'label' => 'Use a custom endpoint'],
+                                    ]"
+                                    x-model="useCustomWebhookEndpoint"
+                                    helper="Use a custom public URL when Coolify is behind a tunnel or reverse proxy." />
+                            </div>
+                            <div class="lg:col-span-2" x-show="!useCustomWebhookEndpoint">
+                                <x-forms.listbox id="webhook_endpoint" x-model="webhookEndpoint"
+                                    label="Selected endpoint"
+                                    helper="Gitea will use this endpoint unless custom mode is enabled."
+                                    :options="collect([$fqdn, $ipv4, $ipv6, config('app.url')])
+                                        ->filter()->unique()->map(fn ($endpoint) => [
+                                            'value' => $endpoint,
+                                            'label' => 'Use '.$endpoint,
+                                        ])->values()->all()" />
+                            </div>
+                            <div class="lg:col-span-2" x-cloak x-show="useCustomWebhookEndpoint">
+                                <x-forms.input x-model="customWebhookEndpoint" id="custom_webhook_endpoint"
+                                    type="url" label="Custom endpoint"
+                                    placeholder="https://coolify.example.com"
+                                    helper="Gitea will use this custom public URL. Do not include /webhooks." />
+                            </div>
+                        </div>
+                    @endif
+
+                    <div class="mt-4" x-data="{ open: false }">
+                        <button type="button" @click="open = !open"
+                            class="flex w-full items-center justify-between rounded-lg border border-neutral-200 px-3 py-2.5 text-left text-[12px] font-medium text-neutral-700 transition-colors hover:bg-neutral-50 dark:border-white/[0.08] dark:text-fg-dim dark:hover:bg-white/[0.03]">
+                            Advanced / self-hosted
+                            <svg class="size-3.5 transition-transform" :class="{ 'rotate-180': open }"
+                                viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <polyline points="6 9 12 15 18 9"></polyline>
+                            </svg>
+                        </button>
+                        <div x-cloak x-show="open" x-collapse.duration.200ms
+                            class="mt-3 grid gap-4 rounded-lg border border-neutral-200 p-3 lg:grid-cols-2 dark:border-white/[0.08]">
+                            <x-forms.input id="htmlUrl" label="Gitea URL"
+                                helper="Only change this for self-hosted Gitea (e.g. https://gitea.example.com)." />
+                            <x-forms.input id="apiUrl" label="API URL"
+                                helper="Usually your Gitea URL with /api/v1 appended." />
+                            <x-forms.input id="customUser" label="SSH user" />
+                            <x-forms.input type="number" id="customPort" label="SSH port" />
+                            @if (! isCloud())
+                                <div class="max-w-xs lg:col-span-2">
+                                    <x-forms.checkbox label="System wide" id="isSystemWide"
+                                        helper="If checked, this Gitea App will be available for everyone in this Coolify instance." />
+                                </div>
+                            @endif
+                        </div>
+                    </div>
+                </x-application.settings-section>
+            </form>
+
+            @if ($clientId)
+                <x-application.settings-section title="Step 3 · Authorize with Gitea"
+                    description="Authorize Coolify with your Gitea instance. The redirect URI must match the one configured in Gitea.">
+                    <a href="{{ $this->getOAuthUrl() }}" wire:key="oauth-url-{{ md5((string) $redirectUri) }}"
+                        class="button button-highlighted">
+                        Connect to Gitea
+                        <x-external-link />
+                    </a>
+                </x-application.settings-section>
+            @endif
+        </div>
+    @endif
+</div>
diff --git a/resources/views/livewire/source/gitea/create.blade.php b/resources/views/livewire/source/gitea/create.blade.php
new file mode 100644
index 0000000000..a605c8dd9d
--- /dev/null
+++ b/resources/views/livewire/source/gitea/create.blade.php
@@ -0,0 +1,59 @@
+@can('createAnyResource')
+    <form wire:submit="createGiteaApp" class="flex w-full flex-col gap-4">
+        <p class="text-[12px] leading-5 text-neutral-500 dark:text-fg-dim">
+            Connect a Gitea OAuth2 application for private repositories, webhooks, and deployments.
+        </p>
+
+        <div class="grid gap-4 sm:grid-cols-2">
+            <x-forms.input id="name" label="Name" required />
+            <x-forms.input id="organization" label="Organization"
+                helper="Optional. Comma-separated organization or user names to filter repositories (e.g. myorg,myuser)."
+                placeholder="All accessible repositories when empty" />
+        </div>
+
+        @if (! isCloud())
+            <div x-data="{ showWarning: @entangle('is_system_wide') }">
+                <div class="max-w-xs">
+                    <x-forms.checkbox id="is_system_wide" label="System wide"
+                        helper="If checked, this Gitea App will be available for everyone in this Coolify instance." />
+                </div>
+                <div x-cloak x-show="showWarning" x-transition class="mt-3">
+                    <x-callout type="warning" title="Shared with every team">
+                        System-wide Gitea Apps are available to every team on this instance. Prefer team-specific apps when you need repository isolation.
+                    </x-callout>
+                </div>
+            </div>
+        @endif
+
+        <div x-data="{
+            open: false,
+        }" class="rounded-lg border border-neutral-200 dark:border-white/[0.08]">
+            <button type="button" @click="open = !open"
+                class="flex w-full items-center justify-between px-3 py-2.5 text-left text-[12px] font-medium text-neutral-700 transition-colors hover:bg-neutral-50 dark:text-fg-dim dark:hover:bg-white/[0.03]">
+                Self-hosted Gitea
+                <svg class="size-3.5 transition-transform" :class="{ 'rotate-180': open }" viewBox="0 0 24 24"
+                    fill="none" stroke="currentColor" stroke-width="2">
+                    <polyline points="6 9 12 15 18 9"></polyline>
+                </svg>
+            </button>
+            <div x-cloak x-show="open" x-collapse.duration.200ms class="border-t border-neutral-200 px-3 py-3 dark:border-white/[0.08]">
+                <div class="grid gap-4 sm:grid-cols-2">
+                    <x-forms.input id="html_url" label="Gitea URL" required
+                        helper="For self-hosted Gitea, enter your instance URL (e.g. https://gitea.example.com)." />
+                    <x-forms.input id="api_url" label="API URL" required
+                        helper="Usually your Gitea URL with /api/v1 appended." />
+                    <x-forms.input id="custom_user" label="Custom Git user" required />
+                    <x-forms.input id="custom_port" type="number" label="Custom Git port" required />
+                </div>
+            </div>
+        </div>
+
+        <x-forms.button class="mt-1 w-full justify-center" type="submit">
+            Continue
+        </x-forms.button>
+    </form>
+@else
+    <x-callout type="danger" title="Insufficient permissions">
+        You don't have permission to create new Gitea Apps. Contact your team administrator.
+    </x-callout>
+@endcan
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index 9567a3f7fa..6a74d5fb0b 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -34,7 +34,7 @@
                     'label' => 'Danger Zone',
                     'route' => 'source.github.danger',
                     'active' => $activeTab === 'danger',
-                    'icon' => 'shield-alert',
+                    'icon' => 'danger',
                 ],
             ];
         @endphp
@@ -47,12 +47,14 @@
         @if ($showSettingsSidebar)
             <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
                 <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-                    <aside class="application-settings-navigation min-w-0 xl:self-start"
+                    <x-main-nav-menu back-label="Sources" back-title="Back to Integrations"
                         data-settings-search-items="{{ json_encode(settingsSearchItems(['GitHub App' => $settingsMenuItems], $githubAppRouteParameters)) }}">
                         <nav aria-label="GitHub App settings"
                             class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                            <div class="nav-section hidden xl:block">Settings</div>
                             @foreach ($settingsMenuItems as $menuItem)
+                                @if ($menuItem['label'] === 'Danger Zone')
+                                    <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
+                                @endif
                                 <a wire:key="github-app-settings-{{ str($menuItem['label'])->slug() }}"
                                     @class([
                                         'menu-item',
@@ -65,7 +67,7 @@
                                 </a>
                             @endforeach
                         </nav>
-                    </aside>
+                    </x-main-nav-menu>
 
                     <div class="min-w-0">
                         @if (!data_get($github_app, 'installation_id') && $activeTab === 'general')
diff --git a/resources/views/livewire/source/gitlab/change.blade.php b/resources/views/livewire/source/gitlab/change.blade.php
index 2ba6bb1d63..a773769aa0 100644
--- a/resources/views/livewire/source/gitlab/change.blade.php
+++ b/resources/views/livewire/source/gitlab/change.blade.php
@@ -95,7 +95,7 @@
             </x-application.settings-section>
 
             <x-application.settings-section title="Webhook"
-                description="Configure this webhook URL in your GitLab project settings (Settings → Webhooks).">
+                description="Configure this webhook URL in your GitLab project settings (Settings → Webhooks). On self-managed GitLab, an admin can instead add the same URL and token once as a system hook (Admin Area → System hooks) with Push events and Merge request events enabled.">
                 <div class="grid gap-4 lg:grid-cols-2">
                     <div class="lg:col-span-2">
                         <x-forms.input readonly label="Webhook URL"
diff --git a/resources/views/livewire/storage/index.blade.php b/resources/views/livewire/storage/index.blade.php
index 30f492705e..ddb23ab6ea 100644
--- a/resources/views/livewire/storage/index.blade.php
+++ b/resources/views/livewire/storage/index.blade.php
@@ -44,7 +44,7 @@
             matches(values) { const query = this.search.trim().toLowerCase(); return !query || values.some(value => String(value || '').toLowerCase().includes(query)); },
             setViewMode(mode) { this.viewMode = mode; localStorage.setItem('coolify-s3-storages-view', mode); }
         }">
-        @include('livewire.shared.list-search-controls', ['placeholder' => 'Search S3 storages', 'singular' => 'storage', 'plural' => 'storages'])
+        @include('livewire.shared.list-search-controls', ['placeholder' => 'Search S3 storages'])
         <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
             @foreach ($s3 as $storage)
                 <a x-show="matches(@js([$storage->name, $storage->description ?: 'S3-compatible storage', $storage->is_usable ? 'Connected' : 'Not usable']))" {{ wireNavigate() }} href="/storages/{{ $storage->uuid }}"
diff --git a/resources/views/livewire/storage/resources.blade.php b/resources/views/livewire/storage/resources.blade.php
index dd8b004e4c..3caa1f6c94 100644
--- a/resources/views/livewire/storage/resources.blade.php
+++ b/resources/views/livewire/storage/resources.blade.php
@@ -43,6 +43,8 @@
                                     ]);
                                 }
                             }
+                        } elseif ($database instanceof \App\Models\StandalonePostgresql && $database->id === 0) {
+                            $resourceLink = route('settings.backup');
                         } elseif ($database) {
                             $environment = $database->environment;
                             $project = $environment?->project;
@@ -103,10 +105,10 @@
                                 <button type="button" class="button shrink-0"
                                     wire:click="moveBackup({{ $backup->id }})">Move</button>
                                 <div wire:key="disableS3-{{ $backup->id }}">
-                                    <x-modal-confirmation title="Disable S3 for this backup schedule?"
+                                    <x-modal-confirmation title="Remove this storage from the backup schedule?"
                                         submitAction="disableS3({{ $backup->id }})" :confirmWithText="false"
-                                        :confirmWithPassword="false" step2ButtonText="Disable S3"
-                                        :actions="['Backups from this schedule will no longer be uploaded to S3.']">
+                                        :confirmWithPassword="false" step2ButtonText="Remove storage"
+                                        :actions="['Backups from this schedule will no longer be uploaded to this storage. S3 backup turns off when no other storage remains.']">
                                         <x-slot:trigger>
                                             <button type="button" class="button shrink-0 text-error">Disable</button>
                                         </x-slot:trigger>
@@ -148,10 +150,10 @@
                             <button type="button" class="button shrink-0"
                                 wire:click="moveVolumeBackup({{ $backup->id }})">Move</button>
                             <div wire:key="disableVolumeS3-{{ $backup->id }}">
-                                <x-modal-confirmation title="Disable S3 for this backup schedule?"
+                                <x-modal-confirmation title="Remove this storage from the backup schedule?"
                                     submitAction="disableVolumeS3({{ $backup->id }})" :confirmWithText="false"
-                                    :confirmWithPassword="false" step2ButtonText="Disable S3"
-                                    :actions="['Backups from this schedule will no longer be uploaded to S3.']">
+                                    :confirmWithPassword="false" step2ButtonText="Remove storage"
+                                    :actions="['Backups from this schedule will no longer be uploaded to this storage. S3 backup turns off when no other storage remains.']">
                                     <x-slot:trigger>
                                         <button type="button" class="button shrink-0 text-error">Disable</button>
                                     </x-slot:trigger>
diff --git a/resources/views/livewire/storage/show.blade.php b/resources/views/livewire/storage/show.blade.php
index 93fa1150ee..aacc03706a 100644
--- a/resources/views/livewire/storage/show.blade.php
+++ b/resources/views/livewire/storage/show.blade.php
@@ -23,7 +23,7 @@
                 'label' => 'Danger Zone',
                 'route' => 'storage.danger',
                 'active' => $currentRoute === 'storage.danger',
-                'icon' => 'shield-alert',
+                'icon' => 'danger',
             ],
         ];
     @endphp
@@ -36,12 +36,14 @@
     @if ($showSettingsSidebar)
         <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
             <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-                <aside class="application-settings-navigation min-w-0 xl:self-start"
+                <x-main-nav-menu back-label="S3 Storage" back-title="Back to Integrations"
                     data-settings-search-items="{{ json_encode(settingsSearchItems(['S3 storage' => $settingsMenuItems], $storageRouteParameters)) }}">
                     <nav aria-label="S3 storage settings"
                         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                        <div class="nav-section hidden xl:block">Settings</div>
                         @foreach ($settingsMenuItems as $menuItem)
+                            @if ($menuItem['label'] === 'Danger Zone')
+                                <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
+                            @endif
                             <a wire:key="storage-settings-{{ str($menuItem['label'])->slug() }}"
                                 @class([
                                     'menu-item',
@@ -54,7 +56,7 @@
                             </a>
                         @endforeach
                     </nav>
-                </aside>
+                </x-main-nav-menu>
 
                 <div class="min-w-0">
                     @if ($currentRoute === 'storage.show')
diff --git a/resources/views/livewire/switch-team.blade.php b/resources/views/livewire/switch-team.blade.php
index 31ea8d3086..2346b4efe7 100644
--- a/resources/views/livewire/switch-team.blade.php
+++ b/resources/views/livewire/switch-team.blade.php
@@ -1,6 +1,5 @@
 @php
     $currentTeam = auth()->user()->currentTeam();
-    $teamInitial = strtoupper(mb_substr($currentTeam->name, 0, 1));
 @endphp
 <div class="min-w-0">
     {{-- Expanded: inline switcher (team name + up/down chevron) --}}
@@ -9,6 +8,7 @@
         <button type="button" @click="open = !open" @click.outside="open = false"
             title="Switch team"
             class="group/team flex h-8 items-center gap-1.5 rounded-lg px-2 -ml-1 text-left opacity-70 transition-[background-color,opacity] hover:bg-neutral-100 hover:opacity-100 dark:hover:bg-white/[0.05]">
+            <x-team.avatar :team="$currentTeam" class="size-5 text-[11px]" />
             <span class="whitespace-nowrap text-[13px] font-semibold text-black dark:text-fg">{{ $currentTeam->name }}</span>
             <svg class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" viewBox="0 0 24 24" fill="none">
                 <path d="M8 9l4-4 4 4M8 15l4 4 4-4" stroke="currentColor" stroke-width="1.6"
@@ -24,6 +24,7 @@
             @foreach (auth()->user()->teams as $team)
                 <button type="button" wire:click="switch_to({{ $team->id }})" @click="open = false"
                     class="listbox-option {{ $team->id === $currentTeam->id ? 'bg-neutral-100 font-medium dark:bg-white/[0.06]' : '' }}">
+                    <x-team.avatar :team="$team" class="size-5 text-[11px]" />
                     <span class="min-w-0 flex-1 truncate">{{ $team->name }}</span>
                 </button>
             @endforeach
@@ -55,8 +56,8 @@
             }
         }">
         <button @click="openTeamMenu($event)" type="button" title="Team: {{ $currentTeam->name }}"
-            class="flex items-center justify-center w-8 h-8 p-0 text-[13px] font-semibold text-neutral-600 dark:text-fg bg-neutral-100 dark:bg-white/[0.06] hover:bg-neutral-200 dark:hover:bg-white/[0.1] rounded-lg cursor-pointer transition-colors">
-            {{ $teamInitial }}
+            class="flex items-center justify-center w-8 h-8 p-0 rounded-lg cursor-pointer transition-colors hover:bg-neutral-100 dark:hover:bg-white/[0.06]">
+            <x-team.avatar :team="$currentTeam" class="size-6 text-[12px]" />
         </button>
         <div x-show="teamOpen" @click.outside="teamOpen = false" x-transition.opacity.duration.100ms x-cloak
             :style="`left: ${teamX}px; top: ${teamY}px;`"
@@ -68,6 +69,7 @@
             @foreach (auth()->user()->teams as $team)
                 <button type="button" wire:click="switch_to({{ $team->id }})" @click="teamOpen = false"
                     class="listbox-option {{ $team->id === $currentTeam->id ? 'bg-neutral-100 font-medium dark:bg-white/[0.06]' : '' }}">
+                    <x-team.avatar :team="$team" class="size-5 text-[11px]" />
                     <span class="min-w-0 flex-1 truncate">{{ $team->name }}</span>
                 </button>
             @endforeach
diff --git a/resources/views/livewire/tags/canvas.blade.php b/resources/views/livewire/tags/canvas.blade.php
new file mode 100644
index 0000000000..246addc1e6
--- /dev/null
+++ b/resources/views/livewire/tags/canvas.blade.php
@@ -0,0 +1,29 @@
+<div class="h-full">
+    <x-slot:title>
+        Tags > Canvas | Coolify
+    </x-slot>
+    <div data-environment-canvas data-mode="tags" data-endpoint="/tags/canvas"
+        data-team="{{ $teamId }}" data-user="{{ auth()->id() }}"
+        class="relative h-full" wire:ignore>
+        {{-- The canvas moves this group into its toolbar (page actions last, at the right end),
+             which can be outside this component,
+             so the button opens the modal below with a window event. --}}
+        <div data-ec-views class="flex items-center gap-2">
+            <x-canvas-view-toggle on-canvas :list-url="route('tags.show')"
+                :canvas-url="route('tags.canvas')" />
+            @can('create', App\Models\Tag::class)
+                <button type="button" x-data x-on:click="$dispatch('open-new-tag')"
+                    class="button button-highlighted whitespace-nowrap">
+                    <x-reicon name="plus" class="size-3.5" />
+                    New tag
+                </button>
+            @endcan
+        </div>
+    </div>
+    @can('create', App\Models\Tag::class)
+        <x-modal-input title="New tag" x-on:open-new-tag.window="modalOpen = true">
+            <x-slot:content></x-slot:content>
+            @include('livewire.tags.partials.new-tag-form')
+        </x-modal-input>
+    @endcan
+</div>
diff --git a/resources/views/livewire/tags/partials/new-tag-form.blade.php b/resources/views/livewire/tags/partials/new-tag-form.blade.php
new file mode 100644
index 0000000000..214ecd0d18
--- /dev/null
+++ b/resources/views/livewire/tags/partials/new-tag-form.blade.php
@@ -0,0 +1,7 @@
+<form wire:submit="createTag" class="flex w-full flex-col gap-4">
+    <x-forms.input id="newTagName" label="Name" placeholder="production" required
+        helper="Lowercase, without spaces. You can add resources to the tag later." />
+    <div class="flex justify-end border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+        <x-forms.button type="submit" isHighlighted>Create tag</x-forms.button>
+    </div>
+</form>
diff --git a/resources/views/livewire/tags/show.blade.php b/resources/views/livewire/tags/show.blade.php
index 44ce541f45..65904408df 100644
--- a/resources/views/livewire/tags/show.blade.php
+++ b/resources/views/livewire/tags/show.blade.php
@@ -19,11 +19,26 @@
                 @endif
             </p>
         </div>
+        @unless (isset($tag))
+            <div class="flex shrink-0 items-center gap-2">
+                @can('create', App\Models\Tag::class)
+                    <x-modal-input title="New tag">
+                        <x-slot:content>
+                            <button type="button" class="button button-highlighted whitespace-nowrap">
+                                <x-reicon name="plus" class="size-3.5" />
+                                New tag
+                            </button>
+                        </x-slot:content>
+                        @include('livewire.tags.partials.new-tag-form')
+                    </x-modal-input>
+                @endcan
+            </div>
+        @endunless
     </header>
 
     @if ($tags->isEmpty())
         <x-empty title="No tags yet"
-            description="Open a resource and add a tag to start grouping related deployments."
+            description="Create a tag, then connect it to resources to group related deployments."
             icon-name="tags" />
     @elseif (! isset($tag))
         <div x-data="tagsIndex()" class="w-full">
@@ -41,7 +56,7 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-2">
+                <div class="flex flex-wrap items-center gap-2">
                     <x-table.dropdown panel-class="w-52!">
                         <x-slot:trigger>
                             <button type="button" class="button" aria-haspopup="listbox" :aria-expanded="open">
@@ -68,27 +83,8 @@
                             </template>
                     </x-table.dropdown>
 
-                    <div
-                        class="view-toggle">
-                        <button type="button" x-on:click="setViewMode('table')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'table'
-                                ?
-                                'control-selected' :
-                                'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Table view" title="Table view">
-                            <x-reicon name="unordered-list" class="size-3.5" />
-                        </button>
-                        <button type="button" x-on:click="setViewMode('grid')"
-                            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                            :class="viewMode === 'grid'
-                                ?
-                                'control-selected' :
-                                'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                            aria-label="Grid view" title="Grid view">
-                            <x-reicon name="grid" class="size-3.5" />
-                        </button>
-                    </div>
+                    <x-canvas-view-toggle :list-url="route('tags.show')"
+                        :canvas-url="route('tags.canvas')" />
                 </div>
             </div>
 
@@ -176,7 +172,7 @@
                     search: '',
                     sortBy: 'name-asc',
                     sortOpen: false,
-                    viewMode: localStorage.getItem('tags-view') || 'grid',
+                    viewMode: @js($this->listView('tags', 'grid')),
                     page: 1,
                     pageSize: 12,
                     tags: @js($tagsJs),
@@ -231,7 +227,7 @@
                     setViewMode(mode) {
                         this.viewMode = mode;
                         this.page = 1;
-                        localStorage.setItem('tags-view', mode);
+                        this.$wire.saveListView('tags', mode);
                     },
                     previousPage() {
                         this.page = Math.max(1, this.page - 1);
@@ -284,6 +280,56 @@
             <x-application.settings-section :title="$tag->name"
                 description="Use this webhook to deploy every resource with this tag.">
                 <x-slot:actions>
+                    {{-- Two ways to connect: a list in a modal, or the canvas (wide screens only). --}}
+                    <x-modal-input title="Connect to resources" subtitle="Add this tag to resources, or remove it."
+                        wireOpen="connectResourcesOpen" :wireIgnore="false" :contentClicks="false">
+                        <x-slot:content>
+                            <button type="button" class="button whitespace-nowrap" wire:click="openConnectResources">
+                                <x-reicon name="link" class="size-3.5" />
+                                Connect to resources
+                            </button>
+                        </x-slot:content>
+                        @forelse ($connectableResources as $context => $resources)
+                            <div wire:key="connect-group-{{ $context }}" class="mb-4 last:mb-0">
+                                <p class="mb-1.5 truncate text-[11px] font-medium text-neutral-500 dark:text-fg-faint">{{ $context }}</p>
+                                <div class="flex flex-col gap-1">
+                                    @foreach ($resources as $resource)
+                                        <label wire:key="connect-resource-{{ $resource['uuid'] }}" @class([
+                                            'flex items-center gap-2.5 rounded-md border border-neutral-200 px-3 py-2 text-[13px] dark:border-white/[0.08]',
+                                            'cursor-pointer' => $resource['can_update'],
+                                            'opacity-60' => ! $resource['can_update'],
+                                        ])>
+                                            <input type="checkbox" @checked($resource['tagged']) @disabled(! $resource['can_update'])
+                                                wire:click="toggleResource(@js($resource['uuid']))" wire:loading.attr="disabled"
+                                                class="size-4 shrink-0 rounded-sm border-neutral-300 text-accent focus:ring-accent dark:border-white/20 dark:bg-transparent" />
+                                            <span class="min-w-0 truncate">{{ $resource['name'] }}</span>
+                                        </label>
+                                    @endforeach
+                                </div>
+                            </div>
+                        @empty
+                            <div wire:loading.remove wire:target="openConnectResources">
+                                <x-empty title="No resources yet" description="Create a resource in a project first." icon-name="tags" size="sm" />
+                            </div>
+                        @endforelse
+                    </x-modal-input>
+                    <a href="{{ app(App\Services\TagCanvas::class)->connectLink($tag) }}"
+                        class="button hidden whitespace-nowrap md:inline-flex"
+                        title="Add this tag to resources on the canvas, and see which resources have it">
+                        <x-reicon name="deploy-canvas" class="size-3.5" />
+                        Connect in canvas
+                    </a>
+                    @can('delete', $tag)
+                        <x-modal-confirmation title="Delete this tag?" isErrorButton buttonTitle="Delete"
+                            submitAction="deleteTag" :actions="[
+                                'The tag will be removed from every resource.',
+                                'The deploy webhook of this tag will stop working.',
+                            ]"
+                            confirmationText="{{ $tag->name }}"
+                            confirmationLabel="Please confirm the execution of the actions by entering the Tag Name below"
+                            shortConfirmationLabel="Tag Name" :confirmWithPassword="false"
+                            step2ButtonText="Delete tag" />
+                    @endcan
                     <x-modal-confirmation title="Redeploy all resources with this tag?"
                         buttonTitle="Redeploy all" submitAction="redeployAll" :actions="[
                             'All resources with this tag will be redeployed.',
@@ -302,7 +348,7 @@
                 description="{{ $resourceCount }} {{ Str::plural('resource', $resourceCount) }} use this tag.">
                 @if ($resourceCount === 0)
                     <x-empty title="No resources use this tag"
-                        description="Add this tag to an application or service to see it here."
+                        description="Connect this tag to resources to see them here."
                         icon-name="tags" size="sm" />
                 @else
                     <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
@@ -311,8 +357,8 @@
                                 class="group flex min-h-24 flex-col rounded-lg border border-neutral-200 bg-neutral-50/70 p-3 transition-colors hover:border-neutral-300 hover:no-underline dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                 <div class="flex items-start gap-2.5">
                                     <div
-                                        class="flex size-7 shrink-0 items-center justify-center rounded-md border border-neutral-200 bg-white text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
-                                        <x-reicon name="browser-code" class="size-3.5" />
+                                        class="flex size-7 shrink-0 items-center justify-center overflow-hidden rounded-md border border-neutral-200 bg-white text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
+                                        <x-resource-logo :resource="$application" icon-class="size-3.5" />
                                     </div>
                                     <div class="min-w-0">
                                         <h3
@@ -335,8 +381,8 @@
                                 class="group flex min-h-24 flex-col rounded-lg border border-neutral-200 bg-neutral-50/70 p-3 transition-colors hover:border-neutral-300 hover:no-underline dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]">
                                 <div class="flex items-start gap-2.5">
                                     <div
-                                        class="flex size-7 shrink-0 items-center justify-center rounded-md border border-neutral-200 bg-white text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
-                                        <x-reicon name="layers" class="size-3.5" />
+                                        class="flex size-7 shrink-0 items-center justify-center overflow-hidden rounded-md border border-neutral-200 bg-white text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
+                                        <x-resource-logo :resource="$service" icon-class="size-3.5" />
                                     </div>
                                     <div class="min-w-0">
                                         <h3
diff --git a/resources/views/livewire/team/index.blade.php b/resources/views/livewire/team/index.blade.php
index c1b7cc2c3f..fdf38bf818 100644
--- a/resources/views/livewire/team/index.blade.php
+++ b/resources/views/livewire/team/index.blade.php
@@ -15,6 +15,67 @@
                     </x-modal-input>
                 </x-slot:actions>
                 <div class="grid gap-4 lg:grid-cols-2">
+                    <div class="lg:col-span-2" x-data="{
+                        processing: false,
+                        uploadError: null,
+                        async prepareAvatar(event) {
+                            const file = event.target.files?.[0];
+                            if (!file) return;
+                            this.processing = true;
+                            this.uploadError = null;
+
+                            try {
+                                const image = await new Promise((resolve, reject) => {
+                                    const element = new Image();
+                                    element.onload = () => resolve(element);
+                                    element.onerror = reject;
+                                    element.src = URL.createObjectURL(file);
+                                });
+                                const cropSize = Math.min(image.naturalWidth, image.naturalHeight);
+                                const canvas = document.createElement('canvas');
+                                canvas.width = 256;
+                                canvas.height = 256;
+                                const context = canvas.getContext('2d');
+                                context.fillStyle = '#ffffff';
+                                context.fillRect(0, 0, 256, 256);
+                                context.drawImage(image, (image.naturalWidth - cropSize) / 2, (image.naturalHeight - cropSize) / 2, cropSize, cropSize, 0, 0, 256, 256);
+                                const blob = await new Promise((resolve, reject) => canvas.toBlob(value => value ? resolve(value) : reject(new Error('JPEG compression failed')), 'image/jpeg', 0.8));
+                                const compressed = new File([blob], 'team-avatar.jpg', { type: 'image/jpeg' });
+                                this.$wire.upload('avatar', compressed, async () => {
+                                    await this.$wire.uploadAvatar();
+                                    this.processing = false;
+                                }, () => {
+                                    this.processing = false;
+                                    this.uploadError = 'The image could not be uploaded.';
+                                });
+                            } catch (error) {
+                                this.processing = false;
+                                this.uploadError = 'The image could not be processed in this browser.';
+                            }
+                            event.target.value = '';
+                        },
+                    }">
+                        <div class="mb-2 text-sm font-medium leading-4">Avatar</div>
+                        <div class="flex items-center gap-4">
+                            <x-team.avatar :team="$team" class="size-16 rounded-xl! text-2xl" />
+                            @can('update', $team)
+                                <div class="flex min-w-0 flex-1 flex-col gap-2">
+                                    <div class="flex flex-wrap gap-2">
+                                        <input x-ref="avatarInput" type="file" x-on:change="prepareAvatar($event)" accept="image/jpeg,image/png,image/webp" class="hidden">
+                                        <x-forms.button type="button" x-on:click="$refs.avatarInput.click()" x-bind:disabled="processing">
+                                            <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
+                                        </x-forms.button>
+                                        @if ($team->avatar_path)
+                                            <x-forms.button type="button" wire:click="removeAvatar" x-bind:disabled="processing" isError>Remove</x-forms.button>
+                                        @endif
+                                    </div>
+                                    <p class="text-xs text-neutral-500 dark:text-fg-dim">JPG, PNG, or WebP. Shown in the team switcher.</p>
+                                    <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
+                                    @error('avatar') <p class="text-xs text-red-500">{{ $message }}</p> @enderror
+                                </div>
+                            @endcan
+                        </div>
+                    </div>
                     <x-forms.input id="name" label="Name" required canGate="update" :canResource="$team" />
                     <x-forms.input id="description" label="Description" canGate="update" :canResource="$team" />
                     <div class="lg:col-span-2">
diff --git a/resources/views/livewire/team/member.blade.php b/resources/views/livewire/team/member.blade.php
index 724256e904..4b1261a07a 100644
--- a/resources/views/livewire/team/member.blade.php
+++ b/resources/views/livewire/team/member.blade.php
@@ -7,10 +7,15 @@
     ])>
     <div>
         <div class="flex items-center gap-2">
-            <div
-                class="flex size-7 shrink-0 items-center justify-center rounded-lg bg-neutral-100 text-[11px] font-semibold text-neutral-600 dark:bg-white/[0.06] dark:text-fg-dim">
-                {{ Str::upper(Str::substr($member->name ?: $member->email, 0, 1)) }}
-            </div>
+            @if ($member->avatar_path)
+                <img src="{{ profile_avatar_url($member) }}" alt="{{ $member->name }}"
+                    class="size-7 shrink-0 rounded-lg object-cover">
+            @else
+                <div
+                    class="flex size-7 shrink-0 items-center justify-center rounded-lg bg-neutral-100 text-[11px] font-semibold text-neutral-600 dark:bg-white/[0.06] dark:text-fg-dim">
+                    {{ Str::upper(Str::substr($member->name ?: $member->email, 0, 1)) }}
+                </div>
+            @endif
             <span class="truncate text-[13px] font-medium text-black dark:text-fg">{{ $member->name }}</span>
             @if ($member->id === Auth::id())
                 <span
@@ -35,52 +40,54 @@
     <div class="flex justify-end">
         @can('manageMembers', currentTeam())
             @if ($member->id !== Auth::id())
-                <div class="relative" x-data="{ open: false }" @keydown.escape.window="open = false"
-                    @click.outside="open = false">
-                    <button type="button" class="button h-7! px-2.5! text-[11px]!" @click="open = !open"
-                        aria-haspopup="menu" :aria-expanded="open">
+                <div x-data="{ open: false }" @keydown.escape.window="open = false">
+                    <button type="button" class="button h-7! px-2.5! text-[11px]!" x-ref="trigger"
+                        @click="open = !open" aria-haspopup="menu" :aria-expanded="open">
                         Manage
                     </button>
-                    <div x-show="open" x-cloak role="menu"
-                        class="listbox-panel top-full! right-0! left-auto! mt-1! w-36! min-w-0!">
-                        @if (Auth::user()->isOwner())
-                            @if (data_get($member, 'pivot.role') !== 'owner')
-                                <button type="button" class="listbox-option justify-start!" wire:click="makeOwner"
-                                    @click="open = false">
-                                    Make owner
-                                </button>
+                    <template x-teleport="body">
+                        <div x-show="open" x-cloak role="menu" x-anchor.bottom-end.fixed.offset.4="$refs.trigger"
+                            @click.outside="if (! $refs.trigger.contains($event.target)) open = false"
+                            class="listbox-panel w-36! min-w-0! z-50!">
+                            @if (Auth::user()->isOwner())
+                                @if (data_get($member, 'pivot.role') !== 'owner')
+                                    <button type="button" class="listbox-option justify-start!" wire:click="makeOwner"
+                                        @click="open = false">
+                                        Make owner
+                                    </button>
+                                @endif
+                                @if (data_get($member, 'pivot.role') !== 'admin')
+                                    <button type="button" class="listbox-option justify-start!" wire:click="makeAdmin"
+                                        @click="open = false">
+                                        Make admin
+                                    </button>
+                                @endif
+                                @if (data_get($member, 'pivot.role') !== 'member')
+                                    <button type="button" class="listbox-option justify-start!"
+                                        wire:click="makeReadonly" @click="open = false">
+                                        Make member
+                                    </button>
+                                @endif
+                            @elseif (Auth::user()->isAdmin())
+                                @if (data_get($member, 'pivot.role') === 'admin')
+                                    <button type="button" class="listbox-option justify-start!"
+                                        wire:click="makeReadonly" @click="open = false">
+                                        Make member
+                                    </button>
+                                @elseif (data_get($member, 'pivot.role') === 'member')
+                                    <button type="button" class="listbox-option justify-start!" wire:click="makeAdmin"
+                                        @click="open = false">
+                                        Make admin
+                                    </button>
+                                @endif
                             @endif
-                            @if (data_get($member, 'pivot.role') !== 'admin')
-                                <button type="button" class="listbox-option justify-start!" wire:click="makeAdmin"
-                                    @click="open = false">
-                                    Make admin
-                                </button>
-                            @endif
-                            @if (data_get($member, 'pivot.role') !== 'member')
-                                <button type="button" class="listbox-option justify-start!"
-                                    wire:click="makeReadonly" @click="open = false">
-                                    Make member
-                                </button>
-                            @endif
-                        @elseif (Auth::user()->isAdmin())
-                            @if (data_get($member, 'pivot.role') === 'admin')
-                                <button type="button" class="listbox-option justify-start!"
-                                    wire:click="makeReadonly" @click="open = false">
-                                    Make member
-                                </button>
-                            @elseif (data_get($member, 'pivot.role') === 'member')
-                                <button type="button" class="listbox-option justify-start!" wire:click="makeAdmin"
-                                    @click="open = false">
-                                    Make admin
-                                </button>
-                            @endif
-                        @endif
-                        <div class="my-1 border-t border-neutral-200 dark:border-white/[0.08]"></div>
-                        <button type="button" class="listbox-option justify-start! text-error! hover:text-error!"
-                            wire:click="remove" @click="open = false">
-                            Remove member
-                        </button>
-                    </div>
+                            <div class="my-1 border-t border-neutral-200 dark:border-white/[0.08]"></div>
+                            <button type="button" class="listbox-option justify-start! text-error! hover:text-error!"
+                                wire:click="remove" @click="open = false">
+                                Remove member
+                            </button>
+                        </div>
+                    </template>
                 </div>
             @endif
         @endcan
diff --git a/resources/views/livewire/terminal/index.blade.php b/resources/views/livewire/terminal/index.blade.php
index 0a3f361596..cd65d085dc 100644
--- a/resources/views/livewire/terminal/index.blade.php
+++ b/resources/views/livewire/terminal/index.blade.php
@@ -65,6 +65,7 @@
     <section class="{{ $selected_uuid === 'default' ? 'w-full' : 'terminal-page-console min-h-0 w-full flex-1 overflow-hidden' }}"
         x-on:terminal-theme-selected="setTheme($event.detail.theme)"
         x-on:terminal-starting.window="syncTheme()"
+        x-on:terminal-mode-updated.window="attachAvailable = $event.detail.attachAvailable; terminalMode = $event.detail.mode; hasShell = $event.detail.hasShell"
         x-data="{
             targets: @js($terminalOptions),
             multipleServers: @js($servers->count() > 1),
@@ -76,6 +77,10 @@
             themeAccents: @js($consoleThemeAccents),
             consoleTheme: 'system',
             themeOpen: false,
+            attachAvailable: false,
+            hasShell: true,
+            terminalMode: 'shell',
+            modeOpen: false,
             get filteredTargetGroups() {
                 const query = this.targetSearch.trim().toLowerCase();
                 const targets = query
@@ -98,6 +103,15 @@
                 localStorage.setItem('coolify-console-theme', theme);
                 window.dispatchEvent(new CustomEvent('terminal-theme-change', { detail: { theme } }));
             },
+            setTerminalMode(mode) {
+                this.modeOpen = false;
+                if (this.terminalMode === mode || (mode === 'shell' && !this.hasShell)) {
+                    return;
+                }
+                this.terminalMode = mode;
+                window.dispatchEvent(new CustomEvent('terminal-starting'));
+                Livewire.dispatch('set-terminal-mode', { mode });
+            },
             syncTheme() {
                 const savedTheme = localStorage.getItem('coolify-console-theme');
                 this.consoleTheme = this.themeKeys.includes(savedTheme) ? savedTheme : 'system';
@@ -260,8 +274,11 @@
                     @endif
                 </div>
 
-                <x-terminal.theme-selector :themes="$consoleThemes" :theme-names="$consoleThemeNames"
+                <div class="ml-auto flex items-center gap-2">
+                    <x-terminal.mode-selector />
+                    <x-terminal.theme-selector :themes="$consoleThemes" :theme-names="$consoleThemeNames"
                         :theme-accents="$consoleThemeAccents" />
+                </div>
             </header>
 
             <div class="terminal-session-panel flex min-h-0 flex-1 flex-col overflow-hidden p-3 sm:p-6">
diff --git a/resources/views/livewire/traffic/_breakdown-section.blade.php b/resources/views/livewire/traffic/_breakdown-section.blade.php
index e6b1e9be4f..df862b9ec1 100644
--- a/resources/views/livewire/traffic/_breakdown-section.blade.php
+++ b/resources/views/livewire/traffic/_breakdown-section.blade.php
@@ -1,5 +1,5 @@
 {{--
-    One breakdown dimension rendered as a paginated settings-section. Handles the
+    One breakdown dimension rendered as a sortable, paginated settings-section. Handles the
     per-dimension presentation: referrers get a DuckDuckGo favicon + an openable
     external link (rel="noopener noreferrer nofollow", new tab), devices are mapped
     to friendly capitalized labels, and Sentinel's `__other__` overflow bucket reads
@@ -20,7 +20,14 @@
         <x-empty size="sm" title="No data"
             :description="'No '.strtolower($label).' data for the selected range.'" icon-name="network" />
     @else
-        <div x-data="{ page: 0, per: 10, total: {{ count($rows) }} }">
+        <div x-data="trafficTable()">
+            <div class="flex items-center gap-3 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+                @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Name', 'text' => true, 'class' => 'min-w-0 flex-1'])
+                <span class="hidden w-16 shrink-0 sm:inline" aria-hidden="true"></span>
+                @include('livewire.traffic._sort-header', ['column' => 'requests', 'label' => 'Requests', 'class' => 'w-16 shrink-0'])
+                @include('livewire.traffic._sort-header', ['column' => 'bytesOut', 'label' => 'Bandwidth', 'class' => 'hidden w-16 shrink-0 sm:inline-flex', 'title' => 'Total response data sent'])
+            </div>
+            <div class="flex flex-col">
             @foreach ($rows as $row)
                 @php
                     $value = (string) ($row['value'] ?? '');
@@ -35,11 +42,13 @@
                             default => $value !== '' ? $value : 'Unknown',
                         };
                     $requests = (int) ($row['requests'] ?? 0);
+                    $bytesOut = (int) ($row['bytesOut'] ?? 0);
                     $width = min(100, round(($requests / $maxRequests) * 100, 1));
                 @endphp
                 <div wire:key="analytics-{{ $dimension }}-{{ md5($value) }}"
-                    x-show="{{ $loop->index }} >= page * per && {{ $loop->index }} < (page + 1) * per"
-                    class="flex min-h-11 items-center gap-3 border-b border-neutral-200 px-4 py-2 last:border-b-0 dark:border-white/[0.07]">
+                    data-row="{{ json_encode(['name' => $display, 'requests' => $requests, 'bytesOut' => $bytesOut]) }}" @if ($isOther) data-pinned @endif
+                    x-show="shown($el)"
+                    class="flex min-h-11 items-center gap-3 border-t border-neutral-200 px-4 py-2 transition-colors hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.03]">
                     @if ($dimension === 'referer' && $host)
                         <img src="{{ refererFaviconUrl($host) }}" alt="" loading="lazy" width="16" height="16"
                             class="size-4 shrink-0 rounded-sm" onerror="this.style.visibility='hidden'">
@@ -51,11 +60,12 @@
                     <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
                         <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
                     </div>
-                    <span class="w-12 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                    <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
                         title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
-                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes((int) ($row['bytesOut'] ?? 0)) }}</span>
+                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($bytesOut) }}</span>
                 </div>
             @endforeach
+            </div>
             @include('livewire.traffic._pager')
         </div>
     @endif
diff --git a/resources/views/livewire/traffic/_geo.blade.php b/resources/views/livewire/traffic/_geo.blade.php
index 06f24bfee6..754edd9aa6 100644
--- a/resources/views/livewire/traffic/_geo.blade.php
+++ b/resources/views/livewire/traffic/_geo.blade.php
@@ -1,13 +1,14 @@
 {{--
-    Shared geo visualization for traffic analytics: a lightweight interactive 3D
-    dotted globe (WebGL, via cobe — see resources/js/traffic-globe.js) with a
-    request-volume marker per country, beside a scrollable ranked country list.
-    Hovering a country row rotates the globe to face it. Driven by the `country`
-    breakdown; each row is ['value' => ISO-A2, 'requests', 'bytesOut']. The globe
-    live-updates from the host's `refreshChartData-{chartId}-status` payload
-    (`geo` key), so `$chartId` must be in scope.
+    "Locations" settings-section for traffic analytics: a lightweight interactive
+    3D dotted globe (WebGL, via cobe — see resources/js/traffic-globe.js) beside a
+    scrollable ranked list. A Countries / Cities switch in the section header picks
+    the list and the globe markers; the choice is saved per-browser in localStorage.
+    Hovering a row rotates the globe to face it. The globe live-updates from the
+    host's `refreshChartData-{chartId}-status` payload (`geo` key), so `$chartId`
+    must be in scope.
 
-    @param iterable $countries    country-breakdown rows
+    @param iterable $countries    country-breakdown rows: ['value' => ISO-A2, 'requests', 'bytesOut']
+    @param array    $cities       output of trafficCityRows(); empty when there is no city data
     @param ?string  $attribution  optional Sentinel attribution note
 --}}
 @php
@@ -25,9 +26,6 @@
         fn ($r) => preg_match('/^[A-Z]{2}$/', $r['value']) && countryName($r['value']) !== 'Unknown'
     );
 
-    // Initial marker payload for the globe, keyed by ISO-A2 request volume.
-    $geoInit = $known->map(fn ($r) => ['code' => $r['value'], 'requests' => $r['requests']])->values()->all();
-
     $countryRows = $known->values();
     if ($unknown->isNotEmpty()) {
         $countryRows->push([
@@ -39,99 +37,179 @@
     $countryRows = $countryRows->sortByDesc('requests')->values();
     $maxRequests = max(1, (int) $countryRows->max('requests'));
 
+    $cityRows = collect($cities ?? []);
+    $maxCityRequests = max(1, (int) $cityRows->max('requests'));
+
+    // Initial marker payload for the globe: one set for each view.
+    $geoInit = trafficGeoMarkers($known->all(), $cityRows->all());
+
     $hasData = $countryRows->isNotEmpty();
     $globeId = ($chartId ?? 'traffic').'-globe';
+    $viewButton = 'h-7 rounded-md px-2.5 text-[12px] font-medium transition-colors';
+    $viewButtonActive = 'bg-white text-black shadow-sm ring-1 ring-neutral-200 dark:bg-white/[0.09] dark:text-fg dark:ring-white/[0.08]';
+    $viewButtonInactive = 'text-neutral-500 hover:text-black dark:text-fg-faint dark:hover:text-fg';
+    $listClass = 'max-h-[320px] overflow-y-auto pr-1 scrollbar-thin scrollbar-track-transparent scrollbar-thumb-neutral-300 dark:scrollbar-thumb-white/10';
+    $rowClass = 'group flex min-h-10 items-center gap-3 rounded-md px-2 py-1.5 transition-colors hover:bg-neutral-50 dark:hover:bg-white/[0.03]';
 @endphp
 
-<div class="flex flex-col">
-    @if (! $hasData)
-        <x-empty size="sm" title="No data" description="No country data for the selected range."
-            icon-name="network" />
-    @else
-        <div class="grid grid-cols-1 items-stretch gap-4 border-b border-neutral-200 p-4 lg:grid-cols-[2fr_3fr] dark:border-white/[0.07]">
-            {{-- Interactive dotted globe (40%). wire:ignore so live-poll morphs never tear
-                 down the WebGL canvas. Mounted via Alpine, not Livewire's script directive:
-                 it ran before the lazy-loaded canvas was in the DOM, and only once per
-                 component, so a globe inserted by a later render (no data -> data after a
-                 range change or live poll) never mounted either. Alpine's
-                 init()/destroy() run each time this element enters or leaves the DOM. --}}
-            <div wire:ignore class="flex items-center justify-center"
-                x-data="{
-                    controller: null,
-                    refreshCleanup: null,
-                    isDark() { return document.documentElement.classList.contains('dark'); },
-                    init() {
-                        const canvas = this.$refs.canvas;
-                        if (typeof window.mountTrafficGlobe !== 'function') { return; }
-                        this.controller = window.mountTrafficGlobe(canvas, @js($geoInit), this.isDark());
-                        // Expose for row-hover focus() from the Alpine list scope.
-                        canvas._trafficGlobe = this.controller;
-                        this.refreshCleanup = Livewire.on('refreshChartData-{!! $chartId !!}-status', payload => {
-                            const data = Array.isArray(payload) ? payload[0] : payload;
-                            if (data && Array.isArray(data.geo)) { this.controller.update(data.geo, this.isDark()); }
-                        });
-                    },
-                    destroy() {
-                        if (this.refreshCleanup) { this.refreshCleanup(); this.refreshCleanup = null; }
-                        if (this.controller) { this.controller.destroy(); this.controller = null; }
-                        if (this.$refs.canvas) { this.$refs.canvas._trafficGlobe = null; }
-                    },
-                }">
-                <div class="relative aspect-square w-full max-w-[320px]">
-                    <canvas id="{!! $globeId !!}" x-ref="canvas"
-                        class="h-full w-full [touch-action:none]"
-                        style="width: 100%; height: 100%;"></canvas>
-                </div>
-            </div>
+<x-application.settings-section id="analytics-country-section" title="Locations"
+    helper="Request volume by visitor country and city for the selected range." flush
+    x-data="{
+        // Storage can be blocked (sandboxed iframe, privacy mode, full quota); the switch then works without saving.
+        view: (() => { try { return localStorage.getItem('traffic-geo-view') === 'cities' ? 'cities' : 'countries'; } catch (e) { return 'countries'; } })(),
+        setView(next) {
+            this.view = next;
+            try { localStorage.setItem('traffic-geo-view', next); } catch (e) {}
+        },
+        globe() {
+            const canvas = document.getElementById('{{ $globeId }}');
 
-            {{-- Ranked, scrollable country list (60%). Hover a row to face it on the globe. --}}
-            <div class="min-w-0" x-data="{
-                focus(code) {
-                    const g = document.getElementById('{!! $globeId !!}');
-                    if (g && g._trafficGlobe) { g._trafficGlobe.focus(code); }
-                },
-                blur() {
-                    const g = document.getElementById('{!! $globeId !!}');
-                    if (g && g._trafficGlobe) { g._trafficGlobe.resume(); }
-                },
-            }">
-                <div class="max-h-[320px] overflow-y-auto pr-1 scrollbar-thin scrollbar-track-transparent scrollbar-thumb-neutral-300 dark:scrollbar-thumb-white/10">
-                    @foreach ($countryRows as $row)
-                        @php
-                            $isUnknown = $row['value'] === '';
-                            $width = min(100, round(($row['requests'] / $maxRequests) * 100, 1));
-                        @endphp
-                        <div wire:key="geo-country-{{ $globeId }}-{{ $loop->index }}"
-                            @if (! $isUnknown) @mouseenter="focus('{{ $row['value'] }}')" @mouseleave="blur()" @endif
-                            class="group flex min-h-10 items-center gap-3 rounded-md px-2 py-1.5 transition-colors hover:bg-neutral-50 dark:hover:bg-white/[0.03]">
-                            @php $flagUrl = $isUnknown ? null : countryFlagUrl($row['value']); @endphp
-                            @if ($flagUrl)
-                                <img src="{{ $flagUrl }}" srcset="{{ countryFlagUrl($row['value'], '48x36') }} 2x" alt=""
-                                    loading="lazy" width="20" height="15"
-                                    class="h-[15px] w-5 shrink-0 rounded-[2px] object-cover ring-1 ring-black/5 dark:ring-white/10"
-                                    onerror="this.style.visibility='hidden'">
-                            @else
-                                <span class="shrink-0 text-[14px] leading-none" aria-hidden="true">🌐</span>
-                            @endif
-                            <span class="min-w-0 flex-1 truncate text-[12px] text-black dark:text-fg">
-                                {{ $isUnknown ? 'Unknown' : countryName($row['value']) }}
-                            </span>
-                            <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
-                                <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
-                            </div>
-                            <span class="w-12 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
-                                title="{{ number_format($row['requests']) }} requests">{{ compactNumber($row['requests']) }}</span>
-                            <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($row['bytesOut']) }}</span>
-                        </div>
-                    @endforeach
-                </div>
-            </div>
+            return canvas ? canvas._trafficGlobe : null;
+        },
+    }">
+    <x-slot:actions>
+        @if ($hasData)
+        <div wire:key="geo-view-{{ $globeId }}"
+            class="inline-flex items-center gap-0.5 rounded-lg bg-neutral-100 p-1 dark:bg-white/[0.04]"
+            role="group" aria-label="Location detail">
+            @foreach (['countries' => 'Countries', 'cities' => 'Cities'] as $viewKey => $viewLabel)
+                <button type="button" @click="setView('{{ $viewKey }}')"
+                    :aria-pressed="view === '{{ $viewKey }}' ? 'true' : 'false'"
+                    class="{{ $viewButton }}"
+                    :class="view === '{{ $viewKey }}' ? '{{ $viewButtonActive }}' : '{{ $viewButtonInactive }}'">{{ $viewLabel }}</button>
+            @endforeach
         </div>
-
-        @if (! empty($attribution))
-            <p class="px-4 py-2 text-[11px] text-neutral-400 dark:text-fg-faint">
-                {{ $attribution }}
-            </p>
         @endif
-    @endif
-</div>
+    </x-slot:actions>
+
+    <div class="flex flex-col">
+        @if (! $hasData)
+            <x-empty size="sm" title="No data" description="No country data for the selected range."
+                icon-name="network" />
+        @else
+            {{-- Keyed so the lazy-load morph inserts fresh nodes instead of reusing the
+                 placeholder skeleton, which has the same shape. --}}
+            <div wire:key="geo-body-{{ $globeId }}"
+                class="grid grid-cols-1 items-start gap-4 border-b border-neutral-200 p-4 lg:grid-cols-[2fr_3fr] dark:border-white/[0.07]">
+                {{-- Interactive dotted globe (40%). wire:ignore so live-poll morphs never tear
+                     down the WebGL canvas. Mounted via Alpine init()/destroy(), which run each
+                     time this element enters or leaves the DOM (a Livewire script directive
+                     runs one time only, before the lazy-loaded canvas exists). --}}
+                <div wire:ignore class="flex items-center justify-center"
+                    x-data="{
+                        controller: null,
+                        refreshCleanup: null,
+                        geo: @js($geoInit),
+                        isDark() { return document.documentElement.classList.contains('dark'); },
+                        // City markers in the Cities view; country markers when there are no cities.
+                        markers() {
+                            return this.view === 'cities' && this.geo.cities.length ? this.geo.cities : this.geo.countries;
+                        },
+                        init() {
+                            const canvas = this.$refs.canvas;
+                            if (typeof window.mountTrafficGlobe !== 'function') { return; }
+                            this.controller = window.mountTrafficGlobe(canvas, this.markers(), this.isDark());
+                            // Expose for row-hover focus() from the list rows.
+                            canvas._trafficGlobe = this.controller;
+                            this.$watch('view', () => this.controller && this.controller.update(this.markers(), this.isDark()));
+                            this.refreshCleanup = Livewire.on('refreshChartData-{!! $chartId !!}-status', payload => {
+                                const data = Array.isArray(payload) ? payload[0] : payload;
+                                if (data && data.geo && Array.isArray(data.geo.countries)) {
+                                    this.geo = data.geo;
+                                    this.controller.update(this.markers(), this.isDark());
+                                }
+                            });
+                        },
+                        destroy() {
+                            if (this.refreshCleanup) { this.refreshCleanup(); this.refreshCleanup = null; }
+                            if (this.controller) { this.controller.destroy(); this.controller = null; }
+                            if (this.$refs.canvas) { this.$refs.canvas._trafficGlobe = null; }
+                        },
+                    }">
+                    <div class="relative aspect-square w-full max-w-[320px]">
+                        <canvas id="{!! $globeId !!}" x-ref="canvas"
+                            class="h-full w-full [touch-action:none]"
+                            style="width: 100%; height: 100%;"></canvas>
+                    </div>
+                </div>
+
+                {{-- Ranked, scrollable lists (60%). Hover a row to face it on the globe. --}}
+                <div class="min-w-0">
+                    <div x-show="view === 'countries'" class="{{ $listClass }}">
+                        @foreach ($countryRows as $row)
+                            @php
+                                $isUnknown = $row['value'] === '';
+                                $width = min(100, round(($row['requests'] / $maxRequests) * 100, 1));
+                                $flagUrl = $isUnknown ? null : countryFlagUrl($row['value']);
+                            @endphp
+                            <div wire:key="geo-country-{{ $globeId }}-{{ $isUnknown ? 'unknown' : $row['value'] }}"
+                                @if (! $isUnknown) @mouseenter="globe()?.focus('{{ $row['value'] }}')" @mouseleave="globe()?.resume()" @endif
+                                class="{{ $rowClass }}">
+                                @if ($flagUrl)
+                                    <img src="{{ $flagUrl }}" srcset="{{ countryFlagUrl($row['value'], '48x36') }} 2x" alt=""
+                                        loading="lazy" width="20" height="15"
+                                        class="h-[15px] w-5 shrink-0 rounded-[2px] object-cover ring-1 ring-black/5 dark:ring-white/10"
+                                        onerror="this.style.visibility='hidden'">
+                                @else
+                                    <span class="w-5 shrink-0 text-center text-[14px] leading-none" aria-hidden="true">🌐</span>
+                                @endif
+                                <span class="min-w-0 flex-1 truncate text-[12px] text-black dark:text-fg">
+                                    {{ $isUnknown ? 'Unknown' : countryName($row['value']) }}
+                                </span>
+                                <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
+                                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+                                </div>
+                                <span class="w-12 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                                    title="{{ number_format($row['requests']) }} requests">{{ compactNumber($row['requests']) }}</span>
+                                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($row['bytesOut']) }}</span>
+                            </div>
+                        @endforeach
+                    </div>
+
+                    <div x-show="view === 'cities'" x-cloak class="{{ $listClass }}">
+                        @forelse ($cityRows as $row)
+                            @php
+                                $hasCoordinates = $row['lat'] !== null && $row['lon'] !== null;
+                                $width = min(100, round(($row['requests'] / $maxCityRequests) * 100, 1));
+                                $flagUrl = countryFlagUrl($row['country']);
+                            @endphp
+                            <div wire:key="geo-city-{{ $globeId }}-{{ md5($row['key']) }}"
+                                @if ($hasCoordinates) @mouseenter="globe()?.focus([{{ (float) $row['lat'] }}, {{ (float) $row['lon'] }}])" @mouseleave="globe()?.resume()" @endif
+                                class="{{ $rowClass }}">
+                                @if ($flagUrl)
+                                    <img src="{{ $flagUrl }}" srcset="{{ countryFlagUrl($row['country'], '48x36') }} 2x" alt=""
+                                        loading="lazy" width="20" height="15"
+                                        class="h-[15px] w-5 shrink-0 rounded-[2px] object-cover ring-1 ring-black/5 dark:ring-white/10"
+                                        onerror="this.style.visibility='hidden'">
+                                @else
+                                    <span class="w-5 shrink-0 text-center text-[14px] leading-none" aria-hidden="true">🌐</span>
+                                @endif
+                                <span class="flex min-w-0 flex-1 items-baseline gap-2" title="{{ $row['label'] }}">
+                                    <span class="truncate text-[12px] text-black dark:text-fg">{{ $row['name'] }}</span>
+                                    @if ($row['detail'] !== '')
+                                        <span class="hidden shrink-0 text-[11px] text-neutral-400 md:inline dark:text-fg-faint">{{ $row['detail'] }}</span>
+                                    @endif
+                                </span>
+                                <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
+                                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+                                </div>
+                                <span class="w-12 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                                    title="{{ number_format($row['requests']) }} requests">{{ compactNumber($row['requests']) }}</span>
+                                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($row['bytesOut']) }}</span>
+                            </div>
+                        @empty
+                            <x-empty size="sm" title="No city data" description="No city data for the selected range."
+                                icon-name="network" />
+                        @endforelse
+                    </div>
+                </div>
+            </div>
+
+            @if (! empty($attribution))
+                <p class="px-4 py-2 text-[11px] text-neutral-400 dark:text-fg-faint">
+                    {{ $attribution }}
+                </p>
+            @endif
+        @endif
+    </div>
+</x-application.settings-section>
diff --git a/resources/views/livewire/traffic/_hosts-list.blade.php b/resources/views/livewire/traffic/_hosts-list.blade.php
index 710e8fa637..9785bd38eb 100644
--- a/resources/views/livewire/traffic/_hosts-list.blade.php
+++ b/resources/views/livewire/traffic/_hosts-list.blade.php
@@ -1,7 +1,8 @@
 {{--
-    Paginated "top hosts" list — request volume grouped by served hostname (an app's
-    primary domain), with a proportional bar and right-aligned compact metrics.
-    Links each host to its live origin. Expects `$hosts` in scope.
+    Sortable, paginated "top hosts" list — request volume grouped by served hostname
+    (an app's primary domain), with a proportional bar and right-aligned compact
+    metrics. Select a column header to sort by it. Links each host to its live
+    origin. Expects `$hosts` in scope.
 
     @param iterable $hosts      host rows: ['host', 'requests', 'bandwidth']
     @param ?string  $keyPrefix  wire:key prefix (default "analytics-host")
@@ -15,37 +16,42 @@
     <x-empty size="sm" title="No host data" description="No hostnames were recorded for the selected range."
         icon-name="unordered-list" />
 @else
-    <div x-data="{ page: 0, per: 10, total: {{ count($hosts) }} }">
-        <div class="flex items-center gap-3 border-b border-neutral-200 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:border-white/[0.07] dark:text-fg-dim">
-            <span class="min-w-0 flex-1">Host</span>
-            <span class="hidden w-16 shrink-0 text-right sm:inline" title="Request volume relative to the busiest row in this list">Volume</span>
-            <span class="w-16 shrink-0 text-right">Requests</span>
-            <span class="hidden w-16 shrink-0 text-right sm:inline" title="Total response data sent">Bandwidth</span>
+    <div x-data="trafficTable()">
+        <div class="flex items-center gap-3 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+            @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Host', 'text' => true, 'class' => 'min-w-0 flex-1'])
+            <span class="hidden w-16 shrink-0 sm:inline" aria-hidden="true"></span>
+            @include('livewire.traffic._sort-header', ['column' => 'requests', 'label' => 'Requests', 'class' => 'w-16 shrink-0'])
+            @include('livewire.traffic._sort-header', ['column' => 'bytesOut', 'label' => 'Bandwidth', 'class' => 'hidden w-16 shrink-0 sm:inline-flex', 'title' => 'Total response data sent'])
         </div>
-        @foreach ($hosts as $row)
-            @php
-                $host = (string) ($row['host'] ?? '');
-                $known = $host !== '';
-                $requests = (int) ($row['requests'] ?? 0);
-                $width = min(100, round(($requests / $maxRequests) * 100, 1));
-            @endphp
-            <div wire:key="{{ $keyPrefix }}-{{ $loop->index }}"
-                x-show="{{ $loop->index }} >= page * per && {{ $loop->index }} < (page + 1) * per"
-                class="flex min-h-11 items-center gap-3 border-b border-neutral-200 px-4 py-2 last:border-b-0 dark:border-white/[0.07]">
-                @if ($known)
-                    <a href="https://{{ $host }}" target="_blank" rel="noopener noreferrer nofollow"
-                        class="min-w-0 flex-1 truncate font-mono text-[12px] text-black hover:underline dark:text-fg">{{ $host }}</a>
-                @else
-                    <span class="min-w-0 flex-1 truncate text-[12px] text-neutral-500 dark:text-fg-dim">Unknown host</span>
-                @endif
-                <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
-                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+        <div class="flex flex-col">
+            @foreach ($hosts as $row)
+                @php
+                    $host = (string) ($row['host'] ?? '');
+                    $known = $host !== '';
+                    $requests = (int) ($row['requests'] ?? 0);
+                    $bandwidth = (int) ($row['bandwidth'] ?? 0);
+                    $width = min(100, round(($requests / $maxRequests) * 100, 1));
+                @endphp
+                <div wire:key="{{ $keyPrefix }}-{{ md5($host) }}"
+                    data-row="{{ json_encode(['name' => $host, 'requests' => $requests, 'bytesOut' => $bandwidth]) }}" @if (! $known) data-pinned @endif
+                    x-show="shown($el)"
+                    class="flex min-h-11 items-center gap-3 border-t border-neutral-200 px-4 py-2 transition-colors hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.03]">
+                    @if ($known)
+                        <a href="https://{{ $host }}" target="_blank" rel="noopener noreferrer nofollow"
+                            class="min-w-0 flex-1 truncate font-mono text-[12px] text-black hover:underline dark:text-fg">{{ $host }}</a>
+                    @else
+                        <span class="min-w-0 flex-1 truncate text-[12px] text-neutral-500 dark:text-fg-dim">Unknown host</span>
+                    @endif
+                    <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]"
+                        title="Request volume relative to the busiest row in this list">
+                        <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+                    </div>
+                    <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                        title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
+                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($bandwidth) }}</span>
                 </div>
-                <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
-                    title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
-                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes((int) ($row['bandwidth'] ?? 0)) }}</span>
-            </div>
-        @endforeach
+            @endforeach
+        </div>
         @include('livewire.traffic._pager')
     </div>
 @endif
diff --git a/resources/views/livewire/traffic/_pager.blade.php b/resources/views/livewire/traffic/_pager.blade.php
index 73aa17cc9b..d0dcf08dd0 100644
--- a/resources/views/livewire/traffic/_pager.blade.php
+++ b/resources/views/livewire/traffic/_pager.blade.php
@@ -1,7 +1,7 @@
 {{--
     Client-side "top 10" pager footer for traffic lists. Expects an enclosing
     Alpine scope that defines reactive `page` (0-based), `per` (page size) and
-    `total` (row count). Rows themselves are toggled with x-show on their index;
+    `total` (row count). Rows themselves are toggled with x-show by their scope;
     this partial only renders the summary + prev/next controls, and hides itself
     when everything fits on one page.
 --}}
diff --git a/resources/views/livewire/traffic/_paths-list.blade.php b/resources/views/livewire/traffic/_paths-list.blade.php
index 2882b0e69b..0287c84996 100644
--- a/resources/views/livewire/traffic/_paths-list.blade.php
+++ b/resources/views/livewire/traffic/_paths-list.blade.php
@@ -1,82 +1,90 @@
 {{--
-    Paginated "top paths" list. Each row shows the request path, a proportional
-    request-volume bar, and right-aligned compact metrics (requests / bytes / p95).
-    The path links to its live URL when the owning domain is known (new tab,
-    rel="noopener noreferrer nofollow"); the domain shows next to the path so the
-    same path of two apps stays apart. Sentinel's `__other__` overflow row reads
-    as "Other paths". Expects `$paths` in scope; optional
-    `$keyPrefix` to namespace wire:keys.
+    Sortable, paginated "top paths" list. Each row shows the request path, a
+    proportional request-volume bar, and right-aligned compact metrics. Select a
+    column header to sort by it. The path links to its live URL when the owning
+    domain is known (new tab, rel="noopener noreferrer nofollow"); the domain shows
+    next to the path so the same path of two apps stays apart. Sentinel's
+    `__other__` overflow row reads as "Other paths" and stays last. Expects
+    `$paths` in scope; optional `$keyPrefix` to namespace wire:keys.
 
-    @param iterable $paths      path rows: ['path', 'domain'?, 'requests', 'bytesOut', 'p95']
+    @param iterable $paths      path rows: ['path', 'domain'?, 'requests', 'bytesOut', 's4xx', 's5xx', 'p95']
     @param ?string  $keyPrefix  wire:key prefix (default "analytics-path")
 --}}
 @php
     $paths = $paths ?? [];
     $keyPrefix = $keyPrefix ?? 'analytics-path';
     $maxRequests = max(1, (int) collect($paths)->max('requests'));
+    $muted = 'text-neutral-300 dark:text-fg-faint';
 @endphp
 @if (collect($paths)->isEmpty())
     <x-empty size="sm" title="No path data" description="No requests were recorded for the selected range."
         icon-name="unordered-list" />
 @else
-    <div x-data="{ page: 0, per: 10, total: {{ count($paths) }} }">
-        <div class="flex items-center gap-3 border-b border-neutral-200 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:border-white/[0.07] dark:text-fg-dim">
-            <span class="min-w-0 flex-1">Path</span>
-            <span class="hidden w-16 shrink-0 text-right sm:inline" title="Request volume relative to the busiest row in this list">Volume</span>
-            <span class="w-16 shrink-0 text-right">Requests</span>
-            <span class="hidden w-14 shrink-0 text-right sm:inline" title="HTTP 4xx client-error responses">4xx errors</span>
-            <span class="w-14 shrink-0 text-right" title="HTTP 5xx server-error responses">5xx errors</span>
-            <span class="hidden w-12 shrink-0 text-right lg:inline" title="Percentage of requests with a 4xx or 5xx response">Error %</span>
-            <span class="hidden w-16 shrink-0 text-right sm:inline" title="Total response data sent">Bandwidth</span>
-            <span class="hidden w-16 shrink-0 text-right md:inline" title="95% of requests completed within this response time">p95 latency</span>
+    <div x-data="trafficTable()">
+        <div class="flex items-center gap-3 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+            @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Path', 'text' => true, 'class' => 'min-w-0 flex-1'])
+            <span class="hidden w-16 shrink-0 sm:inline" aria-hidden="true"></span>
+            @include('livewire.traffic._sort-header', ['column' => 'requests', 'label' => 'Requests', 'class' => 'w-16 shrink-0'])
+            @include('livewire.traffic._sort-header', ['column' => 's4xx', 'label' => '4xx', 'class' => 'hidden w-12 shrink-0 sm:inline-flex', 'title' => 'HTTP 4xx client-error responses'])
+            @include('livewire.traffic._sort-header', ['column' => 's5xx', 'label' => '5xx', 'class' => 'w-12 shrink-0', 'title' => 'HTTP 5xx server-error responses'])
+            @include('livewire.traffic._sort-header', ['column' => 'errorRate', 'label' => 'Error %', 'class' => 'hidden w-14 shrink-0 lg:inline-flex', 'title' => 'Percentage of requests with a 4xx or 5xx response'])
+            @include('livewire.traffic._sort-header', ['column' => 'bytesOut', 'label' => 'Bandwidth', 'class' => 'hidden w-16 shrink-0 sm:inline-flex', 'title' => 'Total response data sent'])
+            @include('livewire.traffic._sort-header', ['column' => 'p95', 'label' => 'p95', 'class' => 'hidden w-16 shrink-0 md:inline-flex', 'title' => '95% of requests completed within this response time'])
         </div>
-        @foreach ($paths as $path)
-            @php
-                $domain = $path['domain'] ?? null;
-                $pathStr = (string) ($path['path'] ?? '');
-                $isOther = $pathStr === '__other__';
-                $href = $domain && ! $isOther ? 'https://'.$domain.$pathStr : null;
-                $requests = (int) ($path['requests'] ?? 0);
-                $s4xx = (int) ($path['s4xx'] ?? 0);
-                $s5xx = (int) ($path['s5xx'] ?? 0);
-                $errorRate = $requests > 0 ? round((($s4xx + $s5xx) / $requests) * 100, 1) : 0;
-                $width = min(100, round(($requests / $maxRequests) * 100, 1));
-            @endphp
-            <div wire:key="{{ $keyPrefix }}-{{ md5($domain."\n".$pathStr) }}"
-                x-show="{{ $loop->index }} >= page * per && {{ $loop->index }} < (page + 1) * per"
-                class="flex min-h-11 items-center gap-3 border-b border-neutral-200 px-4 py-2 last:border-b-0 dark:border-white/[0.07]">
-                @if ($isOther)
-                    <span class="min-w-0 flex-1 truncate text-[12px] text-neutral-500 dark:text-fg-dim"
-                        title="All paths outside the top paths that Sentinel tracks">Other paths</span>
-                @else
-                    <span class="flex min-w-0 flex-1 items-baseline gap-1.5">
-                        @if ($href)
-                            <a href="{{ $href }}" target="_blank" rel="noopener noreferrer nofollow"
-                                class="truncate font-mono text-[12px] text-black hover:underline dark:text-fg">{{ $pathStr }}</a>
-                        @else
-                            <span class="truncate font-mono text-[12px] text-black dark:text-fg">{{ $pathStr }}</span>
-                        @endif
-                        @if ($domain)
-                            <span class="max-w-48 shrink-0 truncate text-[11px] text-neutral-400 dark:text-fg-faint" title="{{ $domain }}">{{ $domain }}</span>
-                        @endif
-                    </span>
-                @endif
-                <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
-                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+        <div class="flex flex-col">
+            @foreach ($paths as $path)
+                @php
+                    $domain = $path['domain'] ?? null;
+                    $pathStr = (string) ($path['path'] ?? '');
+                    $isOther = $pathStr === '__other__';
+                    $href = $domain && ! $isOther ? 'https://'.$domain.$pathStr : null;
+                    $requests = (int) ($path['requests'] ?? 0);
+                    $s4xx = (int) ($path['s4xx'] ?? 0);
+                    $s5xx = (int) ($path['s5xx'] ?? 0);
+                    $bytesOut = (int) ($path['bytesOut'] ?? 0);
+                    $p95 = (float) ($path['p95'] ?? 0);
+                    $errorRate = $requests > 0 ? round((($s4xx + $s5xx) / $requests) * 100, 1) : 0;
+                    $width = min(100, round(($requests / $maxRequests) * 100, 1));
+                    $sort = ['name' => $pathStr.' '.$domain, 'requests' => $requests, 's4xx' => $s4xx, 's5xx' => $s5xx, 'errorRate' => $errorRate, 'bytesOut' => $bytesOut, 'p95' => $p95];
+                @endphp
+                <div wire:key="{{ $keyPrefix }}-{{ md5($domain."\n".$pathStr) }}"
+                    data-row="{{ json_encode($sort) }}" @if ($isOther) data-pinned @endif
+                    x-show="shown($el)"
+                    class="flex min-h-11 items-center gap-3 border-t border-neutral-200 px-4 py-2 transition-colors hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.03]">
+                    @if ($isOther)
+                        <span class="min-w-0 flex-1 truncate text-[12px] text-neutral-500 dark:text-fg-dim"
+                            title="All paths outside the top paths that Sentinel tracks">Other paths</span>
+                    @else
+                        <span class="flex min-w-0 flex-1 items-baseline gap-1.5">
+                            @if ($href)
+                                <a href="{{ $href }}" target="_blank" rel="noopener noreferrer nofollow"
+                                    class="truncate font-mono text-[12px] text-black hover:underline dark:text-fg">{{ $pathStr }}</a>
+                            @else
+                                <span class="truncate font-mono text-[12px] text-black dark:text-fg">{{ $pathStr }}</span>
+                            @endif
+                            @if ($domain)
+                                <span class="max-w-48 shrink-0 truncate text-[11px] text-neutral-400 dark:text-fg-faint" title="{{ $domain }}">{{ $domain }}</span>
+                            @endif
+                        </span>
+                    @endif
+                    <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]"
+                        title="Request volume relative to the busiest row in this list">
+                        <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+                    </div>
+                    <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                        title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
+                    <span @class(['hidden w-12 shrink-0 text-right text-[12px] tabular-nums sm:inline', $s4xx > 0 ? 'font-medium text-pink-600 dark:text-pink-400' : $muted])
+                        title="{{ number_format($s4xx) }} client-error responses">{{ compactNumber($s4xx) }}</span>
+                    <span @class(['w-12 shrink-0 text-right text-[12px] tabular-nums', $s5xx > 0 ? 'font-medium text-purple-600 dark:text-purple-400' : $muted])
+                        title="{{ number_format($s5xx) }} server-error responses">{{ compactNumber($s5xx) }}</span>
+                    <span @class(['hidden w-14 shrink-0 text-right text-[11px] tabular-nums lg:inline', $errorRate > 0 ? 'text-neutral-500 dark:text-fg-dim' : $muted])
+                        title="Combined 4xx and 5xx response rate">{{ $errorRate }}%</span>
+                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($bytesOut) }}</span>
+                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 md:inline dark:text-fg-faint"
+                        title="p95 latency">{{ number_format($p95, 1) }} ms</span>
                 </div>
-                <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
-                    title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
-                <span class="hidden w-14 shrink-0 text-right text-[11px] font-medium tabular-nums text-pink-600 sm:inline dark:text-pink-400"
-                    title="{{ number_format($s4xx) }} client-error responses">{{ compactNumber($s4xx) }} 4xx</span>
-                <span class="w-14 shrink-0 text-right text-[11px] font-medium tabular-nums text-purple-600 dark:text-purple-400"
-                    title="{{ number_format($s5xx) }} server-error responses">{{ compactNumber($s5xx) }} 5xx</span>
-                <span class="hidden w-12 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 lg:inline dark:text-fg-faint"
-                    title="Combined 4xx and 5xx response rate">{{ $errorRate }}%</span>
-                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes((int) ($path['bytesOut'] ?? 0)) }}</span>
-                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 md:inline dark:text-fg-faint"
-                    title="p95 latency">{{ number_format((float) ($path['p95'] ?? 0), 1) }} ms</span>
-            </div>
-        @endforeach
+            @endforeach
+        </div>
         @include('livewire.traffic._pager')
     </div>
 @endif
diff --git a/resources/views/livewire/traffic/_sort-header.blade.php b/resources/views/livewire/traffic/_sort-header.blade.php
new file mode 100644
index 0000000000..82602ee4cf
--- /dev/null
+++ b/resources/views/livewire/traffic/_sort-header.blade.php
@@ -0,0 +1,31 @@
+{{--
+    One sortable column header for a traffic list. Expects an enclosing Alpine
+    scope from `trafficTable()` (resources/js/traffic-table.js).
+
+    @param string  $column  key in the rows' `data-row` JSON
+    @param string  $label   header text
+    @param ?string $class   width and responsive classes of the column; a column that
+                            hides on small screens passes `hidden <breakpoint>:inline-flex`
+    @param ?string $title   tooltip
+    @param ?bool   $text    true for a text column: left-aligned, first sort ascending
+    @param ?string $dir     first sort direction, when it differs from the default of the alignment
+--}}
+@php
+    $text = $text ?? false;
+    $firstDir = $dir ?? ($text ? 'asc' : 'desc');
+    $class = $class ?? '';
+    // `hidden` and `inline-flex` on one element conflict, so add the display only when the caller sets none.
+    $display = str_contains($class, 'hidden') ? '' : 'inline-flex';
+@endphp
+<button type="button" @click="sortBy('{{ $column }}', '{{ $firstDir }}')"
+    title="{{ $title ?? 'Sort by '.strtolower($label) }}"
+    :aria-label="'Sort by {{ strtolower($label) }}' + (sorted('{{ $column }}') ? ', sorted ' + (sorted('{{ $column }}') === 'asc' ? 'ascending' : 'descending') : '')"
+    class="group {{ $display }} items-center gap-1 whitespace-nowrap rounded-sm transition-colors hover:text-black focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:hover:text-fg {{ $text ? 'justify-start text-left' : 'flex-row-reverse justify-start text-right' }} {{ $class }}"
+    :class="sorted('{{ $column }}') ? 'text-black dark:text-fg' : ''">
+    <span>{{ $label }}</span>
+    <svg class="size-3 shrink-0 transition-[opacity,transform]" viewBox="0 0 24 24" fill="none" stroke="currentColor"
+        stroke-width="2.5" aria-hidden="true"
+        :class="[sorted('{{ $column }}') ? 'opacity-100' : 'opacity-0 group-hover:opacity-50', sorted('{{ $column }}') === 'asc' ? 'rotate-180' : '']">
+        <path stroke-linecap="round" stroke-linejoin="round" d="M6 9l6 6 6-6" />
+    </svg>
+</button>
diff --git a/resources/views/livewire/traffic/_sparkline.blade.php b/resources/views/livewire/traffic/_sparkline.blade.php
index 4fb3ce8cc2..5999cc1b82 100644
--- a/resources/views/livewire/traffic/_sparkline.blade.php
+++ b/resources/views/livewire/traffic/_sparkline.blade.php
@@ -16,14 +16,16 @@
     @param string   $colorVar  CSS custom property for the line color (e.g. --chart-status-3xx)
     @param ?string  $event     Livewire event to listen on for updates (optional)
     @param ?string  $key       payload key holding the numeric array (required with $event)
+    @param ?array   $categories initial x-axis timestamps (defaults to $series buckets)
 --}}
 @php
     $initial = $initial ?? [];
     $colorVar = $colorVar ?? '--chart-status-3xx';
+    $color = $color ?? '';
     $event = $event ?? '';
     $key = $key ?? '';
-    $initialCategories = array_column($series ?? [], 'bucket');
-    $label = match ($key) {
+    $initialCategories = $categories ?? array_column($series ?? [], 'bucket');
+    $label = $label ?? match ($key) {
         'requestsSpark' => 'Requests',
         'uniquesSpark' => 'Visitors',
         'bandwidthSpark' => 'Bandwidth',
@@ -31,12 +33,17 @@
         'latencySpark' => 'p95 latency',
         default => 'Value',
     };
+    $format = $format ?? match ($key) {
+        'bandwidthSpark' => 'bytes',
+        'latencySpark' => 'ms',
+        default => 'number',
+    };
 @endphp
 <div wire:ignore id="{!! $id !!}" class="h-9 w-full [&_.apexcharts-svg]:overflow-visible!"
     x-data="{
         chart: null,
         refreshCleanup: null,
-        accent() { return getComputedStyle(document.documentElement).getPropertyValue('{{ $colorVar }}').trim() || '#3b82f6'; },
+        accent() { const c = @js($color); if (c) { return c; } return getComputedStyle(document.documentElement).getPropertyValue('{{ $colorVar }}').trim() || '#3b82f6'; },
         muted() { return getComputedStyle(document.documentElement).getPropertyValue('--chart-geo-empty').trim() || 'rgba(128,128,128,0.45)'; },
         isFlat(a) { return !Array.isArray(a) || a.length === 0 || a.every(v => !Number(v)); },
         points(values, categories) {
@@ -68,14 +75,17 @@
                 timeZoneName: 'short',
             });
             const formatValue = value => {
-                if (@js($key) === 'bandwidthSpark') {
+                if (value === null || value === undefined) { return '—'; }
+                const fmt = @js($format);
+                if (fmt === 'bytes') {
                     const units = ['B', 'KB', 'MB', 'GB', 'TB'];
                     let amount = Number(value) || 0;
                     let unit = 0;
                     while (amount >= 1024 && unit < units.length - 1) { amount /= 1024; unit++; }
                     return `${Number(amount.toFixed(unit === 0 ? 0 : 2))} ${units[unit]}`;
                 }
-                if (@js($key) === 'latencySpark') { return `${Number(value).toLocaleString()} ms`; }
+                if (fmt === 'ms') { return `${Number(value).toLocaleString()} ms`; }
+                if (fmt === 'percent') { return `${Number(Number(value).toFixed(1)).toLocaleString()}%`; }
                 return Number(value).toLocaleString();
             };
             this.chart = new ApexCharts($el, {
diff --git a/resources/views/proxy/error-page.blade.php b/resources/views/proxy/error-page.blade.php
new file mode 100644
index 0000000000..4a8d2e7cc1
--- /dev/null
+++ b/resources/views/proxy/error-page.blade.php
@@ -0,0 +1,18 @@
+@extends('proxy.layout')
+
+@section('title', 'Site not available')
+
+@section('content')
+    <p class="status">503 Service Unavailable</p>
+    <h1>This site is not available at the moment</h1>
+    <p><span id="host">This site</span> cannot answer your request right now. Please try again later.</p>
+    <section>
+        <h2>Are you the site owner?</h2>
+        <ul>
+            <li>The domain is not configured on a resource in Coolify, or its DNS points to another server.</li>
+            <li>The application is stopped, still deploying, or has crashed.</li>
+            <li>The application health check is failing.</li>
+        </ul>
+        <a href="https://coolify.io/docs/troubleshoot/applications/no-available-server" rel="noopener noreferrer">Read the troubleshooting guide</a>
+    </section>
+@endsection
diff --git a/resources/views/proxy/layout.blade.php b/resources/views/proxy/layout.blade.php
new file mode 100644
index 0000000000..077b3ce2f6
--- /dev/null
+++ b/resources/views/proxy/layout.blade.php
@@ -0,0 +1,116 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="robots" content="noindex">
+    <title>@yield('title')</title>
+    <style>
+        :root {
+            color-scheme: light dark;
+            --canvas: #fafafa;
+            --card: #ffffff;
+            --hairline: #d4d4d4;
+            --text: #171717;
+            --subtle: #737373;
+            --accent: #6b16ed;
+        }
+
+        @media (prefers-color-scheme: dark) {
+            :root {
+                --canvas: #0a0a0a;
+                --card: #1c1c1c;
+                --hairline: #333333;
+                --text: #f5f5f5;
+                --subtle: #a3a3a3;
+                --accent: #fcd452;
+            }
+        }
+
+        * {
+            box-sizing: border-box;
+        }
+
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 24px;
+            background: var(--canvas);
+            color: var(--text);
+            font: 14px/1.6 'Geist Sans', Inter, ui-sans-serif, system-ui, -apple-system, 'Segoe UI', sans-serif;
+            -webkit-font-smoothing: antialiased;
+        }
+
+        main {
+            width: 100%;
+            max-width: 560px;
+            padding: 32px;
+            background: var(--card);
+            border-radius: 12px;
+            box-shadow: 0 0 0 1px var(--hairline), 0 1px 2px rgb(0 0 0 / 0.05);
+        }
+
+        .status {
+            margin: 0 0 8px;
+            color: var(--subtle);
+            font: 12px/1.4 'Geist Mono', ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+        }
+
+        h1 {
+            margin: 0 0 8px;
+            font-size: 20px;
+            line-height: 1.3;
+            font-weight: 600;
+        }
+
+        h2 {
+            margin: 0 0 8px;
+            font-size: 14px;
+            font-weight: 600;
+        }
+
+        p {
+            margin: 0;
+            color: var(--subtle);
+        }
+
+        section {
+            margin-top: 24px;
+            padding-top: 24px;
+            border-top: 1px solid var(--hairline);
+        }
+
+        ul {
+            margin: 0 0 16px;
+            padding-left: 20px;
+            color: var(--subtle);
+        }
+
+        li + li {
+            margin-top: 4px;
+        }
+
+        a {
+            color: var(--accent);
+            font-weight: 500;
+        }
+
+        #host {
+            color: var(--text);
+            font-weight: 500;
+            word-break: break-all;
+        }
+    </style>
+</head>
+<body>
+    <main>
+        @yield('content')
+    </main>
+    <script>
+        document.getElementById('host').textContent = location.hostname || 'This site';
+    </script>
+</body>
+</html>
diff --git a/resources/views/proxy/maintenance-page.blade.php b/resources/views/proxy/maintenance-page.blade.php
new file mode 100644
index 0000000000..236e6c8706
--- /dev/null
+++ b/resources/views/proxy/maintenance-page.blade.php
@@ -0,0 +1,9 @@
+@extends('proxy.layout')
+
+@section('title', 'Under maintenance')
+
+@section('content')
+    <p class="status">503 Service Unavailable</p>
+    <h1>We are doing some maintenance</h1>
+    <p><span id="host">This site</span> is temporarily unavailable for maintenance. Please check back soon.</p>
+@endsection
diff --git a/resources/views/source/all.blade.php b/resources/views/source/all.blade.php
index fc93d4a72c..528f92d98c 100644
--- a/resources/views/source/all.blade.php
+++ b/resources/views/source/all.blade.php
@@ -44,6 +44,16 @@
                             </x-slot:content>
                             <livewire:source.gitlab.create />
                         </x-modal-input>
+                        <x-modal-input title="New Gitea App" :closeOutside="false">
+                            <x-slot:content>
+                                <button type="button" @click="dropdownOpen = false"
+                                    class="listbox-option justify-start! gap-2.5!" role="menuitem">
+                                    <x-git-icon class="size-3.5 shrink-0 opacity-70" git="App\Models\GiteaApp" />
+                                    Gitea App
+                                </button>
+                            </x-slot:content>
+                            <livewire:source.gitea.create />
+                        </x-modal-input>
                     </div>
                 </div>
             @endcan
@@ -56,11 +66,15 @@
         @else
             @php
                 $items = $sources->map(function ($source) {
-                    $isGithub = $source->getMorphClass() === 'App\\Models\\GithubApp';
+                    $isGitlab = $source->getMorphClass() === 'App\\Models\\GitlabApp';
                     return [
                         'name' => $source->name,
-                        'provider' => $isGithub ? 'GitHub' : 'GitLab',
-                        'organization' => $isGithub ? $source->organization : $source->group_name,
+                        'provider' => match ($source->getMorphClass()) {
+                            'App\\Models\\GithubApp' => 'GitHub',
+                            'App\\Models\\GiteaApp' => 'Gitea',
+                            default => 'GitLab',
+                        },
+                        'organization' => $isGitlab ? $source->group_name : $source->organization,
                         'status' => $source->isConnected() ? 'Connected' : 'Setup incomplete',
                     ];
                 })->values();
@@ -71,7 +85,7 @@
                 matches(values) { const query = this.search.trim().toLowerCase(); return !query || values.some(value => String(value || '').toLowerCase().includes(query)); },
                 setViewMode(mode) { this.viewMode = mode; localStorage.setItem('coolify-sources-view', mode); }
             }">
-            @include('livewire.shared.list-search-controls', ['placeholder' => 'Search sources', 'singular' => 'source', 'plural' => 'sources'])
+            @include('livewire.shared.list-search-controls', ['placeholder' => 'Search sources'])
             <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                 @foreach ($sources as $source)
                     @if ($source->getMorphClass() === 'App\Models\GithubApp')
@@ -120,6 +134,33 @@
                                 </div>
                             </div>
 
+                            <div class="mt-auto pt-4">
+                                @if ($source->isConnected())
+                                    <x-status-badge label="Connected" type="success" />
+                                @else
+                                    <x-status-badge label="Setup required" type="warning" />
+                                @endif
+                            </div>
+                        </a>
+                    @elseif ($source->getMorphClass() === 'App\Models\GiteaApp')
+                        <a x-show="matches(@js([$source->name, 'Gitea', $source->organization, $source->isConnected() ? 'Connected' : 'Setup incomplete']))" class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
+                            {{ wireNavigate() }}
+                            href="{{ route('source.gitea.show', ['gitea_app_uuid' => data_get($source, 'uuid')]) }}">
+                            <div class="flex items-start gap-3">
+                                <div
+                                    class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+                                    <x-git-icon class="size-4" git="App\Models\GiteaApp" />
+                                </div>
+                                <div class="min-w-0 flex-1">
+                                    <h2 class="truncate text-[13px]! leading-4! font-semibold! text-black dark:text-fg">
+                                        {{ $source->name }}
+                                    </h2>
+                                    <p class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+                                        {{ $source->organization ? "Gitea · {$source->organization}" : 'Gitea' }}
+                                    </p>
+                                </div>
+                            </div>
+
                             <div class="mt-auto pt-4">
                                 @if ($source->isConnected())
                                     <x-status-badge label="Connected" type="success" />
@@ -135,10 +176,11 @@
                 <div class="grid min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.7fr)_9rem] border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint"><div>Source</div><div>Provider</div><div>Status</div></div>
                 @foreach ($sources as $source)
                     @php
-                        $isGithub = $source->getMorphClass() === 'App\\Models\\GithubApp';
-                        $provider = $isGithub ? 'GitHub' : 'GitLab';
-                        $organization = $isGithub ? $source->organization : $source->group_name;
-                        $href = $isGithub ? route('source.github.show', ['github_app_uuid' => $source->uuid]) : route('source.gitlab.show', ['gitlab_app_uuid' => $source->uuid]);
+                        [$provider, $organization, $href] = match ($source->getMorphClass()) {
+                            'App\\Models\\GithubApp' => ['GitHub', $source->organization, route('source.github.show', ['github_app_uuid' => $source->uuid])],
+                            'App\\Models\\GiteaApp' => ['Gitea', $source->organization, route('source.gitea.show', ['gitea_app_uuid' => $source->uuid])],
+                            default => ['GitLab', $source->group_name, route('source.gitlab.show', ['gitlab_app_uuid' => $source->uuid])],
+                        };
                     @endphp
                     <a x-show="matches(@js([$source->name, $provider, $organization, $source->isConnected() ? 'Connected' : 'Setup incomplete']))" {{ wireNavigate() }} href="{{ $href }}" class="grid min-h-14 min-w-[620px] grid-cols-[minmax(0,1fr)_minmax(10rem,.7fr)_9rem] items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                         <div class="truncate font-semibold text-black dark:text-fg">{{ $source->name }}</div>
diff --git a/routes/ai.php b/routes/ai.php
index d3f9bf83d2..154866edcc 100644
--- a/routes/ai.php
+++ b/routes/ai.php
@@ -1,8 +1,7 @@
 <?php
 
-use App\Http\Middleware\ApiIpAllowed;
 use App\Mcp\Servers\CoolifyServer;
 use Laravel\Mcp\Facades\Mcp;
 
 Mcp::web('/mcp', CoolifyServer::class)
-    ->middleware(['mcp.enabled', 'auth:sanctum', 'api.token.team', ApiIpAllowed::class, 'mcp.team.enabled']);
+    ->middleware(['mcp.enabled', 'api.ip.allowed', 'auth:sanctum', 'api.token.team', 'mcp.team.enabled']);
diff --git a/routes/api.php b/routes/api.php
index bfbb2d29fa..f2efce3b00 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -13,6 +13,7 @@ use App\Http\Controllers\Api\DigitalOceanController;
 use App\Http\Controllers\Api\GithubController;
 use App\Http\Controllers\Api\GitlabController;
 use App\Http\Controllers\Api\HetznerController;
+use App\Http\Controllers\Api\HostingerController;
 use App\Http\Controllers\Api\InstanceEmailSettingsController;
 use App\Http\Controllers\Api\IntegrationTokensController;
 use App\Http\Controllers\Api\NotificationsController;
@@ -40,7 +41,6 @@ use App\Http\Controllers\Api\TeamController;
 use App\Http\Controllers\Api\VolumeBackupsController;
 use App\Http\Controllers\Api\VultrController;
 use App\Http\Middleware\ApiAllowed;
-use App\Http\Middleware\ApiIpAllowed;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/health', [OtherController::class, 'healthcheck']);
@@ -54,12 +54,10 @@ Route::post('/feedback', [OtherController::class, 'feedback'])
     ->middleware('throttle:feedback');
 
 Route::group([
-    'middleware' => ['auth:sanctum', 'api.token.team', ApiIpAllowed::class, 'api.ability:write'],
+    'middleware' => ['api.ip.allowed', 'auth:sanctum', 'api.token.team', 'api.ability:write'],
     'prefix' => 'v1',
 ], function () {
-    Route::get('/enable', [OtherController::class, 'post_required']);
     Route::get('/disable', [OtherController::class, 'post_required']);
-    Route::post('/enable', [OtherController::class, 'enable_api']);
     Route::post('/disable', [OtherController::class, 'disable_api']);
     Route::post('/mcp/enable', [OtherController::class, 'enable_mcp']);
     Route::post('/mcp/disable', [OtherController::class, 'disable_mcp']);
@@ -205,9 +203,9 @@ Route::group([
     Route::post('/servers/{uuid}/proxy/restart', [ServerProxyController::class, 'restart'])->middleware(['api.ability:deploy']);
 
     Route::post('/servers', [ServersController::class, 'create_server'])->middleware(['api.ability:write']);
+    Route::get('/servers/import/check', [ServerTransferController::class, 'check'])->middleware(['api.ability:write', 'api.ability:deploy']);
     Route::post('/servers/import', [ServerTransferController::class, 'import'])->middleware(['api.ability:write', 'api.ability:deploy']);
-    Route::get('/servers/{uuid}/export', [ServerTransferController::class, 'export'])->middleware(['api.ability:read']);
-    Route::post('/servers/{uuid}/export/mailbox', [ServerTransferController::class, 'writeMailbox'])->middleware(['api.ability:write']);
+    Route::get('/servers/{uuid}/transfer', [ServerTransferController::class, 'status'])->middleware(['api.ability:read,write']);
     Route::post('/servers/{uuid}/transfer/complete', [ServerTransferController::class, 'complete'])->middleware(['api.ability:write']);
     Route::post('/servers/{uuid}/migrate', [ServerTransferController::class, 'migrate'])->middleware(['api.ability:write']);
     Route::patch('/servers/{uuid}', [ServersController::class, 'update_server'])->middleware(['api.ability:write']);
@@ -233,6 +231,13 @@ Route::group([
     Route::get('/digitalocean/ssh-keys', [DigitalOceanController::class, 'sshKeys'])->middleware(['api.ability:read']);
     Route::post('/servers/digitalocean', [DigitalOceanController::class, 'createServer'])->middleware(['api.ability:write']);
 
+    Route::get('/hostinger/data-centers', [HostingerController::class, 'dataCenters'])->middleware(['api.ability:read']);
+    Route::get('/hostinger/catalog', [HostingerController::class, 'catalog'])->middleware(['api.ability:read']);
+    Route::get('/hostinger/templates', [HostingerController::class, 'templates'])->middleware(['api.ability:read']);
+    Route::get('/hostinger/ssh-keys', [HostingerController::class, 'sshKeys'])->middleware(['api.ability:read']);
+    Route::get('/hostinger/post-install-scripts', [HostingerController::class, 'postInstallScripts'])->middleware(['api.ability:read']);
+    Route::post('/servers/hostinger', [HostingerController::class, 'createServer'])->middleware(['api.ability:write']);
+
     Route::get('/resources', [ResourcesController::class, 'resources'])->middleware(['api.ability:read']);
 
     Route::get('/tags', [TagsController::class, 'tags'])->middleware(['api.ability:read']);
diff --git a/routes/web.php b/routes/web.php
index 65a9cb4d48..27e1bfa892 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,18 +1,38 @@
 <?php
 
+use App\Http\Controllers\Api\ApplicationsController;
+use App\Http\Controllers\Api\DatabasesController;
+use App\Http\Controllers\Api\DeployController;
+use App\Http\Controllers\Api\DestinationsController;
+use App\Http\Controllers\Api\EnvironmentCanvasController;
+use App\Http\Controllers\Api\GithubController;
+use App\Http\Controllers\Api\ProjectCanvasController;
+use App\Http\Controllers\Api\ProjectController;
+use App\Http\Controllers\Api\SecurityController;
+use App\Http\Controllers\Api\ServerCanvasController;
+use App\Http\Controllers\Api\ServersController;
+use App\Http\Controllers\Api\ServicesController;
+use App\Http\Controllers\Api\SharedVariableCanvasController;
+use App\Http\Controllers\Api\TagCanvasController;
 use App\Http\Controllers\Controller;
+use App\Http\Controllers\FileBrowserDownloadController;
 use App\Http\Controllers\OauthController;
 use App\Http\Controllers\ProfileAvatarController;
 use App\Http\Controllers\ProjectIconController;
+use App\Http\Controllers\TeamAvatarController;
 use App\Http\Controllers\UploadController;
+use App\Http\Middleware\UseSessionTeamApiToken;
 use App\Livewire\Admin\Index as AdminIndex;
 use App\Livewire\Analytics;
 use App\Livewire\Boarding\Index as BoardingIndex;
 use App\Livewire\Dashboard;
+use App\Livewire\Dashboard\Canvas as DashboardCanvas;
+use App\Livewire\DeployCanvas;
 use App\Livewire\Destination\Index as DestinationIndex;
 use App\Livewire\Destination\Resources as DestinationResources;
 use App\Livewire\Destination\Show as DestinationShow;
 use App\Livewire\Dev\LivewireRequestFailurePreview;
+use App\Livewire\Fleet\Metrics as FleetMetrics;
 use App\Livewire\ForcePasswordReset;
 use App\Livewire\Notifications\Discord as NotificationDiscord;
 use App\Livewire\Notifications\Email as NotificationEmail;
@@ -32,8 +52,11 @@ use App\Livewire\Project\Database\Backup\Execution as DatabaseBackupExecution;
 use App\Livewire\Project\Database\Backup\Index as DatabaseBackupIndex;
 use App\Livewire\Project\Database\Configuration as DatabaseConfiguration;
 use App\Livewire\Project\Edit as ProjectEdit;
+use App\Livewire\Project\EnvironmentCanvas;
 use App\Livewire\Project\EnvironmentEdit;
 use App\Livewire\Project\Index as ProjectIndex;
+use App\Livewire\Project\ProjectCanvas;
+use App\Livewire\Project\ProjectsCanvas;
 use App\Livewire\Project\Resource\Create as ResourceCreate;
 use App\Livewire\Project\Resource\Index as ResourceIndex;
 use App\Livewire\Project\Service\Configuration as ServiceConfiguration;
@@ -43,6 +66,7 @@ use App\Livewire\Project\Service\Index as ServiceIndex;
 use App\Livewire\Project\Service\VolumeBackup\Index;
 use App\Livewire\Project\Service\VolumeBackup\Show;
 use App\Livewire\Project\Shared\ExecuteContainerCommand;
+use App\Livewire\Project\Shared\FileBrowser;
 use App\Livewire\Project\Shared\Logs;
 use App\Livewire\Project\Show as ProjectShow;
 use App\Livewire\Security\ApiTokens;
@@ -57,6 +81,7 @@ use App\Livewire\SelectTeam;
 use App\Livewire\Server\Advanced as ServerAdvanced;
 use App\Livewire\Server\Analytics\Show as ServerAnalytics;
 use App\Livewire\Server\CaCertificate\Show as CaCertificateShow;
+use App\Livewire\Server\Canvas as ServerCanvas;
 use App\Livewire\Server\Charts as ServerCharts;
 use App\Livewire\Server\CloudflareTunnel;
 use App\Livewire\Server\CloudProviderToken\Show as CloudProviderTokenShow;
@@ -83,13 +108,13 @@ use App\Livewire\Server\Sentinel\Show as SentinelShow;
 use App\Livewire\Server\Show as ServerShow;
 use App\Livewire\Server\Swarm as ServerSwarm;
 use App\Livewire\Server\Transfer as ServerTransfer;
-use App\Livewire\Server\TransferImport as ServerTransferImport;
 use App\Livewire\Settings\Advanced as SettingsAdvanced;
 use App\Livewire\Settings\Index as SettingsIndex;
 use App\Livewire\Settings\Updates as SettingsUpdates;
 use App\Livewire\SettingsBackup;
 use App\Livewire\SettingsEmail;
 use App\Livewire\SettingsOauth;
+use App\Livewire\SharedVariables\Canvas as SharedVariablesCanvas;
 use App\Livewire\SharedVariables\Environment\Index as EnvironmentSharedVariablesIndex;
 use App\Livewire\SharedVariables\Environment\Show as EnvironmentSharedVariablesShow;
 use App\Livewire\SharedVariables\Index as SharedVariablesIndex;
@@ -98,12 +123,14 @@ use App\Livewire\SharedVariables\Project\Show as ProjectSharedVariablesShow;
 use App\Livewire\SharedVariables\Server\Index as ServerSharedVariablesIndex;
 use App\Livewire\SharedVariables\Server\Show as ServerSharedVariablesShow;
 use App\Livewire\SharedVariables\Team\Index as TeamSharedVariablesIndex;
+use App\Livewire\Source\Gitea\Change as GiteaChange;
 use App\Livewire\Source\Github\Change as GitHubChange;
 use App\Livewire\Source\Gitlab\Change as GitLabChange;
 use App\Livewire\Storage\Index as StorageIndex;
 use App\Livewire\Storage\Show as StorageShow;
 use App\Livewire\Subscription\Index as SubscriptionIndex;
 use App\Livewire\Subscription\Show as SubscriptionShow;
+use App\Livewire\Tags\Canvas as TagsCanvas;
 use App\Livewire\Tags\Show as TagsShow;
 use App\Livewire\Team\AdminView as TeamAdminView;
 use App\Livewire\Team\AuditLog as TeamAuditLog;
@@ -166,7 +193,65 @@ Route::middleware(['auth', 'verified'])->group(function () {
     });
 
     Route::get('/', Dashboard::class)->name('dashboard');
+    Route::get('/dashboard/canvas', DashboardCanvas::class)->name('dashboard.canvas');
     Route::get('/analytics', Analytics::class)->name('analytics');
+    Route::get('/metrics', FleetMetrics::class)->name('metrics');
+    Route::get('/canvas', DeployCanvas::class)->name('deploy-canvas');
+    Route::get('/canvas/tags', TagsCanvas::class)->name('tags.canvas');
+    // The canvas calls these API controllers with the browser session (no API token).
+    Route::prefix('canvas/api')->middleware([UseSessionTeamApiToken::class, 'api.token.team', 'api.sensitive'])->group(function () {
+        Route::get('/projects', [ProjectController::class, 'projects'])->middleware(['api.ability:read']);
+        Route::post('/projects', [ProjectController::class, 'create_project'])->middleware(['api.ability:write']);
+        Route::get('/projects/canvas', [ProjectCanvasController::class, 'index'])->middleware(['api.ability:read']);
+        Route::get('/projects/{uuid}/canvas', [ProjectCanvasController::class, 'show'])->middleware(['api.ability:read']);
+        Route::get('/projects/{uuid}/environments', [ProjectController::class, 'get_environments'])->middleware(['api.ability:read']);
+        Route::post('/projects/{uuid}/environments', [ProjectController::class, 'create_environment'])->middleware(['api.ability:write']);
+        Route::get('/projects/{uuid}/environments/{environment_name_or_uuid}/canvas', [EnvironmentCanvasController::class, 'show'])->middleware(['api.ability:read']);
+        Route::patch('/projects/{uuid}/environments/{environment_name_or_uuid}/canvas/positions', [EnvironmentCanvasController::class, 'updatePositions'])->middleware(['api.ability:write']);
+        Route::post('/projects/{uuid}/environments/{environment_name_or_uuid}/canvas/links', [EnvironmentCanvasController::class, 'storeLink'])->middleware(['api.ability:write']);
+        Route::patch('/projects/{uuid}/environments/{environment_name_or_uuid}/canvas/links/{link_uuid}', [EnvironmentCanvasController::class, 'updateLink'])->middleware(['api.ability:write']);
+        Route::delete('/projects/{uuid}/environments/{environment_name_or_uuid}/canvas/links/{link_uuid}', [EnvironmentCanvasController::class, 'destroyLink'])->middleware(['api.ability:write']);
+        Route::get('/tags/canvas', [TagCanvasController::class, 'show'])->middleware(['api.ability:read']);
+        Route::post('/tags/canvas/links', [TagCanvasController::class, 'storeLink'])->middleware(['api.ability:write']);
+        Route::delete('/tags/canvas/links/{link_id}', [TagCanvasController::class, 'destroyLink'])->middleware(['api.ability:write']);
+        Route::get('/shared-variables/team/canvas', [SharedVariableCanvasController::class, 'show'])->middleware(['api.ability:read']);
+        Route::post('/shared-variables/team/canvas/links', [SharedVariableCanvasController::class, 'storeLink'])->middleware(['api.ability:write']);
+        Route::delete('/shared-variables/team/canvas/links/{link_id}', [SharedVariableCanvasController::class, 'destroyLink'])->middleware(['api.ability:write']);
+        Route::get('/shared-variables/{scope}/{uuid}/canvas', [SharedVariableCanvasController::class, 'show'])->whereIn('scope', ['project', 'environment', 'server'])->middleware(['api.ability:read']);
+        Route::post('/shared-variables/{scope}/{uuid}/canvas/links', [SharedVariableCanvasController::class, 'storeLink'])->whereIn('scope', ['project', 'environment', 'server'])->middleware(['api.ability:write']);
+        Route::delete('/shared-variables/{scope}/{uuid}/canvas/links/{link_id}', [SharedVariableCanvasController::class, 'destroyLink'])->whereIn('scope', ['project', 'environment', 'server'])->middleware(['api.ability:write']);
+        Route::get('/servers', [ServersController::class, 'servers'])->middleware(['api.ability:read']);
+        Route::get('/servers/canvas', [ServerCanvasController::class, 'index'])->middleware(['api.ability:read']);
+        Route::get('/dashboard/canvas', [ServerCanvasController::class, 'dashboard'])->middleware(['api.ability:read']);
+        Route::get('/servers/{uuid}/canvas', [ServerCanvasController::class, 'show'])->middleware(['api.ability:read']);
+        Route::get('/servers/{uuid}/canvas/containers', [ServerCanvasController::class, 'containers'])->middleware(['api.ability:read']);
+        Route::get('/servers/{uuid}/canvas/usage', [ServerCanvasController::class, 'usage'])->middleware(['api.ability:read']);
+        Route::get('/servers/{server_uuid}/destinations', [DestinationsController::class, 'index_by_server'])->middleware(['api.ability:read']);
+        Route::get('/github-apps', [GithubController::class, 'list_github_apps'])->middleware(['api.ability:read']);
+        Route::get('/github-apps/{github_app_id}/repositories', [GithubController::class, 'load_repositories'])->middleware(['api.ability:read']);
+        Route::get('/github-apps/{github_app_id}/repositories/{owner}/{repo}/branches', [GithubController::class, 'load_branches'])->middleware(['api.ability:read']);
+        Route::get('/security/keys', [SecurityController::class, 'keys'])->middleware(['api.ability:read']);
+        Route::post('/applications/public', [ApplicationsController::class, 'create_public_application'])->middleware(['api.ability:write']);
+        Route::post('/applications/private-github-app', [ApplicationsController::class, 'create_private_gh_app_application'])->middleware(['api.ability:write']);
+        Route::post('/applications/private-deploy-key', [ApplicationsController::class, 'create_private_deploy_key_application'])->middleware(['api.ability:write']);
+        Route::post('/applications/dockerfile', [ApplicationsController::class, 'create_dockerfile_application'])->middleware(['api.ability:write']);
+        Route::post('/applications/dockerimage', [ApplicationsController::class, 'create_dockerimage_application'])->middleware(['api.ability:write']);
+        Route::get('/applications/{uuid}', [ApplicationsController::class, 'application_by_uuid'])->middleware(['api.ability:read']);
+        Route::patch('/applications/{uuid}', [ApplicationsController::class, 'update_by_uuid'])->middleware(['api.ability:write']);
+        Route::patch('/applications/{uuid}/envs/bulk', [ApplicationsController::class, 'create_bulk_envs'])->middleware(['api.ability:write']);
+        Route::post('/services', [ServicesController::class, 'create_service'])->middleware(['api.ability:write']);
+        Route::patch('/services/{uuid}/envs/bulk', [ServicesController::class, 'create_bulk_envs'])->middleware(['api.ability:write']);
+        Route::post('/databases/postgresql', [DatabasesController::class, 'create_database_postgresql'])->middleware(['api.ability:write']);
+        Route::post('/databases/mysql', [DatabasesController::class, 'create_database_mysql'])->middleware(['api.ability:write']);
+        Route::post('/databases/mariadb', [DatabasesController::class, 'create_database_mariadb'])->middleware(['api.ability:write']);
+        Route::post('/databases/mongodb', [DatabasesController::class, 'create_database_mongodb'])->middleware(['api.ability:write']);
+        Route::post('/databases/redis', [DatabasesController::class, 'create_database_redis'])->middleware(['api.ability:write']);
+        Route::post('/databases/clickhouse', [DatabasesController::class, 'create_database_clickhouse'])->middleware(['api.ability:write']);
+        Route::post('/databases/dragonfly', [DatabasesController::class, 'create_database_dragonfly'])->middleware(['api.ability:write']);
+        Route::post('/databases/keydb', [DatabasesController::class, 'create_database_keydb'])->middleware(['api.ability:write']);
+        Route::post('/deploy', [DeployController::class, 'deploy'])->middleware(['api.ability:deploy']);
+        Route::get('/deployments/{uuid}', [DeployController::class, 'deployment_by_uuid'])->middleware(['api.ability:read']);
+    });
     Route::get('/admin', AdminIndex::class)->name('admin.index');
     Route::get('/onboarding', BoardingIndex::class)->name('onboarding');
 
@@ -186,6 +271,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::get('/profile', ProfileIndex::class)->name('profile');
     Route::get('/profile/avatar', ProfileAvatarController::class)->name('profile.avatar');
     Route::get('/profile/appearance', ProfileAppearance::class)->name('profile.appearance');
+    Route::get('/profile/passkeys/confirm', fn () => redirect()->route('profile')->with('status', 'passkey-add'))
+        ->middleware('password.confirm')
+        ->name('profile.passkeys.confirm');
 
     Route::prefix('tags')->group(function () {
         Route::get('/{tagName?}', TagsShow::class)->name('tags.show');
@@ -209,17 +297,23 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::prefix('shared-variables')->group(function () {
         Route::get('/', SharedVariablesIndex::class)->name('shared-variables.index');
         Route::get('/team', TeamSharedVariablesIndex::class)->name('shared-variables.team.index');
+        Route::get('/team/canvas', SharedVariablesCanvas::class)->name('shared-variables.team.canvas');
         Route::get('/projects', ProjectSharedVariablesIndex::class)->name('shared-variables.project.index');
         Route::get('/project/{project_uuid}', ProjectSharedVariablesShow::class)->name('shared-variables.project.show');
+        Route::get('/project/{project_uuid}/canvas', SharedVariablesCanvas::class)->name('shared-variables.project.canvas');
         Route::get('/environments', EnvironmentSharedVariablesIndex::class)->name('shared-variables.environment.index');
         Route::get('/environments/project/{project_uuid}/environment/{environment_uuid}', EnvironmentSharedVariablesShow::class)->name('shared-variables.environment.show');
+        Route::get('/environments/project/{project_uuid}/environment/{environment_uuid}/canvas', SharedVariablesCanvas::class)->name('shared-variables.environment.canvas');
         Route::get('/servers', ServerSharedVariablesIndex::class)->name('shared-variables.server.index');
         Route::get('/server/{server_uuid}', ServerSharedVariablesShow::class)->name('shared-variables.server.show');
+        Route::get('/server/{server_uuid}/canvas', SharedVariablesCanvas::class)->name('shared-variables.server.canvas');
     });
 
     Route::prefix('team')->group(function () {
         Route::get('/', TeamIndex::class)->name('team.index');
+        Route::get('/{team_id}/avatar', TeamAvatarController::class)->whereNumber('team_id')->name('team.avatar');
         Route::get('/members', TeamMemberIndex::class)->name('team.member.index');
+        Route::get('/members/{user_id}/avatar', ProfileAvatarController::class)->whereNumber('user_id')->name('team.member.avatar');
         Route::get('/audit-log', TeamAuditLog::class)->name('team.audit-log');
         Route::get('/admin', TeamAdminView::class)->name('team.admin-view');
         Route::get('/danger', TeamDangerZone::class)->name('team.danger-zone');
@@ -273,9 +367,12 @@ Route::middleware(['auth', 'verified'])->group(function () {
     });
 
     Route::get('/projects', ProjectIndex::class)->name('project.index');
+    Route::get('/projects/canvas', ProjectsCanvas::class)->name('project.canvas.index');
     Route::get('/project/{project_uuid}/icon', ProjectIconController::class)->name('project.icon');
+    Route::get('/files/download/{token}', FileBrowserDownloadController::class)->name('project.files.download')->middleware('can.access.terminal');
     Route::prefix('project/{project_uuid}')->group(function () {
         Route::get('/', ProjectShow::class)->name('project.show');
+        Route::get('/canvas', ProjectCanvas::class)->name('project.canvas');
         Route::get('/edit', ProjectEdit::class)->name('project.edit')->middleware('can.update.resource');
     });
     Route::prefix('project/{project_uuid}/environment/{environment_uuid}')->group(function () {
@@ -283,6 +380,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/clone', ProjectCloneMe::class)->name('project.clone-me')->middleware('can.create.resources');
         Route::get('/new', ResourceCreate::class)->name('project.resource.create')->middleware('can.create.resources');
         Route::get('/edit', EnvironmentEdit::class)->name('project.environment.edit')->middleware('can.update.resource');
+        Route::get('/canvas', EnvironmentCanvas::class)->name('project.environment.canvas');
     });
     Route::prefix('project/{project_uuid}/environment/{environment_uuid}/application/{application_uuid}')->group(function () {
         Route::get('/', ApplicationConfiguration::class)->name('project.application.configuration');
@@ -293,8 +391,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/persistent-storage', ApplicationConfiguration::class)->name('project.application.persistent-storage');
         Route::get('/backups', ApplicationBackupIndex::class)->name('project.application.backup.index');
         Route::get('/backups/{backup_uuid}', ApplicationBackupShow::class)->name('project.application.backup.show');
-        Route::get('/backups/{backup_uuid}/s3', ApplicationBackupShow::class)->name('project.application.backup.s3');
-        Route::get('/backups/{backup_uuid}/retention', ApplicationBackupShow::class)->name('project.application.backup.retention');
+        // S3 and retention settings moved into the general page; keep old links working.
+        Route::redirect('/backups/{backup_uuid}/s3', '/project/{project_uuid}/environment/{environment_uuid}/application/{application_uuid}/backups/{backup_uuid}');
+        Route::redirect('/backups/{backup_uuid}/retention', '/project/{project_uuid}/environment/{environment_uuid}/application/{application_uuid}/backups/{backup_uuid}');
         Route::get('/backups/{backup_uuid}/executions', ApplicationBackupShow::class)->name('project.application.backup.executions');
         Route::get('/backups/{backup_uuid}/danger', ApplicationBackupShow::class)->name('project.application.backup.danger');
         Route::get('/source', ApplicationConfiguration::class)->name('project.application.source');
@@ -315,7 +414,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/deployment/{deployment_uuid}', DeploymentShow::class)->name('project.application.deployment.show');
         Route::get('/logs', Logs::class)->name('project.application.logs');
         Route::get('/terminal', ExecuteContainerCommand::class)->name('project.application.command')->middleware('can.access.terminal');
-        Route::get('/tasks/{task_uuid}', ApplicationConfiguration::class)->name('project.application.scheduled-tasks');
+        Route::get('/files', FileBrowser::class)->name('project.application.files')->middleware('can.access.terminal');
+        // Tasks open in a modal on the list page; keep old links (e.g. notifications) working.
+        Route::get('/tasks/{task_uuid}', fn () => redirect()->route('project.application.scheduled-tasks.show', get_route_parameters()))->name('project.application.scheduled-tasks');
     });
     Route::prefix('project/{project_uuid}/environment/{environment_uuid}/database/{database_uuid}')->group(function () {
         Route::get('/', DatabaseConfiguration::class)->name('project.database.configuration');
@@ -333,10 +434,12 @@ Route::middleware(['auth', 'verified'])->group(function () {
 
         Route::get('/logs', Logs::class)->name('project.database.logs');
         Route::get('/terminal', ExecuteContainerCommand::class)->name('project.database.command')->middleware('can.access.terminal');
+        Route::get('/files', FileBrowser::class)->name('project.database.files')->middleware('can.access.terminal');
         Route::get('/backups', DatabaseBackupIndex::class)->name('project.database.backup.index');
         Route::get('/backups/{backup_uuid}', DatabaseBackupExecution::class)->name('project.database.backup.execution');
-        Route::get('/backups/{backup_uuid}/s3', DatabaseBackupExecution::class)->name('project.database.backup.s3');
-        Route::get('/backups/{backup_uuid}/retention', DatabaseBackupExecution::class)->name('project.database.backup.retention');
+        // S3 and retention settings moved into the general page; keep old links working.
+        Route::redirect('/backups/{backup_uuid}/s3', '/project/{project_uuid}/environment/{environment_uuid}/database/{database_uuid}/backups/{backup_uuid}');
+        Route::redirect('/backups/{backup_uuid}/retention', '/project/{project_uuid}/environment/{environment_uuid}/database/{database_uuid}/backups/{backup_uuid}');
         Route::get('/backups/{backup_uuid}/executions', DatabaseBackupExecution::class)->name('project.database.backup.executions');
         Route::get('/backups/{backup_uuid}/danger', DatabaseBackupExecution::class)->name('project.database.backup.danger');
     });
@@ -351,8 +454,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/import-backup/{stack_service_uuid}', ServiceImportBackup::class)->name('project.service.import-backup.database')->middleware('can.update.resource');
         Route::get('/storage-backups', Index::class)->name('project.service.volume-backups.index');
         Route::get('/storage-backups/{backup_uuid}', Show::class)->name('project.service.volume-backups.show');
-        Route::get('/storage-backups/{backup_uuid}/s3', Show::class)->name('project.service.volume-backups.s3');
-        Route::get('/storage-backups/{backup_uuid}/retention', Show::class)->name('project.service.volume-backups.retention');
+        // S3 and retention settings moved into the general page; keep old links working.
+        Route::redirect('/storage-backups/{backup_uuid}/s3', '/project/{project_uuid}/environment/{environment_uuid}/service/{service_uuid}/storage-backups/{backup_uuid}');
+        Route::redirect('/storage-backups/{backup_uuid}/retention', '/project/{project_uuid}/environment/{environment_uuid}/service/{service_uuid}/storage-backups/{backup_uuid}');
         Route::get('/storage-backups/{backup_uuid}/executions', Show::class)->name('project.service.volume-backups.executions');
         Route::get('/storage-backups/{backup_uuid}/danger', Show::class)->name('project.service.volume-backups.danger');
         Route::get('/scheduled-tasks', ServiceConfiguration::class)->name('project.service.scheduled-tasks.show');
@@ -361,27 +465,30 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/tags', ServiceConfiguration::class)->name('project.service.tags');
         Route::get('/danger', ServiceConfiguration::class)->name('project.service.danger');
         Route::get('/terminal', ExecuteContainerCommand::class)->name('project.service.command')->middleware('can.access.terminal');
+        Route::get('/files', FileBrowser::class)->name('project.service.files')->middleware('can.access.terminal');
         Route::get('/{stack_service_uuid}/backups', ServiceDatabaseBackups::class)->name('project.service.database.backups');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}', ServiceDatabaseBackups::class)->name('project.service.database.backup.show');
-        Route::get('/{stack_service_uuid}/backups/{backup_uuid}/s3', ServiceDatabaseBackups::class)->name('project.service.database.backup.s3');
-        Route::get('/{stack_service_uuid}/backups/{backup_uuid}/retention', ServiceDatabaseBackups::class)->name('project.service.database.backup.retention');
+        Route::redirect('/{stack_service_uuid}/backups/{backup_uuid}/s3', '/project/{project_uuid}/environment/{environment_uuid}/service/{service_uuid}/{stack_service_uuid}/backups/{backup_uuid}');
+        Route::redirect('/{stack_service_uuid}/backups/{backup_uuid}/retention', '/project/{project_uuid}/environment/{environment_uuid}/service/{service_uuid}/{stack_service_uuid}/backups/{backup_uuid}');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/executions', ServiceDatabaseBackups::class)->name('project.service.database.backup.executions');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/danger', ServiceDatabaseBackups::class)->name('project.service.database.backup.danger');
         Route::get('/{stack_service_uuid}/import', ServiceImportBackup::class)->name('project.service.database.import')->middleware('can.update.resource');
         Route::get('/{stack_service_uuid}/advanced', ServiceIndex::class)->name('project.service.index.advanced');
         Route::get('/{stack_service_uuid}', ServiceIndex::class)->name('project.service.index');
-        Route::get('/tasks/{task_uuid}', ServiceConfiguration::class)->name('project.service.scheduled-tasks');
+        // Tasks open in a modal on the list page; keep old links (e.g. notifications) working.
+        Route::get('/tasks/{task_uuid}', fn () => redirect()->route('project.service.scheduled-tasks.show', get_route_parameters()))->name('project.service.scheduled-tasks');
     });
 
     Route::get('/servers', ServerIndex::class)->name('server.index');
+    Route::get('/servers/canvas', ServerCanvas::class)->name('server.canvas.index');
     Route::get('/registries', ServerDockerRegistries::class)->name('registries.index');
-    Route::get('/servers/import', ServerTransferImport::class)->name('server.transfer.import')->middleware('can:create,'.Server::class);
     Route::get('/servers/new', ServerCreatePage::class)->name('server.create')->middleware('can:create,'.Server::class);
-    Route::get('/servers/new/{type}/{token_uuid}', ServerCreatePage::class)->name('server.create.token')->middleware('can:create,'.Server::class)->whereIn('type', ['hetzner', 'vultr', 'digital-ocean']);
-    Route::get('/servers/new/{type}', ServerCreatePage::class)->name('server.create.type')->middleware('can:create,'.Server::class)->whereIn('type', ['hetzner', 'vultr', 'digital-ocean', 'manual']);
+    Route::get('/servers/new/{type}/{token_uuid}', ServerCreatePage::class)->name('server.create.token')->middleware('can:create,'.Server::class)->whereIn('type', ['hetzner', 'vultr', 'digital-ocean', 'hostinger']);
+    Route::get('/servers/new/{type}', ServerCreatePage::class)->name('server.create.type')->middleware('can:create,'.Server::class)->whereIn('type', ['hetzner', 'vultr', 'digital-ocean', 'hostinger', 'manual']);
 
     Route::prefix('server/{server_uuid}')->group(function () {
         Route::get('/', ServerShow::class)->name('server.show');
+        Route::get('/canvas', ServerCanvas::class)->name('server.canvas');
         Route::get('/advanced', ServerAdvanced::class)->name('server.advanced');
         Route::get('/swarm', ServerSwarm::class)->name('server.swarm');
         Route::get('/sentinel', SentinelShow::class)->name('server.sentinel');
@@ -442,6 +549,7 @@ Route::middleware(['auth'])->group(function () {
     Route::get('/source/github/{github_app_uuid}/permissions', GitHubChange::class)->name('source.github.permissions');
     Route::get('/source/github/{github_app_uuid}/resources', GitHubChange::class)->name('source.github.resources');
     Route::get('/source/gitlab/{gitlab_app_uuid}', GitLabChange::class)->name('source.gitlab.show');
+    Route::get('/source/gitea/{gitea_app_uuid}', GiteaChange::class)->name('source.gitea.show');
 });
 
 Route::middleware(['auth'])->group(function () {
@@ -471,15 +579,29 @@ Route::middleware(['auth'])->group(function () {
                 }
             }
             $filename = data_get($execution, 'filename');
-            if ($execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class) {
-                $server = $execution->scheduledDatabaseBackup->database->service->destination->server;
-            } else {
-                $server = $execution->scheduledDatabaseBackup->database->destination->server;
+            if (! $execution->local_storage_deleted && filled($filename)) {
+                if ($execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class) {
+                    $server = $execution->scheduledDatabaseBackup->database->service->destination->server;
+                } else {
+                    $server = $execution->scheduledDatabaseBackup->database->destination->server;
+                }
+
+                try {
+                    return streamBackupFromServer($server, $filename, 'application/octet-stream');
+                } catch (FileNotFoundException) {
+                    // Fall back to an S3 copy.
+                }
             }
 
-            return streamBackupFromServer($server, $filename, 'application/octet-stream');
-        } catch (FileNotFoundException) {
-            if (isset($execution) && $execution->scheduledDatabaseBackup->disable_local_backup === true && $execution->scheduledDatabaseBackup->save_s3 === true) {
+            // Only storages of the team that owns the database can serve the copy.
+            $s3DownloadUrl = is_null($execution_team_id)
+                ? null
+                : $execution->s3DownloadUrl($execution_team_id, $execution->scheduledDatabaseBackup->s3_storage_id);
+            if ($s3DownloadUrl) {
+                return redirect()->away($s3DownloadUrl);
+            }
+
+            if ($execution->scheduledDatabaseBackup->disable_local_backup && $execution->scheduledDatabaseBackup->save_s3) {
                 return response()->json(['message' => 'Backup not available locally, but available on S3.'], 404);
             }
 
@@ -506,17 +628,29 @@ Route::middleware(['auth'])->group(function () {
             if ($team->id !== 0 && $team->id !== $execution->scheduledVolumeBackup->team_id) {
                 return response()->json(['message' => 'Permission denied.'], 403);
             }
-            if ($execution->local_storage_deleted || blank($execution->filename)) {
+            if (blank($execution->filename)) {
                 return response()->json(['message' => 'Backup not found locally on the server.'], 404);
             }
 
-            $server = $execution->scheduledVolumeBackup->server();
-            if (! $server) {
+            $server = $execution->local_storage_deleted ? null : $execution->scheduledVolumeBackup->server();
+            if ($server) {
+                try {
+                    return streamBackupFromServer($server, $execution->filename, 'application/gzip');
+                } catch (FileNotFoundException) {
+                    // Fall back to an S3 copy.
+                }
+            }
+
+            // Only storages of the team that owns the backup can serve the copy.
+            $s3DownloadUrl = $execution->s3DownloadUrl($execution->scheduledVolumeBackup->team_id, $execution->s3_storage_id);
+            if ($s3DownloadUrl) {
+                return redirect()->away($s3DownloadUrl);
+            }
+
+            if (! $execution->local_storage_deleted && ! $server) {
                 return response()->json(['message' => 'Server not found.'], 404);
             }
 
-            return streamBackupFromServer($server, $execution->filename, 'application/gzip');
-        } catch (FileNotFoundException) {
             return response()->json(['message' => 'Backup not found locally on the server.'], 404);
         } catch (Throwable) {
             return response()->json(['message' => 'Failed to download backup.'], 500);
diff --git a/routes/webhooks.php b/routes/webhooks.php
index cc5524de4f..a0ffa528de 100644
--- a/routes/webhooks.php
+++ b/routes/webhooks.php
@@ -11,6 +11,7 @@ Route::middleware(['web', 'auth', 'throttle:60,1'])->group(function () {
     Route::get('/source/github/redirect', [Github::class, 'redirect']);
     Route::get('/source/github/install', [Github::class, 'install']);
     Route::get('/source/gitlab/redirect', [Gitlab::class, 'redirect']);
+    Route::get('/source/gitea/redirect', [Gitea::class, 'redirect']);
 });
 
 Route::post('/source/github/events', [Github::class, 'normal']);
@@ -21,6 +22,7 @@ Route::post('/source/gitlab/events/manual', [Gitlab::class, 'manual']);
 
 Route::post('/source/bitbucket/events/manual', [Bitbucket::class, 'manual']);
 
+Route::post('/source/gitea/events', [Gitea::class, 'normal']);
 Route::post('/source/gitea/events/manual', [Gitea::class, 'manual']);
 
 Route::post('/payments/stripe/events', [Stripe::class, 'events']);
diff --git a/scripts/dev b/scripts/dev
index 5a02758a58..3102f0b9d7 100755
--- a/scripts/dev
+++ b/scripts/dev
@@ -24,12 +24,17 @@
 #
 # Env: COOLIFY_DEV_SERVER_BACKEND=auto|lima|testing-host, COOLIFY_DEV_KVM_PROFILE=<profile>
 #
+# Side by side: COOLIFY_DEV_INSTANCE=<name> COOLIFY_DEV_SIDE_BY_SIDE=1 starts a second instance of
+# this checkout without stopping the other ones (for example a transfer target, see
+# scripts/transfer-test). It gets its own SSH key folder; the instance remembers the mode.
+#
 set -euo pipefail
 
 cd "$(dirname "$0")/.."
 ROOT="$(pwd -P)"
 
 COMPOSE_FILE="docker-compose.dev-multi.yml"
+SIDE_BY_SIDE_COMPOSE_FILE="docker-compose.dev-side-by-side.yml"
 GIT_COMMON_DIR="$(git rev-parse --path-format=absolute --git-common-dir)"
 # Shared by all worktrees, so slots, APP_KEYs, and data survive worktree removal.
 ENV_DIR="$(dirname "$GIT_COMMON_DIR")/.dev-instances"
@@ -38,7 +43,7 @@ QEMU_STORAGE="${DEVELOPMENT_QEMU_STORAGE_PATH:-/var/lib/libvirt/images/coolify-d
 LEGACY_CONTAINERS=(coolify coolify-db coolify-redis coolify-vite coolify-mail coolify-minio coolify-minio-init coolify-testing-host)
 
 usage() {
-  sed -n '2,26p' "$0" | sed 's/^# \?//'
+  sed -n '2,30p' "$0" | sed 's/^# \?//'
 }
 
 normalize_name() {
@@ -66,6 +71,7 @@ current_instance() {
 project_name() { echo "coolify-dev-$1"; }
 env_file() { echo "$ENV_DIR/$1.env"; }
 env_value() { grep -E "^$2=" "$(env_file "$1")" | cut -d= -f2-; }
+is_side_by_side() { [[ -f "$(env_file "$1")" ]] && grep -qxF 'DEV_SIDE_BY_SIDE=1' "$(env_file "$1")"; }
 
 # Lowest free slot (1..254), stable per instance name. It selects the port block
 # and the libvirt network (10.221.<slot>.0/24) of the instance.
@@ -135,6 +141,11 @@ ensure_env() {
   fi
   printf '%s\n' "$existing_key" >"$ENV_DIR/$name.appkey"
 
+  local side_by_side="${COOLIFY_DEV_SIDE_BY_SIDE:-}"
+  if [[ -z "$side_by_side" ]] && is_side_by_side "$name"; then
+    side_by_side=1
+  fi
+
   cat >"$env_file" <<EOF
 # Generated by scripts/dev for instance ${name} — do not commit
 COMPOSE_PROJECT_NAME=$(project_name "$name")
@@ -158,6 +169,9 @@ PUSHER_APP_ID=coolify-${name}
 PUSHER_APP_KEY=coolify-${name}
 PUSHER_APP_SECRET=coolify-${name}
 EOF
+  if [[ "$side_by_side" == 1 ]]; then
+    echo 'DEV_SIDE_BY_SIDE=1' >>"$env_file"
+  fi
 }
 
 # compose <name> <args...>: .env of the checkout first, generated instance env wins.
@@ -168,7 +182,11 @@ compose() {
   if [[ -f .env ]]; then
     env_files+=(--env-file .env)
   fi
-  docker compose -p "$(project_name "$name")" -f "$COMPOSE_FILE" \
+  local -a compose_files=(-f "$COMPOSE_FILE")
+  if is_side_by_side "$name"; then
+    compose_files+=(-f "$SIDE_BY_SIDE_COMPOSE_FILE")
+  fi
+  docker compose -p "$(project_name "$name")" "${compose_files[@]}" \
     "${env_files[@]}" --env-file "$(env_file "$name")" "${profiles[@]}" "$@"
 }
 
@@ -221,12 +239,14 @@ wait_for_coolify() {
 
 # Only one instance of a checkout runs at a time: they share its ports (main checkout)
 # and its public/hot Vite file. The legacy fixed-name stack also holds the main ports.
+# Side-by-side instances have their own ports and run next to the others on purpose.
 stop_other_checkout_instances() {
   local file other
+  is_side_by_side "$instance" && return 0
   for file in "$ENV_DIR"/*.env; do
     [[ -f "$file" ]] || continue
     other="$(basename "$file" .env)"
-    if [[ "$other" != "$instance" ]] && grep -qxF "DEV_CHECKOUT=$ROOT" "$file" &&
+    if [[ "$other" != "$instance" ]] && ! is_side_by_side "$other" && grep -qxF "DEV_CHECKOUT=$ROOT" "$file" &&
       [[ -n "$(docker ps -q --filter "label=com.docker.compose.project=$(project_name "$other")")" ]]; then
       echo "Stopping instance ${other} (same checkout)"
       docker compose -p "$(project_name "$other")" stop
@@ -382,9 +402,10 @@ start_backend() {
     local host="${DEV_BIND_ADDRESS:-127.0.0.1}"
     [[ "$host" == 0.0.0.0 ]] && host=127.0.0.1
     echo "Using KVM profile: $profile"
-    # The host command must reach this instance's database and encrypt with this instance's
-    # APP_KEY, not the ones in .env, and must not create root-owned files in storage/logs.
-    LOG_CHANNEL=stderr APP_KEY="$(env_value "$instance" APP_KEY)" \
+    # Use this instance database and encryption key, without a stale environment or config cache.
+    # Send logs to stderr to avoid root-owned files in storage/logs.
+    APP_ENV=local APP_CONFIG_CACHE="$ROOT/bootstrap/cache/dev-qemu-$$.php" \
+      LOG_CHANNEL=stderr APP_KEY="$(env_value "$instance" APP_KEY)" \
       DB_HOST="$host" DB_PORT="$(env_value "$instance" FORWARD_DB_PORT)" \
       REDIS_HOST="$host" REDIS_PORT="$(env_value "$instance" FORWARD_REDIS_PORT)" \
       DEVELOPMENT_QEMU_INSTANCE="$instance" \
diff --git a/scripts/patch.sh b/scripts/patch.sh
new file mode 100755
index 0000000000..5cf29c4a0b
--- /dev/null
+++ b/scripts/patch.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# Patches Coolify 4.0 to 4.4 to the security fix release of its own line.
+# Only the coolify container is recreated, the compose files and the other containers stay as they are.
+# Usage: curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash
+set -euo pipefail
+
+SOURCE_DIR=/data/coolify/source
+ENV_FILE="$SOURCE_DIR/.env"
+TIMESTAMP="$(date +%Y-%m-%d-%H-%M-%S)"
+LOG_FILE="$SOURCE_DIR/patch-$TIMESTAMP.log"
+BACKUP_FILE="$ENV_FILE-$TIMESTAMP"
+PATCH_VERSIONS=(4.0.1 4.1.3 4.2.1 4.3.24 4.4.7)
+
+BOLD=$'\033[1m' GREEN=$'\033[32m' BLUE=$'\033[34m' RED=$'\033[31m' RESET=$'\033[0m'
+
+heading() { printf '\n  %s%s%s\n' "$BOLD" "$*" "$RESET"; }
+info() { printf '  %sℹ%s %s\n' "$BLUE" "$RESET" "$*"; }
+ok() { printf '  %s✔%s %s\n' "$GREEN" "$RESET" "$*"; }
+die() {
+	printf '  %s✖%s %s\n' "$RED" "$RESET" "$*" >&2
+	exit 1
+}
+
+main() {
+	check_installation
+	read_version
+	select_patch_version
+	check_compose_files
+	heading "Patching Coolify $current_version to $patch_version"
+	pull_image
+	update_env_file
+	restart_coolify
+	wait_for_coolify
+}
+
+check_installation() {
+	heading "Checking the installation"
+	[ "$EUID" = 0 ] || die "run this script as root, for example with sudo"
+	[ -f "$ENV_FILE" ] && [ -f "$SOURCE_DIR/docker-compose.prod.yml" ] || die "Coolify is not installed in $SOURCE_DIR"
+	docker compose version > /dev/null 2>&1 || die "the Docker Compose plugin is not installed"
+	compose=(docker compose --env-file "$ENV_FILE" -f "$SOURCE_DIR/docker-compose.yml" -f "$SOURCE_DIR/docker-compose.prod.yml")
+	if [ -f "$SOURCE_DIR/docker-compose.custom.yml" ]; then
+		compose+=(-f "$SOURCE_DIR/docker-compose.custom.yml")
+	fi
+	if [ -f "$SOURCE_DIR/docker-compose.postgres-upgrade.yml" ]; then
+		compose+=(-f "$SOURCE_DIR/docker-compose.postgres-upgrade.yml")
+	fi
+	ok "Coolify is installed in $SOURCE_DIR"
+}
+
+read_version() {
+	# Copy the file out of the container, because this also works when the mitigation advice was followed and the container is stopped
+	current_version="$(docker cp coolify:/var/www/html/config/constants.php - 2> /dev/null | tar -xO 2> /dev/null | awk -F "'" "/'version' =>/ && !found { print \$(NF - 1); found = 1 }")" && [ -n "$current_version" ] || die "could not read the Coolify version from the coolify container"
+	ok "Coolify $BOLD$current_version$RESET is installed"
+}
+
+select_patch_version() {
+	[[ "$current_version" =~ ^4\.([0-4])\.([0-9]+)$ ]] || die "Coolify $current_version has no security fix release, upgrade to the latest version from the dashboard instead"
+	patch_version="${PATCH_VERSIONS[${BASH_REMATCH[1]}]}"
+	if [ "${BASH_REMATCH[2]}" -ge "${patch_version##*.}" ]; then
+		ok "Coolify $current_version already includes the security fixes"
+		exit 0
+	fi
+}
+
+check_compose_files() {
+	local has_realtime=false needs_realtime=true
+	if grep -q 'coollabsio/coolify-realtime:' "$SOURCE_DIR/docker-compose.prod.yml"; then
+		has_realtime=true
+	fi
+	if [[ "$patch_version" == 4.4.* ]]; then
+		needs_realtime=false
+	fi
+	[ "$has_realtime" = "$needs_realtime" ] || die "the compose files in $SOURCE_DIR do not belong to Coolify $current_version, update to ${PATCH_VERSIONS[4]} instead: curl -fsSL https://cdn.coollabs.io/coolify/upgrade.sh | sudo bash -s ${PATCH_VERSIONS[4]}"
+	ok "the compose files belong to Coolify $current_version"
+}
+
+pull_image() {
+	LATEST_IMAGE="$patch_version" "${compose[@]}" pull coolify < /dev/null >> "$LOG_FILE" 2>&1 || die "could not pull Coolify $patch_version, nothing was changed (log: $LOG_FILE)"
+	ok "pulled Coolify $patch_version"
+}
+
+update_env_file() {
+	local key updated
+	cp "$ENV_FILE" "$BACKUP_FILE"
+	for key in LATEST_IMAGE COOLIFY_VERSION; do
+		if grep -q "^$key=" "$ENV_FILE"; then
+			updated="$(sed "s|^$key=.*|$key=$patch_version|" "$ENV_FILE")"
+			printf '%s\n' "$updated" > "$ENV_FILE"
+		fi
+	done
+	ok "backed up .env to $BACKUP_FILE"
+}
+
+restart_coolify() {
+	# Detached, because the Coolify 4.4 terminal runs inside the coolify container and closes when it stops
+	LATEST_IMAGE="$patch_version" nohup "${compose[@]}" up -d --no-deps coolify < /dev/null >> "$LOG_FILE" 2>&1 &
+	wait $! || die "could not restart the coolify container (log: $LOG_FILE)"
+	ok "restarted the coolify container"
+}
+
+wait_for_coolify() {
+	local status
+	for _ in $(seq 60); do
+		status="$(docker inspect --format '{{.State.Health.Status}}' coolify 2> /dev/null || true)"
+		if [ "$status" = healthy ]; then
+			ok "Coolify $BOLD$patch_version$RESET is healthy and runs PHP $(docker exec coolify php -r 'echo PHP_VERSION;')"
+			return
+		fi
+		sleep 5
+	done
+	info "roll back with: cp $BACKUP_FILE $ENV_FILE && LATEST_IMAGE=$current_version ${compose[*]} up -d --no-deps coolify"
+	die "Coolify $patch_version is not healthy after 5 minutes, check it with: docker logs coolify"
+}
+
+main
diff --git a/scripts/transfer-test/README.md b/scripts/transfer-test/README.md
new file mode 100644
index 0000000000..0a90e0f1c4
--- /dev/null
+++ b/scripts/transfer-test/README.md
@@ -0,0 +1,70 @@
+# Server transfer test kit
+
+Live end-to-end tests for the server transfer (moving a server and its resources to another Coolify instance).
+The unit tests in `tests/Unit/ServerTransfer/` fake SSH and HTTP. These scripts use two real dev instances and
+real VMs, so they also find problems with shells, sudo, networks, queues, and running containers.
+
+- **Source (A):** the dev instance of this checkout (`./scripts/dev start`). Its localhost is the `ubuntu-root` VM.
+  The tests transfer its `ubuntu-non-root` and `debian-root` VMs.
+- **Target (B):** a second instance of the same checkout that runs side by side (`transfer-target`). Its localhost is
+  the testing-host container.
+
+Requirements: Linux with KVM (the dev VMs), root or passwordless sudo (VMs and iptables), `jq`, and PHP on the host.
+macOS with Lima is not supported yet.
+
+## Steps
+
+```bash
+./scripts/dev start                        # A, if it does not run yet
+scripts/transfer-test/setup.sh             # start B and connect A, B, and A's VMs (safe to run again)
+scripts/transfer-test/reset.sh             # WIPES BOTH DEV DATABASES, then seeds A with deployed resources (~4 min)
+
+scripts/transfer-test/e2e.sh               # transfer both VMs A -> B through the API (41 checks)
+scripts/transfer-test/reset.sh
+scripts/transfer-test/reverse-e2e.sh       # undo paths: transfer back, transfer over an archive, take back, archive delete (18 checks)
+scripts/transfer-test/reset.sh
+scripts/transfer-test/extras-e2e.sh        # fake tokens, DNS, secret links, runner config, links, icon ... (31 checks)
+scripts/transfer-test/reset.sh
+```
+
+For a manual test, run `scripts/transfer-test/manual-setup.sh`: it resets, adds the fake extra records to A, and
+prints the URLs, logins, and tokens.
+
+Each test ends with `=== N failure(s)` and exits with N. Run `reset.sh` between two tests: a test leaves servers
+transferred. After `reset.sh`, you can also test by hand: log in to A and B with `test@example.com` / `password`, open a
+VM server on A → Transfer, and use the target URL `http://localhost:<B port>` with the token in
+`<main checkout>/.dev-instances/transfer-test/<source>/target.token`.
+
+## Files
+
+| File | What it does |
+|---|---|
+| `lib.sh` | Shared values (from `.dev-instances/*.env` and `config/development-qemu.php`) and helpers |
+| `setup.sh` | Starts B side by side, adds the iptables rule for B → A's VMs, and adds socat forwards when the ports listen on 127.0.0.1 |
+| `reset.sh` | Removes test workloads from the VMs, wipes both databases, seeds A's VMs, makes the helper image available, creates API tokens, runs `seed.sh` |
+| `seed.sh` | Creates and deploys resources on A through the API |
+| `e2e.sh`, `reverse-e2e.sh`, `extras-e2e.sh` | The tests |
+| `seed-extras.php`, `verify-extras-*.php` | Fake records and checks of `extras-e2e.sh` |
+| `manual-setup.sh` | Reset plus the fake extra records, then prints what to open and enter for a manual test |
+| `seed-inventory.php` | Seeds a large database-only demo server (no deploys) on the current instance |
+
+Tokens and the VM SSH key are written to `<main checkout>/.dev-instances/transfer-test/<source>/` (not in git).
+For a full manual test of every transferred setting, see `docs/server-transfer-full-coverage.md`.
+
+## Options
+
+- `TRANSFER_TEST_SOURCE=<instance>`: another source instance than the one of this checkout.
+- `TRANSFER_TEST_TARGET=<instance>`: another target name than `transfer-target`.
+
+## Notes
+
+- A and B share `storage/` of the checkout. The side-by-side mode of `scripts/dev` gives B its own SSH folder, because
+  both instances have a server with the uuid `localhost`.
+- A and B have the same `app.id`, so the DNS owner comment does not change in a transfer here.
+  `extras-e2e.sh` expects that. With different ids, the target must change the comment at the DNS provider.
+- `reset.sh` tags the newest local helper image with the configured helper version when that version is not
+  published yet.
+- Remove the kit: run `./scripts/dev destroy transfer-target` and
+  `docker rm -f $(docker ps -aq --filter name=coolify-transfer-test-forward)`. Then remove the iptables rule that
+  `setup.sh` added: `sudo iptables -D LIBVIRT_FWI -s <B subnet> -d 10.221.<A slot>.0/24 -o cdevbr<A slot> -j ACCEPT`
+  (`setup.sh` prints the subnet; `sudo iptables -S LIBVIRT_FWI` lists the rules).
diff --git a/scripts/transfer-test/e2e.sh b/scripts/transfer-test/e2e.sh
new file mode 100755
index 0000000000..7f13cc253a
--- /dev/null
+++ b/scripts/transfer-test/e2e.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Transfer both VM servers A -> B through the API and check source, target, server, and a redeploy from B.
+# Run reset.sh before and after.
+source "$(dirname "$0")/lib.sh"
+TA="$(source_token)"
+TB="$(target_token)"
+
+for profile in "${TRANSFER_PROFILES[@]}"; do
+  S="$(vm_field "$profile" uuid)"
+  ip="$(vm_field "$profile" ip)"
+  echo "=== $S"
+  before="$(stable_workloads "$profile")"
+  apps="$(tinker "$A" "echo App\\Models\\Server::where('uuid','$S')->first()->applications()->pluck('uuid')->implode(' ');" | tail -1)"
+
+  echo '-- start the transfer on A'
+  r="$(api POST "$A_PORT" "/servers/$S/migrate" "$TA" "$(jq -nc --arg u "http://localhost:$B_PORT" --arg t "$TB" '{target_url:$u,target_token:$t}')")"
+  if [[ "$(jq -r .migration.status <<<"$r" 2>/dev/null)" != running ]]; then
+    bad "transfer request accepted: $r"
+    continue
+  fi
+  ok 'transfer request accepted'
+  for _ in $(seq 1 40); do sleep 3; st="$(api GET "$A_PORT" "/servers/$S/transfer" "$TA" | jq -r .migration.status)"; [[ "$st" != running ]] && break; done
+  check "transfer finished ($st)" test "$st" = succeeded
+
+  echo '-- source A'
+  a="$(api GET "$A_PORT" "/servers/$S/transfer" "$TA")"
+  export_id="$(jq -r .transfer.export_id <<<"$a")"
+  check 'A transfer.status = transferred' test "$(jq -r .transfer.status <<<"$a")" = transferred
+  check 'A force_disabled + Sentinel off' test "$(tinker "$A" "\$s=App\\Models\\Server::where('uuid','$S')->first()->settings; echo (int)\$s->force_disabled.(int)\$s->is_sentinel_enabled;" | tail -1)" = 10
+  check 'A shows the take-back modal' test "$(tinker "$A" "$login_php echo (int) str_contains(Livewire\\Livewire::test(App\\Livewire\\Server\\Show::class, ['server_uuid'=>'$S'])->html(), 'Take back a transferred server?');" | tail -1)" = 1
+  r="$(api POST "$A_PORT" "/servers/$S/migrate" "$TA" "$(jq -nc --arg u "http://localhost:$B_PORT" --arg t "$TB" '{target_url:$u,target_token:$t}')")"
+  check 'second transfer refused by the prechecks' grep -q 'already transferred' <<<"$r"
+
+  echo '-- target B'
+  b="$(api GET "$B_PORT" "/servers/$S/transfer" "$TB")"
+  check 'B transfer.status = claimed' test "$(jq -r .transfer.status <<<"$b")" = claimed
+  check 'same export id on A and B' test "$(jq -r .transfer.export_id <<<"$b")" = "$export_id"
+  for _ in $(seq 1 20); do
+    sleep 3
+    meta="$(tinker "$B" "\$s=App\\Models\\Server::where('uuid','$S')->first(); echo json_encode(['os'=>data_get(\$s->server_metadata,'os'),'reach'=>\$s->settings->is_reachable,'usable'=>\$s->settings->is_usable,'logs'=>\$s->validation_logs,'transfer'=>data_get(\$s->server_metadata,'transfer.status')]);" | tail -1)"
+    [[ "$(jq -r .os <<<"$meta")" != null ]] && break
+  done
+  check "automatic validation filled the metadata ($(jq -r .os <<<"$meta"))" test "$(jq -r .os <<<"$meta")" != null
+  check 'B reachable + usable, no validation error' test "$(jq -c '[.reach,.usable,.logs]' <<<"$meta")" = '[true,true,null]'
+  check 'transfer state kept after validation' test "$(jq -r .transfer <<<"$meta")" = claimed
+  check 'B started the finish list' test "$(tinker "$B" "echo count((array) data_get(App\\Models\\Server::where('uuid','$S')->first()->server_metadata,'transfer.finish.items')) > 0 ? 1 : 0;" | tail -1)" = 1
+  check 'A links to the server on B' test "$(jq -r .migration.target_server_url <<<"$a")" = "$B_URL/server/$S"
+  check 'B has all applications' test "$(tinker "$B" "echo App\\Models\\Server::where('uuid','$S')->first()->applications()->pluck('uuid')->implode(' ');" | tail -1)" = "$apps"
+  check 'B validates the server over SSH' test "$(tinker "$B" "\$r=App\\Models\\Server::where('uuid','$S')->first()->validateConnection(); echo (int)(bool)\$r['uptime'];" | tail -1)" = 1
+
+  echo '-- server'
+  sleep 5
+  after="$(workloads "$profile")"
+  check 'proxy + workloads not recreated' test "$before" = "$after"
+  sentinel_env="$(ssh_vm "$profile" "docker inspect coolify-sentinel --format '{{range .Config.Env}}{{println .}}{{end}}'")"
+  check 'Sentinel sends to B' grep -qx "PUSH_ENDPOINT=$B_URL" <<<"$sentinel_env"
+  for app in $apps; do check "app $app answers over HTTP" bash -c "curl -sf -m5 -H 'Host: $app.$ip.sslip.io' http://$ip/ >/dev/null"; done
+
+  echo '-- redeploy one app from B'
+  app="${apps%% *}"
+  api POST "$B_PORT" "/deploy?uuid=$app&force=false" "$TB" >/dev/null
+  for _ in $(seq 1 40); do sleep 5; ds="$(tinker "$B" "echo App\\Models\\ApplicationDeploymentQueue::where('application_id', App\\Models\\Application::where('uuid','$app')->value('id'))->latest('id')->value('status');" | tail -1)"; [[ "$ds" == finished || "$ds" == failed ]] && break; done
+  check "redeploy from B ($ds)" test "$ds" = finished
+  check 'app answers after the redeploy' bash -c "for i in {1..10}; do curl -sf -m5 -H 'Host: $app.$ip.sslip.io' http://$ip/ >/dev/null && exit 0; sleep 3; done; exit 1"
+done
+
+echo "=== $FAILS failure(s)"
+exit "$FAILS"
diff --git a/scripts/transfer-test/extras-e2e.sh b/scripts/transfer-test/extras-e2e.sh
new file mode 100755
index 0000000000..652ff577aa
--- /dev/null
+++ b/scripts/transfer-test/extras-e2e.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Add fake records around debian-root on A (tokens, DNS, secret manager link, tunnel token, GitHub App + runner config,
+# resource links, canvas positions, team variable, maintenance mode, proxy error page, project icon, and an app of the
+# same project on the other VM), transfer debian-root to B through the Transfer page, and check them on B and A.
+# Run reset.sh before and after.
+source "$(dirname "$0")/lib.sh"
+S="$(vm_field debian-root uuid)"
+
+echo '=== seed fake records on A'
+php_file "$A" "$TT_DIR/seed-extras.php"
+echo "=== transfer $S A -> B"
+echo "status: $(transfer_from_page "$S")"
+
+# The target compares the DNS owner comment, which contains the instance id, with the one of the source.
+tinker "$A" 'echo config("app.id");' | tail -1 | docker exec -i "$B" sh -c 'cat > /tmp/source-app-id'
+
+echo '=== target B'
+b="$(php_file "$B" "$TT_DIR/verify-extras-target.php")"
+echo "$b"
+echo '=== source A'
+a="$(php_file "$A" "$TT_DIR/verify-extras-source.php")"
+echo "$a"
+FAILS="$(printf '%s\n%s\n' "$a" "$b" | grep -c '^FAIL')"
+echo "=== $FAILS failure(s)"
+exit "$FAILS"
diff --git a/scripts/transfer-test/lib.sh b/scripts/transfer-test/lib.sh
new file mode 100644
index 0000000000..bb0b9d975f
--- /dev/null
+++ b/scripts/transfer-test/lib.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# Shared values and helpers of the server transfer test kit. The other scripts source this file.
+#
+# Source (A): the dev instance of this checkout, as `./scripts/dev` names it. Override: TRANSFER_TEST_SOURCE.
+# Target (B): a side-by-side instance of the same checkout. Default "transfer-target". Override: TRANSFER_TEST_TARGET.
+# Tokens and the VM SSH key are stored in <main checkout>/.dev-instances/transfer-test/<source>/ (not in git).
+
+set -uo pipefail
+
+TT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+ROOT="$(cd "$TT_DIR/../.." && pwd -P)"
+cd "$ROOT"
+ENV_DIR="$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)")/.dev-instances"
+
+SOURCE="${TRANSFER_TEST_SOURCE:-$(./scripts/dev container | sed 's/^coolify-dev-//')}"
+TARGET="${TRANSFER_TEST_TARGET:-transfer-target}"
+A="coolify-dev-$SOURCE"
+B="coolify-dev-$TARGET"
+STATE_DIR="$ENV_DIR/transfer-test/$SOURCE"
+VM_KEY="$STATE_DIR/vm_key"
+
+# The VM servers that the tests transfer, and the profile that is localhost of the source.
+TRANSFER_PROFILES=(ubuntu-non-root debian-root)
+LOCALHOST_PROFILE=ubuntu-root
+
+PRIVILEGED=()
+if [[ $EUID -ne 0 ]]; then
+  PRIVILEGED=(sudo -n -E)
+fi
+
+die() {
+  echo "ERROR: $*" >&2
+  exit 1
+}
+
+env_value() {
+  local file="$ENV_DIR/$1.env"
+  [[ -f "$file" ]] || die "No dev instance '$1' ($file). See ./scripts/dev urls"
+  grep -E "^$2=" "$file" | cut -d= -f2-
+}
+
+A_PORT="$(env_value "$SOURCE" APP_PORT)"
+A_SLOT="$(env_value "$SOURCE" DEVELOPMENT_QEMU_SLOT)"
+A_URL="$(env_value "$SOURCE" APP_URL)"
+
+target_values() {
+  B_PORT="$(env_value "$TARGET" APP_PORT)"
+  B_URL="$(env_value "$TARGET" APP_URL)"
+}
+if [[ -f "$ENV_DIR/$TARGET.env" ]]; then
+  target_values
+fi
+
+# vm_field <profile> <field>: a value of config/development-qemu.php for the source instance (ip, user, uuid).
+vm_field() {
+  DEVELOPMENT_QEMU_INSTANCE="$SOURCE" DEVELOPMENT_QEMU_SLOT="$A_SLOT" php -r '
+    function env($key, $default = null) { $value = getenv($key); return $value === false ? $default : $value; }
+    $config = require "config/development-qemu.php";
+    echo $config["profiles"][$argv[1]][$argv[2]];
+  ' "$1" "$2"
+}
+
+running() { [[ "$(docker inspect --format '{{.State.Running}}' "$1" 2>/dev/null)" == true ]]; }
+
+# tinker <container> <php>: run PHP in a Coolify container.
+tinker() { docker exec -u www-data "$1" php artisan tinker --execute "$2" 2>/dev/null; }
+
+# php_file <container> <file>: run a PHP file of this kit in a Coolify container.
+php_file() {
+  docker cp "$2" "$1:/tmp/$(basename "$2")" >/dev/null &&
+    docker exec -u www-data "$1" php artisan tinker --execute "require '/tmp/$(basename "$2")';" 2>&1 | grep -v '^$'
+}
+
+# api <METHOD> <port> <path> <token> [json]
+api() {
+  curl -sS -m 30 -X "$1" "http://127.0.0.1:$2/api/v1$3" -H "Authorization: Bearer $4" \
+    -H 'Content-Type: application/json' -H 'Accept: application/json' ${5:+-d "$5"}
+}
+
+source_token() { cat "$STATE_DIR/source.token"; }
+target_token() { cat "$STATE_DIR/target.token"; }
+
+# The VMs accept the dev key that the seeders create as private key 1.
+fetch_vm_key() {
+  mkdir -p "$STATE_DIR"
+  tinker "$A" 'echo optional(App\Models\PrivateKey::find(1))->private_key;' >"$VM_KEY.tmp"
+  if grep -q 'PRIVATE KEY' "$VM_KEY.tmp"; then
+    mv "$VM_KEY.tmp" "$VM_KEY"
+    chmod 600 "$VM_KEY"
+    return 0
+  fi
+  rm -f "$VM_KEY.tmp"
+  return 1
+}
+
+# ssh_vm <profile> <command>: run a shell command as root on a VM of the source.
+ssh_vm() {
+  local user ip sudo=''
+  user="$(vm_field "$1" user)"
+  ip="$(vm_field "$1" ip)"
+  [[ "$user" != root ]] && sudo='sudo '
+  ssh -i "$VM_KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ConnectTimeout=5 \
+    "$user@$ip" "${sudo}sh -c $(printf '%q' "$2")"
+}
+
+# workloads <profile>: the containers on a VM, without Sentinel, which a claim restarts on purpose.
+workloads() { ssh_vm "$1" 'docker ps --format "{{.Names}} {{.ID}}" | grep -v coolify-sentinel | sort'; }
+
+# stable_workloads <profile>: the workloads once they stop changing. reset.sh returns while databases still start.
+stable_workloads() {
+  local previous='' current
+  for _ in $(seq 1 30); do
+    current="$(workloads "$1")"
+    [[ -n "$current" && "$current" == "$previous" ]] && break
+    previous="$current"
+    sleep 10
+  done
+  echo "$current"
+}
+
+# require_dev_instance <container>: refuse to wipe anything that is not a running local dev instance.
+require_dev_instance() {
+  running "$1" || die "Container $1 is not running."
+  [[ "$1" == coolify-dev-* ]] || die "$1 is not a scripts/dev instance."
+  [[ "$(tinker "$1" 'echo app()->environment();' | tail -1)" == local ]] || die "$1 does not run with APP_ENV=local."
+}
+
+# Pass/fail counter of the e2e scripts.
+FAILS=0
+ok() { echo "  PASS $*"; }
+bad() {
+  echo "  FAIL $*"
+  FAILS=$((FAILS + 1))
+}
+check() {
+  local name="$1"
+  shift
+  if "$@" >/dev/null 2>&1; then ok "$name"; else bad "$name"; fi
+}
+
+login_php="auth()->login(App\\Models\\User::find(0)); session(['currentTeam' => App\\Models\\Team::find(0)]);"
+
+# transfer_from_page <server uuid>: start a transfer A -> B through the Transfer page, wait, print the final status.
+transfer_from_page() {
+  local status
+  tinker "$A" "$login_php Livewire\\Livewire::test(App\\Livewire\\Server\\Transfer::class, ['server_uuid' => '$1'])->set('targetUrl', 'http://localhost:$B_PORT')->set('targetToken', '$(target_token)')->call('migrateServer');" >/dev/null
+  for _ in $(seq 1 60); do
+    sleep 3
+    status="$(tinker "$A" "echo data_get(App\\Models\\Server::where('uuid', '$1')->first()?->server_metadata, 'migration.status');" | tail -1)"
+    [[ "$status" != running ]] && break
+  done
+  echo "$status"
+}
diff --git a/scripts/transfer-test/manual-setup.sh b/scripts/transfer-test/manual-setup.sh
new file mode 100755
index 0000000000..bb90def1b1
--- /dev/null
+++ b/scripts/transfer-test/manual-setup.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Prepare A and B for a manual transfer test: reset, then add the fake extra records of extras-e2e.sh to A
+# (tokens, DNS, secret manager link, tunnel token, GitHub App + runner config, resource links, canvas positions,
+# team variable, maintenance mode, proxy error page, project icon, a git app with a system-wide GitHub App, and an
+# app of the same project on the other VM). Prints what to open and what to enter.
+#
+# Usage: scripts/transfer-test/manual-setup.sh
+source "$(dirname "$0")/lib.sh"
+
+"$TT_DIR/reset.sh" || die 'reset.sh failed'
+echo '== add the fake extra records to A'
+php_file "$A" "$TT_DIR/seed-extras.php"
+
+cat <<EOF
+
+Ready for a manual transfer test.
+
+  A (source): $A_URL
+  B (target): $B_URL
+  Login on both: test@example.com / password
+
+  Servers on A:
+    $(vm_field ubuntu-non-root uuid)  $(vm_field ubuntu-non-root ip)  project "Transfer Demo": whoami, nginx-dockerfile, postgres, redis, uptime-kuma
+    $(vm_field debian-root uuid)  $(vm_field debian-root ip)  project "Second Server": whoami-2, mariadb, git-shop, and all the fake extra records
+
+  Transfer on A: open a server -> Transfer
+    Target instance URL: http://localhost:$B_PORT
+    Target API token:    $(target_token)
+  Transfer back on A (archive -> Transfer):
+    Instance that manages the server now: http://localhost:$B_PORT   (same token)
+    URL of this instance:                 http://localhost:$A_PORT
+  Token of A (for a transfer from B to A): $(source_token)
+
+Reset again: scripts/transfer-test/manual-setup.sh
+EOF
diff --git a/scripts/transfer-test/reset.sh b/scripts/transfer-test/reset.sh
new file mode 100755
index 0000000000..0abbea8c42
--- /dev/null
+++ b/scripts/transfer-test/reset.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Put the kit back to its start: A manages its localhost VM and the transfer VMs with deployed resources, B is empty.
+# WIPES BOTH DEV DATABASES (migrate:fresh --seed) and the test workloads on the VMs. VM disks are kept. About 4 minutes.
+#
+# Usage: scripts/transfer-test/reset.sh
+source "$(dirname "$0")/lib.sh"
+
+require_dev_instance "$A"
+require_dev_instance "$B"
+mkdir -p "$STATE_DIR"
+
+echo '== 1. remove test workloads from the VMs (the proxy stays)'
+if fetch_vm_key; then
+  for profile in "${TRANSFER_PROFILES[@]}"; do
+    ssh_vm "$profile" '
+      for c in $(docker ps -aq); do n=$(docker inspect -f "{{.Name}}" $c); case "$n" in /coolify-proxy*) ;; *) docker rm -f $c >/dev/null;; esac; done
+      docker volume ls -q | grep -v "^coolify" | xargs -r docker volume rm >/dev/null 2>&1 || true
+      rm -rf /data/coolify/applications/* /data/coolify/databases/* /data/coolify/services/* /data/coolify/sentinel/* /data/coolify/transfer
+      echo "  $(hostname): $(docker ps --format "{{.Names}}" | tr "\n" " ")"' || echo "  $profile: not reachable, skipped"
+  done
+else
+  echo '  no VM key yet (first run), skipped'
+fi
+
+echo '== 2. fresh databases, Redis, SSH folders'
+for C in "$A" "$B"; do
+  docker exec "$C-redis-1" redis-cli FLUSHALL >/dev/null
+  docker exec "$C" sh -c 'rm -rf /var/www/html/storage/app/ssh/keys/* /var/www/html/storage/app/ssh/mux/*; mkdir -p /var/www/html/storage/app/ssh/keys /var/www/html/storage/app/ssh/mux; chown -R www-data:www-data /var/www/html/storage/app/ssh'
+  docker exec -u www-data "$C" php artisan migrate:fresh --seed --force >/dev/null || die "migrate:fresh failed in $C"
+  echo "  $C: database seeded"
+done
+
+echo '== 3. seed the VM servers of A'
+host="${DEV_BIND_ADDRESS:-$(grep -E '^DEV_BIND_ADDRESS=' .env 2>/dev/null | tail -1 | cut -d= -f2-)}"
+[[ -z "$host" || "$host" == 0.0.0.0 ]] && host=127.0.0.1
+APP_ENV=local APP_CONFIG_CACHE="$ROOT/bootstrap/cache/dev-qemu-$$.php" LOG_CHANNEL=stderr \
+  APP_KEY="$(env_value "$SOURCE" APP_KEY)" DB_HOST="$host" DB_PORT="$(env_value "$SOURCE" FORWARD_DB_PORT)" \
+  REDIS_HOST="$host" REDIS_PORT="$(env_value "$SOURCE" FORWARD_REDIS_PORT)" \
+  DEVELOPMENT_QEMU_INSTANCE="$SOURCE" DEVELOPMENT_QEMU_SLOT="$A_SLOT" \
+  DEVELOPMENT_QEMU_DOCKER_NETWORK="$A" DEVELOPMENT_QEMU_COOLIFY_CONTAINER="$A" \
+  "${PRIVILEGED[@]}" sh -c "php artisan dev:qemu $LOCALHOST_PROFILE --as-localhost && php artisan dev:qemu ${TRANSFER_PROFILES[*]}" 2>&1 | grep -E 'Started|rror'
+docker exec "$A" chown -R www-data:www-data /var/www/html/storage/app/ssh
+fetch_vm_key || die 'The VM key (private key 1) is missing on A after seeding.'
+
+echo '== 4. helper image on the VMs'
+helper="$(tinker "$A" 'echo config("constants.coolify.helper_image").":".config("constants.coolify.helper_version");' | tail -1)"
+for profile in "${TRANSFER_PROFILES[@]}"; do
+  # An unreleased helper version cannot be pulled; tag the newest local helper image with that version instead.
+  ssh_vm "$profile" "docker image inspect $helper >/dev/null 2>&1 || docker pull -q $helper >/dev/null 2>&1 || {
+      latest=\$(docker images --format '{{.Repository}}:{{.Tag}}' | grep -E '(^|/)coollabsio/coolify-helper:' | sort -V | tail -1)
+      [ -n \"\$latest\" ] && docker tag \"\$latest\" $helper && echo \"  \$(hostname): tagged \$latest as $helper (not published yet)\"
+    }"
+done
+
+echo '== 5. proxies, API tokens, new code in Horizon'
+tinker "$A" 'foreach (App\Models\Server::where("id", "!=", 0)->get() as $s) { $s->proxy->set("type", "TRAEFIK"); $s->proxy->set("status", "exited"); $s->save(); App\Actions\Proxy\StartProxy::run($s->fresh(), async: false, force: true); echo "  proxy ok: ".$s->name.PHP_EOL; }'
+for side in source target; do
+  C="$A"
+  [[ "$side" == target ]] && C="$B"
+  tinker "$C" '$s = App\Models\InstanceSettings::get(); $s->is_api_enabled = true; $s->save(); session(["currentTeam" => App\Models\Team::find(0)]); echo App\Models\User::find(0)->createToken("transfer-test", ["root"])->plainTextToken;' | tail -1 >"$STATE_DIR/$side.token"
+  chmod 600 "$STATE_DIR/$side.token"
+  docker exec -u www-data "$C" php artisan horizon:terminate >/dev/null
+done
+
+echo '== 6. create and deploy resources on A'
+sleep 10
+"$TT_DIR/seed.sh" >/dev/null || die 'seed.sh failed'
+echo '  waiting for deployments...'
+for _ in $(seq 1 30); do
+  sleep 10
+  [[ "$(tinker "$A" 'echo App\Models\ApplicationDeploymentQueue::whereIn("status", ["queued", "in_progress"])->count();' | tail -1)" == 0 ]] && break
+done
+tinker "$A" 'foreach (App\Models\ApplicationDeploymentQueue::get() as $d) echo "  deploy ".$d->application_name.": ".$d->status.PHP_EOL;'
+for profile in "${TRANSFER_PROFILES[@]}"; do
+  ssh_vm "$profile" 'echo "  $(hostname): $(docker ps --format "{{.Names}}" | grep -v "^coolify-" | wc -l) workload containers"'
+done
+echo "Done. A: $A_URL  B: $B_URL  (login test@example.com / password)"
diff --git a/scripts/transfer-test/reverse-e2e.sh b/scripts/transfer-test/reverse-e2e.sh
new file mode 100755
index 0000000000..52aea2b887
--- /dev/null
+++ b/scripts/transfer-test/reverse-e2e.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Undo paths: the owner marker, transfer back from the archive, a transfer over an archive, take back with automatic
+# release, and deleting an archive.
+# Uses the debian-root VM. Run reset.sh before and after.
+source "$(dirname "$0")/lib.sh"
+TA="$(source_token)"
+TB="$(target_token)"
+PROFILE=debian-root
+S="$(vm_field "$PROFILE" uuid)"
+
+marker() { ssh_vm "$PROFILE" 'cat /data/coolify/transfer/owner.json 2>/dev/null' | jq -r .claim_id; }
+claim_id() { tinker "$1" "echo data_get(App\\Models\\Server::where('uuid','$S')->first()?->server_metadata,'transfer.claim.claim_id');" | tail -1; }
+status() { tinker "$1" "echo data_get(App\\Models\\Server::withTrashed()->where('uuid','$S')->first()?->server_metadata,'transfer.status','none');" | tail -1; }
+# migrate <from port> <from token> <to port> <to token>: transfer through the API, wait, print the transfer status JSON.
+migrate() {
+  local r
+  api POST "$1" "/servers/$S/migrate" "$2" "$(jq -nc --arg u "http://localhost:$3" --arg t "$4" '{target_url:$u,target_token:$t}')" >/dev/null
+  for _ in $(seq 1 40); do sleep 3; r="$(api GET "$1" "/servers/$S/transfer" "$2")"; [[ "$(jq -r .migration.status <<<"$r")" != running ]] && break; done
+  echo "$r"
+}
+
+before="$(stable_workloads "$PROFILE")"
+
+echo '=== 1. A -> B writes the owner marker of B'
+r="$(migrate "$A_PORT" "$TA" "$B_PORT" "$TB")"
+check "transfer A -> B ($(jq -r .migration.status <<<"$r"))" test "$(jq -r .migration.status <<<"$r")" = succeeded
+cb="$(claim_id "$B")"
+check "marker = claim of B ($cb)" test "$(marker)" = "$cb"
+
+echo '=== 2. Transfer back from the Transfer page of the archive on A'
+tinker "$A" "$login_php Livewire\\Livewire::test(App\\Livewire\\Server\\Transfer::class, ['server_uuid'=>'$S'])->set('managerUrl','http://localhost:$B_PORT')->set('managerToken','$TB')->set('thisInstanceUrl','http://localhost:$A_PORT')->call('transferBack');" >/dev/null
+for _ in $(seq 1 40); do sleep 3; [[ "$(status "$A")" == claimed ]] && break; done
+ca="$(claim_id "$A")"
+check 'A claimed (archive replaced), B transferred' test "$(status "$A")/$(status "$B")" = claimed/transferred
+check 'A has one server with this uuid' test "$(tinker "$A" "echo App\\Models\\Server::withTrashed()->where('uuid','$S')->count();" | tail -1)" = 1
+check "marker = claim of A ($ca)" test "$(marker)" = "$ca"
+check 'workloads unchanged after the transfer back' test "$(workloads "$PROFILE")" = "$before"
+
+echo '=== 3. A -> B again replaces the archive on B'
+r="$(migrate "$A_PORT" "$TA" "$B_PORT" "$TB")"
+check "transfer A -> B again ($(jq -r .migration.status <<<"$r"))" test "$(jq -r .migration.status <<<"$r")" = succeeded
+check 'B claimed, A transferred' test "$(status "$B")/$(status "$A")" = claimed/transferred
+check 'workloads unchanged after the second transfer' test "$(workloads "$PROFILE")" = "$before"
+
+echo '=== 4. Take back on A, then B releases the server on its next connection check'
+tinker "$A" "$login_php Livewire\\Livewire::test(App\\Livewire\\Server\\Show::class, ['server_uuid'=>'$S'])->call('enableManagement');" >/dev/null
+ca="$(claim_id "$A")"
+check 'A claimed again' test "$(status "$A")" = claimed
+check "marker = new claim of A ($ca)" test "$(marker)" = "$ca"
+check 'A started the finish list' test "$(tinker "$A" "echo count((array) data_get(App\\Models\\Server::where('uuid','$S')->first()->server_metadata,'transfer.finish.items')) > 0 ? 1 : 0;" | tail -1)" = 1
+check 'B still claimed before its check' test "$(status "$B")" = claimed
+tinker "$B" "(new App\\Jobs\\ServerConnectionCheckJob(App\\Models\\Server::where('uuid','$S')->first()))->handle();" >/dev/null
+check 'B released the server after its check' test "$(status "$B")" = transferred
+check 'B is force disabled' test "$(tinker "$B" "echo (int) App\\Models\\Server::where('uuid','$S')->first()->settings->force_disabled;" | tail -1)" = 1
+tinker "$A" "(new App\\Jobs\\ServerConnectionCheckJob(App\\Models\\Server::where('uuid','$S')->first()))->handle();" >/dev/null
+check 'A keeps the server after its own check' test "$(status "$A")" = claimed
+
+echo '=== 5. Delete the archive on B (records only)'
+tinker "$B" "$login_php Livewire\\Livewire::test(App\\Livewire\\Server\\Delete::class, ['server_uuid'=>'$S'])->call('delete','password');" >/dev/null
+for _ in $(seq 1 20); do sleep 3; [[ "$(status "$B")" == none ]] && break; done
+check 'archive is gone on B' test "$(status "$B")" = none
+check 'workloads unchanged at the end' test "$(workloads "$PROFILE")" = "$before"
+
+echo "=== $FAILS failure(s)"
+exit "$FAILS"
diff --git a/scripts/transfer-test/seed-extras.php b/scripts/transfer-test/seed-extras.php
new file mode 100644
index 0000000000..11b6a85fde
--- /dev/null
+++ b/scripts/transfer-test/seed-extras.php
@@ -0,0 +1,92 @@
+<?php
+
+// Fake records on the source (A) around development-qemu-debian-root, for extras-e2e.sh.
+// Fake credentials are enough: the test checks that the records move, not that the providers accept them.
+
+use App\Models\Application;
+use App\Models\DnsProviderZone;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\ResourceLink;
+use App\Models\SecretManagerLink;
+use App\Models\Server;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneMariadb;
+use App\Services\ProjectIconStorageService;
+
+$quiet = function (string $class, array $attributes) {
+    $model = new $class;
+    $model->forceFill(['uuid' => new_public_id(), ...$attributes])->saveQuietly();
+
+    return $model;
+};
+
+$server = Server::where('uuid', 'development-qemu-debian-root')->firstOrFail();
+$teamId = $server->team_id;
+$app = Application::where('name', 'whoami-2')->firstOrFail();
+$db = StandaloneMariadb::where('name', 'mariadb')->firstOrFail();
+$environment = $app->environment;
+$project = $environment->project;
+
+// Team credentials
+$cloudflare = $quiet(IntegrationToken::class, ['team_id' => $teamId, 'provider' => 'cloudflare', 'name' => 'fake-cloudflare', 'token' => 'fake-cf-token', 'capabilities' => ['dns', 'tunnel']]);
+$infisical = $quiet(IntegrationToken::class, ['team_id' => $teamId, 'provider' => 'infisical', 'name' => 'fake-infisical', 'token' => 'fake-inf-token', 'capabilities' => ['secrets'], 'metadata' => ['client_id' => 'fake-client']]);
+
+// DNS zone + owned record used only by whoami-2
+$zone = $quiet(DnsProviderZone::class, ['integration_token_id' => $cloudflare->id, 'provider_zone_id' => 'fake-zone-id', 'name' => 'example.test', 'account_id' => 'fake-account', 'account_name' => 'Fake']);
+$record = $quiet(ManagedDnsRecord::class, ['team_id' => $teamId, 'integration_token_id' => $cloudflare->id, 'dns_provider_zone_id' => $zone->id, 'provider_record_id' => 'fake-record-id', 'type' => 'A', 'name' => 'whoami2.example.test', 'content' => $server->ip, 'owned' => true]);
+$record->addReference($app);
+
+// Secret manager link
+$quiet(SecretManagerLink::class, ['resourceable_type' => $app->getMorphClass(), 'resourceable_id' => $app->id, 'integration_token_id' => $infisical->id, 'settings' => ['project_id' => 'fake-project', 'environment' => 'prod', 'secret_path' => '/']]);
+
+// Server: Cloudflare tunnel token + custom proxy error page
+$server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $cloudflare->id, 'cloudflare_tunnel_id' => 'fake-tunnel', 'cloudflare_tunnel_account_id' => 'fake-account'])->saveQuietly();
+$server->forceFill(['proxy_error_page' => '<h1>fake error page</h1>'])->saveQuietly();
+
+// GitHub App + runner config (enabled) + one idle runner
+$githubApp = $quiet(GithubApp::class, ['name' => 'fake-gh-app', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'organization' => 'fake-org', 'app_id' => 123, 'installation_id' => 456, 'client_id' => 'fake-client', 'client_secret' => 'fake-secret', 'webhook_secret' => 'fake-webhook', 'is_system_wide' => false, 'is_public' => false, 'team_id' => $teamId, 'private_key_id' => $server->private_key_id]);
+$runnerConfig = $quiet(GithubRunnerConfig::class, ['server_id' => $server->id, 'github_app_id' => $githubApp->id, 'labels' => ['fake-label'], 'is_enabled' => true, 'max_runners' => 2]);
+$quiet(GithubRunnerExecution::class, ['github_app_id' => $githubApp->id, 'github_runner_config_id' => $runnerConfig->id, 'server_id' => $server->id, 'status' => 'idle', 'trigger_workflow_job_id' => 1, 'runner_name' => 'coolify-runner-fake', 'runner_id' => 99, 'labels' => ['fake-label']]);
+
+// A resource of the same project on the OTHER server: same environment (link that stays) and a staging environment
+$ubuntu = Server::where('uuid', 'development-qemu-ubuntu-non-root')->firstOrFail();
+$ubuntuDestination = StandaloneDocker::where('server_id', $ubuntu->id)->firstOrFail();
+$onUbuntu = fn (Environment $env, string $name) => Application::create([
+    'name' => $name, 'environment_id' => $env->id, 'destination_id' => $ubuntuDestination->id, 'destination_type' => $ubuntuDestination->getMorphClass(),
+    'build_pack' => 'dockerimage', 'docker_registry_image_name' => 'traefik/whoami', 'docker_registry_image_tag' => 'latest', 'ports_exposes' => '80',
+    'git_repository' => 'coollabsio/coolify', 'git_branch' => 'main',
+]);
+$otherServerApp = $onUbuntu($environment, 'fake-on-ubuntu');
+$staging = Environment::firstOrCreate(['project_id' => $project->id, 'name' => 'fake-staging']);
+$onUbuntu($staging, 'fake-staging-on-ubuntu');
+
+// Resource links: one between two resources of this server, one to the other server
+$quiet(ResourceLink::class, ['environment_id' => $environment->id, 'source_type' => $app->getMorphClass(), 'source_id' => $app->id, 'target_type' => $db->getMorphClass(), 'target_id' => $db->id, 'label' => 'uses db']);
+$quiet(ResourceLink::class, ['environment_id' => $environment->id, 'source_type' => $app->getMorphClass(), 'source_id' => $app->id, 'target_type' => $otherServerApp->getMorphClass(), 'target_id' => $otherServerApp->id, 'label' => 'calls other']);
+
+// Canvas positions, team shared variable used by an app variable, maintenance mode
+$environment->forceFill(['canvas_positions' => [$app->uuid => ['x' => 111, 'y' => 222], $db->uuid => ['x' => 333, 'y' => 444]]])->saveQuietly();
+SharedEnvironmentVariable::create(['type' => 'team', 'team_id' => $teamId, 'key' => 'FAKE_TEAM_VAR', 'value' => 'team-value']);
+EnvironmentVariable::create(['key' => 'USES_TEAM', 'value' => '{{team.FAKE_TEAM_VAR}}', 'resourceable_type' => $app->getMorphClass(), 'resourceable_id' => $app->id]);
+$app->forceFill(['is_maintenance_enabled' => true, 'maintenance_page' => '<h1>fake maintenance</h1>'])->saveQuietly();
+
+// A git application that uses a system-wide GitHub App, which the transfer does not move
+$systemApp = $quiet(GithubApp::class, ['name' => 'fake-system-wide-app', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'team_id' => 0, 'is_system_wide' => true, 'is_public' => false]);
+$gitApp = new Application;
+$gitApp->forceFill([
+    'uuid' => new_public_id(), 'name' => 'git-shop', 'build_pack' => 'nixpacks', 'git_repository' => 'acme/shop', 'git_branch' => 'main', 'ports_exposes' => '3000',
+    'environment_id' => $environment->id, 'destination_id' => $app->destination_id, 'destination_type' => $app->destination_type,
+    'source_type' => GithubApp::class, 'source_id' => $systemApp->id,
+])->saveQuietly();
+
+// Project icon: a 1x1 JPEG
+app(ProjectIconStorageService::class)->storeProjectContents($project, base64_decode('/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAP//////////////////////////////////////////////////////////////////////////////////////wgALCAABAAEBAREA/8QAFBABAAAAAAAAAAAAAAAAAAAAAP/aAAgBAQABPxA='));
+
+echo "seeded\n";
diff --git a/scripts/seed-transfer-demo.php b/scripts/transfer-test/seed-inventory.php
similarity index 98%
rename from scripts/seed-transfer-demo.php
rename to scripts/transfer-test/seed-inventory.php
index 03c6ae17d2..e8a29020b6 100644
--- a/scripts/seed-transfer-demo.php
+++ b/scripts/transfer-test/seed-inventory.php
@@ -1,9 +1,10 @@
 <?php
 
 /**
- * Seed a rich transfer-demo inventory on the current Coolify instance.
- * Run: php artisan tinker scripts/seed-transfer-demo.php
- * Or:  ./scripts/dev exec php artisan tinker --execute "require 'scripts/seed-transfer-demo.php';"
+ * Seed a rich transfer-demo inventory on the current Coolify instance, in the database only: a server
+ * "transfer-full-demo" on the testing-host container with many resource types. Nothing is deployed.
+ * For live transfers between two instances, use the other scripts of scripts/transfer-test (see README.md).
+ * Run: ./scripts/dev exec php artisan tinker --execute "require 'scripts/transfer-test/seed-inventory.php';"
  */
 
 use App\Models\Application;
diff --git a/scripts/transfer-test/seed.sh b/scripts/transfer-test/seed.sh
new file mode 100755
index 0000000000..1527c864d5
--- /dev/null
+++ b/scripts/transfer-test/seed.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Create real resources on the two transfer VMs of A through the API, then deploy and start them.
+# Run on a fresh A only (reset.sh calls it); it does not clean up. Writes the uuids to <state>/resources.json.
+source "$(dirname "$0")/lib.sh"
+set -e
+
+T="$(source_token)"
+S1="$(vm_field ubuntu-non-root uuid)"
+S2="$(vm_field debian-root uuid)"
+
+call() { # call METHOD PATH [JSON]: fails on an HTTP error
+  local out code
+  out="$(curl -sS -X "$1" "http://127.0.0.1:$A_PORT/api/v1$2" -H "Authorization: Bearer $T" -H 'Content-Type: application/json' -H 'Accept: application/json' ${3:+-d "$3"} -w $'\n%{http_code}')"
+  code="${out##*$'\n'}"
+  out="${out%$'\n'*}"
+  if [[ "$code" -ge 300 ]]; then
+    echo "FAIL $1 $2 ($code): $out" >&2
+    return 1
+  fi
+  echo "$out"
+}
+uuid() { jq -r '.uuid'; }
+
+echo '== projects'
+P1=$(call POST /projects '{"name":"Transfer Demo","description":"Resources on the ubuntu non-root VM"}' | uuid)
+P2=$(call POST /projects '{"name":"Second Server","description":"Resources on the debian root VM"}' | uuid)
+call POST "/projects/$P1/environments" '{"name":"staging"}' >/dev/null
+
+echo '== server 1 (ubuntu non-root): Docker image app with variables, volume, tag, scheduled task'
+APP1=$(call POST /applications/dockerimage "$(jq -nc --arg p "$P1" --arg s "$S1" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"whoami",docker_registry_image_name:"traefik/whoami",docker_registry_image_tag:"latest",ports_exposes:"80",instant_deploy:false}')" | uuid)
+call POST "/applications/$APP1/envs" '{"key":"WHOAMI_NAME","value":"transfer-demo"}' >/dev/null
+call POST "/applications/$APP1/envs" '{"key":"APP_SECRET","value":"very-secret-value"}' >/dev/null
+call POST "/applications/$APP1/storages" '{"type":"persistent","name":"whoami-data","mount_path":"/data"}' >/dev/null || true
+call POST "/applications/$APP1/tags" '{"tag_name":"transfer-demo"}' >/dev/null || true
+call POST "/applications/$APP1/scheduled-tasks" '{"name":"hello","command":"echo hello","frequency":"*/30 * * * *"}' >/dev/null || true
+
+echo '== server 1: Dockerfile app (staging)'
+DF=$(printf 'FROM nginx:alpine\nRUN echo "built by Coolify A" > /usr/share/nginx/html/index.html\nEXPOSE 80\n' | base64 -w0)
+APP2=$(call POST /applications/dockerfile "$(jq -nc --arg p "$P1" --arg s "$S1" --arg d "$DF" '{project_uuid:$p,server_uuid:$s,environment_name:"staging",name:"nginx-dockerfile",dockerfile:$d,ports_exposes:"80",instant_deploy:false}')" | uuid)
+
+echo '== server 1: PostgreSQL with a backup, Redis'
+PG=$(call POST /databases/postgresql "$(jq -nc --arg p "$P1" --arg s "$S1" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"postgres",postgres_user:"demo",postgres_password:"pg-secret-password",postgres_db:"demo",instant_deploy:false}')" | uuid)
+call POST "/databases/$PG/backups" '{"frequency":"0 3 * * *","enabled":true,"save_s3":false,"databases_to_backup":"demo"}' >/dev/null || true
+RD=$(call POST /databases/redis "$(jq -nc --arg p "$P1" --arg s "$S1" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"redis",instant_deploy:false}')" | uuid)
+
+echo '== server 1: one-click service (uptime-kuma)'
+SV=$(call POST /services "$(jq -nc --arg p "$P1" --arg s "$S1" '{type:"uptime-kuma",project_uuid:$p,server_uuid:$s,environment_name:"production",name:"uptime-kuma",instant_deploy:false}')" | uuid)
+
+echo '== server 2 (debian root): whoami-2, MariaDB'
+APP3=$(call POST /applications/dockerimage "$(jq -nc --arg p "$P2" --arg s "$S2" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"whoami-2",docker_registry_image_name:"traefik/whoami",docker_registry_image_tag:"latest",ports_exposes:"80",instant_deploy:false}')" | uuid)
+MD=$(call POST /databases/mariadb "$(jq -nc --arg p "$P2" --arg s "$S2" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"mariadb",instant_deploy:false}')" | uuid)
+
+echo '== deploy and start everything'
+for u in $APP1 $APP2 $APP3; do call POST "/deploy?uuid=$u" >/dev/null && echo "deploy queued $u"; done
+for u in $PG $RD $MD; do call POST "/databases/$u/start" >/dev/null && echo "start queued $u"; done
+call POST "/services/$SV/start" >/dev/null && echo "start queued $SV"
+
+jq -n --arg p1 "$P1" --arg p2 "$P2" --arg app1 "$APP1" --arg app2 "$APP2" --arg app3 "$APP3" --arg pg "$PG" --arg rd "$RD" --arg md "$MD" --arg sv "$SV" \
+  '{projects:[$p1,$p2],apps:[$app1,$app2,$app3],databases:[$pg,$rd,$md],service:$sv}' | tee "$STATE_DIR/resources.json"
diff --git a/scripts/transfer-test/setup.sh b/scripts/transfer-test/setup.sh
new file mode 100755
index 0000000000..55c02fbb96
--- /dev/null
+++ b/scripts/transfer-test/setup.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Prepare the transfer test kit: start the target instance (B) next to the source (A), and let them reach
+# each other and A's VMs. Safe to run again, for example after a host reboot. Linux with KVM only.
+#
+# Usage: scripts/transfer-test/setup.sh    (then scripts/transfer-test/reset.sh)
+source "$(dirname "$0")/lib.sh"
+
+[[ -c /dev/kvm ]] || die 'The kit needs KVM VMs (Linux). See scripts/transfer-test/README.md.'
+running "$A" || die "Start the source instance first: ./scripts/dev start"
+
+echo "== 1. target instance $TARGET (side by side, testing-host as its localhost)"
+# On a new instance, its server seeding can run before the migrations. That does not matter: reset.sh seeds B again.
+COOLIFY_DEV_INSTANCE="$TARGET" COOLIFY_DEV_SIDE_BY_SIDE=1 COOLIFY_DEV_SERVER_BACKEND=testing-host ./scripts/dev start ||
+  echo '  (the seeding of the new instance failed; reset.sh seeds both databases again)'
+running "$B" || die "The target instance $B does not run."
+target_values
+
+echo "== 2. firewall: B may reach the VM network of A (10.221.$A_SLOT.0/24)"
+subnet="$(docker network inspect "$B" --format '{{(index .IPAM.Config 0).Subnet}}')"
+rule=(LIBVIRT_FWI -s "$subnet" -d "10.221.$A_SLOT.0/24" -o "cdevbr$A_SLOT" -j ACCEPT)
+if "${PRIVILEGED[@]}" iptables -C "${rule[@]}" 2>/dev/null; then
+  echo "  rule exists"
+else
+  "${PRIVILEGED[@]}" iptables -I "${rule[0]}" 1 "${rule[@]:1}" && echo "  rule added for $subnet"
+fi
+
+echo "== 3. A and B reach each other's app port"
+bind="$(grep -E '^DEV_BIND_ADDRESS=' .env 2>/dev/null | tail -1 | cut -d= -f2-)"
+if [[ "${bind:-0.0.0.0}" == 127.0.0.1 ]]; then
+  # The ports listen on 127.0.0.1 only; containers reach the host through the docker0 gateway.
+  gateway="$(docker network inspect bridge --format '{{(index .IPAM.Config 0).Gateway}}')"
+  for port in "$A_PORT" "$B_PORT"; do
+    name="coolify-transfer-test-forward-$port"
+    if running "$name"; then
+      echo "  $name runs"
+    else
+      docker rm -f "$name" >/dev/null 2>&1 || true
+      docker run -d --name "$name" --network host --restart unless-stopped alpine/socat \
+        "tcp-listen:$port,bind=$gateway,fork,reuseaddr" "tcp:127.0.0.1:$port" >/dev/null && echo "  $name started ($gateway:$port -> 127.0.0.1:$port)"
+    fi
+  done
+else
+  echo "  not needed: the ports listen on ${bind:-0.0.0.0}"
+fi
+
+echo "Done. A: $A_URL  B: $B_URL"
+echo "Next: scripts/transfer-test/reset.sh"
diff --git a/scripts/transfer-test/verify-extras-source.php b/scripts/transfer-test/verify-extras-source.php
new file mode 100644
index 0000000000..2caeb569c1
--- /dev/null
+++ b/scripts/transfer-test/verify-extras-source.php
@@ -0,0 +1,28 @@
+<?php
+
+// Checks on the source (A) after the debian-root transfer of extras-e2e.sh. Prints PASS/FAIL lines.
+
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
+use App\Models\ManagedDnsRecord;
+use App\Models\Server;
+
+$check = function (string $name, bool $ok, string $detail = '') {
+    echo ($ok ? 'PASS ' : 'FAIL ').$name.($detail !== '' ? " ({$detail})" : '')."\n";
+};
+
+$server = Server::where('uuid', 'development-qemu-debian-root')->first();
+$migration = (array) data_get($server?->server_metadata, 'migration');
+$messages = collect($migration['log'] ?? [])->pluck('message');
+$check('source is transferred away', $server?->isTransferredAway() === true);
+$check('transfer succeeded', ($migration['status'] ?? null) === 'succeeded', (string) ($migration['error'] ?? ''));
+$check('precheck NOTE about resources on the other server', $messages->contains(fn ($m) => str_starts_with($m, "NOTE: project 'Second Server' also has 2 resources on other servers")));
+$check('runner config disabled on the source', GithubRunnerConfig::where('server_id', $server?->id)->value('is_enabled') === false);
+$check('runner execution cancelled on the source', GithubRunnerExecution::where('runner_name', 'coolify-runner-fake')->value('status')?->value === 'cancelled');
+$record = ManagedDnsRecord::where('name', 'whoami2.example.test')->first();
+$check('source keeps the DNS record for a take back, not owned', $record !== null && $record->owned === false);
+$check('precheck NOTE about the system-wide GitHub App', $messages->contains(fn ($m) => str_starts_with($m, "NOTE: the system-wide GitHub App 'fake-system-wide-app'")));
+$checklist = implode("\n", (array) ($migration['checklist'] ?? []));
+$check('checklist: GitHub App URLs', str_contains($checklist, 'GitHub App fake-gh-app'));
+$check('checklist: enable GitHub runners', str_contains($checklist, 'enable GitHub runners'));
+echo "--- warnings\n".implode("\n", (array) ($migration['warnings'] ?? []))."\n--- checklist\n{$checklist}\n";
diff --git a/scripts/transfer-test/verify-extras-target.php b/scripts/transfer-test/verify-extras-target.php
new file mode 100644
index 0000000000..b34de610e4
--- /dev/null
+++ b/scripts/transfer-test/verify-extras-target.php
@@ -0,0 +1,69 @@
+<?php
+
+// Checks on the target (B) after the debian-root transfer of extras-e2e.sh. Prints PASS/FAIL lines.
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\ResourceLink;
+use App\Models\SecretManagerLink;
+use App\Models\Server;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneMariadb;
+use App\Services\ProjectIconStorageService;
+
+$check = function (string $name, bool $ok, string $detail = '') {
+    echo ($ok ? 'PASS ' : 'FAIL ').$name.($detail !== '' ? " ({$detail})" : '')."\n";
+};
+
+$server = Server::where('uuid', 'development-qemu-debian-root')->first();
+$check('server is on B and claimed', data_get($server?->server_metadata, 'transfer.status') === 'claimed');
+$check('custom proxy error page', $server?->proxy_error_page === '<h1>fake error page</h1>');
+
+$cloudflare = IntegrationToken::where('name', 'fake-cloudflare')->first();
+$infisical = IntegrationToken::where('name', 'fake-infisical')->first();
+$check('Cloudflare token moved with its secret', $cloudflare?->token === 'fake-cf-token');
+$check('Infisical token moved with its secret', $infisical?->token === 'fake-inf-token');
+$check('Cloudflare tunnel uses the moved token', $server?->settings?->cloudflare_tunnel_integration_token_id === $cloudflare?->id && $server?->settings?->cloudflare_tunnel_id === 'fake-tunnel');
+
+$app = Application::where('name', 'whoami-2')->first();
+$link = SecretManagerLink::where('resourceable_type', $app?->getMorphClass())->where('resourceable_id', $app?->id)->first();
+$check('secret manager link moved to the moved token', $link?->integration_token_id === $infisical?->id && data_get($link?->settings, 'project_id') === 'fake-project');
+
+$record = ManagedDnsRecord::where('name', 'whoami2.example.test')->first();
+$check('DNS record + zone moved', $record !== null && $record->zone?->provider_zone_id === 'fake-zone-id' && $record->integration_token_id === $cloudflare?->id);
+$check('DNS record references the moved app', $record?->references()->where('resource_type', $app?->getMorphClass())->where('resource_id', $app?->id)->exists() === true);
+// Same app.id on both instances: the owner comment does not change, so the record stays owned.
+// Different app.id: the target must change the comment at Cloudflare, which fails with a fake token.
+$sourceAppId = trim((string) @file_get_contents('/tmp/source-app-id'));
+$sameInstanceId = $sourceAppId === (string) config('app.id');
+$check('DNS ownership '.($sameInstanceId ? 'kept (same instance ID, no adoption needed)' : 'dropped (fake token cannot adopt)'), $record?->owned === $sameInstanceId);
+
+$githubApp = GithubApp::where('name', 'fake-gh-app')->first();
+$runner = GithubRunnerConfig::where('server_id', $server?->id)->first();
+$check('GitHub App moved (only the runner config uses it)', $githubApp !== null && $githubApp->organization === 'fake-org');
+$check('runner config moved, DISABLED, same App and labels', $runner !== null && $runner->is_enabled === false && $runner->github_app_id === $githubApp?->id && in_array('fake-label', (array) $runner->labels, true));
+
+$db = StandaloneMariadb::where('name', 'mariadb')->first();
+$check('resource link between the two moved resources', ResourceLink::where('source_id', $app?->id)->where('target_type', $db?->getMorphClass())->where('target_id', $db?->id)->where('label', 'uses db')->exists());
+$check('resource link to the other server is not moved', ! ResourceLink::where('label', 'calls other')->exists());
+
+$environment = $app?->environment;
+$check('canvas positions moved', data_get($environment?->canvas_positions, ($app?->uuid).'.x') === 111);
+$check('environment without resources on this server is not moved', ! Environment::where('name', 'fake-staging')->exists());
+$check('apps on the other server are not moved', ! Application::whereIn('name', ['fake-on-ubuntu', 'fake-staging-on-ubuntu'])->exists());
+
+$check('team shared variable created', SharedEnvironmentVariable::where('type', 'team')->where('key', 'FAKE_TEAM_VAR')->value('value') === 'team-value');
+$check('app variable that uses it moved', $app?->environment_variables()->where('key', 'USES_TEAM')->value('value') === '{{team.FAKE_TEAM_VAR}}');
+$check('maintenance mode moved', $app?->is_maintenance_enabled === true && $app?->maintenance_page === '<h1>fake maintenance</h1>');
+
+$gitShop = Application::where('name', 'git-shop')->first();
+$check('git-shop moved without its system-wide source', $gitShop !== null && $gitShop->source_id === null);
+$check('finish list has a git source step for git-shop', collect(data_get($server?->server_metadata, 'transfer.finish.items'))->contains('key', 'git_source:'.$gitShop?->uuid));
+
+$project = $environment?->project;
+$icon = $project ? app(ProjectIconStorageService::class)->projectContents($project) : null;
+$check('project icon moved', $icon !== null && str_starts_with($icon, "\xFF\xD8\xFF"));
diff --git a/templates/compose/appwrite.yaml b/templates/compose/appwrite.yaml
index f20cc86649..7ba5c69bb0 100644
--- a/templates/compose/appwrite.yaml
+++ b/templates/compose/appwrite.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://appwrite.io/docs
 # slogan: A backend-as-a-service platform that simplifies the web & mobile app development.
 # category: backend
diff --git a/templates/compose/babybuddy.yaml b/templates/compose/babybuddy.yaml
index af07b2282e..89313047c8 100644
--- a/templates/compose/babybuddy.yaml
+++ b/templates/compose/babybuddy.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.baby-buddy.net
 # slogan: It helps parents track their baby's daily activities, growth, and health with ease.
 # category: productivity
diff --git a/templates/compose/bookstack.yaml b/templates/compose/bookstack.yaml
index c2ac53675f..4de93bc045 100644
--- a/templates/compose/bookstack.yaml
+++ b/templates/compose/bookstack.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.bookstackapp.com/docs/
 # slogan: BookStack is a simple, self-hosted, easy-to-use platform for organising and storing information
 # category: cms
diff --git a/templates/compose/budge.yaml b/templates/compose/budge.yaml
index d4b7828540..b613dab375 100644
--- a/templates/compose/budge.yaml
+++ b/templates/compose/budge.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://github.com/linuxserver/budge
 # slogan: A budgeting personal finance app.
 # category: finance
diff --git a/templates/compose/castopod.yaml b/templates/compose/castopod.yaml
index 8eaed59e5c..0a2516a5d3 100644
--- a/templates/compose/castopod.yaml
+++ b/templates/compose/castopod.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation:https://docs.castopod.org/main/en/
 # slogan: Castopod is a free & open-source hosting platform made for podcasters who want engage and interact with their audience.
 # category: media
diff --git a/templates/compose/classicpress-with-mariadb.yaml b/templates/compose/classicpress-with-mariadb.yaml
index 19ee86e424..46b142847c 100644
--- a/templates/compose/classicpress-with-mariadb.yaml
+++ b/templates/compose/classicpress-with-mariadb.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.classicpress.net/
 # slogan: A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).
 # category: cms
diff --git a/templates/compose/classicpress-with-mysql.yaml b/templates/compose/classicpress-with-mysql.yaml
index 2d90e046c9..e1561763fc 100644
--- a/templates/compose/classicpress-with-mysql.yaml
+++ b/templates/compose/classicpress-with-mysql.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.classicpress.net/
 # slogan: A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).
 # category: cms
diff --git a/templates/compose/classicpress-without-database.yaml b/templates/compose/classicpress-without-database.yaml
index c52fc38605..c1f5bbee0d 100644
--- a/templates/compose/classicpress-without-database.yaml
+++ b/templates/compose/classicpress-without-database.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.classicpress.net/
 # slogan: A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).
 # category: cms
diff --git a/templates/compose/cockpit.yaml b/templates/compose/cockpit.yaml
index 11588bac81..43f97b89db 100644
--- a/templates/compose/cockpit.yaml
+++ b/templates/compose/cockpit.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://getcockpit.com/documentation/
 # slogan: Cockpit is a headless content platform that is lightweight, fast and ready for takeoff.
 # category: cms
diff --git a/templates/compose/dokuwiki.yaml b/templates/compose/dokuwiki.yaml
index 32ce13b293..5bc1b4771c 100644
--- a/templates/compose/dokuwiki.yaml
+++ b/templates/compose/dokuwiki.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.dokuwiki.org/
 # slogan: A lightweight and easy-to-use wiki platform for creating and managing documentation and knowledge bases.
 # category: cms
diff --git a/templates/compose/dolibarr.yaml b/templates/compose/dolibarr.yaml
index 4cdfc05fe5..9a453f54c7 100644
--- a/templates/compose/dolibarr.yaml
+++ b/templates/compose/dolibarr.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.dolibarr.org/documentation-home.php
 # slogan: Dolibarr is a modern software package to manage your organization's activity (contacts, quotes, invoices, orders, stocks, agenda, hr, expense reports, accountancy, ecm, manufacturing, ...).
 # category: productivity
diff --git a/templates/compose/drupal-with-postgresql.yaml b/templates/compose/drupal-with-postgresql.yaml
index 419f0e3002..d3ba2aee66 100644
--- a/templates/compose/drupal-with-postgresql.yaml
+++ b/templates/compose/drupal-with-postgresql.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.drupal.org/about
 # slogan: Drupal is a free and open-source web content management system written in PHP and distributed under the GNU General Public License.
 # category: cms
diff --git a/templates/compose/easyappointments.yaml b/templates/compose/easyappointments.yaml
index 55b9d0c85f..95138d8877 100644
--- a/templates/compose/easyappointments.yaml
+++ b/templates/compose/easyappointments.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://easyappointments.org/
 # slogan: Schedule Anything. Let's start with easy! Get the best free online appointment scheduler on your server, today.
 # category: productivity
diff --git a/templates/compose/espocrm.yaml b/templates/compose/espocrm.yaml
index 8fec5d2ed9..1e95c99cbd 100644
--- a/templates/compose/espocrm.yaml
+++ b/templates/compose/espocrm.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.espocrm.com
 # slogan: EspoCRM is a free and open-source CRM platform.
 # category: productivity
diff --git a/templates/compose/firefly.yaml b/templates/compose/firefly.yaml
index 2fbbdd2989..964e724187 100644
--- a/templates/compose/firefly.yaml
+++ b/templates/compose/firefly.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://firefly-iii.org
 # slogan: A personal finances manager that can help you save money.
 # category: finance
diff --git a/templates/compose/freescout.yaml b/templates/compose/freescout.yaml
index 247220f962..9350e306bf 100644
--- a/templates/compose/freescout.yaml
+++ b/templates/compose/freescout.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://github.com/freescout-help-desk/freescout/wiki/
 # slogan: FreeScout is the super lightweight and powerful free open source help desk and shared inbox written in PHP (Laravel framework).
 # category: helpdesk
diff --git a/templates/compose/freshrss-with-mariadb.yaml b/templates/compose/freshrss-with-mariadb.yaml
index dc0e189169..433a034302 100644
--- a/templates/compose/freshrss-with-mariadb.yaml
+++ b/templates/compose/freshrss-with-mariadb.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://freshrss.org/index.html
 # slogan: A free, self-hostable feed aggregator.
 # category: RSS
diff --git a/templates/compose/freshrss-with-mysql.yaml b/templates/compose/freshrss-with-mysql.yaml
index f475de5695..b796c8661e 100644
--- a/templates/compose/freshrss-with-mysql.yaml
+++ b/templates/compose/freshrss-with-mysql.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://freshrss.org/index.html
 # slogan: A free, self-hostable feed aggregator.
 # category: RSS
diff --git a/templates/compose/freshrss-with-postgresql.yaml b/templates/compose/freshrss-with-postgresql.yaml
index 381aabc8be..c3467f1d31 100644
--- a/templates/compose/freshrss-with-postgresql.yaml
+++ b/templates/compose/freshrss-with-postgresql.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://freshrss.org/index.html
 # slogan: A free, self-hostable feed aggregator.
 # category: RSS
diff --git a/templates/compose/freshrss.yaml b/templates/compose/freshrss.yaml
index b5c2e92c68..e19c407af2 100644
--- a/templates/compose/freshrss.yaml
+++ b/templates/compose/freshrss.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://freshrss.org/index.html
 # slogan: A free, self-hostable feed aggregator.
 # category: RSS
diff --git a/templates/compose/glpi.yaml b/templates/compose/glpi.yaml
index c0b3201c90..7ac784a2c4 100644
--- a/templates/compose/glpi.yaml
+++ b/templates/compose/glpi.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://help.glpi-project.org/documentation
 # slogan: GLPI (Gestionnaire Libre de Parc Informatique) is a free, open-source IT Service Management (ITSM) platform used for IT asset management, helpdesk, and service desk operations.
 # category: helpdesk
diff --git a/templates/compose/grocy.yaml b/templates/compose/grocy.yaml
index fc96d272df..783ce27767 100644
--- a/templates/compose/grocy.yaml
+++ b/templates/compose/grocy.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://github.com/grocy/grocy
 # slogan: Grocy is a web-based household management and grocery list application.
 # category: productivity
diff --git a/templates/compose/heimdall.yaml b/templates/compose/heimdall.yaml
index 56e193f1cf..5c9f4729b3 100644
--- a/templates/compose/heimdall.yaml
+++ b/templates/compose/heimdall.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://github.com/linuxserver/Heimdall
 # slogan: Heimdall is a dashboard for managing and organizing your server applications.
 # category: productivity
diff --git a/templates/compose/invoice-ninja.yaml b/templates/compose/invoice-ninja.yaml
index c4581cc9f4..f9908a6deb 100644
--- a/templates/compose/invoice-ninja.yaml
+++ b/templates/compose/invoice-ninja.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://invoiceninja.github.io/selfhost.html
 # slogan: The leading open-source invoicing platform
 # category: finance
diff --git a/templates/compose/joomla-with-mariadb.yaml b/templates/compose/joomla-with-mariadb.yaml
index 06ce5c20e3..76c5ee560d 100644
--- a/templates/compose/joomla-with-mariadb.yaml
+++ b/templates/compose/joomla-with-mariadb.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://joomla.org
 # slogan: Joomla! is the mobile-ready and user-friendly way to build your website. Choose from thousands of features and designs. Joomla! is free and open source.
 # category: cms
diff --git a/templates/compose/kimai.yaml b/templates/compose/kimai.yaml
index c9795f0d21..f846598829 100644
--- a/templates/compose/kimai.yaml
+++ b/templates/compose/kimai.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.kimai.org/
 # slogan: Open source time-tracking app.
 # category: productivity
diff --git a/templates/compose/leantime.yaml b/templates/compose/leantime.yaml
index 44235d8af3..7b2f693282 100644
--- a/templates/compose/leantime.yaml
+++ b/templates/compose/leantime.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://leantime.io
 # slogan: Leantime is a goals focused project management system for non-project managers.
 # category: productivity
diff --git a/templates/compose/librespeed.yaml b/templates/compose/librespeed.yaml
index 6e53a3aff5..e2a06a9360 100644
--- a/templates/compose/librespeed.yaml
+++ b/templates/compose/librespeed.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://github.com/librespeed/speedtest
 # slogan: Self-hosted lightweight Speed Test.
 # category: devtools
diff --git a/templates/compose/limesurvey.yaml b/templates/compose/limesurvey.yaml
index 47b8c5e0ea..b3add1382a 100644
--- a/templates/compose/limesurvey.yaml
+++ b/templates/compose/limesurvey.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.limesurvey.org/manual/
 # slogan: Simple, quick and anonymous online survey tool that's bursting with juicy insights.
 # category: productivity
diff --git a/templates/compose/mediawiki.yaml b/templates/compose/mediawiki.yaml
index ba6a2871f6..fe76b28946 100644
--- a/templates/compose/mediawiki.yaml
+++ b/templates/compose/mediawiki.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.mediawiki.org
 # slogan: MediaWiki is a collaboration and documentation platform brought to you by a vibrant community.
 # category: cms
diff --git a/templates/compose/mixpost.yaml b/templates/compose/mixpost.yaml
index ca0937f4de..80542038e0 100644
--- a/templates/compose/mixpost.yaml
+++ b/templates/compose/mixpost.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.mixpost.app/lite
 # slogan: Mixpost is a robust and versatile social media management software, designed to streamline social media operations and enhance content marketing strategies.
 # category: analytics
diff --git a/templates/compose/moodle.yaml b/templates/compose/moodle.yaml
index 41b7916b9b..2fa8f784c4 100644
--- a/templates/compose/moodle.yaml
+++ b/templates/compose/moodle.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://moodle.org
 # slogan: Moodle is the world’s most customisable and trusted eLearning solution that empowers educators to improve our world.
 # category: cms
diff --git a/templates/compose/nextcloud-with-mariadb.yaml b/templates/compose/nextcloud-with-mariadb.yaml
index 033423cafd..734599d0dc 100644
--- a/templates/compose/nextcloud-with-mariadb.yaml
+++ b/templates/compose/nextcloud-with-mariadb.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.nextcloud.com
 # slogan: NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.
 # category: storage
diff --git a/templates/compose/nextcloud-with-mysql.yaml b/templates/compose/nextcloud-with-mysql.yaml
index 17d803c5da..abbe868eaf 100644
--- a/templates/compose/nextcloud-with-mysql.yaml
+++ b/templates/compose/nextcloud-with-mysql.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.nextcloud.com
 # slogan: NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.
 # category: storage
diff --git a/templates/compose/nextcloud-with-postgres.yaml b/templates/compose/nextcloud-with-postgres.yaml
index 0f717cd856..bea81f8673 100644
--- a/templates/compose/nextcloud-with-postgres.yaml
+++ b/templates/compose/nextcloud-with-postgres.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.nextcloud.com
 # slogan: NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.
 # category: storage
diff --git a/templates/compose/nextcloud.yaml b/templates/compose/nextcloud.yaml
index a5b7836415..986d92d02f 100644
--- a/templates/compose/nextcloud.yaml
+++ b/templates/compose/nextcloud.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.nextcloud.com
 # slogan: NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.
 # category: storage
diff --git a/templates/compose/observium.yaml b/templates/compose/observium.yaml
index 5227704e59..f0ac2ed7d3 100644
--- a/templates/compose/observium.yaml
+++ b/templates/compose/observium.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.observium.org/
 # slogan: Observium is a comprehensive network monitoring platform designed to deliver powerful monitoring capabilities, combined with an elegant and intuitive user interface.
 # category: monitoring
diff --git a/templates/compose/opnform.yaml b/templates/compose/opnform.yaml
index 048327b017..281d9ad703 100644
--- a/templates/compose/opnform.yaml
+++ b/templates/compose/opnform.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.opnform.com/introduction
 # slogan: OpnForm is an open-source form builder that lets you create beautiful forms and share them anywhere. It's super fast, you don't need to know how to code
 # category: productivity
diff --git a/templates/compose/orangehrm.yaml b/templates/compose/orangehrm.yaml
index c93495a1f9..9413350659 100644
--- a/templates/compose/orangehrm.yaml
+++ b/templates/compose/orangehrm.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://starterhelp.orangehrm.com/hc/en-us
 # slogan: OrangeHRM open source HR management software.
 # category: productivity
diff --git a/templates/compose/organizr.yaml b/templates/compose/organizr.yaml
index aaa92e30dd..c135dfa6a9 100644
--- a/templates/compose/organizr.yaml
+++ b/templates/compose/organizr.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.organizr.app/
 # slogan: Homelab Services Organizer
 # category: productivity
diff --git a/templates/compose/owncloud.yaml b/templates/compose/owncloud.yaml
index c341a53902..69a628096e 100644
--- a/templates/compose/owncloud.yaml
+++ b/templates/compose/owncloud.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://owncloud.com/docs-guides/
 # slogan: OwnCloud with Open Web UI integrates file management with a powerful, user-friendly interface.
 # category: storage
diff --git a/templates/compose/passbolt.yaml b/templates/compose/passbolt.yaml
index 4705e04096..468b0bcc60 100644
--- a/templates/compose/passbolt.yaml
+++ b/templates/compose/passbolt.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.passbolt.com/ce/docker
 # slogan: Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!
 # category: auth
diff --git a/templates/compose/paymenter.yaml b/templates/compose/paymenter.yaml
index d86c101a4c..9201bdd867 100644
--- a/templates/compose/paymenter.yaml
+++ b/templates/compose/paymenter.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://paymenter.org/docs/guides/docker
 # slogan: Open-Source Billing, Built for Hosting
 # category: finance
diff --git a/templates/compose/phpmyadmin.yaml b/templates/compose/phpmyadmin.yaml
index 6c95948e07..b0aa26b3f1 100644
--- a/templates/compose/phpmyadmin.yaml
+++ b/templates/compose/phpmyadmin.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://phpmyadmin.net
 # slogan: phpMyAdmin is a web-based database management tool for administering your MySQL and MariaDB databases through a user-friendly interface.
 # category: database
diff --git a/templates/compose/privatebin.yaml b/templates/compose/privatebin.yaml
index caca2c42b4..98353d3fdf 100644
--- a/templates/compose/privatebin.yaml
+++ b/templates/compose/privatebin.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://github.com/PrivateBin/PrivateBin/blob/master/doc/README.md
 # slogan: PrivateBin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data.
 # category: security
diff --git a/templates/compose/pterodactyl-panel.yaml b/templates/compose/pterodactyl-panel.yaml
index 2ee3b74815..3c6349e1f9 100644
--- a/templates/compose/pterodactyl-panel.yaml
+++ b/templates/compose/pterodactyl-panel.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://pterodactyl.io/
 # slogan: Pterodactyl is a free, open-source game server management panel
 # category: media
diff --git a/templates/compose/pterodactyl-with-wings.yaml b/templates/compose/pterodactyl-with-wings.yaml
index f88b671b7f..f9f881d97c 100644
--- a/templates/compose/pterodactyl-with-wings.yaml
+++ b/templates/compose/pterodactyl-with-wings.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://pterodactyl.io/
 # slogan: Pterodactyl is a free, open-source game server management panel
 # category: media
diff --git a/templates/compose/shlink.yaml b/templates/compose/shlink.yaml
index 6d12269701..fc004ec9be 100644
--- a/templates/compose/shlink.yaml
+++ b/templates/compose/shlink.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://shlink.io/
 # slogan: The definitive self-hosted URL shortener
 # category: productivity
diff --git a/templates/compose/snapdrop.yaml b/templates/compose/snapdrop.yaml
index 6fba2adbb6..7731fb458e 100644
--- a/templates/compose/snapdrop.yaml
+++ b/templates/compose/snapdrop.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://github.com/RobinLinus/snapdrop
 # slogan: A self-hosted file-sharing service for secure and convenient file transfers, whether on a local network or the internet.
 # category: productivity
diff --git a/templates/compose/snipe-it.yaml b/templates/compose/snipe-it.yaml
index fad5674105..8c2ad863f6 100644
--- a/templates/compose/snipe-it.yaml
+++ b/templates/compose/snipe-it.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://snipe-it.readme.io/docs/introduction
 # slogan: Snipe-IT is an open-source asset management platform built for IT departments.
 # category: productivity
diff --git a/templates/compose/soketi-app-manager.yaml b/templates/compose/soketi-app-manager.yaml
index b431817586..66ddd23247 100644
--- a/templates/compose/soketi-app-manager.yaml
+++ b/templates/compose/soketi-app-manager.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://github.com/rahulhaque/soketi-app-manager-filament
 # slogan: Manage soketi websocket server and apps with ease.
 # category: devtools
diff --git a/templates/compose/vvveb-with-mariadb.yaml b/templates/compose/vvveb-with-mariadb.yaml
index b1b3db3053..75d3ec2876 100644
--- a/templates/compose/vvveb-with-mariadb.yaml
+++ b/templates/compose/vvveb-with-mariadb.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.vvveb.com
 # slogan: Powerful and easy to use cms to build websites, blogs or ecommerce stores.
 # category: cms
diff --git a/templates/compose/vvveb-with-mysql.yaml b/templates/compose/vvveb-with-mysql.yaml
index 1feb3f627e..2a8af5b472 100644
--- a/templates/compose/vvveb-with-mysql.yaml
+++ b/templates/compose/vvveb-with-mysql.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.vvveb.com
 # slogan: Powerful and easy to use cms to build websites, blogs or ecommerce stores.
 # category: cms
diff --git a/templates/compose/vvveb.yaml b/templates/compose/vvveb.yaml
index 483e6dbb5a..6b77339745 100644
--- a/templates/compose/vvveb.yaml
+++ b/templates/compose/vvveb.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://docs.vvveb.com
 # slogan: Powerful and easy to use cms to build websites, blogs or ecommerce stores.
 # category: cms
diff --git a/templates/compose/windmill.yaml b/templates/compose/windmill.yaml
index f22b471d8c..ec8d6bbfed 100644
--- a/templates/compose/windmill.yaml
+++ b/templates/compose/windmill.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://www.windmill.dev/docs/
 # slogan: Windmill is a developer platform to build production-grade multi-steps automations and internal apps.
 # category: automation
diff --git a/templates/compose/wordpress-with-mariadb.yaml b/templates/compose/wordpress-with-mariadb.yaml
index 7822a05539..ad23ee8e65 100644
--- a/templates/compose/wordpress-with-mariadb.yaml
+++ b/templates/compose/wordpress-with-mariadb.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://wordpress.org
 # slogan: WordPress is open source software you can use to create a beautiful website, blog, or app.
 # category: cms
diff --git a/templates/compose/wordpress-with-mysql.yaml b/templates/compose/wordpress-with-mysql.yaml
index 269208e514..5adb619779 100644
--- a/templates/compose/wordpress-with-mysql.yaml
+++ b/templates/compose/wordpress-with-mysql.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://wordpress.org
 # slogan: WordPress is open source software you can use to create a beautiful website, blog, or app.
 # category: cms
diff --git a/templates/compose/wordpress-without-database.yaml b/templates/compose/wordpress-without-database.yaml
index cb9a459b58..c3ea291b0e 100644
--- a/templates/compose/wordpress-without-database.yaml
+++ b/templates/compose/wordpress-without-database.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://wordpress.org
 # slogan: WordPress is open source software you can use to create a beautiful website, blog, or app.
 # category: cms
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index b68fbfc5ac..135d486d55 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -14,7 +14,7 @@
         "category": "ai",
         "logo": "svgs/9router.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-04T18:02:06+02:00",
+        "template_last_updated_at": "2026-10-05T11:08:52+02:00",
         "port": "20128"
     },
     "activepieces": {
@@ -125,7 +125,7 @@
         "category": "productivity",
         "logo": "svgs/appflowy.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-16T11:26:29-05:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "80"
     },
     "apprise-api": {
@@ -159,21 +159,6 @@
         "template_last_updated_at": "2026-09-02T19:39:19+02:00",
         "port": "80"
     },
-    "appwrite": {
-        "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
-        "slogan": "A backend-as-a-service platform that simplifies the web & mobile app development.",
-        "compose": "c2VydmljZXM6CiAgYXBwd3JpdGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuNS4wJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQVBQV1JJVEU9L3YxCiAgICAgIC0gJ19BUFBfRE5TX0VYVEVSTkFMPSR7X0FQUF9ETlNfRVhURVJOQUx9JwogICAgICAtICdfQVBQX0FMTE9XRURfSU5URVJOQUxfQUREUkVTU0VTPSR7X0FQUF9BTExPV0VEX0lOVEVSTkFMX0FERFJFU1NFU30nCiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSAnX0FQUF9FRElUSU9OPSR7X0FQUF9FRElUSU9OOi1zZWxmLWhvc3RlZH0nCiAgICAgIC0gJ19BUFBfV09SS0VSX1BFUl9DT1JFPSR7X0FQUF9XT1JLRVJfUEVSX0NPUkU6LTZ9JwogICAgICAtICdfQVBQX0xPQ0FMRT0ke19BUFBfTE9DQUxFOi1lbn0nCiAgICAgIC0gJ19BUFBfQ09NUFJFU1NJT05fRU5BQkxFRD0ke19BUFBfQ09NUFJFU1NJT05fRU5BQkxFRDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09NUFJFU1NJT05fTUlOX1NJWkVfQllURVM9JHtfQVBQX0NPTVBSRVNTSU9OX01JTl9TSVpFX0JZVEVTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9ST09UPSR7X0FQUF9DT05TT0xFX1dISVRFTElTVF9ST09UOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9FTUFJTFM9JHtfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0VNQUlMU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9TRVNTSU9OX0FMRVJUUz0ke19BUFBfQ09OU09MRV9TRVNTSU9OX0FMRVJUUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0lQUz0ke19BUFBfQ09OU09MRV9XSElURUxJU1RfSVBTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0hPU1ROQU1FUz0ke19BUFBfQ09OU09MRV9IT1NUTkFNRVN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRIVUJfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUSFVCX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HSVRIVUJfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVExBQl9BUFBfSUQ9JHtfQVBQX0NPTlNPTEVfR0lUTEFCX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRMQUJfU0VDUkVUPSR7X0FQUF9DT05TT0xFX0dJVExBQl9TRUNSRVR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUTEFCX0VORFBPSU5UPSR7X0FQUF9DT05TT0xFX0dJVExBQl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9CSVRCVUNLRVRfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0JJVEJVQ0tFVF9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQklUQlVDS0VUX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9CSVRCVUNLRVRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dPT0dMRV9BUFBfSUQ9JHtfQVBQX0NPTlNPTEVfR09PR0xFX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HT09HTEVfU0VDUkVUPSR7X0FQUF9DT05TT0xFX0dPT0dMRV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9OQU1FPSR7X0FQUF9TWVNURU1fRU1BSUxfTkFNRTotQXBwd3JpdGV9JwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTPSR7X0FQUF9TWVNURU1fRU1BSUxfQUREUkVTUzotbm9yZXBseUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfU1lTVEVNX1RFQU1fRU1BSUw9JHtfQVBQX1NZU1RFTV9URUFNX0VNQUlMOi10ZWFtQGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9FTUFJTF9TRUNVUklUWT0ke19BUFBfRU1BSUxfU0VDVVJJVFk6LXNlY3VyaXR5QGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9TWVNURU1fUkVTUE9OU0VfRk9STUFUPSR7X0FQUF9TWVNURU1fUkVTUE9OU0VfRk9STUFUfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0FCVVNFPSR7X0FQUF9PUFRJT05TX0FCVVNFOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0FCVVNFX0lOQ1JFQVNFRF9MSU1JVF9QUk9KRUNUUz0ke19BUFBfT1BUSU9OU19BQlVTRV9JTkNSRUFTRURfTElNSVRfUFJPSkVDVFN9JwogICAgICAtICdfQVBQX09QVElPTlNfUk9VVEVSX1BST1RFQ1RJT049JHtfQVBQX09QVElPTlNfUk9VVEVSX1BST1RFQ1RJT046LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTPSR7X0FQUF9ST1VURVJfQVVUT19DRVJUSUZJQ0FURVM6LWRpc2FibGVkfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gX0FQUF9OT1RJRklDQVRJT05TX1RSQUNLSU5HX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9OT1RJRklDQVRJT05TCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0NPTlNPTEVfRE9NQUlOPSR7X0FQUF9DT05TT0xFX0RPTUFJTn0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9VUkw9JHtfQVBQX0NPTlNPTEVfVVJMfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFM9JHtfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQj0ke19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1RfVkVDVE9SU0RCPSR7X0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQjotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9WRUNUT1JTREI9JHtfQVBQX0RCX1BPUlRfVkVDVE9SU0RCOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCPSR7X0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSX1ZFQ1RPUlNEQj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTX1ZFQ1RPUlNEQj0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI6LW1vbmdvZGJ9JwogICAgICAtICdfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI6LTI3MDE3fScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUEFTU19ET0NVTUVOVFNEQj0ke19BUFBfREJfUEFTU19ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQn0nCiAgICAgIC0gJ19BUFBfU01UUF9IT1NUPSR7X0FQUF9TTVRQX0hPU1R9JwogICAgICAtICdfQVBQX1NNVFBfUE9SVD0ke19BUFBfU01UUF9QT1JUfScKICAgICAgLSAnX0FQUF9TTVRQX1NFQ1VSRT0ke19BUFBfU01UUF9TRUNVUkV9JwogICAgICAtICdfQVBQX1NNVFBfVVNFUk5BTUU9JHtfQVBQX1NNVFBfVVNFUk5BTUV9JwogICAgICAtICdfQVBQX1NNVFBfUEFTU1dPUkQ9JHtfQVBQX1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElNSVQ9JHtfQVBQX1NUT1JBR0VfTElNSVQ6LTMwMDAwMDAwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1BSRVZJRVdfTElNSVQ9JHtfQVBQX1NUT1JBR0VfUFJFVklFV19MSU1JVDotMjAwMDAwMDB9JwogICAgICAtICdfQVBQX0FVVE9HUkFWSVRZX0hPU1Q9JHtfQVBQX0FVVE9HUkFWSVRZX0hPU1R9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQU5USVZJUlVTPSR7X0FQUF9TVE9SQUdFX0FOVElWSVJVUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQU5USVZJUlVTX0hPU1Q9JHtfQVBQX1NUT1JBR0VfQU5USVZJUlVTX0hPU1R9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQU5USVZJUlVTX1BPUlQ9JHtfQVBQX1NUT1JBR0VfQU5USVZJUlVTX1BPUlQ6LTMzMTB9JwogICAgICAtICdfQVBQX1NUT1JBR0VfREVWSUNFPSR7X0FQUF9TVE9SQUdFX0RFVklDRTotbG9jYWx9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9TM19TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9TM19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlQ9JHtfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9ET19TUEFDRVNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT049JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfUkVHSU9OOi11cy13ZXN0LTAwNH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfTElOT0RFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9MSU5PREVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT049JHtfQVBQX1NUT1JBR0VfTElOT0RFX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9XQVNBQklfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX1dBU0FCSV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9XQVNBQklfUkVHSU9OOi1ldS1jZW50cmFsLTF9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfQlVDS0VUfScKICAgICAgLSAnX0FQUF9DT01QVVRFX1NJWkVfTElNSVQ9JHtfQVBQX0NPTVBVVEVfU0laRV9MSU1JVDotMzAwMDAwMDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQlVJTERfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9CVUlMRF9TSVpFX0xJTUlUOi0yMDAwMDAwMDAwfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfVElNRU9VVD0ke19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfU0lURVNfVElNRU9VVD0ke19BUFBfU0lURVNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVDotMjcwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9DUFVTPSR7X0FQUF9DT01QVVRFX0NQVVM6LTB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfTUVNT1JZPSR7X0FQUF9DT01QVVRFX01FTU9SWTotMH0nCiAgICAgIC0gJ19BUFBfRlVOQ1RJT05TX1JVTlRJTUVTPSR7X0FQUF9GVU5DVElPTlNfUlVOVElNRVM6LW5vZGUtMjJ9JwogICAgICAtICdfQVBQX1NJVEVTX1JVTlRJTUVTPSR7X0FQUF9TSVRFU19SVU5USU1FUzotc3RhdGljLTEsbm9kZS0yMn0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1NJVEVTPSR7X0FQUF9ET01BSU5fU0lURVM6LXNpdGVzLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtIF9BUFBfRVhFQ1VUT1JfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0VYRUNVVE9SCiAgICAgIC0gJ19BUFBfRVhFQ1VUT1JfSE9TVD0ke19BUFBfRVhFQ1VUT1JfSE9TVDotaHR0cDovL29wZW5ydW50aW1lcy1leGVjdXRvci92MX0nCiAgICAgIC0gJ19BUFBfQlVJTERTX1ZPTFVNRT0ke0NPTVBPU0VfUFJPSkVDVF9OQU1FfV9hcHB3cml0ZS1idWlsZHMnCiAgICAgIC0gJ19BUFBfSk9CU19IT1NUPSR7X0FQUF9KT0JTX0hPU1Q6LWh0dHA6Ly9vcmNoZXN0cmF0b3I6ODA4MH0nCiAgICAgIC0gX0FQUF9KT0JTX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9KT0JTCiAgICAgIC0gJ19BUFBfSk9CU19FTkRQT0lOVD0ke19BUFBfSk9CU19FTkRQT0lOVDotaHR0cDovL2FwcHdyaXRlfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0NPTkZJRz0ke19BUFBfTE9HR0lOR19DT05GSUd9JwogICAgICAtICdfQVBQX0xPR0dJTkdfRk9STUFUPSR7X0FQUF9MT0dHSU5HX0ZPUk1BVDotcHJldHR5fScKICAgICAgLSAnX0FQUF9MT0NLSU5HX0VOQUJMRUQ9JHtfQVBQX0xPQ0tJTkdfRU5BQkxFRDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTj0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTjotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU6LTI1OTIwMDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUz0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUzotODY0MDB9JwogICAgICAtICdfQVBQX1NNU19QUk9WSURFUj0ke19BUFBfU01TX1BST1ZJREVSfScKICAgICAgLSAnX0FQUF9TTVNfRlJPTT0ke19BUFBfU01TX0ZST019JwogICAgICAtICdfQVBQX0dSQVBIUUxfSU5UUk9TUEVDVElPTj0ke19BUFBfR1JBUEhRTF9JTlRST1NQRUNUSU9OOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX01BWF9CQVRDSF9TSVpFPSR7X0FQUF9HUkFQSFFMX01BWF9CQVRDSF9TSVpFOi0xMH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfQ09NUExFWElUWT0ke19BUFBfR1JBUEhRTF9NQVhfQ09NUExFWElUWTotMjUwfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX01BWF9ERVBUSD0ke19BUFBfR1JBUEhRTF9NQVhfREVQVEg6LTN9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQVBQX05BTUU9JHtfQVBQX1ZDU19HSVRIVUJfQVBQX05BTUV9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfUFJJVkFURV9LRVk9JHtfQVBQX1ZDU19HSVRIVUJfUFJJVkFURV9LRVl9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQVBQX0lEPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEhVQl9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0VORFBPSU5UPSR7X0FQUF9WQ1NfR0lURUFfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9CUk9XU0VSX0VORFBPSU5UPSR7X0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0NMSUVOVF9JRD0ke19BUFBfVkNTX0dJVEVBX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRFQV9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVExBQl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0dJVExBQl9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfSUQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0JJVEJVQ0tFVF9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9DTElFTlRfSUQ9JHtfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfT1JJR0lOX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfT1JJR0lOX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfV0VCSE9PS19VUkw9JHtfQVBQX1ZDU19XRUJIT09LX1VSTH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfSUQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9DT1VOVFJJRVNfREVOWUxJU1Q9JHtfQVBQX0NPTlNPTEVfQ09VTlRSSUVTX0RFTllMSVNUfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfTkFNRVNQQUNFPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfTkFNRVNQQUNFfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfQ1JFQVRJT05fQUJVU0VfTElNSVQ9JHtfQVBQX0ZVTkNUSU9OU19DUkVBVElPTl9BQlVTRV9MSU1JVH0nCiAgICAgIC0gJ19BUFBfQ1VTVE9NX0RPTUFJTl9ERU5ZX0xJU1Q9JHtfQVBQX0NVU1RPTV9ET01BSU5fREVOWV9MSVNUOi1leGFtcGxlLmNvbSx0ZXN0LmNvbSxhcHAuZXhhbXBsZS5jb219JwogICAgICAtICdfQVBQX1RSVVNURURfSEVBREVSUz0ke19BUFBfVFJVU1RFRF9IRUFERVJTOi14LWZvcndhcmRlZC1mb3J9JwogICAgICAtICdfQVBQX1RSVVNURURfUFJPWElFUz0ke19BUFBfVFJVU1RFRF9QUk9YSUVTOi0xMjcuMC4wLjEsOjoxLDEwLjAuMC4wLzgsMTAwLjY0LjAuMC8xMCwxNzIuMTYuMC4wLzEyLDE5Mi4xNjguMC4wLzE2fScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05fSE9TVD0ke19BUFBfTUlHUkFUSU9OX0hPU1Q6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0dFT19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfR0VPCiAgICAgIC0gJ19BUFBfR0VPX0VORFBPSU5UPSR7X0FQUF9HRU9fRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZS1nZW8vdjF9JwogICAgICAtICdfQVBQX1BXTkVEX1BBU1NXT1JEU19EU049JHtfQVBQX1BXTkVEX1BBU1NXT1JEU19EU046LW5vbmU6Ly9sb2NhbGhvc3R9JwogICAgICAtICdfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIPSR7X0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSDotMTAwfScKICAgICAgLSAnX0FQUF9ET0NVTUVOVFNEQj0ke19BUFBfRE9DVU1FTlRTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9WRUNUT1JTREI9JHtfQVBQX1ZFQ1RPUlNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0VNQkVERElORz0ke19BUFBfRU1CRURESU5HOi1kaXNhYmxlZH0nCiAgICB2b2x1bWVzOgogICAgICAtICdhcHB3cml0ZS11cGxvYWRzOi9zdG9yYWdlL3VwbG9hZHM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWltcG9ydHM6L3N0b3JhZ2UvaW1wb3J0czpydycKICAgICAgLSAnYXBwd3JpdGUtY2FjaGU6L3N0b3JhZ2UvY2FjaGU6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNvbmZpZzovc3RvcmFnZS9jb25maWc6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNlcnRpZmljYXRlczovc3RvcmFnZS9jZXJ0aWZpY2F0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWZ1bmN0aW9uczovc3RvcmFnZS9mdW5jdGlvbnM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLXNpdGVzOi9zdG9yYWdlL3NpdGVzOnJ3JwogICAgICAtICdhcHB3cml0ZS1idWlsZHM6L3N0b3JhZ2UvYnVpbGRzOnJ3JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1jbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLWdlbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mc1MgLW8gL2Rldi9udWxsIGh0dHA6Ly9sb2NhbGhvc3QvdjEvaGVhbHRoL3ZlcnNpb24gfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDYKICAgICAgc3RhcnRfcGVyaW9kOiAxMjBzCiAgYXBwd3JpdGUtY29uc29sZToKICAgIGltYWdlOiAnYXBwd3JpdGUvbmV3OjEuMi43NC1zZWxmLWhvc3RlZCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0FQUFdSSVRFXzMwMDA9LwogICAgICAtIFZJVEVfQ09OU09MRV9QUk9GSUxFPXNlbGYtaG9zdGVkCiAgICAgIC0gVklURV9BUFBXUklURV9WRVJTSU9OPTIuNS4wCiAgICAgIC0gQVBQV1JJVEVfRU5EUE9JTlRfU0FNRV9PUklHSU49dHJ1ZQogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGU6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnYnVuIC1lICJmZXRjaCgnJ2h0dHA6Ly9sb2NhbGhvc3Q6MzAwMCcnKS50aGVuKHIgPT4gcHJvY2Vzcy5leGl0KHIuc3RhdHVzIDwgNTAwID8gMCA6IDEpKS5jYXRjaCgoKSA9PiBwcm9jZXNzLmV4aXQoMSkpIicKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtcmVhbHRpbWU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuNS4wJwogICAgZW50cnlwb2ludDogcmVhbHRpbWUKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0FQUFdSSVRFPS92MS9yZWFsdGltZQogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9XT1JLRVJfUEVSX0NPUkU9JHtfQVBQX1dPUktFUl9QRVJfQ09SRTotNn0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTj0ke19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfSE9TVE5BTUVTPSR7X0FQUF9DT05TT0xFX0hPU1ROQU1FU30nCiAgICAgIC0gJ19BUFBfUkVBTFRJTUVfVEFJTF9SQVRFPSR7X0FQUF9SRUFMVElNRV9UQUlMX1JBVEU6LTUwfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9IRUFERVJTPSR7X0FQUF9UUlVTVEVEX0hFQURFUlM6LXgtZm9yd2FyZGVkLWZvcn0nCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9QUk9YSUVTPSR7X0FQUF9UUlVTVEVEX1BST1hJRVM6LTEyNy4wLjAuMSw6OjEsMTAuMC4wLjAvOCwxMDAuNjQuMC4wLzEwLDE3Mi4xNi4wLjAvMTIsMTkyLjE2OC4wLjAvMTZ9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIPSR7X0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSDotMTAwfScKICAgICAgLSAnX0FQUF9ET0NVTUVOVFNEQj0ke19BUFBfRE9DVU1FTlRTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9WRUNUT1JTREI9JHtfQVBQX1ZFQ1RPUlNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0VNQkVERElORz0ke19BUFBfRU1CRURESU5HOi1kaXNhYmxlZH0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXMgbG9jYWxob3N0ID4gL2Rldi9udWxsIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtd29ya2VyOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IHdvcmtlcgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX0ROU19FWFRFUk5BTD0ke19BUFBfRE5TX0VYVEVSTkFMfScKICAgICAgLSAnX0FQUF9BTExPV0VEX0lOVEVSTkFMX0FERFJFU1NFUz0ke19BUFBfQUxMT1dFRF9JTlRFUk5BTF9BRERSRVNTRVN9JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSBfQVBQX1dPUktFUlNfTlVNPTEKICAgICAgLSBfQVBQX1dPUktFUl9NQVhfQ09ST1VUSU5FUz03OAogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfRU1BSUxfU0VDVVJJVFk9JHtfQVBQX0VNQUlMX1NFQ1VSSVRZOi1zZWN1cml0eUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfRU1BSUxfQ0VSVElGSUNBVEVTPSR7X0FQUF9FTUFJTF9DRVJUSUZJQ0FURVN9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQj0ke19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1RfVkVDVE9SU0RCPSR7X0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQjotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9WRUNUT1JTREI9JHtfQVBQX0RCX1BPUlRfVkVDVE9SU0RCOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCPSR7X0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSX1ZFQ1RPUlNEQj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTX1ZFQ1RPUlNEQj0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI6LW1vbmdvZGJ9JwogICAgICAtICdfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI6LTI3MDE3fScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUEFTU19ET0NVTUVOVFNEQj0ke19BUFBfREJfUEFTU19ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQn0nCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1FVRVVFX05BTUU9JHtfQVBQX1FVRVVFX05BTUV9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfVVJMPSR7X0FQUF9DT05TT0xFX1VSTH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9ET01BSU49JHtfQVBQX0NPTlNPTEVfRE9NQUlOfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFM9JHtfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfV0VCSE9PS19NQVhfRkFJTEVEX0FUVEVNUFRTPSR7X0FQUF9XRUJIT09LX01BWF9GQUlMRURfQVRURU1QVFM6LTEwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RFVklDRT0ke19BUFBfU1RPUkFHRV9ERVZJQ0U6LWxvY2FsfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfUzNfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9SRUdJT049JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTjotdXMtd2VzdC0wMDR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT046LWV1LWNlbnRyYWwtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9SRUdJT049JHtfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVH0nCiAgICAgIC0gX0FQUF9FWEVDVVRPUl9TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfRVhFQ1VUT1IKICAgICAgLSAnX0FQUF9FWEVDVVRPUl9IT1NUPSR7X0FQUF9FWEVDVVRPUl9IT1NUOi1odHRwOi8vb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yL3YxfScKICAgICAgLSAnX0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FPSR7X0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FfScKICAgICAgLSAnX0FQUF9ET0NLRVJfSFVCX1BBU1NXT1JEPSR7X0FQUF9ET0NLRVJfSFVCX1BBU1NXT1JEfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfVElNRU9VVD0ke19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfU0lURVNfVElNRU9VVD0ke19BUFBfU0lURVNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVDotMjcwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9DUFVTPSR7X0FQUF9DT01QVVRFX0NQVVM6LTB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfTUVNT1JZPSR7X0FQUF9DT01QVVRFX01FTU9SWTotMH0nCiAgICAgIC0gJ19BUFBfT1BFTl9SVU5USU1FU19ORlQ9JHtfQVBQX09QRU5fUlVOVElNRVNfTkZUOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9DT01QVVRFX1NJWkVfTElNSVQ9JHtfQVBQX0NPTVBVVEVfU0laRV9MSU1JVDotMzAwMDAwMDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQlVJTERfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9CVUlMRF9TSVpFX0xJTUlUOi0yMDAwMDAwMDAwfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9JRD0ke19BUFBfVkNTX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX1dFQkhPT0tfVVJMPSR7X0FQUF9WQ1NfV0VCSE9PS19VUkx9JwogICAgICAtICdfQVBQX0JVSUxEU19WT0xVTUU9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX1fYXBwd3JpdGUtYnVpbGRzJwogICAgICAtICdfQVBQX0pPQlNfSE9TVD0ke19BUFBfSk9CU19IT1NUOi1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODB9JwogICAgICAtIF9BUFBfSk9CU19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfSk9CUwogICAgICAtICdfQVBQX0pPQlNfRU5EUE9JTlQ9JHtfQVBQX0pPQlNfRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfQlJPV1NFUl9IT1NUPSR7X0FQUF9CUk9XU0VSX0hPU1Q6LWh0dHA6Ly9hcHB3cml0ZS1icm93c2VyOjMwMDAvdjF9JwogICAgICAtICdfQVBQX1dPUktFUl9TQ1JFRU5TSE9UU19ST1VURVI9JHtfQVBQX1dPUktFUl9TQ1JFRU5TSE9UU19ST1VURVI6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9OT1RJRklDQVRJT05TX1RSQUNLSU5HX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9OT1RJRklDQVRJT05TCiAgICAgIC0gJ19BUFBfU1lTVEVNX0VNQUlMX05BTUU9JHtfQVBQX1NZU1RFTV9FTUFJTF9OQU1FOi1BcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfU1lTVEVNX0VNQUlMX0FERFJFU1M9JHtfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTOi1ub3JlcGx5QGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9TTVRQX0hPU1Q9JHtfQVBQX1NNVFBfSE9TVH0nCiAgICAgIC0gJ19BUFBfU01UUF9QT1JUPSR7X0FQUF9TTVRQX1BPUlR9JwogICAgICAtICdfQVBQX1NNVFBfU0VDVVJFPSR7X0FQUF9TTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ19BUFBfU01UUF9VU0VSTkFNRT0ke19BUFBfU01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ19BUFBfU01UUF9QQVNTV09SRD0ke19BUFBfU01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ19BUFBfU01TX0ZST009JHtfQVBQX1NNU19GUk9NfScKICAgICAgLSAnX0FQUF9TTVNfUFJPVklERVI9JHtfQVBQX1NNU19QUk9WSURFUn0nCiAgICAgIC0gJ19BUFBfU01TX1BST0pFQ1RTX0RFTllfTElTVD0ke19BUFBfU01TX1BST0pFQ1RTX0RFTllfTElTVH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfSUQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OX0hPU1Q9JHtfQVBQX01JR1JBVElPTl9IT1NUOi1hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g9JHtfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIOi0xMDB9JwogICAgICAtICdfQVBQX0RPQ1VNRU5UU0RCPSR7X0FQUF9ET0NVTUVOVFNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1ZFQ1RPUlNEQj0ke19BUFBfVkVDVE9SU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfRU1CRURESU5HPSR7X0FQUF9FTUJFRERJTkc6LWRpc2FibGVkfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXVwbG9hZHM6L3N0b3JhZ2UvdXBsb2FkczpydycKICAgICAgLSAnYXBwd3JpdGUtaW1wb3J0czovc3RvcmFnZS9pbXBvcnRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1jYWNoZTovc3RvcmFnZS9jYWNoZTpydycKICAgICAgLSAnYXBwd3JpdGUtY29uZmlnOi9zdG9yYWdlL2NvbmZpZzpydycKICAgICAgLSAnYXBwd3JpdGUtY2VydGlmaWNhdGVzOi9zdG9yYWdlL2NlcnRpZmljYXRlczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWJ1aWxkczovc3RvcmFnZS9idWlsZHM6cncnCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9yY2hlc3RyYXRvcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLXNjaGVkdWxlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi41LjAnCiAgICBlbnRyeXBvaW50OiBzY2hlZHVsZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gX0FQUF9XT1JLRVJfTUFYX0NPUk9VVElORVM9OAogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0RPTUFJTj0ke19BUFBfQ09OU09MRV9ET01BSU59JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05fSE9TVD0ke19BUFBfTUlHUkFUSU9OX0hPU1Q6LWFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ9JHtfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ6LTB9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLW1haW50ZW5hbmNlOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IG1haW50ZW5hbmNlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRURJVElPTj0ke19BUFBfRURJVElPTjotc2VsZi1ob3N0ZWR9JwogICAgICAtICdfQVBQX1JPVVRFUl9BVVRPX0NFUlRJRklDQVRFUz0ke19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTOi1kaXNhYmxlZH0nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTj0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTjotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU6LTI1OTIwMDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUz0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUzotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1NUQVJUX1RJTUU9JHtfQVBQX01BSU5URU5BTkNFX1NUQVJUX1RJTUV9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLWludGVydmFsOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IGludGVydmFsCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1NJVEVTPSR7X0FQUF9ET01BSU5fU0lURVM6LXNpdGVzLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtIF9BUFBfT1BFTlNTTF9LRVlfVjE9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfQVBQV1JJVEUKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0lOVEVSVkFMX0RPTUFJTl9WRVJJRklDQVRJT049JHtfQVBQX0lOVEVSVkFMX0RPTUFJTl9WRVJJRklDQVRJT046LTEyMH0nCiAgICAgIC0gJ19BUFBfSU5URVJWQUxfQ0xFQU5VUF9TVEFMRV9FWEVDVVRJT05TPSR7X0FQUF9JTlRFUlZBTF9DTEVBTlVQX1NUQUxFX0VYRUNVVElPTlM6LTMwMH0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgLXEgJ1twXWhwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIGFwcHdyaXRlLWdlbzoKICAgIGltYWdlOiAnYXBwd3JpdGUvZ2VvOjAuMy4yJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gR0VPX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9HRU8KICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAicGhwIC1yIFwiZXhpdChqc29uX2RlY29kZShmaWxlX2dldF9jb250ZW50cygnaHR0cDovL2xvY2FsaG9zdC92MS9oZWFsdGgnKSktPnN0YXR1cyA9PT0gJ29rJyA/IDAgOiAxKTtcIiIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgYXBwd3JpdGUtYnJvd3NlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYnJvd3NlcjowLjMuNicKICAgIGVudmlyb25tZW50OgogICAgICAtIEFMTE9XRURfSE9TVFM9YXBwd3JpdGUKICAgIGRuczoKICAgICAgLSAxLjEuMS4xCiAgICAgIC0gOC44LjguOAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yOgogICAgaW1hZ2U6ICdvcGVucnVudGltZXMvZXhlY3V0b3I6MS4xLjInCiAgICBob3N0bmFtZTogb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yCiAgICBzdG9wX3NpZ25hbDogU0lHSU5UCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnT1BSX0VYRUNVVE9SX0lNQUdFUz0ke19BUFBfRVhFQ1VUT1JfSU1BR0VTOi1vcGVucnVudGltZXMvbm9kZTp2NS0yMixvcGVucnVudGltZXMvc3RhdGljOnY1LTF9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfSU5BQ1RJVkVfVEhSRVNIT0xEPSR7X0FQUF9DT01QVVRFX0lOQUNUSVZFX1RIUkVTSE9MRDotNjAwfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX01BSU5URU5BTkNFX0lOVEVSVkFMPSR7X0FQUF9DT01QVVRFX01BSU5URU5BTkNFX0lOVEVSVkFMOi02MDB9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfTkVUV09SSz0ke19BUFBfQ09NUFVURV9SVU5USU1FU19ORVRXT1JLOi1ydW50aW1lc30nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9ET0NLRVJfSFVCX1VTRVJOQU1FPSR7X0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0RPQ0tFUl9IVUJfUEFTU1dPUkQ9JHtfQVBQX0RPQ0tFUl9IVUJfUEFTU1dPUkR9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdPUFJfRVhFQ1VUT1JfUlVOVElNRVM9JHtfQVBQX0ZVTkNUSU9OU19SVU5USU1FUzotbm9kZS0yMn0sJHtfQVBQX1NJVEVTX1JVTlRJTUVTOi1zdGF0aWMtMSxub2RlLTIyfScKICAgICAgLSBPUFJfRVhFQ1VUT1JfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0VYRUNVVE9SCiAgICAgIC0gT1BSX0VYRUNVVE9SX1JVTlRJTUVfVkVSU0lPTlM9djUKICAgICAgLSAnT1BFTl9SVU5USU1FU19ORlQ9JHtfQVBQX09QRU5fUlVOVElNRVNfTkZUOi1lbmFibGVkfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9DT05ORUNUSU9OX1NUT1JBR0U9JHtfQVBQX0VYRUNVVE9SX0NPTk5FQ1RJT05fU1RPUkFHRTotbG9jYWw6Ly9sb2NhbGhvc3R9JwogICAgICAtIE9QUl9FWEVDVVRPUl9DT05ORUNUSU9OX0JVSUxEX0NBQ0hFX1NUT1JBR0U9CiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnYXBwd3JpdGUtYnVpbGRzOi9zdG9yYWdlL2J1aWxkczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJy90bXA6L3RtcDpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIC1IICJBdXRob3JpemF0aW9uOiBCZWFyZXIgJCRPUFJfRVhFQ1VUT1JfU0VDUkVUIiBodHRwOi8vbG9jYWxob3N0L3YxL2hlYWx0aCA+IC9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG9yY2hlc3RyYXRvcjoKICAgIGltYWdlOiAnZ2hjci5pby9vcGVuLXJ1bnRpbWVzL29yY2hlc3RyYXRvci9vcmNoZXN0cmF0b3I6Mi4yLjInCiAgICBob3N0bmFtZTogb3JjaGVzdHJhdG9yCiAgICB1c2VyOiByb290CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBPUkNIRVNUUkFUT1JfQkFDS0VORD1kb2NrZXIKICAgICAgLSAnT1JDSEVTVFJBVE9SX05FVFdPUks9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX0nCiAgICAgIC0gJ0RPQ0tFUl9ORVRXT1JLPSR7Q09NUE9TRV9QUk9KRUNUX05BTUV9JwogICAgICAtICdBUlRJRkFDVF9FTkRQT0lOVD1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODAnCiAgICAgIC0gJ1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnUzNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnUzNfQUNDRVNTX0tFWV9JRD0ke19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZfScKICAgICAgLSAnUzNfU0VDUkVUX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9rby1hcHAvb3JjaGVzdHJhdG9yCiAgICAgICAgLSAnLWNoZWNrLXJlYWR5JwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9wb3N0Z3JlczowLjEuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXBvc3RncmVzcWw6L3Zhci9saWIvcG9zdGdyZXNxbDpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTAKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBhcHB3cml0ZS1yZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LjctYWxwaW5lJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLW1heG1lbW9yeSA1MTJtYiAtLW1heG1lbW9yeS1wb2xpY3kgYWxsa2V5cy1scnUgLS1tYXhtZW1vcnktc2FtcGxlcyA1JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtcmVkaXM6L2RhdGE6cncnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUKICBhcHB3cml0ZS1jbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI2LjQuMy1hbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBDTElDS0hPVVNFX0RCPWFwcHdyaXRlCiAgICAgIC0gQ0xJQ0tIT1VTRV9VU0VSPWFwcHdyaXRlCiAgICAgIC0gQ0xJQ0tIT1VTRV9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gQ0xJQ0tIT1VTRV9ERUZBVUxUX0FDQ0VTU19NQU5BR0VNRU5UPTEKICAgICAgLSBDTElDS0hPVVNFX0FMV0FZU19SVU5fSU5JVERCX1NDUklQVFM9MQogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtY2xpY2tob3VzZTovdmFyL2xpYi9jbGlja2hvdXNlOnJ3JwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlLWNvbmZpZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvYXBwd3JpdGUueG1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogIjw/eG1sIHZlcnNpb249XCIxLjBcIj8+XG48IS0tXG4gICAgUmV0ZW50aW9uIGZvciBDbGlja0hvdXNlJ3Mgb3duIHN5c3RlbSBsb2cgdGFibGVzLlxuXG4gICAgRXZlcnkgPHR0bD4gaW4gdGhlIGltYWdlJ3MgY29uZmlnLnhtbCBzaXRzIGluc2lkZSBhbiBYTUwgY29tbWVudCwgc28gdGhlc2VcbiAgICB0YWJsZXMga2VlcCBldmVyeSByb3cgZm9yZXZlciwgYW5kIHRoZSBtZXRyaWMgb25lcyBhZGQgYSByb3cgcGVyIHNlY29uZFxuICAgIHdoZXRoZXIgb3Igbm90IHRoZSBpbnN0YW5jZSBzZXJ2ZXMgdHJhZmZpYy4gTGVmdCBhbG9uZSB0aGV5IG91dGdyb3cgdGhlXG4gICAgdXNhZ2UgZGF0YSB0aGV5IHNpdCBuZXh0IHRvIGFuZCBmaWxsIHRoZSB2b2x1bWUuXG5cbiAgICBXaGVuIGEgd2luZG93IGhlcmUgY2hhbmdlcywgQ2xpY2tIb3VzZSByZXBsYWNlcyB0aGUgdGFibGUgb24gdGhlIG5leHRcbiAgICByZXN0YXJ0IGFuZCBrZWVwcyB0aGUgb2xkIG9uZSwgcm93cyBhbmQgYWxsLCBhcyA8bG9nPl88Tj4uXG4gICAgY2xpY2tob3VzZS1pbml0LnNoIGdpdmVzIHRob3NlIG9sZCB0YWJsZXMgdGhlIHNhbWUgd2luZG93LlxuLS0+XG48Y2xpY2tob3VzZT5cbiAgICA8IS0tIFRoZSBtZXRyaWMsIHRyYWNlIGFuZCBwcm9maWxlIGxvZ3Mgc2FtcGxlIHRoZSBzZXJ2ZXIgZXZlcnkgc2Vjb25kIHdoZXRoZXJcbiAgICAgICAgIG9yIG5vdCBBcHB3cml0ZSBzZXJ2ZXMgdHJhZmZpYywgYW5kIG5vdGhpbmcgcmVhZHMgdGhlbSBiYWNrLCBzbyB0aGVpclxuICAgICAgICAgd3JpdGVzIGFuZCB0aGUgbWVyZ2VzIGJlaGluZCB0aGVtIGFyZSBwdXJlIG92ZXJoZWFkLiAtLT5cbiAgICA8YXN5bmNocm9ub3VzX21ldHJpY19sb2cgcmVtb3ZlPVwiMVwiLz5cbiAgICA8bWV0cmljX2xvZyByZW1vdmU9XCIxXCIvPlxuICAgIDxoaXN0b2dyYW1fbWV0cmljX2xvZyByZW1vdmU9XCIxXCIvPlxuICAgIDxxdWVyeV9tZXRyaWNfbG9nIHJlbW92ZT1cIjFcIi8+XG4gICAgPHByb2Nlc3NvcnNfcHJvZmlsZV9sb2cgcmVtb3ZlPVwiMVwiLz5cbiAgICA8dHJhY2VfbG9nIHJlbW92ZT1cIjFcIi8+XG4gICAgPCEtLSB0ZXh0X2xvZyByZXBlYXRzIHRoZSBzZXJ2ZXIgbG9nIHRoZSBjb250YWluZXIgYWxyZWFkeSB3cml0ZXMuIC0tPlxuICAgIDx0ZXh0X2xvZyByZW1vdmU9XCIxXCIvPlxuXG4gICAgPCEtLSBLZXB0IGZvciBkZWJ1Z2dpbmcsIGNhcHBlZCBzbyB0aGV5IGNhbm5vdCBmaWxsIHRoZSB2b2x1bWUuIC0tPlxuICAgIDxhc3luY2hyb25vdXNfaW5zZXJ0X2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAzIERBWSBERUxFVEU8L3R0bD48L2FzeW5jaHJvbm91c19pbnNlcnRfbG9nPlxuICAgIDxxdWVyeV9sb2c+PHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgNyBEQVkgREVMRVRFPC90dGw+PC9xdWVyeV9sb2c+XG4gICAgPHF1ZXJ5X3ZpZXdzX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEU8L3R0bD48L3F1ZXJ5X3ZpZXdzX2xvZz5cbiAgICA8cXVlcnlfdGhyZWFkX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEU8L3R0bD48L3F1ZXJ5X3RocmVhZF9sb2c+XG4gICAgPHBhcnRfbG9nPjx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDcgREFZIERFTEVURTwvdHRsPjwvcGFydF9sb2c+XG4gICAgPGJhY2tncm91bmRfc2NoZWR1bGVfcG9vbF9sb2c+PHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgNyBEQVkgREVMRVRFPC90dGw+PC9iYWNrZ3JvdW5kX3NjaGVkdWxlX3Bvb2xfbG9nPlxuXG4gICAgPCEtLSBMb25nZXIsIHNvIGl0IHN0aWxsIGNvdmVycyBhIHJlcG9ydCB0aGF0IHJlYWNoZXMgdXMgbGF0ZS4gY3Jhc2hfbG9nIGlzXG4gICAgICAgICBkZWxpYmVyYXRlbHkgbGVmdCBhbG9uZTogaXQgaXMgdGlueSBhbmQgd29ydGgga2VlcGluZy4gLS0+XG4gICAgPGVycm9yX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxNCBEQVkgREVMRVRFPC90dGw+PC9lcnJvcl9sb2c+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2UtaW5pdC5zaAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2NsaWNraG91c2UtaW5pdC5zaAogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICIjIS9iaW4vYmFzaFxuIyBUaGUgQ2xpY2tIb3VzZSBlbnRyeXBvaW50IHNvdXJjZXMgdGhpcyBmaWxlLCBzbyBhIHN1YnNoZWxsIGtlZXBzIHRoZXNlIG9wdGlvbnMgb3V0IG9mIGl0LlxuKFxuICBzZXQgLWV1byBwaXBlZmFpbFxuXG4gIGNsaWVudCgpIHtcbiAgICBjbGlja2hvdXNlLWNsaWVudCAtLWhvc3QgMTI3LjAuMC4xIC0tdXNlciBcIiRDTElDS0hPVVNFX1VTRVJcIiAtLXBhc3N3b3JkIFwiJENMSUNLSE9VU0VfUEFTU1dPUkRcIiBcIiRAXCJcbiAgfVxuXG4gICMgRmx1c2hpbmcgcmVwbGFjZXMgbG9nIHRhYmxlcyB3aG9zZSBkZWZpbml0aW9uIGNoYW5nZWQsIGtlZXBpbmcgZWFjaCBvbGQgdGFibGUgYXMgPGxvZz5fPE4+LlxuICBjbGllbnQgLS1xdWVyeSAnU1lTVEVNIEZMVVNIIExPR1MnXG5cbiAgIyBUYWJsZXMgbGVmdCBiZWhpbmQgbmV2ZXIgZXhwaXJlIG9uIHRoZWlyIG93bjogdGFrZSB0aGUgVFRMIG9mIHRoZSBsb2cgdGhhdFxuICAjIHJlcGxhY2VkIHRoaXMgb25lLCBvciBhIHdlZWsgd2hlbiB0aGUgbG9nIGlzIG5vIGxvbmdlciB3cml0dGVuIGF0IGFsbC5cbiAgIyBUaGUgbmFtZWQgbG9ncyBtdXN0IG1hdGNoIHRoZSBvbmVzIGNsaWNraG91c2UtY29uZmlnLnhtbCByZW1vdmVzOiBhIGxvZyB0aGF0XG4gICMgaXMgc3RpbGwgd3JpdHRlbiBnZXRzIHJlcGxhY2VkIG9uIHRoZSBuZXh0IHJlc3RhcnQgaWYgaXRzIFRUTCBpcyBhbHRlcmVkIGhlcmUuXG4gIGNsaWVudCAtLWZvcm1hdCBUU1ZSYXcgPDwnU1FMJyB8IGNsaWVudCAtLW11bHRpcXVlcnlcblNFTEVDVCBjb25jYXQoJ0FMVEVSIFRBQkxFIHN5c3RlbS4nLCBzdGFsZS5uYW1lLCAnIE1PRElGWSBUVEwgJywgaWYoYWN0aXZlLm5hbWUgPSAnJywgJ2V2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEUnLCBzcGxpdEJ5U3RyaW5nKCcgU0VUVElOR1MgJywgc3BsaXRCeVN0cmluZygnIFRUTCAnLCBhY3RpdmUuZW5naW5lX2Z1bGwpWzJdKVsxXSksICc7JylcbkZST00gKFxuICBTRUxFQ1QgbmFtZSwgc3BsaXRCeUNoYXIoJ18nLCBuYW1lKVstMV0gQVMgc3VmZml4LCBhcnJheVN0cmluZ0NvbmNhdChhcnJheVBvcEJhY2soc3BsaXRCeUNoYXIoJ18nLCBuYW1lKSksICdfJykgQVMgbG9nXG4gIEZST00gc3lzdGVtLnRhYmxlc1xuICBXSEVSRSBkYXRhYmFzZSA9ICdzeXN0ZW0nXG4gICAgQU5EIHBvc2l0aW9uKGVuZ2luZV9mdWxsLCAnIFRUTCAnKSA9IDBcbiAgICBBTkQgZW5kc1dpdGgoZW5naW5lLCAnTWVyZ2VUcmVlJylcbiAgICBBTkQgbmFtZSBJTiAoU0VMRUNUIHRhYmxlIEZST00gc3lzdGVtLmNvbHVtbnMgV0hFUkUgZGF0YWJhc2UgPSAnc3lzdGVtJyBBTkQgbmFtZSA9ICdldmVudF9kYXRlJyBBTkQgdHlwZSA9ICdEYXRlJylcbikgQVMgc3RhbGVcbkxFRlQgSk9JTiBzeXN0ZW0udGFibGVzIEFTIGFjdGl2ZVxuICBPTiBhY3RpdmUuZGF0YWJhc2UgPSAnc3lzdGVtJ1xuICBBTkQgYWN0aXZlLm5hbWUgPSBzdGFsZS5sb2dcbiAgQU5EIHBvc2l0aW9uKGFjdGl2ZS5lbmdpbmVfZnVsbCwgJyBUVEwgJykgPiAwXG5XSEVSRSAoZW5kc1dpdGgoc3RhbGUubG9nLCAnX2xvZycpIEFORCB0b1VJbnQ2NE9yTnVsbChzdGFsZS5zdWZmaXgpIElTIE5PVCBOVUxMKVxuICBPUiBzdGFsZS5uYW1lIElOICgnYXN5bmNocm9ub3VzX21ldHJpY19sb2cnLCAnbWV0cmljX2xvZycsICdoaXN0b2dyYW1fbWV0cmljX2xvZycsICdxdWVyeV9tZXRyaWNfbG9nJywgJ3Byb2Nlc3NvcnNfcHJvZmlsZV9sb2cnLCAndHJhY2VfbG9nJywgJ3RleHRfbG9nJylcblNRTFxuKSIKICAgIHVsaW1pdHM6CiAgICAgIG5vZmlsZToKICAgICAgICBzb2Z0OiAyNjIxNDQKICAgICAgICBoYXJkOiAyNjIxNDQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY2xpY2tob3VzZS1jbGllbnQgLS11c2VyICIkJENMSUNLSE9VU0VfVVNFUiIgLS1wYXNzd29yZCAiJCRDTElDS0hPVVNFX1BBU1NXT1JEIiAtLXF1ZXJ5ICJTRUxFQ1QgMSIgPiAvZGV2L251bGwgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDIwCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCg==",
-        "tags": [
-            "backend",
-            "backend-as-a-service",
-            "platform"
-        ],
-        "category": "backend",
-        "logo": "svgs/appwrite.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-08T19:41:04+02:00",
-        "port": "80"
-    },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
         "slogan": "Argilla is a collaboration tool for AI engineers and domain experts who need to build high-quality datasets for their projects.",
@@ -254,23 +239,6 @@
         "template_last_updated_at": "2026-09-27T23:49:51+02:00",
         "port": "80"
     },
-    "babybuddy": {
-        "documentation": "https://docs.baby-buddy.net?utm_source=coolify.io",
-        "slogan": "It helps parents track their baby's daily activities, growth, and health with ease.",
-        "compose": "c2VydmljZXM6CiAgYmFieWJ1ZGR5OgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL2JhYnlidWRkeTpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9CQUJZQlVERFkKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSBUWj1FdXJvcGUvTWFkcmlkCiAgICAgIC0gQ1NSRl9UUlVTVEVEX09SSUdJTlM9JFNFUlZJQ0VfVVJMX0JBQllCVUREWQogICAgdm9sdW1lczoKICAgICAgLSAnYmFieWJ1ZGR5LWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
-        "tags": [
-            "baby",
-            "parents",
-            "health",
-            "growth",
-            "activities"
-        ],
-        "category": "productivity",
-        "logo": "svgs/babybuddy.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "8000"
-    },
     "bento-pdf": {
         "documentation": "https://bentopdf.com/docs?utm_source=coolify.io",
         "slogan": "Process PDFs entirely in your browser. No uploads. No servers. Complete privacy.",
@@ -350,26 +318,6 @@
         "template_last_updated_at": "2026-05-09T19:19:48+05:30",
         "port": "3000"
     },
-    "bookstack": {
-        "documentation": "https://www.bookstackapp.com/docs/?utm_source=coolify.io",
-        "slogan": "BookStack is a simple, self-hosted, easy-to-use platform for organising and storing information",
-        "compose": "c2VydmljZXM6CiAgYm9va3N0YWNrOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL2Jvb2tzdGFjazpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9CT09LU1RBQ0tfODAKICAgICAgLSAnQVBQX1VSTD0ke1NFUlZJQ0VfVVJMX0JPT0tTVEFDS30nCiAgICAgIC0gJ0FQUF9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX0FQUEtFWX0nCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9CZXJsaW59JwogICAgICAtIERCX0hPU1Q9bWFyaWFkYgogICAgICAtIERCX1BPUlQ9MzMwNgogICAgICAtICdEQl9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ0RCX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWJvb2tzdGFja2FwcH0nCiAgICAgIC0gJ1FVRVVFX0NPTk5FQ1RJT049JHtRVUVVRV9DT05ORUNUSU9OfScKICAgICAgLSAnR0lUSFVCX0FQUF9JRD0ke0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdHSVRIVUJfQVBQX1NFQ1JFVD0ke0dJVEhVQl9BUFBfU0VDUkVUfScKICAgICAgLSAnTUFJTF9EUklWRVI9JHtNQUlMX0RSSVZFUjotc210cH0nCiAgICAgIC0gJ01BSUxfSE9TVD0ke01BSUxfSE9TVH0nCiAgICAgIC0gJ01BSUxfUE9SVD0ke01BSUxfUE9SVDotNTg3fScKICAgICAgLSAnTUFJTF9FTkNSWVBUSU9OPSR7TUFJTF9FTkNSWVBUSU9OOi10bHN9JwogICAgICAtICdNQUlMX1VTRVJOQU1FPSR7TUFJTF9VU0VSTkFNRX0nCiAgICAgIC0gJ01BSUxfUEFTU1dPUkQ9JHtNQUlMX1BBU1NXT1JEfScKICAgICAgLSAnTUFJTF9GUk9NPSR7TUFJTF9GUk9NfScKICAgICAgLSAnTUFJTF9GUk9NX05BTUU9JHtNQUlMX0ZST01fTkFNRTotQm9va1N0YWNrfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Jvb2tzdGFjay1kYXRhOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLWYgaHR0cDovLzEyNy4wLjAuMTo4MC8nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL21hcmlhZGI6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9CZXJsaW59JwogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTFJPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1ib29rc3RhY2t9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Jvb2tzdGFjay1tYXJpYWRiLWRhdGE6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "free-and-open-source",
-            "mfa",
-            "dark-light-themes",
-            "searchable",
-            "connected",
-            "simple-interface",
-            "diagramms",
-            "notes"
-        ],
-        "category": "cms",
-        "logo": "svgs/bookstack.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "browserless": {
         "documentation": "https://docs.browserless.io/?utm_source=coolify.io",
         "slogan": "A headless Chrome browser as a service.",
@@ -386,21 +334,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "3000"
     },
-    "budge": {
-        "documentation": "https://github.com/linuxserver/budge?utm_source=coolify.io",
-        "slogan": "A budgeting personal finance app.",
-        "compose": "c2VydmljZXM6CiAgYnVkZ2U6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvYnVkZ2U6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQlVER0UKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSBUWj1FdXJvcGUvTWFkcmlkCiAgICB2b2x1bWVzOgogICAgICAtICdidWRnZS1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "personal finance",
-            "budgeting",
-            "expense tracking"
-        ],
-        "category": "finance",
-        "logo": "svgs/budge.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
         "slogan": "Low code platform for building business apps and workflows in minutes. Supports PostgreSQL, MySQL, MSSQL, MongoDB, Rest API, Docker, K8s, and more.",
@@ -421,7 +354,7 @@
         "category": "automation",
         "logo": "svgs/budibase.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-17T10:54:40+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "10000"
     },
     "bugsink": {
@@ -454,7 +387,7 @@
         "category": "Mail",
         "logo": "svgs/bulwark.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-12T17:21:51+02:00",
+        "template_last_updated_at": "2026-10-01T20:31:00+02:00",
         "port": "3000"
     },
     "buzz": {
@@ -474,7 +407,7 @@
         "category": "messaging",
         "logo": "svgs/buzz.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-12T19:27:01+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "calibre-web-automated-book-downloader": {
@@ -555,26 +488,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "5679"
     },
-    "castopod": {
-        "documentation": "https://docs.castopod.org/main/en/?utm_source=coolify.io",
-        "slogan": "Castopod is a free & open-source hosting platform made for podcasters who want engage and interact with their audience.",
-        "compose": "c2VydmljZXM6CiAgY2FzdG9wb2Q6CiAgICBpbWFnZTogJ2Nhc3RvcG9kL2Nhc3RvcG9kOjEuMTUuNCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Nhc3RvcG9kLW1lZGlhOi92YXIvd3d3L2Nhc3RvcG9kL3B1YmxpYy9tZWRpYScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0NBU1RPUE9EXzgwODAKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1jYXN0b3BvZAogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NWVNRTAogICAgICAtIE1ZU1FMX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01ZU1FMCiAgICAgIC0gJ0NQX0RJU0FCTEVfSFRUUFM9JHtDUF9ESVNBQkxFX0hUVFBTOi0xfScKICAgICAgLSBDUF9CQVNFVVJMPSRTRVJWSUNFX1VSTF9DQVNUT1BPRAogICAgICAtIENQX0FOQUxZVElDU19TQUxUPSRTRVJWSUNFX1JFQUxCQVNFNjRfNjRfU0FMVAogICAgICAtIENQX0NBQ0hFX0hBTkRMRVI9cmVkaXMKICAgICAgLSBDUF9SRURJU19IT1NUPXJlZGlzCiAgICAgIC0gQ1BfUkVESVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEuMicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Nhc3RvcG9kLWRiOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTVlTUUxfUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgICAtIE1ZU1FMX0RBVEFCQVNFPWNhc3RvcG9kCiAgICAgIC0gTVlTUUxfVVNFUj0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjItYWxwaW5lJwogICAgY29tbWFuZDogJy0tcmVxdWlyZXBhc3MgJFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMnCiAgICB2b2x1bWVzOgogICAgICAtICdjYXN0b3BvZC1jYWNoZTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncmVkaXMtY2xpIC1hICRTRVJWSUNFX1BBU1NXT1JEX1JFRElTIHBpbmcgfCBncmVwIFBPTkcnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "podcast",
-            "media",
-            "audio",
-            "video",
-            "streaming",
-            "hosting",
-            "platform",
-            "castopod"
-        ],
-        "category": "media",
-        "logo": "svgs/castopod.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-03-13T12:05:06+05:30",
-        "port": "8080"
-    },
     "celld": {
         "documentation": "https://celld.dev/docs?utm_source=coolify.io",
         "slogan": "Self-hosted, distributed Durable Objects powered by Deno.",
@@ -705,54 +618,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "8000"
     },
-    "classicpress-with-mariadb": {
-        "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
-        "slogan": "A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).",
-        "compose": "c2VydmljZXM6CiAgY2xhc3NpY3ByZXNzOgogICAgaW1hZ2U6ICdjbGFzc2ljcHJlc3MvY2xhc3NpY3ByZXNzOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NsYXNzaWNwcmVzcy1maWxlczovdmFyL3d3dy9odG1sJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQ0xBU1NJQ1BSRVNTCiAgICAgIC0gQ0xBU1NJQ1BSRVNTX0RCX0hPU1Q9bWFyaWFkYgogICAgICAtIENMQVNTSUNQUkVTU19EQl9VU0VSPSRTRVJWSUNFX1VTRVJfQ0xBU1NJQ1BSRVNTCiAgICAgIC0gQ0xBU1NJQ1BSRVNTX0RCX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX0NMQVNTSUNQUkVTUwogICAgICAtIENMQVNTSUNQUkVTU19EQl9OQU1FPWNsYXNzaWNwcmVzcwogICAgZGVwZW5kc19vbjoKICAgICAgLSBtYXJpYWRiCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTVlTUUxfUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9ST09UCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9Y2xhc3NpY3ByZXNzCiAgICAgIC0gTVlTUUxfVVNFUj0kU0VSVklDRV9VU0VSX0NMQVNTSUNQUkVTUwogICAgICAtIE1ZU1FMX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX0NMQVNTSUNQUkVTUwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management"
-        ],
-        "category": "cms",
-        "logo": "svgs/classicpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "classicpress-with-mysql": {
-        "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
-        "slogan": "A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).",
-        "compose": "c2VydmljZXM6CiAgY2xhc3NpY3ByZXNzOgogICAgaW1hZ2U6ICdjbGFzc2ljcHJlc3MvY2xhc3NpY3ByZXNzOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NsYXNzaWNwcmVzcy1maWxlczovdmFyL3d3dy9odG1sJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQ0xBU1NJQ1BSRVNTCiAgICAgIC0gQ0xBU1NJQ1BSRVNTX0RCX0hPU1Q9bXlzcWwKICAgICAgLSBDTEFTU0lDUFJFU1NfREJfVVNFUj0kU0VSVklDRV9VU0VSX0NMQVNTSUNQUkVTUwogICAgICAtIENMQVNTSUNQUkVTU19EQl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DTEFTU0lDUFJFU1MKICAgICAgLSBDTEFTU0lDUFJFU1NfREJfTkFNRT1jbGFzc2ljcHJlc3MKICAgIGRlcGVuZHNfb246CiAgICAgIC0gbXlzcWwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxMAogIG15c3FsOgogICAgaW1hZ2U6ICdteXNxbDo4JwogICAgdm9sdW1lczoKICAgICAgLSAnbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUk9PVAogICAgICAtIE1ZU1FMX0RBVEFCQVNFPWNsYXNzaWNwcmVzcwogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9DTEFTU0lDUFJFU1MKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DTEFTU0lDUFJFU1MKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management"
-        ],
-        "category": "cms",
-        "logo": "svgs/classicpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "classicpress-without-database": {
-        "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
-        "slogan": "A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).",
-        "compose": "c2VydmljZXM6CiAgY2xhc3NpY3ByZXNzOgogICAgaW1hZ2U6ICdjbGFzc2ljcHJlc3MvY2xhc3NpY3ByZXNzOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NsYXNzaWNwcmVzcy1maWxlczovdmFyL3d3dy9odG1sJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQ0xBU1NJQ1BSRVNTCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management"
-        ],
-        "category": "cms",
-        "logo": "svgs/classicpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "cloudbeaver": {
         "documentation": "https://dbeaver.com/docs/cloudbeaver/?utm_source=coolify.io",
         "slogan": "CloudBeaver is a lightweight web application designed for comprehensive data management.",
@@ -813,23 +678,6 @@
         "template_last_updated_at": "2026-03-03T11:20:40+05:30",
         "port": "5212"
     },
-    "cockpit": {
-        "documentation": "https://getcockpit.com/documentation/?utm_source=coolify.io",
-        "slogan": "Cockpit is a headless content platform that is lightweight, fast and ready for takeoff.",
-        "compose": "c2VydmljZXM6CiAgY29ja3BpdDoKICAgIGltYWdlOiAnY29ja3BpdGhxL2NvY2twaXQ6Y29yZS1sYXRlc3QnCiAgICB2b2x1bWVzOgogICAgICAtICdjb2NrcGl0LWNvbmZpZzovdmFyL3d3dy9odG1sL2NvbmZpZycKICAgICAgLSAnY29ja3BpdC1zcGFjZXM6L3Zhci93d3cvaHRtbC8uc3BhY2VzJwogICAgICAtICdjb2NrcGl0LXN0b3JhZ2U6L3Zhci93d3cvaHRtbC9zdG9yYWdlJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctcScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xL2FwaS9zeXN0ZW0vaGVhbHRoY2hlY2snCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cockpit",
-            "headless",
-            "cms",
-            "database",
-            "nosql"
-        ],
-        "category": "cms",
-        "logo": "svgs/cockpit.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "code-server": {
         "documentation": "https://coder.com/docs/code-server/latest?utm_source=coolify.io",
         "slogan": "Code-Server is a web-based code editor that enables remote coding and collaboration from any device, anywhere.",
@@ -1120,36 +968,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "3000"
     },
-    "dokuwiki": {
-        "documentation": "https://www.dokuwiki.org/?utm_source=coolify.io",
-        "slogan": "A lightweight and easy-to-use wiki platform for creating and managing documentation and knowledge bases.",
-        "compose": "c2VydmljZXM6CiAgZG9rdXdpa2k6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvZG9rdXdpa2k6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfRE9LVVdJS0kKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSBUWj1FdXJvcGUvTWFkcmlkCiAgICB2b2x1bWVzOgogICAgICAtICdkb2t1d2lraS1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "wiki",
-            "documentation",
-            "knowledge",
-            "base"
-        ],
-        "category": "cms",
-        "logo": "svgs/dokuwiki.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "dolibarr": {
-        "documentation": "https://www.dolibarr.org/documentation-home.php?utm_source=coolify.io",
-        "slogan": "Dolibarr is a modern software package to manage your organization's activity (contacts, quotes, invoices, orders, stocks, agenda, hr, expense reports, accountancy, ecm, manufacturing, ...).",
-        "compose": "c2VydmljZXM6CiAgZG9saWJhcnI6CiAgICBpbWFnZTogJ2RvbGliYXJyL2RvbGliYXJyOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0RPTElCQVJSXzgwCiAgICAgIC0gJ1dXV19VU0VSX0lEPSR7V1dXX1VTRVJfSUQ6LTEwMDB9JwogICAgICAtICdXV1dfR1JPVVBfSUQ9JHtXV1dfR1JPVVBfSUQ6LTEwMDB9JwogICAgICAtIERPTElfREJfSE9TVD1tYXJpYWRiCiAgICAgIC0gJ0RPTElfREJfTkFNRT0ke01ZU1FMX0RBVEFCQVNFOi1kb2xpYmFyci1kYn0nCiAgICAgIC0gJ0RPTElfREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ0RPTElfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnRE9MSV9VUkxfUk9PVD0ke1NFUlZJQ0VfVVJMX0RPTElCQVJSfScKICAgICAgLSAnRE9MSV9BRE1JTl9MT0dJTj0ke1NFUlZJQ0VfVVNFUl9ET0xJQkFSUn0nCiAgICAgIC0gJ0RPTElfQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0RPTElCQVJSfScKICAgICAgLSAnRE9MSV9DUk9OPSR7RE9MSV9DUk9OOi0wfScKICAgICAgLSAnRE9MSV9JTklUX0RFTU89JHtET0xJX0lOSVRfREVNTzotMH0nCiAgICAgIC0gJ0RPTElfQ09NUEFOWV9OQU1FPSR7RE9MSV9DT01QQU5ZX05BTUU6LU15QmlnQ29tcGFueX0nCiAgICB2b2x1bWVzOgogICAgICAtICdkb2xpYmFycl9kb2NzOi92YXIvd3d3L2RvY3VtZW50cycKICAgICAgLSAnZG9saWJhcnJfY3VzdG9tOi92YXIvd3d3L2h0bWwvY3VzdG9tJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotZG9saWJhcnItZGJ9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICB2b2x1bWVzOgogICAgICAtICdkb2xpYmFycl9tYXJpYWRiX2RhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "crm",
-            "erp"
-        ],
-        "category": "productivity",
-        "logo": "svgs/dolibarr.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
     "dozzle-with-auth": {
         "documentation": "https://dozzle.dev/?utm_source=coolify.io",
         "slogan": "Dozzle is a simple and lightweight web UI for Docker logs.",
@@ -1199,23 +1017,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "4983"
     },
-    "drupal-with-postgresql": {
-        "documentation": "https://www.drupal.org/about?utm_source=coolify.io",
-        "slogan": "Drupal is a free and open-source web content management system written in PHP and distributed under the GNU General Public License.",
-        "compose": "c2VydmljZXM6CiAgZHJ1cGFsOgogICAgaW1hZ2U6ICdkcnVwYWw6MTAtYXBhY2hlJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfRFJVUEFMCiAgICAgIC0gREJfSE9TVD1wb3N0Z3JlcwogICAgICAtIERCX05BTUU9cG9zdGdyZXMKICAgICAgLSBEQl9VU0VSPXBvc3RncmVzCiAgICAgIC0gREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiB2b2x1bWUKICAgICAgICBzb3VyY2U6IGRydXBhbF9tb2R1bGVzCiAgICAgICAgdGFyZ2V0OiAvdmFyL3d3dy9odG1sL21vZHVsZXMKICAgICAgICBpc19kaXJlY3Rvcnk6IHRydWUKICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogZHJ1cGFsX3Byb2ZpbGVzCiAgICAgICAgdGFyZ2V0OiAvdmFyL3d3dy9odG1sL3Byb2ZpbGVzCiAgICAgICAgaXNfZGlyZWN0b3J5OiB0cnVlCiAgICAgIC0KICAgICAgICB0eXBlOiB2b2x1bWUKICAgICAgICBzb3VyY2U6IGRydXBhbF90aGVtZXMKICAgICAgICB0YXJnZXQ6IC92YXIvd3d3L2h0bWwvdGhlbWVzCiAgICAgICAgaXNfZGlyZWN0b3J5OiB0cnVlCiAgICAgIC0KICAgICAgICB0eXBlOiB2b2x1bWUKICAgICAgICBzb3VyY2U6IGRydXBhbF9zaXRlcwogICAgICAgIHRhcmdldDogL3Zhci93d3cvaHRtbC9zaXRlcwogICAgICAgIGlzX2RpcmVjdG9yeTogdHJ1ZQogICAgZGVwZW5kc19vbjoKICAgICAgLSBwb3N0Z3JlcwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mIGh0dHA6Ly9sb2NhbGhvc3Q6ODAgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiA1CiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfREI9cG9zdGdyZXMKICAgICAgLSBQT1NUR1JFU19VU0VSPXBvc3RncmVzCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMjAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "postgresql"
-        ],
-        "category": "cms",
-        "logo": "svgs/drupal.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "duplicati": {
         "documentation": "https://duplicati.readthedocs.io?utm_source=coolify.io",
         "slogan": "Duplicati is a backup solution, allowing you to make scheduled backups with encryption.",
@@ -1230,21 +1031,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "8200"
     },
-    "easyappointments": {
-        "documentation": "https://easyappointments.org/?utm_source=coolify.io",
-        "slogan": "Schedule Anything. Let's start with easy! Get the best free online appointment scheduler on your server, today.",
-        "compose": "c2VydmljZXM6CiAgZWFzeWFwcG9pbnRtZW50czoKICAgIGltYWdlOiAnYWxleHRzZWxlZ2lkaXMvZWFzeWFwcG9pbnRtZW50czpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9FQVNZQVBQT0lOVE1FTlRTXzgwCiAgICAgIC0gJ0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfRUFTWUFQUE9JTlRNRU5UU30nCiAgICAgIC0gREJfSE9TVD1teXNxbAogICAgICAtIERCX05BTUU9ZWFzeWFwcG9pbnRtZW50cwogICAgICAtIERCX1VTRVJOQU1FPXJvb3QKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0VBU1lBUFBPSU5UTUVOVFN9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBteXNxbAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMwCiAgbXlzcWw6CiAgICBpbWFnZTogJ215c3FsOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdlYXN5YXBwb2ludG1lbnRzLW15c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfRUFTWUFQUE9JTlRNRU5UU30nCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9ZWFzeWFwcG9pbnRtZW50cwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "calendar",
-            "scheduling",
-            "database"
-        ],
-        "category": "productivity",
-        "logo": "svgs/easyappointments.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "elasticsearch-with-kibana": {
         "documentation": "https://www.elastic.co/docs/deploy-manage/deploy/self-managed/install-kibana-with-docker?utm_source=coolify.io",
         "slogan": "Elastic + Kibana is a Free and Open Source Search, Monitoring, and Visualization Stack",
@@ -1390,7 +1176,7 @@
         "category": "media",
         "logo": "svgs/ente-photos.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-22T16:05:17+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8080"
     },
     "ente-photos": {
@@ -1429,24 +1215,6 @@
         "template_last_updated_at": "2026-01-05T14:20:17+01:00",
         "port": "6052"
     },
-    "espocrm": {
-        "documentation": "https://docs.espocrm.com?utm_source=coolify.io",
-        "slogan": "EspoCRM is a free and open-source CRM platform.",
-        "compose": "c2VydmljZXM6CiAgZXNwb2NybToKICAgIGltYWdlOiAnZXNwb2NybS9lc3BvY3JtOjEwJwogICAgY29udGFpbmVyX25hbWU6IGVzcG9jcm0KICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0VTUE9DUk0KICAgICAgLSAnRVNQT0NSTV9BRE1JTl9VU0VSTkFNRT0ke0VTUE9DUk1fQURNSU5fVVNFUk5BTUU6LWFkbWlufScKICAgICAgLSAnRVNQT0NSTV9BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtIEVTUE9DUk1fREFUQUJBU0VfUExBVEZPUk09TXlzcWwKICAgICAgLSBFU1BPQ1JNX0RBVEFCQVNFX0hPU1Q9ZXNwb2NybS1kYgogICAgICAtICdFU1BPQ1JNX0RBVEFCQVNFX05BTUU9JHtNQVJJQURCX0RBVEFCQVNFOi1lc3BvY3JtfScKICAgICAgLSAnRVNQT0NSTV9EQVRBQkFTRV9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdFU1BPQ1JNX0RBVEFCQVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnRVNQT0NSTV9TSVRFX1VSTD0ke1NFUlZJQ0VfVVJMX0VTUE9DUk19JwogICAgdm9sdW1lczoKICAgICAgLSAnZXNwb2NybS1kYXRhOi92YXIvd3d3L2h0bWwvZGF0YScKICAgICAgLSAnZXNwb2NybS1jdXN0b206L3Zhci93d3cvaHRtbC9jdXN0b20nCiAgICAgIC0gJ2VzcG9jcm0tY3VzdG9tLWNsaWVudDovdmFyL3d3dy9odG1sL2NsaWVudC9jdXN0b20nCiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAogICAgZGVwZW5kc19vbjoKICAgICAgZXNwb2NybS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGJpbi9jb21tYW5kCiAgICAgICAgLSBhcHAtY2hlY2sKICAgICAgc3RhcnRfcGVyaW9kOiAyMHMKICAgICAgaW50ZXJ2YWw6IDYwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwogIGVzcG9jcm0tZGFlbW9uOgogICAgaW1hZ2U6ICdlc3BvY3JtL2VzcG9jcm06MTAnCiAgICBjb250YWluZXJfbmFtZTogZXNwb2NybS1kYWVtb24KICAgIHZvbHVtZXNfZnJvbToKICAgICAgLSBlc3BvY3JtCiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAogICAgZW50cnlwb2ludDogZG9ja2VyLWRhZW1vbi5zaAogICAgZGVwZW5kc19vbjoKICAgICAgZXNwb2NybToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGJpbi9jb21tYW5kCiAgICAgICAgLSBhcHAtY2hlY2sKICAgICAgc3RhcnRfcGVyaW9kOiAyMHMKICAgICAgaW50ZXJ2YWw6IDE4MHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDMKICBlc3BvY3JtLXdlYnNvY2tldDoKICAgIGltYWdlOiAnZXNwb2NybS9lc3BvY3JtOjEwJwogICAgY29udGFpbmVyX25hbWU6IGVzcG9jcm0td2Vic29ja2V0CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9FU1BPQ1JNX1dFQlNPQ0tFVF84MDgwCiAgICAgIC0gRVNQT0NSTV9DT05GSUdfVVNFX1dFQl9TT0NLRVQ9dHJ1ZQogICAgICAtIEVTUE9DUk1fQ09ORklHX1dFQl9TT0NLRVRfVVJMPSRTRVJWSUNFX1VSTF9FU1BPQ1JNX1dFQlNPQ0tFVAogICAgICAtICdFU1BPQ1JNX0NPTkZJR19XRUJfU09DS0VUX1pFUk9fTV9RX1NVQlNDUklCRVJfRFNOPXRjcDovLyo6Nzc3NycKICAgICAgLSAnRVNQT0NSTV9DT05GSUdfV0VCX1NPQ0tFVF9aRVJPX01fUV9TVUJNSVNTSU9OX0RTTj10Y3A6Ly9lc3BvY3JtLXdlYnNvY2tldDo3Nzc3JwogICAgdm9sdW1lc19mcm9tOgogICAgICAtIGVzcG9jcm0KICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnRyeXBvaW50OiBkb2NrZXItd2Vic29ja2V0LnNoCiAgICBkZXBlbmRzX29uOgogICAgICBlc3BvY3JtOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gYmluL2NvbW1hbmQKICAgICAgICAtIGFwcC1jaGVjawogICAgICBzdGFydF9wZXJpb2Q6IDIwcwogICAgICBpbnRlcnZhbDogMTgwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwogIGVzcG9jcm0tZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTIuMycKICAgIGNvbnRhaW5lcl9uYW1lOiBlc3BvY3JtLWRiCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUFSSUFEQl9EQVRBQkFTRT0ke01BUklBREJfREFUQUJBU0U6LWVzcG9jcm19JwogICAgICAtICdNQVJJQURCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01BUklBREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtICdNQVJJQURCX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgdm9sdW1lczoKICAgICAgLSAnZXNwb2NybS1kYjovdmFyL2xpYi9teXNxbCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMK",
-        "tags": [
-            "crm",
-            "self-hosted",
-            "open-source",
-            "workflow",
-            "automation",
-            "project management"
-        ],
-        "category": "productivity",
-        "logo": "svgs/espocrm.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-07-03T15:15:43+03:00",
-        "port": "80"
-    },
     "evolution-api": {
         "documentation": "https://doc.evolution-api.com/v2/en/get-started/introduction?utm_source=coolify.io",
         "slogan": "Multi-platform messaging (whatsapp and more) integration API",
@@ -1563,22 +1331,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "5000"
     },
-    "firefly": {
-        "documentation": "https://firefly-iii.org?utm_source=coolify.io",
-        "slogan": "A personal finances manager that can help you save money.",
-        "compose": "c2VydmljZXM6CiAgZmlyZWZseToKICAgIGltYWdlOiAnZmlyZWZseWlpaS9jb3JlOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZJUkVGTFlfODA4MAogICAgICAtIEFQUF9LRVk9JFNFUlZJQ0VfQkFTRTY0X0FQUEtFWQogICAgICAtIERCX0hPU1Q9bXlzcWwKICAgICAgLSBEQl9QT1JUPTMzMDYKICAgICAgLSBEQl9DT05ORUNUSU9OPW15c3FsCiAgICAgIC0gJ0RCX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWZpcmVmbHl9JwogICAgICAtIERCX1VTRVJOQU1FPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBEQl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgICAtIFNUQVRJQ19DUk9OX1RPS0VOPSRTRVJWSUNFX0JBU0U2NF9DUk9OVE9LRU4KICAgICAgLSAnVFJVU1RFRF9QUk9YSUVTPSonCiAgICB2b2x1bWVzOgogICAgICAtICdmaXJlZmx5LXVwbG9hZDovdmFyL3d3dy9odG1sL3N0b3JhZ2UvdXBsb2FkJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwODAvaGVhbHRoJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICBkZXBlbmRzX29uOgogICAgICBteXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIG15c3FsOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1maXJlZmx5fScKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYXJpYWRiLWFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgICAtICctdXJvb3QnCiAgICAgICAgLSAnLXAke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAnZmlyZWZseS1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogIGNyb246CiAgICBpbWFnZTogYWxwaW5lCiAgICBlbnRyeXBvaW50OgogICAgICAtIC9lbnRyeXBvaW50LnNoCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9lbnRyeXBvaW50LnNoCiAgICAgICAgdGFyZ2V0OiAvZW50cnlwb2ludC5zaAogICAgICAgIGNvbnRlbnQ6ICIjIS9iaW4vc2hcbiMgU3Vic3RpdHV0ZSB0aGUgZW52aXJvbm1lbnQgdmFyaWFibGUgaW50byB0aGUgY3JvbiBjb21tYW5kXG5DUk9OX0NPTU1BTkQ9XCIwIDMgKiAqICogd2dldCAtcU8tIGh0dHA6Ly9maXJlZmx5OjgwODAvYXBpL3YxL2Nyb24vJHtTVEFUSUNfQ1JPTl9UT0tFTn1cIlxuIyBBZGQgdGhlIGNyb24gY29tbWFuZCB0byB0aGUgY3JvbnRhYlxuZWNobyBcIiRDUk9OX0NPTU1BTkRcIiB8IGNyb250YWIgLVxuIyBTdGFydCB0aGUgY3JvbiBkYWVtb24gaW4gdGhlIGZvcmVncm91bmQgd2l0aCBsb2dnaW5nIHRvIHN0ZG91dFxuY3JvbmQgLWYgLUwgL2Rldi9zdGRvdXQiCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTVEFUSUNfQ1JPTl9UT0tFTj0kU0VSVklDRV9CQVNFNjRfQ1JPTlRPS0VOCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2xzIC9lbnRyeXBvaW50LnNoIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDQwcwo=",
-        "tags": [
-            "finance",
-            "money",
-            "personal",
-            "manager"
-        ],
-        "category": "finance",
-        "logo": "svgs/firefly.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T10:43:04+02:00",
-        "port": "8080"
-    },
     "firefox": {
         "documentation": "https://github.com/jlesage/docker-firefox?utm_source=coolify.io",
         "slogan": "Fast, private, and self-hosted secure browser for browsing without limits.",
@@ -1696,7 +1448,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-mysql": {
@@ -1714,7 +1466,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-postgresql": {
@@ -1732,7 +1484,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-runner-with-mariadb": {
@@ -1754,7 +1506,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-runner-with-mysql": {
@@ -1776,7 +1528,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-runner-with-postgresql": {
@@ -1798,7 +1550,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-runner": {
@@ -1819,7 +1571,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo": {
@@ -1836,7 +1588,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "formbricks": {
@@ -1852,7 +1604,7 @@
         "category": "productivity",
         "logo": "svgs/formbricks.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "foundryvtt": {
@@ -1872,78 +1624,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "30000"
     },
-    "freescout": {
-        "documentation": "https://github.com/freescout-help-desk/freescout/wiki/?utm_source=coolify.io",
-        "slogan": "FreeScout is the super lightweight and powerful free open source help desk and shared inbox written in PHP (Laravel framework).",
-        "compose": "c2VydmljZXM6CiAgZnJlZXNjb3V0OgogICAgaW1hZ2U6ICd0aXJlZG9maXQvZnJlZXNjb3V0OmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ZyZWVzY291dC1kYXRhOi9kYXRhJwogICAgICAtICdmcmVlc2NvdXQtbG9nczovd3d3L2xvZ3MnCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9GUkVFU0NPVVRfODAKICAgICAgLSBEQl9IT1NUPW1hcmlhZGIKICAgICAgLSAnREJfTkFNRT0ke01BUklBREJfREFUQUJBU0U6LWZyZWVzY291dH0nCiAgICAgIC0gJ0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQjotZnJlZXNjb3V0fScKICAgICAgLSAnREJfUEFTUz0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ1NJVEVfVVJMPSR7U0VSVklDRV9VUkxfRlJFRVNDT1VUfScKICAgICAgLSAnQURNSU5fRU1BSUw9JHtBRE1JTl9FTUFJTDotYWRtaW5AZXhhbXBsZS5jb219JwogICAgICAtICdBRE1JTl9QQVNTPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gJ0RJU1BMQVlfRVJST1JTPSR7RElTUExBWV9FUlJPUlM6LUZBTFNFfScKICAgICAgLSAnVElNRVpPTkU9JHtUSU1FWk9ORTotVVRDfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG1hcmlhZGI6CiAgICBpbWFnZTogbWFyaWFkYgogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01BUklBREJfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICAgIC0gJ01BUklBREJfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFfScKICAgICAgLSAnTUFSSUFEQl9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNQVJJQURCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "helpdesk",
-            "support",
-            "ticketing",
-            "customer-support"
-        ],
-        "category": "helpdesk",
-        "logo": "svgs/freescout.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "freshrss-with-mariadb": {
-        "documentation": "https://freshrss.org/index.html?utm_source=coolify.io",
-        "slogan": "A free, self-hostable feed aggregator.",
-        "compose": "c2VydmljZXM6CiAgZnJlc2hyc3M6CiAgICBpbWFnZTogJ2ZyZXNocnNzL2ZyZXNocnNzOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZSRVNIUlNTXzgwCiAgICAgIC0gJ0NST05fTUlOPSR7Q1JPTl9NSU46LTEsMzF9JwogICAgICAtICdNQVJJQURCX0RCPSR7TUFSSUFEQl9EQVRBQkFTRTotZnJlc2hyc3N9JwogICAgICAtICdNQVJJQURCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01BUklBREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgdm9sdW1lczoKICAgICAgLSAnZnJlc2hyc3MtZGF0YTovdmFyL3d3dy9GcmVzaFJTUy9kYXRhJwogICAgICAtICdmcmVzaHJzcy1leHRlbnNpb25zOi92YXIvd3d3L0ZyZXNoUlNTL2V4dGVuc2lvbnMnCiAgICBkZXBlbmRzX29uOgogICAgICBmcmVzaHJzcy1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc6PiAvZGV2L3RjcC8xMjcuMC4wLjEvODAnIHx8IGV4aXQgMSIKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAzCiAgZnJlc2hyc3MtZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICdtYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1mcmVzaHJzc30nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "rss",
-            "feed"
-        ],
-        "category": "RSS",
-        "logo": "svgs/freshrss.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "freshrss-with-mysql": {
-        "documentation": "https://freshrss.org/index.html?utm_source=coolify.io",
-        "slogan": "A free, self-hostable feed aggregator.",
-        "compose": "c2VydmljZXM6CiAgZnJlc2hyc3M6CiAgICBpbWFnZTogJ2ZyZXNocnNzL2ZyZXNocnNzOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZSRVNIUlNTXzgwCiAgICAgIC0gJ0NST05fTUlOPSR7Q1JPTl9NSU46LTEsMzF9JwogICAgICAtICdNWVNRTF9EQj0ke01ZU1FMX0RBVEFCQVNFOi1mcmVzaHJzc30nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgdm9sdW1lczoKICAgICAgLSAnZnJlc2hyc3MtZGF0YTovdmFyL3d3dy9GcmVzaFJTUy9kYXRhJwogICAgICAtICdmcmVzaHJzcy1leHRlbnNpb25zOi92YXIvd3d3L0ZyZXNoUlNTL2V4dGVuc2lvbnMnCiAgICBkZXBlbmRzX29uOgogICAgICBmcmVzaHJzcy1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc6PiAvZGV2L3RjcC8xMjcuMC4wLjEvODAnIHx8IGV4aXQgMSIKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAzCiAgZnJlc2hyc3MtZGI6CiAgICBpbWFnZTogJ215c3FsOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdteXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTVlTUUxfUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9ST09UCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWZyZXNocnNzfScKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "rss",
-            "feed"
-        ],
-        "category": "RSS",
-        "logo": "svgs/freshrss.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "freshrss-with-postgresql": {
-        "documentation": "https://freshrss.org/index.html?utm_source=coolify.io",
-        "slogan": "A free, self-hostable feed aggregator.",
-        "compose": "c2VydmljZXM6CiAgZnJlc2hyc3M6CiAgICBpbWFnZTogJ2ZyZXNocnNzL2ZyZXNocnNzOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZSRVNIUlNTXzgwCiAgICAgIC0gJ0NST05fTUlOPSR7Q1JPTl9NSU46LTEsMzF9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTUUxfREFUQUJBU0U6LWZyZXNocnNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUx9JwogICAgICAtIFBPU1RHUkVTX0hPU1Q9ZnJlc2hyc3MtZGIKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ZyZXNocnNzLWRhdGE6L3Zhci93d3cvRnJlc2hSU1MvZGF0YScKICAgICAgLSAnZnJlc2hyc3MtZXh0ZW5zaW9uczovdmFyL3d3dy9GcmVzaFJTUy9leHRlbnNpb25zJwogICAgZGVwZW5kc19vbjoKICAgICAgZnJlc2hyc3MtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAiYmFzaCAtYyAnOj4gL2Rldi90Y3AvMTI3LjAuMC4xLzgwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwogIGZyZXNocnNzLWRiOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ZyZXNocnNzLXBvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUx9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTUUxfREFUQUJBU0U6LWZyZXNocnNzfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "rss",
-            "feed"
-        ],
-        "category": "RSS",
-        "logo": "svgs/freshrss.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "freshrss": {
-        "documentation": "https://freshrss.org/index.html?utm_source=coolify.io",
-        "slogan": "A free, self-hostable feed aggregator.",
-        "compose": "c2VydmljZXM6CiAgZnJlc2hyc3M6CiAgICBpbWFnZTogJ2ZyZXNocnNzL2ZyZXNocnNzOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZSRVNIUlNTXzgwCiAgICAgIC0gJ0NST05fTUlOPSR7Q1JPTl9NSU46LTEsMzF9JwogICAgdm9sdW1lczoKICAgICAgLSAnZnJlc2hyc3MtZGF0YTovdmFyL3d3dy9GcmVzaFJTUy9kYXRhJwogICAgICAtICdmcmVzaHJzcy1leHRlbnNpb25zOi92YXIvd3d3L0ZyZXNoUlNTL2V4dGVuc2lvbnMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gImJhc2ggLWMgJzo+IC9kZXYvdGNwLzEyNy4wLjAuMS84MCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDMK",
-        "tags": [
-            "rss",
-            "feed"
-        ],
-        "category": "RSS",
-        "logo": "svgs/freshrss.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
     "garage": {
         "documentation": "https://garagehq.deuxfleurs.fr/documentation/?utm_source=coolify.io",
         "slogan": "Garage is an S3-compatible distributed object storage service designed for self-hosting.",
@@ -2168,22 +1848,6 @@
         "template_last_updated_at": "2026-02-10T11:22:57+05:30",
         "port": "8000"
     },
-    "glpi": {
-        "documentation": "https://help.glpi-project.org/documentation?utm_source=coolify.io",
-        "slogan": "GLPI (Gestionnaire Libre de Parc Informatique) is a free, open-source IT Service Management (ITSM) platform used for IT asset management, helpdesk, and service desk operations.",
-        "compose": "c2VydmljZXM6CiAgZ2xwaToKICAgIGltYWdlOiAnZ2xwaS9nbHBpOjExJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfR0xQSV84MAogICAgICAtIEdMUElfREJfSE9TVD1nbHBpLWRiCiAgICAgIC0gR0xQSV9EQl9QT1JUPTMzMDYKICAgICAgLSAnR0xQSV9EQl9OQU1FPSR7TVlTUUxfREFUQUJBU0U6LWdscGktZGJ9JwogICAgICAtICdHTFBJX0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdHTFBJX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICB2b2x1bWVzOgogICAgICAtICdnbHBpLWRhdGE6L3Zhci9nbHBpOnJ3JwogICAgZGVwZW5kc19vbjoKICAgICAgZ2xwaS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0LycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogIGdscGktZGI6CiAgICBpbWFnZTogJ215c3FsOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdteXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1nbHBpLWRifScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "helpdesk",
-            "ticketing",
-            "support",
-            "open-source"
-        ],
-        "category": "helpdesk",
-        "logo": "svgs/glpi.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-01-13T21:07:54+01:00",
-        "port": "80"
-    },
     "goatcounter": {
         "documentation": "https://www.goatcounter.com/help?utm_source=coolify.io",
         "slogan": "Lightweight web analytics platform.",
@@ -2327,23 +1991,6 @@
         "template_last_updated_at": "2026-02-16T15:13:50+02:00",
         "port": "8484"
     },
-    "grocy": {
-        "documentation": "https://github.com/grocy/grocy?utm_source=coolify.io",
-        "slogan": "Grocy is a web-based household management and grocery list application.",
-        "compose": "c2VydmljZXM6CiAgZ3JvY3k6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvZ3JvY3k6NC42LjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9HUk9DWQogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtIFRaPUV1cm9wZS9NYWRyaWQKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2dyb2N5LWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
-        "tags": [
-            "groceries",
-            "household",
-            "management",
-            "grocery",
-            "shopping"
-        ],
-        "category": "productivity",
-        "logo": "svgs/grocy.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
         "slogan": "Hatchet allows you to run background tasks at scale with a high-throughput, low-latency computing service built on an open-source, fault-tolerant queue.",
@@ -2357,7 +2004,7 @@
         "category": "automation",
         "logo": "svgs/hatchet.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-10-15T22:51:15+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "80"
     },
     "healthchecks": {
@@ -2379,26 +2026,10 @@
         "template_last_updated_at": "2026-05-25T13:06:59-04:00",
         "port": "80000"
     },
-    "heimdall": {
-        "documentation": "https://github.com/linuxserver/Heimdall?utm_source=coolify.io",
-        "slogan": "Heimdall is a dashboard for managing and organizing your server applications.",
-        "compose": "c2VydmljZXM6CiAgaGVpbWRhbGw6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvaGVpbWRhbGw6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfSEVJTURBTEwKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSBUWj1FdXJvcGUvTWFkcmlkCiAgICB2b2x1bWVzOgogICAgICAtICdoZWltZGFsbC1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "dashboard",
-            "server",
-            "applications",
-            "interface"
-        ],
-        "category": "productivity",
-        "logo": "svgs/heimdall.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "hermes-agent-with-webui": {
         "documentation": "https://github.com/nesquena/hermes-webui?utm_source=coolify.io",
         "slogan": "Hermes Agent - autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
-        "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50OnYyMDI2LjYuNScKICAgIGNvbW1hbmQ6ICdnYXRld2F5IHJ1bicKICAgIGVudmlyb25tZW50OgogICAgICAtIEhFUk1FU19IT01FPS9ob21lL2hlcm1lcy8uaGVybWVzCiAgICAgIC0gV0lLSV9QQVRIPS9ob21lL2hlcm1lcy8uaGVybWVzL3dpa2kKICAgICAgLSBHQVRFV0FZX0FMTE9XX0FMTF9VU0VSUz10cnVlCiAgICAgIC0gSEVSTUVTX1JFREFDVF9TRUNSRVRTPXRydWUKICAgICAgLSBIRVJNRVNfVUlEPTEwMDAKICAgICAgLSBIRVJNRVNfR0lEPTEwMDAKICAgICAgLSAnSEVSTUVTX0VOQUJMRV9QUk9KRUNUX1BMVUdJTlM9JHtIRVJNRVNfRU5BQkxFX1BST0pFQ1RfUExVR0lOUzotdHJ1ZX0nCiAgICAgIC0gJ0hFUk1FU19PUFRJT05BTF9TS0lMTFM9JHtIRVJNRVNfT1BUSU9OQUxfU0tJTExTOi19JwogICAgICAtICdIRVJNRVNfQUxMT1dfUFJJVkFURV9VUkxTPSR7SEVSTUVTX0FMTE9XX1BSSVZBVEVfVVJMUzotZmFsc2V9JwogICAgICAtICdGSVJFQ1JBV0xfQVBJX0tFWT0ke0ZJUkVDUkFXTF9BUElfS0VZOi19JwogICAgICAtICdGSVJFQ1JBV0xfQVBJX1VSTD0ke0ZJUkVDUkFXTF9BUElfVVJMOi1odHRwczovL2FwaS5maXJlY3Jhd2wuZGV2fScKICAgICAgLSAnT1BFTlJPVVRFUl9BUElfS0VZPSR7T1BFTlJPVVRFUl9BUElfS0VZOi19JwogICAgICAtICdBTlRIUk9QSUNfQVBJX0tFWT0ke0FOVEhST1BJQ19BUElfS0VZOi19JwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZOi19JwogICAgICAtICdHT09HTEVfQVBJX0tFWT0ke0dPT0dMRV9BUElfS0VZOi19JwogICAgdm9sdW1lczoKICAgICAgLSAnaGVybWVzLWhvbWU6L2hvbWUvaGVybWVzLy5oZXJtZXMnCiAgICAgIC0gJ2hlcm1lcy1za2lsbHM6L2hvbWUvaGVybWVzLy5oZXJtZXMvc2tpbGxzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUxLjQ4OScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gaGVybWVzLWFnZW50CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9IRVJNRVNXRUJVSV84Nzg3CiAgICAgIC0gU0VSVklDRV9VU0VSX0hFUk1FU1dFQlVJCiAgICAgIC0gU0VSVklDRV9QQVNTV09SRF9IRVJNRVNXRUJVSQogICAgICAtIEhFUk1FU19XRUJVSV9IT1NUPTAuMC4wLjAKICAgICAgLSBIRVJNRVNfV0VCVUlfUE9SVD04Nzg3CiAgICAgIC0gSEVSTUVTX1dFQlVJX1NUQVRFX0RJUj0vaG9tZS9oZXJtZXN3ZWJ1aS8uaGVybWVzL3dlYnVpCiAgICAgIC0gV0FOVEVEX1VJRD0xMDAwCiAgICAgIC0gV0FOVEVEX0dJRD0xMDAwCiAgICAgIC0gJ0hFUk1FU19XRUJVSV9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9IRVJNRVNXRUJVSX0nCiAgICAgIC0gJ0hFUk1FU19XRUJVSV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSEVSTUVTV0VCVUl9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGVybWVzLWhvbWU6L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcycKICAgICAgLSAnaGVybWVzLWFnZW50LXNyYzovaG9tZS9oZXJtZXN3ZWJ1aS8uaGVybWVzL2hlcm1lcy1hZ2VudDpybycKICAgICAgLSAnaGVybWVzLXdvcmtzcGFjZTovd29ya3NwYWNlJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjg3ODcvaGVhbHRoJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMK",
+        "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50OnYyMDI2LjkuMjQnCiAgICBjb21tYW5kOiAnZ2F0ZXdheSBydW4nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBIRVJNRVNfSE9NRT0vaG9tZS9oZXJtZXMvLmhlcm1lcwogICAgICAtIFdJS0lfUEFUSD0vaG9tZS9oZXJtZXMvLmhlcm1lcy93aWtpCiAgICAgIC0gR0FURVdBWV9BTExPV19BTExfVVNFUlM9dHJ1ZQogICAgICAtIEhFUk1FU19SRURBQ1RfU0VDUkVUUz10cnVlCiAgICAgIC0gSEVSTUVTX1VJRD0xMDAwCiAgICAgIC0gSEVSTUVTX0dJRD0xMDAwCiAgICAgIC0gJ0hFUk1FU19FTkFCTEVfUFJPSkVDVF9QTFVHSU5TPSR7SEVSTUVTX0VOQUJMRV9QUk9KRUNUX1BMVUdJTlM6LXRydWV9JwogICAgICAtICdIRVJNRVNfT1BUSU9OQUxfU0tJTExTPSR7SEVSTUVTX09QVElPTkFMX1NLSUxMUzotfScKICAgICAgLSAnSEVSTUVTX0FMTE9XX1BSSVZBVEVfVVJMUz0ke0hFUk1FU19BTExPV19QUklWQVRFX1VSTFM6LWZhbHNlfScKICAgICAgLSAnRklSRUNSQVdMX0FQSV9LRVk9JHtGSVJFQ1JBV0xfQVBJX0tFWTotfScKICAgICAgLSAnRklSRUNSQVdMX0FQSV9VUkw9JHtGSVJFQ1JBV0xfQVBJX1VSTDotaHR0cHM6Ly9hcGkuZmlyZWNyYXdsLmRldn0nCiAgICAgIC0gJ09QRU5ST1VURVJfQVBJX0tFWT0ke09QRU5ST1VURVJfQVBJX0tFWTotfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWTotfScKICAgICAgLSAnT1BFTkFJX0FQSV9LRVk9JHtPUEVOQUlfQVBJX0tFWTotfScKICAgICAgLSAnR09PR0xFX0FQSV9LRVk9JHtHT09HTEVfQVBJX0tFWTotfScKICAgICAgLSBBUElfU0VSVkVSX0VOQUJMRUQ9dHJ1ZQogICAgICAtIEFQSV9TRVJWRVJfSE9TVD0wLjAuMC4wCiAgICAgIC0gJ0FQSV9TRVJWRVJfS0VZPSR7U0VSVklDRV9QQVNTV09SRF82NF9IRVJNRVNBUEl9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGVybWVzLWhvbWU6L2hvbWUvaGVybWVzLy5oZXJtZXMnCiAgICAgIC0gJ2hlcm1lcy1za2lsbHM6L2hvbWUvaGVybWVzLy5oZXJtZXMvc2tpbGxzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUyLjQ1OCcKICAgIGRlcGVuZHNfb246CiAgICAgIC0gaGVybWVzLWFnZW50CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9IRVJNRVNXRUJVSV84Nzg3CiAgICAgIC0gU0VSVklDRV9VU0VSX0hFUk1FU1dFQlVJCiAgICAgIC0gU0VSVklDRV9QQVNTV09SRF9IRVJNRVNXRUJVSQogICAgICAtIEhFUk1FU19XRUJVSV9IT1NUPTAuMC4wLjAKICAgICAgLSBIRVJNRVNfV0VCVUlfUE9SVD04Nzg3CiAgICAgIC0gSEVSTUVTX1dFQlVJX1NUQVRFX0RJUj0vaG9tZS9oZXJtZXN3ZWJ1aS8uaGVybWVzL3dlYnVpCiAgICAgIC0gV0FOVEVEX1VJRD0xMDAwCiAgICAgIC0gV0FOVEVEX0dJRD0xMDAwCiAgICAgIC0gJ0hFUk1FU19XRUJVSV9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9IRVJNRVNXRUJVSX0nCiAgICAgIC0gJ0hFUk1FU19XRUJVSV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSEVSTUVTV0VCVUl9JwogICAgICAtICdIRVJNRVNfQVBJX1VSTD1odHRwOi8vaGVybWVzLWFnZW50Ojg2NDInCiAgICAgIC0gJ0hFUk1FU19XRUJVSV9HQVRFV0FZX0FQSV9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0hFUk1FU0FQSX0nCiAgICB2b2x1bWVzOgogICAgICAtICdoZXJtZXMtaG9tZTovaG9tZS9oZXJtZXN3ZWJ1aS8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMvaGVybWVzLWFnZW50OnJvJwogICAgICAtICdoZXJtZXMtd29ya3NwYWNlOi93b3Jrc3BhY2UnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODc4Ny9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "ai",
             "agent",
@@ -2412,7 +2043,7 @@
         "category": "ai",
         "logo": "svgs/hermes-agent.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-12T16:39:52+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8787"
     },
     "hermes-agent": {
@@ -2467,13 +2098,13 @@
         "category": "productivity",
         "logo": "svgs/homarr.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T19:03:43+02:00",
+        "template_last_updated_at": "2026-10-01T20:31:00+02:00",
         "port": "7575"
     },
     "home-assistant": {
         "documentation": "https://www.home-assistant.io/installation/linux#docker-compose?utm_source=coolify.io",
         "slogan": "Open source home automation that puts local control and privacy first.",
-        "compose": "c2VydmljZXM6CiAgaG9tZWFzc2lzdGFudDoKICAgIGltYWdlOiAnZ2hjci5pby9ob21lLWFzc2lzdGFudC9ob21lLWFzc2lzdGFudDoyMDI1LjEwLjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9IT01FQVNTSVNUQU5UXzgxMjMKICAgICAgLSAnVFo9JHtUWjotVVRDfScKICAgICAgLSAnRElTQUJMRV9KRU1BTExPQz0ke0RJU0FCTEVfSkVNQUxMT0M6LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hvbWVhc3Npc3RhbnQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJy9ydW4vZGJ1czovcnVuL2RidXM6cm8nCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NvbmZpZ3VyYXRpb24ueWFtbAogICAgICAgIHRhcmdldDogL2NvbmZpZy9jb25maWd1cmF0aW9uLnlhbWwKICAgICAgICBjb250ZW50OiAiIyBMb2FkcyBkZWZhdWx0IHNldCBvZiBpbnRlZ3JhdGlvbnMuIERvIG5vdCByZW1vdmUuXG5kZWZhdWx0X2NvbmZpZzpcblxuIyBDb25maWd1cmF0aW9uIGZvciByZXZlcnNlIHByb3h5IHN1cHBvcnQgKHJlcXVpcmVkIGZvciBDb29saWZ5KVxuaHR0cDpcbiAgdXNlX3hfZm9yd2FyZGVkX2ZvcjogdHJ1ZVxuICB0cnVzdGVkX3Byb3hpZXM6XG4gICAgLSAxMC4wLjAuMC84XG4gICAgLSAxNzIuMTYuMC4wLzEyXG4gICAgLSAxOTIuMTY4LjAuMC8xNlxuICBpcF9iYW5fZW5hYmxlZDogdHJ1ZVxuICBsb2dpbl9hdHRlbXB0c190aHJlc2hvbGQ6IDUiCiAgICBwcml2aWxlZ2VkOiB0cnVlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODEyMycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDYwcwo=",
+        "compose": "c2VydmljZXM6CiAgaG9tZWFzc2lzdGFudDoKICAgIGltYWdlOiAnZ2hjci5pby9ob21lLWFzc2lzdGFudC9ob21lLWFzc2lzdGFudDoyMDI1LjEwLjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9IT01FQVNTSVNUQU5UXzgxMjMKICAgICAgLSAnVFo9JHtUWjotVVRDfScKICAgICAgLSAnRElTQUJMRV9KRU1BTExPQz0ke0RJU0FCTEVfSkVNQUxMT0M6LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hvbWVhc3Npc3RhbnQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJy9ydW4vZGJ1czovcnVuL2RidXM6cm8nCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NvbmZpZ3VyYXRpb24ueWFtbAogICAgICAgIHRhcmdldDogL2NvbmZpZy9jb25maWd1cmF0aW9uLnlhbWwKICAgICAgICBjb250ZW50OiAiIyBMb2FkcyBkZWZhdWx0IHNldCBvZiBpbnRlZ3JhdGlvbnMuIERvIG5vdCByZW1vdmUuXG5kZWZhdWx0X2NvbmZpZzpcblxuIyBDb25maWd1cmF0aW9uIGZvciByZXZlcnNlIHByb3h5IHN1cHBvcnQgKHJlcXVpcmVkIGZvciBDb29saWZ5KVxuaHR0cDpcbiAgdXNlX3hfZm9yd2FyZGVkX2ZvcjogdHJ1ZVxuICB0cnVzdGVkX3Byb3hpZXM6XG4gICAgLSAxMC4wLjAuMC84XG4gICAgLSAxNzIuMTYuMC4wLzEyXG4gICAgLSAxOTIuMTY4LjAuMC8xNlxuICBpcF9iYW5fZW5hYmxlZDogdHJ1ZVxuICBsb2dpbl9hdHRlbXB0c190aHJlc2hvbGQ6IDVcbiIKICAgIHByaXZpbGVnZWQ6IHRydWUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MTIzJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogNjBzCg==",
         "tags": [
             "home-automation",
             "iot",
@@ -2516,7 +2147,7 @@
         "category": "productivity",
         "logo": "svgs/homepage.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "template_last_updated_at": "2026-10-19T21:18:41+02:00",
         "port": "3000"
     },
     "honcho": {
@@ -2651,23 +2282,6 @@
         "template_last_updated_at": "2026-07-02T13:25:47+02:00",
         "port": "8288"
     },
-    "invoice-ninja": {
-        "documentation": "https://invoiceninja.github.io/selfhost.html?utm_source=coolify.io",
-        "slogan": "The leading open-source invoicing platform",
-        "compose": "c2VydmljZXM6CiAgaW52b2ljZS1uaW5qYToKICAgIGltYWdlOiAnaW52b2ljZW5pbmphL2ludm9pY2VuaW5qYTo1JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfSU5WT0lDRU5JTkpBCiAgICAgIC0gJ0FQUF9OQU1FPSR7QVBQX05BTUU6LSJJbnZvaWNlIE5pbmphIn0nCiAgICAgIC0gJ0FQUF9FTlY9JHtBUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnQVBQX1VSTD0ke1NFUlZJQ0VfVVJMX0lOVk9JQ0VOSU5KQX0nCiAgICAgIC0gJ0FQUF9LRVk9YmFzZTY0OiR7U0VSVklDRV9SRUFMQkFTRTY0X0lOVk9JQ0VOSU5KQX0nCiAgICAgIC0gJ0FQUF9ERUJVRz0ke0FQUF9ERUJVRzotZmFsc2V9JwogICAgICAtICdSRVFVSVJFX0hUVFBTPSR7UkVRVUlSRV9IVFRQUzotZmFsc2V9JwogICAgICAtICdQSEFOVE9NSlNfUERGX0dFTkVSQVRJT049JHtQSEFOVE9NSlNfUERGX0dFTkVSQVRJT046LWZhbHNlfScKICAgICAgLSAnUERGX0dFTkVSQVRPUj0ke1BERl9HRU5FUkFUT1I6LWhvc3RlZF9uaW5qYX0nCiAgICAgIC0gJ1RSVVNURURfUFJPWElFUz0ke1RSVVNURURfUFJPWElFUzotKn0nCiAgICAgIC0gQ0FDSEVfRFJJVkVSPXJlZGlzCiAgICAgIC0gJ1FVRVVFX0NPTk5FQ1RJT049JHtRVUVVRV9DT05ORUNUSU9OOi1yZWRpc30nCiAgICAgIC0gU0VTU0lPTl9EUklWRVI9cmVkaXMKICAgICAgLSAnUkVESVNfSE9TVD0ke1JFRElTX0hPU1Q6LXJlZGlzfScKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgICAgLSAnUkVESVNfUE9SVD0ke1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdEQl9IT1NUPSR7REJfSE9TVDotbWFyaWFkYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtEQl9QT1JUOi0zMzA2fScKICAgICAgLSAnREJfREFUQUJBU0U9JHtEQl9EQVRBQkFTRTotaW52b2ljZW5pbmphfScKICAgICAgLSAnREJfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnSU5fVVNFUl9FTUFJTD0ke0lOX1VTRVJfRU1BSUw6LWFkbWluQGV4YW1wbGUuY29tfScKICAgICAgLSAnSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0lOVk9JQ0VOSU5KQVVTRVJ9JwogICAgICAtICdNQUlMX01BSUxFUj0ke01BSUxfTUFJTEVSOi1sb2d9JwogICAgICAtICdNQUlMX0hPU1Q9JHtNQUlMX0hPU1R9JwogICAgICAtICdNQUlMX1BPUlQ9JHtNQUlMX1BPUlR9JwogICAgICAtICdNQUlMX1VTRVJOQU1FPSR7TUFJTF9VU0VSTkFNRX0nCiAgICAgIC0gJ01BSUxfUEFTU1dPUkQ9JHtNQUlMX1BBU1NXT1JEfScKICAgICAgLSAnTUFJTF9FTkNSWVBUSU9OPSR7TUFJTF9FTkNSWVBUSU9OfScKICAgICAgLSAnTUFJTF9GUk9NX0FERFJFU1M9JHtNQUlMX0ZST01fQUREUkVTU30nCiAgICAgIC0gJ01BSUxfRlJPTV9OQU1FPSR7TUFJTF9GUk9NX05BTUV9JwogICAgICAtICdBV1NfQUNDRVNTX0tFWV9JRD0ke0FXU19BQ0NFU1NfS0VZX0lEfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgLSAnQVdTX0RFRkFVTFRfUkVHSU9OPSR7QVdTX0RFRkFVTFRfUkVHSU9OfScKICAgICAgLSAnQVdTX0JVQ0tFVD0ke0FXU19CVUNLRVR9JwogICAgICAtICdBV1NfVVJMPSR7QVdTX1VSTH0nCiAgICAgIC0gJ0FXU19FTkRQT0lOVD0ke0FXU19FTkRQT0lOVH0nCiAgICAgIC0gJ05PUkRJR0VOX1NFQ1JFVF9JRD0ke05PUkRJR0VOX1NFQ1JFVF9JRH0nCiAgICAgIC0gJ05PUkRJR0VOX1NFQ1JFVF9LRVk9JHtOT1JESUdFTl9TRUNSRVRfS0VZfScKICAgICAgLSBJU19ET0NLRVI9dHJ1ZQogICAgICAtICdTQ09VVF9EUklWRVI9JHtTQ09VVF9EUklWRVJ9JwogICAgICAtICdMSUNFTlNFX0tFWT0ke0xJQ0VOU0VfS0VZfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSBvawogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICdpbnZvaWNlLW5pbmphLXB1YmxpYzovdmFyL3d3dy9hcHAvcHVibGljJwogICAgICAtICdpbnZvaWNlLW5pbmphLXN0b3JhZ2U6L3Zhci93d3cvYXBwL3N0b3JhZ2UnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3N1cGVydmlzb3JkLmNvbmYKICAgICAgICB0YXJnZXQ6IC9ldGMvc3VwZXJ2aXNvcmQuY29uZgogICAgICAgIGNvbnRlbnQ6ICJbc3VwZXJ2aXNvcmRdXG5ub2RhZW1vbj10cnVlXG5waWRmaWxlPS90bXAvc3VwZXJ2aXNvcmQucGlkXG5sb2dmaWxlPS9kZXYvbnVsbCA7IG5vZGFlbW9uIHdpbGwgY2F1c2UgbG9ncyB0byBnbyB0byBzdGRvdXRcbmxvZ2ZpbGVfbWF4Ynl0ZXM9MFxubG9nbGV2ZWw9aW5mb1xuXG5bcHJvZ3JhbTpwaHAtZnBtXVxucmVkaXJlY3Rfc3RkZXJyPXRydWVcbnN0ZG91dF9sb2dmaWxlPS9kZXYvc3Rkb3V0XG5zdGRvdXRfbG9nZmlsZV9tYXhieXRlcz0wXG5zdGRlcnJfbG9nZmlsZT0vZGV2L3N0ZGVyclxuc3RkZXJyX2xvZ2ZpbGVfbWF4Ynl0ZXM9MFxuY29tbWFuZD1waHAgYXJ0aXNhbiBzZXJ2ZSAtLWhvc3QgMC4wLjAuMCAtLXBvcnQgOTAwMFxuXG5bcHJvZ3JhbTpzY2hlZHVsZXJdXG5hdXRvcmVzdGFydD10cnVlXG5yZWRpcmVjdF9zdGRlcnI9dHJ1ZVxuc3Rkb3V0X2xvZ2ZpbGU9L2Rldi9zdGRvdXRcbnN0ZG91dF9sb2dmaWxlX21heGJ5dGVzPTBcbnN0ZGVycl9sb2dmaWxlPS9kZXYvc3RkZXJyXG5zdGRlcnJfbG9nZmlsZV9tYXhieXRlcz0wXG5jb21tYW5kPXBocCBhcnRpc2FuIHNjaGVkdWxlOndvcmtcblxuW3Byb2dyYW06cXVldWUtd29ya2VyXVxucHJvY2Vzc19uYW1lPSUocHJvZ3JhbV9uYW1lKXNfJShwcm9jZXNzX251bSkwMmRcbmF1dG9yZXN0YXJ0PXRydWVcbnJlZGlyZWN0X3N0ZGVycj10cnVlXG5zdGRvdXRfbG9nZmlsZT0vZGV2L3N0ZG91dFxuc3Rkb3V0X2xvZ2ZpbGVfbWF4Ynl0ZXM9MFxuc3RkZXJyX2xvZ2ZpbGU9L2Rldi9zdGRlcnJcbnN0ZGVycl9sb2dmaWxlX21heGJ5dGVzPTBcbm51bXByb2NzPTJcbmNvbW1hbmQ9cGhwIGFydGlzYW4gcXVldWU6d29yayAtLXNsZWVwPTMgLS10cmllcz0xIC0tbWVtb3J5PTI1NiAtLXRpbWVvdXQ9MzYwMFxuXG5bZXZlbnRsaXN0ZW5lcjpzaHV0ZG93bl1cbmNvbW1hbmQ9c2h1dGRvd24uc2hcbmV2ZW50cz1QUk9DRVNTX1NUQVRFX1NUT1BQRUQsIFBST0NFU1NfU1RBVEVfRVhJVEVELCBQUk9DRVNTX1NUQVRFX0ZBVEFMXG5zdGRvdXRfbG9nZmlsZT0vZGV2L3N0ZG91dFxuc3Rkb3V0X2xvZ2ZpbGVfbWF4Ynl0ZXM9MFxuc3RkZXJyX2xvZ2ZpbGU9L2Rldi9zdGRlcnJcbnN0ZGVycl9sb2dmaWxlX21heGJ5dGVzPTBcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vcGhwLmluaQogICAgICAgIHRhcmdldDogL3Vzci9sb2NhbC9ldGMvcGhwL3BocC5pbmkKICAgICAgICBjb250ZW50OiAic2Vzc2lvbi5hdXRvX3N0YXJ0ID0gT2ZmXG5zaG9ydF9vcGVuX3RhZyA9IE9mZlxuXG5lcnJvcl9yZXBvcnRpbmcgPSBFX0FMTCAmIH5FX05PVElDRSAmIH5FX1dBUk5JTkcgJiB+RV9TVFJJQ1QgJiB+RV9ERVBSRUNBVEVEXG5cbjsgb3BjYWNoZS5lbmFibGU9MVxuOyBvcGNhY2hlLnByZWxvYWQ9L3Nydi93d3cvaW52b2ljZW5pbmphL2N1cnJlbnQvcHJlbG9hZC5waHBcbjsgb3BjYWNoZS5wcmVsb2FkX3VzZXI9d3d3LWRhdGFcblxuOyA7IFRoZSBPUGNhY2hlIHNoYXJlZCBtZW1vcnkgc3RvcmFnZSBzaXplLlxuOyBvcGNhY2hlLm1heF9hY2NlbGVyYXRlZF9maWxlcz0zMDAwMDBcbjsgb3BjYWNoZS52YWxpZGF0ZV90aW1lc3RhbXBzPTFcbjsgb3BjYWNoZS5yZXZhbGlkYXRlX2ZyZXE9MzBcbjsgb3BjYWNoZS5qaXRfYnVmZmVyX3NpemU9MjU2TVxuOyBvcGNhY2hlLmppdD0xMjA1XG47IG9wY2FjaGUubWVtb3J5X2NvbnN1bXB0aW9uPTEwMjRNXG5cbnBvc3RfbWF4X3NpemUgPSA2ME1cbnVwbG9hZF9tYXhfZmlsZXNpemUgPSA1ME1cbm1lbW9yeV9saW1pdD01MTJNXG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3BocC1jbGkuaW5pCiAgICAgICAgdGFyZ2V0OiAvdXNyL2xvY2FsL2V0Yy9waHAvcGhwLWNsaS5pbmkKICAgICAgICBjb250ZW50OiAic2Vzc2lvbi5hdXRvX3N0YXJ0ID0gT2ZmXG5zaG9ydF9vcGVuX3RhZyA9IE9mZlxuXG5lcnJvcl9yZXBvcnRpbmcgPSBFX0FMTCAmIH5FX05PVElDRSAmIH5FX1dBUk5JTkcgJiB+RV9TVFJJQ1QgJiB+RV9ERVBSRUNBVEVEXG5cbjsgb3BjYWNoZS5lbmFibGVfY2xpPTFcbjsgb3BjYWNoZS5mYXN0X3NodXRkb3duPTFcbjsgb3BjYWNoZS5tZW1vcnlfY29uc3VtcHRpb249MjU2XG47IG9wY2FjaGUuaW50ZXJuZWRfc3RyaW5nc19idWZmZXI9OFxuOyBvcGNhY2hlLm1heF9hY2NlbGVyYXRlZF9maWxlcz00MDAwXG47IG9wY2FjaGUucmV2YWxpZGF0ZV9mcmVxPTYwXG47ICMgaHR0cDovL3N5bWZvbnkuY29tL2RvYy9jdXJyZW50L3BlcmZvcm1hbmNlLmh0bWxcbjsgcmVhbHBhdGhfY2FjaGVfc2l6ZSA9IDQwOTZLXG47IHJlYWxwYXRoX2NhY2hlX3R0bCA9IDYwMFxuXG5tZW1vcnlfbGltaXQgPSAyR1xucG9zdF9tYXhfc2l6ZSA9IDYwTVxudXBsb2FkX21heF9maWxlc2l6ZSA9IDUwTVxuIgogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICdtYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQlJPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke0RCX0RBVEFCQVNFOi1pbnZvaWNlbmluamF9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LWFscGluZScKICAgIGNvbW1hbmQ6ICdyZWRpcy1zZXJ2ZXIgLS1yZXF1aXJlcGFzcyAke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JFRElTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9SRURJU30nCiAgICB2b2x1bWVzOgogICAgICAtICdpbnZvaWNlLW5pbmphLXJlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1Cg==",
-        "tags": [
-            "invoicing",
-            "billing",
-            "accounting",
-            "finance",
-            "self-hosted"
-        ],
-        "category": "finance",
-        "logo": "svgs/invoiceninja.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "9000"
-    },
     "it-tools": {
         "documentation": "https://github.com/corentinth/it-tools?utm_source=coolify.io",
         "slogan": "IT Tools is a self-hosted solution for managing various IT tasks.",
@@ -2752,23 +2366,6 @@
         "template_last_updated_at": "2026-04-24T09:40:01+05:30",
         "port": "80"
     },
-    "joomla-with-mariadb": {
-        "documentation": "https://joomla.org?utm_source=coolify.io",
-        "slogan": "Joomla! is the mobile-ready and user-friendly way to build your website. Choose from thousands of features and designs. Joomla! is free and open source.",
-        "compose": "c2VydmljZXM6CiAgam9vbWxhOgogICAgaW1hZ2U6ICdqb29tbGE6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnam9vbWxhX2RhdGE6L3Zhci93d3cvaHRtbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0pPT01MQQogICAgICAtIEpPT01MQV9EQl9IT1NUPW1hcmlhZGIKICAgICAgLSAnSk9PTUxBX0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfSk9PTUxBfScKICAgICAgLSAnSk9PTUxBX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9KT09NTEF9JwogICAgICAtICdKT09NTEFfREJfTkFNRT0ke01ZU1FMX0RBVEFCQVNFOi1qb29tbGEtZGJ9JwogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2pvb21sYV9tYXJpYWRiX2RhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWpvb21sYS1kYn0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfSk9PTUxBfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pPT01MQX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "mariadb"
-        ],
-        "category": "cms",
-        "logo": "svgs/joomla.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "joplin": {
         "documentation": "https://github.com/laurent22/joplin/blob/dev/packages/server/README.md?utm_source=coolify.io",
         "slogan": "Self-hosted sync server for Joplin",
@@ -2873,20 +2470,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "8080"
     },
-    "kimai": {
-        "documentation": "https://www.kimai.org/?utm_source=coolify.io",
-        "slogan": "Open source time-tracking app.",
-        "compose": "c2VydmljZXM6CiAgbXlzcWw6CiAgICBpbWFnZTogJ215c3FsOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdraW1haS1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWtpbWFpfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgY29tbWFuZDogJy0tZGVmYXVsdC1zdG9yYWdlLWVuZ2luZSBpbm5vZGInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBraW1haToKICAgIGltYWdlOiAna2ltYWkva2ltYWkyOmFwYWNoZScKICAgIGNvbnRhaW5lcl9uYW1lOiBraW1haQogICAgZGVwZW5kc19vbjoKICAgICAgbXlzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2tpbWFpLWRhdGE6L29wdC9raW1haS92YXIvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0tJTUFJXzgwMDEKICAgICAgLSAnQVBQX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfQVBQU0VDUkVUfScKICAgICAgLSAnTUFJTEVSX0ZST009JHtNQUlMRVJfRlJPTTota2ltYWlAZXhhbXBsZS5jb219JwogICAgICAtICdNQUlMRVJfVVJMPSR7TUFJTEVSX1VSTDotbnVsbDovL251bGx9JwogICAgICAtICdBRE1JTk1BSUw9JHtBRE1JTk1BSUw6LWFkbWluQGtpbWFpLmxvY2FsfScKICAgICAgLSAnQURNSU5QQVNTPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTlBBU1N9JwogICAgICAtICdEQVRBQkFTRV9VUkw9bXlzcWw6Ly8ke1NFUlZJQ0VfVVNFUl9NWVNRTH06JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfUBteXNxbC8ke01ZU1FMX0RBVEFCQVNFfT9jaGFyc2V0PXV0ZjhtYjQmc2VydmVyVmVyc2lvbj04LjMuMCcKICAgICAgLSAnVFJVU1RFRF9IT1NUUz0ke1RSVVNURURfSE9TVFN9fGxvY2FsaG9zdHwxMjcuMC4wLjEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAwMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "time-tracking",
-            "open-source"
-        ],
-        "category": "productivity",
-        "logo": "svgs/kimai.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-01-27T21:11:35+01:00",
-        "port": "8001"
-    },
     "kuzzle": {
         "documentation": "https://kuzzle.io?utm_source=coolify.io",
         "slogan": "Kuzzle is a generic backend offering the basic building blocks common to every application.",
@@ -2978,27 +2561,9 @@
         "category": "ai",
         "logo": "svgs/langfuse.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-23T18:08:40+02:00",
+        "template_last_updated_at": "2026-10-19T17:18:16+02:00",
         "port": "3000"
     },
-    "leantime": {
-        "documentation": "https://leantime.io?utm_source=coolify.io",
-        "slogan": "Leantime is a goals focused project management system for non-project managers.",
-        "compose": "c2VydmljZXM6CiAgbGVhbnRpbWU6CiAgICBpbWFnZTogJ2xlYW50aW1lL2xlYW50aW1lOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0xFQU5USU1FXzgwODAKICAgICAgLSAnTEVBTl9BUFBfVVJMPSR7U0VSVklDRV9VUkxfTEVBTlRJTUV9JwogICAgICAtIExFQU5fREJfSE9TVD1teXNxbAogICAgICAtICdMRUFOX0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUxEQn0nCiAgICAgIC0gJ0xFQU5fREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMREJ9JwogICAgICAtICdMRUFOX0RCX0RBVEFCQVNFPSR7REJfTkFNRTotbGVhbnRpbWUtZGJ9JwogICAgICAtICdMRUFOX1NFU1NJT05fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1NBTFR9JwogICAgICAtICdMRUFOX1NFU1NJT05fRVhQSVJBVElPTj0ke1NFU1NJT05fRVhQSVJBVElPTjotMjg4MDB9JwogICAgICAtICdMRUFOX1VTRV9SRURJUz0ke1VTRV9SRURJUzotdHJ1ZX0nCiAgICAgIC0gTEVBTl9SRURJU19IT1NUPXJlZGlzCiAgICAgIC0gJ0xFQU5fUkVESVNfUE9SVD0ke1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdMRUFOX1JFRElTX1NDSEVNRT0ke1JFRElTX1NDSEVNRTotdGNwfScKICAgIGRlcGVuZHNfb246CiAgICAgIG15c3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICB2b2x1bWVzOgogICAgICAtICdwdWJsaWMtdXNlcmZpbGVzOi92YXIvd3d3L2h0bWwvcHVibGljL3VzZXJmaWxlcycKICAgICAgLSAndXNlcmZpbGVzOi92YXIvd3d3L2h0bWwvdXNlcmZpbGVzJwogICAgICAtICdwbHVnaW5zOi92YXIvd3d3L2h0bWwvYXBwL1BsdWdpbnMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIG15c3FsOgogICAgaW1hZ2U6ICdteXNxbDo4LjQnCiAgICB2b2x1bWVzOgogICAgICAtICdsZWFudGltZV9teXNxbF9kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUxEQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTERCfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtEQl9OQU1FOi1sZWFudGltZS1kYn0nCiAgICBjb21tYW5kOiAnLS1jaGFyYWN0ZXItc2V0LXNlcnZlcj1VVEY4TUI0IC0tY29sbGF0aW9uLXNlcnZlcj1VVEY4TUI0X3VuaWNvZGVfY2knCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gbG9jYWxob3N0CiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOiAncmVkaXMtc2VydmVyIC0tYXBwZW5kb25seSB5ZXMnCiAgICB2b2x1bWVzOgogICAgICAtICdsZWFudGltZV9yZWRpc19kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
-        "tags": [
-            "project management",
-            "productivity",
-            "php",
-            "mysql",
-            "laravel",
-            "open source"
-        ],
-        "category": "productivity",
-        "logo": "svgs/leantime.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "8080"
-    },
     "librechat": {
         "documentation": "https://docs.librechat.ai/install/configuration/dotenv.html?utm_source=coolify.io",
         "slogan": "Self-hosted, powerful, and privacy-focused chat UI for multiple AI models",
@@ -3039,20 +2604,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "3000"
     },
-    "librespeed": {
-        "documentation": "https://github.com/librespeed/speedtest?utm_source=coolify.io",
-        "slogan": "Self-hosted lightweight Speed Test.",
-        "compose": "c2VydmljZXM6CiAgbGlicmVzcGVlZDoKICAgIGNvbnRhaW5lcl9uYW1lOiBsaWJyZXNwZWVkCiAgICBpbWFnZTogJ2doY3IuaW8vbGlicmVzcGVlZC9zcGVlZHRlc3Q6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTElCUkVTUEVFRF84MgogICAgICAtIE1PREU9c3RhbmRhbG9uZQogICAgICAtIFRFTEVNRVRSWT1mYWxzZQogICAgICAtIERJU1RBTkNFPWttCiAgICAgIC0gV0VCUE9SVD04MgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdjdXJsIDEyNy4wLjAuMTo4MiB8fCBleGl0IDEnCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIGludGVydmFsOiAxbTBzCiAgICAgIHJldHJpZXM6IDEK",
-        "tags": [
-            "speedtest",
-            "internet-speed"
-        ],
-        "category": "devtools",
-        "logo": "svgs/librespeed.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-02-25T23:48:15Z",
-        "port": "82"
-    },
     "libretranslate": {
         "documentation": "https://libretranslate.com/docs/?utm_source=coolify.io",
         "slogan": "Free and open-source machine translation API, entirely self-hosted.",
@@ -3067,22 +2618,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "5000"
     },
-    "limesurvey": {
-        "documentation": "https://www.limesurvey.org/manual/?utm_source=coolify.io",
-        "slogan": "Simple, quick and anonymous online survey tool that's bursting with juicy insights.",
-        "compose": "c2VydmljZXM6CiAgbGltZXN1cnZleToKICAgIGltYWdlOiAnYWRhbXphbW1pdC9saW1lc3VydmV5OmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0xJTUVTVVJWRVlfODAKICAgICAgLSBMSU1FU1VSVkVZX0RCX0hPU1Q9bWFyaWFkYgogICAgICAtICdMSU1FU1VSVkVZX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfREJfTkFNRT0ke01ZU1FMX0RBVEFCQVNFOi1saW1lc3VydmV5LWRifScKICAgICAgLSAnTElNRVNVUlZFWV9BRE1JTl9VU0VSPSR7TElNRVNVUlZFWV9BRE1JTl9VU0VSOi1hZG1pbn0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnTElNRVNVUlZFWV9BRE1JTl9OQU1FPSR7TElNRVNVUlZFWV9BRE1JTl9OQU1FOi1BZG1pbn0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfQURNSU5fRU1BSUw9JHtMSU1FU1VSVkVZX0FETUlOX0VNQUlMOi1hZG1pbkBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfRlJPTV9FTUFJTD0ke0xJTUVTVVJWRVlfRlJPTV9FTUFJTH0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfU01UUF9IT1NUPSR7TElNRVNVUlZFWV9TTVRQX0hPU1R9JwogICAgICAtICdMSU1FU1VSVkVZX1NNVFBfVVNFUj0ke0xJTUVTVVJWRVlfU01UUF9VU0VSfScKICAgICAgLSAnTElNRVNVUlZFWV9TTVRQX1BBU1NXT1JEPSR7TElNRVNVUlZFWV9TTVRQX1BBU1NXT1JEfScKICAgICAgLSAnTElNRVNVUlZFWV9TTVRQX1NTTD0ke0xJTUVTVVJWRVlfU01UUF9TU0x9JwogICAgICAtIExJTUVTVVJWRVlfUEhQX1NFU1NJT05fU0FWRV9IQU5ETEVSPXJlZGlzCiAgICAgIC0gJ0xJTUVTVVJWRVlfUEhQX1NFU1NJT05fU0FWRV9QQVRIPXRjcDovL3JlZGlzOjYzNzknCiAgICAgIC0gJ1RaPSR7VFo6LUFtZXJpY2EvSmFtYWljYX0nCiAgICB2b2x1bWVzOgogICAgICAtICdsaW1lc3VydmV5X3BsdWdpbnNfZGF0YTovdmFyL3d3dy9odG1sL3BsdWdpbnMnCiAgICAgIC0gJ2xpbWVzdXJ2ZXlfdXBsb2FkX2RhdGE6L3Zhci93d3cvaHRtbC91cGxvYWQnCiAgICAgIC0gJ2xpbWVzdXJ2ZXlfY29uZmlnX2RhdGE6L3Zhci93d3cvaHRtbC9hcHBsaWNhdGlvbi9jb25maWcnCiAgICAgIC0gJ2xpbWVzdXJ2ZXlfc2Vzc2lvbnNfZGF0YTovdmFyL2xpbWUvc2Vzc2lvbnMnCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1saW1lc3VydmV5LWRifScKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2xpbWVzdXJ2ZXlfbWFyaWFkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjctYWxwaW5lJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogM3MKICAgICAgcmV0cmllczogMwo=",
-        "tags": [
-            "online survey",
-            "forms",
-            "no code",
-            "open source"
-        ],
-        "category": "productivity",
-        "logo": "svgs/limesurvey.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "linkding-plus": {
         "documentation": "https://linkding.link/?utm_source=coolify.io",
         "slogan": "A self-hosted bookmark manager designed to be minimal, fast, and easy to set up. (Includes feature for archiving websites as HTML snapshots)",
@@ -3147,7 +2682,7 @@
     "litellm": {
         "documentation": "https://docs.litellm.ai?utm_source=coolify.io",
         "slogan": "Call all LLM APIs using the OpenAI format. Use Bedrock, Azure, OpenAI, Cohere, Anthropic, Ollama, Sagemaker, HuggingFace, Replicate, Groq (100+ LLMs)",
-        "compose": "c2VydmljZXM6CiAgbGl0ZWxsbToKICAgIGltYWdlOiAnZ2hjci5pby9iZXJyaWFpL2xpdGVsbG0tZGF0YWJhc2U6bWFpbi1zdGFibGUnCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTElURUxMTV80MDAwCiAgICAgIC0gJ0xJVEVMTE1fTE9HPSR7TElURUxMTV9MT0c6LUVSUk9SfScKICAgICAgLSAnTElURUxMTV9NT0RFPSR7TElURUxMTV9NT0RFOi1QUk9EVUNUSU9OfScKICAgICAgLSAnTElURUxMTV9NQVNURVJfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NQVNURVJLRVl9JwogICAgICAtICdVSV9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9VSX0nCiAgICAgIC0gJ1VJX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9VSX0nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3Jlc3FsOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1saXRlbGxtfScKICAgICAgLSAnUkVESVNfSE9TVD0ke1JFRElTX0hPU1Q6LXJlZGlzfScKICAgICAgLSAnUkVESVNfUE9SVD0ke1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbGl0ZWxsbX0nCiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7T1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdPUEVOQUlfQVBJX0JBU0U9JHtPUEVOQUlfQVBJX0JBU0V9JwogICAgICAtICdBTlRIUk9QSUNfQVBJX0tFWT0ke0FOVEhST1BJQ19BUElfS0VZfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9CQVNFPSR7QU5USFJPUElDX0FQSV9CQVNFfScKICAgICAgLSAnVk9ZQUdFX0FQSV9LRVk9JHtWT1lBR0VfQVBJX0tFWX0nCiAgICAgIC0gJ1ZPWUFHRV9BUElfQkFTRT0ke1ZPWUFHRV9BUElfQkFTRX0nCiAgICAgIC0gJ1NUT1JFX01PREVMX0lOX0RCPSR7U1RPUkVfTU9ERUxfSU5fREJ9JwogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vbGl0ZWxsbS1jb25maWcueWFtbAogICAgICAgIHRhcmdldDogL2FwcC9jb25maWcueWFtbAogICAgICAgIGNvbnRlbnQ6ICJnZW5lcmFsX3NldHRpbmdzOlxuICBwcm94eV9iYXRjaF93cml0ZV9hdDogNjBcbiAgc3RvcmVfcHJvbXB0c19pbl9zcGVuZF9sb2dzOiBmYWxzZVxuXG5yb3V0ZXJfc2V0dGluZ3M6XG4gIHJlZGlzX2hvc3Q6IG9zLmVudmlyb24vUkVESVNfSE9TVFxuICByZWRpc19wb3J0OiBvcy5lbnZpcm9uL1JFRElTX1BPUlRcbiAgcmVkaXNfcGFzc3dvcmQ6IG9zLmVudmlyb24vUkVESVNfUEFTU1dPUkRcbiAgZW5hYmxlX3ByZV9jYWxsX2NoZWNrOiB0cnVlXG5cbmxpdGVsbG1fc2V0dGluZ3M6XG4gIHNldF92ZXJib3NlOiBmYWxzZVxuICBqc29uX2xvZ3M6IHRydWVcbiAgbG9nX3Jhd19yZXF1ZXN0X3Jlc3BvbnNlOiBmYWxzZVxuICAjIHR1cm5fb2ZmX21lc3NhZ2VfbG9nZ2luZzogZmFsc2VcbiAgIyByZWRhY3RfdXNlcl9hcGlfa2V5X2luZm86IGZhbHNlXG4gIHNlcnZpY2VfY2FsbGJhY2s6IFtcInByb21ldGhldXNfc3lzdGVtXCJdXG4gIGRyb3BfcGFyYW1zOiB0cnVlXG4gICMgbWF4X2J1ZGdldDogMTAwXG4gICMgYnVkZ2V0X2R1cmF0aW9uOiAzMGRcbiAgbnVtX3JldHJpZXM6IDFcbiAgcmVxdWVzdF90aW1lb3V0OiAxMjBcbiAgdGVsZW1ldHJ5OiBmYWxzZVxuICBjYWNoZTogdHJ1ZVxuICBjYWNoZV9wYXJhbXM6XG4gICAgdHlwZTogcmVkaXNcbiAgICBob3N0OiBvcy5lbnZpcm9uL1JFRElTX0hPU1RcbiAgICBwb3J0OiBvcy5lbnZpcm9uL1JFRElTX1BPUlRcbiAgICBwYXNzd29yZDogb3MuZW52aXJvbi9SRURJU19QQVNTV09SRFxuICAgIG5hbWVzcGFjZTogXCJsaXRlbGxtX2NhY2hlXCJcbiAgICB0dGw6IDYwMFxuICBzdWNjZXNzX2NhbGxiYWNrOlxuICAgICMgLSBcImxhbmdmdXNlXCJcbiAgICAtIFwicHJvbWV0aGV1c1wiXG4gIGZhaWx1cmVfY2FsbGJhY2s6XG4gICAgIyAtIFwibGFuZ2Z1c2VcIlxuICAgIC0gXCJwcm9tZXRoZXVzXCJcbm1vZGVsX2xpc3Q6XG4gICMgT3BlbkFJXG4gIC0gbW9kZWxfbmFtZTogZ3B0LTRcbiAgICBsaXRlbGxtX3BhcmFtczpcbiAgICAgIG1vZGVsOiBvcGVuYWkvZ3B0LTRcbiAgICAgIGFwaV9rZXk6IG9zLmVudmlyb24vT1BFTkFJX0FQSV9LRVlcbiAgICAgIGFwaV9iYXNlOiBvcy5lbnZpcm9uL09QRU5BSV9BUElfQkFTRVxuICAtIG1vZGVsX25hbWU6IGdwdC00b1xuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IG9wZW5haS9ncHQtNG9cbiAgICAgIGFwaV9rZXk6IG9zLmVudmlyb24vT1BFTkFJX0FQSV9LRVlcbiAgICAgIGFwaV9iYXNlOiBvcy5lbnZpcm9uL09QRU5BSV9BUElfQkFTRVxuICAtIG1vZGVsX25hbWU6IGdwdC00by1taW5pXG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogb3BlbmFpL2dwdC00by1taW5pXG4gICAgICBhcGlfa2V5OiBvcy5lbnZpcm9uL09QRU5BSV9BUElfS0VZXG4gICAgICBhcGlfYmFzZTogb3MuZW52aXJvbi9PUEVOQUlfQVBJX0JBU0VcbiAgIyBBbnRocm9waWNcbiAgLSBtb2RlbF9uYW1lOiBjbGF1ZGUtMy1oYWlrdVxuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IGNsYXVkZS0zLWhhaWt1LTIwMjQwMzA3XG4gICAgICBhcGlfa2V5OiBcIm9zLmVudmlyb24vQU5USFJPUElDX0FQSV9LRVlcIlxuICAgICAgYXBpX2Jhc2U6IFwib3MuZW52aXJvbi9BTlRIUk9QSUNfQVBJX0JBU0VcIlxuICAtIG1vZGVsX25hbWU6IGNsYXVkZS0zLjUtc29ubmV0XG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogY2xhdWRlLTMtNS1zb25uZXQtMjAyNDA2MjBcbiAgICAgIGFwaV9rZXk6IFwib3MuZW52aXJvbi9BTlRIUk9QSUNfQVBJX0tFWVwiXG4gICAgICBhcGlfYmFzZTogXCJvcy5lbnZpcm9uL0FOVEhST1BJQ19BUElfQkFTRVwiXG4gICMgVm95YWdlQUlcbiAgLSBtb2RlbF9uYW1lOiB2b3lhZ2UtbGF3LTJcbiAgICBtb2RlbF9pbmZvOlxuICAgICAgb3V0cHV0X3ZlY3Rvcl9zaXplOiAxMDI0XG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogdm95YWdlL3ZveWFnZS1sYXctMlxuICAgICAgYXBpX2tleTogXCJvcy5lbnZpcm9uL1ZPWUFHRV9BUElfS0VZXCJcbiAgICAgIGFwaV9iYXNlOiBcIm9zLmVudmlyb24vVk9ZQUdFX0FQSV9CQVNFXCJcbiAgICAgICMgcnBtOiAzMDBcbiAgICAgICMgdHBtOiAxMDAwMDAwXG4gIC0gbW9kZWxfbmFtZTogdm95YWdlLW11bHRpbGluZ3VhbC0yXG4gICAgbW9kZWxfaW5mbzpcbiAgICAgIG1vZGU6IGVtYmVkZGluZ1xuICAgICAgbWF4X3Rva2VuczogMzIwMDBcbiAgICAgIG1heF9pbnB1dF90b2tlbnM6IDMyMDAwXG4gICAgICBvdXRwdXRfdmVjdG9yX3NpemU6IDEwMjRcbiAgICBsaXRlbGxtX3BhcmFtczpcbiAgICAgIG1vZGVsOiB2b3lhZ2Uvdm95YWdlLW11bHRpbGluZ3VhbC0yXG4gICAgICBhcGlfa2V5OiBcIm9zLmVudmlyb24vVk9ZQUdFX0FQSV9LRVlcIlxuICAgICAgYXBpX2Jhc2U6IFwib3MuZW52aXJvbi9WT1lBR0VfQVBJX0JBU0VcIlxuICAgICAgaW5wdXRfY29zdF9wZXJfdG9rZW46IDAuMDAwMDAwMTJcbiAgICAgIG91dHB1dF9jb3N0X3Blcl90b2tlbjogMFxuICAgICAgIyBycG06IDMwMFxuICAgICAgIyB0cG06IDEwMDAwMDAiCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcHl0aG9uCiAgICAgICAgLSAnLWMnCiAgICAgICAgLSAiaW1wb3J0IHVybGxpYi5yZXF1ZXN0O3VybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgvbGl2ZWxpbmVzcycsdGltZW91dD01KSIKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCiAgICBjb21tYW5kOgogICAgICAtICctLWNvbmZpZycKICAgICAgLSAvYXBwL2NvbmZpZy55YW1sCiAgICAgIC0gJy0tcG9ydCcKICAgICAgLSAnNDAwMCcKICAgICAgLSAnLS1udW1fd29ya2VycycKICAgICAgLSAnMicKICAgICAgLSAnLS1ydW5fZ3VuaWNvcm4nCiAgICAgIC0gJy0tbWF4X3JlcXVlc3RzX2JlZm9yZV9yZXN0YXJ0JwogICAgICAtICcxMDAwJwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbGl0ZWxsbX0nCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSBQT1NUR1JFU19VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3BnLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1oIGxvY2FsaG9zdCAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjctYWxwaW5lJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLWFwcGVuZG9ubHkgeWVzJwogICAgdm9sdW1lczoKICAgICAgLSAncmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMK",
+        "compose": "c2VydmljZXM6CiAgbGl0ZWxsbToKICAgIGltYWdlOiAnZ2hjci5pby9iZXJyaWFpL2xpdGVsbG0tZGF0YWJhc2U6bWFpbi1zdGFibGUnCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTElURUxMTV80MDAwCiAgICAgIC0gJ0xJVEVMTE1fTE9HPSR7TElURUxMTV9MT0c6LUVSUk9SfScKICAgICAgLSAnTElURUxMTV9NT0RFPSR7TElURUxMTV9NT0RFOi1QUk9EVUNUSU9OfScKICAgICAgLSAnTElURUxMTV9NQVNURVJfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NQVNURVJLRVl9JwogICAgICAtICdVSV9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9VSX0nCiAgICAgIC0gJ1VJX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9VSX0nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3Jlc3FsOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1saXRlbGxtfScKICAgICAgLSAnUkVESVNfSE9TVD0ke1JFRElTX0hPU1Q6LXJlZGlzfScKICAgICAgLSAnUkVESVNfUE9SVD0ke1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbGl0ZWxsbX0nCiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7T1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdPUEVOQUlfQVBJX0JBU0U9JHtPUEVOQUlfQVBJX0JBU0V9JwogICAgICAtICdBTlRIUk9QSUNfQVBJX0tFWT0ke0FOVEhST1BJQ19BUElfS0VZfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9CQVNFPSR7QU5USFJPUElDX0FQSV9CQVNFfScKICAgICAgLSAnVk9ZQUdFX0FQSV9LRVk9JHtWT1lBR0VfQVBJX0tFWX0nCiAgICAgIC0gJ1ZPWUFHRV9BUElfQkFTRT0ke1ZPWUFHRV9BUElfQkFTRX0nCiAgICAgIC0gJ1NUT1JFX01PREVMX0lOX0RCPSR7U1RPUkVfTU9ERUxfSU5fREJ9JwogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vbGl0ZWxsbS1jb25maWcueWFtbAogICAgICAgIHRhcmdldDogL2FwcC9jb25maWcueWFtbAogICAgICAgIGNvbnRlbnQ6ICJnZW5lcmFsX3NldHRpbmdzOlxuICBwcm94eV9iYXRjaF93cml0ZV9hdDogNjBcbiAgc3RvcmVfcHJvbXB0c19pbl9zcGVuZF9sb2dzOiBmYWxzZVxuXG5yb3V0ZXJfc2V0dGluZ3M6XG4gIHJlZGlzX2hvc3Q6IG9zLmVudmlyb24vUkVESVNfSE9TVFxuICByZWRpc19wb3J0OiBvcy5lbnZpcm9uL1JFRElTX1BPUlRcbiAgcmVkaXNfcGFzc3dvcmQ6IG9zLmVudmlyb24vUkVESVNfUEFTU1dPUkRcbiAgZW5hYmxlX3ByZV9jYWxsX2NoZWNrOiB0cnVlXG5cbmxpdGVsbG1fc2V0dGluZ3M6XG4gIHNldF92ZXJib3NlOiBmYWxzZVxuICBqc29uX2xvZ3M6IHRydWVcbiAgbG9nX3Jhd19yZXF1ZXN0X3Jlc3BvbnNlOiBmYWxzZVxuICAjIHR1cm5fb2ZmX21lc3NhZ2VfbG9nZ2luZzogZmFsc2VcbiAgIyByZWRhY3RfdXNlcl9hcGlfa2V5X2luZm86IGZhbHNlXG4gIHNlcnZpY2VfY2FsbGJhY2s6IFtcInByb21ldGhldXNfc3lzdGVtXCJdXG4gIGRyb3BfcGFyYW1zOiB0cnVlXG4gICMgbWF4X2J1ZGdldDogMTAwXG4gICMgYnVkZ2V0X2R1cmF0aW9uOiAzMGRcbiAgbnVtX3JldHJpZXM6IDFcbiAgcmVxdWVzdF90aW1lb3V0OiAxMjBcbiAgdGVsZW1ldHJ5OiBmYWxzZVxuICBjYWNoZTogdHJ1ZVxuICBjYWNoZV9wYXJhbXM6XG4gICAgdHlwZTogcmVkaXNcbiAgICBob3N0OiBvcy5lbnZpcm9uL1JFRElTX0hPU1RcbiAgICBwb3J0OiBvcy5lbnZpcm9uL1JFRElTX1BPUlRcbiAgICBwYXNzd29yZDogb3MuZW52aXJvbi9SRURJU19QQVNTV09SRFxuICAgIG5hbWVzcGFjZTogXCJsaXRlbGxtX2NhY2hlXCJcbiAgICB0dGw6IDYwMFxuICBzdWNjZXNzX2NhbGxiYWNrOlxuICAgICMgLSBcImxhbmdmdXNlXCJcbiAgICAtIFwicHJvbWV0aGV1c1wiXG4gIGZhaWx1cmVfY2FsbGJhY2s6XG4gICAgIyAtIFwibGFuZ2Z1c2VcIlxuICAgIC0gXCJwcm9tZXRoZXVzXCJcbm1vZGVsX2xpc3Q6XG4gICMgT3BlbkFJXG4gIC0gbW9kZWxfbmFtZTogZ3B0LTRcbiAgICBsaXRlbGxtX3BhcmFtczpcbiAgICAgIG1vZGVsOiBvcGVuYWkvZ3B0LTRcbiAgICAgIGFwaV9rZXk6IG9zLmVudmlyb24vT1BFTkFJX0FQSV9LRVlcbiAgICAgIGFwaV9iYXNlOiBvcy5lbnZpcm9uL09QRU5BSV9BUElfQkFTRVxuICAtIG1vZGVsX25hbWU6IGdwdC00b1xuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IG9wZW5haS9ncHQtNG9cbiAgICAgIGFwaV9rZXk6IG9zLmVudmlyb24vT1BFTkFJX0FQSV9LRVlcbiAgICAgIGFwaV9iYXNlOiBvcy5lbnZpcm9uL09QRU5BSV9BUElfQkFTRVxuICAtIG1vZGVsX25hbWU6IGdwdC00by1taW5pXG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogb3BlbmFpL2dwdC00by1taW5pXG4gICAgICBhcGlfa2V5OiBvcy5lbnZpcm9uL09QRU5BSV9BUElfS0VZXG4gICAgICBhcGlfYmFzZTogb3MuZW52aXJvbi9PUEVOQUlfQVBJX0JBU0VcbiAgIyBBbnRocm9waWNcbiAgLSBtb2RlbF9uYW1lOiBjbGF1ZGUtMy1oYWlrdVxuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IGNsYXVkZS0zLWhhaWt1LTIwMjQwMzA3XG4gICAgICBhcGlfa2V5OiBcIm9zLmVudmlyb24vQU5USFJPUElDX0FQSV9LRVlcIlxuICAgICAgYXBpX2Jhc2U6IFwib3MuZW52aXJvbi9BTlRIUk9QSUNfQVBJX0JBU0VcIlxuICAtIG1vZGVsX25hbWU6IGNsYXVkZS0zLjUtc29ubmV0XG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogY2xhdWRlLTMtNS1zb25uZXQtMjAyNDA2MjBcbiAgICAgIGFwaV9rZXk6IFwib3MuZW52aXJvbi9BTlRIUk9QSUNfQVBJX0tFWVwiXG4gICAgICBhcGlfYmFzZTogXCJvcy5lbnZpcm9uL0FOVEhST1BJQ19BUElfQkFTRVwiXG4gICMgVm95YWdlQUlcbiAgLSBtb2RlbF9uYW1lOiB2b3lhZ2UtbGF3LTJcbiAgICBtb2RlbF9pbmZvOlxuICAgICAgb3V0cHV0X3ZlY3Rvcl9zaXplOiAxMDI0XG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogdm95YWdlL3ZveWFnZS1sYXctMlxuICAgICAgYXBpX2tleTogXCJvcy5lbnZpcm9uL1ZPWUFHRV9BUElfS0VZXCJcbiAgICAgIGFwaV9iYXNlOiBcIm9zLmVudmlyb24vVk9ZQUdFX0FQSV9CQVNFXCJcbiAgICAgICMgcnBtOiAzMDBcbiAgICAgICMgdHBtOiAxMDAwMDAwXG4gIC0gbW9kZWxfbmFtZTogdm95YWdlLW11bHRpbGluZ3VhbC0yXG4gICAgbW9kZWxfaW5mbzpcbiAgICAgIG1vZGU6IGVtYmVkZGluZ1xuICAgICAgbWF4X3Rva2VuczogMzIwMDBcbiAgICAgIG1heF9pbnB1dF90b2tlbnM6IDMyMDAwXG4gICAgICBvdXRwdXRfdmVjdG9yX3NpemU6IDEwMjRcbiAgICBsaXRlbGxtX3BhcmFtczpcbiAgICAgIG1vZGVsOiB2b3lhZ2Uvdm95YWdlLW11bHRpbGluZ3VhbC0yXG4gICAgICBhcGlfa2V5OiBcIm9zLmVudmlyb24vVk9ZQUdFX0FQSV9LRVlcIlxuICAgICAgYXBpX2Jhc2U6IFwib3MuZW52aXJvbi9WT1lBR0VfQVBJX0JBU0VcIlxuICAgICAgaW5wdXRfY29zdF9wZXJfdG9rZW46IDAuMDAwMDAwMTJcbiAgICAgIG91dHB1dF9jb3N0X3Blcl90b2tlbjogMFxuICAgICAgIyBycG06IDMwMFxuICAgICAgIyB0cG06IDEwMDAwMDBcbiIKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBweXRob24KICAgICAgICAtICctYycKICAgICAgICAtICJpbXBvcnQgdXJsbGliLnJlcXVlc3Q7dXJsbGliLnJlcXVlc3QudXJsb3BlbignaHR0cDovLzEyNy4wLjAuMTo0MDAwL2hlYWx0aC9saXZlbGluZXNzJyx0aW1lb3V0PTUpIgogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAzMHMKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy0tY29uZmlnJwogICAgICAtIC9hcHAvY29uZmlnLnlhbWwKICAgICAgLSAnLS1wb3J0JwogICAgICAtICc0MDAwJwogICAgICAtICctLW51bV93b3JrZXJzJwogICAgICAtICcyJwogICAgICAtICctLXJ1bl9ndW5pY29ybicKICAgICAgLSAnLS1tYXhfcmVxdWVzdHNfYmVmb3JlX3Jlc3RhcnQnCiAgICAgIC0gJzEwMDAnCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1saXRlbGxtfScKICAgICAgLSBQT1NUR1JFU19QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtIFBPU1RHUkVTX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgdm9sdW1lczoKICAgICAgLSAncGctZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLWggbG9jYWxob3N0IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOiAncmVkaXMtc2VydmVyIC0tYXBwZW5kb25seSB5ZXMnCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "ai",
             "qdrant",
@@ -3299,7 +2834,7 @@
     "matrix-synapse-with-sqlite": {
         "documentation": "https://element-hq.github.io/synapse/latest/welcome_and_overview.html?utm_source=coolify.io",
         "slogan": "Chat securely with your family, friends, community, or build great apps with Matrix!",
-        "compose": "c2VydmljZXM6CiAgc3luYXBzZToKICAgIGltYWdlOiAnbWF0cml4ZG90b3JnL3N5bmFwc2U6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfU1lOQVBTRV84MDA4CiAgICAgIC0gJ1NZTkFQU0VfU0VSVkVSX05BTUU9JHtTWU5BUFNFX1NFUlZFUl9OQU1FOj99JwogICAgICAtICdTWU5BUFNFX1JFUE9SVF9TVEFUUz0ke1NZTkFQU0VfUkVQT1JUX1NUQVRTOi1ub30nCiAgICAgIC0gJ0VOQUJMRV9SRUdJU1RSQVRJT049JHtFTkFCTEVfUkVHSVNUUkFUSU9OOi1mYWxzZX0nCiAgICAgIC0gJ1NFUlZJQ0VfVVNFUl9BRE1JTj0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ1NFUlZJQ0VfUEFTU1dPUkRfQURNSU49JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3N5bmFwc2UtZGF0YTovZGF0YScKICAgIGVudHJ5cG9pbnQ6IC9iaW4vYmFzaAogICAgY29tbWFuZDoKICAgICAgLSAnLWMnCiAgICAgIC0gIiMgR2VuZXJhdGUgY29uZmlnIG9uIGZpcnN0IHJ1blxuaWYgWyAhIC1mIC9kYXRhL2hvbWVzZXJ2ZXIueWFtbCBdOyB0aGVuXG4gICMgR2VuZXJhdGUgZGVmYXVsdCBjb25maWcgdXNpbmcgU1lOQVBTRV9TRVJWRVJfTkFNRSAocGVybWFuZW50LCB1c2VkIGluIHVzZXIgSURzKVxuICAvc3RhcnQucHkgZ2VuZXJhdGVcblxuICAjIFNldCBwdWJsaWNfYmFzZXVybCB0byBhY3R1YWwgZGVwbG95bWVudCBVUkwgKG1heSBkaWZmZXIgZnJvbSBzZXJ2ZXJfbmFtZSlcbiAgIyBUaGlzIGFsbG93cyBob3N0aW5nIGF0IG1hdHJpeC5leGFtcGxlLm9yZyB3aGlsZSBzZXJ2ZXJfbmFtZSBpcyBleGFtcGxlLm9yZ1xuICBpZiAhIGdyZXAgLXEgXCJwdWJsaWNfYmFzZXVybFwiIC9kYXRhL2hvbWVzZXJ2ZXIueWFtbDsgdGhlblxuICAgIHNlZCAtaSBcIi9ec2VydmVyX25hbWU6L2EgcHVibGljX2Jhc2V1cmw6ICR7U0VSVklDRV9VUkxfU1lOQVBTRX0vXCIgL2RhdGEvaG9tZXNlcnZlci55YW1sXG4gIGZpXG5cbiAgIyBDb25maWd1cmUgbGlzdGVuZXIgZm9yIHJldmVyc2UgcHJveHlcbiAgc2VkIC1pICdzL2JpbmRfYWRkcmVzc2VzOiBcXFsuKlxcXS9iaW5kX2FkZHJlc3NlczogW1wiMC4wLjAuMFwiXS8nIC9kYXRhL2hvbWVzZXJ2ZXIueWFtbFxuICBzZWQgLWkgJy94X2ZvcndhcmRlZDovZCcgL2RhdGEvaG9tZXNlcnZlci55YW1sXG4gIHNlZCAtaSAnL3R5cGU6IGh0dHAvYSBcXCAgICB4X2ZvcndhcmRlZDogdHJ1ZScgL2RhdGEvaG9tZXNlcnZlci55YW1sXG5cbiAgIyBFbmFibGUgcmVnaXN0cmF0aW9uIGlmIHJlcXVlc3RlZFxuICBpZiBbIFwiJHtFTkFCTEVfUkVHSVNUUkFUSU9OfVwiID0gXCJ0cnVlXCIgXSAmJiAhIGdyZXAgLXEgXCJlbmFibGVfcmVnaXN0cmF0aW9uXCIgL2RhdGEvaG9tZXNlcnZlci55YW1sOyB0aGVuXG4gICAgZWNobyBcImVuYWJsZV9yZWdpc3RyYXRpb246IHRydWVcIiA+PiAvZGF0YS9ob21lc2VydmVyLnlhbWxcbiAgZmlcbmZpXG5cbiMgUmVnaXN0ZXIgYWRtaW4gdXNlciBpZiBjcmVkZW50aWFscyBwcm92aWRlZFxuaWYgWyAtbiBcIiR7U0VSVklDRV9VU0VSX0FETUlOfVwiIF0gJiYgWyAtbiBcIiR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn1cIiBdOyB0aGVuXG4gIChcbiAgICB3aGlsZSAhIGN1cmwgLXNmIGh0dHA6Ly9sb2NhbGhvc3Q6ODAwOC9oZWFsdGggPiAvZGV2L251bGwgMj4mMTsgZG9cbiAgICAgIHNsZWVwIDJcbiAgICBkb25lXG4gICAgcmVnaXN0ZXJfbmV3X21hdHJpeF91c2VyIC1hIFxcXG4gICAgICAtdSBcIiR7U0VSVklDRV9VU0VSX0FETUlOfVwiIFxcXG4gICAgICAtcCBcIiR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn1cIiBcXFxuICAgICAgLWMgL2RhdGEvaG9tZXNlcnZlci55YW1sIFxcXG4gICAgICBodHRwOi8vbG9jYWxob3N0OjgwMDggMj4vZGV2L251bGwgfHwgdHJ1ZVxuICApICZcbmZpXG5cbmV4ZWMgL3N0YXJ0LnB5XG4iCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODAwOC9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAyMHMK",
+        "compose": "c2VydmljZXM6CiAgc3luYXBzZToKICAgIGltYWdlOiAnbWF0cml4ZG90b3JnL3N5bmFwc2U6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfU1lOQVBTRV84MDA4CiAgICAgIC0gJ1NZTkFQU0VfU0VSVkVSX05BTUU9JHtTWU5BUFNFX1NFUlZFUl9OQU1FOj99JwogICAgICAtICdTWU5BUFNFX1JFUE9SVF9TVEFUUz0ke1NZTkFQU0VfUkVQT1JUX1NUQVRTOi1ub30nCiAgICAgIC0gJ0VOQUJMRV9SRUdJU1RSQVRJT049JHtFTkFCTEVfUkVHSVNUUkFUSU9OOi1mYWxzZX0nCiAgICAgIC0gJ1NFUlZJQ0VfVVNFUl9BRE1JTj0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ1NFUlZJQ0VfUEFTU1dPUkRfQURNSU49JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3N5bmFwc2UtZGF0YTovZGF0YScKICAgIGVudHJ5cG9pbnQ6IC9iaW4vYmFzaAogICAgY29tbWFuZDoKICAgICAgLSAnLWMnCiAgICAgIC0gIiMgR2VuZXJhdGUgY29uZmlnIG9uIGZpcnN0IHJ1blxuaWYgWyAhIC1mIC9kYXRhL2hvbWVzZXJ2ZXIueWFtbCBdOyB0aGVuXG4gICMgR2VuZXJhdGUgZGVmYXVsdCBjb25maWcgdXNpbmcgU1lOQVBTRV9TRVJWRVJfTkFNRSAocGVybWFuZW50LCB1c2VkIGluIHVzZXIgSURzKVxuICAvc3RhcnQucHkgZ2VuZXJhdGVcblxuICAjIFNldCBwdWJsaWNfYmFzZXVybCB0byBhY3R1YWwgZGVwbG95bWVudCBVUkwgKG1heSBkaWZmZXIgZnJvbSBzZXJ2ZXJfbmFtZSlcbiAgIyBUaGlzIGFsbG93cyBob3N0aW5nIGF0IG1hdHJpeC5leGFtcGxlLm9yZyB3aGlsZSBzZXJ2ZXJfbmFtZSBpcyBleGFtcGxlLm9yZ1xuICBpZiAhIGdyZXAgLXEgXCJwdWJsaWNfYmFzZXVybFwiIC9kYXRhL2hvbWVzZXJ2ZXIueWFtbDsgdGhlblxuICAgIHNlZCAtaSBcIi9ec2VydmVyX25hbWU6L2EgcHVibGljX2Jhc2V1cmw6ICR7U0VSVklDRV9VUkxfU1lOQVBTRX0vXCIgL2RhdGEvaG9tZXNlcnZlci55YW1sXG4gIGZpXG5cbiAgIyBDb25maWd1cmUgbGlzdGVuZXIgZm9yIHJldmVyc2UgcHJveHlcbiAgc2VkIC1pICdzL2JpbmRfYWRkcmVzc2VzOiBcXFsuKlxcXS9iaW5kX2FkZHJlc3NlczogW1wiMC4wLjAuMFwiXS8nIC9kYXRhL2hvbWVzZXJ2ZXIueWFtbFxuICBzZWQgLWkgJy94X2ZvcndhcmRlZDovZCcgL2RhdGEvaG9tZXNlcnZlci55YW1sXG4gIHNlZCAtaSAnL3R5cGU6IGh0dHAvYSBcXCAgICB4X2ZvcndhcmRlZDogdHJ1ZScgL2RhdGEvaG9tZXNlcnZlci55YW1sXG5cbiAgIyBFbmFibGUgcmVnaXN0cmF0aW9uIGlmIHJlcXVlc3RlZFxuICBpZiBbIFwiJHtFTkFCTEVfUkVHSVNUUkFUSU9OfVwiID0gXCJ0cnVlXCIgXSAmJiAhIGdyZXAgLXEgXCJlbmFibGVfcmVnaXN0cmF0aW9uXCIgL2RhdGEvaG9tZXNlcnZlci55YW1sOyB0aGVuXG4gICAgZWNobyBcImVuYWJsZV9yZWdpc3RyYXRpb246IHRydWVcIiA+PiAvZGF0YS9ob21lc2VydmVyLnlhbWxcbiAgZmlcbmZpXG5cbiMgUmVnaXN0ZXIgYWRtaW4gdXNlciBpZiBjcmVkZW50aWFscyBwcm92aWRlZFxuaWYgWyAtbiBcIiR7U0VSVklDRV9VU0VSX0FETUlOfVwiIF0gJiYgWyAtbiBcIiR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn1cIiBdOyB0aGVuXG4gIChcbiAgICB3aGlsZSAhIGN1cmwgLXNmIGh0dHA6Ly9sb2NhbGhvc3Q6ODAwOC9oZWFsdGggPiAvZGV2L251bGwgMj4mMTsgZG9cbiAgICAgIHNsZWVwIDJcbiAgICBkb25lXG4gICAgcmVnaXN0ZXJfbmV3X21hdHJpeF91c2VyIC1hIFxcXG4gICAgICAtdSBcIiR7U0VSVklDRV9VU0VSX0FETUlOfVwiIFxcXG4gICAgICAtcCBcIiR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn1cIiBcXFxuICAgICAgLWMgL2RhdGEvaG9tZXNlcnZlci55YW1sIFxcXG4gICAgICBodHRwOi8vbG9jYWxob3N0OjgwMDggMj4vZGV2L251bGwgfHwgdHJ1ZVxuICApICZcbmZpXG5cbmV4ZWMgL3N0YXJ0LnB5IgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwMDgvaGVhbHRoJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMjBzCg==",
         "tags": [
             "chat",
             "slack",
@@ -3349,21 +2884,6 @@
         "template_last_updated_at": "2026-05-12T09:22:15+02:00",
         "port": "9000"
     },
-    "mediawiki": {
-        "documentation": "https://www.mediawiki.org?utm_source=coolify.io",
-        "slogan": "MediaWiki is a collaboration and documentation platform brought to you by a vibrant community.",
-        "compose": "c2VydmljZXM6CiAgbWVkaWF3aWtpOgogICAgaW1hZ2U6ICdtZWRpYXdpa2k6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTUVESUFXSUtJXzgwCiAgICB2b2x1bWVzOgogICAgICAtICdtZWRpYXdpa2ktaW1hZ2VzOi92YXIvd3d3L2h0bWwvaW1hZ2VzJwogICAgICAtICdtZWRpYXdpa2ktc3FsaXRlOi92YXIvd3d3L2h0bWwvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "wiki",
-            "collaboration",
-            "documentation"
-        ],
-        "category": "cms",
-        "logo": "svgs/mediawiki.ico",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "meilisearch": {
         "documentation": "https://www.meilisearch.com?utm_source=coolify.io",
         "slogan": "MeiliSearch is a powerful, fast, easy to use and deploy search engine.",
@@ -3494,45 +3014,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "8080"
     },
-    "mixpost": {
-        "documentation": "https://docs.mixpost.app/lite?utm_source=coolify.io",
-        "slogan": "Mixpost is a robust and versatile social media management software, designed to streamline social media operations and enhance content marketing strategies.",
-        "compose": "c2VydmljZXM6CiAgbWl4cG9zdDoKICAgIGltYWdlOiAnaW5vdmVjdG9yL21peHBvc3Q6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTUlYUE9TVAogICAgICAtIEFQUF9OQU1FPU1peHBvc3QKICAgICAgLSAnQVBQX0tFWT0ke1NFUlZJQ0VfQkFTRTY0X01JWFBPU1R9JwogICAgICAtIEFQUF9ERUJVRz1mYWxzZQogICAgICAtICdBUFBfRE9NQUlOPSR7U0VSVklDRV9VUkxfTUlYUE9TVH0nCiAgICAgIC0gJ0FQUF9VUkw9JHtTRVJWSUNFX1VSTF9NSVhQT1NUfScKICAgICAgLSAnREJfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotbWl4cG9zdF9kYn0nCiAgICAgIC0gJ0RCX1VTRVJOQU1FPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnU1NMX0VNQUlMPSR7U1NMX0VNQUlMOi11c2VyQGV4YW1wbGUuY29tfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21peHBvc3Qtc3RvcmFnZTovdmFyL3d3dy9odG1sL3N0b3JhZ2UvYXBwJwogICAgICAtICdtaXhwb3N0LWxvZ3M6L3Zhci93d3cvaHRtbC9zdG9yYWdlL2xvZ3MnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG15c3FsCiAgICAgIC0gcmVkaXMKICBteXNxbDoKICAgIGltYWdlOiAnbXlzcWwvbXlzcWwtc2VydmVyOjguMCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1taXhwb3N0X2RifScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICB2b2x1bWVzOgogICAgICAtICdtaXhwb3N0LW15c3FsOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICAgIC0gJy11cm9vdCcKICAgICAgICAtICctcCR7U0VSVklDRV9QQVNTV09SRF9NWVNRTFJPT1R9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOmFscGluZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtICctLXJhdycKICAgICAgICAtIGluY3IKICAgICAgICAtIHBpbmcK",
-        "tags": [
-            "social media",
-            "marketing",
-            "content",
-            "management",
-            "automation",
-            "self-hosted"
-        ],
-        "category": "analytics",
-        "logo": "svgs/mixpost.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
-    "moodle": {
-        "documentation": "https://moodle.org?utm_source=coolify.io",
-        "slogan": "Moodle is the world\u2019s most customisable and trusted eLearning solution that empowers educators to improve our world.",
-        "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4xJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQUxMT1dfRU1QVFlfUEFTU1dPUkQ9bm8KICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1iaXRuYW1pX21vb2RsZQogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIE1BUklBREJfQ0hBUkFDVEVSX1NFVD11dGY4bWI0CiAgICAgIC0gTUFSSUFEQl9DT0xMQVRFPXV0ZjhtYjRfdW5pY29kZV9jaQogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc8L2Rldi90Y3AvbG9jYWxob3N0LzMzMDYnIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBtb29kbGU6CiAgICBpbWFnZTogJ2RvY2tlci5pby9iaXRuYW1pbGVnYWN5L21vb2RsZTo0LjMnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX01PT0RMRV84MDgwCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX0hPU1Q9bWFyaWFkYgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9QT1JUX05VTUJFUj0zMzA2CiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX05BTUU9Yml0bmFtaV9tb29kbGUKICAgICAgLSBNT09ETEVfREFUQUJBU0VfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIEFMTE9XX0VNUFRZX1BBU1NXT1JEPW5vCiAgICAgIC0gJ01PT0RMRV9VU0VSTkFNRT0ke01PT0RMRV9VU0VSTkFNRTotdXNlcn0nCiAgICAgIC0gTU9PRExFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01PT0RMRQogICAgICAtIE1PT0RMRV9FTUFJTD11c2VyQGV4YW1wbGUuY29tCiAgICAgIC0gJ01PT0RMRV9TSVRFX05BTUU9JHtNT09ETEVfU0lURV9OQU1FOi1OZXcgU2l0ZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdtb29kbGUtZGF0YTovYml0bmFtaS9tb29kbGUnCiAgICAgIC0gJ21vb2RsZWRhdGEtZGF0YTovYml0bmFtaS9tb29kbGVkYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBocAogICAgICAgIC0gJy1yJwogICAgICAgIC0gImV4aXQoZmlsZV9leGlzdHMoJy9vcHQvYml0bmFtaS9tb29kbGUvY29uZmlnLnBocCcpID8gMCA6IDEpOyIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQo=",
-        "tags": [
-            "moodle",
-            "elearning",
-            "education",
-            "lms",
-            "cms",
-            "open",
-            "source",
-            "low",
-            "code"
-        ],
-        "category": "cms",
-        "logo": "svgs/moodle.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-09T09:49:33+05:30",
-        "port": "8080"
-    },
     "mosquitto": {
         "documentation": "https://mosquitto.org/documentation/?utm_source=coolify.io",
         "slogan": "Mosquitto is lightweight and suitable for use on all devices, from low-power single-board computers to full servers.",
@@ -3703,74 +3184,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "3000"
     },
-    "nextcloud-with-mariadb": {
-        "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
-        "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gTVlTUUxfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAvc3RhdHVzLnBocCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBuZXh0Y2xvdWQtZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01BUklBREJfREFUQUJBU0U6LW5leHRjbG91ZH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLXJlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMjAK",
-        "tags": [
-            "cloud",
-            "collaboration",
-            "communication",
-            "filestorage",
-            "data"
-        ],
-        "category": "storage",
-        "logo": "svgs/nextcloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-07T23:32:57+05:30",
-        "port": "80"
-    },
-    "nextcloud-with-mysql": {
-        "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
-        "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotbmV4dGNsb3VkfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gTVlTUUxfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAvc3RhdHVzLnBocCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBuZXh0Y2xvdWQtZGI6CiAgICBpbWFnZTogJ215c3FsOjguNC4yJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLW15c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LW5leHRjbG91ZH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjcuNC1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtcmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIFBJTkcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAyMAo=",
-        "tags": [
-            "cloud",
-            "collaboration",
-            "communication",
-            "filestorage",
-            "data"
-        ],
-        "category": "storage",
-        "logo": "svgs/nextcloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-07T23:32:57+05:30",
-        "port": "80"
-    },
-    "nextcloud-with-postgres": {
-        "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
-        "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbmV4dGNsb3VkfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAvc3RhdHVzLnBocCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBuZXh0Y2xvdWQtZGI6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1uZXh0Y2xvdWR9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLXJlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMjAK",
-        "tags": [
-            "cloud",
-            "collaboration",
-            "communication",
-            "filestorage",
-            "data"
-        ],
-        "category": "storage",
-        "logo": "svgs/nextcloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-07T23:32:57+05:30",
-        "port": "80"
-    },
-    "nextcloud": {
-        "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
-        "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL01hZHJpZH0nCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3N0YXR1cy5waHAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
-        "tags": [
-            "cloud",
-            "collaboration",
-            "communication",
-            "filestorage",
-            "data"
-        ],
-        "category": "storage",
-        "logo": "svgs/nextcloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-07T23:32:57+05:30",
-        "port": "80"
-    },
     "nexus-arm": {
         "documentation": "https://help.sonatype.com/en/sonatype-nexus-repository.html?utm_source=coolify.io",
         "slogan": "Open source Universal Repository Manager (ARM version, community edition), default credentials: admin/admin123",
@@ -3914,24 +3327,10 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
-    "observium": {
-        "documentation": "https://docs.observium.org/?utm_source=coolify.io",
-        "slogan": "Observium is a comprehensive network monitoring platform designed to deliver powerful monitoring capabilities, combined with an elegant and intuitive user interface.",
-        "compose": "c2VydmljZXM6CiAgb2JzZXJ2aXVtOgogICAgaW1hZ2U6ICdtYml4dGVjaC9vYnNlcnZpdW06bGF0ZXN0JwogICAgcGxhdGZvcm06IGxpbnV4L2FtZDY0CiAgICB2b2x1bWVzOgogICAgICAtICdvYnNlcnZpdW1fbG9nczovb3B0L29ic2Vydml1bS9sb2dzJwogICAgICAtICdvYnNlcnZpdW1fcnJkOi9vcHQvb2JzZXJ2aXVtL3JyZCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdTRVJWSUNFX1VSTF9PQlNFUlZJVU09JHtTRVJWSUNFX1VSTF9PQlNFUlZJVU19JwogICAgICAtICdPQlNFUlZJVU1fQURNSU5fUEFTUz0ke1NFUlZJQ0VfUEFTU1dPUkRfT0JTRVJWSVVNQURNSU59JwogICAgICAtICdPQlNFUlZJVU1fQURNSU5fVVNFUj0ke1NFUlZJQ0VfVVNFUl9PQlNFUlZJVU1BRE1JTn0nCiAgICAgIC0gT0JTRVJWSVVNX0RCX0hPU1Q9bWFyaWFkYgogICAgICAtICdPQlNFUlZJVU1fREJfTkFNRT0ke09CU0VSVklVTV9EQl9OQU1FOi1vYnNlcnZpdW0tZGJ9JwogICAgICAtICdPQlNFUlZJVU1fREJfUEFTUz0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ09CU0VSVklVTV9EQl9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0LycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDVzCiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjpsdHMnCiAgICB2b2x1bWVzOgogICAgICAtICdvYnNlcnZpdW1fbWFyaWFkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01BUklBREJfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQlJPT1R9JwogICAgICAtICdNQVJJQURCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01BUklBREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtICdNQVJJQURCX0RBVEFCQVNFPSR7TUFSSUFEQl9EQVRBQkFTRTotb2JzZXJ2aXVtLWRifScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
-        "tags": [
-            "networking",
-            "monitoring"
-        ],
-        "category": "monitoring",
-        "logo": "svgs/observium.webp",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "obsidian-livesync": {
         "documentation": "https://github.com/vrtmrz/obsidian-livesync/blob/main/docs/setup_own_server.md?utm_source=coolify.io",
         "slogan": "Self-hosted sync backend for Obsidian LiveSync plugin using CouchDB",
-        "compose": "c2VydmljZXM6CiAgY291Y2hkYjoKICAgIGltYWdlOiAnY291Y2hkYjozLjQuMicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9DT1VDSERCXzU5ODQKICAgICAgLSAnQ09VQ0hEQl9VU0VSPSR7U0VSVklDRV9VU0VSX0NPVUNIREJ9JwogICAgICAtICdDT1VDSERCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9DT1VDSERCfScKICAgICAgLSAnTUFYX0RPQ1VNRU5UX1NJWkU9JHtNQVhfRE9DVU1FTlRfU0laRTotNTI0Mjg4MDB9JwogICAgICAtICdNQVhfSFRUUF9SRVFVRVNUX1NJWkU9JHtNQVhfSFRUUF9SRVFVRVNUX1NJWkU6LTY3MTA4ODY0fScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2xvY2FsLmluaQogICAgICAgIHRhcmdldDogL29wdC9jb3VjaGRiL2V0Yy9sb2NhbC5pbmkKICAgICAgICBjb250ZW50OiAiW2NvdWNoZGJdXG5zaW5nbGVfbm9kZT10cnVlXG5tYXhfZG9jdW1lbnRfc2l6ZSA9ICR7TUFYX0RPQ1VNRU5UX1NJWkV9XG5cbltjaHR0cGRdXG5yZXF1aXJlX3ZhbGlkX3VzZXIgPSB0cnVlXG5tYXhfaHR0cF9yZXF1ZXN0X3NpemUgPSAke01BWF9IVFRQX1JFUVVFU1RfU0laRX1cblxuW2NodHRwZF9hdXRoXVxucmVxdWlyZV92YWxpZF91c2VyID0gdHJ1ZVxuYXV0aGVudGljYXRpb25fcmVkaXJlY3QgPSAvX3V0aWxzL3Nlc3Npb24uaHRtbFxuXG5baHR0cGRdXG5XV1ctQXV0aGVudGljYXRlID0gQmFzaWMgcmVhbG09XCJjb3VjaGRiXCJcbmVuYWJsZV9jb3JzID0gdHJ1ZVxuXG5bY29yc11cbm9yaWdpbnMgPSBhcHA6Ly9vYnNpZGlhbi5tZCxjYXBhY2l0b3I6Ly9sb2NhbGhvc3QsaHR0cDovL2xvY2FsaG9zdFxuY3JlZGVudGlhbHMgPSB0cnVlXG5oZWFkZXJzID0gYWNjZXB0LCBhdXRob3JpemF0aW9uLCBjb250ZW50LXR5cGUsIG9yaWdpbiwgcmVmZXJlclxubWV0aG9kcyA9IEdFVCwgUFVULCBQT1NULCBIRUFELCBERUxFVEVcbm1heF9hZ2UgPSAzNjAwIgogICAgICAtICdjb3VjaGRiLWRhdGE6L29wdC9jb3VjaGRiL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLWYgLXUgIiQke0NPVUNIREJfVVNFUn06JCR7Q09VQ0hEQl9QQVNTV09SRH0iIGh0dHA6Ly9sb2NhbGhvc3Q6NTk4NC9fdXAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHN0YXJ0X3BlcmlvZDogNDBzCiAgICAgIHJldHJpZXM6IDMKdm9sdW1lczoKICBjb3VjaGRiLWRhdGE6IG51bGwK",
+        "compose": "c2VydmljZXM6CiAgY291Y2hkYjoKICAgIGltYWdlOiAnY291Y2hkYjozLjQuMicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9DT1VDSERCXzU5ODQKICAgICAgLSAnQ09VQ0hEQl9VU0VSPSR7U0VSVklDRV9VU0VSX0NPVUNIREJ9JwogICAgICAtICdDT1VDSERCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9DT1VDSERCfScKICAgICAgLSAnTUFYX0RPQ1VNRU5UX1NJWkU9JHtNQVhfRE9DVU1FTlRfU0laRTotNTI0Mjg4MDB9JwogICAgICAtICdNQVhfSFRUUF9SRVFVRVNUX1NJWkU9JHtNQVhfSFRUUF9SRVFVRVNUX1NJWkU6LTY3MTA4ODY0fScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2xvY2FsLmluaQogICAgICAgIHRhcmdldDogL29wdC9jb3VjaGRiL2V0Yy9sb2NhbC5pbmkKICAgICAgICBjb250ZW50OiAiW2NvdWNoZGJdXG5zaW5nbGVfbm9kZT10cnVlXG5tYXhfZG9jdW1lbnRfc2l6ZSA9ICR7TUFYX0RPQ1VNRU5UX1NJWkV9XG5cbltjaHR0cGRdXG5yZXF1aXJlX3ZhbGlkX3VzZXIgPSB0cnVlXG5tYXhfaHR0cF9yZXF1ZXN0X3NpemUgPSAke01BWF9IVFRQX1JFUVVFU1RfU0laRX1cblxuW2NodHRwZF9hdXRoXVxucmVxdWlyZV92YWxpZF91c2VyID0gdHJ1ZVxuYXV0aGVudGljYXRpb25fcmVkaXJlY3QgPSAvX3V0aWxzL3Nlc3Npb24uaHRtbFxuXG5baHR0cGRdXG5XV1ctQXV0aGVudGljYXRlID0gQmFzaWMgcmVhbG09XCJjb3VjaGRiXCJcbmVuYWJsZV9jb3JzID0gdHJ1ZVxuXG5bY29yc11cbm9yaWdpbnMgPSBhcHA6Ly9vYnNpZGlhbi5tZCxjYXBhY2l0b3I6Ly9sb2NhbGhvc3QsaHR0cDovL2xvY2FsaG9zdFxuY3JlZGVudGlhbHMgPSB0cnVlXG5oZWFkZXJzID0gYWNjZXB0LCBhdXRob3JpemF0aW9uLCBjb250ZW50LXR5cGUsIG9yaWdpbiwgcmVmZXJlclxubWV0aG9kcyA9IEdFVCwgUFVULCBQT1NULCBIRUFELCBERUxFVEVcbm1heF9hZ2UgPSAzNjAwXG4iCiAgICAgIC0gJ2NvdWNoZGItZGF0YTovb3B0L2NvdWNoZGIvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiAtdSAiJCR7Q09VQ0hEQl9VU0VSfTokJHtDT1VDSERCX1BBU1NXT1JEfSIgaHR0cDovL2xvY2FsaG9zdDo1OTg0L191cCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgc3RhcnRfcGVyaW9kOiA0MHMKICAgICAgcmV0cmllczogMwp2b2x1bWVzOgogIGNvdWNoZGItZGF0YTogbnVsbAo=",
         "tags": [
             "obsidian",
             "couchdb",
@@ -3981,7 +3380,7 @@
         "category": "productivity",
         "logo": "svgs/odoo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "template_last_updated_at": "2026-10-19T21:46:16+02:00",
         "port": "8069"
     },
     "ollama-with-open-webui": {
@@ -4136,7 +3535,7 @@
     "openpanel": {
         "documentation": "https://openpanel.dev/docs?utm_source=coolify.io",
         "slogan": "Open source alternative to Mixpanel and Plausible for product analytics",
-        "compose": "c2VydmljZXM6CiAgb3BlbnBhbmVsLWRhc2hib2FyZDoKICAgIGltYWdlOiAnbGluZGVzdmFyZC9vcGVucGFuZWwtZGFzaGJvYXJkOjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gU0VMRl9IT1NURUQ9dHJ1ZQogICAgICAtIFNFUlZJQ0VfVVJMX09QREFTSEJPQVJEXzMwMDAKICAgICAgLSAnQVBJX1VSTD0ke1NFUlZJQ0VfVVJMX09QQVBJfScKICAgICAgLSAnREFTSEJPQVJEX1VSTD0ke1NFUlZJQ0VfVVJMX09QREFTSEJPQVJEfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke09QRU5QQU5FTF9QT1NUR1JFU19EQjotb3BlbnBhbmVsLWRifT9zY2hlbWE9cHVibGljJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9kZWZhdWx0OiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQ0xJQ0tIT1VTRV9VUkw9aHR0cDovL2NsaWNraG91c2U6ODEyMy9vcGVucGFuZWwnCiAgICBkZXBlbmRzX29uOgogICAgICBvcGVucGFuZWwtYXBpOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9wZW5wYW5lbC13b3JrZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mIGh0dHA6Ly9sb2NhbGhvc3Q6MzAwMC9hcGkvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxNXMKICBvcGVucGFuZWwtYXBpOgogICAgaW1hZ2U6ICdsaW5kZXN2YXJkL29wZW5wYW5lbC1hcGk6MicKICAgIGNvbW1hbmQ6ICJzaCAtYyBcIlxuICBlY2hvICdSdW5uaW5nIG1pZ3JhdGlvbnMuLi4nXG4gIENJPXRydWUgcG5wbSAtciBydW4gbWlncmF0ZTpkZXBsb3lcblxuICBwbnBtIHN0YXJ0XG5cIlxuIgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFNFTEZfSE9TVEVEPXRydWUKICAgICAgLSBTRVJWSUNFX1VSTF9PUEFQSQogICAgICAtICdBUElfVVJMPSR7U0VSVklDRV9VUkxfT1BBUEl9JwogICAgICAtICdEQVNIQk9BUkRfVVJMPSR7U0VSVklDRV9VUkxfT1BEQVNIQk9BUkR9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9P3NjaGVtYT1wdWJsaWMnCiAgICAgIC0gJ0RBVEFCQVNFX1VSTF9ESVJFQ1Q9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9P3NjaGVtYT1wdWJsaWMnCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpczovL2RlZmF1bHQ6JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfUByZWRpczo2Mzc5JwogICAgICAtICdDTElDS0hPVVNFX1VSTD1odHRwOi8vY2xpY2tob3VzZTo4MTIzL29wZW5wYW5lbCcKICAgICAgLSAnQ09PS0lFX1NFQ1JFVD0ke1NFUlZJQ0VfQkFTRTY0X0NPT0tJRVNFQ1JFVH0nCiAgICAgIC0gJ0FMTE9XX1JFR0lTVFJBVElPTj0ke09QRU5QQU5FTF9BTExPV19SRUdJU1RSQVRJT046LWZhbHNlfScKICAgICAgLSAnQUxMT1dfSU5WSVRBVElPTj0ke09QRU5QQU5FTF9BTExPV19JTlZJVEFUSU9OOi1mYWxzZX0nCiAgICAgIC0gJ0VNQUlMX1NFTkRFUj0ke09QRU5QQU5FTF9FTUFJTF9TRU5ERVJ9JwogICAgICAtICdSRVNFTkRfQVBJX0tFWT0ke1JFU0VORF9BUElfS0VZfScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiBodHRwOi8vbG9jYWxob3N0OjMwMDAvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBvcGVucGFuZWwtd29ya2VyOgogICAgaW1hZ2U6ICdsaW5kZXN2YXJkL29wZW5wYW5lbC13b3JrZXI6MicKICAgIGVudmlyb25tZW50OgogICAgICAtICdESVNBQkxFX0JVTExCT0FSRD0ke0RJU0FCTEVfQlVMTEJPQVJEOi0xfScKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gU0VMRl9IT1NURUQ9dHJ1ZQogICAgICAtIFNFUlZJQ0VfVVJMX09QQlVMTEJPQVJECiAgICAgIC0gJ0FQSV9VUkw9JHtTRVJWSUNFX1VSTF9PUEFQSX0nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtPUEVOUEFORUxfUE9TVEdSRVNfREI6LW9wZW5wYW5lbC1kYn0/c2NoZW1hPXB1YmxpYycKICAgICAgLSAnREFUQUJBU0VfVVJMX0RJUkVDVD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtPUEVOUEFORUxfUE9TVEdSRVNfREI6LW9wZW5wYW5lbC1kYn0/c2NoZW1hPXB1YmxpYycKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vZGVmYXVsdDoke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9QHJlZGlzOjYzNzknCiAgICAgIC0gJ0NMSUNLSE9VU0VfVVJMPWh0dHA6Ly9jbGlja2hvdXNlOjgxMjMvb3BlbnBhbmVsJwogICAgZGVwZW5kc19vbjoKICAgICAgb3BlbnBhbmVsLWFwaToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLWYgaHR0cDovL2xvY2FsaG9zdDozMDAwL2hlYWx0aGNoZWNrIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogNXMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTYtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnb3BlbnBhbmVsX3Bvc3RncmVzX2RhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9JwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnb3BlbnBhbmVsX3JlZGlzX2RhdGE6L2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIGNvbW1hbmQ6ICdyZWRpcy1zZXJ2ZXIgLS1yZXF1aXJlcGFzcyAke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9IC0tbWF4bWVtb3J5LXBvbGljeSBub2V2aWN0aW9uJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gJy1hJwogICAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF9SRURJU30nCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogIGNsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjUuMTAuMi42NScKICAgIGVudmlyb25tZW50OgogICAgICAtIENMSUNLSE9VU0VfU0tJUF9VU0VSX1NFVFVQPTEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ29wZW5wYW5lbF9jbGlja2hvdXNlX2RhdGE6L3Zhci9saWIvY2xpY2tob3VzZScKICAgICAgLSAnb3BlbnBhbmVsX2NsaWNraG91c2VfbG9nczovdmFyL2xvZy9jbGlja2hvdXNlLXNlcnZlcicKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS1jb25maWcueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL2NvbmZpZy5kL29wLWNvbmZpZy54bWwKICAgICAgICByZWFkX29ubHk6IHRydWUKICAgICAgICBjb250ZW50OiAiPGNsaWNraG91c2U+XG4gICAgPGxvZ2dlcj5cbiAgICAgICAgPGxldmVsPndhcm5pbmc8L2xldmVsPlxuICAgICAgICA8Y29uc29sZT50cnVlPC9jb25zb2xlPlxuICAgIDwvbG9nZ2VyPlxuICAgIDxrZWVwX2FsaXZlX3RpbWVvdXQ+MTA8L2tlZXBfYWxpdmVfdGltZW91dD5cbiAgICA8IS0tIFN0b3AgYWxsIHRoZSB1bm5lY2Vzc2FyeSBsb2dnaW5nIC0tPlxuICAgIDxxdWVyeV90aHJlYWRfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8cXVlcnlfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8dGV4dF9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDx0cmFjZV9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxtZXRyaWNfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8YXN5bmNocm9ub3VzX21ldHJpY19sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxzZXNzaW9uX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHBhcnRfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8bGlzdGVuX2hvc3Q+MC4wLjAuMDwvbGlzdGVuX2hvc3Q+XG4gICAgPGludGVyc2VydmVyX2xpc3Rlbl9ob3N0PjAuMC4wLjA8L2ludGVyc2VydmVyX2xpc3Rlbl9ob3N0PlxuICAgIDxpbnRlcnNlcnZlcl9odHRwX2hvc3Q+b3BjaDwvaW50ZXJzZXJ2ZXJfaHR0cF9ob3N0PlxuICAgIDwhLS0gRGlzYWJsZSBjZ3JvdXAgbWVtb3J5IG9ic2VydmVyIC0tPlxuICAgIDxjZ3JvdXBzX21lbW9yeV91c2FnZV9vYnNlcnZlcl93YWl0X3RpbWU+MDwvY2dyb3Vwc19tZW1vcnlfdXNhZ2Vfb2JzZXJ2ZXJfd2FpdF90aW1lPlxuICAgIDwhLS0gTm90IHVzZWQgYW55bW9yZSwgYnV0IGtlcHQgZm9yIGJhY2t3YXJkcyBjb21wYXRpYmlsaXR5IC0tPlxuICAgIDxtYWNyb3M+XG4gICAgICAgIDxzaGFyZD4xPC9zaGFyZD5cbiAgICAgICAgPHJlcGxpY2E+cmVwbGljYTE8L3JlcGxpY2E+XG4gICAgICAgIDxjbHVzdGVyPm9wZW5wYW5lbF9jbHVzdGVyPC9jbHVzdGVyPlxuICAgIDwvbWFjcm9zPlxuPC9jbGlja2hvdXNlPiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS11c2VyLWNvbmZpZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvdXNlcnMuZC9vcC11c2VyLWNvbmZpZy54bWwKICAgICAgICByZWFkX29ubHk6IHRydWUKICAgICAgICBjb250ZW50OiAiPGNsaWNraG91c2U+XG4gICAgPHByb2ZpbGVzPlxuICAgICAgICA8ZGVmYXVsdD5cbiAgICAgICAgICAgIDxsb2dfcXVlcmllcz4wPC9sb2dfcXVlcmllcz5cbiAgICAgICAgICAgIDxsb2dfcXVlcnlfdGhyZWFkcz4wPC9sb2dfcXVlcnlfdGhyZWFkcz5cbiAgICAgICAgPC9kZWZhdWx0PlxuICAgIDwvcHJvZmlsZXM+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2luaXQtZGIuc2gKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LWRiLnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuc2V0IC1lXG5cbmNsaWNraG91c2UgY2xpZW50IC1uIDw8LUVPU1FMXG4gIENSRUFURSBEQVRBQkFTRSBJRiBOT1QgRVhJU1RTIG9wZW5wYW5lbDtcbkVPU1FMIgogICAgdWxpbWl0czoKICAgICAgbm9maWxlOgogICAgICAgIHNvZnQ6IDI2MjE0NAogICAgICAgIGhhcmQ6IDI2MjE0NAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjbGlja2hvdXNlLWNsaWVudCAtLXF1ZXJ5ICJTRUxFQ1QgMSInCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
+        "compose": "c2VydmljZXM6CiAgb3BlbnBhbmVsLWRhc2hib2FyZDoKICAgIGltYWdlOiAnbGluZGVzdmFyZC9vcGVucGFuZWwtZGFzaGJvYXJkOjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gU0VMRl9IT1NURUQ9dHJ1ZQogICAgICAtIFNFUlZJQ0VfVVJMX09QREFTSEJPQVJEXzMwMDAKICAgICAgLSAnQVBJX1VSTD0ke1NFUlZJQ0VfVVJMX09QQVBJfScKICAgICAgLSAnREFTSEJPQVJEX1VSTD0ke1NFUlZJQ0VfVVJMX09QREFTSEJPQVJEfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke09QRU5QQU5FTF9QT1NUR1JFU19EQjotb3BlbnBhbmVsLWRifT9zY2hlbWE9cHVibGljJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9kZWZhdWx0OiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQ0xJQ0tIT1VTRV9VUkw9aHR0cDovL2NsaWNraG91c2U6ODEyMy9vcGVucGFuZWwnCiAgICBkZXBlbmRzX29uOgogICAgICBvcGVucGFuZWwtYXBpOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9wZW5wYW5lbC13b3JrZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mIGh0dHA6Ly9sb2NhbGhvc3Q6MzAwMC9hcGkvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxNXMKICBvcGVucGFuZWwtYXBpOgogICAgaW1hZ2U6ICdsaW5kZXN2YXJkL29wZW5wYW5lbC1hcGk6MicKICAgIGNvbW1hbmQ6ICJzaCAtYyBcIlxuICBlY2hvICdSdW5uaW5nIG1pZ3JhdGlvbnMuLi4nXG4gIENJPXRydWUgcG5wbSAtciBydW4gbWlncmF0ZTpkZXBsb3lcblxuICBwbnBtIHN0YXJ0XG5cIlxuIgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFNFTEZfSE9TVEVEPXRydWUKICAgICAgLSBTRVJWSUNFX1VSTF9PUEFQSQogICAgICAtICdBUElfVVJMPSR7U0VSVklDRV9VUkxfT1BBUEl9JwogICAgICAtICdEQVNIQk9BUkRfVVJMPSR7U0VSVklDRV9VUkxfT1BEQVNIQk9BUkR9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9P3NjaGVtYT1wdWJsaWMnCiAgICAgIC0gJ0RBVEFCQVNFX1VSTF9ESVJFQ1Q9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9P3NjaGVtYT1wdWJsaWMnCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpczovL2RlZmF1bHQ6JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfUByZWRpczo2Mzc5JwogICAgICAtICdDTElDS0hPVVNFX1VSTD1odHRwOi8vY2xpY2tob3VzZTo4MTIzL29wZW5wYW5lbCcKICAgICAgLSAnQ09PS0lFX1NFQ1JFVD0ke1NFUlZJQ0VfQkFTRTY0X0NPT0tJRVNFQ1JFVH0nCiAgICAgIC0gJ0FMTE9XX1JFR0lTVFJBVElPTj0ke09QRU5QQU5FTF9BTExPV19SRUdJU1RSQVRJT046LWZhbHNlfScKICAgICAgLSAnQUxMT1dfSU5WSVRBVElPTj0ke09QRU5QQU5FTF9BTExPV19JTlZJVEFUSU9OOi1mYWxzZX0nCiAgICAgIC0gJ0VNQUlMX1NFTkRFUj0ke09QRU5QQU5FTF9FTUFJTF9TRU5ERVJ9JwogICAgICAtICdSRVNFTkRfQVBJX0tFWT0ke1JFU0VORF9BUElfS0VZfScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiBodHRwOi8vbG9jYWxob3N0OjMwMDAvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBvcGVucGFuZWwtd29ya2VyOgogICAgaW1hZ2U6ICdsaW5kZXN2YXJkL29wZW5wYW5lbC13b3JrZXI6MicKICAgIGVudmlyb25tZW50OgogICAgICAtICdESVNBQkxFX0JVTExCT0FSRD0ke0RJU0FCTEVfQlVMTEJPQVJEOi0xfScKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gU0VMRl9IT1NURUQ9dHJ1ZQogICAgICAtIFNFUlZJQ0VfVVJMX09QQlVMTEJPQVJECiAgICAgIC0gJ0FQSV9VUkw9JHtTRVJWSUNFX1VSTF9PUEFQSX0nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtPUEVOUEFORUxfUE9TVEdSRVNfREI6LW9wZW5wYW5lbC1kYn0/c2NoZW1hPXB1YmxpYycKICAgICAgLSAnREFUQUJBU0VfVVJMX0RJUkVDVD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtPUEVOUEFORUxfUE9TVEdSRVNfREI6LW9wZW5wYW5lbC1kYn0/c2NoZW1hPXB1YmxpYycKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vZGVmYXVsdDoke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9QHJlZGlzOjYzNzknCiAgICAgIC0gJ0NMSUNLSE9VU0VfVVJMPWh0dHA6Ly9jbGlja2hvdXNlOjgxMjMvb3BlbnBhbmVsJwogICAgZGVwZW5kc19vbjoKICAgICAgb3BlbnBhbmVsLWFwaToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLWYgaHR0cDovL2xvY2FsaG9zdDozMDAwL2hlYWx0aGNoZWNrIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogNXMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTYtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnb3BlbnBhbmVsX3Bvc3RncmVzX2RhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9JwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnb3BlbnBhbmVsX3JlZGlzX2RhdGE6L2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIGNvbW1hbmQ6ICdyZWRpcy1zZXJ2ZXIgLS1yZXF1aXJlcGFzcyAke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9IC0tbWF4bWVtb3J5LXBvbGljeSBub2V2aWN0aW9uJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gJy1hJwogICAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF9SRURJU30nCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogIGNsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjUuMTAuMi42NScKICAgIGVudmlyb25tZW50OgogICAgICAtIENMSUNLSE9VU0VfU0tJUF9VU0VSX1NFVFVQPTEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ29wZW5wYW5lbF9jbGlja2hvdXNlX2RhdGE6L3Zhci9saWIvY2xpY2tob3VzZScKICAgICAgLSAnb3BlbnBhbmVsX2NsaWNraG91c2VfbG9nczovdmFyL2xvZy9jbGlja2hvdXNlLXNlcnZlcicKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS1jb25maWcueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL2NvbmZpZy5kL29wLWNvbmZpZy54bWwKICAgICAgICByZWFkX29ubHk6IHRydWUKICAgICAgICBjb250ZW50OiAiPGNsaWNraG91c2U+XG4gICAgPGxvZ2dlcj5cbiAgICAgICAgPGxldmVsPndhcm5pbmc8L2xldmVsPlxuICAgICAgICA8Y29uc29sZT50cnVlPC9jb25zb2xlPlxuICAgIDwvbG9nZ2VyPlxuICAgIDxrZWVwX2FsaXZlX3RpbWVvdXQ+MTA8L2tlZXBfYWxpdmVfdGltZW91dD5cbiAgICA8IS0tIFN0b3AgYWxsIHRoZSB1bm5lY2Vzc2FyeSBsb2dnaW5nIC0tPlxuICAgIDxxdWVyeV90aHJlYWRfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8cXVlcnlfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8dGV4dF9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDx0cmFjZV9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxtZXRyaWNfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8YXN5bmNocm9ub3VzX21ldHJpY19sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxzZXNzaW9uX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHBhcnRfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8bGlzdGVuX2hvc3Q+MC4wLjAuMDwvbGlzdGVuX2hvc3Q+XG4gICAgPGludGVyc2VydmVyX2xpc3Rlbl9ob3N0PjAuMC4wLjA8L2ludGVyc2VydmVyX2xpc3Rlbl9ob3N0PlxuICAgIDxpbnRlcnNlcnZlcl9odHRwX2hvc3Q+b3BjaDwvaW50ZXJzZXJ2ZXJfaHR0cF9ob3N0PlxuICAgIDwhLS0gRGlzYWJsZSBjZ3JvdXAgbWVtb3J5IG9ic2VydmVyIC0tPlxuICAgIDxjZ3JvdXBzX21lbW9yeV91c2FnZV9vYnNlcnZlcl93YWl0X3RpbWU+MDwvY2dyb3Vwc19tZW1vcnlfdXNhZ2Vfb2JzZXJ2ZXJfd2FpdF90aW1lPlxuICAgIDwhLS0gTm90IHVzZWQgYW55bW9yZSwgYnV0IGtlcHQgZm9yIGJhY2t3YXJkcyBjb21wYXRpYmlsaXR5IC0tPlxuICAgIDxtYWNyb3M+XG4gICAgICAgIDxzaGFyZD4xPC9zaGFyZD5cbiAgICAgICAgPHJlcGxpY2E+cmVwbGljYTE8L3JlcGxpY2E+XG4gICAgICAgIDxjbHVzdGVyPm9wZW5wYW5lbF9jbHVzdGVyPC9jbHVzdGVyPlxuICAgIDwvbWFjcm9zPlxuPC9jbGlja2hvdXNlPlxuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlLXVzZXItY29uZmlnLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci91c2Vycy5kL29wLXVzZXItY29uZmlnLnhtbAogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICI8Y2xpY2tob3VzZT5cbiAgICA8cHJvZmlsZXM+XG4gICAgICAgIDxkZWZhdWx0PlxuICAgICAgICAgICAgPGxvZ19xdWVyaWVzPjA8L2xvZ19xdWVyaWVzPlxuICAgICAgICAgICAgPGxvZ19xdWVyeV90aHJlYWRzPjA8L2xvZ19xdWVyeV90aHJlYWRzPlxuICAgICAgICA8L2RlZmF1bHQ+XG4gICAgPC9wcm9maWxlcz5cbjwvY2xpY2tob3VzZT5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vaW5pdC1kYi5zaAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtZGIuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL3NoXG5zZXQgLWVcblxuY2xpY2tob3VzZSBjbGllbnQgLW4gPDwtRU9TUUxcbiAgQ1JFQVRFIERBVEFCQVNFIElGIE5PVCBFWElTVFMgb3BlbnBhbmVsO1xuRU9TUUxcbiIKICAgIHVsaW1pdHM6CiAgICAgIG5vZmlsZToKICAgICAgICBzb2Z0OiAyNjIxNDQKICAgICAgICBoYXJkOiAyNjIxNDQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY2xpY2tob3VzZS1jbGllbnQgLS1xdWVyeSAiU0VMRUNUIDEiJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUK",
         "tags": [
             "analytics",
             "insights",
@@ -4192,58 +3591,6 @@
         "template_last_updated_at": "2026-09-28T00:20:58+02:00",
         "port": "2785"
     },
-    "opnform": {
-        "documentation": "https://docs.opnform.com/introduction?utm_source=coolify.io",
-        "slogan": "OpnForm is an open-source form builder that lets you create beautiful forms and share them anywhere. It's super fast, you don't need to know how to code",
-        "compose": "eC1zaGFyZWQtZW52OgogIEFQUF9OQU1FOiBPcG5Gb3JtCiAgQVBQX0VOVjogcHJvZHVjdGlvbgogIEFQUF9LRVk6ICcke1NFUlZJQ0VfQkFTRTY0X0FQSUtFWX0nCiAgQVBQX0RFQlVHOiAnJHtBUFBfREVCVUc6LWZhbHNlfScKICBBUFBfVVJMOiAnJHtTRVJWSUNFX1VSTF9OR0lOWH0nCiAgTE9HX0NIQU5ORUw6IGVycm9ybG9nCiAgTE9HX0xFVkVMOiAnJHtMT0dfTEVWRUw6LWRlYnVnfScKICBGSUxFU1lTVEVNX0RSSVZFUjogJyR7RklMRVNZU1RFTV9EUklWRVI6LWxvY2FsfScKICBMT0NBTF9GSUxFU1lTVEVNX1ZJU0lCSUxJVFk6IHB1YmxpYwogIENBQ0hFX0RSSVZFUjogcmVkaXMKICBRVUVVRV9DT05ORUNUSU9OOiByZWRpcwogIFNFU1NJT05fRFJJVkVSOiByZWRpcwogIFNFU1NJT05fTElGRVRJTUU6IDEyMAogIE1BSUxfTUFJTEVSOiAnJHtNQUlMX01BSUxFUjotbG9nfScKICBNQUlMX0hPU1Q6ICcke01BSUxfSE9TVH0nCiAgTUFJTF9QT1JUOiAnJHtNQUlMX1BPUlR9JwogIE1BSUxfVVNFUk5BTUU6ICcke01BSUxfVVNFUk5BTUU6LXlvdXJAZW1haWwuY29tfScKICBNQUlMX1BBU1NXT1JEOiAnJHtNQUlMX1BBU1NXT1JEfScKICBNQUlMX0VOQ1JZUFRJT046ICcke01BSUxfRU5DUllQVElPTn0nCiAgTUFJTF9GUk9NX0FERFJFU1M6ICcke01BSUxfRlJPTV9BRERSRVNTOi15b3VyQGVtYWlsLmNvbX0nCiAgTUFJTF9GUk9NX05BTUU6ICcke01BSUxfRlJPTV9OQU1FOi1PcG5Gb3JtfScKICBBV1NfQUNDRVNTX0tFWV9JRDogJyR7QVdTX0FDQ0VTU19LRVlfSUR9JwogIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJyR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICBBV1NfREVGQVVMVF9SRUdJT046ICcke0FXU19ERUZBVUxUX1JFR0lPTjotdXMtZWFzdC0xfScKICBBV1NfQlVDS0VUOiAnJHtBV1NfQlVDS0VUfScKICBPUEVOX0FJX0FQSV9LRVk6ICcke09QRU5fQUlfQVBJX0tFWX0nCiAgVEVMRUdSQU1fQk9UX0lEOiAnJHtURUxFR1JBTV9CT1RfSUR9JwogIFRFTEVHUkFNX0JPVF9UT0tFTjogJyR7VEVMRUdSQU1fQk9UX1RPS0VOfScKICBSRURJU19IT1NUOiByZWRpcwogIFJFRElTX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICBEQl9IT1NUOiBwb3N0Z3Jlc3FsCiAgREJfREFUQUJBU0U6ICcke1BPU1RHUkVTUUxfREFUQUJBU0U6LW9wbmZvcm19JwogIERCX1VTRVJOQU1FOiAnJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgREJfUEFTU1dPUkQ6ICcke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNRTH0nCiAgREJfQ09OTkVDVElPTjogcGdzcWwKICBQSFBfTUVNT1JZX0xJTUlUOiAxRwogIFBIUF9NQVhfRVhFQ1VUSU9OX1RJTUU6ICc2MDAnCiAgUEhQX1VQTE9BRF9NQVhfRklMRVNJWkU6IDY0TQogIFBIUF9QT1NUX01BWF9TSVpFOiA2NE0KICBGUk9OVF9VUkw6ICcke1NFUlZJQ0VfVVJMX05HSU5YfScKICBGUk9OVF9BUElfU0VDUkVUOiAnJHtTRVJWSUNFX1BBU1NXT1JEX0ZST05UQVBJU0VDUkVUfScKICBQVUJMSUNfVVBMT0FEU19SQVRFX0xJTUlUX1BFUl9NSU5VVEU6ICcke1BVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX01JTlVURTotMzB9JwogIFBVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX0hPVVI6ICcke1BVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX0hPVVI6LTMwMH0nCnNlcnZpY2VzOgogIG9wbmZvcm0tYXBpOgogICAgaW1hZ2U6ICdqaHVtYW5qL29wbmZvcm0tYXBpOjIuMi40JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBpLXN0b3JhZ2U6L3Vzci9zaGFyZS9uZ2lueC9odG1sL3N0b3JhZ2UnCiAgICBlbnZpcm9ubWVudDoKICAgICAgQVBQX05BTUU6IE9wbkZvcm0KICAgICAgQVBQX0VOVjogcHJvZHVjdGlvbgogICAgICBBUFBfS0VZOiAnJHtTRVJWSUNFX0JBU0U2NF9BUElLRVl9JwogICAgICBBUFBfREVCVUc6ICcke0FQUF9ERUJVRzotZmFsc2V9JwogICAgICBBUFBfVVJMOiAnJHtTRVJWSUNFX1VSTF9OR0lOWH0nCiAgICAgIExPR19DSEFOTkVMOiBlcnJvcmxvZwogICAgICBMT0dfTEVWRUw6ICcke0xPR19MRVZFTDotZGVidWd9JwogICAgICBGSUxFU1lTVEVNX0RSSVZFUjogJyR7RklMRVNZU1RFTV9EUklWRVI6LWxvY2FsfScKICAgICAgTE9DQUxfRklMRVNZU1RFTV9WSVNJQklMSVRZOiBwdWJsaWMKICAgICAgQ0FDSEVfRFJJVkVSOiByZWRpcwogICAgICBRVUVVRV9DT05ORUNUSU9OOiByZWRpcwogICAgICBTRVNTSU9OX0RSSVZFUjogcmVkaXMKICAgICAgU0VTU0lPTl9MSUZFVElNRTogMTIwCiAgICAgIE1BSUxfTUFJTEVSOiAnJHtNQUlMX01BSUxFUjotbG9nfScKICAgICAgTUFJTF9IT1NUOiAnJHtNQUlMX0hPU1R9JwogICAgICBNQUlMX1BPUlQ6ICcke01BSUxfUE9SVH0nCiAgICAgIE1BSUxfVVNFUk5BTUU6ICcke01BSUxfVVNFUk5BTUU6LXlvdXJAZW1haWwuY29tfScKICAgICAgTUFJTF9QQVNTV09SRDogJyR7TUFJTF9QQVNTV09SRH0nCiAgICAgIE1BSUxfRU5DUllQVElPTjogJyR7TUFJTF9FTkNSWVBUSU9OfScKICAgICAgTUFJTF9GUk9NX0FERFJFU1M6ICcke01BSUxfRlJPTV9BRERSRVNTOi15b3VyQGVtYWlsLmNvbX0nCiAgICAgIE1BSUxfRlJPTV9OQU1FOiAnJHtNQUlMX0ZST01fTkFNRTotT3BuRm9ybX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAnJHtBV1NfQUNDRVNTX0tFWV9JRH0nCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJyR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgQVdTX0RFRkFVTFRfUkVHSU9OOiAnJHtBV1NfREVGQVVMVF9SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIEFXU19CVUNLRVQ6ICcke0FXU19CVUNLRVR9JwogICAgICBPUEVOX0FJX0FQSV9LRVk6ICcke09QRU5fQUlfQVBJX0tFWX0nCiAgICAgIFRFTEVHUkFNX0JPVF9JRDogJyR7VEVMRUdSQU1fQk9UX0lEfScKICAgICAgVEVMRUdSQU1fQk9UX1RPS0VOOiAnJHtURUxFR1JBTV9CT1RfVE9LRU59JwogICAgICBSRURJU19IT1NUOiByZWRpcwogICAgICBSRURJU19QQVNTV09SRDogJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICAgIERCX0hPU1Q6IHBvc3RncmVzcWwKICAgICAgREJfREFUQUJBU0U6ICcke1BPU1RHUkVTUUxfREFUQUJBU0U6LW9wbmZvcm19JwogICAgICBEQl9VU0VSTkFNRTogJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTUUx9JwogICAgICBEQl9QQVNTV09SRDogJyR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgREJfQ09OTkVDVElPTjogcGdzcWwKICAgICAgUEhQX01FTU9SWV9MSU1JVDogMUcKICAgICAgUEhQX01BWF9FWEVDVVRJT05fVElNRTogJzYwMCcKICAgICAgUEhQX1VQTE9BRF9NQVhfRklMRVNJWkU6IDY0TQogICAgICBQSFBfUE9TVF9NQVhfU0laRTogNjRNCiAgICAgIEZST05UX1VSTDogJyR7U0VSVklDRV9VUkxfTkdJTlh9JwogICAgICBGUk9OVF9BUElfU0VDUkVUOiAnJHtTRVJWSUNFX1BBU1NXT1JEX0ZST05UQVBJU0VDUkVUfScKICAgICAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfTUlOVVRFOiAnJHtQVUJMSUNfVVBMT0FEU19SQVRFX0xJTUlUX1BFUl9NSU5VVEU6LTMwfScKICAgICAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjogJyR7UFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjotMzAwfScKICAgICAgSldUX1RUTDogJyR7SldUX1RUTDotMTQ0MH0nCiAgICAgIEpXVF9TRUNSRVQ6ICcke1NFUlZJQ0VfUEFTU1dPUkRfSldUU0VDUkVUfScKICAgICAgSldUX1NLSVBfSVBfVUFfVkFMSURBVElPTjogJyR7SldUX1NLSVBfSVBfVUFfVkFMSURBVElPTjotZmFsc2V9JwogICAgICBIX0NBUFRDSEFfU0lURV9LRVk6ICcke0hfQ0FQVENIQV9TSVRFX0tFWX0nCiAgICAgIEhfQ0FQVENIQV9TRUNSRVRfS0VZOiAnJHtIX0NBUFRDSEFfU0VDUkVUX0tFWX0nCiAgICAgIFJFX0NBUFRDSEFfU0lURV9LRVk6ICcke1JFX0NBUFRDSEFfU0lURV9LRVl9JwogICAgICBSRV9DQVBUQ0hBX1NFQ1JFVF9LRVk6ICcke1JFX0NBUFRDSEFfU0VDUkVUX0tFWX0nCiAgICAgIFNIT1dfT0ZGSUNJQUxfVEVNUExBVEVTOiAnJHtTSE9XX09GRklDSUFMX1RFTVBMQVRFUzotdHJ1ZX0nCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BocCAvdXNyL3NoYXJlL25naW54L2h0bWwvYXJ0aXNhbiBhYm91dCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiA2MHMKICBhcGktd29ya2VyOgogICAgaW1hZ2U6ICdqaHVtYW5qL29wbmZvcm0tYXBpOjIuMi40JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBpLXN0b3JhZ2U6L3Vzci9zaGFyZS9uZ2lueC9odG1sL3N0b3JhZ2UnCiAgICBlbnZpcm9ubWVudDoKICAgICAgQVBQX05BTUU6IE9wbkZvcm0KICAgICAgQVBQX0VOVjogcHJvZHVjdGlvbgogICAgICBBUFBfS0VZOiAnJHtTRVJWSUNFX0JBU0U2NF9BUElLRVl9JwogICAgICBBUFBfREVCVUc6ICcke0FQUF9ERUJVRzotZmFsc2V9JwogICAgICBBUFBfVVJMOiAnJHtTRVJWSUNFX1VSTF9OR0lOWH0nCiAgICAgIExPR19DSEFOTkVMOiBlcnJvcmxvZwogICAgICBMT0dfTEVWRUw6ICcke0xPR19MRVZFTDotZGVidWd9JwogICAgICBGSUxFU1lTVEVNX0RSSVZFUjogJyR7RklMRVNZU1RFTV9EUklWRVI6LWxvY2FsfScKICAgICAgTE9DQUxfRklMRVNZU1RFTV9WSVNJQklMSVRZOiBwdWJsaWMKICAgICAgQ0FDSEVfRFJJVkVSOiByZWRpcwogICAgICBRVUVVRV9DT05ORUNUSU9OOiByZWRpcwogICAgICBTRVNTSU9OX0RSSVZFUjogcmVkaXMKICAgICAgU0VTU0lPTl9MSUZFVElNRTogMTIwCiAgICAgIE1BSUxfTUFJTEVSOiAnJHtNQUlMX01BSUxFUjotbG9nfScKICAgICAgTUFJTF9IT1NUOiAnJHtNQUlMX0hPU1R9JwogICAgICBNQUlMX1BPUlQ6ICcke01BSUxfUE9SVH0nCiAgICAgIE1BSUxfVVNFUk5BTUU6ICcke01BSUxfVVNFUk5BTUU6LXlvdXJAZW1haWwuY29tfScKICAgICAgTUFJTF9QQVNTV09SRDogJyR7TUFJTF9QQVNTV09SRH0nCiAgICAgIE1BSUxfRU5DUllQVElPTjogJyR7TUFJTF9FTkNSWVBUSU9OfScKICAgICAgTUFJTF9GUk9NX0FERFJFU1M6ICcke01BSUxfRlJPTV9BRERSRVNTOi15b3VyQGVtYWlsLmNvbX0nCiAgICAgIE1BSUxfRlJPTV9OQU1FOiAnJHtNQUlMX0ZST01fTkFNRTotT3BuRm9ybX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAnJHtBV1NfQUNDRVNTX0tFWV9JRH0nCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJyR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgQVdTX0RFRkFVTFRfUkVHSU9OOiAnJHtBV1NfREVGQVVMVF9SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIEFXU19CVUNLRVQ6ICcke0FXU19CVUNLRVR9JwogICAgICBPUEVOX0FJX0FQSV9LRVk6ICcke09QRU5fQUlfQVBJX0tFWX0nCiAgICAgIFRFTEVHUkFNX0JPVF9JRDogJyR7VEVMRUdSQU1fQk9UX0lEfScKICAgICAgVEVMRUdSQU1fQk9UX1RPS0VOOiAnJHtURUxFR1JBTV9CT1RfVE9LRU59JwogICAgICBSRURJU19IT1NUOiByZWRpcwogICAgICBSRURJU19QQVNTV09SRDogJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICAgIERCX0hPU1Q6IHBvc3RncmVzcWwKICAgICAgREJfREFUQUJBU0U6ICcke1BPU1RHUkVTUUxfREFUQUJBU0U6LW9wbmZvcm19JwogICAgICBEQl9VU0VSTkFNRTogJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTUUx9JwogICAgICBEQl9QQVNTV09SRDogJyR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgREJfQ09OTkVDVElPTjogcGdzcWwKICAgICAgUEhQX01FTU9SWV9MSU1JVDogMUcKICAgICAgUEhQX01BWF9FWEVDVVRJT05fVElNRTogJzYwMCcKICAgICAgUEhQX1VQTE9BRF9NQVhfRklMRVNJWkU6IDY0TQogICAgICBQSFBfUE9TVF9NQVhfU0laRTogNjRNCiAgICAgIEZST05UX1VSTDogJyR7U0VSVklDRV9VUkxfTkdJTlh9JwogICAgICBGUk9OVF9BUElfU0VDUkVUOiAnJHtTRVJWSUNFX1BBU1NXT1JEX0ZST05UQVBJU0VDUkVUfScKICAgICAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfTUlOVVRFOiAnJHtQVUJMSUNfVVBMT0FEU19SQVRFX0xJTUlUX1BFUl9NSU5VVEU6LTMwfScKICAgICAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjogJyR7UFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjotMzAwfScKICAgIGNvbW1hbmQ6CiAgICAgIC0gcGhwCiAgICAgIC0gYXJ0aXNhbgogICAgICAtICdxdWV1ZTp3b3JrJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwZ3JlcCAtZiAncGhwIGFydGlzYW4gcXVldWU6d29yaycgPiAvZGV2L251bGwgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogNjBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCiAgYXBpLXNjaGVkdWxlcjoKICAgIGltYWdlOiAnamh1bWFuai9vcG5mb3JtLWFwaToyLjIuNCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwaS1zdG9yYWdlOi91c3Ivc2hhcmUvbmdpbngvaHRtbC9zdG9yYWdlJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9OQU1FOiBPcG5Gb3JtCiAgICAgIEFQUF9FTlY6IHByb2R1Y3Rpb24KICAgICAgQVBQX0tFWTogJyR7U0VSVklDRV9CQVNFNjRfQVBJS0VZfScKICAgICAgQVBQX0RFQlVHOiAnJHtBUFBfREVCVUc6LWZhbHNlfScKICAgICAgQVBQX1VSTDogJyR7U0VSVklDRV9VUkxfTkdJTlh9JwogICAgICBMT0dfQ0hBTk5FTDogZXJyb3Jsb2cKICAgICAgTE9HX0xFVkVMOiAnJHtMT0dfTEVWRUw6LWRlYnVnfScKICAgICAgRklMRVNZU1RFTV9EUklWRVI6ICcke0ZJTEVTWVNURU1fRFJJVkVSOi1sb2NhbH0nCiAgICAgIExPQ0FMX0ZJTEVTWVNURU1fVklTSUJJTElUWTogcHVibGljCiAgICAgIENBQ0hFX0RSSVZFUjogcmVkaXMKICAgICAgUVVFVUVfQ09OTkVDVElPTjogcmVkaXMKICAgICAgU0VTU0lPTl9EUklWRVI6IHJlZGlzCiAgICAgIFNFU1NJT05fTElGRVRJTUU6IDEyMAogICAgICBNQUlMX01BSUxFUjogJyR7TUFJTF9NQUlMRVI6LWxvZ30nCiAgICAgIE1BSUxfSE9TVDogJyR7TUFJTF9IT1NUfScKICAgICAgTUFJTF9QT1JUOiAnJHtNQUlMX1BPUlR9JwogICAgICBNQUlMX1VTRVJOQU1FOiAnJHtNQUlMX1VTRVJOQU1FOi15b3VyQGVtYWlsLmNvbX0nCiAgICAgIE1BSUxfUEFTU1dPUkQ6ICcke01BSUxfUEFTU1dPUkR9JwogICAgICBNQUlMX0VOQ1JZUFRJT046ICcke01BSUxfRU5DUllQVElPTn0nCiAgICAgIE1BSUxfRlJPTV9BRERSRVNTOiAnJHtNQUlMX0ZST01fQUREUkVTUzoteW91ckBlbWFpbC5jb219JwogICAgICBNQUlMX0ZST01fTkFNRTogJyR7TUFJTF9GUk9NX05BTUU6LU9wbkZvcm19JwogICAgICBBV1NfQUNDRVNTX0tFWV9JRDogJyR7QVdTX0FDQ0VTU19LRVlfSUR9JwogICAgICBBV1NfU0VDUkVUX0FDQ0VTU19LRVk6ICcke0FXU19TRUNSRVRfQUNDRVNTX0tFWX0nCiAgICAgIEFXU19ERUZBVUxUX1JFR0lPTjogJyR7QVdTX0RFRkFVTFRfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICBBV1NfQlVDS0VUOiAnJHtBV1NfQlVDS0VUfScKICAgICAgT1BFTl9BSV9BUElfS0VZOiAnJHtPUEVOX0FJX0FQSV9LRVl9JwogICAgICBURUxFR1JBTV9CT1RfSUQ6ICcke1RFTEVHUkFNX0JPVF9JRH0nCiAgICAgIFRFTEVHUkFNX0JPVF9UT0tFTjogJyR7VEVMRUdSQU1fQk9UX1RPS0VOfScKICAgICAgUkVESVNfSE9TVDogcmVkaXMKICAgICAgUkVESVNfUEFTU1dPUkQ6ICcke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9JwogICAgICBEQl9IT1NUOiBwb3N0Z3Jlc3FsCiAgICAgIERCX0RBVEFCQVNFOiAnJHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1vcG5mb3JtfScKICAgICAgREJfVVNFUk5BTUU6ICcke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMfScKICAgICAgREJfUEFTU1dPUkQ6ICcke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNRTH0nCiAgICAgIERCX0NPTk5FQ1RJT046IHBnc3FsCiAgICAgIFBIUF9NRU1PUllfTElNSVQ6IDFHCiAgICAgIFBIUF9NQVhfRVhFQ1VUSU9OX1RJTUU6ICc2MDAnCiAgICAgIFBIUF9VUExPQURfTUFYX0ZJTEVTSVpFOiA2NE0KICAgICAgUEhQX1BPU1RfTUFYX1NJWkU6IDY0TQogICAgICBGUk9OVF9VUkw6ICcke1NFUlZJQ0VfVVJMX05HSU5YfScKICAgICAgRlJPTlRfQVBJX1NFQ1JFVDogJyR7U0VSVklDRV9QQVNTV09SRF9GUk9OVEFQSVNFQ1JFVH0nCiAgICAgIFBVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX01JTlVURTogJyR7UFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfTUlOVVRFOi0zMH0nCiAgICAgIFBVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX0hPVVI6ICcke1BVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX0hPVVI6LTMwMH0nCiAgICBjb21tYW5kOgogICAgICAtIHBocAogICAgICAtIGFydGlzYW4KICAgICAgLSAnc2NoZWR1bGU6d29yaycKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGhwIC91c3Ivc2hhcmUvbmdpbngvaHRtbC9hcnRpc2FuIGFwcDpzY2hlZHVsZXItc3RhdHVzIC0tbW9kZT1jaGVjayAtLW1heC1taW51dGVzPTMgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogNjBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogNzBzCiAgb3BuZm9ybS11aToKICAgIGltYWdlOiAnamh1bWFuai9vcG5mb3JtLWNsaWVudDoyLjIuNCcKICAgIGVudmlyb25tZW50OgogICAgICAtIE5VWFRfUFVCTElDX0FQUF9VUkw9LwogICAgICAtIE5VWFRfUFVCTElDX0FQSV9CQVNFPS9hcGkKICAgICAgLSAnTlVYVF9QUklWQVRFX0FQSV9CQVNFPWh0dHA6Ly9uZ2lueC9hcGknCiAgICAgIC0gTlVYVF9QVUJMSUNfRU5WPXByb2R1Y3Rpb24KICAgICAgLSAnTlVYVF9QVUJMSUNfSF9DQVBUQ0hBX1NJVEVfS0VZPSR7SF9DQVBUQ0hBX1NJVEVfS0VZfScKICAgICAgLSAnTlVYVF9QVUJMSUNfUkVfQ0FQVENIQV9TSVRFX0tFWT0ke1JFX0NBUFRDSEFfU0lURV9LRVl9JwogICAgICAtICdOVVhUX0FQSV9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0ZST05UQVBJU0VDUkVUfScKICAgICAgLSAnTlVYVF9QVUJMSUNfTElDRU5TRV9BUElfRU5EUE9JTlQ9JHtOVVhUX1BVQkxJQ19MSUNFTlNFX0FQSV9FTkRQT0lOVDotaHR0cHM6Ly9hcGkub3BuZm9ybS5jb219JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd3Z2V0IC0tc3BpZGVyIC1xIGh0dHA6Ly9vcG5mb3JtLXVpOjMwMDAvbG9naW4gfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogNDVzCiAgICBkZXBlbmRzX29uOgogICAgICBvcG5mb3JtLWFwaToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIHBvc3RncmVzcWw6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE4JwogICAgdm9sdW1lczoKICAgICAgLSAnb3BuZm9ybS1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTUUx9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNRTF9EQVRBQkFTRTotb3BuZm9ybX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjcnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JlZGlzLWRhdGE6L2RhdGEnCiAgICBjb21tYW5kOgogICAgICAtIHJlZGlzLXNlcnZlcgogICAgICAtICctLXJlcXVpcmVwYXNzJwogICAgICAtICcke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gJy1hJwogICAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDMKICBuZ2lueDoKICAgIGltYWdlOiAnbmdpbng6MS4zMS4zJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTkdJTlgKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL25naW54L25naW54LmNvbmYKICAgICAgICB0YXJnZXQ6IC9ldGMvbmdpbngvY29uZi5kL2RlZmF1bHQuY29uZgogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICJtYXAgJG9yaWdpbmFsX3VyaSAkYXBpX3VyaSB7XG4gICAgfl4vYXBpKC8uKiQpICQxO1xuICAgIGRlZmF1bHQgJG9yaWdpbmFsX3VyaTtcbn1cblxuc2VydmVyIHtcbiAgICBsaXN0ZW4gODAgZGVmYXVsdF9zZXJ2ZXI7XG4gICAgcm9vdCAvdXNyL3NoYXJlL25naW54L2h0bWwvcHVibGljO1xuXG4gICAgYWNjZXNzX2xvZyAvZGV2L3N0ZG91dDtcbiAgICBlcnJvcl9sb2cgL2Rldi9zdGRlcnIgZXJyb3I7XG5cbiAgICBpbmRleCBpbmRleC5odG1sIGluZGV4Lmh0bSBpbmRleC5waHA7XG5cbiAgICBsb2NhdGlvbiAvIHtcbiAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTtcbiAgICAgICAgcHJveHlfcGFzcyBodHRwOi8vb3BuZm9ybS11aTozMDAwO1xuICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtUmVhbC1JUCAkcmVtb3RlX2FkZHI7XG4gICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtSG9zdCAkaG9zdDtcbiAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLUZvcndhcmRlZC1Qb3J0ICRzZXJ2ZXJfcG9ydDtcbiAgICAgICAgcHJveHlfc2V0X2hlYWRlciBVcGdyYWRlICRodHRwX3VwZ3JhZGU7XG4gICAgICAgIHByb3h5X3NldF9oZWFkZXIgQ29ubmVjdGlvbiBcIlVwZ3JhZGVcIjtcbiAgICB9XG5cbiAgICBsb2NhdGlvbiB+LyhhcGl8b3Blbnxsb2NhbFxcL3RlbXB8Zm9ybXNcXC9hc3NldHMpLyB7XG4gICAgICAgIHNldCAkb3JpZ2luYWxfdXJpICR1cmk7XG4gICAgICAgIHRyeV9maWxlcyAkdXJpICR1cmkvIC9pbmRleC5waHAkaXNfYXJncyRhcmdzO1xuICAgIH1cblxuICAgIGxvY2F0aW9uIH4gXFwucGhwJCB7XG4gICAgICAgIGZhc3RjZ2lfc3BsaXRfcGF0aF9pbmZvIF4oLitcXC5waHApKC8uKykkO1xuICAgICAgICBmYXN0Y2dpX3Bhc3Mgb3BuZm9ybS1hcGk6OTAwMDtcbiAgICAgICAgZmFzdGNnaV9pbmRleCBpbmRleC5waHA7XG4gICAgICAgIGluY2x1ZGUgZmFzdGNnaV9wYXJhbXM7XG4gICAgICAgIGZhc3RjZ2lfcGFyYW0gU0NSSVBUX0ZJTEVOQU1FIC91c3Ivc2hhcmUvbmdpbngvaHRtbC9wdWJsaWMvaW5kZXgucGhwO1xuICAgICAgICBmYXN0Y2dpX3BhcmFtIFJFUVVFU1RfVVJJICRhcGlfdXJpO1xuICAgIH1cbn0iCiAgICBkZXBlbmRzX29uOgogICAgICAtIG9wbmZvcm0tYXBpCiAgICAgIC0gb3BuZm9ybS11aQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5naW54CiAgICAgICAgLSAnLXQnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiA0MHMK",
-        "tags": [
-            "opnform",
-            "form",
-            "survey",
-            "cloud",
-            "open-source",
-            "self-hosted",
-            "docker",
-            "no-code",
-            "embeddable"
-        ],
-        "category": "productivity",
-        "logo": "svg/opnform.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T12:49:29+02:00",
-        "port": "80"
-    },
-    "orangehrm": {
-        "documentation": "https://starterhelp.orangehrm.com/hc/en-us?utm_source=coolify.io",
-        "slogan": "OrangeHRM open source HR management software.",
-        "compose": "c2VydmljZXM6CiAgb3JhbmdlaHJtOgogICAgaW1hZ2U6ICdvcmFuZ2Vocm0vb3JhbmdlaHJtOmxhdGVzdCcKICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfT1JBTkdFSFJNXzgwCiAgICAgIC0gT1JBTkdFSFJNX0RBVEFCQVNFX0hPU1Q9bWFyaWFkYgogICAgICAtICdPUkFOR0VIUk1fREFUQUJBU0VfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ09SQU5HRUhSTV9EQVRBQkFTRV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdPUkFOR0VIUk1fREFUQUJBU0VfTkFNRT0ke01ZU1FMX0RBVEFCQVNFOi1vcmFuZ2Vocm0tZGJ9JwogICAgdm9sdW1lczoKICAgICAgLSAnb3JhbmdlaHJtLWRhdGE6L29yYW5nZWhybScKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxMAogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICdvcmFuZ2Vocm1fbWFyaWFkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LW9yYW5nZWhybS1kYn0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "hr",
-            "hris",
-            "hrms",
-            "human resource management",
-            "orangehrm",
-            "hr management"
-        ],
-        "category": "productivity",
-        "logo": "svgs/orangehrm.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "organizr": {
-        "documentation": "https://docs.organizr.app/?utm_source=coolify.io",
-        "slogan": "Homelab Services Organizer",
-        "compose": "c2VydmljZXM6CiAgb3JnYW5penI6CiAgICBpbWFnZTogJ29yZ2FuaXpyL29yZ2FuaXpyOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX09SR0FOSVpSXzgwCiAgICAgIC0gJ2JyYW5jaD0ke2JyYW5jaDotdjItbWFzdGVyfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ29yZ2FuaXpyLWRhdGE6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtc2YgaHR0cDovL2xvY2FsaG9zdDo4MCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMXMKICAgICAgcmV0cmllczogMwo=",
-        "tags": [
-            "tool"
-        ],
-        "category": "productivity",
-        "logo": "svgs/organizr.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "overseerr": {
         "documentation": "https://docs.overseerr.dev/getting-started/installation#docker?utm_source=coolify.io",
         "slogan": "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.",
@@ -4261,23 +3608,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "5055"
     },
-    "owncloud": {
-        "documentation": "https://owncloud.com/docs-guides/?utm_source=coolify.io",
-        "slogan": "OwnCloud with Open Web UI integrates file management with a powerful, user-friendly interface.",
-        "compose": "c2VydmljZXM6CiAgb3duY2xvdWQ6CiAgICBpbWFnZTogJ293bmNsb3VkL3NlcnZlcjpsYXRlc3QnCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PV05DTE9VRF84MDgwCiAgICAgIC0gJ09XTkNMT1VEX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9PV05DTE9VRH0nCiAgICAgIC0gJ09XTkNMT1VEX1RSVVNURURfRE9NQUlOUz0ke1NFUlZJQ0VfRlFETl9PV05DTE9VRH0nCiAgICAgIC0gT1dOQ0xPVURfREJfVFlQRT1teXNxbAogICAgICAtIE9XTkNMT1VEX0RCX0hPU1Q9bWFyaWFkYgogICAgICAtICdPV05DTE9VRF9EQl9OQU1FPSR7REJfTkFNRTotb3duY2xvdWR9JwogICAgICAtICdPV05DTE9VRF9EQl9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnT1dOQ0xPVURfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtICdPV05DTE9VRF9BRE1JTl9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9PV05DTE9VRH0nCiAgICAgIC0gJ09XTkNMT1VEX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9PV05DTE9VRH0nCiAgICAgIC0gJ09XTkNMT1VEX01ZU1FMX1VURjhNQjQ9JHtNWVNRTF9VVEY4TUI0Oi10cnVlfScKICAgICAgLSAnT1dOQ0xPVURfUkVESVNfRU5BQkxFRD0ke1JFRElTX0VOQUJMRUQ6LXRydWV9JwogICAgICAtIE9XTkNMT1VEX1JFRElTX0hPU1Q9cmVkaXMKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSAvdXNyL2Jpbi9oZWFsdGhjaGVjawogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiA1CiAgICB2b2x1bWVzOgogICAgICAtICdvd25jbG91ZC1kYXRhOi9tbnQvZGF0YScKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCUk9PVH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtEQl9OQU1FOi1vd25jbG91ZH0nCiAgICAgIC0gVFo9YXV0bwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jaGFyYWN0ZXItc2V0LXNlcnZlcj11dGY4bWI0JwogICAgICAtICctLWNvbGxhdGlvbi1zZXJ2ZXI9dXRmOG1iNF9iaW4nCiAgICAgIC0gJy0tbWF4LWFsbG93ZWQtcGFja2V0PTEyOE0nCiAgICAgIC0gJy0taW5ub2RiLWxvZy1maWxlLXNpemU9NjRNJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICdvd25jbG91ZC1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo2JwogICAgY29tbWFuZDoKICAgICAgLSAnLS1kYXRhYmFzZXMnCiAgICAgIC0gJzEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
-        "tags": [
-            "owncloud",
-            "file-management",
-            "open-web-ui",
-            "integration",
-            "cloud"
-        ],
-        "category": "storage",
-        "logo": "svgs/owncloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-06-02T12:12:42+03:00",
-        "port": "8080"
-    },
     "pairdrop": {
         "documentation": "https://pairdrop.net/?utm_source=coolify.io",
         "slogan": "Pairdrop is a self-hosted file sharing and collaboration platform, offering secure file sharing and collaboration capabilities for efficient teamwork.",
@@ -4315,37 +3645,6 @@
         "template_last_updated_at": "2025-12-02T12:07:14+01:00",
         "port": "8000"
     },
-    "passbolt": {
-        "documentation": "https://www.passbolt.com/ce/docker?utm_source=coolify.io",
-        "slogan": "Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!",
-        "compose": "c2VydmljZXM6CiAgcGFzc2JvbHQ6CiAgICBpbWFnZTogJ3Bhc3Nib2x0L3Bhc3Nib2x0OmxhdGVzdC1jZScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1BBU1NCT0xUCiAgICAgIC0gJ0FQUF9GVUxMX0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfUEFTU0JPTFR9JwogICAgICAtIERBVEFTT1VSQ0VTX0RFRkFVTFRfSE9TVD1tYXJpYWRiCiAgICAgIC0gJ0RBVEFTT1VSQ0VTX0RFRkFVTFRfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfUEFTU0JPTFR9JwogICAgICAtICdEQVRBU09VUkNFU19ERUZBVUxUX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QQVNTQk9MVH0nCiAgICAgIC0gJ0RBVEFTT1VSQ0VTX0RFRkFVTFRfREFUQUJBU0U9JHtNWVNRTF9EQjotcGFzc2JvbHQtZGJ9JwogICAgdm9sdW1lczoKICAgICAgLSAnZ3BnX3ZvbHVtZTovZXRjL3Bhc3Nib2x0L2dwZycKICAgICAgLSAnand0X3ZvbHVtZTovZXRjL3Bhc3Nib2x0L2p3dCcKICAgIGNvbW1hbmQ6CiAgICAgIC0gL3Vzci9iaW4vd2FpdC1mb3Iuc2gKICAgICAgLSAnLXQnCiAgICAgIC0gJzAnCiAgICAgIC0gJ21hcmlhZGI6MzMwNicKICAgICAgLSAnLS0nCiAgICAgIC0gL2RvY2tlci1lbnRyeXBvaW50LnNoCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01BUklBREJfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVE1BUklBREJ9JwogICAgICAtICdNQVJJQURCX0RBVEFCQVNFPSR7TVlTUUxfREI6LXBhc3Nib2x0LWRifScKICAgICAgLSAnTUFSSUFEQl9VU0VSPSR7U0VSVklDRV9VU0VSX1BBU1NCT0xUfScKICAgICAgLSAnTUFSSUFEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUEFTU0JPTFR9JwogICAgdm9sdW1lczoKICAgICAgLSAncGFzc2JvbHRfbWFyaWFkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "security",
-            "credentials",
-            "password-manager",
-            "open source"
-        ],
-        "category": "auth",
-        "logo": "svgs/passbolt.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
-    "paymenter": {
-        "documentation": "https://paymenter.org/docs/guides/docker?utm_source=coolify.io",
-        "slogan": "Open-Source Billing, Built for Hosting",
-        "compose": "c2VydmljZXM6CiAgcGF5bWVudGVyOgogICAgaW1hZ2U6ICdnaGNyLmlvL3BheW1lbnRlci9wYXltZW50ZXI6djEuNC41JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwX2xvZ3M6L2FwcC9zdG9yYWdlL2xvZ3MnCiAgICAgIC0gJ2V4dGVuc3Rpb25zOi9hcHAvZXh0ZW5zaW9ucycKICAgICAgLSAndGhlbWVzOi9hcHAvdGhlbWVzJwogICAgICAtICdhcHBfc3RvcmFnZTovYXBwL3N0b3JhZ2UvYXBwJwogICAgICAtICdhcHBfcHVibGljX3N0b3JhZ2U6L2FwcC9zdG9yYWdlL2FwcC9wdWJsaWMnCiAgICBlbnZpcm9ubWVudDoKICAgICAgU0VSVklDRV9VUkxfUEFZTUVOVEVSOiAnJHtTRVJWSUNFX1VSTF9QQVlNRU5URVJfODB9JwogICAgICBEQl9EQVRBQkFTRTogJyR7TVlTUUxfREFUQUJBU0U6LXBheW1lbnRlci1kYn0nCiAgICAgIERCX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgREJfVVNFUk5BTUU6ICcke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIEFQUF9FTlY6IHByb2R1Y3Rpb24KICAgICAgQ0FDSEVfU1RPUkU6IHJlZGlzCiAgICAgIFNFU1NJT05fRFJJVkVSOiByZWRpcwogICAgICBRVUVVRV9DT05ORUNUSU9OOiByZWRpcwogICAgICBSRURJU19IT1NUOiByZWRpcwogICAgICBSRURJU19VU0VSTkFNRTogZGVmYXVsdAogICAgICBSRURJU19QQVNTV09SRDogJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICAgIERCX0NPTk5FQ1RJT046IG1hcmlhZGIKICAgICAgREJfSE9TVDogbWFyaWFkYgogICAgICBEQl9QT1JUOiAzMzA2CiAgICAgIEFQUF9LRVk6ICcke1NFUlZJQ0VfQkFTRTY0X0tFWX0nCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXNmIGh0dHA6Ly9sb2NhbGhvc3Q6ODAgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExLjgnCiAgICB2b2x1bWVzOgogICAgICAtICdwYXltZW50ZXJfbWFyaWFkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LXBheW1lbnRlci1kYn0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOmFscGluZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncmVkaXMtY2xpIHBpbmcgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMK",
-        "tags": [
-            "automation",
-            "billing",
-            "open source"
-        ],
-        "category": "finance",
-        "logo": "svgs/paymenter.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
     "peertube": {
         "documentation": "https://docs.joinpeertube.org/install/docker?utm_source=coolify.io",
         "slogan": "Free, open-source and decentralized video platform.",
@@ -4379,7 +3678,7 @@
         "category": "productivity",
         "logo": "svgs/penpot.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-11-29T15:56:03+05:30",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8080"
     },
     "penpot": {
@@ -4428,19 +3727,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "8085"
     },
-    "phpmyadmin": {
-        "documentation": "https://phpmyadmin.net?utm_source=coolify.io",
-        "slogan": "phpMyAdmin is a web-based database management tool for administering your MySQL and MariaDB databases through a user-friendly interface.",
-        "compose": "c2VydmljZXM6CiAgcGhwbXlhZG1pbjoKICAgIGltYWdlOiAnbHNjci5pby9saW51eHNlcnZlci9waHBteWFkbWluOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1BIUE1ZQURNSU4KICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSBUWj1FdXJvcGUvTWFkcmlkCiAgICAgIC0gUE1BX0FSQklUUkFSWT0xCiAgICAgIC0gUE1BX0FCU09MVVRFX1VSST0kU0VSVklDRV9VUkxfUEhQTVlBRE1JTgogICAgdm9sdW1lczoKICAgICAgLSAncGhwbXlhZG1pbi1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "database management"
-        ],
-        "category": "database",
-        "logo": "svgs/phpmyadmin.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "pi-hole": {
         "documentation": "https://pi-hole.net/?utm_source=coolify.io",
         "slogan": "Network-wide Ad Blocking",
@@ -4478,7 +3764,7 @@
         "category": "productivity",
         "logo": "svgs/plane.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-10-15T22:51:15+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "80"
     },
     "plex": {
@@ -4638,20 +3924,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "4200"
     },
-    "privatebin": {
-        "documentation": "https://github.com/PrivateBin/PrivateBin/blob/master/doc/README.md?utm_source=coolify.io",
-        "slogan": "PrivateBin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data.",
-        "compose": "c2VydmljZXM6CiAgcHJpdmF0ZWJpbjoKICAgIGltYWdlOiBwcml2YXRlYmluL25naW54LWZwbS1hbHBpbmUKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1BSSVZBVEVCSU5fODA4MAogICAgdm9sdW1lczoKICAgICAgLSAncHJpdmF0ZWJpbl9kYXRhOi9zcnYvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnd2dldCAtcU8tIGh0dHA6Ly8xMjcuMC4wLjE6ODA4MC8nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "text",
-            "sharing"
-        ],
-        "category": "security",
-        "logo": "svgs/privatebin.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "8080"
-    },
     "prowlarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/prowlarr?utm_source=coolify.io",
         "slogan": "Prowlarr\u2060 is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
@@ -4687,40 +3959,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "9159"
     },
-    "pterodactyl-panel": {
-        "documentation": "https://pterodactyl.io/?utm_source=coolify.io",
-        "slogan": "Pterodactyl is a free, open-source game server management panel",
-        "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS44JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdoZWFsdGhjaGVjay5zaCAtLWNvbm5lY3QgLS1pbm5vZGJfaW5pdGlhbGl6ZWQgfHwgZXhpdCAxJwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9cHRlcm9kYWN0eWwtZGIKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgdm9sdW1lczoKICAgICAgLSAncHRlcm9kYWN0eWwtZGI6L3Zhci9saWIvbXlzcWwnCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOmFscGluZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncmVkaXMtY2xpIHBpbmcgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICBwdGVyb2RhY3R5bDoKICAgIGltYWdlOiAnZ2hjci5pby9wdGVyb2RhY3R5bC9wYW5lbDp2MS4xMi4zJwogICAgdm9sdW1lczoKICAgICAgLSAncGFuZWwtdmFyOi9hcHAvdmFyLycKICAgICAgLSAncGFuZWwtbmdpbng6L2V0Yy9uZ2lueC9odHRwLmQvJwogICAgICAtICdwYW5lbC1jZXJ0czovZXRjL2xldHNlbmNyeXB0LycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZXRjL2VudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9lbnRyeXBvaW50LnNoCiAgICAgICAgbW9kZTogJzA3NTUnCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuc2V0IC1lXG5cbiBlY2hvIFwiU2V0dGluZyBsb2dzIHBlcm1pc3Npb25zLi4uXCJcbiBjaG93biAtUiBuZ2lueDogL2FwcC9zdG9yYWdlL2xvZ3MvXG5cbiBVU0VSX0VYSVNUUz0kKHBocCBhcnRpc2FuIHRpbmtlciAtLW5vLWFuc2kgLS1leGVjdXRlPSdlY2hvIFxcUHRlcm9kYWN0eWxcXE1vZGVsc1xcVXNlcjo6d2hlcmUoXCJlbWFpbFwiLCBcIidcIiRBRE1JTl9FTUFJTFwiJ1wiKS0+ZXhpc3RzKCkgPyBcIjFcIiA6IFwiMFwiOycpXG5cbiBpZiBbIFwiJFVTRVJfRVhJU1RTXCIgPSBcIjBcIiBdOyB0aGVuXG4gICBlY2hvIFwiQWRtaW4gVXNlciBkb2VzIG5vdCBleGlzdCwgY3JlYXRpbmcgdXNlciBub3cuXCJcbiAgIHBocCBhcnRpc2FuIHA6dXNlcjptYWtlIC0tbm8taW50ZXJhY3Rpb24gXFxcbiAgICAgLS1hZG1pbj0xIFxcXG4gICAgIC0tZW1haWw9XCIkQURNSU5fRU1BSUxcIiBcXFxuICAgICAtLXVzZXJuYW1lPVwiJEFETUlOX1VTRVJOQU1FXCIgXFxcbiAgICAgLS1uYW1lLWZpcnN0PVwiJEFETUlOX0ZJUlNUTkFNRVwiIFxcXG4gICAgIC0tbmFtZS1sYXN0PVwiJEFETUlOX0xBU1ROQU1FXCIgXFxcbiAgICAgLS1wYXNzd29yZD1cIiRBRE1JTl9QQVNTV09SRFwiXG4gICBlY2hvIFwiQWRtaW4gdXNlciBjcmVhdGVkIHN1Y2Nlc3NmdWxseSFcIlxuIGVsc2VcbiAgIGVjaG8gXCJBZG1pbiBVc2VyIGFscmVhZHkgZXhpc3RzLCBza2lwcGluZyBjcmVhdGlvbi5cIlxuIGZpXG5cbiBleGVjIHN1cGVydmlzb3JkIC0tbm9kYWVtb25cbiIKICAgIGNvbW1hbmQ6CiAgICAgIC0gL2VudHJ5cG9pbnQuc2gKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtc2YgaHR0cDovL2xvY2FsaG9zdDo4MCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEFTSElEU19TQUxUPSRTRVJWSUNFX1BBU1NXT1JEX0hBU0hJRFMKICAgICAgLSBIQVNISURTX0xFTkdUSD04CiAgICAgIC0gU0VSVklDRV9VUkxfUFRFUk9EQUNUWUxfODAKICAgICAgLSAnQURNSU5fRU1BSUw9JHtBRE1JTl9FTUFJTDotYWRtaW5AZXhhbXBsZS5jb219JwogICAgICAtICdBRE1JTl9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0FETUlOX0ZJUlNUTkFNRT0ke0FETUlOX0ZJUlNUTkFNRTotQWRtaW59JwogICAgICAtICdBRE1JTl9MQVNUTkFNRT0ke0FETUlOX0xBU1ROQU1FOi1Vc2VyfScKICAgICAgLSAnQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnUFRFUk9EQUNUWUxfSFRUUFM9JHtQVEVST0RBQ1RZTF9IVFRQUzotZmFsc2V9JwogICAgICAtIEFQUF9FTlY9cHJvZHVjdGlvbgogICAgICAtIEFQUF9FTlZJUk9OTUVOVF9PTkxZPWZhbHNlCiAgICAgIC0gQVBQX1VSTD0kU0VSVklDRV9VUkxfUFRFUk9EQUNUWUwKICAgICAgLSAnQVBQX1RJTUVaT05FPSR7VElNRVpPTkU6LVVUQ30nCiAgICAgIC0gJ0FQUF9TRVJWSUNFX0FVVEhPUj0ke0FQUF9TRVJWSUNFX0FVVEhPUjotYXV0aG9yQGV4YW1wbGUuY29tfScKICAgICAgLSAnTE9HX0xFVkVMPSR7TE9HX0xFVkVMOi1kZWJ1Z30nCiAgICAgIC0gQ0FDSEVfRFJJVkVSPXJlZGlzCiAgICAgIC0gU0VTU0lPTl9EUklWRVI9cmVkaXMKICAgICAgLSBRVUVVRV9EUklWRVI9cmVkaXMKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gREJfREFUQUJBU0U9cHRlcm9kYWN0eWwtZGIKICAgICAgLSBEQl9VU0VSTkFNRT0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gREJfSE9TVD1tYXJpYWRiCiAgICAgIC0gREJfUE9SVD0zMzA2CiAgICAgIC0gREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUwKICAgICAgLSBNQUlMX0ZST009JE1BSUxfRlJPTQogICAgICAtIE1BSUxfRFJJVkVSPSRNQUlMX0RSSVZFUgogICAgICAtIE1BSUxfSE9TVD0kTUFJTF9IT1NUCiAgICAgIC0gTUFJTF9QT1JUPSRNQUlMX1BPUlQKICAgICAgLSBNQUlMX1VTRVJOQU1FPSRNQUlMX1VTRVJOQU1FCiAgICAgIC0gTUFJTF9QQVNTV09SRD0kTUFJTF9QQVNTV09SRAogICAgICAtIE1BSUxfRU5DUllQVElPTj0kTUFJTF9FTkNSWVBUSU9OCg==",
-        "tags": [
-            "game",
-            "game server",
-            "management",
-            "panel",
-            "minecraft"
-        ],
-        "category": "media",
-        "logo": "svgs/pterodactyl.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T18:06:35+02:00",
-        "port": "80"
-    },
-    "pterodactyl-with-wings": {
-        "documentation": "https://pterodactyl.io/?utm_source=coolify.io",
-        "slogan": "Pterodactyl is a free, open-source game server management panel",
-        "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS44JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdoZWFsdGhjaGVjay5zaCAtLWNvbm5lY3QgLS1pbm5vZGJfaW5pdGlhbGl6ZWQgfHwgZXhpdCAxJwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9cHRlcm9kYWN0eWwtZGIKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgdm9sdW1lczoKICAgICAgLSAncHRlcm9kYWN0eWwtZGI6L3Zhci9saWIvbXlzcWwnCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOmFscGluZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncmVkaXMtY2xpIHBpbmcgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICBwdGVyb2RhY3R5bDoKICAgIGltYWdlOiAnZ2hjci5pby9wdGVyb2RhY3R5bC9wYW5lbDp2MS4xMi4zJwogICAgdm9sdW1lczoKICAgICAgLSAncGFuZWwtdmFyOi9hcHAvdmFyLycKICAgICAgLSAncGFuZWwtbmdpbng6L2V0Yy9uZ2lueC9odHRwLmQvJwogICAgICAtICdwYW5lbC1jZXJ0czovZXRjL2xldHNlbmNyeXB0LycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZXRjL2VudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9lbnRyeXBvaW50LnNoCiAgICAgICAgbW9kZTogJzA3NTUnCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuc2V0IC1lXG5cbiBlY2hvIFwiU2V0dGluZyBsb2dzIHBlcm1pc3Npb25zLi4uXCJcbiBjaG93biAtUiBuZ2lueDogL2FwcC9zdG9yYWdlL2xvZ3MvXG5cbiBVU0VSX0VYSVNUUz0kKHBocCBhcnRpc2FuIHRpbmtlciAtLW5vLWFuc2kgLS1leGVjdXRlPSdlY2hvIFxcUHRlcm9kYWN0eWxcXE1vZGVsc1xcVXNlcjo6d2hlcmUoXCJlbWFpbFwiLCBcIidcIiRBRE1JTl9FTUFJTFwiJ1wiKS0+ZXhpc3RzKCkgPyBcIjFcIiA6IFwiMFwiOycpXG5cbiBpZiBbIFwiJFVTRVJfRVhJU1RTXCIgPSBcIjBcIiBdOyB0aGVuXG4gICBlY2hvIFwiQWRtaW4gVXNlciBkb2VzIG5vdCBleGlzdCwgY3JlYXRpbmcgdXNlciBub3cuXCJcbiAgIHBocCBhcnRpc2FuIHA6dXNlcjptYWtlIC0tbm8taW50ZXJhY3Rpb24gXFxcbiAgICAgLS1hZG1pbj0xIFxcXG4gICAgIC0tZW1haWw9XCIkQURNSU5fRU1BSUxcIiBcXFxuICAgICAtLXVzZXJuYW1lPVwiJEFETUlOX1VTRVJOQU1FXCIgXFxcbiAgICAgLS1uYW1lLWZpcnN0PVwiJEFETUlOX0ZJUlNUTkFNRVwiIFxcXG4gICAgIC0tbmFtZS1sYXN0PVwiJEFETUlOX0xBU1ROQU1FXCIgXFxcbiAgICAgLS1wYXNzd29yZD1cIiRBRE1JTl9QQVNTV09SRFwiXG4gICBlY2hvIFwiQWRtaW4gdXNlciBjcmVhdGVkIHN1Y2Nlc3NmdWxseSFcIlxuIGVsc2VcbiAgIGVjaG8gXCJBZG1pbiBVc2VyIGFscmVhZHkgZXhpc3RzLCBza2lwcGluZyBjcmVhdGlvbi5cIlxuIGZpXG5cbiBleGVjIHN1cGVydmlzb3JkIC0tbm9kYWVtb25cbiIKICAgIGNvbW1hbmQ6CiAgICAgIC0gL2VudHJ5cG9pbnQuc2gKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtc2YgaHR0cDovL2xvY2FsaG9zdDo4MCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEFTSElEU19TQUxUPSRTRVJWSUNFX1BBU1NXT1JEX0hBU0hJRFMKICAgICAgLSBIQVNISURTX0xFTkdUSD04CiAgICAgIC0gU0VSVklDRV9VUkxfUFRFUk9EQUNUWUxfODAKICAgICAgLSAnQURNSU5fRU1BSUw9JHtBRE1JTl9FTUFJTDotYWRtaW5AZXhhbXBsZS5jb219JwogICAgICAtICdBRE1JTl9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0FETUlOX0ZJUlNUTkFNRT0ke0FETUlOX0ZJUlNUTkFNRTotQWRtaW59JwogICAgICAtICdBRE1JTl9MQVNUTkFNRT0ke0FETUlOX0xBU1ROQU1FOi1Vc2VyfScKICAgICAgLSAnQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnUFRFUk9EQUNUWUxfSFRUUFM9JHtQVEVST0RBQ1RZTF9IVFRQUzotZmFsc2V9JwogICAgICAtIEFQUF9FTlY9cHJvZHVjdGlvbgogICAgICAtIEFQUF9FTlZJUk9OTUVOVF9PTkxZPWZhbHNlCiAgICAgIC0gQVBQX1VSTD0kU0VSVklDRV9VUkxfUFRFUk9EQUNUWUwKICAgICAgLSAnQVBQX1RJTUVaT05FPSR7VElNRVpPTkU6LVVUQ30nCiAgICAgIC0gJ0FQUF9TRVJWSUNFX0FVVEhPUj0ke0FQUF9TRVJWSUNFX0FVVEhPUjotYXV0aG9yQGV4YW1wbGUuY29tfScKICAgICAgLSAnTE9HX0xFVkVMPSR7TE9HX0xFVkVMOi1kZWJ1Z30nCiAgICAgIC0gQ0FDSEVfRFJJVkVSPXJlZGlzCiAgICAgIC0gU0VTU0lPTl9EUklWRVI9cmVkaXMKICAgICAgLSBRVUVVRV9EUklWRVI9cmVkaXMKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gREJfREFUQUJBU0U9cHRlcm9kYWN0eWwtZGIKICAgICAgLSBEQl9VU0VSTkFNRT0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gREJfSE9TVD1tYXJpYWRiCiAgICAgIC0gREJfUE9SVD0zMzA2CiAgICAgIC0gREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUwKICAgICAgLSBNQUlMX0ZST009JE1BSUxfRlJPTQogICAgICAtIE1BSUxfRFJJVkVSPSRNQUlMX0RSSVZFUgogICAgICAtIE1BSUxfSE9TVD0kTUFJTF9IT1NUCiAgICAgIC0gTUFJTF9QT1JUPSRNQUlMX1BPUlQKICAgICAgLSBNQUlMX1VTRVJOQU1FPSRNQUlMX1VTRVJOQU1FCiAgICAgIC0gTUFJTF9QQVNTV09SRD0kTUFJTF9QQVNTV09SRAogICAgICAtIE1BSUxfRU5DUllQVElPTj0kTUFJTF9FTkNSWVBUSU9OCiAgd2luZ3M6CiAgICBpbWFnZTogJ2doY3IuaW8vcHRlcm9kYWN0eWwvd2luZ3M6djEuMTIuMScKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBwb3J0czoKICAgICAgLSAnMjAyMjoyMDIyJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfV0lOR1NfODQ0MwogICAgICAtICdUWj0ke1RJTUVaT05FOi1VVEN9JwogICAgICAtIFdJTkdTX1VTRVJOQU1FPXB0ZXJvZGFjdHlsCiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnL3Zhci9saWIvZG9ja2VyL2NvbnRhaW5lcnMvOi92YXIvbGliL2RvY2tlci9jb250YWluZXJzLycKICAgICAgLSAnL3Zhci9saWIvcHRlcm9kYWN0eWwvOi92YXIvbGliL3B0ZXJvZGFjdHlsLycKICAgICAgLSAnL3RtcC9wdGVyb2RhY3R5bC86L3RtcC9wdGVyb2RhY3R5bC8nCiAgICAgIC0gJ3dpbmdzLWxvZ3M6L3Zhci9sb2cvcHRlcm9kYWN0eWwvJwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9ldGMvY29uZmlnLnltbAogICAgICAgIHRhcmdldDogL2V0Yy9wdGVyb2RhY3R5bC9jb25maWcueW1sCiAgICAgICAgY29udGVudDogImRlYnVnOiBmYWxzZVxudXVpZDogUkVQTEFDRSBGUk9NIENPTkZJRyAjZXhhbXBsZTogYWJjOWFiYzgtYWJjNy1hYmM2LWFiYzUtYWJjNGFiYzNhYmMyXG50b2tlbl9pZDogUkVQTEFDRSBGUk9NIENPTkZJRyAjZXhhbXBsZTogYWJjMWFiYzJhYmMzYWJjNFxudG9rZW46IFJFUExBQ0UgRlJPTSBDT05GSUcgICNleGFtcGxlOiBhYmMxYWJjMmFiYzNhYmM0YWJjNWFiYzZhYmM3YWJjOGFiYzlhYmMxMGFiYzExYWJjMTJhYmMxM2FiYzE0YWJjMTVhYmMxNlxuYXBpOlxuICBob3N0OiAwLjAuMC4wXG4gIHBvcnQ6IDg0NDMgIyB1c2UgcG9ydCA0NDMgSU4gVEhFIFBBTkVMIGR1cmluZyBub2RlIHNldHVwXG4gIHNzbDpcbiAgICBlbmFibGVkOiBmYWxzZVxuICAgIGNlcnQ6IFJFUExBQ0UgRlJPTSBDT05GSUcgI2V4YW1wbGU6IC9ldGMvbGV0c2VuY3J5cHQvbGl2ZS93aW5ncy1hYmNhYmNhYmNhYmNhYmMuZXhhbXBsZS5jb20vZnVsbGNoYWluLnBlbVxuICAgIGtleTogUkVQTEFDRSBGUk9NIENPTkZJRyAjZXhhbXBsZTogL2V0Yy9sZXRzZW5jcnlwdC9saXZlL3dpbmdzLWFiY2FiY2FiY2FiY2FiYy5leGFtcGxlLmNvbS9wcml2a2V5LnBlbVxuICBkaXNhYmxlX3JlbW90ZV9kb3dubG9hZDogZmFsc2VcbiAgdXBsb2FkX2xpbWl0OiAxMDBcbiAgdHJ1c3RlZF9wcm94aWVzOiBbXVxuc3lzdGVtOlxuICByb290X2RpcmVjdG9yeTogL3Zhci9saWIvcHRlcm9kYWN0eWxcbiAgbG9nX2RpcmVjdG9yeTogL3Zhci9sb2cvcHRlcm9kYWN0eWxcbiAgZGF0YTogL3Zhci9saWIvcHRlcm9kYWN0eWwvdm9sdW1lc1xuICBhcmNoaXZlX2RpcmVjdG9yeTogL3Zhci9saWIvcHRlcm9kYWN0eWwvYXJjaGl2ZXNcbiAgYmFja3VwX2RpcmVjdG9yeTogL3Zhci9saWIvcHRlcm9kYWN0eWwvYmFja3Vwc1xuICB0bXBfZGlyZWN0b3J5OiAvdG1wL3B0ZXJvZGFjdHlsXG4gIHVzZXJuYW1lOiBwdGVyb2RhY3R5bFxuICB0aW1lem9uZTogVVRDXG4gIHVzZXI6XG4gICAgcm9vdGxlc3M6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICAgICAgY29udGFpbmVyX3VpZDogMFxuICAgICAgY29udGFpbmVyX2dpZDogMFxuICAgIHVpZDogOTg4XG4gICAgZ2lkOiA5ODhcbiAgZGlza19jaGVja19pbnRlcnZhbDogMTUwXG4gIGFjdGl2aXR5X3NlbmRfaW50ZXJ2YWw6IDYwXG4gIGFjdGl2aXR5X3NlbmRfY291bnQ6IDEwMFxuICBjaGVja19wZXJtaXNzaW9uc19vbl9ib290OiB0cnVlXG4gIGVuYWJsZV9sb2dfcm90YXRlOiB0cnVlXG4gIHdlYnNvY2tldF9sb2dfY291bnQ6IDE1MFxuICBzZnRwOlxuICAgIGJpbmRfYWRkcmVzczogMC4wLjAuMFxuICAgIGJpbmRfcG9ydDogMjAyMlxuICAgIHJlYWRfb25seTogZmFsc2VcbiAgY3Jhc2hfZGV0ZWN0aW9uOlxuICAgIGVuYWJsZWQ6IHRydWVcbiAgICBkZXRlY3RfY2xlYW5fZXhpdF9hc19jcmFzaDogdHJ1ZVxuICAgIHRpbWVvdXQ6IDYwXG4gIGJhY2t1cHM6XG4gICAgd3JpdGVfbGltaXQ6IDBcbiAgICBjb21wcmVzc2lvbl9sZXZlbDogYmVzdF9zcGVlZFxuICB0cmFuc2ZlcnM6XG4gICAgZG93bmxvYWRfbGltaXQ6IDBcbiAgb3BlbmF0X21vZGU6IGF1dG9cbmRvY2tlcjpcbiAgbmV0d29yazpcbiAgICBpbnRlcmZhY2U6IDE3Mi4yOC4wLjFcbiAgICBkbnM6XG4gICAgICAtIDEuMS4xLjFcbiAgICAgIC0gMS4wLjAuMVxuICAgIG5hbWU6IHB0ZXJvZGFjdHlsX253XG4gICAgaXNwbjogZmFsc2VcbiAgICBkcml2ZXI6IGJyaWRnZVxuICAgIG5ldHdvcmtfbW9kZTogcHRlcm9kYWN0eWxfbndcbiAgICBpc19pbnRlcm5hbDogZmFsc2VcbiAgICBlbmFibGVfaWNjOiB0cnVlXG4gICAgbmV0d29ya19tdHU6IDE1MDBcbiAgICBpbnRlcmZhY2VzOlxuICAgICAgdjQ6XG4gICAgICAgIHN1Ym5ldDogMTcyLjI4LjAuMC8xNlxuICAgICAgICBnYXRld2F5OiAxNzIuMjguMC4xXG4gICAgICB2NjpcbiAgICAgICAgc3VibmV0OiBmZGJhOjE3Yzg6NmM5NDo6LzY0XG4gICAgICAgIGdhdGV3YXk6IGZkYmE6MTdjODo2Yzk0OjoxMDExXG4gIGRvbWFpbm5hbWU6IFwiXCJcbiAgcmVnaXN0cmllczoge31cbiAgdG1wZnNfc2l6ZTogMTAwXG4gIGNvbnRhaW5lcl9waWRfbGltaXQ6IDUxMlxuICBpbnN0YWxsZXJfbGltaXRzOlxuICAgIG1lbW9yeTogMTAyNFxuICAgIGNwdTogMTAwXG4gIG92ZXJoZWFkOlxuICAgIG92ZXJyaWRlOiBmYWxzZVxuICAgIGRlZmF1bHRfbXVsdGlwbGllcjogMS4wNVxuICAgIG11bHRpcGxpZXJzOiB7fVxuICB1c2VfcGVyZm9ybWFudF9pbnNwZWN0OiB0cnVlXG4gIHVzZXJuc19tb2RlOiBcIlwiXG4gIGxvZ19jb25maWc6XG4gICAgdHlwZTogbG9jYWxcbiAgICBjb25maWc6XG4gICAgICBjb21wcmVzczogXCJmYWxzZVwiXG4gICAgICBtYXgtZmlsZTogXCIxXCJcbiAgICAgIG1heC1zaXplOiA1bVxuICAgICAgbW9kZTogbm9uLWJsb2NraW5nXG50aHJvdHRsZXM6XG4gIGVuYWJsZWQ6IHRydWVcbiAgbGluZXM6IDIwMDBcbiAgbGluZV9yZXNldF9pbnRlcnZhbDogMTAwXG5yZW1vdGU6IGh0dHA6Ly9wdGVyb2RhY3R5bDo4MFxucmVtb3RlX3F1ZXJ5OlxuICB0aW1lb3V0OiAzMFxuICBib290X3NlcnZlcnNfcGVyX3BhZ2U6IDUwXG5hbGxvd2VkX21vdW50czogW11cbmFsbG93ZWRfb3JpZ2luczpcbiAgLSBodHRwOi8vcHRlcm9kYWN0eWw6ODBcbiAgLSBQQU5FTCBET01BSU4gIyBleGFtcGxlOiBodHRwczovL3B0ZXJvZGFjdHlsLWFiY2FiY2FiY2FiY2F2Yy5leGFtcGxlLmNvbVxuYWxsb3dfY29yc19wcml2YXRlX25ldHdvcms6IGZhbHNlXG5pZ25vcmVfcGFuZWxfY29uZmlnX3VwZGF0ZXM6IGZhbHNlIgo=",
-        "tags": [
-            "game",
-            "game server",
-            "management",
-            "panel",
-            "minecraft"
-        ],
-        "category": "media",
-        "logo": "svgs/pterodactyl.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T18:06:35+02:00",
-        "port": "80, 8443"
-    },
     "qbittorrent": {
         "documentation": "https://docs.linuxserver.io/images/docker-qbittorrent/?utm_source=coolify.io",
         "slogan": "The qBittorrent project aims to provide an open-source software alternative to \u03bcTorrent.",
@@ -4772,7 +4010,7 @@
         "category": "messaging",
         "logo": "svgs/rabbitmq.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "15672"
     },
     "radarr": {
@@ -4820,7 +4058,7 @@
         "category": "productivity",
         "logo": "svgs/rxresume.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-01-27T21:30:50+01:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "readeck": {
@@ -4924,7 +4162,7 @@
     "rybbit": {
         "documentation": "https://rybbit.io/docs?utm_source=coolify.io",
         "slogan": "Open-source, privacy-first web analytics.",
-        "compose": "c2VydmljZXM6CiAgcnliYml0OgogICAgaW1hZ2U6ICdnaGNyLmlvL3J5YmJpdC1pby9yeWJiaXQtY2xpZW50OnYyLjIuMycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1JZQkJJVF8zMDAyCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtICdORVhUX1BVQkxJQ19CQUNLRU5EX1VSTD0ke1NFUlZJQ0VfVVJMX1JZQkJJVH0nCiAgICAgIC0gJ05FWFRfUFVCTElDX0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gcnliYml0X2JhY2tlbmQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnbmMgLXogMTI3LjAuMC4xIDMwMDInCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByeWJiaXRfYmFja2VuZDoKICAgIGltYWdlOiAnZ2hjci5pby9yeWJiaXQtaW8vcnliYml0LWJhY2tlbmQ6djIuMi4zJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFRSVVNUX1BST1hZPXRydWUKICAgICAgLSAnQkFTRV9VUkw9JHtTRVJWSUNFX1VSTF9SWUJCSVR9JwogICAgICAtICdDTElDS0hPVVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnQkVUVEVSX0FVVEhfU0VDUkVUPSR7U0VSVklDRV9CQVNFNjRfNjRfQkFDS0VORH0nCiAgICAgIC0gJ0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgICAgLSAnRElTQUJMRV9URUxFTUVUUlk9JHtESVNBQkxFX1RFTEVNRVRSWTotdHJ1ZX0nCiAgICAgIC0gJ0NMSUNLSE9VU0VfSE9TVD1odHRwOi8vcnliYml0X2NsaWNraG91c2U6ODEyMycKICAgICAgLSAnQ0xJQ0tIT1VTRV9VU0VSPSR7Q0xJQ0tIT1VTRV9VU0VSOi1kZWZhdWx0fScKICAgICAgLSAnQ0xJQ0tIT1VTRV9EQj0ke0NMSUNLSE9VU0VfREI6LWFuYWx5dGljc30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1yeWJiaXRfcG9zdGdyZXMKICAgICAgLSBQT1NUR1JFU19QT1JUPTU0MzIKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYW5hbHl0aWNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1BPU1RHUkVTX1VTRVI6LWZyb2d9JwogICAgZGVwZW5kc19vbjoKICAgICAgcnliYml0X2NsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcnliYml0X3Bvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAxL2FwaS9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByeWJiaXRfcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3LjQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYW5hbHl0aWNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1BPU1RHUkVTX1VTRVI6LWZyb2d9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgcnliYml0X2NsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjUuNC4yJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0NMSUNLSE9VU0VfREI9JHtDTElDS0hPVVNFX0RCOi1hbmFseXRpY3N9JwogICAgICAtICdDTElDS0hPVVNFX1VTRVI9JHtDTElDS0hPVVNFX1VTRVI6LWRlZmF1bHR9JwogICAgICAtICdDTElDS0hPVVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgxMjMvcGluZycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgdm9sdW1lczoKICAgICAgLSAnY2xpY2tob3VzZV9kYXRhOi92YXIvbGliL2NsaWNraG91c2UnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL2VuYWJsZV9qc29uLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9lbmFibGVfanNvbi54bWwKICAgICAgICBjb250ZW50OiAiPGNsaWNraG91c2U+XG4gICAgPHNldHRpbmdzPlxuICAgICAgICA8ZW5hYmxlX2pzb25fdHlwZT4xPC9lbmFibGVfanNvbl90eXBlPlxuICAgIDwvc2V0dGluZ3M+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL2xvZ2dpbmdfcnVsZXMueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL2NvbmZpZy5kL2xvZ2dpbmdfcnVsZXMueG1sCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxsb2dnZXI+XG4gICAgICAgIDxsZXZlbD53YXJuaW5nPC9sZXZlbD5cbiAgICAgICAgPGNvbnNvbGU+dHJ1ZTwvY29uc29sZT5cbiAgICA8L2xvZ2dlcj5cbiAgICA8cXVlcnlfdGhyZWFkX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHF1ZXJ5X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHRleHRfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8dHJhY2VfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8bWV0cmljX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPGFzeW5jaHJvbm91c19tZXRyaWNfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8c2Vzc2lvbl9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxwYXJ0X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPGxhdGVuY3lfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8cHJvY2Vzc29yc19wcm9maWxlX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG48L2NsaWNraG91c2U+IgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlX2NvbmZpZy9uZXR3b3JrLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9uZXR3b3JrLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8Y2xpY2tob3VzZT5cbiAgICA8bGlzdGVuX2hvc3Q+MC4wLjAuMDwvbGlzdGVuX2hvc3Q+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL3VzZXJfbG9nZ2luZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvdXNlcl9sb2dnaW5nLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8Y2xpY2tob3VzZT5cbiAgICA8cHJvZmlsZXM+XG4gICAgICAgIDxkZWZhdWx0PlxuICAgICAgICAgICAgPGxvZ19xdWVyaWVzPjA8L2xvZ19xdWVyaWVzPlxuICAgICAgICAgICAgPGxvZ19xdWVyeV90aHJlYWRzPjA8L2xvZ19xdWVyeV90aHJlYWRzPlxuICAgICAgICAgICAgPGxvZ19wcm9jZXNzb3JzX3Byb2ZpbGVzPjA8L2xvZ19wcm9jZXNzb3JzX3Byb2ZpbGVzPlxuICAgICAgICA8L2RlZmF1bHQ+XG4gICAgPC9wcm9maWxlcz5cbjwvY2xpY2tob3VzZT5cbiIK",
+        "compose": "c2VydmljZXM6CiAgcnliYml0OgogICAgaW1hZ2U6ICdnaGNyLmlvL3J5YmJpdC1pby9yeWJiaXQtY2xpZW50OnYyLjIuMycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1JZQkJJVF8zMDAyCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtICdORVhUX1BVQkxJQ19CQUNLRU5EX1VSTD0ke1NFUlZJQ0VfVVJMX1JZQkJJVH0nCiAgICAgIC0gJ05FWFRfUFVCTElDX0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gcnliYml0X2JhY2tlbmQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnbmMgLXogMTI3LjAuMC4xIDMwMDInCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByeWJiaXRfYmFja2VuZDoKICAgIGltYWdlOiAnZ2hjci5pby9yeWJiaXQtaW8vcnliYml0LWJhY2tlbmQ6djIuMi4zJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFRSVVNUX1BST1hZPXRydWUKICAgICAgLSAnQkFTRV9VUkw9JHtTRVJWSUNFX1VSTF9SWUJCSVR9JwogICAgICAtICdDTElDS0hPVVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnQkVUVEVSX0FVVEhfU0VDUkVUPSR7U0VSVklDRV9CQVNFNjRfNjRfQkFDS0VORH0nCiAgICAgIC0gJ0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgICAgLSAnRElTQUJMRV9URUxFTUVUUlk9JHtESVNBQkxFX1RFTEVNRVRSWTotdHJ1ZX0nCiAgICAgIC0gJ0NMSUNLSE9VU0VfSE9TVD1odHRwOi8vcnliYml0X2NsaWNraG91c2U6ODEyMycKICAgICAgLSAnQ0xJQ0tIT1VTRV9VU0VSPSR7Q0xJQ0tIT1VTRV9VU0VSOi1kZWZhdWx0fScKICAgICAgLSAnQ0xJQ0tIT1VTRV9EQj0ke0NMSUNLSE9VU0VfREI6LWFuYWx5dGljc30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1yeWJiaXRfcG9zdGdyZXMKICAgICAgLSBQT1NUR1JFU19QT1JUPTU0MzIKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYW5hbHl0aWNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1BPU1RHUkVTX1VTRVI6LWZyb2d9JwogICAgZGVwZW5kc19vbjoKICAgICAgcnliYml0X2NsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcnliYml0X3Bvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAxL2FwaS9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByeWJiaXRfcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3LjQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYW5hbHl0aWNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1BPU1RHUkVTX1VTRVI6LWZyb2d9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgcnliYml0X2NsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjUuNC4yJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0NMSUNLSE9VU0VfREI9JHtDTElDS0hPVVNFX0RCOi1hbmFseXRpY3N9JwogICAgICAtICdDTElDS0hPVVNFX1VTRVI9JHtDTElDS0hPVVNFX1VTRVI6LWRlZmF1bHR9JwogICAgICAtICdDTElDS0hPVVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgxMjMvcGluZycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgdm9sdW1lczoKICAgICAgLSAnY2xpY2tob3VzZV9kYXRhOi92YXIvbGliL2NsaWNraG91c2UnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL2VuYWJsZV9qc29uLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9lbmFibGVfanNvbi54bWwKICAgICAgICBjb250ZW50OiAiPGNsaWNraG91c2U+XG4gICAgPHNldHRpbmdzPlxuICAgICAgICA8ZW5hYmxlX2pzb25fdHlwZT4xPC9lbmFibGVfanNvbl90eXBlPlxuICAgIDwvc2V0dGluZ3M+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL2xvZ2dpbmdfcnVsZXMueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL2NvbmZpZy5kL2xvZ2dpbmdfcnVsZXMueG1sCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxsb2dnZXI+XG4gICAgICAgIDxsZXZlbD53YXJuaW5nPC9sZXZlbD5cbiAgICAgICAgPGNvbnNvbGU+dHJ1ZTwvY29uc29sZT5cbiAgICA8L2xvZ2dlcj5cbiAgICA8cXVlcnlfdGhyZWFkX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHF1ZXJ5X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHRleHRfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8dHJhY2VfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8bWV0cmljX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPGFzeW5jaHJvbm91c19tZXRyaWNfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8c2Vzc2lvbl9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxwYXJ0X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPGxhdGVuY3lfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8cHJvY2Vzc29yc19wcm9maWxlX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL25ldHdvcmsueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL2NvbmZpZy5kL25ldHdvcmsueG1sCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxsaXN0ZW5faG9zdD4wLjAuMC4wPC9saXN0ZW5faG9zdD5cbjwvY2xpY2tob3VzZT5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZV9jb25maWcvdXNlcl9sb2dnaW5nLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC91c2VyX2xvZ2dpbmcueG1sCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxwcm9maWxlcz5cbiAgICAgICAgPGRlZmF1bHQ+XG4gICAgICAgICAgICA8bG9nX3F1ZXJpZXM+MDwvbG9nX3F1ZXJpZXM+XG4gICAgICAgICAgICA8bG9nX3F1ZXJ5X3RocmVhZHM+MDwvbG9nX3F1ZXJ5X3RocmVhZHM+XG4gICAgICAgICAgICA8bG9nX3Byb2Nlc3NvcnNfcHJvZmlsZXM+MDwvbG9nX3Byb2Nlc3NvcnNfcHJvZmlsZXM+XG4gICAgICAgIDwvZGVmYXVsdD5cbiAgICA8L3Byb2ZpbGVzPlxuPC9jbGlja2hvdXNlPlxuIgo=",
         "tags": [
             "analytics",
             "web",
@@ -4987,7 +4225,7 @@
         "category": "storage",
         "logo": "svgs/seafile.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-23T08:56:51+05:30",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "80"
     },
     "searxng": {
@@ -5077,29 +4315,10 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "8080"
     },
-    "shlink": {
-        "documentation": "https://shlink.io/?utm_source=coolify.io",
-        "slogan": "The definitive self-hosted URL shortener",
-        "compose": "c2VydmljZXM6CiAgc2hsaW5rOgogICAgaW1hZ2U6ICdzaGxpbmtpby9zaGxpbms6c3RhYmxlJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfU0hMSU5LXzgwODAKICAgICAgLSAnREVGQVVMVF9ET01BSU49JHtTRVJWSUNFX0ZRRE5fU0hMSU5LfScKICAgICAgLSBJU19IVFRQU19FTkFCTEVEPWZhbHNlCiAgICAgIC0gJ0lOSVRJQUxfQVBJX0tFWT0ke1NFUlZJQ0VfQkFTRTY0X1NITElOS0FQSUtFWX0nCiAgICB2b2x1bWVzOgogICAgICAtICdzaGxpbmstZGF0YTovZXRjL3NobGluay9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwODAvcmVzdC92My9oZWFsdGgnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBzaGxpbmstd2ViOgogICAgaW1hZ2U6IHNobGlua2lvL3NobGluay13ZWItY2xpZW50CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TSExJTktXRUJfODA4MAogICAgICAtICdTSExJTktfU0VSVkVSX0FQSV9LRVk9JHtTRVJWSUNFX0JBU0U2NF9TSExJTktBUElLRVl9JwogICAgICAtICdTSExJTktfU0VSVkVSX1VSTD0ke1NFUlZJQ0VfVVJMX1NITElOS30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "links",
-            "shortener",
-            "sharing",
-            "url",
-            "short",
-            "link",
-            "sharing"
-        ],
-        "category": "productivity",
-        "logo": "svgs/default.webp",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-02T19:40:32+02:00",
-        "port": "8080"
-    },
     "signoz": {
         "documentation": "https://signoz.io/docs/introduction/?utm_source=coolify.io",
         "slogan": "An observability platform native to OpenTelemetry with logs, traces and metrics.",
-        "compose": "c2VydmljZXM6CiAgaW5pdC1jbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI1LjEyLjUtYWxwaW5lJwogICAgY29tbWFuZDoKICAgICAgLSBiYXNoCiAgICAgIC0gJy1jJwogICAgICAtICJ2ZXJzaW9uPVwidjAuMC4xXCJcbm5vZGVfb3M9JCQodW5hbWUgLXMgfCB0ciAnWzp1cHBlcjpdJyAnWzpsb3dlcjpdJylcbm5vZGVfYXJjaD0kJCh1bmFtZSAtbSB8IHNlZCBzL2FhcmNoNjQvYXJtNjQvIHwgc2VkIHMveDg2XzY0L2FtZDY0LylcbmVjaG8gXCJGZXRjaGluZyBoaXN0b2dyYW0tYmluYXJ5IGZvciAkJHtub2RlX29zfS8kJHtub2RlX2FyY2h9XCJcbmNkIC90bXBcbndnZXQgLU8gaGlzdG9ncmFtLXF1YW50aWxlLnRhci5neiBcImh0dHBzOi8vZ2l0aHViLmNvbS9TaWdOb3ovc2lnbm96L3JlbGVhc2VzL2Rvd25sb2FkL2hpc3RvZ3JhbS1xdWFudGlsZSUyRiQke3ZlcnNpb259L2hpc3RvZ3JhbS1xdWFudGlsZV8kJHtub2RlX29zfV8kJHtub2RlX2FyY2h9LnRhci5nelwiXG50YXIgLXh2emYgaGlzdG9ncmFtLXF1YW50aWxlLnRhci5nelxubXYgaGlzdG9ncmFtLXF1YW50aWxlIC92YXIvbGliL2NsaWNraG91c2UvdXNlcl9zY3JpcHRzL2hpc3RvZ3JhbVF1YW50aWxlXG4iCiAgICByZXN0YXJ0OiBvbi1mYWlsdXJlCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGxvZ2dpbmc6CiAgICAgIG9wdGlvbnM6CiAgICAgICAgbWF4LXNpemU6IDUwbQogICAgICAgIG1heC1maWxlOiAnMycKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiB2b2x1bWUKICAgICAgICBzb3VyY2U6IHVzZXItc2NyaXB0cwogICAgICAgIHRhcmdldDogL3Zhci9saWIvY2xpY2tob3VzZS91c2VyX3NjcmlwdHMKICB6b29rZWVwZXI6CiAgICBpbWFnZTogJ3NpZ25vei96b29rZWVwZXI6My45LjMnCiAgICB1c2VyOiByb290CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXMgLW0gMiBodHRwOi8vbG9jYWxob3N0OjgwODAvY29tbWFuZHMvcnVvayB8IGdyZXAgZXJyb3IgfCBncmVwIG51bGwnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgdm9sdW1lczoKICAgICAgLSAnem9va2VlcGVyOi9iaXRuYW1pL3pvb2tlZXBlcicKICAgIGVudmlyb25tZW50OgogICAgICAtICdBTExPV19BTk9OWU1PVVNfTE9HSU49JHtaT09fQUxMT1dfQU5PTllNT1VTX0xPR0lOOi15ZXN9JwogICAgICAtICdaT09fQVVUT1BVUkdFX0lOVEVSVkFMPSR7Wk9PX0FVVE9QVVJHRV9JTlRFUlZBTDotMX0nCiAgICAgIC0gJ1pPT19FTkFCTEVfUFJPTUVUSEVVU19NRVRSSUNTPSR7Wk9PX0VOQUJMRV9QUk9NRVRIRVVTX01FVFJJQ1M6LXllc30nCiAgICAgIC0gJ1pPT19QUk9NRVRIRVVTX01FVFJJQ1NfUE9SVF9OVU1CRVI9JHtaT09fUFJPTUVUSEVVU19NRVRSSUNTX1BPUlRfTlVNQkVSOi05MTQxfScKICBjbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI1LjEyLjUtYWxwaW5lJwogICAgdHR5OiB0cnVlCiAgICBkZXBlbmRzX29uOgogICAgICBpbml0LWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgem9va2VlcGVyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy1PLScKICAgICAgICAtICcwLjAuMC4wOjgxMjMvcGluZycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICB1bGltaXRzOgogICAgICBucHJvYzogNjU1MzUKICAgICAgbm9maWxlOgogICAgICAgIHNvZnQ6IDI2MjE0NAogICAgICAgIGhhcmQ6IDI2MjE0NAogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQ0xJQ0tIT1VTRV9TS0lQX1VTRVJfU0VUVVA9MQogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogY2xpY2tob3VzZQogICAgICAgIHRhcmdldDogL3Zhci9saWIvY2xpY2tob3VzZS8KICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogdXNlci1zY3JpcHRzCiAgICAgICAgdGFyZ2V0OiAvdmFyL2xpYi9jbGlja2hvdXNlL3VzZXJfc2NyaXB0cwogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlL2N1c3RvbS1mdW5jdGlvbi54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY3VzdG9tLWZ1bmN0aW9uLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8ZnVuY3Rpb25zPlxuICAgIDxmdW5jdGlvbj5cbiAgICAgICAgPHR5cGU+ZXhlY3V0YWJsZTwvdHlwZT5cbiAgICAgICAgPG5hbWU+aGlzdG9ncmFtUXVhbnRpbGU8L25hbWU+XG4gICAgICAgIDxyZXR1cm5fdHlwZT5GbG9hdDY0PC9yZXR1cm5fdHlwZT5cbiAgICAgICAgPGFyZ3VtZW50PlxuICAgICAgICAgICAgPHR5cGU+QXJyYXkoRmxvYXQ2NCk8L3R5cGU+XG4gICAgICAgICAgICA8bmFtZT5idWNrZXRzPC9uYW1lPlxuICAgICAgICA8L2FyZ3VtZW50PlxuICAgICAgICA8YXJndW1lbnQ+XG4gICAgICAgICAgICA8dHlwZT5BcnJheShGbG9hdDY0KTwvdHlwZT5cbiAgICAgICAgICAgIDxuYW1lPmNvdW50czwvbmFtZT5cbiAgICAgICAgPC9hcmd1bWVudD5cbiAgICAgICAgPGFyZ3VtZW50PlxuICAgICAgICAgICAgPHR5cGU+RmxvYXQ2NDwvdHlwZT5cbiAgICAgICAgICAgIDxuYW1lPnF1YW50aWxlPC9uYW1lPlxuICAgICAgICA8L2FyZ3VtZW50PlxuICAgICAgICA8Zm9ybWF0PkNTVjwvZm9ybWF0PlxuICAgICAgICA8Y29tbWFuZD4uL2hpc3RvZ3JhbVF1YW50aWxlPC9jb21tYW5kPlxuICAgIDwvZnVuY3Rpb24+XG48L2Z1bmN0aW9ucz5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS9jbHVzdGVyLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9jbHVzdGVyLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8P3htbCB2ZXJzaW9uPVwiMS4wXCI/PlxuPGNsaWNraG91c2U+XG4gICAgPHpvb2tlZXBlcj5cbiAgICAgICAgPG5vZGUgaW5kZXg9XCIxXCI+XG4gICAgICAgICAgICA8aG9zdD56b29rZWVwZXI8L2hvc3Q+XG4gICAgICAgICAgICA8cG9ydD4yMTgxPC9wb3J0PlxuICAgICAgICA8L25vZGU+XG4gICAgPC96b29rZWVwZXI+XG4gICAgPHJlbW90ZV9zZXJ2ZXJzPlxuICAgICAgICA8Y2x1c3Rlcj5cbiAgICAgICAgICAgIDxzaGFyZD5cbiAgICAgICAgICAgICAgICA8cmVwbGljYT5cbiAgICAgICAgICAgICAgICAgICAgPGhvc3Q+Y2xpY2tob3VzZTwvaG9zdD5cbiAgICAgICAgICAgICAgICAgICAgPHBvcnQ+OTAwMDwvcG9ydD5cbiAgICAgICAgICAgICAgICA8L3JlcGxpY2E+XG4gICAgICAgICAgICA8L3NoYXJkPlxuICAgICAgICA8L2NsdXN0ZXI+XG4gICAgPC9yZW1vdGVfc2VydmVycz5cbiAgICA8bWFjcm9zPlxuICAgICAgICA8c2hhcmQ+MDE8L3NoYXJkPlxuICAgICAgICA8cmVwbGljYT5yZXBsaWNhMDE8L3JlcGxpY2E+XG4gICAgPC9tYWNyb3M+XG4gICAgPHVzZXJfc2NyaXB0c19wYXRoPi92YXIvbGliL2NsaWNraG91c2UvdXNlcl9zY3JpcHRzLzwvdXNlcl9zY3JpcHRzX3BhdGg+XG4gICAgPHVzZXJfZGVmaW5lZF9leGVjdXRhYmxlX2Z1bmN0aW9uc19jb25maWc+KmZ1bmN0aW9uLnhtbDwvdXNlcl9kZWZpbmVkX2V4ZWN1dGFibGVfZnVuY3Rpb25zX2NvbmZpZz5cbjwvY2xpY2tob3VzZT5cbiIKICBzaWdub3o6CiAgICBpbWFnZTogJ3NpZ25vei9zaWdub3o6djAuMTM3LjEnCiAgICBkZXBlbmRzX29uOgogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHRlbGVtZXRyeXN0b3JlLW1pZ3JhdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICBsb2dnaW5nOgogICAgICBvcHRpb25zOgogICAgICAgIG1heC1zaXplOiA1MG0KICAgICAgICBtYXgtZmlsZTogJzMnCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogdm9sdW1lCiAgICAgICAgc291cmNlOiBzcWxpdGUKICAgICAgICB0YXJnZXQ6IC92YXIvbGliL3NpZ25vei8KICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1NJR05PWl84MDgwCiAgICAgIC0gJ1NJR05PWl9UT0tFTklaRVJfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUkVBTEJBU0U2NF9KV1RTRUNSRVR9JwogICAgICAtIFNJR05PWl9TUUxTVE9SRV9QUk9WSURFUj1zcWxpdGUKICAgICAgLSBTSUdOT1pfU1FMU1RPUkVfU1FMSVRFX1BBVEg9L3Zhci9saWIvc2lnbm96L3NpZ25vei5kYgogICAgICAtIFNJR05PWl9URUxFTUVUUllTVE9SRV9QUk9WSURFUj1jbGlja2hvdXNlCiAgICAgIC0gJ1NJR05PWl9URUxFTUVUUllTVE9SRV9DTElDS0hPVVNFX0RTTj10Y3A6Ly9jbGlja2hvdXNlOjkwMDAnCiAgICAgIC0gR09ERUJVRz1uZXRkbnM9Z28KICAgICAgLSBERVBMT1lNRU5UX1RZUEU9ZG9ja2VyLXN0YW5kYWxvbmUtYW1kCiAgICAgIC0gJ1NJR05PWl9TVEFUU1JFUE9SVEVSX0VOQUJMRUQ9JHtTSUdOT1pfU1RBVFNSRVBPUlRFUl9FTkFCTEVEOi10cnVlfScKICAgICAgLSAnU0lHTk9aX0VNQUlMSU5HX0VOQUJMRUQ9JHtTSUdOT1pfRU1BSUxJTkdfRU5BQkxFRDotZmFsc2V9JwogICAgICAtICdTSUdOT1pfRU1BSUxJTkdfU01UUF9BRERSRVNTPSR7U0lHTk9aX0VNQUlMSU5HX1NNVFBfQUREUkVTU30nCiAgICAgIC0gJ1NJR05PWl9FTUFJTElOR19TTVRQX0ZST009JHtTSUdOT1pfRU1BSUxJTkdfU01UUF9GUk9NfScKICAgICAgLSAnU0lHTk9aX0VNQUlMSU5HX1NNVFBfQVVUSF9VU0VSTkFNRT0ke1NJR05PWl9FTUFJTElOR19TTVRQX0FVVEhfVVNFUk5BTUV9JwogICAgICAtICdTSUdOT1pfRU1BSUxJTkdfU01UUF9BVVRIX1BBU1NXT1JEPSR7U0lHTk9aX0VNQUlMSU5HX1NNVFBfQVVUSF9QQVNTV09SRH0nCiAgICAgIC0gU0lHTk9aX0FMRVJUTUFOQUdFUl9QUk9WSURFUj1zaWdub3oKICAgICAgLSAnU0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0FVVEhfX1BBU1NXT1JEPSR7U0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0FVVEhfX1BBU1NXT1JEfScKICAgICAgLSAnU0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0FVVEhfX1VTRVJOQU1FPSR7U0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0FVVEhfX1VTRVJOQU1FfScKICAgICAgLSAnU0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0ZST009JHtTSUdOT1pfQUxFUlRNQU5BR0VSX1NJR05PWl9HTE9CQUxfU01UUF9fRlJPTX0nCiAgICAgIC0gJ1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19TTUFSVEhPU1Q9JHtTSUdOT1pfQUxFUlRNQU5BR0VSX1NJR05PWl9HTE9CQUxfU01UUF9fU01BUlRIT1NUfScKICAgICAgLSBET1RfTUVUUklDU19FTkFCTEVEPXRydWUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnLXEnCiAgICAgICAgLSAnbG9jYWxob3N0OjgwODAvYXBpL3YxL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgdGVsZW1ldHJ5c3RvcmUtbWlncmF0b3I6CiAgICBpbWFnZTogJ3NpZ25vei9zaWdub3otb3RlbC1jb2xsZWN0b3I6djAuMTQ0LjgnCiAgICBkZXBlbmRzX29uOgogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnRyeXBvaW50OgogICAgICAtIC9iaW4vc2gKICAgICAgLSAnLWMnCiAgICBjb21tYW5kOgogICAgICAtICIvc2lnbm96LW90ZWwtY29sbGVjdG9yIG1pZ3JhdGUgYm9vdHN0cmFwIC0tY2xpY2tob3VzZS1kc24gdGNwOi8vY2xpY2tob3VzZTo5MDAwICYmXG4vc2lnbm96LW90ZWwtY29sbGVjdG9yIG1pZ3JhdGUgc3luYyB1cCAtLWNsaWNraG91c2UtZHNuIHRjcDovL2NsaWNraG91c2U6OTAwMCAmJlxuL3NpZ25vei1vdGVsLWNvbGxlY3RvciBtaWdyYXRlIGFzeW5jIHVwIC0tY2xpY2tob3VzZS1kc24gdGNwOi8vY2xpY2tob3VzZTo5MDAwXG4iCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfRFNOPXRjcDovL2NsaWNraG91c2U6OTAwMCcKICAgICAgLSBTSUdOT1pfT1RFTF9DT0xMRUNUT1JfQ0xJQ0tIT1VTRV9DTFVTVEVSPWNsdXN0ZXIKICAgICAgLSBTSUdOT1pfT1RFTF9DT0xMRUNUT1JfQ0xJQ0tIT1VTRV9SRVBMSUNBVElPTj10cnVlCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX1RJTUVPVVQ9MTBtCiAgICByZXN0YXJ0OiBvbi1mYWlsdXJlCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGxvZ2dpbmc6CiAgICAgIG9wdGlvbnM6CiAgICAgICAgbWF4LXNpemU6IDUwbQogICAgICAgIG1heC1maWxlOiAnMycKICBvdGVsLWNvbGxlY3RvcjoKICAgIGltYWdlOiAnc2lnbm96L3NpZ25vei1vdGVsLWNvbGxlY3Rvcjp2MC4xNDQuOCcKICAgIGRlcGVuZHNfb246CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgdGVsZW1ldHJ5c3RvcmUtbWlncmF0b3I6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgc2lnbm96OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBsb2dnaW5nOgogICAgICBvcHRpb25zOgogICAgICAgIG1heC1zaXplOiA1MG0KICAgICAgICBtYXgtZmlsZTogJzMnCiAgICBlbnRyeXBvaW50OgogICAgICAtIC9iaW4vc2gKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy1jJwogICAgICAtICJzZXQgLWVcbmNhdCA+IC90bXAvb3RlbC1jb25maWcueWFtbCA8PCdTSUdOT1pfQ0ZHJ1xuY29ubmVjdG9yczpcbiAgc2lnbm96bWV0ZXI6XG4gICAgbWV0cmljc19mbHVzaF9pbnRlcnZhbDogMWhcbiAgICBkaW1lbnNpb25zOlxuICAgICAgLSBuYW1lOiBzZXJ2aWNlLm5hbWVcbiAgICAgIC0gbmFtZTogZGVwbG95bWVudC5lbnZpcm9ubWVudFxuICAgICAgLSBuYW1lOiBob3N0Lm5hbWVcbnJlY2VpdmVyczpcbiAgb3RscDpcbiAgICBwcm90b2NvbHM6XG4gICAgICBncnBjOlxuICAgICAgICBlbmRwb2ludDogMC4wLjAuMDo0MzE3XG4gICAgICBodHRwOlxuICAgICAgICBlbmRwb2ludDogMC4wLjAuMDo0MzE4XG4gICAgICAgIGF1dGg6XG4gICAgICAgICAgYXV0aGVudGljYXRvcjogYmFzaWNhdXRoL3NlcnZlclxucHJvY2Vzc29yczpcbiAgYmF0Y2g6XG4gICAgc2VuZF9iYXRjaF9zaXplOiA1MDAwMFxuICAgIHNlbmRfYmF0Y2hfbWF4X3NpemU6IDU1MDAwXG4gICAgdGltZW91dDogNXNcbiAgYmF0Y2gvbWV0ZXI6XG4gICAgc2VuZF9iYXRjaF9zaXplOiAyMDAwMFxuICAgIHNlbmRfYmF0Y2hfbWF4X3NpemU6IDI1MDAwXG4gICAgdGltZW91dDogNXNcbiAgc2lnbm96c3Bhbm1ldHJpY3MvZGVsdGE6XG4gICAgbWV0cmljc19leHBvcnRlcjogc2lnbm96Y2xpY2tob3VzZW1ldHJpY3NcbiAgICBtZXRyaWNzX2ZsdXNoX2ludGVydmFsOiA2MHNcbiAgICBsYXRlbmN5X2hpc3RvZ3JhbV9idWNrZXRzOiBbMTAwdXMsIDFtcywgMm1zLCA2bXMsIDEwbXMsIDUwbXMsIDEwMG1zLCAyNTBtcywgNTAwbXMsIDEwMDBtcywgMTQwMG1zLCAyMDAwbXMsIDVzLCAxMHMsIDIwcywgNDBzLCA2MHNdXG4gICAgZGltZW5zaW9uc19jYWNoZV9zaXplOiAxMDAwMDBcbiAgICBhZ2dyZWdhdGlvbl90ZW1wb3JhbGl0eTogQUdHUkVHQVRJT05fVEVNUE9SQUxJVFlfREVMVEFcbiAgICBlbmFibGVfZXhwX2hpc3RvZ3JhbTogdHJ1ZVxuICAgIGRpbWVuc2lvbnM6XG4gICAgICAtIG5hbWU6IHNlcnZpY2UubmFtZXNwYWNlXG4gICAgICAgIGRlZmF1bHQ6IGRlZmF1bHRcbiAgICAgIC0gbmFtZTogZGVwbG95bWVudC5lbnZpcm9ubWVudFxuICAgICAgICBkZWZhdWx0OiBkZWZhdWx0XG4gICAgICAjIFRoaXMgaXMgYWRkZWQgdG8gZW5zdXJlIHRoZSB1bmlxdWVuZXNzIG9mIHRoZSB0aW1lc2VyaWVzXG4gICAgICAjIE90aGVyd2lzZSwgaWRlbnRpY2FsIHRpbWVzZXJpZXMgcHJvZHVjZWQgYnkgbXVsdGlwbGUgcmVwbGljYXMgb2ZcbiAgICAgICMgY29sbGVjdG9ycyByZXN1bHQgaW4gaW5jb3JyZWN0IEFQTSBtZXRyaWNzXG4gICAgICAtIG5hbWU6IHNpZ25vei5jb2xsZWN0b3IuaWRcbiAgICAgIC0gbmFtZTogc2VydmljZS52ZXJzaW9uXG5leHBvcnRlcnM6XG4gIGNsaWNraG91c2V0cmFjZXM6XG4gICAgZGF0YXNvdXJjZTogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel90cmFjZXNcbiAgICBsb3dfY2FyZGluYWxfZXhjZXB0aW9uX2dyb3VwaW5nOiBmYWxzZVxuICAgIHVzZV9uZXdfc2NoZW1hOiB0cnVlXG4gICAgdGltZW91dDogNDVzXG4gICAgc2VuZGluZ19xdWV1ZTpcbiAgICAgIGVuYWJsZWQ6IGZhbHNlXG4gIHNpZ25vemNsaWNraG91c2VtZXRyaWNzOlxuICAgIGRzbjogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel9tZXRyaWNzXG4gICAgdGltZW91dDogNDVzXG4gICAgc2VuZGluZ19xdWV1ZTpcbiAgICAgIGVuYWJsZWQ6IGZhbHNlXG4gIGNsaWNraG91c2Vsb2dzZXhwb3J0ZXI6XG4gICAgZHNuOiB0Y3A6Ly9jbGlja2hvdXNlOjkwMDAvc2lnbm96X2xvZ3NcbiAgICB1c2VfbmV3X3NjaGVtYTogdHJ1ZVxuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIHNlbmRpbmdfcXVldWU6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICBzaWdub3pjbGlja2hvdXNlbWV0ZXI6XG4gICAgZHNuOiB0Y3A6Ly9jbGlja2hvdXNlOjkwMDAvc2lnbm96X21ldGVyXG4gICAgdGltZW91dDogNDVzXG4gICAgc2VuZGluZ19xdWV1ZTpcbiAgICAgIGVuYWJsZWQ6IGZhbHNlXG4gIG1ldGFkYXRhZXhwb3J0ZXI6XG4gICAgZW5hYmxlZDogdHJ1ZVxuICAgIGRzbjogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel9tZXRhZGF0YVxuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIGNhY2hlOlxuICAgICAgcHJvdmlkZXI6IGluX21lbW9yeVxuZXh0ZW5zaW9uczpcbiAgc2lnbm96X2hlYWx0aF9jaGVjazpcbiAgICBlbmRwb2ludDogMC4wLjAuMDoxMzEzM1xuICBwcHJvZjpcbiAgICBlbmRwb2ludDogMC4wLjAuMDoxNzc3XG4gIGJhc2ljYXV0aC9zZXJ2ZXI6XG4gICAgaHRwYXNzd2Q6XG4gICAgICBpbmxpbmU6IFwiJCR7ZW52Ok9URUxfQkFTSUNfQVVUSH1cXG5cIlxuc2VydmljZTpcbiAgdGVsZW1ldHJ5OlxuICAgIGxvZ3M6XG4gICAgICBlbmNvZGluZzoganNvblxuICBleHRlbnNpb25zOlxuICAgIC0gc2lnbm96X2hlYWx0aF9jaGVja1xuICAgIC0gcHByb2ZcbiAgICAtIGJhc2ljYXV0aC9zZXJ2ZXJcbiAgcGlwZWxpbmVzOlxuICAgIHRyYWNlczpcbiAgICAgIHJlY2VpdmVyczogW290bHBdXG4gICAgICBwcm9jZXNzb3JzOiBbc2lnbm96c3Bhbm1ldHJpY3MvZGVsdGEsIGJhdGNoXVxuICAgICAgZXhwb3J0ZXJzOiBbY2xpY2tob3VzZXRyYWNlcywgc2lnbm96bWV0ZXIsIG1ldGFkYXRhZXhwb3J0ZXJdXG4gICAgbWV0cmljczpcbiAgICAgIHJlY2VpdmVyczogW290bHBdXG4gICAgICBwcm9jZXNzb3JzOiBbYmF0Y2hdXG4gICAgICBleHBvcnRlcnM6IFtzaWdub3pjbGlja2hvdXNlbWV0cmljcywgc2lnbm96bWV0ZXIsIG1ldGFkYXRhZXhwb3J0ZXJdXG4gICAgbG9nczpcbiAgICAgIHJlY2VpdmVyczogW290bHBdXG4gICAgICBwcm9jZXNzb3JzOiBbYmF0Y2hdXG4gICAgICBleHBvcnRlcnM6IFtjbGlja2hvdXNlbG9nc2V4cG9ydGVyLCBzaWdub3ptZXRlciwgbWV0YWRhdGFleHBvcnRlcl1cbiAgICBtZXRyaWNzL21ldGVyOlxuICAgICAgcmVjZWl2ZXJzOiBbc2lnbm96bWV0ZXJdXG4gICAgICBwcm9jZXNzb3JzOiBbYmF0Y2gvbWV0ZXJdXG4gICAgICBleHBvcnRlcnM6IFtzaWdub3pjbGlja2hvdXNlbWV0ZXJdXG5TSUdOT1pfQ0ZHXG5jYXQgPiAvdG1wL29wYW1wLWNvbmZpZy55YW1sIDw8J1NJR05PWl9PUEFNUCdcbnNlcnZlcl9lbmRwb2ludDogd3M6Ly9zaWdub3o6NDMyMC92MS9vcGFtcFxuU0lHTk9aX09QQU1QXG4vc2lnbm96LW90ZWwtY29sbGVjdG9yIG1pZ3JhdGUgc3luYyBjaGVja1xuZXhlYyAvc2lnbm96LW90ZWwtY29sbGVjdG9yIC0tY29uZmlnPS90bXAvb3RlbC1jb25maWcueWFtbCAtLW1hbmFnZXItY29uZmlnPS90bXAvb3BhbXAtY29uZmlnLnlhbWwgLS1jb3B5LXBhdGg9L3Zhci90bXAvY29sbGVjdG9yLWNvbmZpZy55YW1sXG4iCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PVEVMQ09MTEVDVE9SSFRUUF80MzE4CiAgICAgIC0gJ09URUxfUkVTT1VSQ0VfQVRUUklCVVRFUz1ob3N0Lm5hbWU9c2lnbm96LWhvc3Qsb3MudHlwZT1saW51eCcKICAgICAgLSBMT1dfQ0FSRElOQUxfRVhDRVBUSU9OX0dST1VQSU5HPWZhbHNlCiAgICAgIC0gJ1NJR05PWl9PVEVMX0NPTExFQ1RPUl9DTElDS0hPVVNFX0RTTj10Y3A6Ly9jbGlja2hvdXNlOjkwMDAnCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfQ0xVU1RFUj1jbHVzdGVyCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfUkVQTElDQVRJT049dHJ1ZQogICAgICAtIFNJR05PWl9PVEVMX0NPTExFQ1RPUl9USU1FT1VUPTEwbQogICAgICAtICdPVEVMX0JBU0lDX0FVVEg9c2lnbm96OiR7U0VSVklDRV9QQVNTV09SRF82NF9PVEVMQVVUSH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ2Jhc2ggLWMgImV4ZWMgNjw+IC9kZXYvdGNwL2xvY2FsaG9zdC8xMzEzMyInCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
+        "compose": "c2VydmljZXM6CiAgaW5pdC1jbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI1LjEyLjUtYWxwaW5lJwogICAgY29tbWFuZDoKICAgICAgLSBiYXNoCiAgICAgIC0gJy1jJwogICAgICAtICJ2ZXJzaW9uPVwidjAuMC4xXCJcbm5vZGVfb3M9JCQodW5hbWUgLXMgfCB0ciAnWzp1cHBlcjpdJyAnWzpsb3dlcjpdJylcbm5vZGVfYXJjaD0kJCh1bmFtZSAtbSB8IHNlZCBzL2FhcmNoNjQvYXJtNjQvIHwgc2VkIHMveDg2XzY0L2FtZDY0LylcbmVjaG8gXCJGZXRjaGluZyBoaXN0b2dyYW0tYmluYXJ5IGZvciAkJHtub2RlX29zfS8kJHtub2RlX2FyY2h9XCJcbmNkIC90bXBcbndnZXQgLU8gaGlzdG9ncmFtLXF1YW50aWxlLnRhci5neiBcImh0dHBzOi8vZ2l0aHViLmNvbS9TaWdOb3ovc2lnbm96L3JlbGVhc2VzL2Rvd25sb2FkL2hpc3RvZ3JhbS1xdWFudGlsZSUyRiQke3ZlcnNpb259L2hpc3RvZ3JhbS1xdWFudGlsZV8kJHtub2RlX29zfV8kJHtub2RlX2FyY2h9LnRhci5nelwiXG50YXIgLXh2emYgaGlzdG9ncmFtLXF1YW50aWxlLnRhci5nelxubXYgaGlzdG9ncmFtLXF1YW50aWxlIC92YXIvbGliL2NsaWNraG91c2UvdXNlcl9zY3JpcHRzL2hpc3RvZ3JhbVF1YW50aWxlXG4iCiAgICByZXN0YXJ0OiBvbi1mYWlsdXJlCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGxvZ2dpbmc6CiAgICAgIG9wdGlvbnM6CiAgICAgICAgbWF4LXNpemU6IDUwbQogICAgICAgIG1heC1maWxlOiAnMycKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiB2b2x1bWUKICAgICAgICBzb3VyY2U6IHVzZXItc2NyaXB0cwogICAgICAgIHRhcmdldDogL3Zhci9saWIvY2xpY2tob3VzZS91c2VyX3NjcmlwdHMKICB6b29rZWVwZXI6CiAgICBpbWFnZTogJ3NpZ25vei96b29rZWVwZXI6My45LjMnCiAgICB1c2VyOiByb290CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXMgLW0gMiBodHRwOi8vbG9jYWxob3N0OjgwODAvY29tbWFuZHMvcnVvayB8IGdyZXAgZXJyb3IgfCBncmVwIG51bGwnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgdm9sdW1lczoKICAgICAgLSAnem9va2VlcGVyOi9iaXRuYW1pL3pvb2tlZXBlcicKICAgIGVudmlyb25tZW50OgogICAgICAtICdBTExPV19BTk9OWU1PVVNfTE9HSU49JHtaT09fQUxMT1dfQU5PTllNT1VTX0xPR0lOOi15ZXN9JwogICAgICAtICdaT09fQVVUT1BVUkdFX0lOVEVSVkFMPSR7Wk9PX0FVVE9QVVJHRV9JTlRFUlZBTDotMX0nCiAgICAgIC0gJ1pPT19FTkFCTEVfUFJPTUVUSEVVU19NRVRSSUNTPSR7Wk9PX0VOQUJMRV9QUk9NRVRIRVVTX01FVFJJQ1M6LXllc30nCiAgICAgIC0gJ1pPT19QUk9NRVRIRVVTX01FVFJJQ1NfUE9SVF9OVU1CRVI9JHtaT09fUFJPTUVUSEVVU19NRVRSSUNTX1BPUlRfTlVNQkVSOi05MTQxfScKICBjbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI1LjEyLjUtYWxwaW5lJwogICAgdHR5OiB0cnVlCiAgICBkZXBlbmRzX29uOgogICAgICBpbml0LWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgem9va2VlcGVyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy1PLScKICAgICAgICAtICcwLjAuMC4wOjgxMjMvcGluZycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICB1bGltaXRzOgogICAgICBucHJvYzogNjU1MzUKICAgICAgbm9maWxlOgogICAgICAgIHNvZnQ6IDI2MjE0NAogICAgICAgIGhhcmQ6IDI2MjE0NAogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQ0xJQ0tIT1VTRV9TS0lQX1VTRVJfU0VUVVA9MQogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogY2xpY2tob3VzZQogICAgICAgIHRhcmdldDogL3Zhci9saWIvY2xpY2tob3VzZS8KICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogdXNlci1zY3JpcHRzCiAgICAgICAgdGFyZ2V0OiAvdmFyL2xpYi9jbGlja2hvdXNlL3VzZXJfc2NyaXB0cwogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlL2N1c3RvbS1mdW5jdGlvbi54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY3VzdG9tLWZ1bmN0aW9uLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8ZnVuY3Rpb25zPlxuICAgIDxmdW5jdGlvbj5cbiAgICAgICAgPHR5cGU+ZXhlY3V0YWJsZTwvdHlwZT5cbiAgICAgICAgPG5hbWU+aGlzdG9ncmFtUXVhbnRpbGU8L25hbWU+XG4gICAgICAgIDxyZXR1cm5fdHlwZT5GbG9hdDY0PC9yZXR1cm5fdHlwZT5cbiAgICAgICAgPGFyZ3VtZW50PlxuICAgICAgICAgICAgPHR5cGU+QXJyYXkoRmxvYXQ2NCk8L3R5cGU+XG4gICAgICAgICAgICA8bmFtZT5idWNrZXRzPC9uYW1lPlxuICAgICAgICA8L2FyZ3VtZW50PlxuICAgICAgICA8YXJndW1lbnQ+XG4gICAgICAgICAgICA8dHlwZT5BcnJheShGbG9hdDY0KTwvdHlwZT5cbiAgICAgICAgICAgIDxuYW1lPmNvdW50czwvbmFtZT5cbiAgICAgICAgPC9hcmd1bWVudD5cbiAgICAgICAgPGFyZ3VtZW50PlxuICAgICAgICAgICAgPHR5cGU+RmxvYXQ2NDwvdHlwZT5cbiAgICAgICAgICAgIDxuYW1lPnF1YW50aWxlPC9uYW1lPlxuICAgICAgICA8L2FyZ3VtZW50PlxuICAgICAgICA8Zm9ybWF0PkNTVjwvZm9ybWF0PlxuICAgICAgICA8Y29tbWFuZD4uL2hpc3RvZ3JhbVF1YW50aWxlPC9jb21tYW5kPlxuICAgIDwvZnVuY3Rpb24+XG48L2Z1bmN0aW9ucz5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS9jbHVzdGVyLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9jbHVzdGVyLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8P3htbCB2ZXJzaW9uPVwiMS4wXCI/PlxuPGNsaWNraG91c2U+XG4gICAgPHpvb2tlZXBlcj5cbiAgICAgICAgPG5vZGUgaW5kZXg9XCIxXCI+XG4gICAgICAgICAgICA8aG9zdD56b29rZWVwZXI8L2hvc3Q+XG4gICAgICAgICAgICA8cG9ydD4yMTgxPC9wb3J0PlxuICAgICAgICA8L25vZGU+XG4gICAgPC96b29rZWVwZXI+XG4gICAgPHJlbW90ZV9zZXJ2ZXJzPlxuICAgICAgICA8Y2x1c3Rlcj5cbiAgICAgICAgICAgIDxzaGFyZD5cbiAgICAgICAgICAgICAgICA8cmVwbGljYT5cbiAgICAgICAgICAgICAgICAgICAgPGhvc3Q+Y2xpY2tob3VzZTwvaG9zdD5cbiAgICAgICAgICAgICAgICAgICAgPHBvcnQ+OTAwMDwvcG9ydD5cbiAgICAgICAgICAgICAgICA8L3JlcGxpY2E+XG4gICAgICAgICAgICA8L3NoYXJkPlxuICAgICAgICA8L2NsdXN0ZXI+XG4gICAgPC9yZW1vdGVfc2VydmVycz5cbiAgICA8bWFjcm9zPlxuICAgICAgICA8c2hhcmQ+MDE8L3NoYXJkPlxuICAgICAgICA8cmVwbGljYT5yZXBsaWNhMDE8L3JlcGxpY2E+XG4gICAgPC9tYWNyb3M+XG4gICAgPHVzZXJfc2NyaXB0c19wYXRoPi92YXIvbGliL2NsaWNraG91c2UvdXNlcl9zY3JpcHRzLzwvdXNlcl9zY3JpcHRzX3BhdGg+XG4gICAgPHVzZXJfZGVmaW5lZF9leGVjdXRhYmxlX2Z1bmN0aW9uc19jb25maWc+KmZ1bmN0aW9uLnhtbDwvdXNlcl9kZWZpbmVkX2V4ZWN1dGFibGVfZnVuY3Rpb25zX2NvbmZpZz5cbjwvY2xpY2tob3VzZT5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS9zeXN0ZW0tbG9ncy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvc3lzdGVtLWxvZ3MueG1sCiAgICAgICAgY29udGVudDogIjw/eG1sIHZlcnNpb249XCIxLjBcIj8+XG48Y2xpY2tob3VzZT5cbiAgICA8cXVlcnlfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICAgICAgPGZsdXNoX2ludGVydmFsX21pbGxpc2Vjb25kcz4zMDAwMDwvZmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPlxuICAgIDwvcXVlcnlfbG9nPlxuICAgIDxxdWVyeV90aHJlYWRfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICA8L3F1ZXJ5X3RocmVhZF9sb2c+XG4gICAgPHF1ZXJ5X21ldHJpY19sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgIDwvcXVlcnlfbWV0cmljX2xvZz5cbiAgICA8cXVlcnlfdmlld3NfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICA8L3F1ZXJ5X3ZpZXdzX2xvZz5cbiAgICA8cGFydF9sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgIDwvcGFydF9sb2c+XG4gICAgPG1ldHJpY19sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgICAgICA8Zmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPjMwMDAwPC9mbHVzaF9pbnRlcnZhbF9taWxsaXNlY29uZHM+XG4gICAgPC9tZXRyaWNfbG9nPlxuICAgIDxhc3luY2hyb25vdXNfbWV0cmljX2xvZz5cbiAgICAgICAgPHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgMSBEQVkgREVMRVRFPC90dGw+XG4gICAgPC9hc3luY2hyb25vdXNfbWV0cmljX2xvZz5cbiAgICA8dHJhY2VfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICAgICAgPGZsdXNoX2ludGVydmFsX21pbGxpc2Vjb25kcz4zMDAwMDwvZmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPlxuICAgIDwvdHJhY2VfbG9nPlxuICAgIDxlcnJvcl9sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgIDwvZXJyb3JfbG9nPlxuICAgIDxwcm9jZXNzb3JzX3Byb2ZpbGVfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICAgICAgPGZsdXNoX2ludGVydmFsX21pbGxpc2Vjb25kcz4zMDAwMDwvZmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPlxuICAgIDwvcHJvY2Vzc29yc19wcm9maWxlX2xvZz5cbiAgICA8dGV4dF9sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgICAgICA8Zmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPjMwMDAwPC9mbHVzaF9pbnRlcnZhbF9taWxsaXNlY29uZHM+XG4gICAgPC90ZXh0X2xvZz5cbjwvY2xpY2tob3VzZT5cbiIKICBzaWdub3o6CiAgICBpbWFnZTogJ3NpZ25vei9zaWdub3o6djAuMTM3LjEnCiAgICBkZXBlbmRzX29uOgogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHRlbGVtZXRyeXN0b3JlLW1pZ3JhdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICBsb2dnaW5nOgogICAgICBvcHRpb25zOgogICAgICAgIG1heC1zaXplOiA1MG0KICAgICAgICBtYXgtZmlsZTogJzMnCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogdm9sdW1lCiAgICAgICAgc291cmNlOiBzcWxpdGUKICAgICAgICB0YXJnZXQ6IC92YXIvbGliL3NpZ25vei8KICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1NJR05PWl84MDgwCiAgICAgIC0gJ1NJR05PWl9UT0tFTklaRVJfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUkVBTEJBU0U2NF9KV1RTRUNSRVR9JwogICAgICAtIFNJR05PWl9TUUxTVE9SRV9QUk9WSURFUj1zcWxpdGUKICAgICAgLSBTSUdOT1pfU1FMU1RPUkVfU1FMSVRFX1BBVEg9L3Zhci9saWIvc2lnbm96L3NpZ25vei5kYgogICAgICAtIFNJR05PWl9URUxFTUVUUllTVE9SRV9QUk9WSURFUj1jbGlja2hvdXNlCiAgICAgIC0gJ1NJR05PWl9URUxFTUVUUllTVE9SRV9DTElDS0hPVVNFX0RTTj10Y3A6Ly9jbGlja2hvdXNlOjkwMDAnCiAgICAgIC0gR09ERUJVRz1uZXRkbnM9Z28KICAgICAgLSBERVBMT1lNRU5UX1RZUEU9ZG9ja2VyLXN0YW5kYWxvbmUtYW1kCiAgICAgIC0gJ1NJR05PWl9TVEFUU1JFUE9SVEVSX0VOQUJMRUQ9JHtTSUdOT1pfU1RBVFNSRVBPUlRFUl9FTkFCTEVEOi10cnVlfScKICAgICAgLSAnU0lHTk9aX0VNQUlMSU5HX0VOQUJMRUQ9JHtTSUdOT1pfRU1BSUxJTkdfRU5BQkxFRDotZmFsc2V9JwogICAgICAtICdTSUdOT1pfRU1BSUxJTkdfU01UUF9BRERSRVNTPSR7U0lHTk9aX0VNQUlMSU5HX1NNVFBfQUREUkVTU30nCiAgICAgIC0gJ1NJR05PWl9FTUFJTElOR19TTVRQX0ZST009JHtTSUdOT1pfRU1BSUxJTkdfU01UUF9GUk9NfScKICAgICAgLSAnU0lHTk9aX0VNQUlMSU5HX1NNVFBfQVVUSF9VU0VSTkFNRT0ke1NJR05PWl9FTUFJTElOR19TTVRQX0FVVEhfVVNFUk5BTUV9JwogICAgICAtICdTSUdOT1pfRU1BSUxJTkdfU01UUF9BVVRIX1BBU1NXT1JEPSR7U0lHTk9aX0VNQUlMSU5HX1NNVFBfQVVUSF9QQVNTV09SRH0nCiAgICAgIC0gU0lHTk9aX0FMRVJUTUFOQUdFUl9QUk9WSURFUj1zaWdub3oKICAgICAgLSAnU0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0FVVEhfX1BBU1NXT1JEPSR7U0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0FVVEhfX1BBU1NXT1JEfScKICAgICAgLSAnU0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0FVVEhfX1VTRVJOQU1FPSR7U0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0FVVEhfX1VTRVJOQU1FfScKICAgICAgLSAnU0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0ZST009JHtTSUdOT1pfQUxFUlRNQU5BR0VSX1NJR05PWl9HTE9CQUxfU01UUF9fRlJPTX0nCiAgICAgIC0gJ1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19TTUFSVEhPU1Q9JHtTSUdOT1pfQUxFUlRNQU5BR0VSX1NJR05PWl9HTE9CQUxfU01UUF9fU01BUlRIT1NUfScKICAgICAgLSBET1RfTUVUUklDU19FTkFCTEVEPXRydWUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnLXEnCiAgICAgICAgLSAnbG9jYWxob3N0OjgwODAvYXBpL3YxL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgdGVsZW1ldHJ5c3RvcmUtbWlncmF0b3I6CiAgICBpbWFnZTogJ3NpZ25vei9zaWdub3otb3RlbC1jb2xsZWN0b3I6djAuMTQ0LjgnCiAgICBkZXBlbmRzX29uOgogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnRyeXBvaW50OgogICAgICAtIC9iaW4vc2gKICAgICAgLSAnLWMnCiAgICBjb21tYW5kOgogICAgICAtICIvc2lnbm96LW90ZWwtY29sbGVjdG9yIG1pZ3JhdGUgYm9vdHN0cmFwIC0tY2xpY2tob3VzZS1kc24gdGNwOi8vY2xpY2tob3VzZTo5MDAwICYmXG4vc2lnbm96LW90ZWwtY29sbGVjdG9yIG1pZ3JhdGUgc3luYyB1cCAtLWNsaWNraG91c2UtZHNuIHRjcDovL2NsaWNraG91c2U6OTAwMCAmJlxuL3NpZ25vei1vdGVsLWNvbGxlY3RvciBtaWdyYXRlIGFzeW5jIHVwIC0tY2xpY2tob3VzZS1kc24gdGNwOi8vY2xpY2tob3VzZTo5MDAwXG4iCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfRFNOPXRjcDovL2NsaWNraG91c2U6OTAwMCcKICAgICAgLSBTSUdOT1pfT1RFTF9DT0xMRUNUT1JfQ0xJQ0tIT1VTRV9DTFVTVEVSPWNsdXN0ZXIKICAgICAgLSBTSUdOT1pfT1RFTF9DT0xMRUNUT1JfQ0xJQ0tIT1VTRV9SRVBMSUNBVElPTj10cnVlCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX1RJTUVPVVQ9MTBtCiAgICByZXN0YXJ0OiBvbi1mYWlsdXJlCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGxvZ2dpbmc6CiAgICAgIG9wdGlvbnM6CiAgICAgICAgbWF4LXNpemU6IDUwbQogICAgICAgIG1heC1maWxlOiAnMycKICBvdGVsLWNvbGxlY3RvcjoKICAgIGltYWdlOiAnc2lnbm96L3NpZ25vei1vdGVsLWNvbGxlY3Rvcjp2MC4xNDQuOCcKICAgIGRlcGVuZHNfb246CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgdGVsZW1ldHJ5c3RvcmUtbWlncmF0b3I6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgc2lnbm96OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBsb2dnaW5nOgogICAgICBvcHRpb25zOgogICAgICAgIG1heC1zaXplOiA1MG0KICAgICAgICBtYXgtZmlsZTogJzMnCiAgICBlbnRyeXBvaW50OgogICAgICAtIC9iaW4vc2gKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy1jJwogICAgICAtICJzZXQgLWVcbmNhdCA+IC90bXAvb3RlbC1jb25maWcueWFtbCA8PCdTSUdOT1pfQ0ZHJ1xuY29ubmVjdG9yczpcbiAgc2lnbm96bWV0ZXI6XG4gICAgbWV0cmljc19mbHVzaF9pbnRlcnZhbDogMWhcbiAgICBkaW1lbnNpb25zOlxuICAgICAgLSBuYW1lOiBzZXJ2aWNlLm5hbWVcbiAgICAgIC0gbmFtZTogZGVwbG95bWVudC5lbnZpcm9ubWVudFxuICAgICAgLSBuYW1lOiBob3N0Lm5hbWVcbnJlY2VpdmVyczpcbiAgb3RscDpcbiAgICBwcm90b2NvbHM6XG4gICAgICBncnBjOlxuICAgICAgICBlbmRwb2ludDogMC4wLjAuMDo0MzE3XG4gICAgICBodHRwOlxuICAgICAgICBlbmRwb2ludDogMC4wLjAuMDo0MzE4XG4gICAgICAgIGF1dGg6XG4gICAgICAgICAgYXV0aGVudGljYXRvcjogYmFzaWNhdXRoL3NlcnZlclxucHJvY2Vzc29yczpcbiAgYmF0Y2g6XG4gICAgc2VuZF9iYXRjaF9zaXplOiA1MDAwMFxuICAgIHNlbmRfYmF0Y2hfbWF4X3NpemU6IDU1MDAwXG4gICAgdGltZW91dDogNXNcbiAgYmF0Y2gvbWV0ZXI6XG4gICAgc2VuZF9iYXRjaF9zaXplOiAyMDAwMFxuICAgIHNlbmRfYmF0Y2hfbWF4X3NpemU6IDI1MDAwXG4gICAgdGltZW91dDogNXNcbiAgc2lnbm96c3Bhbm1ldHJpY3MvZGVsdGE6XG4gICAgbWV0cmljc19leHBvcnRlcjogc2lnbm96Y2xpY2tob3VzZW1ldHJpY3NcbiAgICBtZXRyaWNzX2ZsdXNoX2ludGVydmFsOiA2MHNcbiAgICBsYXRlbmN5X2hpc3RvZ3JhbV9idWNrZXRzOiBbMTAwdXMsIDFtcywgMm1zLCA2bXMsIDEwbXMsIDUwbXMsIDEwMG1zLCAyNTBtcywgNTAwbXMsIDEwMDBtcywgMTQwMG1zLCAyMDAwbXMsIDVzLCAxMHMsIDIwcywgNDBzLCA2MHNdXG4gICAgZGltZW5zaW9uc19jYWNoZV9zaXplOiAxMDAwMDBcbiAgICBhZ2dyZWdhdGlvbl90ZW1wb3JhbGl0eTogQUdHUkVHQVRJT05fVEVNUE9SQUxJVFlfREVMVEFcbiAgICBlbmFibGVfZXhwX2hpc3RvZ3JhbTogdHJ1ZVxuICAgIGRpbWVuc2lvbnM6XG4gICAgICAtIG5hbWU6IHNlcnZpY2UubmFtZXNwYWNlXG4gICAgICAgIGRlZmF1bHQ6IGRlZmF1bHRcbiAgICAgIC0gbmFtZTogZGVwbG95bWVudC5lbnZpcm9ubWVudFxuICAgICAgICBkZWZhdWx0OiBkZWZhdWx0XG4gICAgICAjIFRoaXMgaXMgYWRkZWQgdG8gZW5zdXJlIHRoZSB1bmlxdWVuZXNzIG9mIHRoZSB0aW1lc2VyaWVzXG4gICAgICAjIE90aGVyd2lzZSwgaWRlbnRpY2FsIHRpbWVzZXJpZXMgcHJvZHVjZWQgYnkgbXVsdGlwbGUgcmVwbGljYXMgb2ZcbiAgICAgICMgY29sbGVjdG9ycyByZXN1bHQgaW4gaW5jb3JyZWN0IEFQTSBtZXRyaWNzXG4gICAgICAtIG5hbWU6IHNpZ25vei5jb2xsZWN0b3IuaWRcbiAgICAgIC0gbmFtZTogc2VydmljZS52ZXJzaW9uXG5leHBvcnRlcnM6XG4gIGNsaWNraG91c2V0cmFjZXM6XG4gICAgZGF0YXNvdXJjZTogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel90cmFjZXNcbiAgICBsb3dfY2FyZGluYWxfZXhjZXB0aW9uX2dyb3VwaW5nOiBmYWxzZVxuICAgIHVzZV9uZXdfc2NoZW1hOiB0cnVlXG4gICAgdGltZW91dDogNDVzXG4gICAgc2VuZGluZ19xdWV1ZTpcbiAgICAgIGVuYWJsZWQ6IGZhbHNlXG4gIHNpZ25vemNsaWNraG91c2VtZXRyaWNzOlxuICAgIGRzbjogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel9tZXRyaWNzXG4gICAgdGltZW91dDogNDVzXG4gICAgc2VuZGluZ19xdWV1ZTpcbiAgICAgIGVuYWJsZWQ6IGZhbHNlXG4gIGNsaWNraG91c2Vsb2dzZXhwb3J0ZXI6XG4gICAgZHNuOiB0Y3A6Ly9jbGlja2hvdXNlOjkwMDAvc2lnbm96X2xvZ3NcbiAgICB1c2VfbmV3X3NjaGVtYTogdHJ1ZVxuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIHNlbmRpbmdfcXVldWU6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICBzaWdub3pjbGlja2hvdXNlbWV0ZXI6XG4gICAgZHNuOiB0Y3A6Ly9jbGlja2hvdXNlOjkwMDAvc2lnbm96X21ldGVyXG4gICAgdGltZW91dDogNDVzXG4gICAgc2VuZGluZ19xdWV1ZTpcbiAgICAgIGVuYWJsZWQ6IGZhbHNlXG4gIG1ldGFkYXRhZXhwb3J0ZXI6XG4gICAgZW5hYmxlZDogdHJ1ZVxuICAgIGRzbjogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel9tZXRhZGF0YVxuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIGNhY2hlOlxuICAgICAgcHJvdmlkZXI6IGluX21lbW9yeVxuZXh0ZW5zaW9uczpcbiAgc2lnbm96X2hlYWx0aF9jaGVjazpcbiAgICBlbmRwb2ludDogMC4wLjAuMDoxMzEzM1xuICBwcHJvZjpcbiAgICBlbmRwb2ludDogMC4wLjAuMDoxNzc3XG4gIGJhc2ljYXV0aC9zZXJ2ZXI6XG4gICAgaHRwYXNzd2Q6XG4gICAgICBpbmxpbmU6IFwiJCR7ZW52Ok9URUxfQkFTSUNfQVVUSH1cXG5cIlxuc2VydmljZTpcbiAgdGVsZW1ldHJ5OlxuICAgIGxvZ3M6XG4gICAgICBlbmNvZGluZzoganNvblxuICBleHRlbnNpb25zOlxuICAgIC0gc2lnbm96X2hlYWx0aF9jaGVja1xuICAgIC0gcHByb2ZcbiAgICAtIGJhc2ljYXV0aC9zZXJ2ZXJcbiAgcGlwZWxpbmVzOlxuICAgIHRyYWNlczpcbiAgICAgIHJlY2VpdmVyczogW290bHBdXG4gICAgICBwcm9jZXNzb3JzOiBbc2lnbm96c3Bhbm1ldHJpY3MvZGVsdGEsIGJhdGNoXVxuICAgICAgZXhwb3J0ZXJzOiBbY2xpY2tob3VzZXRyYWNlcywgc2lnbm96bWV0ZXIsIG1ldGFkYXRhZXhwb3J0ZXJdXG4gICAgbWV0cmljczpcbiAgICAgIHJlY2VpdmVyczogW290bHBdXG4gICAgICBwcm9jZXNzb3JzOiBbYmF0Y2hdXG4gICAgICBleHBvcnRlcnM6IFtzaWdub3pjbGlja2hvdXNlbWV0cmljcywgc2lnbm96bWV0ZXIsIG1ldGFkYXRhZXhwb3J0ZXJdXG4gICAgbG9nczpcbiAgICAgIHJlY2VpdmVyczogW290bHBdXG4gICAgICBwcm9jZXNzb3JzOiBbYmF0Y2hdXG4gICAgICBleHBvcnRlcnM6IFtjbGlja2hvdXNlbG9nc2V4cG9ydGVyLCBzaWdub3ptZXRlciwgbWV0YWRhdGFleHBvcnRlcl1cbiAgICBtZXRyaWNzL21ldGVyOlxuICAgICAgcmVjZWl2ZXJzOiBbc2lnbm96bWV0ZXJdXG4gICAgICBwcm9jZXNzb3JzOiBbYmF0Y2gvbWV0ZXJdXG4gICAgICBleHBvcnRlcnM6IFtzaWdub3pjbGlja2hvdXNlbWV0ZXJdXG5TSUdOT1pfQ0ZHXG5jYXQgPiAvdG1wL29wYW1wLWNvbmZpZy55YW1sIDw8J1NJR05PWl9PUEFNUCdcbnNlcnZlcl9lbmRwb2ludDogd3M6Ly9zaWdub3o6NDMyMC92MS9vcGFtcFxuU0lHTk9aX09QQU1QXG4vc2lnbm96LW90ZWwtY29sbGVjdG9yIG1pZ3JhdGUgc3luYyBjaGVja1xuZXhlYyAvc2lnbm96LW90ZWwtY29sbGVjdG9yIC0tY29uZmlnPS90bXAvb3RlbC1jb25maWcueWFtbCAtLW1hbmFnZXItY29uZmlnPS90bXAvb3BhbXAtY29uZmlnLnlhbWwgLS1jb3B5LXBhdGg9L3Zhci90bXAvY29sbGVjdG9yLWNvbmZpZy55YW1sXG4iCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PVEVMQ09MTEVDVE9SSFRUUF80MzE4CiAgICAgIC0gJ09URUxfUkVTT1VSQ0VfQVRUUklCVVRFUz1ob3N0Lm5hbWU9c2lnbm96LWhvc3Qsb3MudHlwZT1saW51eCcKICAgICAgLSBMT1dfQ0FSRElOQUxfRVhDRVBUSU9OX0dST1VQSU5HPWZhbHNlCiAgICAgIC0gJ1NJR05PWl9PVEVMX0NPTExFQ1RPUl9DTElDS0hPVVNFX0RTTj10Y3A6Ly9jbGlja2hvdXNlOjkwMDAnCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfQ0xVU1RFUj1jbHVzdGVyCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfUkVQTElDQVRJT049dHJ1ZQogICAgICAtIFNJR05PWl9PVEVMX0NPTExFQ1RPUl9USU1FT1VUPTEwbQogICAgICAtICdPVEVMX0JBU0lDX0FVVEg9c2lnbm96OiR7U0VSVklDRV9QQVNTV09SRF82NF9PVEVMQVVUSH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ2Jhc2ggLWMgImV4ZWMgNjw+IC9kZXYvdGNwL2xvY2FsaG9zdC8xMzEzMyInCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "telemetry",
             "server",
@@ -5113,7 +4332,7 @@
         "category": "monitoring",
         "logo": "svgs/signoz.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-08T19:22:39+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8080"
     },
     "silverbullet": {
@@ -5165,38 +4384,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "5231"
     },
-    "snapdrop": {
-        "documentation": "https://github.com/RobinLinus/snapdrop?utm_source=coolify.io",
-        "slogan": "A self-hosted file-sharing service for secure and convenient file transfers, whether on a local network or the internet.",
-        "compose": "c2VydmljZXM6CiAgc25hcGRyb3A6CiAgICBpbWFnZTogJ2xpbnV4c2VydmVyL3NuYXBkcm9wOnZlcnNpb24tYjhiNzhjYzInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TTkFQRFJPUAogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtIFRaPUV1cm9wZS9NYWRyaWQKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NuYXBkcm9wLWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
-        "tags": [
-            "file",
-            "sharing",
-            "transfer",
-            "local",
-            "network",
-            "internet"
-        ],
-        "category": "productivity",
-        "logo": "svgs/default.webp",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "snipe-it": {
-        "documentation": "https://snipe-it.readme.io/docs/introduction?utm_source=coolify.io",
-        "slogan": "Snipe-IT is an open-source asset management platform built for IT departments.",
-        "compose": "c2VydmljZXM6CiAgYXBwOgogICAgaW1hZ2U6ICdzbmlwZS9zbmlwZS1pdDp2OC43LjEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TTklQRUlUXzgwCiAgICAgIC0gQVBQX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gQVBQX0RFQlVHPWZhbHNlCiAgICAgIC0gJ0FQUF9LRVk9YmFzZTY0OiR7U0VSVklDRV9SRUFMQkFTRTY0XzMyX0FQUEtFWX0nCiAgICAgIC0gJ0FQUF9VUkw9JHtTRVJWSUNFX1VSTF9TTklQRUlUfScKICAgICAgLSAnQVBQX1RJTUVaT05FPSR7QVBQX1RJTUVaT05FOi1VVEN9JwogICAgICAtICdBUFBfTE9DQUxFPSR7QVBQX0xPQ0FMRTotZW4tVVN9JwogICAgICAtIERCX0NPTk5FQ1RJT049bXlzcWwKICAgICAgLSBEQl9IT1NUPW1hcmlhZGIKICAgICAgLSBEQl9QT1JUPTMzMDYKICAgICAgLSAnREJfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotc25pcGVpdH0nCiAgICAgIC0gJ0RCX1VTRVJOQU1FPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ01BSUxfTUFJTEVSPSR7TUFJTF9NQUlMRVI6LXNtdHB9JwogICAgICAtICdNQUlMX0hPU1Q9JHtNQUlMX0hPU1Q6LW51bGx9JwogICAgICAtICdNQUlMX1BPUlQ9JHtNQUlMX1BPUlQ6LTEwMjV9JwogICAgICAtICdNQUlMX1VTRVJOQU1FPSR7TUFJTF9VU0VSTkFNRTotbnVsbH0nCiAgICAgIC0gJ01BSUxfUEFTU1dPUkQ9JHtNQUlMX1BBU1NXT1JEOi1udWxsfScKICAgICAgLSAnTUFJTF9GUk9NX0FERFI9JHtNQUlMX0ZST01fQUREUjoteW91QGV4YW1wbGUuY29tfScKICAgICAgLSAnTUFJTF9GUk9NX05BTUU9JHtNQUlMX0ZST01fTkFNRTotU25pcGUtSVR9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3RvcmFnZTovdmFyL2xpYi9zbmlwZWl0JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS44JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LXNuaXBlaXR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgdm9sdW1lczoKICAgICAgLSAnZGJfZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDUK",
-        "tags": [
-            "inventory",
-            "open-source"
-        ],
-        "category": "productivity",
-        "logo": "svgs/snipe-it.webp",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-17T14:08:10+02:00",
-        "port": "80"
-    },
     "soju": {
         "documentation": "https://soju.im/?utm_source=coolify.io",
         "slogan": "A user-friendly IRC bouncer with a modern web interface",
@@ -5214,22 +4401,6 @@
         "template_last_updated_at": "2025-12-09T00:35:53+03:00",
         "port": "80"
     },
-    "soketi-app-manager": {
-        "documentation": "https://github.com/rahulhaque/soketi-app-manager-filament?utm_source=coolify.io",
-        "slogan": "Manage soketi websocket server and apps with ease.",
-        "compose": "c2VydmljZXM6CiAgc29rZXRpLWFwcC1tYW5hZ2VyOgogICAgaW1hZ2U6ICdnaGNyLmlvL3JhaHVsaGFxdWUvc29rZXRpLWFwcC1tYW5hZ2VyLWZpbGFtZW50LWFscGluZTpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU09LRVRJQVBQTUFOQUdFUl84MDgwCiAgICAgIC0gQVVUT1JVTl9FTkFCTEVEPXRydWUKICAgICAgLSAnQVVUT1JVTl9MQVJBVkVMX01JR1JBVElPTj0ke0FVVE9SVU5fTEFSQVZFTF9NSUdSQVRJT046LXRydWV9JwogICAgICAtICdBUFBfREVCVUc9JHtBUFBfREVCVUc6LWZhbHNlfScKICAgICAgLSBBUFBfVVJMPSRTRVJWSUNFX0ZRRE5fU09LRVRJQVBQTUFOQUdFUgogICAgICAtIEFQUF9LRVk9JEFQUF9LRVkKICAgICAgLSBEQl9DT05ORUNUSU9OPSREQl9DT05ORUNUSU9OCiAgICAgIC0gREJfSE9TVD0kREJfSE9TVAogICAgICAtIERCX1BPUlQ9JERCX1BPUlQKICAgICAgLSBEQl9EQVRBQkFTRT0kREJfREFUQUJBU0UKICAgICAgLSBEQl9VU0VSTkFNRT0kREJfVVNFUk5BTUUKICAgICAgLSBEQl9QQVNTV09SRD0kREJfUEFTU1dPUkQKICAgICAgLSBQVVNIRVJfSE9TVD0kUFVTSEVSX0hPU1QKICAgICAgLSBQVVNIRVJfUE9SVD0kUFVTSEVSX1BPUlQKICAgICAgLSBQVVNIRVJfU0NIRU1FPSRQVVNIRVJfU0NIRU1FCiAgICAgIC0gUFVTSEVSX0FQUF9DTFVTVEVSPSRQVVNIRVJfQVBQX0NMVVNURVIKICAgICAgLSBTT0tFVElfREJfUkVESVNfVVNFUk5BTUU9JFNPS0VUSV9EQl9SRURJU19VU0VSTkFNRQogICAgICAtIFNPS0VUSV9EQl9SRURJU19QQVNTV09SRD0kU09LRVRJX0RCX1JFRElTX1BBU1NXT1JECiAgICAgIC0gTUVUUklDU19IT1NUPSRNRVRSSUNTX0hPU1QKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwaHAtZnBtLWhlYWx0aGNoZWNrCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCg==",
-        "tags": [
-            "soketi",
-            "websockets",
-            "app-manager",
-            "dashboard"
-        ],
-        "category": "devtools",
-        "logo": "svgs/soketi-app-manager.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "8080"
-    },
     "soketi": {
         "documentation": "https://docs.soketi.app?utm_source=coolify.io",
         "slogan": "Soketi is your simple, fast, and resilient open-source WebSockets server.",
@@ -5377,7 +4548,7 @@
     "supabase": {
         "documentation": "https://supabase.io?utm_source=coolify.io",
         "slogan": "The open source Firebase alternative.",
-        "compose": "c2VydmljZXM6CiAgc3VwYWJhc2Uta29uZzoKICAgIGltYWdlOiAna29uZy9rb25nOjMuOS4xJwogICAgZW50cnlwb2ludDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGtvbmcKICAgICAgICAtIGhlYWx0aAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfU1VQQUJBU0VLT05HXzgwMDAKICAgICAgLSAnS09OR19QT1JUX01BUFM9NDQzOjgwMDAnCiAgICAgIC0gJ0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gS09OR19EQVRBQkFTRT1vZmYKICAgICAgLSBLT05HX0RFQ0xBUkFUSVZFX0NPTkZJRz0vdXNyL2xvY2FsL2tvbmcva29uZy55bWwKICAgICAgLSAnS09OR19ETlNfT1JERVI9TEFTVCxBLENOQU1FJwogICAgICAtIEtPTkdfRE5TX05PVF9GT1VORF9UVEw9MQogICAgICAtICdLT05HX1BMVUdJTlM9cmVxdWVzdC10cmFuc2Zvcm1lcixjb3JzLGtleS1hdXRoLGFjbCxiYXNpYy1hdXRoLHJlcXVlc3QtdGVybWluYXRpb24saXAtcmVzdHJpY3Rpb24scG9zdC1mdW5jdGlvbicKICAgICAgLSBLT05HX05HSU5YX1BST1hZX1BST1hZX0JVRkZFUl9TSVpFPTE2MGsKICAgICAgLSAnS09OR19OR0lOWF9QUk9YWV9QUk9YWV9CVUZGRVJTPTY0IDE2MGsnCiAgICAgIC0gJ0tPTkdfUFJPWFlfQUNDRVNTX0xPRz0vZGV2L3N0ZG91dCBjb21iaW5lZCcKICAgICAgLSAnU1VQQUJBU0VfQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTVVBBQkFTRV9TRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWT0ke1NVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWTotfScKICAgICAgLSAnU1VQQUJBU0VfU0VDUkVUX0tFWT0ke1NVUEFCQVNFX1NFQ1JFVF9LRVk6LX0nCiAgICAgIC0gJ0FOT05fS0VZX0FTWU1NRVRSSUM9JHtBTk9OX0tFWV9BU1lNTUVUUklDOi19JwogICAgICAtICdTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUM9JHtTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUM6LX0nCiAgICAgIC0gJ0RBU0hCT0FSRF9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0RBU0hCT0FSRF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtICdLT05HX1NUT1JBR0VfQ09OTkVDVF9USU1FT1VUPSR7S09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVDotNjB9JwogICAgICAtICdLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9XUklURV9USU1FT1VUOi0zNjAwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFQURfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVQ6LTM2MDB9JwogICAgICAtICdLT05HX1NUT1JBR0VfUkVRVUVTVF9CVUZGRVJJTkc9JHtLT05HX1NUT1JBR0VfUkVRVUVTVF9CVUZGRVJJTkc6LWZhbHNlfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFU1BPTlNFX0JVRkZFUklORz0ke0tPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkc6LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvYXBpL2tvbmctZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL2Jhc2hcbiMgQ3VzdG9tIGVudHJ5cG9pbnQgZm9yIEtvbmcgdGhhdCBidWlsZHMgTHVhIGV4cHJlc3Npb25zIGZvciByZXF1ZXN0LXRyYW5zZm9ybWVyXG4jIGFuZCBwZXJmb3JtcyBlbnZpcm9ubWVudCB2YXJpYWJsZSBzdWJzdGl0dXRpb24gaW4gdGhlIGRlY2xhcmF0aXZlIGNvbmZpZy5cblxuaWYgWyAtbiBcIiRTVVBBQkFTRV9TRUNSRVRfS0VZXCIgXSAmJiBbIC1uIFwiJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWVwiIF07IHRoZW5cbiAgICBleHBvcnQgTFVBX0FVVEhfRVhQUj1cIlxcJCgoaGVhZGVycy5hdXRob3JpemF0aW9uIH49IG5pbCBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uOnN1YigxLCAxMCkgfj0gJ0JlYXJlciBzYl8nIGFuZCBoZWFkZXJzLmF1dGhvcml6YXRpb24pIG9yIChoZWFkZXJzLmFwaWtleSA9PSAnJFNVUEFCQVNFX1NFQ1JFVF9LRVknIGFuZCAnQmVhcmVyICRTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUMnKSBvciAoaGVhZGVycy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVknIGFuZCAnQmVhcmVyICRBTk9OX0tFWV9BU1lNTUVUUklDJykgb3IgaGVhZGVycy5hcGlrZXkpXCJcbiAgICBleHBvcnQgTFVBX1JUX1dTX0VYUFI9XCJcXCQoKHF1ZXJ5X3BhcmFtcy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9TRUNSRVRfS0VZJyBhbmQgJyRTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUMnKSBvciAocXVlcnlfcGFyYW1zLmFwaWtleSA9PSAnJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWScgYW5kICckQU5PTl9LRVlfQVNZTU1FVFJJQycpIG9yIHF1ZXJ5X3BhcmFtcy5hcGlrZXkpXCJcbmVsc2VcbiAgICBleHBvcnQgTFVBX0FVVEhfRVhQUj1cIlxcJCgoaGVhZGVycy5hdXRob3JpemF0aW9uIH49IG5pbCBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uOnN1YigxLCAxMCkgfj0gJ0JlYXJlciBzYl8nIGFuZCBoZWFkZXJzLmF1dGhvcml6YXRpb24pIG9yIGhlYWRlcnMuYXBpa2V5KVwiXG4gICAgZXhwb3J0IExVQV9SVF9XU19FWFBSPVwiXFwkKHF1ZXJ5X3BhcmFtcy5hcGlrZXkpXCJcbmZpXG5cbmF3ayAne1xuICByZXN1bHQgPSBcIlwiXG4gIHJlc3QgPSAkMFxuICB3aGlsZSAobWF0Y2gocmVzdCwgL1xcJFtBLVphLXpfXVtBLVphLXpfMC05XSovKSkge1xuICAgIHZhcm5hbWUgPSBzdWJzdHIocmVzdCwgUlNUQVJUICsgMSwgUkxFTkdUSCAtIDEpXG4gICAgaWYgKHZhcm5hbWUgaW4gRU5WSVJPTikge1xuICAgICAgcmVzdWx0ID0gcmVzdWx0IHN1YnN0cihyZXN0LCAxLCBSU1RBUlQgLSAxKSBFTlZJUk9OW3Zhcm5hbWVdXG4gICAgfSBlbHNlIHtcbiAgICAgIHJlc3VsdCA9IHJlc3VsdCBzdWJzdHIocmVzdCwgMSwgUlNUQVJUICsgUkxFTkdUSCAtIDEpXG4gICAgfVxuICAgIHJlc3QgPSBzdWJzdHIocmVzdCwgUlNUQVJUICsgUkxFTkdUSClcbiAgfVxuICBwcmludCByZXN1bHQgcmVzdFxufScgL2hvbWUva29uZy90ZW1wLnltbCA+IFwiJEtPTkdfREVDTEFSQVRJVkVfQ09ORklHXCJcblxuc2VkIC1pICcvXltbOnNwYWNlOl1dKi0ga2V5OltbOnNwYWNlOl1dKiQvZCcgXCIkS09OR19ERUNMQVJBVElWRV9DT05GSUdcIlxuXG5leGVjIC9lbnRyeXBvaW50LnNoIGtvbmcgZG9ja2VyLXN0YXJ0XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvYXBpL2tvbmcueW1sCiAgICAgICAgdGFyZ2V0OiAvaG9tZS9rb25nL3RlbXAueW1sCiAgICAgICAgY29udGVudDogIl9mb3JtYXRfdmVyc2lvbjogJzIuMSdcbl90cmFuc2Zvcm06IHRydWVcblxuIyMjXG4jIyMgQ29uc3VtZXJzIC8gVXNlcnNcbiMjI1xuY29uc3VtZXJzOlxuICAtIHVzZXJuYW1lOiBEQVNIQk9BUkRcbiAgLSB1c2VybmFtZTogYW5vblxuICAgIGtleWF1dGhfY3JlZGVudGlhbHM6XG4gICAgICAtIGtleTogJFNVUEFCQVNFX0FOT05fS0VZXG4gICAgICAtIGtleTogJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWVxuICAtIHVzZXJuYW1lOiBzZXJ2aWNlX3JvbGVcbiAgICBrZXlhdXRoX2NyZWRlbnRpYWxzOlxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9TRVJWSUNFX0tFWVxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9TRUNSRVRfS0VZXG5cbiMjI1xuIyMjIEFjY2VzcyBDb250cm9sIExpc3RcbiMjI1xuYWNsczpcbiAgLSBjb25zdW1lcjogYW5vblxuICAgIGdyb3VwOiBhbm9uXG4gIC0gY29uc3VtZXI6IHNlcnZpY2Vfcm9sZVxuICAgIGdyb3VwOiBhZG1pblxuXG4jIyNcbiMjIyBEYXNoYm9hcmQgY3JlZGVudGlhbHNcbiMjI1xuYmFzaWNhdXRoX2NyZWRlbnRpYWxzOlxuLSBjb25zdW1lcjogREFTSEJPQVJEXG4gIHVzZXJuYW1lOiAnJERBU0hCT0FSRF9VU0VSTkFNRSdcbiAgcGFzc3dvcmQ6ICckREFTSEJPQVJEX1BBU1NXT1JEJ1xuXG5cbiMjI1xuIyMjIEFQSSBSb3V0ZXNcbiMjI1xuc2VydmljZXM6XG5cbiAgIyMgT3BlbiBBdXRoIHJvdXRlc1xuICAtIG5hbWU6IGF1dGgtdjEtb3BlblxuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS92ZXJpZnlcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3BlblxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvdmVyaWZ5XG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1jYWxsYmFja1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9jYWxsYmFja1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWNhbGxiYWNrXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS9jYWxsYmFja1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tYXV0aG9yaXplXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L2F1dGhvcml6ZVxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWF1dGhvcml6ZVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvYXV0aG9yaXplXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1qd2tzXG4gICAgX2NvbW1lbnQ6ICdBdXRoOiAvYXV0aC92MS8ud2VsbC1rbm93bi9qd2tzLmpzb24gLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9qd2tzLmpzb24nXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5Ly53ZWxsLWtub3duL2p3a3MuanNvblxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWp3a3NcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvblxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tYWNzXG4gICAgdXJsOiBcImh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvc3NvL3NhbWwvYWNzXCJcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tYWNzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgIC0gL3Nzby9zYW1sL2Fjc1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tbWV0YWRhdGFcbiAgICB1cmw6IFwiaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9zc28vc2FtbC9tZXRhZGF0YVwiXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLW1ldGFkYXRhXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgIC0gL3Nzby9zYW1sL21ldGFkYXRhXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuXG4gICMjIFNlY3VyZSBBdXRoIHJvdXRlc1xuICAtIG5hbWU6IGF1dGgtdjFcbiAgICBfY29tbWVudDogJ0dvVHJ1ZTogL2F1dGgvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5LyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTZWN1cmUgUkVTVCByb3V0ZXNcbiAgLSBuYW1lOiByZXN0LXYxXG4gICAgX2NvbW1lbnQ6ICdQb3N0Z1JFU1Q6IC9yZXN0L3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC8qJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlc3QtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvcmVzdC92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU2VjdXJlIEdyYXBoUUwgcm91dGVzXG4gIC0gbmFtZTogZ3JhcGhxbC12MVxuICAgIF9jb21tZW50OiAnUG9zdGdSRVNUOiAvZ3JhcGhxbC92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvcnBjL2dyYXBocWwnXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtcmVzdDozMDAwL3JwYy9ncmFwaHFsXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBncmFwaHFsLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2dyYXBocWwvdjFcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQ29udGVudC1Qcm9maWxlOiBncmFwaHFsX3B1YmxpY1wiXG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJDb250ZW50LVByb2ZpbGU6IGdyYXBocWxfcHVibGljXCJcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuXG4gICMjIFNlY3VyZSBSZWFsdGltZSByb3V0ZXNcbiAgLSBuYW1lOiByZWFsdGltZS12MS13c1xuICAgIF9jb21tZW50OiAnUmVhbHRpbWU6IC9yZWFsdGltZS92MS8qIC0+IHdzOi8vcmVhbHRpbWU6NDAwMC9zb2NrZXQvKidcbiAgICB1cmw6IGh0dHA6Ly9yZWFsdGltZS1kZXY6NDAwMC9zb2NrZXRcbiAgICBwcm90b2NvbDogd3NcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlYWx0aW1lLXYxLXdzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvcmVhbHRpbWUvdjEvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgcXVlcnlzdHJpbmc6XG4gICAgICAgICAgICAgIC0gXCJhcGlrZXk6ICRMVUFfUlRfV1NfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIHF1ZXJ5c3RyaW5nOlxuICAgICAgICAgICAgICAtIFwiYXBpa2V5OiAkTFVBX1JUX1dTX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG4gIC0gbmFtZTogcmVhbHRpbWUtdjEtcmVzdFxuICAgIF9jb21tZW50OiAnUmVhbHRpbWU6IC9yZWFsdGltZS92MS9hcGkvKiAtPiBodHRwOi8vcmVhbHRpbWU6NDAwMC9hcGkvKidcbiAgICB1cmw6IGh0dHA6Ly9yZWFsdGltZS1kZXY6NDAwMC9hcGlcbiAgICBwcm90b2NvbDogaHR0cFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogcmVhbHRpbWUtdjEtcmVzdFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3JlYWx0aW1lL3YxL2FwaVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTdG9yYWdlIEFQSSBlbmRwb2ludFxuICAjIyBObyBrZXktYXV0aCAtIFMzIHByb3RvY29sIHJlcXVlc3RzIGRvbid0IGNhcnJ5IGFuIGFwaWtleSBoZWFkZXIuXG4gIC0gbmFtZTogc3RvcmFnZS12MVxuICAgIF9jb21tZW50OiAnU3RvcmFnZTogL3N0b3JhZ2UvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2Utc3RvcmFnZTo1MDAwLyonXG4gICAgY29ubmVjdF90aW1lb3V0OiAkS09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVFxuICAgIHdyaXRlX3RpbWVvdXQ6ICRLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVFxuICAgIHJlYWRfdGltZW91dDogJEtPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVRcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdG9yYWdlOjUwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBzdG9yYWdlLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3N0b3JhZ2UvdjEvXG4gICAgICAgIHJlcXVlc3RfYnVmZmVyaW5nOiAkS09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HXG4gICAgICAgIHJlc3BvbnNlX2J1ZmZlcmluZzogJEtPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkdcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IHBvc3QtZnVuY3Rpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFjY2VzczpcbiAgICAgICAgICAgIC0gfFxuICAgICAgICAgICAgICBsb2NhbCBhdXRoID0ga29uZy5yZXF1ZXN0LmdldF9oZWFkZXIoXCJhdXRob3JpemF0aW9uXCIpXG4gICAgICAgICAgICAgIGlmIGF1dGggPT0gbmlsIG9yIGF1dGggPT0gXCJcIiBvciBhdXRoOmZpbmQoXCJeJXMqJFwiKSB0aGVuXG4gICAgICAgICAgICAgICAga29uZy5zZXJ2aWNlLnJlcXVlc3QuY2xlYXJfaGVhZGVyKFwiYXV0aG9yaXphdGlvblwiKVxuICAgICAgICAgICAgICBlbmRcblxuICAjIyBFZGdlIEZ1bmN0aW9ucyByb3V0ZXNcbiAgLSBuYW1lOiBmdW5jdGlvbnMtdjFcbiAgICBfY29tbWVudDogJ0VkZ2UgRnVuY3Rpb25zOiAvZnVuY3Rpb25zL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zOjkwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczo5MDAwL1xuICAgIHJlYWRfdGltZW91dDogMTUwMDAwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBmdW5jdGlvbnMtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvZnVuY3Rpb25zL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBPQXV0aCAyLjAgQXV0aG9yaXphdGlvbiBTZXJ2ZXIgTWV0YWRhdGEgKFJGQyA4NDE0KVxuICAtIG5hbWU6IHdlbGwta25vd24tb2F1dGhcbiAgICBfY29tbWVudDogJ0F1dGg6IC8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlciAtPiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5Ly53ZWxsLWtub3duL29hdXRoLWF1dGhvcml6YXRpb24tc2VydmVyJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlclxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogd2VsbC1rbm93bi1vYXV0aFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gLy53ZWxsLWtub3duL29hdXRoLWF1dGhvcml6YXRpb24tc2VydmVyXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuXG4gICMjIEFuYWx5dGljcyByb3V0ZXNcbiAgIyMgTm90IHVzZWQgLSBTdHVkaW8gYW5kIFZlY3RvciB0YWxrIGRpcmVjdGx5IHRvIGFuYWx5dGljcyB2aWEgRG9ja2VyIG5ldHdvcmtpbmcuXG4gICMgLSBuYW1lOiBhbmFseXRpY3MtdjFcbiAgIyAgIF9jb21tZW50OiAnQW5hbHl0aWNzOiAvYW5hbHl0aWNzL3YxLyogLT4gaHR0cDovL2xvZ2ZsYXJlOjQwMDAvKidcbiAgIyAgIHVybDogaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL1xuICAjICAgcm91dGVzOlxuICAjICAgICAtIG5hbWU6IGFuYWx5dGljcy12MS1hbGxcbiAgIyAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICMgICAgICAgcGF0aHM6XG4gICMgICAgICAgICAtIC9hbmFseXRpY3MvdjEvXG5cbiAgIyMgU2VjdXJlIERhdGFiYXNlIHJvdXRlc1xuICAtIG5hbWU6IG1ldGFcbiAgICBfY29tbWVudDogJ3BnLW1ldGE6IC9wZy8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtZXRhLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3BnL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuXG4gICMjIEJsb2NrIGFjY2VzcyB0byAvYXBpL21jcFxuICAtIG5hbWU6IG1jcC1ibG9ja2VyXG4gICAgX2NvbW1lbnQ6ICdCbG9jayBkaXJlY3QgYWNjZXNzIHRvIC9hcGkvbWNwJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXN0dWRpbzozMDAwL2FwaS9tY3BcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IG1jcC1ibG9ja2VyLXJvdXRlXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXBpL21jcFxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdGVybWluYXRpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIHN0YXR1c19jb2RlOiA0MDNcbiAgICAgICAgICBtZXNzYWdlOiBcIkFjY2VzcyBpcyBmb3JiaWRkZW4uXCJcblxuICAjIyBNQ1AgZW5kcG9pbnQgLSBsb2NhbCBhY2Nlc3NcbiAgLSBuYW1lOiBtY3BcbiAgICBfY29tbWVudDogJ01DUDogL21jcCAtPiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvYXBpL21jcCAobG9jYWwgYWNjZXNzKSdcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9hcGkvbWNwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtY3BcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9tY3BcbiAgICBwbHVnaW5zOlxuICAgICAgIyBCbG9jayBhY2Nlc3MgdG8gL21jcCBieSBkZWZhdWx0XG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdGVybWluYXRpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIHN0YXR1c19jb2RlOiA0MDNcbiAgICAgICAgICBtZXNzYWdlOiBcIkFjY2VzcyBpcyBmb3JiaWRkZW4uXCJcbiAgICAgICMgRW5hYmxlIGxvY2FsIGFjY2VzcyAoZGFuZ2VyIHpvbmUhKVxuICAgICAgIyAxLiBDb21tZW50IG91dCB0aGUgJ3JlcXVlc3QtdGVybWluYXRpb24nIHNlY3Rpb24gYWJvdmVcbiAgICAgICMgMi4gVW5jb21tZW50IHRoZSBlbnRpcmUgc2VjdGlvbiBiZWxvdywgaW5jbHVkaW5nICdkZW55J1xuICAgICAgIyAzLiBBZGQgeW91ciBsb2NhbCBJUHMgdG8gdGhlICdhbGxvdycgbGlzdFxuICAgICAgIy0gbmFtZTogY29yc1xuICAgICAgIy0gbmFtZTogaXAtcmVzdHJpY3Rpb25cbiAgICAgICMgIGNvbmZpZzpcbiAgICAgICMgICAgYWxsb3c6XG4gICAgICAjICAgICAgLSAxMjcuMC4wLjFcbiAgICAgICMgICAgICAtIDo6MVxuICAgICAgIyAgICBkZW55OiBbXVxuXG4gICMjIFByb3RlY3RlZCBEYXNoYm9hcmQgLSBjYXRjaCBhbGwgcmVtYWluaW5nIHJvdXRlc1xuICAtIG5hbWU6IGRhc2hib2FyZFxuICAgIF9jb21tZW50OiAnU3R1ZGlvOiAvKiAtPiBodHRwOi8vc3R1ZGlvOjMwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGRhc2hib2FyZC1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGJhc2ljLWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IHRydWVcbiIKICBzdXBhYmFzZS1zdHVkaW86CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N0dWRpbzoyMDI2LjAzLjE2LXNoYS01NTI4ODE3JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5vZGUKICAgICAgICAtICctZScKICAgICAgICAtICJmZXRjaCgnaHR0cDovLzEyNy4wLjAuMTozMDAwL2FwaS9wbGF0Zm9ybS9wcm9maWxlJykudGhlbigocikgPT4ge2lmIChyLnN0YXR1cyAhPT0gMjAwKSB0aHJvdyBuZXcgRXJyb3Ioci5zdGF0dXMpfSkiCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAzCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIEhPU1ROQU1FPTAuMC4wLjAKICAgICAgLSAnU1RVRElPX1BHX01FVEFfVVJMPWh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAnCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1Q9JHtQT1NUR1JFU19IT1NUOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ1BPU1RHUkVTX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSAnREVGQVVMVF9PUkdBTklaQVRJT05fTkFNRT0ke1NUVURJT19ERUZBVUxUX09SR0FOSVpBVElPTjotRGVmYXVsdCBPcmdhbml6YXRpb259JwogICAgICAtICdERUZBVUxUX1BST0pFQ1RfTkFNRT0ke1NUVURJT19ERUZBVUxUX1BST0pFQ1Q6LURlZmF1bHQgUHJvamVjdH0nCiAgICAgIC0gJ1NVUEFCQVNFX1VSTD1odHRwOi8vc3VwYWJhc2Uta29uZzo4MDAwJwogICAgICAtICdTVVBBQkFTRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9VUkxfU1VQQUJBU0VLT05HfScKICAgICAgLSAnU1VQQUJBU0VfQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTVVBBQkFTRV9TRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ0FVVEhfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdfTUVUQV9DUllQVE9fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9QR01FVEFDUllQVE99JwogICAgICAtICdMT0dGTEFSRV9BUElfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFfScKICAgICAgLSAnTE9HRkxBUkVfUFJJVkFURV9BQ0NFU1NfVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFUFJJVkFURX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1VSTD1odHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAnCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSBORVhUX1BVQkxJQ19FTkFCTEVfTE9HUz10cnVlCiAgICAgIC0gTkVYVF9BTkFMWVRJQ1NfQkFDS0VORF9QUk9WSURFUj1wb3N0Z3JlcwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSBTTklQUEVUU19NQU5BR0VNRU5UX0ZPTERFUj0vYXBwL3NuaXBwZXRzCiAgICAgIC0gRURHRV9GVU5DVElPTlNfTUFOQUdFTUVOVF9GT0xERVI9L2FwcC9lZGdlLWZ1bmN0aW9ucwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3NuaXBwZXRzOi9hcHAvc25pcHBldHMnCiAgICAgIC0gJy4vdm9sdW1lcy9mdW5jdGlvbnM6L2FwcC9lZGdlLWZ1bmN0aW9ucycKICBzdXBhYmFzZS1kYjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXM6MTUuOC4xLjA4NScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncGdfaXNyZWFkeSAtVSBwb3N0Z3JlcyAtaCAxMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtdmVjdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBjb21tYW5kOgogICAgICAtIHBvc3RncmVzCiAgICAgIC0gJy1jJwogICAgICAtIGNvbmZpZ19maWxlPS9ldGMvcG9zdGdyZXNxbC9wb3N0Z3Jlc3FsLmNvbmYKICAgICAgLSAnLWMnCiAgICAgIC0gbG9nX21pbl9tZXNzYWdlcz1mYXRhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSE9TVD0vdmFyL3J1bi9wb3N0Z3Jlc3FsCiAgICAgIC0gJ1BHUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUEdEQVRBQkFTRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwYWJhc2UtZGItZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvcmVhbHRpbWUuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85OS1yZWFsdGltZS5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxuY3JlYXRlIHNjaGVtYSBpZiBub3QgZXhpc3RzIF9yZWFsdGltZTtcbmFsdGVyIHNjaGVtYSBfcmVhbHRpbWUgb3duZXIgdG8gOnBndXNlcjtcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9kYi9fc3VwYWJhc2Uuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85Ny1fc3VwYWJhc2Uuc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cbkNSRUFURSBEQVRBQkFTRSBfc3VwYWJhc2UgV0lUSCBPV05FUiA6cGd1c2VyO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3Bvb2xlci5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LXBvb2xlci5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxcYyBfc3VwYWJhc2VcbmNyZWF0ZSBzY2hlbWEgaWYgbm90IGV4aXN0cyBfc3VwYXZpc29yO1xuYWx0ZXIgc2NoZW1hIF9zdXBhdmlzb3Igb3duZXIgdG8gOnBndXNlcjtcblxcYyBwb3N0Z3Jlc1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3dlYmhvb2tzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OC13ZWJob29rcy5zcWwKICAgICAgICBjb250ZW50OiAiQkVHSU47XG4tLSBDcmVhdGUgcGdfbmV0IGV4dGVuc2lvblxuQ1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHBnX25ldCBTQ0hFTUEgZXh0ZW5zaW9ucztcbi0tIENyZWF0ZSBzdXBhYmFzZV9mdW5jdGlvbnMgc2NoZW1hXG5DUkVBVEUgU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBBVVRIT1JJWkFUSU9OIHN1cGFiYXNlX2FkbWluO1xuR1JBTlQgVVNBR0UgT04gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFRBQkxFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIEZVTkNUSU9OUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFNFUVVFTkNFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLm1pZ3JhdGlvbnMgZGVmaW5pdGlvblxuQ1JFQVRFIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5taWdyYXRpb25zIChcbiAgdmVyc2lvbiB0ZXh0IFBSSU1BUlkgS0VZLFxuICBpbnNlcnRlZF9hdCB0aW1lc3RhbXB0eiBOT1QgTlVMTCBERUZBVUxUIE5PVygpXG4pO1xuLS0gSW5pdGlhbCBzdXBhYmFzZV9mdW5jdGlvbnMgbWlncmF0aW9uXG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnaW5pdGlhbCcpO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLmhvb2tzIGRlZmluaXRpb25cbkNSRUFURSBUQUJMRSBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgKFxuICBpZCBiaWdzZXJpYWwgUFJJTUFSWSBLRVksXG4gIGhvb2tfdGFibGVfaWQgaW50ZWdlciBOT1QgTlVMTCxcbiAgaG9va19uYW1lIHRleHQgTk9UIE5VTEwsXG4gIGNyZWF0ZWRfYXQgdGltZXN0YW1wdHogTk9UIE5VTEwgREVGQVVMVCBOT1coKSxcbiAgcmVxdWVzdF9pZCBiaWdpbnRcbik7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX3JlcXVlc3RfaWRfaWR4IE9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBVU0lORyBidHJlZSAocmVxdWVzdF9pZCk7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX2hfdGFibGVfaWRfaF9uYW1lX2lkeCBPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgVVNJTkcgYnRyZWUgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSk7XG5DT01NRU5UIE9OIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBJUyAnU3VwYWJhc2UgRnVuY3Rpb25zIEhvb2tzOiBBdWRpdCB0cmFpbCBmb3IgdHJpZ2dlcmVkIGhvb2tzLic7XG5DUkVBVEUgRlVOQ1RJT04gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpXG4gIFJFVFVSTlMgdHJpZ2dlclxuICBMQU5HVUFHRSBwbHBnc3FsXG4gIEFTICRmdW5jdGlvbiRcbiAgREVDTEFSRVxuICAgIHJlcXVlc3RfaWQgYmlnaW50O1xuICAgIHBheWxvYWQganNvbmI7XG4gICAgdXJsIHRleHQgOj0gVEdfQVJHVlswXTo6dGV4dDtcbiAgICBtZXRob2QgdGV4dCA6PSBUR19BUkdWWzFdOjp0ZXh0O1xuICAgIGhlYWRlcnMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICBwYXJhbXMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICB0aW1lb3V0X21zIGludGVnZXIgREVGQVVMVCAxMDAwO1xuICBCRUdJTlxuICAgIElGIHVybCBJUyBOVUxMIE9SIHVybCA9ICdudWxsJyBUSEVOXG4gICAgICBSQUlTRSBFWENFUFRJT04gJ3VybCBhcmd1bWVudCBpcyBtaXNzaW5nJztcbiAgICBFTkQgSUY7XG5cbiAgICBJRiBtZXRob2QgSVMgTlVMTCBPUiBtZXRob2QgPSAnbnVsbCcgVEhFTlxuICAgICAgUkFJU0UgRVhDRVBUSU9OICdtZXRob2QgYXJndW1lbnQgaXMgbWlzc2luZyc7XG4gICAgRU5EIElGO1xuXG4gICAgSUYgVEdfQVJHVlsyXSBJUyBOVUxMIE9SIFRHX0FSR1ZbMl0gPSAnbnVsbCcgVEhFTlxuICAgICAgaGVhZGVycyA9ICd7XCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCJ9Jzo6anNvbmI7XG4gICAgRUxTRVxuICAgICAgaGVhZGVycyA9IFRHX0FSR1ZbMl06Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbM10gSVMgTlVMTCBPUiBUR19BUkdWWzNdID0gJ251bGwnIFRIRU5cbiAgICAgIHBhcmFtcyA9ICd7fSc6Ompzb25iO1xuICAgIEVMU0VcbiAgICAgIHBhcmFtcyA9IFRHX0FSR1ZbM106Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbNF0gSVMgTlVMTCBPUiBUR19BUkdWWzRdID0gJ251bGwnIFRIRU5cbiAgICAgIHRpbWVvdXRfbXMgPSAxMDAwO1xuICAgIEVMU0VcbiAgICAgIHRpbWVvdXRfbXMgPSBUR19BUkdWWzRdOjppbnRlZ2VyO1xuICAgIEVORCBJRjtcblxuICAgIENBU0VcbiAgICAgIFdIRU4gbWV0aG9kID0gJ0dFVCcgVEhFTlxuICAgICAgICBTRUxFQ1QgaHR0cF9nZXQgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfZ2V0KFxuICAgICAgICAgIHVybCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBXSEVOIG1ldGhvZCA9ICdQT1NUJyBUSEVOXG4gICAgICAgIHBheWxvYWQgPSBqc29uYl9idWlsZF9vYmplY3QoXG4gICAgICAgICAgJ29sZF9yZWNvcmQnLCBPTEQsXG4gICAgICAgICAgJ3JlY29yZCcsIE5FVyxcbiAgICAgICAgICAndHlwZScsIFRHX09QLFxuICAgICAgICAgICd0YWJsZScsIFRHX1RBQkxFX05BTUUsXG4gICAgICAgICAgJ3NjaGVtYScsIFRHX1RBQkxFX1NDSEVNQVxuICAgICAgICApO1xuXG4gICAgICAgIFNFTEVDVCBodHRwX3Bvc3QgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfcG9zdChcbiAgICAgICAgICB1cmwsXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBFTFNFXG4gICAgICAgIFJBSVNFIEVYQ0VQVElPTiAnbWV0aG9kIGFyZ3VtZW50ICUgaXMgaW52YWxpZCcsIG1ldGhvZDtcbiAgICBFTkQgQ0FTRTtcblxuICAgIElOU0VSVCBJTlRPIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rc1xuICAgICAgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSwgcmVxdWVzdF9pZClcbiAgICBWQUxVRVNcbiAgICAgIChUR19SRUxJRCwgVEdfTkFNRSwgcmVxdWVzdF9pZCk7XG5cbiAgICBSRVRVUk4gTkVXO1xuICBFTkRcbiRmdW5jdGlvbiQ7XG4tLSBTdXBhYmFzZSBzdXBlciBhZG1pblxuRE9cbiQkXG5CRUdJTlxuICBJRiBOT1QgRVhJU1RTIChcbiAgICBTRUxFQ1QgMVxuICAgIEZST00gcGdfcm9sZXNcbiAgICBXSEVSRSByb2xuYW1lID0gJ3N1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbidcbiAgKVxuICBUSEVOXG4gICAgQ1JFQVRFIFVTRVIgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIE5PSU5IRVJJVCBDUkVBVEVST0xFIExPR0lOIE5PUkVQTElDQVRJT047XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBTQ0hFTUEgc3VwYWJhc2VfZnVuY3Rpb25zIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkdSQU5UIEFMTCBQUklWSUxFR0VTIE9OIEFMTCBUQUJMRVMgSU4gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBBTEwgU0VRVUVOQ0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gU0VUIHNlYXJjaF9wYXRoID0gXCJzdXBhYmFzZV9mdW5jdGlvbnNcIjtcbkFMVEVSIHRhYmxlIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIubWlncmF0aW9ucyBPV05FUiBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5BTFRFUiB0YWJsZSBcInN1cGFiYXNlX2Z1bmN0aW9uc1wiLmhvb2tzIE9XTkVSIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkFMVEVSIGZ1bmN0aW9uIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIuaHR0cF9yZXF1ZXN0KCkgT1dORVIgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuR1JBTlQgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIFRPIHBvc3RncmVzO1xuLS0gUmVtb3ZlIHVudXNlZCBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gcm9sZVxuRE9cbiQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19yb2xlc1xuICAgIFdIRVJFIHJvbG5hbWUgPSAnc3VwYWJhc2VfcGdfbmV0X2FkbWluJ1xuICApXG4gIFRIRU5cbiAgICBSRUFTU0lHTiBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gVE8gc3VwYWJhc2VfYWRtaW47XG4gICAgRFJPUCBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW47XG4gICAgRFJPUCBST0xFIHN1cGFiYXNlX3BnX25ldF9hZG1pbjtcbiAgRU5EIElGO1xuRU5EXG4kJDtcbi0tIHBnX25ldCBncmFudHMgd2hlbiBleHRlbnNpb24gaXMgYWxyZWFkeSBlbmFibGVkXG5ET1xuJCRcbkJFR0lOXG4gIElGIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V4dGVuc2lvblxuICAgIFdIRVJFIGV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG4tLSBFdmVudCB0cmlnZ2VyIGZvciBwZ19uZXRcbkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIGV4dGVuc2lvbnMuZ3JhbnRfcGdfbmV0X2FjY2VzcygpXG5SRVRVUk5TIGV2ZW50X3RyaWdnZXJcbkxBTkdVQUdFIHBscGdzcWxcbkFTICQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19ldmVudF90cmlnZ2VyX2RkbF9jb21tYW5kcygpIEFTIGV2XG4gICAgSk9JTiBwZ19leHRlbnNpb24gQVMgZXh0XG4gICAgT04gZXYub2JqaWQgPSBleHQub2lkXG4gICAgV0hFUkUgZXh0LmV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORDtcbiQkO1xuQ09NTUVOVCBPTiBGVU5DVElPTiBleHRlbnNpb25zLmdyYW50X3BnX25ldF9hY2Nlc3MgSVMgJ0dyYW50cyBhY2Nlc3MgdG8gcGdfbmV0JztcbkRPXG4kJFxuQkVHSU5cbiAgSUYgTk9UIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V2ZW50X3RyaWdnZXJcbiAgICBXSEVSRSBldnRuYW1lID0gJ2lzc3VlX3BnX25ldF9hY2Nlc3MnXG4gICkgVEhFTlxuICAgIENSRUFURSBFVkVOVCBUUklHR0VSIGlzc3VlX3BnX25ldF9hY2Nlc3MgT04gZGRsX2NvbW1hbmRfZW5kIFdIRU4gVEFHIElOICgnQ1JFQVRFIEVYVEVOU0lPTicpXG4gICAgRVhFQ1VURSBQUk9DRURVUkUgZXh0ZW5zaW9ucy5ncmFudF9wZ19uZXRfYWNjZXNzKCk7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnMjAyMTA4MDkxODM0MjNfdXBkYXRlX2dyYW50cycpO1xuQUxURVIgZnVuY3Rpb24gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpIFNFQ1VSSVRZIERFRklORVI7XG5BTFRFUiBmdW5jdGlvbiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgU0VUIHNlYXJjaF9wYXRoID0gc3VwYWJhc2VfZnVuY3Rpb25zO1xuUkVWT0tFIEFMTCBPTiBGVU5DVElPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgRlJPTSBQVUJMSUM7XG5HUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5odHRwX3JlcXVlc3QoKSBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQ09NTUlUO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3JvbGVzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OS1yb2xlcy5zcWwKICAgICAgICBjb250ZW50OiAiLS0gTk9URTogY2hhbmdlIHRvIHlvdXIgb3duIHBhc3N3b3JkcyBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHNcbiBcXHNldCBwZ3Bhc3MgYGVjaG8gXCIkUE9TVEdSRVNfUEFTU1dPUkRcImBcblxuIEFMVEVSIFVTRVIgYXV0aGVudGljYXRvciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHBnYm91bmNlciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHN1cGFiYXNlX2F1dGhfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9zdG9yYWdlX2FkbWluIFdJVEggUEFTU1dPUkQgOidwZ3Bhc3MnO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL2p3dC5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LXNjcmlwdHMvOTktand0LnNxbAogICAgICAgIGNvbnRlbnQ6ICJcXHNldCBqd3Rfc2VjcmV0IGBlY2hvIFwiJEpXVF9TRUNSRVRcImBcblxcc2V0IGp3dF9leHAgYGVjaG8gXCIkSldUX0VYUFwiYFxuXFxzZXQgZGJfbmFtZSBgZWNobyBcIiR7UE9TVEdSRVNfREI6LXBvc3RncmVzfVwiYFxuXG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X3NlY3JldFwiIFRPIDonand0X3NlY3JldCc7XG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X2V4cFwiIFRPIDonand0X2V4cCc7XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvbG9ncy5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LWxvZ3Muc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cXGMgX3N1cGFiYXNlXG5jcmVhdGUgc2NoZW1hIGlmIG5vdCBleGlzdHMgX2FuYWx5dGljcztcbmFsdGVyIHNjaGVtYSBfYW5hbHl0aWNzIG93bmVyIHRvIDpwZ3VzZXI7XG5cXGMgcG9zdGdyZXNcbiIKICAgICAgLSAnc3VwYWJhc2UtZGItY29uZmlnOi9ldGMvcG9zdGdyZXNxbC1jdXN0b20nCiAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9sb2dmbGFyZToxLjMxLjInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIExPR0ZMQVJFX05PREVfSE9TVD0xMjcuMC4wLjEKICAgICAgLSBEQl9VU0VSTkFNRT1zdXBhYmFzZV9hZG1pbgogICAgICAtIERCX0RBVEFCQVNFPV9zdXBhYmFzZQogICAgICAtICdEQl9IT1NUTkFNRT0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBEQl9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BSSVZBVEVfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRVBSSVZBVEV9JwogICAgICAtIExPR0ZMQVJFX1NJTkdMRV9URU5BTlQ9dHJ1ZQogICAgICAtIExPR0ZMQVJFX1NVUEFCQVNFX01PREU9dHJ1ZQogICAgICAtICdQT1NUR1JFU19CQUNLRU5EX1VSTD1wb3N0Z3Jlc3FsOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gUE9TVEdSRVNfQkFDS0VORF9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtIExPR0ZMQVJFX0ZFQVRVUkVfRkxBR19PVkVSUklERT1tdWx0aWJhY2tlbmQ9dHJ1ZQogIHN1cGFiYXNlLXZlY3RvcjoKICAgIGltYWdlOiAndGltYmVyaW8vdmVjdG9yOjAuNTMuMC1hbHBpbmUnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovL3N1cGFiYXNlLXZlY3Rvcjo5MDAxL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvbG9ncy92ZWN0b3IueW1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogImFwaTpcbiAgZW5hYmxlZDogdHJ1ZVxuICBhZGRyZXNzOiAwLjAuMC4wOjkwMDFcblxuc291cmNlczpcbiAgZG9ja2VyX2hvc3Q6XG4gICAgdHlwZTogZG9ja2VyX2xvZ3NcbiAgICBleGNsdWRlX2NvbnRhaW5lcnM6XG4gICAgICAtIHN1cGFiYXNlLXZlY3RvclxuXG50cmFuc2Zvcm1zOlxuICBwcm9qZWN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIGRvY2tlcl9ob3N0XG4gICAgc291cmNlOiB8LVxuICAgICAgLnByb2plY3QgPSBcImRlZmF1bHRcIlxuICAgICAgLmV2ZW50X21lc3NhZ2UgPSBkZWwoLm1lc3NhZ2UpXG4gICAgICAuYXBwbmFtZSA9IGRlbCguY29udGFpbmVyX25hbWUpXG4gICAgICBkZWwoLmNvbnRhaW5lcl9jcmVhdGVkX2F0KVxuICAgICAgZGVsKC5jb250YWluZXJfaWQpXG4gICAgICBkZWwoLnNvdXJjZV90eXBlKVxuICAgICAgZGVsKC5zdHJlYW0pXG4gICAgICBkZWwoLmxhYmVsKVxuICAgICAgZGVsKC5pbWFnZSlcbiAgICAgIGRlbCguaG9zdClcbiAgICAgIGRlbCguc3RyZWFtKVxuICByb3V0ZXI6XG4gICAgdHlwZTogcm91dGVcbiAgICBpbnB1dHM6XG4gICAgICAtIHByb2plY3RfbG9nc1xuICAgIHJvdXRlOlxuICAgICAga29uZzogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWtvbmdcIiknXG4gICAgICBhdXRoOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtYXV0aFwiKSdcbiAgICAgIHJlc3Q6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZXN0XCIpJ1xuICAgICAgcmVhbHRpbWU6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJyZWFsdGltZS1kZXZcIiknXG4gICAgICBzdG9yYWdlOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2Utc3RvcmFnZVwiKSdcbiAgICAgIGZ1bmN0aW9uczogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zXCIpJ1xuICAgICAgZGI6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1kYlwiKSdcbiAgIyBJZ25vcmVzIG5vbiBuZ2lueCBlcnJvcnMgc2luY2UgdGhleSBhcmUgcmVsYXRlZCB3aXRoIGtvbmcgYm9vdGluZyB1cFxuICBrb25nX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5rb25nXG4gICAgc291cmNlOiB8LVxuICAgICAgcmVxLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiY29tYmluZWRcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcmVxLnRpbWVzdGFtcFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMucmVmZXJlciA9IHJlcS5yZWZlcmVyXG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy51c2VyX2FnZW50ID0gcmVxLmFnZW50XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5jZl9jb25uZWN0aW5nX2lwID0gcmVxLmNsaWVudFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IHJlcS5zdGF0dXNcbiAgICAgICAgICB1cmwsIHNwbGl0X2VyciA9IHNwbGl0KHJlcS5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBzcGxpdF9lcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIElnbm9yZXMgbm9uIG5naW54IGVycm9ycyBzaW5jZSB0aGV5IGFyZSByZWxhdGVkIHdpdGgga29uZyBib290aW5nIHVwXG4gIGtvbmdfZXJyOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIua29uZ1xuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IFwiR0VUXCJcbiAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IDIwMFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiZXJyb3JcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcGFyc2VkLnRpbWVzdGFtcFxuICAgICAgICAgIC5zZXZlcml0eSA9IHBhcnNlZC5zZXZlcml0eVxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lmhvc3QgPSBwYXJzZWQuaG9zdFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMuY2ZfY29ubmVjdGluZ19pcCA9IHBhcnNlZC5jbGllbnRcbiAgICAgICAgICB1cmwsIGVyciA9IHNwbGl0KHBhcnNlZC5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIEdvdHJ1ZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIGpzb24gc3RyaW5ncyB3aGljaCBmcm9udGVuZCBwYXJzZXMgZGlyZWN0bHkuIEJ1dCB3ZSBrZWVwIG1ldGFkYXRhIGZvciBjb25zaXN0ZW5jeS5cbiAgYXV0aF9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuYXV0aFxuICAgIHNvdXJjZTogfC1cbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEgPSBtZXJnZSEoLm1ldGFkYXRhLCBwYXJzZWQpXG4gICAgICB9XG4gICMgUG9zdGdSRVNUIGxvZ3MgYXJlIHN0cnVjdHVyZWQgc28gd2Ugc2VwYXJhdGUgdGltZXN0YW1wIGZyb20gbWVzc2FnZSB1c2luZyByZWdleFxuICByZXN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5yZXN0XG4gICAgc291cmNlOiB8LVxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcideKD9QPHRpbWU+LiopOiAoP1A8bXNnPi4qKSQnKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5ldmVudF9tZXNzYWdlID0gcGFyc2VkLm1zZ1xuICAgICAgICAgIC50aW1lc3RhbXAgPSBwYXJzZV90aW1lc3RhbXAhKHZhbHVlOiBwYXJzZWQudGltZSwgZm9ybWF0OiBcIiVkLyViLyVZOiVIOiVNOiVTICV6XCIpXG4gICAgICAgICAgLm1ldGFkYXRhLmhvc3QgPSAucHJvamVjdFxuICAgICAgfVxuICAjIEZpbHRlciBvdXQgaGVhbHRoY2hlY2sgbG9ncyBmcm9tIFJlYWx0aW1lXG4gIHJlYWx0aW1lX2xvZ3NfZmlsdGVyZWQ6XG4gICAgdHlwZTogZmlsdGVyXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIucmVhbHRpbWVcbiAgICBjb25kaXRpb246ICchY29udGFpbnMoc3RyaW5nISguZXZlbnRfbWVzc2FnZSksIFwiL2hlYWx0aFwiKSdcbiAgIyBSZWFsdGltZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIHNvIHdlIHBhcnNlIHRoZSBzZXZlcml0eSBsZXZlbCB1c2luZyByZWdleCAoaWdub3JlIHRpbWUgYmVjYXVzZSBpdCBoYXMgbm8gZGF0ZSlcbiAgcmVhbHRpbWVfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcmVhbHRpbWVfbG9nc19maWx0ZXJlZFxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLmV4dGVybmFsX2lkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfcmVnZXgoLmV2ZW50X21lc3NhZ2UsIHInXig/UDx0aW1lPlxcZCs6XFxkKzpcXGQrXFwuXFxkKykgXFxbKD9QPGxldmVsPlxcdyspXFxdICg/UDxtc2c+LiopJCcpXG4gICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgLmV2ZW50X21lc3NhZ2UgPSBwYXJzZWQubXNnXG4gICAgICAgICAgLm1ldGFkYXRhLmxldmVsID0gcGFyc2VkLmxldmVsXG4gICAgICB9XG4gICMgU3RvcmFnZSBsb2dzIG1heSBjb250YWluIGpzb24gb2JqZWN0cyBzbyB3ZSBwYXJzZSB0aGVtIGZvciBjb21wbGV0ZW5lc3NcbiAgc3RvcmFnZV9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuc3RvcmFnZVxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLnRlbmFudElkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAuZXZlbnRfbWVzc2FnZSA9IHBhcnNlZC5tc2dcbiAgICAgICAgICAubWV0YWRhdGEubGV2ZWwgPSBwYXJzZWQubGV2ZWxcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEuY29udGV4dFswXS5ob3N0ID0gcGFyc2VkLmhvc3RuYW1lXG4gICAgICAgICAgLm1ldGFkYXRhLmNvbnRleHRbMF0ucGlkID0gcGFyc2VkLnBpZFxuICAgICAgfVxuICAjIEZ1bmN0aW9uIGxvZ3MgYXJlIHVuc3RydWN0dXJlZCBtZXNzYWdlcyBvbiBzdGRlcnJcbiAgZnVuY3Rpb25zX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5mdW5jdGlvbnNcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEucHJvamVjdF9yZWYgPSBkZWwoLnByb2plY3QpXG4gICMgUG9zdGdyZXMgbG9ncyBzb21lIG1lc3NhZ2VzIHRvIHN0ZGVyciB3aGljaCB3ZSBtYXAgdG8gd2FybmluZyBzZXZlcml0eSBsZXZlbFxuICBkYl9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuZGJcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEuaG9zdCA9IFwiZGItZGVmYXVsdFwiXG4gICAgICAubWV0YWRhdGEucGFyc2VkLnRpbWVzdGFtcCA9IC50aW1lc3RhbXBcblxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcicuKig/UDxsZXZlbD5JTkZPfE5PVElDRXxXQVJOSU5HfEVSUk9SfExPR3xGQVRBTHxQQU5JQz8pOi4qJywgbnVtZXJpY19ncm91cHM6IHRydWUpXG5cbiAgICAgIGlmIGVyciAhPSBudWxsIHx8IHBhcnNlZCA9PSBudWxsIHtcbiAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwiaW5mb1wiXG4gICAgICB9XG4gICAgICBpZiBwYXJzZWQubGV2ZWwgIT0gbnVsbCB7XG4gICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IHBhcnNlZC5sZXZlbFxuICAgICAgfVxuICAgICAgaWYgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9PSBcImluZm9cIiB7XG4gICAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwibG9nXCJcbiAgICAgIH1cbiAgICAgIC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkgPSB1cGNhc2UhKC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkpXG5cbnNpbmtzOlxuICBsb2dmbGFyZV9hdXRoOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gYXV0aF9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1nb3RydWUubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9yZWFsdGltZTpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlYWx0aW1lX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXJlYWx0aW1lLmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfcmVzdDpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlc3RfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9cG9zdGdSRVNULmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfZGI6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBkYl9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1wb3N0Z3Jlcy5sb2dzJ1xuICBsb2dmbGFyZV9mdW5jdGlvbnM6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBmdW5jdGlvbnNfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9ZGVuby1yZWxheS1sb2dzJ1xuICBsb2dmbGFyZV9zdG9yYWdlOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gc3RvcmFnZV9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1zdG9yYWdlLmxvZ3MucHJvZC4yJ1xuICBsb2dmbGFyZV9rb25nOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0ga29uZ19sb2dzXG4gICAgICAtIGtvbmdfZXJyXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1jbG91ZGZsYXJlLmxvZ3MucHJvZCdcbiIKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2s6cm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jb25maWcnCiAgICAgIC0gL2V0Yy92ZWN0b3IvdmVjdG9yLnltbAogIHN1cGFiYXNlLXJlc3Q6CiAgICBpbWFnZTogJ3Bvc3RncmVzdC9wb3N0Z3Jlc3Q6djE0LjYnCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQR1JTVF9EQl9VUkk9cG9zdGdyZXM6Ly9hdXRoZW50aWNhdG9yOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSBQR1JTVF9EQl9BTk9OX1JPTEU9YW5vbgogICAgICAtICdQR1JTVF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIFBHUlNUX0RCX1VTRV9MRUdBQ1lfR1VDUz1mYWxzZQogICAgICAtICdQR1JTVF9BUFBfU0VUVElOR1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdSU1RfQVBQX1NFVFRJTkdTX0pXVF9FWFA9JHtKV1RfRVhQSVJZOi0zNjAwfScKICAgIGNvbW1hbmQ6IHBvc3RncmVzdAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgc3VwYWJhc2UtYXV0aDoKICAgIGltYWdlOiAnc3VwYWJhc2UvZ290cnVlOnYyLjE4Ni4wJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo5OTk5L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIEdPVFJVRV9BUElfSE9TVD0wLjAuMC4wCiAgICAgIC0gR09UUlVFX0FQSV9QT1JUPTk5OTkKICAgICAgLSAnQVBJX0VYVEVSTkFMX1VSTD0ke0FQSV9FWFRFUk5BTF9VUkw6LWh0dHA6Ly9zdXBhYmFzZS1rb25nOjgwMDB9JwogICAgICAtIEdPVFJVRV9EQl9EUklWRVI9cG9zdGdyZXMKICAgICAgLSAnR09UUlVFX0RCX0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovL3N1cGFiYXNlX2F1dGhfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0dPVFJVRV9TSVRFX1VSTD0ke0dPVFJVRV9TSVRFX1VSTDotJHtTRVJWSUNFX1VSTF9TVVBBQkFTRUtPTkd9fScKICAgICAgLSAnR09UUlVFX1VSSV9BTExPV19MSVNUPSR7QURESVRJT05BTF9SRURJUkVDVF9VUkxTfScKICAgICAgLSAnR09UUlVFX0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgICAgLSBHT1RSVUVfSldUX0FETUlOX1JPTEVTPXNlcnZpY2Vfcm9sZQogICAgICAtIEdPVFJVRV9KV1RfQVVEPWF1dGhlbnRpY2F0ZWQKICAgICAgLSBHT1RSVUVfSldUX0RFRkFVTFRfR1JPVVBfTkFNRT1hdXRoZW50aWNhdGVkCiAgICAgIC0gJ0dPVFJVRV9KV1RfRVhQPSR7SldUX0VYUElSWTotMzYwMH0nCiAgICAgIC0gJ0dPVFJVRV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfRU1BSUxfRU5BQkxFRD0ke0VOQUJMRV9FTUFJTF9TSUdOVVA6LXRydWV9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfQU5PTllNT1VTX1VTRVJTX0VOQUJMRUQ9JHtFTkFCTEVfQU5PTllNT1VTX1VTRVJTOi1mYWxzZX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfQVVUT0NPTkZJUk09JHtFTkFCTEVfRU1BSUxfQVVUT0NPTkZJUk06LWZhbHNlfScKICAgICAgLSAnR09UUlVFX1NNVFBfQURNSU5fRU1BSUw9JHtTTVRQX0FETUlOX0VNQUlMfScKICAgICAgLSAnR09UUlVFX1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BPUlQ9JHtTTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1VTRVI9JHtTTVRQX1VTRVJ9JwogICAgICAtICdHT1RSVUVfU01UUF9QQVNTPSR7U01UUF9QQVNTfScKICAgICAgLSAnR09UUlVFX1NNVFBfU0VOREVSX05BTUU9JHtTTVRQX1NFTkRFUl9OQU1FfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19JTlZJVEU9JHtNQUlMRVJfVVJMUEFUSFNfSU5WSVRFOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0NPTkZJUk1BVElPTj0ke01BSUxFUl9VUkxQQVRIU19DT05GSVJNQVRJT046LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk9JHtNQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk6LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1VSTFBBVEhTX0VNQUlMX0NIQU5HRTotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfSU5WSVRFPSR7TUFJTEVSX1RFTVBMQVRFU19JTlZJVEV9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19DT05GSVJNQVRJT049JHtNQUlMRVJfVEVNUExBVEVTX0NPTkZJUk1BVElPTn0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX1JFQ09WRVJZPSR7TUFJTEVSX1RFTVBMQVRFU19SRUNPVkVSWX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX01BR0lDX0xJTks9JHtNQUlMRVJfVEVNUExBVEVTX01BR0lDX0xJTkt9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19FTUFJTF9DSEFOR0U9JHtNQUlMRVJfVEVNUExBVEVTX0VNQUlMX0NIQU5HRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfQ09ORklSTUFUSU9OPSR7TUFJTEVSX1NVQkpFQ1RTX0NPTkZJUk1BVElPTn0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfUkVDT1ZFUlk9JHtNQUlMRVJfU1VCSkVDVFNfUkVDT1ZFUll9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX01BR0lDX0xJTks9JHtNQUlMRVJfU1VCSkVDVFNfTUFHSUNfTElOS30nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1NVQkpFQ1RTX0VNQUlMX0NIQU5HRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfSU5WSVRFPSR7TUFJTEVSX1NVQkpFQ1RTX0lOVklURX0nCiAgICAgIC0gJ0dPVFJVRV9FWFRFUk5BTF9QSE9ORV9FTkFCTEVEPSR7RU5BQkxFX1BIT05FX1NJR05VUDotdHJ1ZX0nCiAgICAgIC0gJ0dPVFJVRV9TTVNfQVVUT0NPTkZJUk09JHtFTkFCTEVfUEhPTkVfQVVUT0NPTkZJUk06LXRydWV9JwogIHJlYWx0aW1lLWRldjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcmVhbHRpbWU6djIuNzYuNScKICAgIGNvbnRhaW5lcl9uYW1lOiByZWFsdGltZS1kZXYuc3VwYWJhc2UtcmVhbHRpbWUKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctc1NmTCcKICAgICAgICAtICctLWhlYWQnCiAgICAgICAgLSAnLW8nCiAgICAgICAgLSAvZGV2L251bGwKICAgICAgICAtICctSCcKICAgICAgICAtICdBdXRob3JpemF0aW9uOiBCZWFyZXIgJHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9hcGkvdGVuYW50cy9yZWFsdGltZS1kZXYvaGVhbHRoJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9SVD00MDAwCiAgICAgIC0gJ0RCX0hPU1Q9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdEQl9QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gREJfVVNFUj1zdXBhYmFzZV9hZG1pbgogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQl9OQU1FPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnREJfQUZURVJfQ09OTkVDVF9RVUVSWT1TRVQgc2VhcmNoX3BhdGggVE8gX3JlYWx0aW1lJwogICAgICAtIERCX0VOQ19LRVk9c3VwYWJhc2VyZWFsdGltZQogICAgICAtICdBUElfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnU0VDUkVUX0tFWV9CQVNFPSR7U0VSVklDRV9QQVNTV09SRF82NF9SRUFMVElNRX0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAiRE5TX05PREVTPScnIgogICAgICAtIFJMSU1JVF9OT0ZJTEU9MTAwMDAKICAgICAgLSBBUFBfTkFNRT1yZWFsdGltZQogICAgICAtIFNFRURfU0VMRl9IT1NUPXRydWUKICAgICAgLSBMT0dfTEVWRUw9ZXJyb3IKICAgICAgLSBSVU5fSkFOSVRPUj10cnVlCiAgICAgIC0gSkFOSVRPUl9JTlRFUlZBTD02MDAwMAogICAgICAtIERJU0FCTEVfSEVBTFRIQ0hFQ0tfTE9HR0lORz10cnVlCiAgICBjb21tYW5kOiAic2ggLWMgXCIvYXBwL2Jpbi9taWdyYXRlICYmIC9hcHAvYmluL3JlYWx0aW1lIGV2YWwgJ1JlYWx0aW1lLlJlbGVhc2Uuc2VlZHMoUmVhbHRpbWUuUmVwbyknICYmIC9hcHAvYmluL3NlcnZlclwiXG4iCiAgc3VwYWJhc2UtbWluaW86CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBjb21tYW5kOiAnc2VydmVyIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSIgL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovZGF0YScKICBtaW5pby1jcmVhdGVidWNrZXQ6CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIHJlc3RhcnQ6ICdubycKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1taW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDoKICAgICAgLSAvZW50cnlwb2ludC5zaAogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2VudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL3NoXG4vdXNyL2Jpbi9tYyBhbGlhcyBzZXQgc3VwYWJhc2UtbWluaW8gaHR0cDovL3N1cGFiYXNlLW1pbmlvOjkwMDAgJHtNSU5JT19ST09UX1VTRVJ9ICR7TUlOSU9fUk9PVF9QQVNTV09SRH07XG4vdXNyL2Jpbi9tYyBtYiAtLWlnbm9yZS1leGlzdGluZyBzdXBhYmFzZS1taW5pby9zdHViO1xuZXhpdCAwXG4iCiAgc3VwYWJhc2Utc3RvcmFnZToKICAgIGltYWdlOiAnc3VwYWJhc2Uvc3RvcmFnZS1hcGk6djEuNDQuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLXJlc3Q6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgICAgaW1ncHJveHk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjUwMDAvc3RhdHVzJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVkVSX1BPUlQ9NTAwMAogICAgICAtIFNFUlZFUl9SRUdJT049bG9jYWwKICAgICAgLSBNVUxUSV9URU5BTlQ9ZmFsc2UKICAgICAgLSAnQVVUSF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly9zdXBhYmFzZV9zdG9yYWdlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtIERCX0lOU1RBTExfUk9MRVM9ZmFsc2UKICAgICAgLSBTVE9SQUdFX0JBQ0tFTkQ9czMKICAgICAgLSBTVE9SQUdFX1MzX0JVQ0tFVD1zdHViCiAgICAgIC0gJ1NUT1JBR0VfUzNfRU5EUE9JTlQ9aHR0cDovL3N1cGFiYXNlLW1pbmlvOjkwMDAnCiAgICAgIC0gU1RPUkFHRV9TM19GT1JDRV9QQVRIX1NUWUxFPXRydWUKICAgICAgLSBTVE9SQUdFX1MzX1JFR0lPTj11cy1lYXN0LTEKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSBVUExPQURfRklMRV9TSVpFX0xJTUlUPTUyNDI4ODAwMAogICAgICAtIFVQTE9BRF9GSUxFX1NJWkVfTElNSVRfU1RBTkRBUkQ9NTI0Mjg4MDAwCiAgICAgIC0gVVBMT0FEX1NJR05FRF9VUkxfRVhQSVJBVElPTl9USU1FPTEyMAogICAgICAtIFRVU19VUkxfUEFUSD0vdXBsb2FkL3Jlc3VtYWJsZQogICAgICAtIFRVU19NQVhfU0laRT0zNjAwMDAwCiAgICAgIC0gRU5BQkxFX0lNQUdFX1RSQU5TRk9STUFUSU9OPXRydWUKICAgICAgLSAnSU1HUFJPWFlfVVJMPWh0dHA6Ly9pbWdwcm94eTo4MDgwJwogICAgICAtIElNR1BST1hZX1JFUVVFU1RfVElNRU9VVD0xNQogICAgICAtIERBVEFCQVNFX1NFQVJDSF9QQVRIPXN0b3JhZ2UKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gUkVRVUVTVF9BTExPV19YX0ZPUldBUkRFRF9QQVRIPXRydWUKICAgICAgLSAnQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1BPU1RHUkVTVF9VUkw9aHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMCcKICAgICAgLSAnUEdSU1RfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnU1RPUkFHRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9VUkxfU1VQQUJBU0VLT05HfScKICAgICAgLSAnVEVOQU5UX0lEPSR7U1RPUkFHRV9URU5BTlRfSUQ6LXN0b3JhZ2Utc2luZ2xlLXRlbmFudH0nCiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovdmFyL2xpYi9zdG9yYWdlJwogIGltZ3Byb3h5OgogICAgaW1hZ2U6ICdkYXJ0aHNpbS9pbWdwcm94eTp2My4zMC4xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGltZ3Byb3h5CiAgICAgICAgLSBoZWFsdGgKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtICdJTUdQUk9YWV9CSU5EPTo4MDgwJwogICAgICAtIElNR1BST1hZX0xPQ0FMX0ZJTEVTWVNURU1fUk9PVD0vCiAgICAgIC0gSU1HUFJPWFlfVVNFX0VUQUc9dHJ1ZQogICAgICAtICdJTUdQUk9YWV9BVVRPX1dFQlA9JHtJTUdQUk9YWV9BVVRPX1dFQlA6LXRydWV9JwogICAgICAtIElNR1BST1hZX01BWF9TUkNfUkVTT0xVVElPTj0xNi44CiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovdmFyL2xpYi9zdG9yYWdlJwogIHN1cGFiYXNlLW1ldGE6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3Bvc3RncmVzLW1ldGE6djAuOTUuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUEdfTUVUQV9QT1JUPTgwODAKICAgICAgLSAnUEdfTUVUQV9EQl9IT1NUPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUEdfTUVUQV9EQl9QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHX01FVEFfREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gUEdfTUVUQV9EQl9VU0VSPXN1cGFiYXNlX2FkbWluCiAgICAgIC0gJ1BHX01FVEFfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnQ1JZUFRPX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfUEdNRVRBQ1JZUFRPfScKICBzdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczoKICAgIGltYWdlOiAnc3VwYWJhc2UvZWRnZS1ydW50aW1lOnYxLjcxLjInCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnRWRnZSBGdW5jdGlvbnMgaXMgaGVhbHRoeScKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtICdKV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdTVVBBQkFTRV9VUkw9aHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMCcKICAgICAgLSAnU1VQQUJBU0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9ST0xFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX0RCX1VSTD1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXM6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1ZFUklGWV9KV1Q9JHtGVU5DVElPTlNfVkVSSUZZX0pXVDotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL2Z1bmN0aW9uczovaG9tZS9kZW5vL2Z1bmN0aW9ucycKICAgICAgLSAnZGVuby1jYWNoZTovcm9vdC8uY2FjaGUvZGVubycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICJpbXBvcnQgKiBhcyBqb3NlIGZyb20gJ2h0dHBzOi8vZGVuby5sYW5kL3gvam9zZUB2NC4xNC40L2luZGV4LnRzJ1xuXG5jb25zb2xlLmxvZygnbWFpbiBmdW5jdGlvbiBzdGFydGVkJylcblxuY29uc3QgSldUX1NFQ1JFVCA9IERlbm8uZW52LmdldCgnSldUX1NFQ1JFVCcpXG5jb25zdCBTVVBBQkFTRV9VUkwgPSBEZW5vLmVudi5nZXQoJ1NVUEFCQVNFX1VSTCcpXG5jb25zdCBWRVJJRllfSldUID0gRGVuby5lbnYuZ2V0KCdWRVJJRllfSldUJykgPT09ICd0cnVlJ1xuXG4vLyBDcmVhdGUgSldLUyBmb3IgRVMyNTYvUlMyNTYgdG9rZW5zIChuZXdlciB0b2tlbnMpXG5sZXQgU1VQQUJBU0VfSldUX0tFWVM6IFJldHVyblR5cGU8dHlwZW9mIGpvc2UuY3JlYXRlUmVtb3RlSldLU2V0PiB8IG51bGwgPSBudWxsXG5pZiAoU1VQQUJBU0VfVVJMKSB7XG4gIHRyeSB7XG4gICAgU1VQQUJBU0VfSldUX0tFWVMgPSBqb3NlLmNyZWF0ZVJlbW90ZUpXS1NldChcbiAgICAgIG5ldyBVUkwoJy9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvbicsIFNVUEFCQVNFX1VSTClcbiAgICApXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdGYWlsZWQgdG8gZmV0Y2ggSldLUyBmcm9tIFNVUEFCQVNFX1VSTDonLCBlKVxuICB9XG59XG5cbmZ1bmN0aW9uIGdldEF1dGhUb2tlbihyZXE6IFJlcXVlc3QpIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmdldCgnYXV0aG9yaXphdGlvbicpXG4gIGlmICghYXV0aEhlYWRlcikge1xuICAgIHRocm93IG5ldyBFcnJvcignTWlzc2luZyBhdXRob3JpemF0aW9uIGhlYWRlcicpXG4gIH1cbiAgY29uc3QgW2JlYXJlciwgdG9rZW5dID0gYXV0aEhlYWRlci5zcGxpdCgnICcpXG4gIGlmIChiZWFyZXIgIT09ICdCZWFyZXInKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBBdXRoIGhlYWRlciBpcyBub3QgJ0JlYXJlciB7dG9rZW59J2ApXG4gIH1cbiAgcmV0dXJuIHRva2VuXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGlzVmFsaWRMZWdhY3lKV1Qoand0OiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFKV1RfU0VDUkVUKSB7XG4gICAgY29uc29sZS5lcnJvcignSldUX1NFQ1JFVCBub3QgYXZhaWxhYmxlIGZvciBIUzI1NiB0b2tlbiB2ZXJpZmljYXRpb24nKVxuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgY29uc3QgZW5jb2RlciA9IG5ldyBUZXh0RW5jb2RlcigpO1xuICBjb25zdCBzZWNyZXRLZXkgPSBlbmNvZGVyLmVuY29kZShKV1RfU0VDUkVUKVxuXG4gIHRyeSB7XG4gICAgYXdhaXQgam9zZS5qd3RWZXJpZnkoand0LCBzZWNyZXRLZXkpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcignU3ltbWV0cmljIExlZ2FjeSBKV1QgdmVyaWZpY2F0aW9uIGVycm9yJywgZSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGlmICghU1VQQUJBU0VfSldUX0tFWVMpIHtcbiAgICBjb25zb2xlLmVycm9yKCdKV0tTIG5vdCBhdmFpbGFibGUgZm9yIEVTMjU2L1JTMjU2IHRva2VuIHZlcmlmaWNhdGlvbicpXG4gICAgcmV0dXJuIGZhbHNlXG4gIH1cblxuICB0cnkge1xuICAgIGF3YWl0IGpvc2Uuand0VmVyaWZ5KGp3dCwgU1VQQUJBU0VfSldUX0tFWVMpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdBc3ltbWV0cmljIEpXVCB2ZXJpZmljYXRpb24gZXJyb3InLCBlKTtcbiAgICByZXR1cm4gZmFsc2VcbiAgfVxuXG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSHlicmlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHsgYWxnOiBqd3RBbGdvcml0aG0gfSA9IGpvc2UuZGVjb2RlUHJvdGVjdGVkSGVhZGVyKGp3dClcblxuICBpZiAoand0QWxnb3JpdGhtID09PSAnSFMyNTYnKSB7XG4gICAgY29uc29sZS5sb2coYExlZ2FjeSB0b2tlbiB0eXBlIGRldGVjdGVkLCBhdHRlbXB0aW5nICR7and0QWxnb3JpdGhtfSB2ZXJpZmljYXRpb24uYClcblxuICAgIHJldHVybiBhd2FpdCBpc1ZhbGlkTGVnYWN5SldUKGp3dClcbiAgfVxuXG4gIGlmIChqd3RBbGdvcml0aG0gPT09ICdFUzI1NicgfHwgand0QWxnb3JpdGhtID09PSAnUlMyNTYnKSB7XG4gICAgcmV0dXJuIGF3YWl0IGlzVmFsaWRKV1Qoand0KVxuICB9XG5cbiAgcmV0dXJuIGZhbHNlO1xufVxuXG5EZW5vLnNlcnZlKGFzeW5jIChyZXE6IFJlcXVlc3QpID0+IHtcbiAgaWYgKHJlcS5tZXRob2QgIT09ICdPUFRJT05TJyAmJiBWRVJJRllfSldUKSB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRva2VuID0gZ2V0QXV0aFRva2VuKHJlcSlcbiAgICAgIGNvbnN0IGlzVmFsaWRKV1QgPSBhd2FpdCBpc1ZhbGlkSHlicmlkSldUKHRva2VuKTtcblxuICAgICAgaWYgKCFpc1ZhbGlkSldUKSB7XG4gICAgICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoeyBtc2c6ICdJbnZhbGlkIEpXVCcgfSksIHtcbiAgICAgICAgICBzdGF0dXM6IDQwMSxcbiAgICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICBjb25zb2xlLmVycm9yKGUpXG4gICAgICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KHsgbXNnOiBlLnRvU3RyaW5nKCkgfSksIHtcbiAgICAgICAgc3RhdHVzOiA0MDEsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgfSlcbiAgICB9XG4gIH1cblxuICBjb25zdCB1cmwgPSBuZXcgVVJMKHJlcS51cmwpXG4gIGNvbnN0IHsgcGF0aG5hbWUgfSA9IHVybFxuICBjb25zdCBwYXRoX3BhcnRzID0gcGF0aG5hbWUuc3BsaXQoJy8nKVxuICBjb25zdCBzZXJ2aWNlX25hbWUgPSBwYXRoX3BhcnRzWzFdXG5cbiAgaWYgKCFzZXJ2aWNlX25hbWUgfHwgc2VydmljZV9uYW1lID09PSAnJykge1xuICAgIGNvbnN0IGVycm9yID0geyBtc2c6ICdtaXNzaW5nIGZ1bmN0aW9uIG5hbWUgaW4gcmVxdWVzdCcgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDQwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cblxuICBjb25zdCBzZXJ2aWNlUGF0aCA9IGAvaG9tZS9kZW5vL2Z1bmN0aW9ucy8ke3NlcnZpY2VfbmFtZX1gXG4gIGNvbnNvbGUuZXJyb3IoYHNlcnZpbmcgdGhlIHJlcXVlc3Qgd2l0aCAke3NlcnZpY2VQYXRofWApXG5cbiAgY29uc3QgbWVtb3J5TGltaXRNYiA9IDE1MFxuICBjb25zdCB3b3JrZXJUaW1lb3V0TXMgPSAxICogNjAgKiAxMDAwXG4gIGNvbnN0IG5vTW9kdWxlQ2FjaGUgPSBmYWxzZVxuICBjb25zdCBpbXBvcnRNYXBQYXRoID0gbnVsbFxuICBjb25zdCBlbnZWYXJzT2JqID0gRGVuby5lbnYudG9PYmplY3QoKVxuICBjb25zdCBlbnZWYXJzID0gT2JqZWN0LmtleXMoZW52VmFyc09iaikubWFwKChrKSA9PiBbaywgZW52VmFyc09ialtrXV0pXG5cbiAgdHJ5IHtcbiAgICBjb25zdCB3b3JrZXIgPSBhd2FpdCBFZGdlUnVudGltZS51c2VyV29ya2Vycy5jcmVhdGUoe1xuICAgICAgc2VydmljZVBhdGgsXG4gICAgICBtZW1vcnlMaW1pdE1iLFxuICAgICAgd29ya2VyVGltZW91dE1zLFxuICAgICAgbm9Nb2R1bGVDYWNoZSxcbiAgICAgIGltcG9ydE1hcFBhdGgsXG4gICAgICBlbnZWYXJzLFxuICAgIH0pXG4gICAgcmV0dXJuIGF3YWl0IHdvcmtlci5mZXRjaChyZXEpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zdCBlcnJvciA9IHsgbXNnOiBlLnRvU3RyaW5nKCkgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDUwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cbn0pIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2Z1bmN0aW9ucy9oZWxsby9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvaGVsbG8vaW5kZXgudHMKICAgICAgICBjb250ZW50OiAiLy8gRm9sbG93IHRoaXMgc2V0dXAgZ3VpZGUgdG8gaW50ZWdyYXRlIHRoZSBEZW5vIGxhbmd1YWdlIHNlcnZlciB3aXRoIHlvdXIgZWRpdG9yOlxuLy8gaHR0cHM6Ly9kZW5vLmxhbmQvbWFudWFsL2dldHRpbmdfc3RhcnRlZC9zZXR1cF95b3VyX2Vudmlyb25tZW50XG4vLyBUaGlzIGVuYWJsZXMgYXV0b2NvbXBsZXRlLCBnbyB0byBkZWZpbml0aW9uLCBldGMuXG5cbkRlbm8uc2VydmUoYXN5bmMgKCkgPT4ge1xuICByZXR1cm4gbmV3IFJlc3BvbnNlKFxuICAgIGBcIkhlbGxvIGZyb20gRWRnZSBGdW5jdGlvbnMhXCJgLFxuICAgIHsgaGVhZGVyczogeyBcIkNvbnRlbnQtVHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9IH0sXG4gIClcbn0pXG5cbi8vIFRvIGludm9rZTpcbi8vIGN1cmwgJ2h0dHA6Ly9sb2NhbGhvc3Q6PEtPTkdfSFRUUF9QT1JUPi9mdW5jdGlvbnMvdjEvaGVsbG8nIFxcXG4vLyAgIC0taGVhZGVyICdBdXRob3JpemF0aW9uOiBCZWFyZXIgPGFub24vc2VydmljZV9yb2xlIEFQSSBrZXk+J1xuIgogICAgY29tbWFuZDoKICAgICAgLSBzdGFydAogICAgICAtICctLW1haW4tc2VydmljZScKICAgICAgLSAvaG9tZS9kZW5vL2Z1bmN0aW9ucy9tYWluCiAgc3VwYWJhc2Utc3VwYXZpc29yOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdXBhdmlzb3I6Mi43LjQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1zU2ZMJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo0MDAwL2FwaS9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgICBzdGFydF9wZXJpb2Q6IDMwcwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9PTEVSX1RFTkFOVF9JRD0ke1BPT0xFUl9URU5BTlRfSUQ6LWRldl90ZW5hbnR9JwogICAgICAtIFBPT0xFUl9QT09MX01PREU9dHJhbnNhY3Rpb24KICAgICAgLSAnUE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFPSR7UE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFOi0yMH0nCiAgICAgIC0gJ1BPT0xFUl9NQVhfQ0xJRU5UX0NPTk49JHtQT09MRVJfTUFYX0NMSUVOVF9DT05OOi0xMDB9JwogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1ROQU1FPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQVRBQkFTRV9VUkw9ZWN0bzovL3N1cGFiYXNlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vX3N1cGFiYXNlJwogICAgICAtIENMVVNURVJfUE9TVEdSRVM9dHJ1ZQogICAgICAtICdTRUNSRVRfS0VZX0JBU0U9JHtTRVJWSUNFX1BBU1NXT1JEX1NVUEFWSVNPUlNFQ1JFVH0nCiAgICAgIC0gJ1ZBVUxUX0VOQ19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1ZBVUxURU5DfScKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSBSRUdJT049bG9jYWwKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAnREJfUE9PTF9TSVpFPSR7UE9PTEVSX0RCX1BPT0xfU0laRTotNX0nCiAgICAgIC0gR0xPQkFMX0RPV05TVFJFQU1fQ0VSVF9QQVRIPS9ldGMvc3NsL3NlcnZlci5jcnQKICAgICAgLSBHTE9CQUxfRE9XTlNUUkVBTV9LRVlfUEFUSD0vZXRjL3NzbC9zZXJ2ZXIua2V5CiAgICBjb21tYW5kOgogICAgICAtIC9iaW4vc2gKICAgICAgLSAnLWMnCiAgICAgIC0gImlmIFsgISAtZiAvZXRjL3NzbC9zZXJ2ZXIuY3J0IF07IHRoZW5cbiAgb3BlbnNzbCByZXEgLXg1MDkgLW5vZGVzIC1kYXlzIDM2NTAgLW5ld2tleSByc2E6MjA0OCBcXFxuICAgIC1rZXlvdXQgL2V0Yy9zc2wvc2VydmVyLmtleSAtb3V0IC9ldGMvc3NsL3NlcnZlci5jcnQgXFxcbiAgICAtc3ViaiBcIi9DTj1zdXBhYmFzZS1wb29sZXJcIlxuZmlcbi9hcHAvYmluL21pZ3JhdGUgJiYgL2FwcC9iaW4vc3VwYXZpc29yIGV2YWwgXCIkJChjYXQgL2V0Yy9wb29sZXIvcG9vbGVyLmV4cylcIiAmJiAvYXBwL2Jpbi9zZXJ2ZXJcbiIKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICB0YXJnZXQ6IC9ldGMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICBjb250ZW50OiAiezpvaywgX30gPSBBcHBsaWNhdGlvbi5lbnN1cmVfYWxsX3N0YXJ0ZWQoOnN1cGF2aXNvcilcbns6b2ssIHZlcnNpb259ID1cbiAgICBjYXNlIFN1cGF2aXNvci5SZXBvLnF1ZXJ5IShcInNlbGVjdCB2ZXJzaW9uKClcIikgZG9cbiAgICAle3Jvd3M6IFtbdmVyXV19IC0+IFN1cGF2aXNvci5IZWxwZXJzLnBhcnNlX3BnX3ZlcnNpb24odmVyKVxuICAgIF8gLT4gbmlsXG4gICAgZW5kXG5wYXJhbXMgPSAle1xuICAgIFwiZXh0ZXJuYWxfaWRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9URU5BTlRfSURcIiksXG4gICAgXCJkYl9ob3N0XCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19IT1NUTkFNRVwiKSxcbiAgICBcImRiX3BvcnRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BPUlRcIikgfD4gU3RyaW5nLnRvX2ludGVnZXIoKSxcbiAgICBcImRiX2RhdGFiYXNlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19EQlwiKSxcbiAgICBcInJlcXVpcmVfdXNlclwiID0+IGZhbHNlLFxuICAgIFwiYXV0aF9xdWVyeVwiID0+IFwiU0VMRUNUICogRlJPTSBwZ2JvdW5jZXIuZ2V0X2F1dGgoJDEpXCIsXG4gICAgXCJkZWZhdWx0X21heF9jbGllbnRzXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfTUFYX0NMSUVOVF9DT05OXCIpLFxuICAgIFwiZGVmYXVsdF9wb29sX3NpemVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9ERUZBVUxUX1BPT0xfU0laRVwiKSxcbiAgICBcImRlZmF1bHRfcGFyYW1ldGVyX3N0YXR1c1wiID0+ICV7XCJzZXJ2ZXJfdmVyc2lvblwiID0+IHZlcnNpb259LFxuICAgIFwidXNlcnNcIiA9PiBbJXtcbiAgICBcImRiX3VzZXJcIiA9PiBcInBnYm91bmNlclwiLFxuICAgIFwiZGJfcGFzc3dvcmRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BBU1NXT1JEXCIpLFxuICAgIFwibW9kZV90eXBlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfUE9PTF9NT0RFXCIpLFxuICAgIFwicG9vbF9zaXplXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfREVGQVVMVF9QT09MX1NJWkVcIiksXG4gICAgXCJpc19tYW5hZ2VyXCIgPT4gdHJ1ZVxuICAgIH1dXG59XG5cbnRlbmFudCA9IFN1cGF2aXNvci5UZW5hbnRzLmdldF90ZW5hbnRfYnlfZXh0ZXJuYWxfaWQocGFyYW1zW1wiZXh0ZXJuYWxfaWRcIl0pXG5cbmlmIHRlbmFudCBkb1xuICB7Om9rLCBffSA9IFN1cGF2aXNvci5UZW5hbnRzLnVwZGF0ZV90ZW5hbnQodGVuYW50LCBwYXJhbXMpXG5lbHNlXG4gIHs6b2ssIF99ID0gU3VwYXZpc29yLlRlbmFudHMuY3JlYXRlX3RlbmFudChwYXJhbXMpXG5lbmRcbiIK",
+        "compose": "c2VydmljZXM6CiAgc3VwYWJhc2Uta29uZzoKICAgIGltYWdlOiAna29uZy9rb25nOjMuOS4xJwogICAgZW50cnlwb2ludDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGtvbmcKICAgICAgICAtIGhlYWx0aAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfU1VQQUJBU0VLT05HXzgwMDAKICAgICAgLSAnS09OR19QT1JUX01BUFM9NDQzOjgwMDAnCiAgICAgIC0gJ0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gS09OR19EQVRBQkFTRT1vZmYKICAgICAgLSBLT05HX0RFQ0xBUkFUSVZFX0NPTkZJRz0vdXNyL2xvY2FsL2tvbmcva29uZy55bWwKICAgICAgLSAnS09OR19ETlNfT1JERVI9TEFTVCxBLENOQU1FJwogICAgICAtIEtPTkdfRE5TX05PVF9GT1VORF9UVEw9MQogICAgICAtICdLT05HX1BMVUdJTlM9cmVxdWVzdC10cmFuc2Zvcm1lcixjb3JzLGtleS1hdXRoLGFjbCxiYXNpYy1hdXRoLHJlcXVlc3QtdGVybWluYXRpb24saXAtcmVzdHJpY3Rpb24scG9zdC1mdW5jdGlvbicKICAgICAgLSBLT05HX05HSU5YX1BST1hZX1BST1hZX0JVRkZFUl9TSVpFPTE2MGsKICAgICAgLSAnS09OR19OR0lOWF9QUk9YWV9QUk9YWV9CVUZGRVJTPTY0IDE2MGsnCiAgICAgIC0gJ0tPTkdfUFJPWFlfQUNDRVNTX0xPRz0vZGV2L3N0ZG91dCBjb21iaW5lZCcKICAgICAgLSAnU1VQQUJBU0VfQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTVVBBQkFTRV9TRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWT0ke1NVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWTotfScKICAgICAgLSAnU1VQQUJBU0VfU0VDUkVUX0tFWT0ke1NVUEFCQVNFX1NFQ1JFVF9LRVk6LX0nCiAgICAgIC0gJ0FOT05fS0VZX0FTWU1NRVRSSUM9JHtBTk9OX0tFWV9BU1lNTUVUUklDOi19JwogICAgICAtICdTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUM9JHtTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUM6LX0nCiAgICAgIC0gJ0RBU0hCT0FSRF9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0RBU0hCT0FSRF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtICdLT05HX1NUT1JBR0VfQ09OTkVDVF9USU1FT1VUPSR7S09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVDotNjB9JwogICAgICAtICdLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9XUklURV9USU1FT1VUOi0zNjAwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFQURfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVQ6LTM2MDB9JwogICAgICAtICdLT05HX1NUT1JBR0VfUkVRVUVTVF9CVUZGRVJJTkc9JHtLT05HX1NUT1JBR0VfUkVRVUVTVF9CVUZGRVJJTkc6LWZhbHNlfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFU1BPTlNFX0JVRkZFUklORz0ke0tPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkc6LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvYXBpL2tvbmctZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL2Jhc2hcbiMgQ3VzdG9tIGVudHJ5cG9pbnQgZm9yIEtvbmcgdGhhdCBidWlsZHMgTHVhIGV4cHJlc3Npb25zIGZvciByZXF1ZXN0LXRyYW5zZm9ybWVyXG4jIGFuZCBwZXJmb3JtcyBlbnZpcm9ubWVudCB2YXJpYWJsZSBzdWJzdGl0dXRpb24gaW4gdGhlIGRlY2xhcmF0aXZlIGNvbmZpZy5cblxuaWYgWyAtbiBcIiRTVVBBQkFTRV9TRUNSRVRfS0VZXCIgXSAmJiBbIC1uIFwiJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWVwiIF07IHRoZW5cbiAgICBleHBvcnQgTFVBX0FVVEhfRVhQUj1cIlxcJCgoaGVhZGVycy5hdXRob3JpemF0aW9uIH49IG5pbCBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uOnN1YigxLCAxMCkgfj0gJ0JlYXJlciBzYl8nIGFuZCBoZWFkZXJzLmF1dGhvcml6YXRpb24pIG9yIChoZWFkZXJzLmFwaWtleSA9PSAnJFNVUEFCQVNFX1NFQ1JFVF9LRVknIGFuZCAnQmVhcmVyICRTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUMnKSBvciAoaGVhZGVycy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVknIGFuZCAnQmVhcmVyICRBTk9OX0tFWV9BU1lNTUVUUklDJykgb3IgaGVhZGVycy5hcGlrZXkpXCJcbiAgICBleHBvcnQgTFVBX1JUX1dTX0VYUFI9XCJcXCQoKHF1ZXJ5X3BhcmFtcy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9TRUNSRVRfS0VZJyBhbmQgJyRTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUMnKSBvciAocXVlcnlfcGFyYW1zLmFwaWtleSA9PSAnJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWScgYW5kICckQU5PTl9LRVlfQVNZTU1FVFJJQycpIG9yIHF1ZXJ5X3BhcmFtcy5hcGlrZXkpXCJcbmVsc2VcbiAgICBleHBvcnQgTFVBX0FVVEhfRVhQUj1cIlxcJCgoaGVhZGVycy5hdXRob3JpemF0aW9uIH49IG5pbCBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uOnN1YigxLCAxMCkgfj0gJ0JlYXJlciBzYl8nIGFuZCBoZWFkZXJzLmF1dGhvcml6YXRpb24pIG9yIGhlYWRlcnMuYXBpa2V5KVwiXG4gICAgZXhwb3J0IExVQV9SVF9XU19FWFBSPVwiXFwkKHF1ZXJ5X3BhcmFtcy5hcGlrZXkpXCJcbmZpXG5cbmF3ayAne1xuICByZXN1bHQgPSBcIlwiXG4gIHJlc3QgPSAkMFxuICB3aGlsZSAobWF0Y2gocmVzdCwgL1xcJFtBLVphLXpfXVtBLVphLXpfMC05XSovKSkge1xuICAgIHZhcm5hbWUgPSBzdWJzdHIocmVzdCwgUlNUQVJUICsgMSwgUkxFTkdUSCAtIDEpXG4gICAgaWYgKHZhcm5hbWUgaW4gRU5WSVJPTikge1xuICAgICAgcmVzdWx0ID0gcmVzdWx0IHN1YnN0cihyZXN0LCAxLCBSU1RBUlQgLSAxKSBFTlZJUk9OW3Zhcm5hbWVdXG4gICAgfSBlbHNlIHtcbiAgICAgIHJlc3VsdCA9IHJlc3VsdCBzdWJzdHIocmVzdCwgMSwgUlNUQVJUICsgUkxFTkdUSCAtIDEpXG4gICAgfVxuICAgIHJlc3QgPSBzdWJzdHIocmVzdCwgUlNUQVJUICsgUkxFTkdUSClcbiAgfVxuICBwcmludCByZXN1bHQgcmVzdFxufScgL2hvbWUva29uZy90ZW1wLnltbCA+IFwiJEtPTkdfREVDTEFSQVRJVkVfQ09ORklHXCJcblxuc2VkIC1pICcvXltbOnNwYWNlOl1dKi0ga2V5OltbOnNwYWNlOl1dKiQvZCcgXCIkS09OR19ERUNMQVJBVElWRV9DT05GSUdcIlxuXG5leGVjIC9lbnRyeXBvaW50LnNoIGtvbmcgZG9ja2VyLXN0YXJ0XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvYXBpL2tvbmcueW1sCiAgICAgICAgdGFyZ2V0OiAvaG9tZS9rb25nL3RlbXAueW1sCiAgICAgICAgY29udGVudDogIl9mb3JtYXRfdmVyc2lvbjogJzIuMSdcbl90cmFuc2Zvcm06IHRydWVcblxuIyMjXG4jIyMgQ29uc3VtZXJzIC8gVXNlcnNcbiMjI1xuY29uc3VtZXJzOlxuICAtIHVzZXJuYW1lOiBEQVNIQk9BUkRcbiAgLSB1c2VybmFtZTogYW5vblxuICAgIGtleWF1dGhfY3JlZGVudGlhbHM6XG4gICAgICAtIGtleTogJFNVUEFCQVNFX0FOT05fS0VZXG4gICAgICAtIGtleTogJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWVxuICAtIHVzZXJuYW1lOiBzZXJ2aWNlX3JvbGVcbiAgICBrZXlhdXRoX2NyZWRlbnRpYWxzOlxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9TRVJWSUNFX0tFWVxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9TRUNSRVRfS0VZXG5cbiMjI1xuIyMjIEFjY2VzcyBDb250cm9sIExpc3RcbiMjI1xuYWNsczpcbiAgLSBjb25zdW1lcjogYW5vblxuICAgIGdyb3VwOiBhbm9uXG4gIC0gY29uc3VtZXI6IHNlcnZpY2Vfcm9sZVxuICAgIGdyb3VwOiBhZG1pblxuXG4jIyNcbiMjIyBEYXNoYm9hcmQgY3JlZGVudGlhbHNcbiMjI1xuYmFzaWNhdXRoX2NyZWRlbnRpYWxzOlxuLSBjb25zdW1lcjogREFTSEJPQVJEXG4gIHVzZXJuYW1lOiAnJERBU0hCT0FSRF9VU0VSTkFNRSdcbiAgcGFzc3dvcmQ6ICckREFTSEJPQVJEX1BBU1NXT1JEJ1xuXG5cbiMjI1xuIyMjIEFQSSBSb3V0ZXNcbiMjI1xuc2VydmljZXM6XG5cbiAgIyMgT3BlbiBBdXRoIHJvdXRlc1xuICAtIG5hbWU6IGF1dGgtdjEtb3BlblxuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS92ZXJpZnlcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3BlblxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvdmVyaWZ5XG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1jYWxsYmFja1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9jYWxsYmFja1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWNhbGxiYWNrXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS9jYWxsYmFja1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tYXV0aG9yaXplXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L2F1dGhvcml6ZVxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWF1dGhvcml6ZVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvYXV0aG9yaXplXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1qd2tzXG4gICAgX2NvbW1lbnQ6ICdBdXRoOiAvYXV0aC92MS8ud2VsbC1rbm93bi9qd2tzLmpzb24gLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9qd2tzLmpzb24nXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5Ly53ZWxsLWtub3duL2p3a3MuanNvblxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWp3a3NcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvblxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tYWNzXG4gICAgdXJsOiBcImh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvc3NvL3NhbWwvYWNzXCJcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tYWNzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgIC0gL3Nzby9zYW1sL2Fjc1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tbWV0YWRhdGFcbiAgICB1cmw6IFwiaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9zc28vc2FtbC9tZXRhZGF0YVwiXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLW1ldGFkYXRhXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgIC0gL3Nzby9zYW1sL21ldGFkYXRhXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuXG4gICMjIFNlY3VyZSBBdXRoIHJvdXRlc1xuICAtIG5hbWU6IGF1dGgtdjFcbiAgICBfY29tbWVudDogJ0dvVHJ1ZTogL2F1dGgvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5LyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTZWN1cmUgUkVTVCByb3V0ZXNcbiAgLSBuYW1lOiByZXN0LXYxXG4gICAgX2NvbW1lbnQ6ICdQb3N0Z1JFU1Q6IC9yZXN0L3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC8qJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlc3QtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvcmVzdC92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU2VjdXJlIEdyYXBoUUwgcm91dGVzXG4gIC0gbmFtZTogZ3JhcGhxbC12MVxuICAgIF9jb21tZW50OiAnUG9zdGdSRVNUOiAvZ3JhcGhxbC92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvcnBjL2dyYXBocWwnXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtcmVzdDozMDAwL3JwYy9ncmFwaHFsXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBncmFwaHFsLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2dyYXBocWwvdjFcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQ29udGVudC1Qcm9maWxlOiBncmFwaHFsX3B1YmxpY1wiXG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJDb250ZW50LVByb2ZpbGU6IGdyYXBocWxfcHVibGljXCJcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuXG4gICMjIFNlY3VyZSBSZWFsdGltZSByb3V0ZXNcbiAgLSBuYW1lOiByZWFsdGltZS12MS13c1xuICAgIF9jb21tZW50OiAnUmVhbHRpbWU6IC9yZWFsdGltZS92MS8qIC0+IHdzOi8vcmVhbHRpbWU6NDAwMC9zb2NrZXQvKidcbiAgICB1cmw6IGh0dHA6Ly9yZWFsdGltZS1kZXY6NDAwMC9zb2NrZXRcbiAgICBwcm90b2NvbDogd3NcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlYWx0aW1lLXYxLXdzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvcmVhbHRpbWUvdjEvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgcXVlcnlzdHJpbmc6XG4gICAgICAgICAgICAgIC0gXCJhcGlrZXk6ICRMVUFfUlRfV1NfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIHF1ZXJ5c3RyaW5nOlxuICAgICAgICAgICAgICAtIFwiYXBpa2V5OiAkTFVBX1JUX1dTX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG4gIC0gbmFtZTogcmVhbHRpbWUtdjEtcmVzdFxuICAgIF9jb21tZW50OiAnUmVhbHRpbWU6IC9yZWFsdGltZS92MS9hcGkvKiAtPiBodHRwOi8vcmVhbHRpbWU6NDAwMC9hcGkvKidcbiAgICB1cmw6IGh0dHA6Ly9yZWFsdGltZS1kZXY6NDAwMC9hcGlcbiAgICBwcm90b2NvbDogaHR0cFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogcmVhbHRpbWUtdjEtcmVzdFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3JlYWx0aW1lL3YxL2FwaVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTdG9yYWdlIEFQSSBlbmRwb2ludFxuICAjIyBObyBrZXktYXV0aCAtIFMzIHByb3RvY29sIHJlcXVlc3RzIGRvbid0IGNhcnJ5IGFuIGFwaWtleSBoZWFkZXIuXG4gIC0gbmFtZTogc3RvcmFnZS12MVxuICAgIF9jb21tZW50OiAnU3RvcmFnZTogL3N0b3JhZ2UvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2Utc3RvcmFnZTo1MDAwLyonXG4gICAgY29ubmVjdF90aW1lb3V0OiAkS09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVFxuICAgIHdyaXRlX3RpbWVvdXQ6ICRLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVFxuICAgIHJlYWRfdGltZW91dDogJEtPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVRcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdG9yYWdlOjUwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBzdG9yYWdlLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3N0b3JhZ2UvdjEvXG4gICAgICAgIHJlcXVlc3RfYnVmZmVyaW5nOiAkS09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HXG4gICAgICAgIHJlc3BvbnNlX2J1ZmZlcmluZzogJEtPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkdcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IHBvc3QtZnVuY3Rpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFjY2VzczpcbiAgICAgICAgICAgIC0gfFxuICAgICAgICAgICAgICBsb2NhbCBhdXRoID0ga29uZy5yZXF1ZXN0LmdldF9oZWFkZXIoXCJhdXRob3JpemF0aW9uXCIpXG4gICAgICAgICAgICAgIGlmIGF1dGggPT0gbmlsIG9yIGF1dGggPT0gXCJcIiBvciBhdXRoOmZpbmQoXCJeJXMqJFwiKSB0aGVuXG4gICAgICAgICAgICAgICAga29uZy5zZXJ2aWNlLnJlcXVlc3QuY2xlYXJfaGVhZGVyKFwiYXV0aG9yaXphdGlvblwiKVxuICAgICAgICAgICAgICBlbmRcblxuICAjIyBFZGdlIEZ1bmN0aW9ucyByb3V0ZXNcbiAgLSBuYW1lOiBmdW5jdGlvbnMtdjFcbiAgICBfY29tbWVudDogJ0VkZ2UgRnVuY3Rpb25zOiAvZnVuY3Rpb25zL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zOjkwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczo5MDAwL1xuICAgIHJlYWRfdGltZW91dDogMTUwMDAwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBmdW5jdGlvbnMtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvZnVuY3Rpb25zL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBPQXV0aCAyLjAgQXV0aG9yaXphdGlvbiBTZXJ2ZXIgTWV0YWRhdGEgKFJGQyA4NDE0KVxuICAtIG5hbWU6IHdlbGwta25vd24tb2F1dGhcbiAgICBfY29tbWVudDogJ0F1dGg6IC8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlciAtPiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5Ly53ZWxsLWtub3duL29hdXRoLWF1dGhvcml6YXRpb24tc2VydmVyJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlclxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogd2VsbC1rbm93bi1vYXV0aFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gLy53ZWxsLWtub3duL29hdXRoLWF1dGhvcml6YXRpb24tc2VydmVyXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuXG4gICMjIEFuYWx5dGljcyByb3V0ZXNcbiAgIyMgTm90IHVzZWQgLSBTdHVkaW8gYW5kIFZlY3RvciB0YWxrIGRpcmVjdGx5IHRvIGFuYWx5dGljcyB2aWEgRG9ja2VyIG5ldHdvcmtpbmcuXG4gICMgLSBuYW1lOiBhbmFseXRpY3MtdjFcbiAgIyAgIF9jb21tZW50OiAnQW5hbHl0aWNzOiAvYW5hbHl0aWNzL3YxLyogLT4gaHR0cDovL2xvZ2ZsYXJlOjQwMDAvKidcbiAgIyAgIHVybDogaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL1xuICAjICAgcm91dGVzOlxuICAjICAgICAtIG5hbWU6IGFuYWx5dGljcy12MS1hbGxcbiAgIyAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICMgICAgICAgcGF0aHM6XG4gICMgICAgICAgICAtIC9hbmFseXRpY3MvdjEvXG5cbiAgIyMgU2VjdXJlIERhdGFiYXNlIHJvdXRlc1xuICAtIG5hbWU6IG1ldGFcbiAgICBfY29tbWVudDogJ3BnLW1ldGE6IC9wZy8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtZXRhLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3BnL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuXG4gICMjIEJsb2NrIGFjY2VzcyB0byAvYXBpL21jcFxuICAtIG5hbWU6IG1jcC1ibG9ja2VyXG4gICAgX2NvbW1lbnQ6ICdCbG9jayBkaXJlY3QgYWNjZXNzIHRvIC9hcGkvbWNwJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXN0dWRpbzozMDAwL2FwaS9tY3BcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IG1jcC1ibG9ja2VyLXJvdXRlXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXBpL21jcFxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdGVybWluYXRpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIHN0YXR1c19jb2RlOiA0MDNcbiAgICAgICAgICBtZXNzYWdlOiBcIkFjY2VzcyBpcyBmb3JiaWRkZW4uXCJcblxuICAjIyBNQ1AgZW5kcG9pbnQgLSBsb2NhbCBhY2Nlc3NcbiAgLSBuYW1lOiBtY3BcbiAgICBfY29tbWVudDogJ01DUDogL21jcCAtPiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvYXBpL21jcCAobG9jYWwgYWNjZXNzKSdcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9hcGkvbWNwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtY3BcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9tY3BcbiAgICBwbHVnaW5zOlxuICAgICAgIyBCbG9jayBhY2Nlc3MgdG8gL21jcCBieSBkZWZhdWx0XG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdGVybWluYXRpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIHN0YXR1c19jb2RlOiA0MDNcbiAgICAgICAgICBtZXNzYWdlOiBcIkFjY2VzcyBpcyBmb3JiaWRkZW4uXCJcbiAgICAgICMgRW5hYmxlIGxvY2FsIGFjY2VzcyAoZGFuZ2VyIHpvbmUhKVxuICAgICAgIyAxLiBDb21tZW50IG91dCB0aGUgJ3JlcXVlc3QtdGVybWluYXRpb24nIHNlY3Rpb24gYWJvdmVcbiAgICAgICMgMi4gVW5jb21tZW50IHRoZSBlbnRpcmUgc2VjdGlvbiBiZWxvdywgaW5jbHVkaW5nICdkZW55J1xuICAgICAgIyAzLiBBZGQgeW91ciBsb2NhbCBJUHMgdG8gdGhlICdhbGxvdycgbGlzdFxuICAgICAgIy0gbmFtZTogY29yc1xuICAgICAgIy0gbmFtZTogaXAtcmVzdHJpY3Rpb25cbiAgICAgICMgIGNvbmZpZzpcbiAgICAgICMgICAgYWxsb3c6XG4gICAgICAjICAgICAgLSAxMjcuMC4wLjFcbiAgICAgICMgICAgICAtIDo6MVxuICAgICAgIyAgICBkZW55OiBbXVxuXG4gICMjIFByb3RlY3RlZCBEYXNoYm9hcmQgLSBjYXRjaCBhbGwgcmVtYWluaW5nIHJvdXRlc1xuICAtIG5hbWU6IGRhc2hib2FyZFxuICAgIF9jb21tZW50OiAnU3R1ZGlvOiAvKiAtPiBodHRwOi8vc3R1ZGlvOjMwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGRhc2hib2FyZC1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGJhc2ljLWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IHRydWVcbiIKICBzdXBhYmFzZS1zdHVkaW86CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N0dWRpbzoyMDI2LjAzLjE2LXNoYS01NTI4ODE3JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5vZGUKICAgICAgICAtICctZScKICAgICAgICAtICJmZXRjaCgnaHR0cDovLzEyNy4wLjAuMTozMDAwL2FwaS9wbGF0Zm9ybS9wcm9maWxlJykudGhlbigocikgPT4ge2lmIChyLnN0YXR1cyAhPT0gMjAwKSB0aHJvdyBuZXcgRXJyb3Ioci5zdGF0dXMpfSkiCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAzCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIEhPU1ROQU1FPTAuMC4wLjAKICAgICAgLSAnU1RVRElPX1BHX01FVEFfVVJMPWh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAnCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1Q9JHtQT1NUR1JFU19IT1NUOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ1BPU1RHUkVTX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSAnREVGQVVMVF9PUkdBTklaQVRJT05fTkFNRT0ke1NUVURJT19ERUZBVUxUX09SR0FOSVpBVElPTjotRGVmYXVsdCBPcmdhbml6YXRpb259JwogICAgICAtICdERUZBVUxUX1BST0pFQ1RfTkFNRT0ke1NUVURJT19ERUZBVUxUX1BST0pFQ1Q6LURlZmF1bHQgUHJvamVjdH0nCiAgICAgIC0gJ1NVUEFCQVNFX1VSTD1odHRwOi8vc3VwYWJhc2Uta29uZzo4MDAwJwogICAgICAtICdTVVBBQkFTRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9VUkxfU1VQQUJBU0VLT05HfScKICAgICAgLSAnU1VQQUJBU0VfQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTVVBBQkFTRV9TRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ0FVVEhfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdfTUVUQV9DUllQVE9fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9QR01FVEFDUllQVE99JwogICAgICAtICdMT0dGTEFSRV9BUElfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFfScKICAgICAgLSAnTE9HRkxBUkVfUFJJVkFURV9BQ0NFU1NfVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFUFJJVkFURX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1VSTD1odHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAnCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSBORVhUX1BVQkxJQ19FTkFCTEVfTE9HUz10cnVlCiAgICAgIC0gTkVYVF9BTkFMWVRJQ1NfQkFDS0VORF9QUk9WSURFUj1wb3N0Z3JlcwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSBTTklQUEVUU19NQU5BR0VNRU5UX0ZPTERFUj0vYXBwL3NuaXBwZXRzCiAgICAgIC0gRURHRV9GVU5DVElPTlNfTUFOQUdFTUVOVF9GT0xERVI9L2FwcC9lZGdlLWZ1bmN0aW9ucwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3NuaXBwZXRzOi9hcHAvc25pcHBldHMnCiAgICAgIC0gJy4vdm9sdW1lcy9mdW5jdGlvbnM6L2FwcC9lZGdlLWZ1bmN0aW9ucycKICBzdXBhYmFzZS1kYjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXM6MTUuOC4xLjA4NScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncGdfaXNyZWFkeSAtVSBwb3N0Z3JlcyAtaCAxMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtdmVjdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBjb21tYW5kOgogICAgICAtIHBvc3RncmVzCiAgICAgIC0gJy1jJwogICAgICAtIGNvbmZpZ19maWxlPS9ldGMvcG9zdGdyZXNxbC9wb3N0Z3Jlc3FsLmNvbmYKICAgICAgLSAnLWMnCiAgICAgIC0gbG9nX21pbl9tZXNzYWdlcz1mYXRhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSE9TVD0vdmFyL3J1bi9wb3N0Z3Jlc3FsCiAgICAgIC0gJ1BHUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUEdEQVRBQkFTRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwYWJhc2UtZGItZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvcmVhbHRpbWUuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85OS1yZWFsdGltZS5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxuY3JlYXRlIHNjaGVtYSBpZiBub3QgZXhpc3RzIF9yZWFsdGltZTtcbmFsdGVyIHNjaGVtYSBfcmVhbHRpbWUgb3duZXIgdG8gOnBndXNlcjtcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9kYi9fc3VwYWJhc2Uuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85Ny1fc3VwYWJhc2Uuc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cbkNSRUFURSBEQVRBQkFTRSBfc3VwYWJhc2UgV0lUSCBPV05FUiA6cGd1c2VyO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3Bvb2xlci5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LXBvb2xlci5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxcYyBfc3VwYWJhc2VcbmNyZWF0ZSBzY2hlbWEgaWYgbm90IGV4aXN0cyBfc3VwYXZpc29yO1xuYWx0ZXIgc2NoZW1hIF9zdXBhdmlzb3Igb3duZXIgdG8gOnBndXNlcjtcblxcYyBwb3N0Z3Jlc1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3dlYmhvb2tzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OC13ZWJob29rcy5zcWwKICAgICAgICBjb250ZW50OiAiQkVHSU47XG4tLSBDcmVhdGUgcGdfbmV0IGV4dGVuc2lvblxuQ1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHBnX25ldCBTQ0hFTUEgZXh0ZW5zaW9ucztcbi0tIENyZWF0ZSBzdXBhYmFzZV9mdW5jdGlvbnMgc2NoZW1hXG5DUkVBVEUgU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBBVVRIT1JJWkFUSU9OIHN1cGFiYXNlX2FkbWluO1xuR1JBTlQgVVNBR0UgT04gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFRBQkxFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIEZVTkNUSU9OUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFNFUVVFTkNFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLm1pZ3JhdGlvbnMgZGVmaW5pdGlvblxuQ1JFQVRFIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5taWdyYXRpb25zIChcbiAgdmVyc2lvbiB0ZXh0IFBSSU1BUlkgS0VZLFxuICBpbnNlcnRlZF9hdCB0aW1lc3RhbXB0eiBOT1QgTlVMTCBERUZBVUxUIE5PVygpXG4pO1xuLS0gSW5pdGlhbCBzdXBhYmFzZV9mdW5jdGlvbnMgbWlncmF0aW9uXG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnaW5pdGlhbCcpO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLmhvb2tzIGRlZmluaXRpb25cbkNSRUFURSBUQUJMRSBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgKFxuICBpZCBiaWdzZXJpYWwgUFJJTUFSWSBLRVksXG4gIGhvb2tfdGFibGVfaWQgaW50ZWdlciBOT1QgTlVMTCxcbiAgaG9va19uYW1lIHRleHQgTk9UIE5VTEwsXG4gIGNyZWF0ZWRfYXQgdGltZXN0YW1wdHogTk9UIE5VTEwgREVGQVVMVCBOT1coKSxcbiAgcmVxdWVzdF9pZCBiaWdpbnRcbik7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX3JlcXVlc3RfaWRfaWR4IE9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBVU0lORyBidHJlZSAocmVxdWVzdF9pZCk7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX2hfdGFibGVfaWRfaF9uYW1lX2lkeCBPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgVVNJTkcgYnRyZWUgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSk7XG5DT01NRU5UIE9OIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBJUyAnU3VwYWJhc2UgRnVuY3Rpb25zIEhvb2tzOiBBdWRpdCB0cmFpbCBmb3IgdHJpZ2dlcmVkIGhvb2tzLic7XG5DUkVBVEUgRlVOQ1RJT04gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpXG4gIFJFVFVSTlMgdHJpZ2dlclxuICBMQU5HVUFHRSBwbHBnc3FsXG4gIEFTICRmdW5jdGlvbiRcbiAgREVDTEFSRVxuICAgIHJlcXVlc3RfaWQgYmlnaW50O1xuICAgIHBheWxvYWQganNvbmI7XG4gICAgdXJsIHRleHQgOj0gVEdfQVJHVlswXTo6dGV4dDtcbiAgICBtZXRob2QgdGV4dCA6PSBUR19BUkdWWzFdOjp0ZXh0O1xuICAgIGhlYWRlcnMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICBwYXJhbXMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICB0aW1lb3V0X21zIGludGVnZXIgREVGQVVMVCAxMDAwO1xuICBCRUdJTlxuICAgIElGIHVybCBJUyBOVUxMIE9SIHVybCA9ICdudWxsJyBUSEVOXG4gICAgICBSQUlTRSBFWENFUFRJT04gJ3VybCBhcmd1bWVudCBpcyBtaXNzaW5nJztcbiAgICBFTkQgSUY7XG5cbiAgICBJRiBtZXRob2QgSVMgTlVMTCBPUiBtZXRob2QgPSAnbnVsbCcgVEhFTlxuICAgICAgUkFJU0UgRVhDRVBUSU9OICdtZXRob2QgYXJndW1lbnQgaXMgbWlzc2luZyc7XG4gICAgRU5EIElGO1xuXG4gICAgSUYgVEdfQVJHVlsyXSBJUyBOVUxMIE9SIFRHX0FSR1ZbMl0gPSAnbnVsbCcgVEhFTlxuICAgICAgaGVhZGVycyA9ICd7XCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCJ9Jzo6anNvbmI7XG4gICAgRUxTRVxuICAgICAgaGVhZGVycyA9IFRHX0FSR1ZbMl06Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbM10gSVMgTlVMTCBPUiBUR19BUkdWWzNdID0gJ251bGwnIFRIRU5cbiAgICAgIHBhcmFtcyA9ICd7fSc6Ompzb25iO1xuICAgIEVMU0VcbiAgICAgIHBhcmFtcyA9IFRHX0FSR1ZbM106Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbNF0gSVMgTlVMTCBPUiBUR19BUkdWWzRdID0gJ251bGwnIFRIRU5cbiAgICAgIHRpbWVvdXRfbXMgPSAxMDAwO1xuICAgIEVMU0VcbiAgICAgIHRpbWVvdXRfbXMgPSBUR19BUkdWWzRdOjppbnRlZ2VyO1xuICAgIEVORCBJRjtcblxuICAgIENBU0VcbiAgICAgIFdIRU4gbWV0aG9kID0gJ0dFVCcgVEhFTlxuICAgICAgICBTRUxFQ1QgaHR0cF9nZXQgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfZ2V0KFxuICAgICAgICAgIHVybCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBXSEVOIG1ldGhvZCA9ICdQT1NUJyBUSEVOXG4gICAgICAgIHBheWxvYWQgPSBqc29uYl9idWlsZF9vYmplY3QoXG4gICAgICAgICAgJ29sZF9yZWNvcmQnLCBPTEQsXG4gICAgICAgICAgJ3JlY29yZCcsIE5FVyxcbiAgICAgICAgICAndHlwZScsIFRHX09QLFxuICAgICAgICAgICd0YWJsZScsIFRHX1RBQkxFX05BTUUsXG4gICAgICAgICAgJ3NjaGVtYScsIFRHX1RBQkxFX1NDSEVNQVxuICAgICAgICApO1xuXG4gICAgICAgIFNFTEVDVCBodHRwX3Bvc3QgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfcG9zdChcbiAgICAgICAgICB1cmwsXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBFTFNFXG4gICAgICAgIFJBSVNFIEVYQ0VQVElPTiAnbWV0aG9kIGFyZ3VtZW50ICUgaXMgaW52YWxpZCcsIG1ldGhvZDtcbiAgICBFTkQgQ0FTRTtcblxuICAgIElOU0VSVCBJTlRPIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rc1xuICAgICAgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSwgcmVxdWVzdF9pZClcbiAgICBWQUxVRVNcbiAgICAgIChUR19SRUxJRCwgVEdfTkFNRSwgcmVxdWVzdF9pZCk7XG5cbiAgICBSRVRVUk4gTkVXO1xuICBFTkRcbiRmdW5jdGlvbiQ7XG4tLSBTdXBhYmFzZSBzdXBlciBhZG1pblxuRE9cbiQkXG5CRUdJTlxuICBJRiBOT1QgRVhJU1RTIChcbiAgICBTRUxFQ1QgMVxuICAgIEZST00gcGdfcm9sZXNcbiAgICBXSEVSRSByb2xuYW1lID0gJ3N1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbidcbiAgKVxuICBUSEVOXG4gICAgQ1JFQVRFIFVTRVIgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIE5PSU5IRVJJVCBDUkVBVEVST0xFIExPR0lOIE5PUkVQTElDQVRJT047XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBTQ0hFTUEgc3VwYWJhc2VfZnVuY3Rpb25zIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkdSQU5UIEFMTCBQUklWSUxFR0VTIE9OIEFMTCBUQUJMRVMgSU4gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBBTEwgU0VRVUVOQ0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gU0VUIHNlYXJjaF9wYXRoID0gXCJzdXBhYmFzZV9mdW5jdGlvbnNcIjtcbkFMVEVSIHRhYmxlIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIubWlncmF0aW9ucyBPV05FUiBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5BTFRFUiB0YWJsZSBcInN1cGFiYXNlX2Z1bmN0aW9uc1wiLmhvb2tzIE9XTkVSIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkFMVEVSIGZ1bmN0aW9uIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIuaHR0cF9yZXF1ZXN0KCkgT1dORVIgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuR1JBTlQgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIFRPIHBvc3RncmVzO1xuLS0gUmVtb3ZlIHVudXNlZCBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gcm9sZVxuRE9cbiQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19yb2xlc1xuICAgIFdIRVJFIHJvbG5hbWUgPSAnc3VwYWJhc2VfcGdfbmV0X2FkbWluJ1xuICApXG4gIFRIRU5cbiAgICBSRUFTU0lHTiBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gVE8gc3VwYWJhc2VfYWRtaW47XG4gICAgRFJPUCBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW47XG4gICAgRFJPUCBST0xFIHN1cGFiYXNlX3BnX25ldF9hZG1pbjtcbiAgRU5EIElGO1xuRU5EXG4kJDtcbi0tIHBnX25ldCBncmFudHMgd2hlbiBleHRlbnNpb24gaXMgYWxyZWFkeSBlbmFibGVkXG5ET1xuJCRcbkJFR0lOXG4gIElGIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V4dGVuc2lvblxuICAgIFdIRVJFIGV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG4tLSBFdmVudCB0cmlnZ2VyIGZvciBwZ19uZXRcbkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIGV4dGVuc2lvbnMuZ3JhbnRfcGdfbmV0X2FjY2VzcygpXG5SRVRVUk5TIGV2ZW50X3RyaWdnZXJcbkxBTkdVQUdFIHBscGdzcWxcbkFTICQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19ldmVudF90cmlnZ2VyX2RkbF9jb21tYW5kcygpIEFTIGV2XG4gICAgSk9JTiBwZ19leHRlbnNpb24gQVMgZXh0XG4gICAgT04gZXYub2JqaWQgPSBleHQub2lkXG4gICAgV0hFUkUgZXh0LmV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORDtcbiQkO1xuQ09NTUVOVCBPTiBGVU5DVElPTiBleHRlbnNpb25zLmdyYW50X3BnX25ldF9hY2Nlc3MgSVMgJ0dyYW50cyBhY2Nlc3MgdG8gcGdfbmV0JztcbkRPXG4kJFxuQkVHSU5cbiAgSUYgTk9UIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V2ZW50X3RyaWdnZXJcbiAgICBXSEVSRSBldnRuYW1lID0gJ2lzc3VlX3BnX25ldF9hY2Nlc3MnXG4gICkgVEhFTlxuICAgIENSRUFURSBFVkVOVCBUUklHR0VSIGlzc3VlX3BnX25ldF9hY2Nlc3MgT04gZGRsX2NvbW1hbmRfZW5kIFdIRU4gVEFHIElOICgnQ1JFQVRFIEVYVEVOU0lPTicpXG4gICAgRVhFQ1VURSBQUk9DRURVUkUgZXh0ZW5zaW9ucy5ncmFudF9wZ19uZXRfYWNjZXNzKCk7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnMjAyMTA4MDkxODM0MjNfdXBkYXRlX2dyYW50cycpO1xuQUxURVIgZnVuY3Rpb24gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpIFNFQ1VSSVRZIERFRklORVI7XG5BTFRFUiBmdW5jdGlvbiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgU0VUIHNlYXJjaF9wYXRoID0gc3VwYWJhc2VfZnVuY3Rpb25zO1xuUkVWT0tFIEFMTCBPTiBGVU5DVElPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgRlJPTSBQVUJMSUM7XG5HUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5odHRwX3JlcXVlc3QoKSBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQ09NTUlUO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3JvbGVzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OS1yb2xlcy5zcWwKICAgICAgICBjb250ZW50OiAiLS0gTk9URTogY2hhbmdlIHRvIHlvdXIgb3duIHBhc3N3b3JkcyBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHNcbiBcXHNldCBwZ3Bhc3MgYGVjaG8gXCIkUE9TVEdSRVNfUEFTU1dPUkRcImBcblxuIEFMVEVSIFVTRVIgYXV0aGVudGljYXRvciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHBnYm91bmNlciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHN1cGFiYXNlX2F1dGhfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9zdG9yYWdlX2FkbWluIFdJVEggUEFTU1dPUkQgOidwZ3Bhc3MnO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL2p3dC5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LXNjcmlwdHMvOTktand0LnNxbAogICAgICAgIGNvbnRlbnQ6ICJcXHNldCBqd3Rfc2VjcmV0IGBlY2hvIFwiJEpXVF9TRUNSRVRcImBcblxcc2V0IGp3dF9leHAgYGVjaG8gXCIkSldUX0VYUFwiYFxuXFxzZXQgZGJfbmFtZSBgZWNobyBcIiR7UE9TVEdSRVNfREI6LXBvc3RncmVzfVwiYFxuXG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X3NlY3JldFwiIFRPIDonand0X3NlY3JldCc7XG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X2V4cFwiIFRPIDonand0X2V4cCc7XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvbG9ncy5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LWxvZ3Muc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cXGMgX3N1cGFiYXNlXG5jcmVhdGUgc2NoZW1hIGlmIG5vdCBleGlzdHMgX2FuYWx5dGljcztcbmFsdGVyIHNjaGVtYSBfYW5hbHl0aWNzIG93bmVyIHRvIDpwZ3VzZXI7XG5cXGMgcG9zdGdyZXNcbiIKICAgICAgLSAnc3VwYWJhc2UtZGItY29uZmlnOi9ldGMvcG9zdGdyZXNxbC1jdXN0b20nCiAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9sb2dmbGFyZToxLjMxLjInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIExPR0ZMQVJFX05PREVfSE9TVD0xMjcuMC4wLjEKICAgICAgLSBEQl9VU0VSTkFNRT1zdXBhYmFzZV9hZG1pbgogICAgICAtIERCX0RBVEFCQVNFPV9zdXBhYmFzZQogICAgICAtICdEQl9IT1NUTkFNRT0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBEQl9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BSSVZBVEVfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRVBSSVZBVEV9JwogICAgICAtIExPR0ZMQVJFX1NJTkdMRV9URU5BTlQ9dHJ1ZQogICAgICAtIExPR0ZMQVJFX1NVUEFCQVNFX01PREU9dHJ1ZQogICAgICAtICdQT1NUR1JFU19CQUNLRU5EX1VSTD1wb3N0Z3Jlc3FsOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gUE9TVEdSRVNfQkFDS0VORF9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtIExPR0ZMQVJFX0ZFQVRVUkVfRkxBR19PVkVSUklERT1tdWx0aWJhY2tlbmQ9dHJ1ZQogIHN1cGFiYXNlLXZlY3RvcjoKICAgIGltYWdlOiAndGltYmVyaW8vdmVjdG9yOjAuNTMuMC1hbHBpbmUnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovL3N1cGFiYXNlLXZlY3Rvcjo5MDAxL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvbG9ncy92ZWN0b3IueW1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogImFwaTpcbiAgZW5hYmxlZDogdHJ1ZVxuICBhZGRyZXNzOiAwLjAuMC4wOjkwMDFcblxuc291cmNlczpcbiAgZG9ja2VyX2hvc3Q6XG4gICAgdHlwZTogZG9ja2VyX2xvZ3NcbiAgICBleGNsdWRlX2NvbnRhaW5lcnM6XG4gICAgICAtIHN1cGFiYXNlLXZlY3RvclxuXG50cmFuc2Zvcm1zOlxuICBwcm9qZWN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIGRvY2tlcl9ob3N0XG4gICAgc291cmNlOiB8LVxuICAgICAgLnByb2plY3QgPSBcImRlZmF1bHRcIlxuICAgICAgLmV2ZW50X21lc3NhZ2UgPSBkZWwoLm1lc3NhZ2UpXG4gICAgICAuYXBwbmFtZSA9IGRlbCguY29udGFpbmVyX25hbWUpXG4gICAgICBkZWwoLmNvbnRhaW5lcl9jcmVhdGVkX2F0KVxuICAgICAgZGVsKC5jb250YWluZXJfaWQpXG4gICAgICBkZWwoLnNvdXJjZV90eXBlKVxuICAgICAgZGVsKC5zdHJlYW0pXG4gICAgICBkZWwoLmxhYmVsKVxuICAgICAgZGVsKC5pbWFnZSlcbiAgICAgIGRlbCguaG9zdClcbiAgICAgIGRlbCguc3RyZWFtKVxuICByb3V0ZXI6XG4gICAgdHlwZTogcm91dGVcbiAgICBpbnB1dHM6XG4gICAgICAtIHByb2plY3RfbG9nc1xuICAgIHJvdXRlOlxuICAgICAga29uZzogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWtvbmdcIiknXG4gICAgICBhdXRoOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtYXV0aFwiKSdcbiAgICAgIHJlc3Q6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZXN0XCIpJ1xuICAgICAgcmVhbHRpbWU6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJyZWFsdGltZS1kZXZcIiknXG4gICAgICBzdG9yYWdlOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2Utc3RvcmFnZVwiKSdcbiAgICAgIGZ1bmN0aW9uczogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zXCIpJ1xuICAgICAgZGI6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1kYlwiKSdcbiAgIyBJZ25vcmVzIG5vbiBuZ2lueCBlcnJvcnMgc2luY2UgdGhleSBhcmUgcmVsYXRlZCB3aXRoIGtvbmcgYm9vdGluZyB1cFxuICBrb25nX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5rb25nXG4gICAgc291cmNlOiB8LVxuICAgICAgcmVxLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiY29tYmluZWRcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcmVxLnRpbWVzdGFtcFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMucmVmZXJlciA9IHJlcS5yZWZlcmVyXG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy51c2VyX2FnZW50ID0gcmVxLmFnZW50XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5jZl9jb25uZWN0aW5nX2lwID0gcmVxLmNsaWVudFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IHJlcS5zdGF0dXNcbiAgICAgICAgICB1cmwsIHNwbGl0X2VyciA9IHNwbGl0KHJlcS5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBzcGxpdF9lcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIElnbm9yZXMgbm9uIG5naW54IGVycm9ycyBzaW5jZSB0aGV5IGFyZSByZWxhdGVkIHdpdGgga29uZyBib290aW5nIHVwXG4gIGtvbmdfZXJyOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIua29uZ1xuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IFwiR0VUXCJcbiAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IDIwMFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiZXJyb3JcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcGFyc2VkLnRpbWVzdGFtcFxuICAgICAgICAgIC5zZXZlcml0eSA9IHBhcnNlZC5zZXZlcml0eVxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lmhvc3QgPSBwYXJzZWQuaG9zdFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMuY2ZfY29ubmVjdGluZ19pcCA9IHBhcnNlZC5jbGllbnRcbiAgICAgICAgICB1cmwsIGVyciA9IHNwbGl0KHBhcnNlZC5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIEdvdHJ1ZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIGpzb24gc3RyaW5ncyB3aGljaCBmcm9udGVuZCBwYXJzZXMgZGlyZWN0bHkuIEJ1dCB3ZSBrZWVwIG1ldGFkYXRhIGZvciBjb25zaXN0ZW5jeS5cbiAgYXV0aF9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuYXV0aFxuICAgIHNvdXJjZTogfC1cbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEgPSBtZXJnZSEoLm1ldGFkYXRhLCBwYXJzZWQpXG4gICAgICB9XG4gICMgUG9zdGdSRVNUIGxvZ3MgYXJlIHN0cnVjdHVyZWQgc28gd2Ugc2VwYXJhdGUgdGltZXN0YW1wIGZyb20gbWVzc2FnZSB1c2luZyByZWdleFxuICByZXN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5yZXN0XG4gICAgc291cmNlOiB8LVxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcideKD9QPHRpbWU+LiopOiAoP1A8bXNnPi4qKSQnKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5ldmVudF9tZXNzYWdlID0gcGFyc2VkLm1zZ1xuICAgICAgICAgIC50aW1lc3RhbXAgPSBwYXJzZV90aW1lc3RhbXAhKHZhbHVlOiBwYXJzZWQudGltZSwgZm9ybWF0OiBcIiVkLyViLyVZOiVIOiVNOiVTICV6XCIpXG4gICAgICAgICAgLm1ldGFkYXRhLmhvc3QgPSAucHJvamVjdFxuICAgICAgfVxuICAjIEZpbHRlciBvdXQgaGVhbHRoY2hlY2sgbG9ncyBmcm9tIFJlYWx0aW1lXG4gIHJlYWx0aW1lX2xvZ3NfZmlsdGVyZWQ6XG4gICAgdHlwZTogZmlsdGVyXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIucmVhbHRpbWVcbiAgICBjb25kaXRpb246ICchY29udGFpbnMoc3RyaW5nISguZXZlbnRfbWVzc2FnZSksIFwiL2hlYWx0aFwiKSdcbiAgIyBSZWFsdGltZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIHNvIHdlIHBhcnNlIHRoZSBzZXZlcml0eSBsZXZlbCB1c2luZyByZWdleCAoaWdub3JlIHRpbWUgYmVjYXVzZSBpdCBoYXMgbm8gZGF0ZSlcbiAgcmVhbHRpbWVfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcmVhbHRpbWVfbG9nc19maWx0ZXJlZFxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLmV4dGVybmFsX2lkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfcmVnZXgoLmV2ZW50X21lc3NhZ2UsIHInXig/UDx0aW1lPlxcZCs6XFxkKzpcXGQrXFwuXFxkKykgXFxbKD9QPGxldmVsPlxcdyspXFxdICg/UDxtc2c+LiopJCcpXG4gICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgLmV2ZW50X21lc3NhZ2UgPSBwYXJzZWQubXNnXG4gICAgICAgICAgLm1ldGFkYXRhLmxldmVsID0gcGFyc2VkLmxldmVsXG4gICAgICB9XG4gICMgU3RvcmFnZSBsb2dzIG1heSBjb250YWluIGpzb24gb2JqZWN0cyBzbyB3ZSBwYXJzZSB0aGVtIGZvciBjb21wbGV0ZW5lc3NcbiAgc3RvcmFnZV9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuc3RvcmFnZVxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLnRlbmFudElkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAuZXZlbnRfbWVzc2FnZSA9IHBhcnNlZC5tc2dcbiAgICAgICAgICAubWV0YWRhdGEubGV2ZWwgPSBwYXJzZWQubGV2ZWxcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEuY29udGV4dFswXS5ob3N0ID0gcGFyc2VkLmhvc3RuYW1lXG4gICAgICAgICAgLm1ldGFkYXRhLmNvbnRleHRbMF0ucGlkID0gcGFyc2VkLnBpZFxuICAgICAgfVxuICAjIEZ1bmN0aW9uIGxvZ3MgYXJlIHVuc3RydWN0dXJlZCBtZXNzYWdlcyBvbiBzdGRlcnJcbiAgZnVuY3Rpb25zX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5mdW5jdGlvbnNcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEucHJvamVjdF9yZWYgPSBkZWwoLnByb2plY3QpXG4gICMgUG9zdGdyZXMgbG9ncyBzb21lIG1lc3NhZ2VzIHRvIHN0ZGVyciB3aGljaCB3ZSBtYXAgdG8gd2FybmluZyBzZXZlcml0eSBsZXZlbFxuICBkYl9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuZGJcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEuaG9zdCA9IFwiZGItZGVmYXVsdFwiXG4gICAgICAubWV0YWRhdGEucGFyc2VkLnRpbWVzdGFtcCA9IC50aW1lc3RhbXBcblxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcicuKig/UDxsZXZlbD5JTkZPfE5PVElDRXxXQVJOSU5HfEVSUk9SfExPR3xGQVRBTHxQQU5JQz8pOi4qJywgbnVtZXJpY19ncm91cHM6IHRydWUpXG5cbiAgICAgIGlmIGVyciAhPSBudWxsIHx8IHBhcnNlZCA9PSBudWxsIHtcbiAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwiaW5mb1wiXG4gICAgICB9XG4gICAgICBpZiBwYXJzZWQubGV2ZWwgIT0gbnVsbCB7XG4gICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IHBhcnNlZC5sZXZlbFxuICAgICAgfVxuICAgICAgaWYgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9PSBcImluZm9cIiB7XG4gICAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwibG9nXCJcbiAgICAgIH1cbiAgICAgIC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkgPSB1cGNhc2UhKC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkpXG5cbnNpbmtzOlxuICBsb2dmbGFyZV9hdXRoOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gYXV0aF9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1nb3RydWUubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9yZWFsdGltZTpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlYWx0aW1lX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXJlYWx0aW1lLmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfcmVzdDpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlc3RfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9cG9zdGdSRVNULmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfZGI6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBkYl9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1wb3N0Z3Jlcy5sb2dzJ1xuICBsb2dmbGFyZV9mdW5jdGlvbnM6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBmdW5jdGlvbnNfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9ZGVuby1yZWxheS1sb2dzJ1xuICBsb2dmbGFyZV9zdG9yYWdlOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gc3RvcmFnZV9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1zdG9yYWdlLmxvZ3MucHJvZC4yJ1xuICBsb2dmbGFyZV9rb25nOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0ga29uZ19sb2dzXG4gICAgICAtIGtvbmdfZXJyXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1jbG91ZGZsYXJlLmxvZ3MucHJvZCdcbiIKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2s6cm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jb25maWcnCiAgICAgIC0gL2V0Yy92ZWN0b3IvdmVjdG9yLnltbAogIHN1cGFiYXNlLXJlc3Q6CiAgICBpbWFnZTogJ3Bvc3RncmVzdC9wb3N0Z3Jlc3Q6djE0LjYnCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQR1JTVF9EQl9VUkk9cG9zdGdyZXM6Ly9hdXRoZW50aWNhdG9yOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSBQR1JTVF9EQl9BTk9OX1JPTEU9YW5vbgogICAgICAtICdQR1JTVF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIFBHUlNUX0RCX1VTRV9MRUdBQ1lfR1VDUz1mYWxzZQogICAgICAtICdQR1JTVF9BUFBfU0VUVElOR1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdSU1RfQVBQX1NFVFRJTkdTX0pXVF9FWFA9JHtKV1RfRVhQSVJZOi0zNjAwfScKICAgIGNvbW1hbmQ6IHBvc3RncmVzdAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgc3VwYWJhc2UtYXV0aDoKICAgIGltYWdlOiAnc3VwYWJhc2UvZ290cnVlOnYyLjE4Ni4wJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo5OTk5L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIEdPVFJVRV9BUElfSE9TVD0wLjAuMC4wCiAgICAgIC0gR09UUlVFX0FQSV9QT1JUPTk5OTkKICAgICAgLSAnQVBJX0VYVEVSTkFMX1VSTD0ke0FQSV9FWFRFUk5BTF9VUkw6LWh0dHA6Ly9zdXBhYmFzZS1rb25nOjgwMDB9JwogICAgICAtIEdPVFJVRV9EQl9EUklWRVI9cG9zdGdyZXMKICAgICAgLSAnR09UUlVFX0RCX0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovL3N1cGFiYXNlX2F1dGhfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0dPVFJVRV9TSVRFX1VSTD0ke0dPVFJVRV9TSVRFX1VSTDotJHtTRVJWSUNFX1VSTF9TVVBBQkFTRUtPTkd9fScKICAgICAgLSAnR09UUlVFX1VSSV9BTExPV19MSVNUPSR7QURESVRJT05BTF9SRURJUkVDVF9VUkxTfScKICAgICAgLSAnR09UUlVFX0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgICAgLSBHT1RSVUVfSldUX0FETUlOX1JPTEVTPXNlcnZpY2Vfcm9sZQogICAgICAtIEdPVFJVRV9KV1RfQVVEPWF1dGhlbnRpY2F0ZWQKICAgICAgLSBHT1RSVUVfSldUX0RFRkFVTFRfR1JPVVBfTkFNRT1hdXRoZW50aWNhdGVkCiAgICAgIC0gJ0dPVFJVRV9KV1RfRVhQPSR7SldUX0VYUElSWTotMzYwMH0nCiAgICAgIC0gJ0dPVFJVRV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfRU1BSUxfRU5BQkxFRD0ke0VOQUJMRV9FTUFJTF9TSUdOVVA6LXRydWV9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfQU5PTllNT1VTX1VTRVJTX0VOQUJMRUQ9JHtFTkFCTEVfQU5PTllNT1VTX1VTRVJTOi1mYWxzZX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfQVVUT0NPTkZJUk09JHtFTkFCTEVfRU1BSUxfQVVUT0NPTkZJUk06LWZhbHNlfScKICAgICAgLSAnR09UUlVFX1NNVFBfQURNSU5fRU1BSUw9JHtTTVRQX0FETUlOX0VNQUlMfScKICAgICAgLSAnR09UUlVFX1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BPUlQ9JHtTTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1VTRVI9JHtTTVRQX1VTRVJ9JwogICAgICAtICdHT1RSVUVfU01UUF9QQVNTPSR7U01UUF9QQVNTfScKICAgICAgLSAnR09UUlVFX1NNVFBfU0VOREVSX05BTUU9JHtTTVRQX1NFTkRFUl9OQU1FfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19JTlZJVEU9JHtNQUlMRVJfVVJMUEFUSFNfSU5WSVRFOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0NPTkZJUk1BVElPTj0ke01BSUxFUl9VUkxQQVRIU19DT05GSVJNQVRJT046LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk9JHtNQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk6LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1VSTFBBVEhTX0VNQUlMX0NIQU5HRTotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfSU5WSVRFPSR7TUFJTEVSX1RFTVBMQVRFU19JTlZJVEV9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19DT05GSVJNQVRJT049JHtNQUlMRVJfVEVNUExBVEVTX0NPTkZJUk1BVElPTn0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX1JFQ09WRVJZPSR7TUFJTEVSX1RFTVBMQVRFU19SRUNPVkVSWX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX01BR0lDX0xJTks9JHtNQUlMRVJfVEVNUExBVEVTX01BR0lDX0xJTkt9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19FTUFJTF9DSEFOR0U9JHtNQUlMRVJfVEVNUExBVEVTX0VNQUlMX0NIQU5HRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfQ09ORklSTUFUSU9OPSR7TUFJTEVSX1NVQkpFQ1RTX0NPTkZJUk1BVElPTn0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfUkVDT1ZFUlk9JHtNQUlMRVJfU1VCSkVDVFNfUkVDT1ZFUll9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX01BR0lDX0xJTks9JHtNQUlMRVJfU1VCSkVDVFNfTUFHSUNfTElOS30nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1NVQkpFQ1RTX0VNQUlMX0NIQU5HRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfSU5WSVRFPSR7TUFJTEVSX1NVQkpFQ1RTX0lOVklURX0nCiAgICAgIC0gJ0dPVFJVRV9FWFRFUk5BTF9QSE9ORV9FTkFCTEVEPSR7RU5BQkxFX1BIT05FX1NJR05VUDotdHJ1ZX0nCiAgICAgIC0gJ0dPVFJVRV9TTVNfQVVUT0NPTkZJUk09JHtFTkFCTEVfUEhPTkVfQVVUT0NPTkZJUk06LXRydWV9JwogIHJlYWx0aW1lLWRldjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcmVhbHRpbWU6djIuNzYuNScKICAgIGNvbnRhaW5lcl9uYW1lOiByZWFsdGltZS1kZXYuc3VwYWJhc2UtcmVhbHRpbWUKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctc1NmTCcKICAgICAgICAtICctLWhlYWQnCiAgICAgICAgLSAnLW8nCiAgICAgICAgLSAvZGV2L251bGwKICAgICAgICAtICctSCcKICAgICAgICAtICdBdXRob3JpemF0aW9uOiBCZWFyZXIgJHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9hcGkvdGVuYW50cy9yZWFsdGltZS1kZXYvaGVhbHRoJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9SVD00MDAwCiAgICAgIC0gJ0RCX0hPU1Q9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdEQl9QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gREJfVVNFUj1zdXBhYmFzZV9hZG1pbgogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQl9OQU1FPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnREJfQUZURVJfQ09OTkVDVF9RVUVSWT1TRVQgc2VhcmNoX3BhdGggVE8gX3JlYWx0aW1lJwogICAgICAtIERCX0VOQ19LRVk9c3VwYWJhc2VyZWFsdGltZQogICAgICAtICdBUElfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnU0VDUkVUX0tFWV9CQVNFPSR7U0VSVklDRV9QQVNTV09SRF82NF9SRUFMVElNRX0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAiRE5TX05PREVTPScnIgogICAgICAtIFJMSU1JVF9OT0ZJTEU9MTAwMDAKICAgICAgLSBBUFBfTkFNRT1yZWFsdGltZQogICAgICAtIFNFRURfU0VMRl9IT1NUPXRydWUKICAgICAgLSBMT0dfTEVWRUw9ZXJyb3IKICAgICAgLSBSVU5fSkFOSVRPUj10cnVlCiAgICAgIC0gSkFOSVRPUl9JTlRFUlZBTD02MDAwMAogICAgICAtIERJU0FCTEVfSEVBTFRIQ0hFQ0tfTE9HR0lORz10cnVlCiAgICBjb21tYW5kOiAic2ggLWMgXCIvYXBwL2Jpbi9taWdyYXRlICYmIC9hcHAvYmluL3JlYWx0aW1lIGV2YWwgJ1JlYWx0aW1lLlJlbGVhc2Uuc2VlZHMoUmVhbHRpbWUuUmVwbyknICYmIC9hcHAvYmluL3NlcnZlclwiXG4iCiAgc3VwYWJhc2UtbWluaW86CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBjb21tYW5kOiAnc2VydmVyIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSIgL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovZGF0YScKICBtaW5pby1jcmVhdGVidWNrZXQ6CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIHJlc3RhcnQ6ICdubycKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1taW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDoKICAgICAgLSAvZW50cnlwb2ludC5zaAogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2VudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL3NoXG4vdXNyL2Jpbi9tYyBhbGlhcyBzZXQgc3VwYWJhc2UtbWluaW8gaHR0cDovL3N1cGFiYXNlLW1pbmlvOjkwMDAgJHtNSU5JT19ST09UX1VTRVJ9ICR7TUlOSU9fUk9PVF9QQVNTV09SRH07XG4vdXNyL2Jpbi9tYyBtYiAtLWlnbm9yZS1leGlzdGluZyBzdXBhYmFzZS1taW5pby9zdHViO1xuZXhpdCAwXG4iCiAgc3VwYWJhc2Utc3RvcmFnZToKICAgIGltYWdlOiAnc3VwYWJhc2Uvc3RvcmFnZS1hcGk6djEuNDQuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLXJlc3Q6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgICAgaW1ncHJveHk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjUwMDAvc3RhdHVzJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVkVSX1BPUlQ9NTAwMAogICAgICAtIFNFUlZFUl9SRUdJT049bG9jYWwKICAgICAgLSBNVUxUSV9URU5BTlQ9ZmFsc2UKICAgICAgLSAnQVVUSF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly9zdXBhYmFzZV9zdG9yYWdlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtIERCX0lOU1RBTExfUk9MRVM9ZmFsc2UKICAgICAgLSBTVE9SQUdFX0JBQ0tFTkQ9czMKICAgICAgLSBTVE9SQUdFX1MzX0JVQ0tFVD1zdHViCiAgICAgIC0gJ1NUT1JBR0VfUzNfRU5EUE9JTlQ9aHR0cDovL3N1cGFiYXNlLW1pbmlvOjkwMDAnCiAgICAgIC0gU1RPUkFHRV9TM19GT1JDRV9QQVRIX1NUWUxFPXRydWUKICAgICAgLSBTVE9SQUdFX1MzX1JFR0lPTj11cy1lYXN0LTEKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSBVUExPQURfRklMRV9TSVpFX0xJTUlUPTUyNDI4ODAwMAogICAgICAtIFVQTE9BRF9GSUxFX1NJWkVfTElNSVRfU1RBTkRBUkQ9NTI0Mjg4MDAwCiAgICAgIC0gVVBMT0FEX1NJR05FRF9VUkxfRVhQSVJBVElPTl9USU1FPTEyMAogICAgICAtIFRVU19VUkxfUEFUSD0vdXBsb2FkL3Jlc3VtYWJsZQogICAgICAtIFRVU19NQVhfU0laRT0zNjAwMDAwCiAgICAgIC0gRU5BQkxFX0lNQUdFX1RSQU5TRk9STUFUSU9OPXRydWUKICAgICAgLSAnSU1HUFJPWFlfVVJMPWh0dHA6Ly9pbWdwcm94eTo4MDgwJwogICAgICAtIElNR1BST1hZX1JFUVVFU1RfVElNRU9VVD0xNQogICAgICAtIERBVEFCQVNFX1NFQVJDSF9QQVRIPXN0b3JhZ2UKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gUkVRVUVTVF9BTExPV19YX0ZPUldBUkRFRF9QQVRIPXRydWUKICAgICAgLSAnQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1BPU1RHUkVTVF9VUkw9aHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMCcKICAgICAgLSAnUEdSU1RfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnU1RPUkFHRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9VUkxfU1VQQUJBU0VLT05HfScKICAgICAgLSAnVEVOQU5UX0lEPSR7U1RPUkFHRV9URU5BTlRfSUQ6LXN0b3JhZ2Utc2luZ2xlLXRlbmFudH0nCiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovdmFyL2xpYi9zdG9yYWdlJwogIGltZ3Byb3h5OgogICAgaW1hZ2U6ICdkYXJ0aHNpbS9pbWdwcm94eTp2My4zMC4xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGltZ3Byb3h5CiAgICAgICAgLSBoZWFsdGgKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtICdJTUdQUk9YWV9CSU5EPTo4MDgwJwogICAgICAtIElNR1BST1hZX0xPQ0FMX0ZJTEVTWVNURU1fUk9PVD0vCiAgICAgIC0gSU1HUFJPWFlfVVNFX0VUQUc9dHJ1ZQogICAgICAtICdJTUdQUk9YWV9BVVRPX1dFQlA9JHtJTUdQUk9YWV9BVVRPX1dFQlA6LXRydWV9JwogICAgICAtIElNR1BST1hZX01BWF9TUkNfUkVTT0xVVElPTj0xNi44CiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovdmFyL2xpYi9zdG9yYWdlJwogIHN1cGFiYXNlLW1ldGE6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3Bvc3RncmVzLW1ldGE6djAuOTUuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUEdfTUVUQV9QT1JUPTgwODAKICAgICAgLSAnUEdfTUVUQV9EQl9IT1NUPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUEdfTUVUQV9EQl9QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHX01FVEFfREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gUEdfTUVUQV9EQl9VU0VSPXN1cGFiYXNlX2FkbWluCiAgICAgIC0gJ1BHX01FVEFfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnQ1JZUFRPX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfUEdNRVRBQ1JZUFRPfScKICBzdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczoKICAgIGltYWdlOiAnc3VwYWJhc2UvZWRnZS1ydW50aW1lOnYxLjcxLjInCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnRWRnZSBGdW5jdGlvbnMgaXMgaGVhbHRoeScKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtICdKV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdTVVBBQkFTRV9VUkw9aHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMCcKICAgICAgLSAnU1VQQUJBU0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9ST0xFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX0RCX1VSTD1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXM6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1ZFUklGWV9KV1Q9JHtGVU5DVElPTlNfVkVSSUZZX0pXVDotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL2Z1bmN0aW9uczovaG9tZS9kZW5vL2Z1bmN0aW9ucycKICAgICAgLSAnZGVuby1jYWNoZTovcm9vdC8uY2FjaGUvZGVubycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICJpbXBvcnQgKiBhcyBqb3NlIGZyb20gJ2h0dHBzOi8vZGVuby5sYW5kL3gvam9zZUB2NC4xNC40L2luZGV4LnRzJ1xuXG5jb25zb2xlLmxvZygnbWFpbiBmdW5jdGlvbiBzdGFydGVkJylcblxuY29uc3QgSldUX1NFQ1JFVCA9IERlbm8uZW52LmdldCgnSldUX1NFQ1JFVCcpXG5jb25zdCBTVVBBQkFTRV9VUkwgPSBEZW5vLmVudi5nZXQoJ1NVUEFCQVNFX1VSTCcpXG5jb25zdCBWRVJJRllfSldUID0gRGVuby5lbnYuZ2V0KCdWRVJJRllfSldUJykgPT09ICd0cnVlJ1xuXG4vLyBDcmVhdGUgSldLUyBmb3IgRVMyNTYvUlMyNTYgdG9rZW5zIChuZXdlciB0b2tlbnMpXG5sZXQgU1VQQUJBU0VfSldUX0tFWVM6IFJldHVyblR5cGU8dHlwZW9mIGpvc2UuY3JlYXRlUmVtb3RlSldLU2V0PiB8IG51bGwgPSBudWxsXG5pZiAoU1VQQUJBU0VfVVJMKSB7XG4gIHRyeSB7XG4gICAgU1VQQUJBU0VfSldUX0tFWVMgPSBqb3NlLmNyZWF0ZVJlbW90ZUpXS1NldChcbiAgICAgIG5ldyBVUkwoJy9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvbicsIFNVUEFCQVNFX1VSTClcbiAgICApXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdGYWlsZWQgdG8gZmV0Y2ggSldLUyBmcm9tIFNVUEFCQVNFX1VSTDonLCBlKVxuICB9XG59XG5cbmZ1bmN0aW9uIGdldEF1dGhUb2tlbihyZXE6IFJlcXVlc3QpIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmdldCgnYXV0aG9yaXphdGlvbicpXG4gIGlmICghYXV0aEhlYWRlcikge1xuICAgIHRocm93IG5ldyBFcnJvcignTWlzc2luZyBhdXRob3JpemF0aW9uIGhlYWRlcicpXG4gIH1cbiAgY29uc3QgW2JlYXJlciwgdG9rZW5dID0gYXV0aEhlYWRlci5zcGxpdCgnICcpXG4gIGlmIChiZWFyZXIgIT09ICdCZWFyZXInKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBBdXRoIGhlYWRlciBpcyBub3QgJ0JlYXJlciB7dG9rZW59J2ApXG4gIH1cbiAgcmV0dXJuIHRva2VuXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGlzVmFsaWRMZWdhY3lKV1Qoand0OiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFKV1RfU0VDUkVUKSB7XG4gICAgY29uc29sZS5lcnJvcignSldUX1NFQ1JFVCBub3QgYXZhaWxhYmxlIGZvciBIUzI1NiB0b2tlbiB2ZXJpZmljYXRpb24nKVxuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgY29uc3QgZW5jb2RlciA9IG5ldyBUZXh0RW5jb2RlcigpO1xuICBjb25zdCBzZWNyZXRLZXkgPSBlbmNvZGVyLmVuY29kZShKV1RfU0VDUkVUKVxuXG4gIHRyeSB7XG4gICAgYXdhaXQgam9zZS5qd3RWZXJpZnkoand0LCBzZWNyZXRLZXkpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcignU3ltbWV0cmljIExlZ2FjeSBKV1QgdmVyaWZpY2F0aW9uIGVycm9yJywgZSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGlmICghU1VQQUJBU0VfSldUX0tFWVMpIHtcbiAgICBjb25zb2xlLmVycm9yKCdKV0tTIG5vdCBhdmFpbGFibGUgZm9yIEVTMjU2L1JTMjU2IHRva2VuIHZlcmlmaWNhdGlvbicpXG4gICAgcmV0dXJuIGZhbHNlXG4gIH1cblxuICB0cnkge1xuICAgIGF3YWl0IGpvc2Uuand0VmVyaWZ5KGp3dCwgU1VQQUJBU0VfSldUX0tFWVMpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdBc3ltbWV0cmljIEpXVCB2ZXJpZmljYXRpb24gZXJyb3InLCBlKTtcbiAgICByZXR1cm4gZmFsc2VcbiAgfVxuXG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSHlicmlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHsgYWxnOiBqd3RBbGdvcml0aG0gfSA9IGpvc2UuZGVjb2RlUHJvdGVjdGVkSGVhZGVyKGp3dClcblxuICBpZiAoand0QWxnb3JpdGhtID09PSAnSFMyNTYnKSB7XG4gICAgY29uc29sZS5sb2coYExlZ2FjeSB0b2tlbiB0eXBlIGRldGVjdGVkLCBhdHRlbXB0aW5nICR7and0QWxnb3JpdGhtfSB2ZXJpZmljYXRpb24uYClcblxuICAgIHJldHVybiBhd2FpdCBpc1ZhbGlkTGVnYWN5SldUKGp3dClcbiAgfVxuXG4gIGlmIChqd3RBbGdvcml0aG0gPT09ICdFUzI1NicgfHwgand0QWxnb3JpdGhtID09PSAnUlMyNTYnKSB7XG4gICAgcmV0dXJuIGF3YWl0IGlzVmFsaWRKV1Qoand0KVxuICB9XG5cbiAgcmV0dXJuIGZhbHNlO1xufVxuXG5EZW5vLnNlcnZlKGFzeW5jIChyZXE6IFJlcXVlc3QpID0+IHtcbiAgaWYgKHJlcS5tZXRob2QgIT09ICdPUFRJT05TJyAmJiBWRVJJRllfSldUKSB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRva2VuID0gZ2V0QXV0aFRva2VuKHJlcSlcbiAgICAgIGNvbnN0IGlzVmFsaWRKV1QgPSBhd2FpdCBpc1ZhbGlkSHlicmlkSldUKHRva2VuKTtcblxuICAgICAgaWYgKCFpc1ZhbGlkSldUKSB7XG4gICAgICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoeyBtc2c6ICdJbnZhbGlkIEpXVCcgfSksIHtcbiAgICAgICAgICBzdGF0dXM6IDQwMSxcbiAgICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICBjb25zb2xlLmVycm9yKGUpXG4gICAgICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KHsgbXNnOiBlLnRvU3RyaW5nKCkgfSksIHtcbiAgICAgICAgc3RhdHVzOiA0MDEsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgfSlcbiAgICB9XG4gIH1cblxuICBjb25zdCB1cmwgPSBuZXcgVVJMKHJlcS51cmwpXG4gIGNvbnN0IHsgcGF0aG5hbWUgfSA9IHVybFxuICBjb25zdCBwYXRoX3BhcnRzID0gcGF0aG5hbWUuc3BsaXQoJy8nKVxuICBjb25zdCBzZXJ2aWNlX25hbWUgPSBwYXRoX3BhcnRzWzFdXG5cbiAgaWYgKCFzZXJ2aWNlX25hbWUgfHwgc2VydmljZV9uYW1lID09PSAnJykge1xuICAgIGNvbnN0IGVycm9yID0geyBtc2c6ICdtaXNzaW5nIGZ1bmN0aW9uIG5hbWUgaW4gcmVxdWVzdCcgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDQwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cblxuICBjb25zdCBzZXJ2aWNlUGF0aCA9IGAvaG9tZS9kZW5vL2Z1bmN0aW9ucy8ke3NlcnZpY2VfbmFtZX1gXG4gIGNvbnNvbGUuZXJyb3IoYHNlcnZpbmcgdGhlIHJlcXVlc3Qgd2l0aCAke3NlcnZpY2VQYXRofWApXG5cbiAgY29uc3QgbWVtb3J5TGltaXRNYiA9IDE1MFxuICBjb25zdCB3b3JrZXJUaW1lb3V0TXMgPSAxICogNjAgKiAxMDAwXG4gIGNvbnN0IG5vTW9kdWxlQ2FjaGUgPSBmYWxzZVxuICBjb25zdCBpbXBvcnRNYXBQYXRoID0gbnVsbFxuICBjb25zdCBlbnZWYXJzT2JqID0gRGVuby5lbnYudG9PYmplY3QoKVxuICBjb25zdCBlbnZWYXJzID0gT2JqZWN0LmtleXMoZW52VmFyc09iaikubWFwKChrKSA9PiBbaywgZW52VmFyc09ialtrXV0pXG5cbiAgdHJ5IHtcbiAgICBjb25zdCB3b3JrZXIgPSBhd2FpdCBFZGdlUnVudGltZS51c2VyV29ya2Vycy5jcmVhdGUoe1xuICAgICAgc2VydmljZVBhdGgsXG4gICAgICBtZW1vcnlMaW1pdE1iLFxuICAgICAgd29ya2VyVGltZW91dE1zLFxuICAgICAgbm9Nb2R1bGVDYWNoZSxcbiAgICAgIGltcG9ydE1hcFBhdGgsXG4gICAgICBlbnZWYXJzLFxuICAgIH0pXG4gICAgcmV0dXJuIGF3YWl0IHdvcmtlci5mZXRjaChyZXEpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zdCBlcnJvciA9IHsgbXNnOiBlLnRvU3RyaW5nKCkgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDUwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cbn0pXG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZnVuY3Rpb25zL2hlbGxvL2luZGV4LnRzCiAgICAgICAgdGFyZ2V0OiAvaG9tZS9kZW5vL2Z1bmN0aW9ucy9oZWxsby9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICIvLyBGb2xsb3cgdGhpcyBzZXR1cCBndWlkZSB0byBpbnRlZ3JhdGUgdGhlIERlbm8gbGFuZ3VhZ2Ugc2VydmVyIHdpdGggeW91ciBlZGl0b3I6XG4vLyBodHRwczovL2Rlbm8ubGFuZC9tYW51YWwvZ2V0dGluZ19zdGFydGVkL3NldHVwX3lvdXJfZW52aXJvbm1lbnRcbi8vIFRoaXMgZW5hYmxlcyBhdXRvY29tcGxldGUsIGdvIHRvIGRlZmluaXRpb24sIGV0Yy5cblxuRGVuby5zZXJ2ZShhc3luYyAoKSA9PiB7XG4gIHJldHVybiBuZXcgUmVzcG9uc2UoXG4gICAgYFwiSGVsbG8gZnJvbSBFZGdlIEZ1bmN0aW9ucyFcImAsXG4gICAgeyBoZWFkZXJzOiB7IFwiQ29udGVudC1UeXBlXCI6IFwiYXBwbGljYXRpb24vanNvblwiIH0gfSxcbiAgKVxufSlcblxuLy8gVG8gaW52b2tlOlxuLy8gY3VybCAnaHR0cDovL2xvY2FsaG9zdDo8S09OR19IVFRQX1BPUlQ+L2Z1bmN0aW9ucy92MS9oZWxsbycgXFxcbi8vICAgLS1oZWFkZXIgJ0F1dGhvcml6YXRpb246IEJlYXJlciA8YW5vbi9zZXJ2aWNlX3JvbGUgQVBJIGtleT4nXG4iCiAgICBjb21tYW5kOgogICAgICAtIHN0YXJ0CiAgICAgIC0gJy0tbWFpbi1zZXJ2aWNlJwogICAgICAtIC9ob21lL2Rlbm8vZnVuY3Rpb25zL21haW4KICBzdXBhYmFzZS1zdXBhdmlzb3I6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N1cGF2aXNvcjoyLjcuNCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLXNTZkwnCiAgICAgICAgLSAnLW8nCiAgICAgICAgLSAvZGV2L251bGwKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjQwMDAvYXBpL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDEwCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT09MRVJfVEVOQU5UX0lEPSR7UE9PTEVSX1RFTkFOVF9JRDotZGV2X3RlbmFudH0nCiAgICAgIC0gUE9PTEVSX1BPT0xfTU9ERT10cmFuc2FjdGlvbgogICAgICAtICdQT09MRVJfREVGQVVMVF9QT09MX1NJWkU9JHtQT09MRVJfREVGQVVMVF9QT09MX1NJWkU6LTIwfScKICAgICAgLSAnUE9PTEVSX01BWF9DTElFTlRfQ09OTj0ke1BPT0xFUl9NQVhfQ0xJRU5UX0NPTk46LTEwMH0nCiAgICAgIC0gUE9SVD00MDAwCiAgICAgIC0gJ1BPU1RHUkVTX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUE9TVEdSRVNfSE9TVE5BTUU9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1lY3RvOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gQ0xVU1RFUl9QT1NUR1JFUz10cnVlCiAgICAgIC0gJ1NFQ1JFVF9LRVlfQkFTRT0ke1NFUlZJQ0VfUEFTU1dPUkRfU1VQQVZJU09SU0VDUkVUfScKICAgICAgLSAnVkFVTFRfRU5DX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfVkFVTFRFTkN9JwogICAgICAtICdBUElfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnTUVUUklDU19KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIFJFR0lPTj1sb2NhbAogICAgICAtICdFUkxfQUZMQUdTPS1wcm90b19kaXN0IGluZXRfdGNwJwogICAgICAtICdEQl9QT09MX1NJWkU9JHtQT09MRVJfREJfUE9PTF9TSVpFOi01fScKICAgICAgLSBHTE9CQUxfRE9XTlNUUkVBTV9DRVJUX1BBVEg9L2V0Yy9zc2wvc2VydmVyLmNydAogICAgICAtIEdMT0JBTF9ET1dOU1RSRUFNX0tFWV9QQVRIPS9ldGMvc3NsL3NlcnZlci5rZXkKICAgIGNvbW1hbmQ6CiAgICAgIC0gL2Jpbi9zaAogICAgICAtICctYycKICAgICAgLSAiaWYgWyAhIC1mIC9ldGMvc3NsL3NlcnZlci5jcnQgXTsgdGhlblxuICBvcGVuc3NsIHJlcSAteDUwOSAtbm9kZXMgLWRheXMgMzY1MCAtbmV3a2V5IHJzYToyMDQ4IFxcXG4gICAgLWtleW91dCAvZXRjL3NzbC9zZXJ2ZXIua2V5IC1vdXQgL2V0Yy9zc2wvc2VydmVyLmNydCBcXFxuICAgIC1zdWJqIFwiL0NOPXN1cGFiYXNlLXBvb2xlclwiXG5maVxuL2FwcC9iaW4vbWlncmF0ZSAmJiAvYXBwL2Jpbi9zdXBhdmlzb3IgZXZhbCBcIiQkKGNhdCAvZXRjL3Bvb2xlci9wb29sZXIuZXhzKVwiICYmIC9hcHAvYmluL3NlcnZlclxuIgogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9wb29sZXIvcG9vbGVyLmV4cwogICAgICAgIHRhcmdldDogL2V0Yy9wb29sZXIvcG9vbGVyLmV4cwogICAgICAgIGNvbnRlbnQ6ICJ7Om9rLCBffSA9IEFwcGxpY2F0aW9uLmVuc3VyZV9hbGxfc3RhcnRlZCg6c3VwYXZpc29yKVxuezpvaywgdmVyc2lvbn0gPVxuICAgIGNhc2UgU3VwYXZpc29yLlJlcG8ucXVlcnkhKFwic2VsZWN0IHZlcnNpb24oKVwiKSBkb1xuICAgICV7cm93czogW1t2ZXJdXX0gLT4gU3VwYXZpc29yLkhlbHBlcnMucGFyc2VfcGdfdmVyc2lvbih2ZXIpXG4gICAgXyAtPiBuaWxcbiAgICBlbmRcbnBhcmFtcyA9ICV7XG4gICAgXCJleHRlcm5hbF9pZFwiID0+IFN5c3RlbS5nZXRfZW52KFwiUE9PTEVSX1RFTkFOVF9JRFwiKSxcbiAgICBcImRiX2hvc3RcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX0hPU1ROQU1FXCIpLFxuICAgIFwiZGJfcG9ydFwiID0+IFN5c3RlbS5nZXRfZW52KFwiUE9TVEdSRVNfUE9SVFwiKSB8PiBTdHJpbmcudG9faW50ZWdlcigpLFxuICAgIFwiZGJfZGF0YWJhc2VcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX0RCXCIpLFxuICAgIFwicmVxdWlyZV91c2VyXCIgPT4gZmFsc2UsXG4gICAgXCJhdXRoX3F1ZXJ5XCIgPT4gXCJTRUxFQ1QgKiBGUk9NIHBnYm91bmNlci5nZXRfYXV0aCgkMSlcIixcbiAgICBcImRlZmF1bHRfbWF4X2NsaWVudHNcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9NQVhfQ0xJRU5UX0NPTk5cIiksXG4gICAgXCJkZWZhdWx0X3Bvb2xfc2l6ZVwiID0+IFN5c3RlbS5nZXRfZW52KFwiUE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFXCIpLFxuICAgIFwiZGVmYXVsdF9wYXJhbWV0ZXJfc3RhdHVzXCIgPT4gJXtcInNlcnZlcl92ZXJzaW9uXCIgPT4gdmVyc2lvbn0sXG4gICAgXCJ1c2Vyc1wiID0+IFsle1xuICAgIFwiZGJfdXNlclwiID0+IFwicGdib3VuY2VyXCIsXG4gICAgXCJkYl9wYXNzd29yZFwiID0+IFN5c3RlbS5nZXRfZW52KFwiUE9TVEdSRVNfUEFTU1dPUkRcIiksXG4gICAgXCJtb2RlX3R5cGVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9QT09MX01PREVcIiksXG4gICAgXCJwb29sX3NpemVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9ERUZBVUxUX1BPT0xfU0laRVwiKSxcbiAgICBcImlzX21hbmFnZXJcIiA9PiB0cnVlXG4gICAgfV1cbn1cblxudGVuYW50ID0gU3VwYXZpc29yLlRlbmFudHMuZ2V0X3RlbmFudF9ieV9leHRlcm5hbF9pZChwYXJhbXNbXCJleHRlcm5hbF9pZFwiXSlcblxuaWYgdGVuYW50IGRvXG4gIHs6b2ssIF99ID0gU3VwYXZpc29yLlRlbmFudHMudXBkYXRlX3RlbmFudCh0ZW5hbnQsIHBhcmFtcylcbmVsc2VcbiAgezpvaywgX30gPSBTdXBhdmlzb3IuVGVuYW50cy5jcmVhdGVfdGVuYW50KHBhcmFtcylcbmVuZFxuIgo=",
         "tags": [
             "firebase",
             "alternative",
@@ -5386,13 +4557,13 @@
         "category": "backend",
         "logo": "svgs/supabase.svg",
         "minversion": "4.0.0-beta.228",
-        "template_last_updated_at": "2026-10-15T23:15:19+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8000"
     },
     "superset-with-postgresql": {
         "documentation": "https://github.com/amancevice/docker-superset?utm_source=coolify.io",
         "slogan": "Modern data exploration and visualization platform (unofficial community docker image)",
-        "compose": "c2VydmljZXM6CiAgc3VwZXJzZXQ6CiAgICBpbWFnZTogJ2FtYW5jZXZpY2Uvc3VwZXJzZXQ6Ni4wLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TVVBFUlNFVF84MDg4CiAgICAgIC0gJ1NFQ1JFVF9LRVk9JHtTRVJWSUNFX0JBU0U2NF82NF9TVVBFUlNFVFNFQ1JFVEtFWX0nCiAgICAgIC0gJ01BUEJPWF9BUElfS0VZPSR7TUFQQk9YX0FQSV9LRVl9JwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotc3VwZXJzZXQtZGJ9JwogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vc3VwZXJzZXQvc3VwZXJzZXRfY29uZmlnLnB5CiAgICAgICAgdGFyZ2V0OiAvZXRjL3N1cGVyc2V0L3N1cGVyc2V0X2NvbmZpZy5weQogICAgICAgIGNvbnRlbnQ6ICJcIlwiXCJcbkZvciBtb3JlIGNvbmZpZ3VyYXRpb24gb3B0aW9ucywgc2VlOlxuLSBodHRwczovL3N1cGVyc2V0LmFwYWNoZS5vcmcvZG9jcy9jb25maWd1cmF0aW9uL2NvbmZpZ3VyaW5nLXN1cGVyc2V0XG5cIlwiXCJcblxuaW1wb3J0IG9zXG5cblNFQ1JFVF9LRVkgPSBvcy5nZXRlbnYoXCJTRUNSRVRfS0VZXCIpXG5NQVBCT1hfQVBJX0tFWSA9IG9zLmdldGVudihcIk1BUEJPWF9BUElfS0VZXCIsIFwiXCIpXG5cbkNBQ0hFX0NPTkZJRyA9IHtcbiAgXCJDQUNIRV9UWVBFXCI6IFwiUmVkaXNDYWNoZVwiLFxuICBcIkNBQ0hFX0RFRkFVTFRfVElNRU9VVFwiOiAzMDAsXG4gIFwiQ0FDSEVfS0VZX1BSRUZJWFwiOiBcInN1cGVyc2V0X1wiLFxuICBcIkNBQ0hFX1JFRElTX0hPU1RcIjogXCJyZWRpc1wiLFxuICBcIkNBQ0hFX1JFRElTX1BPUlRcIjogNjM3OSxcbiAgXCJDQUNIRV9SRURJU19EQlwiOiAxLFxuICBcIkNBQ0hFX1JFRElTX1VSTFwiOiBmXCJyZWRpczovLzp7b3MuZ2V0ZW52KCdSRURJU19QQVNTV09SRCcpfUByZWRpczo2Mzc5LzFcIixcbn1cblxuRklMVEVSX1NUQVRFX0NBQ0hFX0NPTkZJRyA9IHsqKkNBQ0hFX0NPTkZJRywgXCJDQUNIRV9LRVlfUFJFRklYXCI6IFwic3VwZXJzZXRfZmlsdGVyX1wifVxuRVhQTE9SRV9GT1JNX0RBVEFfQ0FDSEVfQ09ORklHID0geyoqQ0FDSEVfQ09ORklHLCBcIkNBQ0hFX0tFWV9QUkVGSVhcIjogXCJzdXBlcnNldF9leHBsb3JlX2Zvcm1fXCJ9XG5cblNRTEFMQ0hFTVlfVFJBQ0tfTU9ESUZJQ0FUSU9OUyA9IFRydWVcblNRTEFMQ0hFTVlfREFUQUJBU0VfVVJJID0gZlwicG9zdGdyZXNxbCtwc3ljb3BnMjovL3tvcy5nZXRlbnYoJ1BPU1RHUkVTX1VTRVInKX06e29zLmdldGVudignUE9TVEdSRVNfUEFTU1dPUkQnKX1AcG9zdGdyZXM6NTQzMi97b3MuZ2V0ZW52KCdQT1NUR1JFU19EQicpfVwiXG5cbiMgVW5jb21tZW50IGlmIHlvdSB3YW50IHRvIGxvYWQgZXhhbXBsZSBkYXRhICh1c2luZyBcInN1cGVyc2V0IGxvYWRfZXhhbXBsZXNcIikgYXQgdGhlXG4jIHNhbWUgbG9jYXRpb24gYXMgeW91ciBtZXRhZGF0YSBwb3N0Z3Jlc3FsIGluc3RhbmNlLiBPdGhlcndpc2UsIHRoZSBkZWZhdWx0IHNxbGl0ZVxuIyB3aWxsIGJlIHVzZWQsIHdoaWNoIHdpbGwgbm90IHBlcnNpc3QgaW4gdm9sdW1lIHdoZW4gcmVzdGFydGluZyBzdXBlcnNldCBieSBkZWZhdWx0LlxuI1NRTEFMQ0hFTVlfRVhBTVBMRVNfVVJJID0gU1FMQUxDSEVNWV9EQVRBQkFTRV9VUkkiCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwODgvaGVhbHRoJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE4JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1zdXBlcnNldC1kYn0nCiAgICB2b2x1bWVzOgogICAgICAtICdzdXBlcnNldF9wb3N0Z3Jlc19kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdzdXBlcnNldF9yZWRpc19kYXRhOi9kYXRhJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLXJlcXVpcmVwYXNzICR7U0VSVklDRV9QQVNTV09SRF9SRURJU30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ3JlZGlzLWNsaSBwaW5nJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
+        "compose": "c2VydmljZXM6CiAgc3VwZXJzZXQ6CiAgICBpbWFnZTogJ2FtYW5jZXZpY2Uvc3VwZXJzZXQ6Ni4wLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TVVBFUlNFVF84MDg4CiAgICAgIC0gJ1NFQ1JFVF9LRVk9JHtTRVJWSUNFX0JBU0U2NF82NF9TVVBFUlNFVFNFQ1JFVEtFWX0nCiAgICAgIC0gJ01BUEJPWF9BUElfS0VZPSR7TUFQQk9YX0FQSV9LRVl9JwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotc3VwZXJzZXQtZGJ9JwogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vc3VwZXJzZXQvc3VwZXJzZXRfY29uZmlnLnB5CiAgICAgICAgdGFyZ2V0OiAvZXRjL3N1cGVyc2V0L3N1cGVyc2V0X2NvbmZpZy5weQogICAgICAgIGNvbnRlbnQ6ICJcIlwiXCJcbkZvciBtb3JlIGNvbmZpZ3VyYXRpb24gb3B0aW9ucywgc2VlOlxuLSBodHRwczovL3N1cGVyc2V0LmFwYWNoZS5vcmcvZG9jcy9jb25maWd1cmF0aW9uL2NvbmZpZ3VyaW5nLXN1cGVyc2V0XG5cIlwiXCJcblxuaW1wb3J0IG9zXG5cblNFQ1JFVF9LRVkgPSBvcy5nZXRlbnYoXCJTRUNSRVRfS0VZXCIpXG5NQVBCT1hfQVBJX0tFWSA9IG9zLmdldGVudihcIk1BUEJPWF9BUElfS0VZXCIsIFwiXCIpXG5cbkNBQ0hFX0NPTkZJRyA9IHtcbiAgXCJDQUNIRV9UWVBFXCI6IFwiUmVkaXNDYWNoZVwiLFxuICBcIkNBQ0hFX0RFRkFVTFRfVElNRU9VVFwiOiAzMDAsXG4gIFwiQ0FDSEVfS0VZX1BSRUZJWFwiOiBcInN1cGVyc2V0X1wiLFxuICBcIkNBQ0hFX1JFRElTX0hPU1RcIjogXCJyZWRpc1wiLFxuICBcIkNBQ0hFX1JFRElTX1BPUlRcIjogNjM3OSxcbiAgXCJDQUNIRV9SRURJU19EQlwiOiAxLFxuICBcIkNBQ0hFX1JFRElTX1VSTFwiOiBmXCJyZWRpczovLzp7b3MuZ2V0ZW52KCdSRURJU19QQVNTV09SRCcpfUByZWRpczo2Mzc5LzFcIixcbn1cblxuRklMVEVSX1NUQVRFX0NBQ0hFX0NPTkZJRyA9IHsqKkNBQ0hFX0NPTkZJRywgXCJDQUNIRV9LRVlfUFJFRklYXCI6IFwic3VwZXJzZXRfZmlsdGVyX1wifVxuRVhQTE9SRV9GT1JNX0RBVEFfQ0FDSEVfQ09ORklHID0geyoqQ0FDSEVfQ09ORklHLCBcIkNBQ0hFX0tFWV9QUkVGSVhcIjogXCJzdXBlcnNldF9leHBsb3JlX2Zvcm1fXCJ9XG5cblNRTEFMQ0hFTVlfVFJBQ0tfTU9ESUZJQ0FUSU9OUyA9IFRydWVcblNRTEFMQ0hFTVlfREFUQUJBU0VfVVJJID0gZlwicG9zdGdyZXNxbCtwc3ljb3BnMjovL3tvcy5nZXRlbnYoJ1BPU1RHUkVTX1VTRVInKX06e29zLmdldGVudignUE9TVEdSRVNfUEFTU1dPUkQnKX1AcG9zdGdyZXM6NTQzMi97b3MuZ2V0ZW52KCdQT1NUR1JFU19EQicpfVwiXG5cbiMgVW5jb21tZW50IGlmIHlvdSB3YW50IHRvIGxvYWQgZXhhbXBsZSBkYXRhICh1c2luZyBcInN1cGVyc2V0IGxvYWRfZXhhbXBsZXNcIikgYXQgdGhlXG4jIHNhbWUgbG9jYXRpb24gYXMgeW91ciBtZXRhZGF0YSBwb3N0Z3Jlc3FsIGluc3RhbmNlLiBPdGhlcndpc2UsIHRoZSBkZWZhdWx0IHNxbGl0ZVxuIyB3aWxsIGJlIHVzZWQsIHdoaWNoIHdpbGwgbm90IHBlcnNpc3QgaW4gdm9sdW1lIHdoZW4gcmVzdGFydGluZyBzdXBlcnNldCBieSBkZWZhdWx0LlxuI1NRTEFMQ0hFTVlfRVhBTVBMRVNfVVJJID0gU1FMQUxDSEVNWV9EQVRBQkFTRV9VUklcbiIKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4OC9oZWFsdGgnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTgnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXN1cGVyc2V0LWRifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3N1cGVyc2V0X3Bvc3RncmVzX2RhdGE6L3Zhci9saWIvcG9zdGdyZXNxbCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6OCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3N1cGVyc2V0X3JlZGlzX2RhdGE6L2RhdGEnCiAgICBjb21tYW5kOiAncmVkaXMtc2VydmVyIC0tcmVxdWlyZXBhc3MgJHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncmVkaXMtY2xpIHBpbmcnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
         "tags": [
             "analytics",
             "bi",
@@ -5467,7 +4638,7 @@
         "category": "finance",
         "logo": "svgs/sure.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-02-05T06:44:13+01:00",
+        "template_last_updated_at": "2026-10-19T21:30:29+02:00",
         "port": "3000"
     },
     "swetrix": {
@@ -5636,7 +4807,7 @@
     "trigger": {
         "documentation": "https://trigger.dev/docs/self-hosting/overview?utm_source=coolify.io",
         "slogan": "The open source background jobs platform for developers",
-        "compose": "c2VydmljZXM6CiAgdHJpZ2dlcjoKICAgIGltYWdlOiAnZ2hjci5pby90cmlnZ2VyZG90ZGV2L3RyaWdnZXIuZGV2OnY0LjMuMCcKICAgIHVzZXI6IHJvb3QKICAgIGNvbW1hbmQ6ICJzaCAtYyBcImNob3duIC1SIG5vZGU6bm9kZSAvaG9tZS9ub2RlL3NoYXJlZCAmJiBleGVjIC4vc2NyaXB0cy9lbnRyeXBvaW50LnNoXCJcbiIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1RSSUdHRVJfMzAwMAogICAgICAtICdBUFBfT1JJR0lOPSR7U0VSVklDRV9VUkxfVFJJR0dFUl8zMDAwfScKICAgICAgLSAnTE9HSU5fT1JJR0lOPSR7U0VSVklDRV9VUkxfVFJJR0dFUl8zMDAwfScKICAgICAgLSAnQVBJX09SSUdJTj0ke1NFUlZJQ0VfVVJMX1RSSUdHRVJfMzAwMH0nCiAgICAgIC0gJ1NFU1NJT05fU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9TRVNTSU9OfScKICAgICAgLSAnTUFHSUNfTElOS19TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X01BR0lDTElOS30nCiAgICAgIC0gJ0VOQ1JZUFRJT05fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9FTkNSWVBUSU9OS0VZfScKICAgICAgLSAnTUFOQUdFRF9XT1JLRVJfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9XT1JLRVJTRUNSRVR9JwogICAgICAtICdUUklHR0VSX1dPUktFUl9UT0tFTj0ke1RSSUdHRVJfV09SS0VSX1RPS0VOfScKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gQVBQX0xPR19MRVZFTD1pbmZvCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3Jlc3FsOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXNxbDo1NDMyLyR7UE9TVEdSRVNfREI6LXRyaWdnZXItZGJ9P3NjaGVtYT1wdWJsaWMmc3NsbW9kZT1kaXNhYmxlJwogICAgICAtICdESVJFQ1RfVVJMPXBvc3RncmVzcWw6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlc3FsOjU0MzIvJHtQT1NUR1JFU19EQjotdHJpZ2dlci1kYn0/c2NoZW1hPXB1YmxpYyZzc2xtb2RlPWRpc2FibGUnCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgICAtIFJFRElTX1RMU19ESVNBQkxFRD10cnVlCiAgICAgIC0gJ0VMRUNUUklDX09SSUdJTj1odHRwOi8vZWxlY3RyaWM6MzAwMCcKICAgICAgLSAnREVWX09URUxfRVhQT1JURVJfT1RMUF9FTkRQT0lOVD0ke0RFVl9PVEVMX0VYUE9SVEVSX09UTFBfRU5EUE9JTlQ6LX0nCiAgICAgIC0gJ0RFUExPWV9SRUdJU1RSWV9IT1NUPSR7REVQTE9ZX1JFR0lTVFJZX0hPU1Q6LWdoY3IuaW99JwogICAgICAtICdERVBMT1lfUkVHSVNUUllfUFJPVE9DT0w9JHtERVBMT1lfUkVHSVNUUllfUFJPVE9DT0w6LWh0dHBzfScKICAgICAgLSAnREVQTE9ZX1JFR0lTVFJZX05BTUVTUEFDRT0ke0RFUExPWV9SRUdJU1RSWV9OQU1FU1BBQ0U6LXRyaWdnZXJ9JwogICAgICAtICdWNF9ERVBMT1lfUkVHSVNUUllfTkFNRVNQQUNFPSR7REVQTE9ZX1JFR0lTVFJZX05BTUVTUEFDRTotdHJpZ2dlcn0nCiAgICAgIC0gJ09CSkVDVF9TVE9SRV9CQVNFX1VSTD0ke09CSkVDVF9TVE9SRV9CQVNFX1VSTH0nCiAgICAgIC0gJ09CSkVDVF9TVE9SRV9BQ0NFU1NfS0VZX0lEPSR7T0JKRUNUX1NUT1JFX0FDQ0VTU19LRVlfSUR9JwogICAgICAtICdPQkpFQ1RfU1RPUkVfU0VDUkVUX0FDQ0VTU19LRVk9JHtPQkpFQ1RfU1RPUkVfU0VDUkVUX0FDQ0VTU19LRVl9JwogICAgICAtICdDTElDS0hPVVNFX1VSTD1odHRwOi8vJHtTRVJWSUNFX1VTRVJfQ0xJQ0tIT1VTRX06JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0NMSUNLSE9VU0V9QGNsaWNraG91c2U6ODEyMz9zZWN1cmU9ZmFsc2UnCiAgICAgIC0gQ0xJQ0tIT1VTRV9MT0dfTEVWRUw9aW5mbwogICAgICAtIFJVTl9SRVBMSUNBVElPTl9FTkFCTEVEPTEKICAgICAgLSAnUlVOX1JFUExJQ0FUSU9OX0NMSUNLSE9VU0VfVVJMPWh0dHA6Ly8ke1NFUlZJQ0VfVVNFUl9DTElDS0hPVVNFfToke1NFUlZJQ0VfUEFTU1dPUkRfNjRfQ0xJQ0tIT1VTRX1AY2xpY2tob3VzZTo4MTIzJwogICAgICAtIFJVTl9SRVBMSUNBVElPTl9MT0dfTEVWRUw9aW5mbwogICAgICAtIFRSSUdHRVJfQk9PVFNUUkFQX0VOQUJMRUQ9MQogICAgICAtIFRSSUdHRVJfQk9PVFNUUkFQX1dPUktFUl9HUk9VUF9OQU1FPWJvb3RzdHJhcAogICAgICAtIFRSSUdHRVJfQk9PVFNUUkFQX1dPUktFUl9UT0tFTl9QQVRIPS9ob21lL25vZGUvc2hhcmVkL3dvcmtlcl90b2tlbgogICAgICAtICdERUZBVUxUX09SR19FWEVDVVRJT05fQ09OQ1VSUkVOQ1lfTElNSVQ9JHtERUZBVUxUX09SR19FWEVDVVRJT05fQ09OQ1VSUkVOQ1lfTElNSVQ6LTMwMH0nCiAgICAgIC0gJ0RFRkFVTFRfRU5WX0VYRUNVVElPTl9DT05DVVJSRU5DWV9MSU1JVD0ke0RFRkFVTFRfRU5WX0VYRUNVVElPTl9DT05DVVJSRU5DWV9MSU1JVDotMTAwfScKICAgICAgLSAnQVVUSF9HSVRIVUJfQ0xJRU5UX0lEPSR7QVVUSF9HSVRIVUJfQ0xJRU5UX0lEOi19JwogICAgICAtICdBVVRIX0dJVEhVQl9DTElFTlRfU0VDUkVUPSR7QVVUSF9HSVRIVUJfQ0xJRU5UX1NFQ1JFVDotfScKICAgICAgLSAnRU1BSUxfVFJBTlNQT1JUPSR7RU1BSUxfVFJBTlNQT1JUOi1zbXRwfScKICAgICAgLSAnUkVTRU5EX0FQSV9LRVk9JHtSRVNFTkRfQVBJX0tFWX0nCiAgICAgIC0gJ1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ1NNVFBfUE9SVD0ke1NNVFBfUE9SVH0nCiAgICAgIC0gJ1NNVFBfVVNFUj0ke1NNVFBfVVNFUn0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEfScKICAgICAgLSAnU01UUF9TRUNVUkU9JHtTTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ0ZST01fRU1BSUw9JHtGUk9NX0VNQUlMfScKICAgICAgLSAnUkVQTFlfVE9fRU1BSUw9JHtSRVBMWV9UT19FTUFJTH0nCiAgICAgIC0gJ1dISVRFTElTVEVEX0VNQUlMUz0ke1dISVRFTElTVEVEX0VNQUlMU30nCiAgICAgIC0gJ0FETUlOX0VNQUlMUz0ke0FETUlOX0VNQUlMU30nCiAgICAgIC0gR1JBQ0VGVUxfU0hVVERPV05fVElNRU9VVD0xMDAwCiAgICAgIC0gJ0lOVEVSTkFMX09URUxfVFJBQ0VfTE9HR0lOR19FTkFCTEVEPSR7SU5URVJOQUxfT1RFTF9UUkFDRV9MT0dHSU5HX0VOQUJMRUQ6LTB9JwogICAgICAtICdUUklHR0VSX1RFTEVNRVRSWV9ESVNBQkxFRD0ke1RSSUdHRVJfVEVMRU1FVFJZX0RJU0FCTEVEOi10cnVlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NoYXJlZC1kYXRhOi9ob21lL25vZGUvc2hhcmVkJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5vZGUKICAgICAgICAtICctZScKICAgICAgICAtICJyZXF1aXJlKCdodHRwJykuZ2V0KCdodHRwOi8vMTI3LjAuMC4xOjMwMDAvaGVhbHRoY2hlY2snLChyKT0+cHJvY2Vzcy5leGl0KHIuc3RhdHVzQ29kZT09PTIwMD8wOjEpKS5vbignZXJyb3InLCgpPT5wcm9jZXNzLmV4aXQoMSkpIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgZWxlY3RyaWM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIHN1cGVydmlzb3I6CiAgICBpbWFnZTogJ2doY3IuaW8vdHJpZ2dlcmRvdGRldi9zdXBlcnZpc29yOnY0LjMuMCcKICAgIHVzZXI6IHJvb3QKICAgIGNvbW1hbmQ6ICJzaCAtYyBcImNob3duIC1SIG5vZGU6bm9kZSAvaG9tZS9ub2RlL3NoYXJlZCAmJiBleGVjIC91c3IvYmluL2R1bWItaW5pdCAtLSBwbnBtIHJ1biAtLWZpbHRlciBzdXBlcnZpc29yIHN0YXJ0XCJcbiIKICAgIGVudmlyb25tZW50OgogICAgICAtICdUUklHR0VSX0FQSV9VUkw9aHR0cDovL3RyaWdnZXI6MzAwMCcKICAgICAgLSAnT1RFTF9FWFBPUlRFUl9PVExQX0VORFBPSU5UPWh0dHA6Ly90cmlnZ2VyOjMwMDAvb3RlbCcKICAgICAgLSAnVFJJR0dFUl9XT1JLRVJfVE9LRU49JHtUUklHR0VSX1dPUktFUl9UT0tFTjotZmlsZTovLy9ob21lL25vZGUvc2hhcmVkL3dvcmtlcl90b2tlbn0nCiAgICAgIC0gJ01BTkFHRURfV09SS0VSX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfV09SS0VSU0VDUkVUfScKICAgICAgLSAnVFJJR0dFUl9XT1JLTE9BRF9BUElfRE9NQUlOPSR7VFJJR0dFUl9XT1JLTE9BRF9BUElfRE9NQUlOfScKICAgICAgLSBUUklHR0VSX1dPUktMT0FEX0FQSV9QT1JUX0VYVEVSTkFMPTgwMjAKICAgICAgLSAnRE9DS0VSX0hPU1Q9dGNwOi8vZG9ja2VyLXByb3h5OjIzNzUnCiAgICAgIC0gJ0RPQ0tFUl9SVU5ORVJfTkVUV09SS1M9JHtET0NLRVJfUlVOTkVSX05FVFdPUktTfScKICAgICAgLSAnRE9DS0VSX0FVVE9SRU1PVkVfRVhJVEVEX0NPTlRBSU5FUlM9JHtET0NLRVJfQVVUT1JFTU9WRV9FWElURURfQ09OVEFJTkVSUzotMX0nCiAgICAgIC0gJ0RPQ0tFUl9SRUdJU1RSWV9VUkw9aHR0cHM6Ly8ke0RFUExPWV9SRUdJU1RSWV9IT1NUOi1naGNyLmlvfScKICAgICAgLSAnRE9DS0VSX1JFR0lTVFJZX1VTRVJOQU1FPSR7REVQTE9ZX1JFR0lTVFJZX1VTRVJOQU1FfScKICAgICAgLSAnRE9DS0VSX1JFR0lTVFJZX1BBU1NXT1JEPSR7REVQTE9ZX1JFR0lTVFJZX1BBU1NXT1JEfScKICAgICAgLSBFTkZPUkNFX01BQ0hJTkVfUFJFU0VUUz0xCiAgICAgIC0gVFJJR0dFUl9ERVFVRVVFX0lOVEVSVkFMX01TPTEwMDAKICAgICAgLSAnREVCVUc9JHtTVVBFUlZJU09SX0RFQlVHOi0wfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NoYXJlZC1kYXRhOi9ob21lL25vZGUvc2hhcmVkJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5vZGUKICAgICAgICAtICctZScKICAgICAgICAtICJyZXF1aXJlKCdodHRwJykuZ2V0KCdodHRwOi8vMTI3LjAuMC4xOjgwMjAvaGVhbHRoJywocik9PnByb2Nlc3MuZXhpdChyLnN0YXR1c0NvZGU9PT0yMDA/MDoxKSkub24oJ2Vycm9yJywoKT0+cHJvY2Vzcy5leGl0KDEpKSIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICB0cmlnZ2VyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGRvY2tlci1wcm94eToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIGRvY2tlci1wcm94eToKICAgIGltYWdlOiAndGVjbmF0aXZhL2RvY2tlci1zb2NrZXQtcHJveHk6djAuNC4yJwogICAgdm9sdW1lczoKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2s6cm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBMT0dfTEVWRUw9aW5mbwogICAgICAtICdQT1NUPSR7UE9TVDotMX0nCiAgICAgIC0gJ0NPTlRBSU5FUlM9JHtDT05UQUlORVJTOi0xfScKICAgICAgLSAnSU1BR0VTPSR7SU1BR0VTOi0xfScKICAgICAgLSAnSU5GTz0ke0lORk86LTF9JwogICAgICAtICdORVRXT1JLUz0ke05FVFdPUktTOi0xfScKICAgICAgLSAnQVVUSD0ke0FVVEg6LTF9JwogICAgICAtICdESVNUUklCVVRJT049JHtESVNUUklCVVRJT046LTF9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICduYyAteiAxMjcuMC4wLjEgMjM3NSB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogIHBvc3RncmVzcWw6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy1jJwogICAgICAtIHdhbF9sZXZlbD1sb2dpY2FsCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXRyaWdnZXItZGJ9JwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNxbC1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBlbGVjdHJpYzoKICAgIGltYWdlOiAnZWxlY3RyaWNzcWwvZWxlY3RyaWM6MS4yLjknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzcWw6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlc3FsOjU0MzIvJHtQT1NUR1JFU19EQjotdHJpZ2dlci1kYn0/c3NsbW9kZT1kaXNhYmxlJwogICAgICAtICdFTEVDVFJJQ19TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0VMRUNUUklDfScKICAgICAgLSBFTEVDVFJJQ19VU0FHRV9SRVBPUlRJTkc9ZmFsc2UKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDozMDAwL3YxL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgY2xpY2tob3VzZToKICAgIGltYWdlOiAnY2xpY2tob3VzZS9jbGlja2hvdXNlLXNlcnZlcjoyNS44JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0NMSUNLSE9VU0VfVVNFUj0ke1NFUlZJQ0VfVVNFUl9DTElDS0hPVVNFfScKICAgICAgLSAnQ0xJQ0tIT1VTRV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfQ0xJQ0tIT1VTRX0nCiAgICAgIC0gQ0xJQ0tIT1VTRV9ERUZBVUxUX0FDQ0VTU19NQU5BR0VNRU5UPTEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NsaWNraG91c2UtZGF0YTovdmFyL2xpYi9jbGlja2hvdXNlJwogICAgICAtICdjbGlja2hvdXNlLWxvZ3M6L3Zhci9sb2cvY2xpY2tob3VzZS1zZXJ2ZXInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3dnZXQgLS1uby12ZXJib3NlIC0tdHJpZXM9MSAtLXNwaWRlciBodHRwOi8vbG9jYWxob3N0OjgxMjMvcGluZyB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
+        "compose": "c2VydmljZXM6CiAgdHJpZ2dlcjoKICAgIGltYWdlOiAnZ2hjci5pby90cmlnZ2VyZG90ZGV2L3RyaWdnZXIuZGV2OnY0LjMuMCcKICAgIHVzZXI6IHJvb3QKICAgIGNvbW1hbmQ6ICJzaCAtYyBcImNob3duIC1SIG5vZGU6bm9kZSAvaG9tZS9ub2RlL3NoYXJlZCAmJiBleGVjIC4vc2NyaXB0cy9lbnRyeXBvaW50LnNoXCJcbiIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1RSSUdHRVJfMzAwMAogICAgICAtICdBUFBfT1JJR0lOPSR7U0VSVklDRV9VUkxfVFJJR0dFUn0nCiAgICAgIC0gJ0xPR0lOX09SSUdJTj0ke1NFUlZJQ0VfVVJMX1RSSUdHRVJ9JwogICAgICAtICdBUElfT1JJR0lOPSR7U0VSVklDRV9VUkxfVFJJR0dFUn0nCiAgICAgIC0gJ1NFU1NJT05fU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9TRVNTSU9OfScKICAgICAgLSAnTUFHSUNfTElOS19TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X01BR0lDTElOS30nCiAgICAgIC0gJ0VOQ1JZUFRJT05fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9FTkNSWVBUSU9OS0VZfScKICAgICAgLSAnTUFOQUdFRF9XT1JLRVJfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9XT1JLRVJTRUNSRVR9JwogICAgICAtICdUUklHR0VSX1dPUktFUl9UT0tFTj0ke1RSSUdHRVJfV09SS0VSX1RPS0VOfScKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gQVBQX0xPR19MRVZFTD1pbmZvCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3Jlc3FsOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXNxbDo1NDMyLyR7UE9TVEdSRVNfREI6LXRyaWdnZXItZGJ9P3NjaGVtYT1wdWJsaWMmc3NsbW9kZT1kaXNhYmxlJwogICAgICAtICdESVJFQ1RfVVJMPXBvc3RncmVzcWw6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlc3FsOjU0MzIvJHtQT1NUR1JFU19EQjotdHJpZ2dlci1kYn0/c2NoZW1hPXB1YmxpYyZzc2xtb2RlPWRpc2FibGUnCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgICAtIFJFRElTX1RMU19ESVNBQkxFRD10cnVlCiAgICAgIC0gJ0VMRUNUUklDX09SSUdJTj1odHRwOi8vZWxlY3RyaWM6MzAwMCcKICAgICAgLSAnREVWX09URUxfRVhQT1JURVJfT1RMUF9FTkRQT0lOVD0ke0RFVl9PVEVMX0VYUE9SVEVSX09UTFBfRU5EUE9JTlQ6LX0nCiAgICAgIC0gJ0RFUExPWV9SRUdJU1RSWV9IT1NUPSR7REVQTE9ZX1JFR0lTVFJZX0hPU1Q6LWdoY3IuaW99JwogICAgICAtICdERVBMT1lfUkVHSVNUUllfUFJPVE9DT0w9JHtERVBMT1lfUkVHSVNUUllfUFJPVE9DT0w6LWh0dHBzfScKICAgICAgLSAnREVQTE9ZX1JFR0lTVFJZX05BTUVTUEFDRT0ke0RFUExPWV9SRUdJU1RSWV9OQU1FU1BBQ0U6LXRyaWdnZXJ9JwogICAgICAtICdWNF9ERVBMT1lfUkVHSVNUUllfTkFNRVNQQUNFPSR7REVQTE9ZX1JFR0lTVFJZX05BTUVTUEFDRTotdHJpZ2dlcn0nCiAgICAgIC0gJ09CSkVDVF9TVE9SRV9CQVNFX1VSTD0ke09CSkVDVF9TVE9SRV9CQVNFX1VSTH0nCiAgICAgIC0gJ09CSkVDVF9TVE9SRV9BQ0NFU1NfS0VZX0lEPSR7T0JKRUNUX1NUT1JFX0FDQ0VTU19LRVlfSUR9JwogICAgICAtICdPQkpFQ1RfU1RPUkVfU0VDUkVUX0FDQ0VTU19LRVk9JHtPQkpFQ1RfU1RPUkVfU0VDUkVUX0FDQ0VTU19LRVl9JwogICAgICAtICdDTElDS0hPVVNFX1VSTD1odHRwOi8vJHtTRVJWSUNFX1VTRVJfQ0xJQ0tIT1VTRX06JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0NMSUNLSE9VU0V9QGNsaWNraG91c2U6ODEyMz9zZWN1cmU9ZmFsc2UnCiAgICAgIC0gQ0xJQ0tIT1VTRV9MT0dfTEVWRUw9aW5mbwogICAgICAtIFJVTl9SRVBMSUNBVElPTl9FTkFCTEVEPTEKICAgICAgLSAnUlVOX1JFUExJQ0FUSU9OX0NMSUNLSE9VU0VfVVJMPWh0dHA6Ly8ke1NFUlZJQ0VfVVNFUl9DTElDS0hPVVNFfToke1NFUlZJQ0VfUEFTU1dPUkRfNjRfQ0xJQ0tIT1VTRX1AY2xpY2tob3VzZTo4MTIzJwogICAgICAtIFJVTl9SRVBMSUNBVElPTl9MT0dfTEVWRUw9aW5mbwogICAgICAtIFRSSUdHRVJfQk9PVFNUUkFQX0VOQUJMRUQ9MQogICAgICAtIFRSSUdHRVJfQk9PVFNUUkFQX1dPUktFUl9HUk9VUF9OQU1FPWJvb3RzdHJhcAogICAgICAtIFRSSUdHRVJfQk9PVFNUUkFQX1dPUktFUl9UT0tFTl9QQVRIPS9ob21lL25vZGUvc2hhcmVkL3dvcmtlcl90b2tlbgogICAgICAtICdERUZBVUxUX09SR19FWEVDVVRJT05fQ09OQ1VSUkVOQ1lfTElNSVQ9JHtERUZBVUxUX09SR19FWEVDVVRJT05fQ09OQ1VSUkVOQ1lfTElNSVQ6LTMwMH0nCiAgICAgIC0gJ0RFRkFVTFRfRU5WX0VYRUNVVElPTl9DT05DVVJSRU5DWV9MSU1JVD0ke0RFRkFVTFRfRU5WX0VYRUNVVElPTl9DT05DVVJSRU5DWV9MSU1JVDotMTAwfScKICAgICAgLSAnQVVUSF9HSVRIVUJfQ0xJRU5UX0lEPSR7QVVUSF9HSVRIVUJfQ0xJRU5UX0lEOi19JwogICAgICAtICdBVVRIX0dJVEhVQl9DTElFTlRfU0VDUkVUPSR7QVVUSF9HSVRIVUJfQ0xJRU5UX1NFQ1JFVDotfScKICAgICAgLSAnRU1BSUxfVFJBTlNQT1JUPSR7RU1BSUxfVFJBTlNQT1JUOi1zbXRwfScKICAgICAgLSAnUkVTRU5EX0FQSV9LRVk9JHtSRVNFTkRfQVBJX0tFWX0nCiAgICAgIC0gJ1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ1NNVFBfUE9SVD0ke1NNVFBfUE9SVH0nCiAgICAgIC0gJ1NNVFBfVVNFUj0ke1NNVFBfVVNFUn0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEfScKICAgICAgLSAnU01UUF9TRUNVUkU9JHtTTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ0ZST01fRU1BSUw9JHtGUk9NX0VNQUlMfScKICAgICAgLSAnUkVQTFlfVE9fRU1BSUw9JHtSRVBMWV9UT19FTUFJTH0nCiAgICAgIC0gJ1dISVRFTElTVEVEX0VNQUlMUz0ke1dISVRFTElTVEVEX0VNQUlMU30nCiAgICAgIC0gJ0FETUlOX0VNQUlMUz0ke0FETUlOX0VNQUlMU30nCiAgICAgIC0gR1JBQ0VGVUxfU0hVVERPV05fVElNRU9VVD0xMDAwCiAgICAgIC0gJ0lOVEVSTkFMX09URUxfVFJBQ0VfTE9HR0lOR19FTkFCTEVEPSR7SU5URVJOQUxfT1RFTF9UUkFDRV9MT0dHSU5HX0VOQUJMRUQ6LTB9JwogICAgICAtICdUUklHR0VSX1RFTEVNRVRSWV9ESVNBQkxFRD0ke1RSSUdHRVJfVEVMRU1FVFJZX0RJU0FCTEVEOi10cnVlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NoYXJlZC1kYXRhOi9ob21lL25vZGUvc2hhcmVkJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5vZGUKICAgICAgICAtICctZScKICAgICAgICAtICJyZXF1aXJlKCdodHRwJykuZ2V0KCdodHRwOi8vMTI3LjAuMC4xOjMwMDAvaGVhbHRoY2hlY2snLChyKT0+cHJvY2Vzcy5leGl0KHIuc3RhdHVzQ29kZT09PTIwMD8wOjEpKS5vbignZXJyb3InLCgpPT5wcm9jZXNzLmV4aXQoMSkpIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgZWxlY3RyaWM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIHN1cGVydmlzb3I6CiAgICBpbWFnZTogJ2doY3IuaW8vdHJpZ2dlcmRvdGRldi9zdXBlcnZpc29yOnY0LjMuMCcKICAgIHVzZXI6IHJvb3QKICAgIGNvbW1hbmQ6ICJzaCAtYyBcImNob3duIC1SIG5vZGU6bm9kZSAvaG9tZS9ub2RlL3NoYXJlZCAmJiBleGVjIC91c3IvYmluL2R1bWItaW5pdCAtLSBwbnBtIHJ1biAtLWZpbHRlciBzdXBlcnZpc29yIHN0YXJ0XCJcbiIKICAgIGVudmlyb25tZW50OgogICAgICAtICdUUklHR0VSX0FQSV9VUkw9aHR0cDovL3RyaWdnZXI6MzAwMCcKICAgICAgLSAnT1RFTF9FWFBPUlRFUl9PVExQX0VORFBPSU5UPWh0dHA6Ly90cmlnZ2VyOjMwMDAvb3RlbCcKICAgICAgLSAnVFJJR0dFUl9XT1JLRVJfVE9LRU49JHtUUklHR0VSX1dPUktFUl9UT0tFTjotZmlsZTovLy9ob21lL25vZGUvc2hhcmVkL3dvcmtlcl90b2tlbn0nCiAgICAgIC0gJ01BTkFHRURfV09SS0VSX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfV09SS0VSU0VDUkVUfScKICAgICAgLSAnVFJJR0dFUl9XT1JLTE9BRF9BUElfRE9NQUlOPSR7VFJJR0dFUl9XT1JLTE9BRF9BUElfRE9NQUlOfScKICAgICAgLSBUUklHR0VSX1dPUktMT0FEX0FQSV9QT1JUX0VYVEVSTkFMPTgwMjAKICAgICAgLSAnRE9DS0VSX0hPU1Q9dGNwOi8vZG9ja2VyLXByb3h5OjIzNzUnCiAgICAgIC0gJ0RPQ0tFUl9SVU5ORVJfTkVUV09SS1M9JHtET0NLRVJfUlVOTkVSX05FVFdPUktTfScKICAgICAgLSAnRE9DS0VSX0FVVE9SRU1PVkVfRVhJVEVEX0NPTlRBSU5FUlM9JHtET0NLRVJfQVVUT1JFTU9WRV9FWElURURfQ09OVEFJTkVSUzotMX0nCiAgICAgIC0gJ0RPQ0tFUl9SRUdJU1RSWV9VUkw9aHR0cHM6Ly8ke0RFUExPWV9SRUdJU1RSWV9IT1NUOi1naGNyLmlvfScKICAgICAgLSAnRE9DS0VSX1JFR0lTVFJZX1VTRVJOQU1FPSR7REVQTE9ZX1JFR0lTVFJZX1VTRVJOQU1FfScKICAgICAgLSAnRE9DS0VSX1JFR0lTVFJZX1BBU1NXT1JEPSR7REVQTE9ZX1JFR0lTVFJZX1BBU1NXT1JEfScKICAgICAgLSBFTkZPUkNFX01BQ0hJTkVfUFJFU0VUUz0xCiAgICAgIC0gVFJJR0dFUl9ERVFVRVVFX0lOVEVSVkFMX01TPTEwMDAKICAgICAgLSAnREVCVUc9JHtTVVBFUlZJU09SX0RFQlVHOi0wfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NoYXJlZC1kYXRhOi9ob21lL25vZGUvc2hhcmVkJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5vZGUKICAgICAgICAtICctZScKICAgICAgICAtICJyZXF1aXJlKCdodHRwJykuZ2V0KCdodHRwOi8vMTI3LjAuMC4xOjgwMjAvaGVhbHRoJywocik9PnByb2Nlc3MuZXhpdChyLnN0YXR1c0NvZGU9PT0yMDA/MDoxKSkub24oJ2Vycm9yJywoKT0+cHJvY2Vzcy5leGl0KDEpKSIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICB0cmlnZ2VyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGRvY2tlci1wcm94eToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIGRvY2tlci1wcm94eToKICAgIGltYWdlOiAndGVjbmF0aXZhL2RvY2tlci1zb2NrZXQtcHJveHk6djAuNC4yJwogICAgdm9sdW1lczoKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2s6cm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBMT0dfTEVWRUw9aW5mbwogICAgICAtICdQT1NUPSR7UE9TVDotMX0nCiAgICAgIC0gJ0NPTlRBSU5FUlM9JHtDT05UQUlORVJTOi0xfScKICAgICAgLSAnSU1BR0VTPSR7SU1BR0VTOi0xfScKICAgICAgLSAnSU5GTz0ke0lORk86LTF9JwogICAgICAtICdORVRXT1JLUz0ke05FVFdPUktTOi0xfScKICAgICAgLSAnQVVUSD0ke0FVVEg6LTF9JwogICAgICAtICdESVNUUklCVVRJT049JHtESVNUUklCVVRJT046LTF9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICduYyAteiAxMjcuMC4wLjEgMjM3NSB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogIHBvc3RncmVzcWw6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy1jJwogICAgICAtIHdhbF9sZXZlbD1sb2dpY2FsCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXRyaWdnZXItZGJ9JwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNxbC1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBlbGVjdHJpYzoKICAgIGltYWdlOiAnZWxlY3RyaWNzcWwvZWxlY3RyaWM6MS4yLjknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzcWw6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlc3FsOjU0MzIvJHtQT1NUR1JFU19EQjotdHJpZ2dlci1kYn0/c3NsbW9kZT1kaXNhYmxlJwogICAgICAtICdFTEVDVFJJQ19TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0VMRUNUUklDfScKICAgICAgLSBFTEVDVFJJQ19VU0FHRV9SRVBPUlRJTkc9ZmFsc2UKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDozMDAwL3YxL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgY2xpY2tob3VzZToKICAgIGltYWdlOiAnY2xpY2tob3VzZS9jbGlja2hvdXNlLXNlcnZlcjoyNS44JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0NMSUNLSE9VU0VfVVNFUj0ke1NFUlZJQ0VfVVNFUl9DTElDS0hPVVNFfScKICAgICAgLSAnQ0xJQ0tIT1VTRV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfQ0xJQ0tIT1VTRX0nCiAgICAgIC0gQ0xJQ0tIT1VTRV9ERUZBVUxUX0FDQ0VTU19NQU5BR0VNRU5UPTEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NsaWNraG91c2UtZGF0YTovdmFyL2xpYi9jbGlja2hvdXNlJwogICAgICAtICdjbGlja2hvdXNlLWxvZ3M6L3Zhci9sb2cvY2xpY2tob3VzZS1zZXJ2ZXInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3dnZXQgLS1uby12ZXJib3NlIC0tdHJpZXM9MSAtLXNwaWRlciBodHRwOi8vbG9jYWxob3N0OjgxMjMvcGluZyB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
         "tags": [
             "background-jobs",
             "typescript",
@@ -5650,7 +4821,7 @@
         "category": "automation",
         "logo": "svgs/trigger.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-01-07T19:01:32+01:00",
+        "template_last_updated_at": "2026-10-19T21:05:49+02:00",
         "port": "3000"
     },
     "triliumnext": {
@@ -5683,7 +4854,7 @@
         "category": "productivity",
         "logo": "svgs/twenty.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-03T17:29:34+02:00",
+        "template_last_updated_at": "2026-10-19T21:18:52+02:00",
         "port": "3000"
     },
     "typesense": {
@@ -5926,72 +5097,6 @@
         "template_last_updated_at": "2026-08-17T11:10:01+02:00",
         "port": "3456"
     },
-    "vvveb-with-mariadb": {
-        "documentation": "https://docs.vvveb.com?utm_source=coolify.io",
-        "slogan": "Powerful and easy to use cms to build websites, blogs or ecommerce stores.",
-        "compose": "c2VydmljZXM6CiAgdnZ2ZWI6CiAgICBpbWFnZTogJ3Z2dmViL3Z2dmViY21zOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Z2dmViLWRhdGE6L3Zhci93d3cvaHRtbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1ZWVkVCXzgwCiAgICAgIC0gREJfRU5HSU5FPW15c3FsaQogICAgICAtIERCX0hPU1Q9bWFyaWFkYgogICAgICAtICdEQl9VU0VSPSR7U0VSVklDRV9VU0VSX1ZWVkVCfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1ZWVkVCfScKICAgICAgLSAnREJfTkFNRT0ke01BUklBREJfREFUQUJBU0U6LXZ2dmVifScKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxMAogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICd2dnZlYi1tYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TUFSSUFEQl9EQVRBQkFTRTotdnZ2ZWJ9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX1ZWVkVCfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1ZWVkVCfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "ecommerce",
-            "page-builder",
-            "nocode",
-            "mysql",
-            "sqlite",
-            "pgsql"
-        ],
-        "category": "cms",
-        "logo": "svgs/vvveb.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
-    "vvveb-with-mysql": {
-        "documentation": "https://docs.vvveb.com?utm_source=coolify.io",
-        "slogan": "Powerful and easy to use cms to build websites, blogs or ecommerce stores.",
-        "compose": "c2VydmljZXM6CiAgdnZ2ZWI6CiAgICBpbWFnZTogJ3Z2dmViL3Z2dmViY21zOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Z2dmViLWRhdGE6L3Zhci93d3cvaHRtbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1ZWVkVCXzgwCiAgICAgIC0gREJfRU5HSU5FPW15c3FsaQogICAgICAtIERCX0hPU1Q9bXlzcWwKICAgICAgLSAnREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9WVlZFQn0nCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9WVlZFQn0nCiAgICAgIC0gJ0RCX05BTUU9JHtNWVNRTF9EQVRBQkFTRTotdnZ2ZWJ9JwogICAgZGVwZW5kc19vbjoKICAgICAgbXlzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxMAogIG15c3FsOgogICAgaW1hZ2U6ICdteXNxbDo4LjQuMicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Z2dmViLW15c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LXZ2dmVifScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9WVlZFQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9WVlZFQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "ecommerce",
-            "page-builder",
-            "nocode",
-            "mysql",
-            "sqlite",
-            "pgsql"
-        ],
-        "category": "cms",
-        "logo": "svgs/vvveb.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
-    "vvveb": {
-        "documentation": "https://docs.vvveb.com?utm_source=coolify.io",
-        "slogan": "Powerful and easy to use cms to build websites, blogs or ecommerce stores.",
-        "compose": "c2VydmljZXM6CiAgdnZ2ZWI6CiAgICBpbWFnZTogJ3Z2dmViL3Z2dmViY21zOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Z2dmViLWRhdGE6L3Zhci93d3cvaHRtbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1ZWVkVCXzgwCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "ecommerce",
-            "page-builder",
-            "nocode",
-            "mysql",
-            "sqlite",
-            "pgsql"
-        ],
-        "category": "cms",
-        "logo": "svgs/vvveb.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "wakapi": {
         "documentation": "https://wakapi.dev/?utm_source=coolify.io",
         "slogan": "A minimalist, self-hosted WakaTime-compatible backend for coding statistics",
@@ -6064,7 +5169,7 @@
         "category": "productivity",
         "logo": "svgs/weblate.webp",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-12-31T17:36:41+02:00",
+        "template_last_updated_at": "2026-10-19T21:18:38+02:00",
         "port": "8080"
     },
     "whoogle": {
@@ -6096,23 +5201,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
-    "windmill": {
-        "documentation": "https://www.windmill.dev/docs/?utm_source=coolify.io",
-        "slogan": "Windmill is a developer platform to build production-grade multi-steps automations and internal apps.",
-        "compose": "c2VydmljZXM6CiAgZGI6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2JwogICAgc2htX3NpemU6IDFnCiAgICB2b2x1bWVzOgogICAgICAtICdkYi1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotd2luZG1pbGwtZGJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgd2luZG1pbGwtc2VydmVyOgogICAgaW1hZ2U6ICdnaGNyLmlvL3dpbmRtaWxsLWxhYnMvd2luZG1pbGw6bWFpbicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1dJTkRNSUxMXzgwMDAKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AZGIvJHtQT1NUR1JFU19EQjotd2luZG1pbGwtZGJ9JwogICAgICAtIE1PREU9c2VydmVyCiAgICAgIC0gJ0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfV0lORE1JTEx9JwogICAgZGVwZW5kc19vbjoKICAgICAgZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3dvcmtlci1sb2dzOi90bXAvd2luZG1pbGwvbG9ncycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDAwL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogIHdpbmRtaWxsLXdvcmtlci0xOgogICAgaW1hZ2U6ICdnaGNyLmlvL3dpbmRtaWxsLWxhYnMvd2luZG1pbGw6bWFpbicKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBkYi8ke1BPU1RHUkVTX0RCOi13aW5kbWlsbC1kYn0nCiAgICAgIC0gTU9ERT13b3JrZXIKICAgICAgLSBXT1JLRVJfR1JPVVA9ZGVmYXVsdAogICAgZGVwZW5kc19vbjoKICAgICAgZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgICAtICd3b3JrZXItZGVwZW5kZW5jeS1jYWNoZTovdG1wL3dpbmRtaWxsL2NhY2hlJwogICAgICAtICd3b3JrZXItbG9nczovdG1wL3dpbmRtaWxsL2xvZ3MnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2V4aXQgMCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogIHdpbmRtaWxsLXdvcmtlci0yOgogICAgaW1hZ2U6ICdnaGNyLmlvL3dpbmRtaWxsLWxhYnMvd2luZG1pbGw6bWFpbicKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBkYi8ke1BPU1RHUkVTX0RCOi13aW5kbWlsbC1kYn0nCiAgICAgIC0gTU9ERT13b3JrZXIKICAgICAgLSBXT1JLRVJfR1JPVVA9ZGVmYXVsdAogICAgZGVwZW5kc19vbjoKICAgICAgZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgICAtICd3b3JrZXItZGVwZW5kZW5jeS1jYWNoZTovdG1wL3dpbmRtaWxsL2NhY2hlJwogICAgICAtICd3b3JrZXItbG9nczovdG1wL3dpbmRtaWxsL2xvZ3MnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2V4aXQgMCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogIHdpbmRtaWxsLXdvcmtlci0zOgogICAgaW1hZ2U6ICdnaGNyLmlvL3dpbmRtaWxsLWxhYnMvd2luZG1pbGw6bWFpbicKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBkYi8ke1BPU1RHUkVTX0RCOi13aW5kbWlsbC1kYn0nCiAgICAgIC0gTU9ERT13b3JrZXIKICAgICAgLSBXT1JLRVJfR1JPVVA9ZGVmYXVsdAogICAgZGVwZW5kc19vbjoKICAgICAgZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgICAtICd3b3JrZXItZGVwZW5kZW5jeS1jYWNoZTovdG1wL3dpbmRtaWxsL2NhY2hlJwogICAgICAtICd3b3JrZXItbG9nczovdG1wL3dpbmRtaWxsL2xvZ3MnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2V4aXQgMCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogIHdpbmRtaWxsLXdvcmtlci1uYXRpdmU6CiAgICBpbWFnZTogJ2doY3IuaW8vd2luZG1pbGwtbGFicy93aW5kbWlsbDptYWluJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QGRiLyR7UE9TVEdSRVNfREI6LXdpbmRtaWxsLWRifScKICAgICAgLSBNT0RFPXdvcmtlcgogICAgICAtIFdPUktFUl9HUk9VUD1uYXRpdmUKICAgICAgLSBOVU1fV09SS0VSUz04CiAgICAgIC0gU0xFRVBfUVVFVUU9MjAwCiAgICBkZXBlbmRzX29uOgogICAgICBkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgdm9sdW1lczoKICAgICAgLSAnd29ya2VyLWxvZ3M6L3RtcC93aW5kbWlsbC9sb2dzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdleGl0IDAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICBsc3A6CiAgICBpbWFnZTogJ2doY3IuaW8vd2luZG1pbGwtbGFicy93aW5kbWlsbC1sc3A6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnbHNwLWNhY2hlOi9yb290Ly5jYWNoZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnZXhpdCAwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMjBzCg==",
-        "tags": [
-            "windmill",
-            "workflow",
-            "automation",
-            "developer",
-            "platform"
-        ],
-        "category": "automation",
-        "logo": "svgs/windmill.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "8000"
-    },
     "wings": {
         "documentation": "https://pterodactyl.io/?utm_source=coolify.io",
         "slogan": "The server control plane for Pterodactyl Panel. Written from the ground-up with security, speed, and stability in mind.",
@@ -6146,56 +5234,6 @@
         "template_last_updated_at": "2026-01-05T15:54:25+01:00",
         "port": "8000"
     },
-    "wordpress-with-mariadb": {
-        "documentation": "https://wordpress.org?utm_source=coolify.io",
-        "slogan": "WordPress is open source software you can use to create a beautiful website, blog, or app.",
-        "compose": "c2VydmljZXM6CiAgd29yZHByZXNzOgogICAgaW1hZ2U6ICd3b3JkcHJlc3M6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnd29yZHByZXNzLWZpbGVzOi92YXIvd3d3L2h0bWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9XT1JEUFJFU1MKICAgICAgLSBXT1JEUFJFU1NfREJfSE9TVD1tYXJpYWRiCiAgICAgIC0gV09SRFBSRVNTX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9XT1JEUFJFU1MKICAgICAgLSBXT1JEUFJFU1NfREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfV09SRFBSRVNTCiAgICAgIC0gV09SRFBSRVNTX0RCX05BTUU9d29yZHByZXNzCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxMAogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICdtYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT13b3JkcHJlc3MKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfV09SRFBSRVNTCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfV09SRFBSRVNTCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "mariadb"
-        ],
-        "category": "cms",
-        "logo": "svgs/wordpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "wordpress-with-mysql": {
-        "documentation": "https://wordpress.org?utm_source=coolify.io",
-        "slogan": "WordPress is open source software you can use to create a beautiful website, blog, or app.",
-        "compose": "c2VydmljZXM6CiAgd29yZHByZXNzOgogICAgaW1hZ2U6ICd3b3JkcHJlc3M6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnd29yZHByZXNzLWZpbGVzOi92YXIvd3d3L2h0bWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9XT1JEUFJFU1MKICAgICAgLSBXT1JEUFJFU1NfREJfSE9TVD1teXNxbAogICAgICAtIFdPUkRQUkVTU19EQl9VU0VSPSRTRVJWSUNFX1VTRVJfV09SRFBSRVNTCiAgICAgIC0gV09SRFBSRVNTX0RCX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1dPUkRQUkVTUwogICAgICAtIFdPUkRQUkVTU19EQl9OQU1FPXdvcmRwcmVzcwogICAgZGVwZW5kc19vbjoKICAgICAgLSBteXNxbAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDEwCiAgbXlzcWw6CiAgICBpbWFnZTogJ215c3FsOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdteXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTVlTUUxfUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9ST09UCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9d29yZHByZXNzCiAgICAgIC0gTVlTUUxfVVNFUj0kU0VSVklDRV9VU0VSX1dPUkRQUkVTUwogICAgICAtIE1ZU1FMX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1dPUkRQUkVTUwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "mysql"
-        ],
-        "category": "cms",
-        "logo": "svgs/wordpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "wordpress-without-database": {
-        "documentation": "https://wordpress.org?utm_source=coolify.io",
-        "slogan": "WordPress is open source software you can use to create a beautiful website, blog, or app.",
-        "compose": "c2VydmljZXM6CiAgd29yZHByZXNzOgogICAgaW1hZ2U6ICd3b3JkcHJlc3M6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnd29yZHByZXNzLWZpbGVzOi92YXIvd3d3L2h0bWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9XT1JEUFJFU1MKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management"
-        ],
-        "category": "cms",
-        "logo": "svgs/wordpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "yamtrack-with-postgresql": {
         "documentation": "https://github.com/FuzzyGrim/Yamtrack/wiki?utm_source=coolify.io",
         "slogan": "Yamtrack is a self hosted media tracker for movies, tv shows, anime, manga, video games and books.",
diff --git a/templates/service-templates.json b/templates/service-templates.json
index 86dc5e10f6..3016116668 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -14,7 +14,7 @@
         "category": "ai",
         "logo": "svgs/9router.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-04T18:02:06+02:00",
+        "template_last_updated_at": "2026-10-05T11:08:52+02:00",
         "port": "20128"
     },
     "activepieces": {
@@ -125,7 +125,7 @@
         "category": "productivity",
         "logo": "svgs/appflowy.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-16T11:26:29-05:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "80"
     },
     "apprise-api": {
@@ -159,21 +159,6 @@
         "template_last_updated_at": "2026-09-02T19:39:19+02:00",
         "port": "80"
     },
-    "appwrite": {
-        "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
-        "slogan": "A backend-as-a-service platform that simplifies the web & mobile app development.",
-        "compose": "c2VydmljZXM6CiAgYXBwd3JpdGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuNS4wJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0FQUFdSSVRFPS92MQogICAgICAtICdfQVBQX0ROU19FWFRFUk5BTD0ke19BUFBfRE5TX0VYVEVSTkFMfScKICAgICAgLSAnX0FQUF9BTExPV0VEX0lOVEVSTkFMX0FERFJFU1NFUz0ke19BUFBfQUxMT1dFRF9JTlRFUk5BTF9BRERSRVNTRVN9JwogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtIF9BUFBfVVNBR0VfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfVVNBR0U9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9VU0FHRT0ke19BUFBfUE9PTF9TSVpFX1VTQUdFOi0yfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9FWEVDVVRJT05TPWh0dHA6Ly9hcHB3cml0ZTokU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFQGFwcHdyaXRlLWNsaWNraG91c2U6ODEyMy9hcHB3cml0ZScKICAgICAgLSAnX0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUz0ke19BUFBfUE9PTF9TSVpFX0VYRUNVVElPTlM6LTJ9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9VU0FHRV9UVEw9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9VU0FHRV9UVEw6LTE4MH0nCiAgICAgIC0gJ19BUFBfU1RBVFNfVVNBR0VfUVVFVUVfTkFNRT0ke19BUFBfU1RBVFNfVVNBR0VfUVVFVUVfTkFNRTotdjEtc3RhdHMtdXNhZ2V9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19SRVNPVVJDRVNfUVVFVUVfTkFNRTotdjEtc3RhdHMtcmVzb3VyY2VzfScKICAgICAgLSAnX0FQUF9TVEFUU19SRVNPVVJDRVNfSU5URVJWQUw9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTDotMzYwMH0nCiAgICAgIC0gJ19BUFBfRURJVElPTj0ke19BUFBfRURJVElPTjotc2VsZi1ob3N0ZWR9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9MT0NBTEU9JHtfQVBQX0xPQ0FMRTotZW59JwogICAgICAtICdfQVBQX0NPTVBSRVNTSU9OX0VOQUJMRUQ9JHtfQVBQX0NPTVBSRVNTSU9OX0VOQUJMRUQ6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX0NPTVBSRVNTSU9OX01JTl9TSVpFX0JZVEVTPSR7X0FQUF9DT01QUkVTU0lPTl9NSU5fU0laRV9CWVRFU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9XSElURUxJU1RfUk9PVD0ke19BUFBfQ09OU09MRV9XSElURUxJU1RfUk9PVDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9XSElURUxJU1RfRU1BSUxTPSR7X0FQUF9DT05TT0xFX1dISVRFTElTVF9FTUFJTFN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0VTU0lPTl9BTEVSVFM9JHtfQVBQX0NPTlNPTEVfU0VTU0lPTl9BTEVSVFM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9JUFM9JHtfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0lQU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9IT1NUTkFNRVM9JHtfQVBQX0NPTlNPTEVfSE9TVE5BTUVTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1NDSEVNQT0ke19BUFBfQ09OU09MRV9TQ0hFTUE6LWFwcHdyaXRlaW99JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUSFVCX0FQUF9JRD0ke19BUFBfQ09OU09MRV9HSVRIVUJfQVBQX0lEfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVEhVQl9TRUNSRVQ9JHtfQVBQX0NPTlNPTEVfR0lUSFVCX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRMQUJfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dJVExBQl9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUTEFCX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HSVRMQUJfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVExBQl9FTkRQT0lOVD0ke19BUFBfQ09OU09MRV9HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQklUQlVDS0VUX0FQUF9JRD0ke19BUFBfQ09OU09MRV9CSVRCVUNLRVRfQVBQX0lEfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0JJVEJVQ0tFVF9TRUNSRVQ9JHtfQVBQX0NPTlNPTEVfQklUQlVDS0VUX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HT09HTEVfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dPT0dMRV9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR09PR0xFX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HT09HTEVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TWVNURU1fRU1BSUxfTkFNRT0ke19BUFBfU1lTVEVNX0VNQUlMX05BTUU6LUFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9TWVNURU1fRU1BSUxfQUREUkVTUz0ke19BUFBfU1lTVEVNX0VNQUlMX0FERFJFU1M6LW5vcmVwbHlAYXBwd3JpdGUuaW99JwogICAgICAtICdfQVBQX1NZU1RFTV9URUFNX0VNQUlMPSR7X0FQUF9TWVNURU1fVEVBTV9FTUFJTDotdGVhbUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfRU1BSUxfU0VDVVJJVFk9JHtfQVBQX0VNQUlMX1NFQ1VSSVRZOi1zZWN1cml0eUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfU1lTVEVNX1JFU1BPTlNFX0ZPUk1BVD0ke19BUFBfU1lTVEVNX1JFU1BPTlNFX0ZPUk1BVH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRV9JTkNSRUFTRURfTElNSVRfUFJPSkVDVFM9JHtfQVBQX09QVElPTlNfQUJVU0VfSU5DUkVBU0VEX0xJTUlUX1BST0pFQ1RTfScKICAgICAgLSAnX0FQUF9PUFRJT05TX1JPVVRFUl9QUk9URUNUSU9OPSR7X0FQUF9PUFRJT05TX1JPVVRFUl9QUk9URUNUSU9OOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX1JPVVRFUl9GT1JDRV9IVFRQUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1JPVVRFUl9BVVRPX0NFUlRJRklDQVRFUz0ke19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTOi1kaXNhYmxlZH0nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtIF9BUFBfTk9USUZJQ0FUSU9OU19UUkFDS0lOR19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfTk9USUZJQ0FUSU9OUwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0RPTUFJTj0ke19BUFBfQ09OU09MRV9ET01BSU59JwogICAgICAtICdfQVBQX0NPTlNPTEVfVVJMPSR7X0FQUF9DT05TT0xFX1VSTH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9UUlVTVEVEX1BST0pFQ1RTPSR7X0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFN9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX1NNVFBfSE9TVD0ke19BUFBfU01UUF9IT1NUfScKICAgICAgLSAnX0FQUF9TTVRQX1BPUlQ9JHtfQVBQX1NNVFBfUE9SVH0nCiAgICAgIC0gJ19BUFBfU01UUF9TRUNVUkU9JHtfQVBQX1NNVFBfU0VDVVJFfScKICAgICAgLSAnX0FQUF9TTVRQX1VTRVJOQU1FPSR7X0FQUF9TTVRQX1VTRVJOQU1FfScKICAgICAgLSAnX0FQUF9TTVRQX1BBU1NXT1JEPSR7X0FQUF9TTVRQX1BBU1NXT1JEfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTUlUPSR7X0FQUF9TVE9SQUdFX0xJTUlUOi0zMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9QUkVWSUVXX0xJTUlUPSR7X0FQUF9TVE9SQUdFX1BSRVZJRVdfTElNSVQ6LTIwMDAwMDAwfScKICAgICAgLSAnX0FQUF9BVVRPR1JBVklUWV9IT1NUPSR7X0FQUF9BVVRPR1JBVklUWV9IT1NUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVUz0ke19BUFBfU1RPUkFHRV9BTlRJVklSVVM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVU19IT1NUPSR7X0FQUF9TVE9SQUdFX0FOVElWSVJVU19IT1NUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVU19QT1JUPSR7X0FQUF9TVE9SQUdFX0FOVElWSVJVU19QT1JUOi0zMzEwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RFVklDRT0ke19BUFBfU1RPUkFHRV9ERVZJQ0U6LWxvY2FsfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfUzNfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9SRUdJT049JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTjotdXMtd2VzdC0wMDR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT046LWV1LWNlbnRyYWwtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9SRUdJT049JHtfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9TSVpFX0xJTUlUPSR7X0FQUF9DT01QVVRFX1NJWkVfTElNSVQ6LTMwMDAwMDAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1NJWkVfTElNSVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfU0laRV9MSU1JVDotMjAwMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ9JHtfQVBQX0ZVTkNUSU9OU19USU1FT1VUOi05MDB9JwogICAgICAtICdfQVBQX1NJVEVTX1RJTUVPVVQ9JHtfQVBQX1NJVEVTX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9CVUlMRF9USU1FT1VUPSR7X0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ6LTI3MDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQ1BVUz0ke19BUFBfQ09NUFVURV9DUFVTOi0wfScKICAgICAgLSAnX0FQUF9DT01QVVRFX01FTU9SWT0ke19BUFBfQ09NUFVURV9NRU1PUlk6LTB9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19SVU5USU1FUz0ke19BUFBfRlVOQ1RJT05TX1JVTlRJTUVTOi1ub2RlLTIyfScKICAgICAgLSAnX0FQUF9TSVRFU19SVU5USU1FUz0ke19BUFBfU0lURVNfUlVOVElNRVM6LXN0YXRpYy0xLG5vZGUtMjJ9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSBfQVBQX0VYRUNVVE9SX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9FWEVDVVRPUgogICAgICAtICdfQVBQX0VYRUNVVE9SX0hPU1Q9JHtfQVBQX0VYRUNVVE9SX0hPU1Q6LWh0dHA6Ly9vcGVucnVudGltZXMtZXhlY3V0b3IvdjF9JwogICAgICAtICdfQVBQX0JVSUxEU19WT0xVTUU9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX1fYXBwd3JpdGUtYnVpbGRzJwogICAgICAtICdfQVBQX0pPQlNfSE9TVD0ke19BUFBfSk9CU19IT1NUOi1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODB9JwogICAgICAtIF9BUFBfSk9CU19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfSk9CUwogICAgICAtICdfQVBQX0pPQlNfRU5EUE9JTlQ9JHtfQVBQX0pPQlNfRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19DT05GSUc9JHtfQVBQX0xPR0dJTkdfQ09ORklHfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gJ19BUFBfTE9DS0lOR19FTkFCTEVEPSR7X0FQUF9MT0NLSU5HX0VOQUJMRUQ6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMPSR7X0FQUF9NQUlOVEVOQU5DRV9JTlRFUlZBTDotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9FWEVDVVRJT049JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9FWEVDVVRJT046LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9DQUNIRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFOi0yNTkyMDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQUJVU0U9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRTotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUOi0xMjA5NjAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUX0NPTlNPTEV9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9TQ0hFRFVMRVM9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9TQ0hFRFVMRVM6LTg2NDAwfScKICAgICAgLSAnX0FQUF9TTVNfUFJPVklERVI9JHtfQVBQX1NNU19QUk9WSURFUn0nCiAgICAgIC0gJ19BUFBfU01TX0ZST009JHtfQVBQX1NNU19GUk9NfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX0lOVFJPU1BFQ1RJT049JHtfQVBQX0dSQVBIUUxfSU5UUk9TUEVDVElPTjotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfQkFUQ0hfU0laRT0ke19BUFBfR1JBUEhRTF9NQVhfQkFUQ0hfU0laRTotMTB9JwogICAgICAtICdfQVBQX0dSQVBIUUxfTUFYX0NPTVBMRVhJVFk9JHtfQVBQX0dSQVBIUUxfTUFYX0NPTVBMRVhJVFk6LTI1MH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfREVQVEg9JHtfQVBQX0dSQVBIUUxfTUFYX0RFUFRIOi0zfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9JRD0ke19BUFBfVkNTX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRIVUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEhVQl9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9JRD0ke19BUFBfVkNTX0dJVEhVQl9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX1dFQkhPT0tfVVJMPSR7X0FQUF9WQ1NfV0VCSE9PS19VUkx9JwogICAgICAtICdfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfU0VDUkVUPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQ09VTlRSSUVTX0RFTllMSVNUPSR7X0FQUF9DT05TT0xFX0NPVU5UUklFU19ERU5ZTElTVH0nCiAgICAgIC0gJ19BUFBfREFUQUJBU0VfU0hBUkVEX1RBQkxFUz0ke19BUFBfREFUQUJBU0VfU0hBUkVEX1RBQkxFU30nCiAgICAgIC0gJ19BUFBfREFUQUJBU0VfU0hBUkVEX05BTUVTUEFDRT0ke19BUFBfREFUQUJBU0VfU0hBUkVEX05BTUVTUEFDRX0nCiAgICAgIC0gJ19BUFBfRlVOQ1RJT05TX0NSRUFUSU9OX0FCVVNFX0xJTUlUPSR7X0FQUF9GVU5DVElPTlNfQ1JFQVRJT05fQUJVU0VfTElNSVR9JwogICAgICAtICdfQVBQX0NVU1RPTV9ET01BSU5fREVOWV9MSVNUPSR7X0FQUF9DVVNUT01fRE9NQUlOX0RFTllfTElTVDotZXhhbXBsZS5jb20sdGVzdC5jb20sYXBwLmV4YW1wbGUuY29tfScKICAgICAgLSAnX0FQUF9UUlVTVEVEX0hFQURFUlM9JHtfQVBQX1RSVVNURURfSEVBREVSUzoteC1mb3J3YXJkZWQtZm9yfScKICAgICAgLSAnX0FQUF9UUlVTVEVEX1BST1hJRVM9JHtfQVBQX1RSVVNURURfUFJPWElFUzotMTI3LjAuMC4xLDo6MSwxMC4wLjAuMC84LDEwMC42NC4wLjAvMTAsMTcyLjE2LjAuMC8xMiwxOTIuMTY4LjAuMC8xNn0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OX0hPU1Q9JHtfQVBQX01JR1JBVElPTl9IT1NUOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9HRU9fU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0dFTwogICAgICAtICdfQVBQX0dFT19FTkRQT0lOVD0ke19BUFBfR0VPX0VORFBPSU5UOi1odHRwOi8vYXBwd3JpdGUtZ2VvL3YxfScKICAgICAgLSAnX0FQUF9QV05FRF9QQVNTV09SRFNfRFNOPSR7X0FQUF9QV05FRF9QQVNTV09SRFNfRFNOOi1ub25lOi8vbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSD0ke19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g6LTEwMH0nCiAgICAgIC0gJ19BUFBfRE9DVU1FTlRTREI9JHtfQVBQX0RPQ1VNRU5UU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfVkVDVE9SU0RCPSR7X0FQUF9WRUNUT1JTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9FTUJFRERJTkc9JHtfQVBQX0VNQkVERElORzotZGlzYWJsZWR9JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtdXBsb2Fkczovc3RvcmFnZS91cGxvYWRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1pbXBvcnRzOi9zdG9yYWdlL2ltcG9ydHM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNhY2hlOi9zdG9yYWdlL2NhY2hlOnJ3JwogICAgICAtICdhcHB3cml0ZS1jb25maWc6L3N0b3JhZ2UvY29uZmlnOnJ3JwogICAgICAtICdhcHB3cml0ZS1jZXJ0aWZpY2F0ZXM6L3N0b3JhZ2UvY2VydGlmaWNhdGVzOnJ3JwogICAgICAtICdhcHB3cml0ZS1mdW5jdGlvbnM6L3N0b3JhZ2UvZnVuY3Rpb25zOnJ3JwogICAgICAtICdhcHB3cml0ZS1zaXRlczovc3RvcmFnZS9zaXRlczpydycKICAgICAgLSAnYXBwd3JpdGUtYnVpbGRzOi9zdG9yYWdlL2J1aWxkczpydycKICAgIGRlcGVuZHNfb246CiAgICAgIGFwcHdyaXRlLXBvc3RncmVzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgYXBwd3JpdGUtcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgYXBwd3JpdGUtY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1nZW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIC1vIC9kZXYvbnVsbCBodHRwOi8vbG9jYWxob3N0L3YxL2hlYWx0aC92ZXJzaW9uIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA2CiAgICAgIHN0YXJ0X3BlcmlvZDogMTIwcwogIGFwcHdyaXRlLWNvbnNvbGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL25ldzoxLjIuNzQtc2VsZi1ob3N0ZWQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fQVBQV1JJVEVfMzAwMD0vCiAgICAgIC0gVklURV9DT05TT0xFX1BST0ZJTEU9c2VsZi1ob3N0ZWQKICAgICAgLSBWSVRFX0FQUFdSSVRFX1ZFUlNJT049Mi41LjAKICAgICAgLSBBUFBXUklURV9FTkRQT0lOVF9TQU1FX09SSUdJTj10cnVlCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdidW4gLWUgImZldGNoKCcnaHR0cDovL2xvY2FsaG9zdDozMDAwJycpLnRoZW4ociA9PiBwcm9jZXNzLmV4aXQoci5zdGF0dXMgPCA1MDAgPyAwIDogMSkpLmNhdGNoKCgpID0+IHByb2Nlc3MuZXhpdCgxKSkiJwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS1yZWFsdGltZToKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi41LjAnCiAgICBlbnRyeXBvaW50OiByZWFsdGltZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0FQUFdSSVRFPS92MS9yZWFsdGltZQogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9XT1JLRVJfUEVSX0NPUkU9JHtfQVBQX1dPUktFUl9QRVJfQ09SRTotNn0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTj0ke19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfSE9TVE5BTUVTPSR7X0FQUF9DT05TT0xFX0hPU1ROQU1FU30nCiAgICAgIC0gJ19BUFBfUkVBTFRJTUVfVEFJTF9SQVRFPSR7X0FQUF9SRUFMVElNRV9UQUlMX1JBVEU6LTUwfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9IRUFERVJTPSR7X0FQUF9UUlVTVEVEX0hFQURFUlM6LXgtZm9yd2FyZGVkLWZvcn0nCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9QUk9YSUVTPSR7X0FQUF9UUlVTVEVEX1BST1hJRVM6LTEyNy4wLjAuMSw6OjEsMTAuMC4wLjAvOCwxMDAuNjQuMC4wLzEwLDE3Mi4xNi4wLjAvMTIsMTkyLjE2OC4wLjAvMTZ9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIPSR7X0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSDotMTAwfScKICAgICAgLSAnX0FQUF9ET0NVTUVOVFNEQj0ke19BUFBfRE9DVU1FTlRTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9WRUNUT1JTREI9JHtfQVBQX1ZFQ1RPUlNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0VNQkVERElORz0ke19BUFBfRU1CRURESU5HOi1kaXNhYmxlZH0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXMgbG9jYWxob3N0ID4gL2Rldi9udWxsIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtd29ya2VyOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IHdvcmtlcgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX0ROU19FWFRFUk5BTD0ke19BUFBfRE5TX0VYVEVSTkFMfScKICAgICAgLSAnX0FQUF9BTExPV0VEX0lOVEVSTkFMX0FERFJFU1NFUz0ke19BUFBfQUxMT1dFRF9JTlRFUk5BTF9BRERSRVNTRVN9JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSBfQVBQX1dPUktFUlNfTlVNPTEKICAgICAgLSBfQVBQX1dPUktFUl9NQVhfQ09ST1VUSU5FUz03OAogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfRU1BSUxfU0VDVVJJVFk9JHtfQVBQX0VNQUlMX1NFQ1VSSVRZOi1zZWN1cml0eUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfRU1BSUxfQ0VSVElGSUNBVEVTPSR7X0FQUF9FTUFJTF9DRVJUSUZJQ0FURVN9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQj0ke19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1RfVkVDVE9SU0RCPSR7X0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQjotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9WRUNUT1JTREI9JHtfQVBQX0RCX1BPUlRfVkVDVE9SU0RCOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCPSR7X0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSX1ZFQ1RPUlNEQj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTX1ZFQ1RPUlNEQj0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI6LW1vbmdvZGJ9JwogICAgICAtICdfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI6LTI3MDE3fScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUEFTU19ET0NVTUVOVFNEQj0ke19BUFBfREJfUEFTU19ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQn0nCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1FVRVVFX05BTUU9JHtfQVBQX1FVRVVFX05BTUV9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfVVJMPSR7X0FQUF9DT05TT0xFX1VSTH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9ET01BSU49JHtfQVBQX0NPTlNPTEVfRE9NQUlOfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFM9JHtfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfV0VCSE9PS19NQVhfRkFJTEVEX0FUVEVNUFRTPSR7X0FQUF9XRUJIT09LX01BWF9GQUlMRURfQVRURU1QVFM6LTEwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RFVklDRT0ke19BUFBfU1RPUkFHRV9ERVZJQ0U6LWxvY2FsfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfUzNfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9SRUdJT049JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTjotdXMtd2VzdC0wMDR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT046LWV1LWNlbnRyYWwtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9SRUdJT049JHtfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVH0nCiAgICAgIC0gX0FQUF9FWEVDVVRPUl9TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfRVhFQ1VUT1IKICAgICAgLSAnX0FQUF9FWEVDVVRPUl9IT1NUPSR7X0FQUF9FWEVDVVRPUl9IT1NUOi1odHRwOi8vb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yL3YxfScKICAgICAgLSAnX0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FPSR7X0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FfScKICAgICAgLSAnX0FQUF9ET0NLRVJfSFVCX1BBU1NXT1JEPSR7X0FQUF9ET0NLRVJfSFVCX1BBU1NXT1JEfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfVElNRU9VVD0ke19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfU0lURVNfVElNRU9VVD0ke19BUFBfU0lURVNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVDotMjcwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9DUFVTPSR7X0FQUF9DT01QVVRFX0NQVVM6LTB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfTUVNT1JZPSR7X0FQUF9DT01QVVRFX01FTU9SWTotMH0nCiAgICAgIC0gJ19BUFBfT1BFTl9SVU5USU1FU19ORlQ9JHtfQVBQX09QRU5fUlVOVElNRVNfTkZUOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9DT01QVVRFX1NJWkVfTElNSVQ9JHtfQVBQX0NPTVBVVEVfU0laRV9MSU1JVDotMzAwMDAwMDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQlVJTERfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9CVUlMRF9TSVpFX0xJTUlUOi0yMDAwMDAwMDAwfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9JRD0ke19BUFBfVkNTX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX1dFQkhPT0tfVVJMPSR7X0FQUF9WQ1NfV0VCSE9PS19VUkx9JwogICAgICAtICdfQVBQX0JVSUxEU19WT0xVTUU9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX1fYXBwd3JpdGUtYnVpbGRzJwogICAgICAtICdfQVBQX0pPQlNfSE9TVD0ke19BUFBfSk9CU19IT1NUOi1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODB9JwogICAgICAtIF9BUFBfSk9CU19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfSk9CUwogICAgICAtICdfQVBQX0pPQlNfRU5EUE9JTlQ9JHtfQVBQX0pPQlNfRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfQlJPV1NFUl9IT1NUPSR7X0FQUF9CUk9XU0VSX0hPU1Q6LWh0dHA6Ly9hcHB3cml0ZS1icm93c2VyOjMwMDAvdjF9JwogICAgICAtICdfQVBQX1dPUktFUl9TQ1JFRU5TSE9UU19ST1VURVI9JHtfQVBQX1dPUktFUl9TQ1JFRU5TSE9UU19ST1VURVI6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9OT1RJRklDQVRJT05TX1RSQUNLSU5HX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9OT1RJRklDQVRJT05TCiAgICAgIC0gJ19BUFBfU1lTVEVNX0VNQUlMX05BTUU9JHtfQVBQX1NZU1RFTV9FTUFJTF9OQU1FOi1BcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfU1lTVEVNX0VNQUlMX0FERFJFU1M9JHtfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTOi1ub3JlcGx5QGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9TTVRQX0hPU1Q9JHtfQVBQX1NNVFBfSE9TVH0nCiAgICAgIC0gJ19BUFBfU01UUF9QT1JUPSR7X0FQUF9TTVRQX1BPUlR9JwogICAgICAtICdfQVBQX1NNVFBfU0VDVVJFPSR7X0FQUF9TTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ19BUFBfU01UUF9VU0VSTkFNRT0ke19BUFBfU01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ19BUFBfU01UUF9QQVNTV09SRD0ke19BUFBfU01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ19BUFBfU01TX0ZST009JHtfQVBQX1NNU19GUk9NfScKICAgICAgLSAnX0FQUF9TTVNfUFJPVklERVI9JHtfQVBQX1NNU19QUk9WSURFUn0nCiAgICAgIC0gJ19BUFBfU01TX1BST0pFQ1RTX0RFTllfTElTVD0ke19BUFBfU01TX1BST0pFQ1RTX0RFTllfTElTVH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfSUQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OX0hPU1Q9JHtfQVBQX01JR1JBVElPTl9IT1NUOi1hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g9JHtfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIOi0xMDB9JwogICAgICAtICdfQVBQX0RPQ1VNRU5UU0RCPSR7X0FQUF9ET0NVTUVOVFNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1ZFQ1RPUlNEQj0ke19BUFBfVkVDVE9SU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfRU1CRURESU5HPSR7X0FQUF9FTUJFRERJTkc6LWRpc2FibGVkfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXVwbG9hZHM6L3N0b3JhZ2UvdXBsb2FkczpydycKICAgICAgLSAnYXBwd3JpdGUtaW1wb3J0czovc3RvcmFnZS9pbXBvcnRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1jYWNoZTovc3RvcmFnZS9jYWNoZTpydycKICAgICAgLSAnYXBwd3JpdGUtY29uZmlnOi9zdG9yYWdlL2NvbmZpZzpydycKICAgICAgLSAnYXBwd3JpdGUtY2VydGlmaWNhdGVzOi9zdG9yYWdlL2NlcnRpZmljYXRlczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWJ1aWxkczovc3RvcmFnZS9idWlsZHM6cncnCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9yY2hlc3RyYXRvcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLXNjaGVkdWxlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi41LjAnCiAgICBlbnRyeXBvaW50OiBzY2hlZHVsZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gX0FQUF9XT1JLRVJfTUFYX0NPUk9VVElORVM9OAogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0RPTUFJTj0ke19BUFBfQ09OU09MRV9ET01BSU59JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05fSE9TVD0ke19BUFBfTUlHUkFUSU9OX0hPU1Q6LWFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ9JHtfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ6LTB9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLW1haW50ZW5hbmNlOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IG1haW50ZW5hbmNlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRURJVElPTj0ke19BUFBfRURJVElPTjotc2VsZi1ob3N0ZWR9JwogICAgICAtICdfQVBQX1JPVVRFUl9BVVRPX0NFUlRJRklDQVRFUz0ke19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTOi1kaXNhYmxlZH0nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTj0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTjotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU6LTI1OTIwMDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUz0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUzotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1NUQVJUX1RJTUU9JHtfQVBQX01BSU5URU5BTkNFX1NUQVJUX1RJTUV9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLWludGVydmFsOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IGludGVydmFsCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1NJVEVTPSR7X0FQUF9ET01BSU5fU0lURVM6LXNpdGVzLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtIF9BUFBfT1BFTlNTTF9LRVlfVjE9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfQVBQV1JJVEUKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0lOVEVSVkFMX0RPTUFJTl9WRVJJRklDQVRJT049JHtfQVBQX0lOVEVSVkFMX0RPTUFJTl9WRVJJRklDQVRJT046LTEyMH0nCiAgICAgIC0gJ19BUFBfSU5URVJWQUxfQ0xFQU5VUF9TVEFMRV9FWEVDVVRJT05TPSR7X0FQUF9JTlRFUlZBTF9DTEVBTlVQX1NUQUxFX0VYRUNVVElPTlM6LTMwMH0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgLXEgJ1twXWhwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIGFwcHdyaXRlLWdlbzoKICAgIGltYWdlOiAnYXBwd3JpdGUvZ2VvOjAuMy4yJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gR0VPX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9HRU8KICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAicGhwIC1yIFwiZXhpdChqc29uX2RlY29kZShmaWxlX2dldF9jb250ZW50cygnaHR0cDovL2xvY2FsaG9zdC92MS9oZWFsdGgnKSktPnN0YXR1cyA9PT0gJ29rJyA/IDAgOiAxKTtcIiIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgYXBwd3JpdGUtYnJvd3NlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYnJvd3NlcjowLjMuNicKICAgIGVudmlyb25tZW50OgogICAgICAtIEFMTE9XRURfSE9TVFM9YXBwd3JpdGUKICAgIGRuczoKICAgICAgLSAxLjEuMS4xCiAgICAgIC0gOC44LjguOAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yOgogICAgaW1hZ2U6ICdvcGVucnVudGltZXMvZXhlY3V0b3I6MS4xLjInCiAgICBob3N0bmFtZTogb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yCiAgICBzdG9wX3NpZ25hbDogU0lHSU5UCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnT1BSX0VYRUNVVE9SX0lNQUdFUz0ke19BUFBfRVhFQ1VUT1JfSU1BR0VTOi1vcGVucnVudGltZXMvbm9kZTp2NS0yMixvcGVucnVudGltZXMvc3RhdGljOnY1LTF9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfSU5BQ1RJVkVfVEhSRVNIT0xEPSR7X0FQUF9DT01QVVRFX0lOQUNUSVZFX1RIUkVTSE9MRDotNjAwfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX01BSU5URU5BTkNFX0lOVEVSVkFMPSR7X0FQUF9DT01QVVRFX01BSU5URU5BTkNFX0lOVEVSVkFMOi02MDB9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfTkVUV09SSz0ke19BUFBfQ09NUFVURV9SVU5USU1FU19ORVRXT1JLOi1ydW50aW1lc30nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9ET0NLRVJfSFVCX1VTRVJOQU1FPSR7X0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0RPQ0tFUl9IVUJfUEFTU1dPUkQ9JHtfQVBQX0RPQ0tFUl9IVUJfUEFTU1dPUkR9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdPUFJfRVhFQ1VUT1JfUlVOVElNRVM9JHtfQVBQX0ZVTkNUSU9OU19SVU5USU1FUzotbm9kZS0yMn0sJHtfQVBQX1NJVEVTX1JVTlRJTUVTOi1zdGF0aWMtMSxub2RlLTIyfScKICAgICAgLSBPUFJfRVhFQ1VUT1JfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0VYRUNVVE9SCiAgICAgIC0gT1BSX0VYRUNVVE9SX1JVTlRJTUVfVkVSU0lPTlM9djUKICAgICAgLSAnT1BFTl9SVU5USU1FU19ORlQ9JHtfQVBQX09QRU5fUlVOVElNRVNfTkZUOi1lbmFibGVkfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9DT05ORUNUSU9OX1NUT1JBR0U9JHtfQVBQX0VYRUNVVE9SX0NPTk5FQ1RJT05fU1RPUkFHRTotbG9jYWw6Ly9sb2NhbGhvc3R9JwogICAgICAtIE9QUl9FWEVDVVRPUl9DT05ORUNUSU9OX0JVSUxEX0NBQ0hFX1NUT1JBR0U9CiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnYXBwd3JpdGUtYnVpbGRzOi9zdG9yYWdlL2J1aWxkczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJy90bXA6L3RtcDpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIC1IICJBdXRob3JpemF0aW9uOiBCZWFyZXIgJCRPUFJfRVhFQ1VUT1JfU0VDUkVUIiBodHRwOi8vbG9jYWxob3N0L3YxL2hlYWx0aCA+IC9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG9yY2hlc3RyYXRvcjoKICAgIGltYWdlOiAnZ2hjci5pby9vcGVuLXJ1bnRpbWVzL29yY2hlc3RyYXRvci9vcmNoZXN0cmF0b3I6Mi4yLjInCiAgICBob3N0bmFtZTogb3JjaGVzdHJhdG9yCiAgICB1c2VyOiByb290CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBPUkNIRVNUUkFUT1JfQkFDS0VORD1kb2NrZXIKICAgICAgLSAnT1JDSEVTVFJBVE9SX05FVFdPUks9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX0nCiAgICAgIC0gJ0RPQ0tFUl9ORVRXT1JLPSR7Q09NUE9TRV9QUk9KRUNUX05BTUV9JwogICAgICAtICdBUlRJRkFDVF9FTkRQT0lOVD1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODAnCiAgICAgIC0gJ1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnUzNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnUzNfQUNDRVNTX0tFWV9JRD0ke19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZfScKICAgICAgLSAnUzNfU0VDUkVUX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9rby1hcHAvb3JjaGVzdHJhdG9yCiAgICAgICAgLSAnLWNoZWNrLXJlYWR5JwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9wb3N0Z3JlczowLjEuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXBvc3RncmVzcWw6L3Zhci9saWIvcG9zdGdyZXNxbDpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTAKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBhcHB3cml0ZS1yZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LjctYWxwaW5lJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLW1heG1lbW9yeSA1MTJtYiAtLW1heG1lbW9yeS1wb2xpY3kgYWxsa2V5cy1scnUgLS1tYXhtZW1vcnktc2FtcGxlcyA1JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtcmVkaXM6L2RhdGE6cncnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUKICBhcHB3cml0ZS1jbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI2LjQuMy1hbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBDTElDS0hPVVNFX0RCPWFwcHdyaXRlCiAgICAgIC0gQ0xJQ0tIT1VTRV9VU0VSPWFwcHdyaXRlCiAgICAgIC0gQ0xJQ0tIT1VTRV9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gQ0xJQ0tIT1VTRV9ERUZBVUxUX0FDQ0VTU19NQU5BR0VNRU5UPTEKICAgICAgLSBDTElDS0hPVVNFX0FMV0FZU19SVU5fSU5JVERCX1NDUklQVFM9MQogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtY2xpY2tob3VzZTovdmFyL2xpYi9jbGlja2hvdXNlOnJ3JwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlLWNvbmZpZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvYXBwd3JpdGUueG1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogIjw/eG1sIHZlcnNpb249XCIxLjBcIj8+XG48IS0tXG4gICAgUmV0ZW50aW9uIGZvciBDbGlja0hvdXNlJ3Mgb3duIHN5c3RlbSBsb2cgdGFibGVzLlxuXG4gICAgRXZlcnkgPHR0bD4gaW4gdGhlIGltYWdlJ3MgY29uZmlnLnhtbCBzaXRzIGluc2lkZSBhbiBYTUwgY29tbWVudCwgc28gdGhlc2VcbiAgICB0YWJsZXMga2VlcCBldmVyeSByb3cgZm9yZXZlciwgYW5kIHRoZSBtZXRyaWMgb25lcyBhZGQgYSByb3cgcGVyIHNlY29uZFxuICAgIHdoZXRoZXIgb3Igbm90IHRoZSBpbnN0YW5jZSBzZXJ2ZXMgdHJhZmZpYy4gTGVmdCBhbG9uZSB0aGV5IG91dGdyb3cgdGhlXG4gICAgdXNhZ2UgZGF0YSB0aGV5IHNpdCBuZXh0IHRvIGFuZCBmaWxsIHRoZSB2b2x1bWUuXG5cbiAgICBXaGVuIGEgd2luZG93IGhlcmUgY2hhbmdlcywgQ2xpY2tIb3VzZSByZXBsYWNlcyB0aGUgdGFibGUgb24gdGhlIG5leHRcbiAgICByZXN0YXJ0IGFuZCBrZWVwcyB0aGUgb2xkIG9uZSwgcm93cyBhbmQgYWxsLCBhcyA8bG9nPl88Tj4uXG4gICAgY2xpY2tob3VzZS1pbml0LnNoIGdpdmVzIHRob3NlIG9sZCB0YWJsZXMgdGhlIHNhbWUgd2luZG93LlxuLS0+XG48Y2xpY2tob3VzZT5cbiAgICA8IS0tIFRoZSBtZXRyaWMsIHRyYWNlIGFuZCBwcm9maWxlIGxvZ3Mgc2FtcGxlIHRoZSBzZXJ2ZXIgZXZlcnkgc2Vjb25kIHdoZXRoZXJcbiAgICAgICAgIG9yIG5vdCBBcHB3cml0ZSBzZXJ2ZXMgdHJhZmZpYywgYW5kIG5vdGhpbmcgcmVhZHMgdGhlbSBiYWNrLCBzbyB0aGVpclxuICAgICAgICAgd3JpdGVzIGFuZCB0aGUgbWVyZ2VzIGJlaGluZCB0aGVtIGFyZSBwdXJlIG92ZXJoZWFkLiAtLT5cbiAgICA8YXN5bmNocm9ub3VzX21ldHJpY19sb2cgcmVtb3ZlPVwiMVwiLz5cbiAgICA8bWV0cmljX2xvZyByZW1vdmU9XCIxXCIvPlxuICAgIDxoaXN0b2dyYW1fbWV0cmljX2xvZyByZW1vdmU9XCIxXCIvPlxuICAgIDxxdWVyeV9tZXRyaWNfbG9nIHJlbW92ZT1cIjFcIi8+XG4gICAgPHByb2Nlc3NvcnNfcHJvZmlsZV9sb2cgcmVtb3ZlPVwiMVwiLz5cbiAgICA8dHJhY2VfbG9nIHJlbW92ZT1cIjFcIi8+XG4gICAgPCEtLSB0ZXh0X2xvZyByZXBlYXRzIHRoZSBzZXJ2ZXIgbG9nIHRoZSBjb250YWluZXIgYWxyZWFkeSB3cml0ZXMuIC0tPlxuICAgIDx0ZXh0X2xvZyByZW1vdmU9XCIxXCIvPlxuXG4gICAgPCEtLSBLZXB0IGZvciBkZWJ1Z2dpbmcsIGNhcHBlZCBzbyB0aGV5IGNhbm5vdCBmaWxsIHRoZSB2b2x1bWUuIC0tPlxuICAgIDxhc3luY2hyb25vdXNfaW5zZXJ0X2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAzIERBWSBERUxFVEU8L3R0bD48L2FzeW5jaHJvbm91c19pbnNlcnRfbG9nPlxuICAgIDxxdWVyeV9sb2c+PHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgNyBEQVkgREVMRVRFPC90dGw+PC9xdWVyeV9sb2c+XG4gICAgPHF1ZXJ5X3ZpZXdzX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEU8L3R0bD48L3F1ZXJ5X3ZpZXdzX2xvZz5cbiAgICA8cXVlcnlfdGhyZWFkX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEU8L3R0bD48L3F1ZXJ5X3RocmVhZF9sb2c+XG4gICAgPHBhcnRfbG9nPjx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDcgREFZIERFTEVURTwvdHRsPjwvcGFydF9sb2c+XG4gICAgPGJhY2tncm91bmRfc2NoZWR1bGVfcG9vbF9sb2c+PHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgNyBEQVkgREVMRVRFPC90dGw+PC9iYWNrZ3JvdW5kX3NjaGVkdWxlX3Bvb2xfbG9nPlxuXG4gICAgPCEtLSBMb25nZXIsIHNvIGl0IHN0aWxsIGNvdmVycyBhIHJlcG9ydCB0aGF0IHJlYWNoZXMgdXMgbGF0ZS4gY3Jhc2hfbG9nIGlzXG4gICAgICAgICBkZWxpYmVyYXRlbHkgbGVmdCBhbG9uZTogaXQgaXMgdGlueSBhbmQgd29ydGgga2VlcGluZy4gLS0+XG4gICAgPGVycm9yX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxNCBEQVkgREVMRVRFPC90dGw+PC9lcnJvcl9sb2c+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2UtaW5pdC5zaAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2NsaWNraG91c2UtaW5pdC5zaAogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICIjIS9iaW4vYmFzaFxuIyBUaGUgQ2xpY2tIb3VzZSBlbnRyeXBvaW50IHNvdXJjZXMgdGhpcyBmaWxlLCBzbyBhIHN1YnNoZWxsIGtlZXBzIHRoZXNlIG9wdGlvbnMgb3V0IG9mIGl0LlxuKFxuICBzZXQgLWV1byBwaXBlZmFpbFxuXG4gIGNsaWVudCgpIHtcbiAgICBjbGlja2hvdXNlLWNsaWVudCAtLWhvc3QgMTI3LjAuMC4xIC0tdXNlciBcIiRDTElDS0hPVVNFX1VTRVJcIiAtLXBhc3N3b3JkIFwiJENMSUNLSE9VU0VfUEFTU1dPUkRcIiBcIiRAXCJcbiAgfVxuXG4gICMgRmx1c2hpbmcgcmVwbGFjZXMgbG9nIHRhYmxlcyB3aG9zZSBkZWZpbml0aW9uIGNoYW5nZWQsIGtlZXBpbmcgZWFjaCBvbGQgdGFibGUgYXMgPGxvZz5fPE4+LlxuICBjbGllbnQgLS1xdWVyeSAnU1lTVEVNIEZMVVNIIExPR1MnXG5cbiAgIyBUYWJsZXMgbGVmdCBiZWhpbmQgbmV2ZXIgZXhwaXJlIG9uIHRoZWlyIG93bjogdGFrZSB0aGUgVFRMIG9mIHRoZSBsb2cgdGhhdFxuICAjIHJlcGxhY2VkIHRoaXMgb25lLCBvciBhIHdlZWsgd2hlbiB0aGUgbG9nIGlzIG5vIGxvbmdlciB3cml0dGVuIGF0IGFsbC5cbiAgIyBUaGUgbmFtZWQgbG9ncyBtdXN0IG1hdGNoIHRoZSBvbmVzIGNsaWNraG91c2UtY29uZmlnLnhtbCByZW1vdmVzOiBhIGxvZyB0aGF0XG4gICMgaXMgc3RpbGwgd3JpdHRlbiBnZXRzIHJlcGxhY2VkIG9uIHRoZSBuZXh0IHJlc3RhcnQgaWYgaXRzIFRUTCBpcyBhbHRlcmVkIGhlcmUuXG4gIGNsaWVudCAtLWZvcm1hdCBUU1ZSYXcgPDwnU1FMJyB8IGNsaWVudCAtLW11bHRpcXVlcnlcblNFTEVDVCBjb25jYXQoJ0FMVEVSIFRBQkxFIHN5c3RlbS4nLCBzdGFsZS5uYW1lLCAnIE1PRElGWSBUVEwgJywgaWYoYWN0aXZlLm5hbWUgPSAnJywgJ2V2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEUnLCBzcGxpdEJ5U3RyaW5nKCcgU0VUVElOR1MgJywgc3BsaXRCeVN0cmluZygnIFRUTCAnLCBhY3RpdmUuZW5naW5lX2Z1bGwpWzJdKVsxXSksICc7JylcbkZST00gKFxuICBTRUxFQ1QgbmFtZSwgc3BsaXRCeUNoYXIoJ18nLCBuYW1lKVstMV0gQVMgc3VmZml4LCBhcnJheVN0cmluZ0NvbmNhdChhcnJheVBvcEJhY2soc3BsaXRCeUNoYXIoJ18nLCBuYW1lKSksICdfJykgQVMgbG9nXG4gIEZST00gc3lzdGVtLnRhYmxlc1xuICBXSEVSRSBkYXRhYmFzZSA9ICdzeXN0ZW0nXG4gICAgQU5EIHBvc2l0aW9uKGVuZ2luZV9mdWxsLCAnIFRUTCAnKSA9IDBcbiAgICBBTkQgZW5kc1dpdGgoZW5naW5lLCAnTWVyZ2VUcmVlJylcbiAgICBBTkQgbmFtZSBJTiAoU0VMRUNUIHRhYmxlIEZST00gc3lzdGVtLmNvbHVtbnMgV0hFUkUgZGF0YWJhc2UgPSAnc3lzdGVtJyBBTkQgbmFtZSA9ICdldmVudF9kYXRlJyBBTkQgdHlwZSA9ICdEYXRlJylcbikgQVMgc3RhbGVcbkxFRlQgSk9JTiBzeXN0ZW0udGFibGVzIEFTIGFjdGl2ZVxuICBPTiBhY3RpdmUuZGF0YWJhc2UgPSAnc3lzdGVtJ1xuICBBTkQgYWN0aXZlLm5hbWUgPSBzdGFsZS5sb2dcbiAgQU5EIHBvc2l0aW9uKGFjdGl2ZS5lbmdpbmVfZnVsbCwgJyBUVEwgJykgPiAwXG5XSEVSRSAoZW5kc1dpdGgoc3RhbGUubG9nLCAnX2xvZycpIEFORCB0b1VJbnQ2NE9yTnVsbChzdGFsZS5zdWZmaXgpIElTIE5PVCBOVUxMKVxuICBPUiBzdGFsZS5uYW1lIElOICgnYXN5bmNocm9ub3VzX21ldHJpY19sb2cnLCAnbWV0cmljX2xvZycsICdoaXN0b2dyYW1fbWV0cmljX2xvZycsICdxdWVyeV9tZXRyaWNfbG9nJywgJ3Byb2Nlc3NvcnNfcHJvZmlsZV9sb2cnLCAndHJhY2VfbG9nJywgJ3RleHRfbG9nJylcblNRTFxuKSIKICAgIHVsaW1pdHM6CiAgICAgIG5vZmlsZToKICAgICAgICBzb2Z0OiAyNjIxNDQKICAgICAgICBoYXJkOiAyNjIxNDQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY2xpY2tob3VzZS1jbGllbnQgLS11c2VyICIkJENMSUNLSE9VU0VfVVNFUiIgLS1wYXNzd29yZCAiJCRDTElDS0hPVVNFX1BBU1NXT1JEIiAtLXF1ZXJ5ICJTRUxFQ1QgMSIgPiAvZGV2L251bGwgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDIwCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCg==",
-        "tags": [
-            "backend",
-            "backend-as-a-service",
-            "platform"
-        ],
-        "category": "backend",
-        "logo": "svgs/appwrite.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-08T19:41:04+02:00",
-        "port": "80"
-    },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
         "slogan": "Argilla is a collaboration tool for AI engineers and domain experts who need to build high-quality datasets for their projects.",
@@ -254,23 +239,6 @@
         "template_last_updated_at": "2026-09-27T23:49:51+02:00",
         "port": "80"
     },
-    "babybuddy": {
-        "documentation": "https://docs.baby-buddy.net?utm_source=coolify.io",
-        "slogan": "It helps parents track their baby's daily activities, growth, and health with ease.",
-        "compose": "c2VydmljZXM6CiAgYmFieWJ1ZGR5OgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL2JhYnlidWRkeTpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fQkFCWUJVRERZCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gVFo9RXVyb3BlL01hZHJpZAogICAgICAtIENTUkZfVFJVU1RFRF9PUklHSU5TPSRTRVJWSUNFX0ZRRE5fQkFCWUJVRERZCiAgICB2b2x1bWVzOgogICAgICAtICdiYWJ5YnVkZHktY29uZmlnOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "baby",
-            "parents",
-            "health",
-            "growth",
-            "activities"
-        ],
-        "category": "productivity",
-        "logo": "svgs/babybuddy.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "8000"
-    },
     "bento-pdf": {
         "documentation": "https://bentopdf.com/docs?utm_source=coolify.io",
         "slogan": "Process PDFs entirely in your browser. No uploads. No servers. Complete privacy.",
@@ -350,26 +318,6 @@
         "template_last_updated_at": "2026-05-09T19:19:48+05:30",
         "port": "3000"
     },
-    "bookstack": {
-        "documentation": "https://www.bookstackapp.com/docs/?utm_source=coolify.io",
-        "slogan": "BookStack is a simple, self-hosted, easy-to-use platform for organising and storing information",
-        "compose": "c2VydmljZXM6CiAgYm9va3N0YWNrOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL2Jvb2tzdGFjazpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fQk9PS1NUQUNLXzgwCiAgICAgIC0gJ0FQUF9VUkw9JHtTRVJWSUNFX0ZRRE5fQk9PS1NUQUNLfScKICAgICAgLSAnQVBQX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfQVBQS0VZfScKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL0Jlcmxpbn0nCiAgICAgIC0gREJfSE9TVD1tYXJpYWRiCiAgICAgIC0gREJfUE9SVD0zMzA2CiAgICAgIC0gJ0RCX1VTRVJOQU1FPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnREJfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotYm9va3N0YWNrYXBwfScKICAgICAgLSAnUVVFVUVfQ09OTkVDVElPTj0ke1FVRVVFX0NPTk5FQ1RJT059JwogICAgICAtICdHSVRIVUJfQVBQX0lEPSR7R0lUSFVCX0FQUF9JRH0nCiAgICAgIC0gJ0dJVEhVQl9BUFBfU0VDUkVUPSR7R0lUSFVCX0FQUF9TRUNSRVR9JwogICAgICAtICdNQUlMX0RSSVZFUj0ke01BSUxfRFJJVkVSOi1zbXRwfScKICAgICAgLSAnTUFJTF9IT1NUPSR7TUFJTF9IT1NUfScKICAgICAgLSAnTUFJTF9QT1JUPSR7TUFJTF9QT1JUOi01ODd9JwogICAgICAtICdNQUlMX0VOQ1JZUFRJT049JHtNQUlMX0VOQ1JZUFRJT046LXRsc30nCiAgICAgIC0gJ01BSUxfVVNFUk5BTUU9JHtNQUlMX1VTRVJOQU1FfScKICAgICAgLSAnTUFJTF9QQVNTV09SRD0ke01BSUxfUEFTU1dPUkR9JwogICAgICAtICdNQUlMX0ZST009JHtNQUlMX0ZST019JwogICAgICAtICdNQUlMX0ZST01fTkFNRT0ke01BSUxfRlJPTV9OQU1FOi1Cb29rU3RhY2t9JwogICAgdm9sdW1lczoKICAgICAgLSAnYm9va3N0YWNrLWRhdGE6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiBodHRwOi8vMTI3LjAuMC4xOjgwLycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIG1hcmlhZGI6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvbWFyaWFkYjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL0Jlcmxpbn0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWJvb2tzdGFja30nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgdm9sdW1lczoKICAgICAgLSAnYm9va3N0YWNrLW1hcmlhZGItZGF0YTovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "free-and-open-source",
-            "mfa",
-            "dark-light-themes",
-            "searchable",
-            "connected",
-            "simple-interface",
-            "diagramms",
-            "notes"
-        ],
-        "category": "cms",
-        "logo": "svgs/bookstack.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "browserless": {
         "documentation": "https://docs.browserless.io/?utm_source=coolify.io",
         "slogan": "A headless Chrome browser as a service.",
@@ -386,21 +334,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "3000"
     },
-    "budge": {
-        "documentation": "https://github.com/linuxserver/budge?utm_source=coolify.io",
-        "slogan": "A budgeting personal finance app.",
-        "compose": "c2VydmljZXM6CiAgYnVkZ2U6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvYnVkZ2U6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0JVREdFCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gVFo9RXVyb3BlL01hZHJpZAogICAgdm9sdW1lczoKICAgICAgLSAnYnVkZ2UtY29uZmlnOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
-        "tags": [
-            "personal finance",
-            "budgeting",
-            "expense tracking"
-        ],
-        "category": "finance",
-        "logo": "svgs/budge.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
         "slogan": "Low code platform for building business apps and workflows in minutes. Supports PostgreSQL, MySQL, MSSQL, MongoDB, Rest API, Docker, K8s, and more.",
@@ -421,7 +354,7 @@
         "category": "automation",
         "logo": "svgs/budibase.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-17T10:54:40+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "10000"
     },
     "bugsink": {
@@ -454,7 +387,7 @@
         "category": "Mail",
         "logo": "svgs/bulwark.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-12T17:21:51+02:00",
+        "template_last_updated_at": "2026-10-01T20:31:00+02:00",
         "port": "3000"
     },
     "buzz": {
@@ -474,7 +407,7 @@
         "category": "messaging",
         "logo": "svgs/buzz.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-12T19:27:01+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "calibre-web-automated-book-downloader": {
@@ -555,26 +488,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "5679"
     },
-    "castopod": {
-        "documentation": "https://docs.castopod.org/main/en/?utm_source=coolify.io",
-        "slogan": "Castopod is a free & open-source hosting platform made for podcasters who want engage and interact with their audience.",
-        "compose": "c2VydmljZXM6CiAgY2FzdG9wb2Q6CiAgICBpbWFnZTogJ2Nhc3RvcG9kL2Nhc3RvcG9kOjEuMTUuNCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Nhc3RvcG9kLW1lZGlhOi92YXIvd3d3L2Nhc3RvcG9kL3B1YmxpYy9tZWRpYScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9DQVNUT1BPRF84MDgwCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9Y2FzdG9wb2QKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgICAtICdDUF9ESVNBQkxFX0hUVFBTPSR7Q1BfRElTQUJMRV9IVFRQUzotMX0nCiAgICAgIC0gQ1BfQkFTRVVSTD0kU0VSVklDRV9GUUROX0NBU1RPUE9ECiAgICAgIC0gQ1BfQU5BTFlUSUNTX1NBTFQ9JFNFUlZJQ0VfUkVBTEJBU0U2NF82NF9TQUxUCiAgICAgIC0gQ1BfQ0FDSEVfSEFORExFUj1yZWRpcwogICAgICAtIENQX1JFRElTX0hPU1Q9cmVkaXMKICAgICAgLSBDUF9SRURJU19QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9SRURJUwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwODAvaGVhbHRoJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4yJwogICAgdm9sdW1lczoKICAgICAgLSAnY2FzdG9wb2QtZGI6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01ZU1FMCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9Y2FzdG9wb2QKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjcuMi1hbHBpbmUnCiAgICBjb21tYW5kOiAnLS1yZXF1aXJlcGFzcyAkU0VSVklDRV9QQVNTV09SRF9SRURJUycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Nhc3RvcG9kLWNhY2hlOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdyZWRpcy1jbGkgLWEgJFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMgcGluZyB8IGdyZXAgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "podcast",
-            "media",
-            "audio",
-            "video",
-            "streaming",
-            "hosting",
-            "platform",
-            "castopod"
-        ],
-        "category": "media",
-        "logo": "svgs/castopod.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-03-13T12:05:06+05:30",
-        "port": "8080"
-    },
     "celld": {
         "documentation": "https://celld.dev/docs?utm_source=coolify.io",
         "slogan": "Self-hosted, distributed Durable Objects powered by Deno.",
@@ -705,54 +618,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "8000"
     },
-    "classicpress-with-mariadb": {
-        "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
-        "slogan": "A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).",
-        "compose": "c2VydmljZXM6CiAgY2xhc3NpY3ByZXNzOgogICAgaW1hZ2U6ICdjbGFzc2ljcHJlc3MvY2xhc3NpY3ByZXNzOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NsYXNzaWNwcmVzcy1maWxlczovdmFyL3d3dy9odG1sJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0NMQVNTSUNQUkVTUwogICAgICAtIENMQVNTSUNQUkVTU19EQl9IT1NUPW1hcmlhZGIKICAgICAgLSBDTEFTU0lDUFJFU1NfREJfVVNFUj0kU0VSVklDRV9VU0VSX0NMQVNTSUNQUkVTUwogICAgICAtIENMQVNTSUNQUkVTU19EQl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DTEFTU0lDUFJFU1MKICAgICAgLSBDTEFTU0lDUFJFU1NfREJfTkFNRT1jbGFzc2ljcHJlc3MKICAgIGRlcGVuZHNfb246CiAgICAgIC0gbWFyaWFkYgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21hcmlhZGItZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUk9PVAogICAgICAtIE1ZU1FMX0RBVEFCQVNFPWNsYXNzaWNwcmVzcwogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9DTEFTU0lDUFJFU1MKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DTEFTU0lDUFJFU1MKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management"
-        ],
-        "category": "cms",
-        "logo": "svgs/classicpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "classicpress-with-mysql": {
-        "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
-        "slogan": "A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).",
-        "compose": "c2VydmljZXM6CiAgY2xhc3NpY3ByZXNzOgogICAgaW1hZ2U6ICdjbGFzc2ljcHJlc3MvY2xhc3NpY3ByZXNzOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NsYXNzaWNwcmVzcy1maWxlczovdmFyL3d3dy9odG1sJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0NMQVNTSUNQUkVTUwogICAgICAtIENMQVNTSUNQUkVTU19EQl9IT1NUPW15c3FsCiAgICAgIC0gQ0xBU1NJQ1BSRVNTX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9DTEFTU0lDUFJFU1MKICAgICAgLSBDTEFTU0lDUFJFU1NfREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfQ0xBU1NJQ1BSRVNTCiAgICAgIC0gQ0xBU1NJQ1BSRVNTX0RCX05BTUU9Y2xhc3NpY3ByZXNzCiAgICBkZXBlbmRzX29uOgogICAgICAtIG15c3FsCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAKICBteXNxbDoKICAgIGltYWdlOiAnbXlzcWw6OCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ215c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1jbGFzc2ljcHJlc3MKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfQ0xBU1NJQ1BSRVNTCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfQ0xBU1NJQ1BSRVNTCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management"
-        ],
-        "category": "cms",
-        "logo": "svgs/classicpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "classicpress-without-database": {
-        "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
-        "slogan": "A lightweight, stable, instantly familiar free open-source content management system, based on WordPress without the block editor (Gutenberg).",
-        "compose": "c2VydmljZXM6CiAgY2xhc3NpY3ByZXNzOgogICAgaW1hZ2U6ICdjbGFzc2ljcHJlc3MvY2xhc3NpY3ByZXNzOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NsYXNzaWNwcmVzcy1maWxlczovdmFyL3d3dy9odG1sJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0NMQVNTSUNQUkVTUwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management"
-        ],
-        "category": "cms",
-        "logo": "svgs/classicpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "cloudbeaver": {
         "documentation": "https://dbeaver.com/docs/cloudbeaver/?utm_source=coolify.io",
         "slogan": "CloudBeaver is a lightweight web application designed for comprehensive data management.",
@@ -813,23 +678,6 @@
         "template_last_updated_at": "2026-03-03T11:20:40+05:30",
         "port": "5212"
     },
-    "cockpit": {
-        "documentation": "https://getcockpit.com/documentation/?utm_source=coolify.io",
-        "slogan": "Cockpit is a headless content platform that is lightweight, fast and ready for takeoff.",
-        "compose": "c2VydmljZXM6CiAgY29ja3BpdDoKICAgIGltYWdlOiAnY29ja3BpdGhxL2NvY2twaXQ6Y29yZS1sYXRlc3QnCiAgICB2b2x1bWVzOgogICAgICAtICdjb2NrcGl0LWNvbmZpZzovdmFyL3d3dy9odG1sL2NvbmZpZycKICAgICAgLSAnY29ja3BpdC1zcGFjZXM6L3Zhci93d3cvaHRtbC8uc3BhY2VzJwogICAgICAtICdjb2NrcGl0LXN0b3JhZ2U6L3Zhci93d3cvaHRtbC9zdG9yYWdlJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctcScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xL2FwaS9zeXN0ZW0vaGVhbHRoY2hlY2snCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cockpit",
-            "headless",
-            "cms",
-            "database",
-            "nosql"
-        ],
-        "category": "cms",
-        "logo": "svgs/cockpit.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "code-server": {
         "documentation": "https://coder.com/docs/code-server/latest?utm_source=coolify.io",
         "slogan": "Code-Server is a web-based code editor that enables remote coding and collaboration from any device, anywhere.",
@@ -1120,36 +968,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "3000"
     },
-    "dokuwiki": {
-        "documentation": "https://www.dokuwiki.org/?utm_source=coolify.io",
-        "slogan": "A lightweight and easy-to-use wiki platform for creating and managing documentation and knowledge bases.",
-        "compose": "c2VydmljZXM6CiAgZG9rdXdpa2k6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvZG9rdXdpa2k6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0RPS1VXSUtJCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gVFo9RXVyb3BlL01hZHJpZAogICAgdm9sdW1lczoKICAgICAgLSAnZG9rdXdpa2ktY29uZmlnOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
-        "tags": [
-            "wiki",
-            "documentation",
-            "knowledge",
-            "base"
-        ],
-        "category": "cms",
-        "logo": "svgs/dokuwiki.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "dolibarr": {
-        "documentation": "https://www.dolibarr.org/documentation-home.php?utm_source=coolify.io",
-        "slogan": "Dolibarr is a modern software package to manage your organization's activity (contacts, quotes, invoices, orders, stocks, agenda, hr, expense reports, accountancy, ecm, manufacturing, ...).",
-        "compose": "c2VydmljZXM6CiAgZG9saWJhcnI6CiAgICBpbWFnZTogJ2RvbGliYXJyL2RvbGliYXJyOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9ET0xJQkFSUl84MAogICAgICAtICdXV1dfVVNFUl9JRD0ke1dXV19VU0VSX0lEOi0xMDAwfScKICAgICAgLSAnV1dXX0dST1VQX0lEPSR7V1dXX0dST1VQX0lEOi0xMDAwfScKICAgICAgLSBET0xJX0RCX0hPU1Q9bWFyaWFkYgogICAgICAtICdET0xJX0RCX05BTUU9JHtNWVNRTF9EQVRBQkFTRTotZG9saWJhcnItZGJ9JwogICAgICAtICdET0xJX0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdET0xJX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ0RPTElfVVJMX1JPT1Q9JHtTRVJWSUNFX0ZRRE5fRE9MSUJBUlJ9JwogICAgICAtICdET0xJX0FETUlOX0xPR0lOPSR7U0VSVklDRV9VU0VSX0RPTElCQVJSfScKICAgICAgLSAnRE9MSV9BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfRE9MSUJBUlJ9JwogICAgICAtICdET0xJX0NST049JHtET0xJX0NST046LTB9JwogICAgICAtICdET0xJX0lOSVRfREVNTz0ke0RPTElfSU5JVF9ERU1POi0wfScKICAgICAgLSAnRE9MSV9DT01QQU5ZX05BTUU9JHtET0xJX0NPTVBBTllfTkFNRTotTXlCaWdDb21wYW55fScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2RvbGliYXJyX2RvY3M6L3Zhci93d3cvZG9jdW1lbnRzJwogICAgICAtICdkb2xpYmFycl9jdXN0b206L3Zhci93d3cvaHRtbC9jdXN0b20nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1kb2xpYmFyci1kYn0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2RvbGliYXJyX21hcmlhZGJfZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "crm",
-            "erp"
-        ],
-        "category": "productivity",
-        "logo": "svgs/dolibarr.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
     "dozzle-with-auth": {
         "documentation": "https://dozzle.dev/?utm_source=coolify.io",
         "slogan": "Dozzle is a simple and lightweight web UI for Docker logs.",
@@ -1199,23 +1017,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "4983"
     },
-    "drupal-with-postgresql": {
-        "documentation": "https://www.drupal.org/about?utm_source=coolify.io",
-        "slogan": "Drupal is a free and open-source web content management system written in PHP and distributed under the GNU General Public License.",
-        "compose": "c2VydmljZXM6CiAgZHJ1cGFsOgogICAgaW1hZ2U6ICdkcnVwYWw6MTAtYXBhY2hlJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0RSVVBBTAogICAgICAtIERCX0hPU1Q9cG9zdGdyZXMKICAgICAgLSBEQl9OQU1FPXBvc3RncmVzCiAgICAgIC0gREJfVVNFUj1wb3N0Z3JlcwogICAgICAtIERCX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogdm9sdW1lCiAgICAgICAgc291cmNlOiBkcnVwYWxfbW9kdWxlcwogICAgICAgIHRhcmdldDogL3Zhci93d3cvaHRtbC9tb2R1bGVzCiAgICAgICAgaXNfZGlyZWN0b3J5OiB0cnVlCiAgICAgIC0KICAgICAgICB0eXBlOiB2b2x1bWUKICAgICAgICBzb3VyY2U6IGRydXBhbF9wcm9maWxlcwogICAgICAgIHRhcmdldDogL3Zhci93d3cvaHRtbC9wcm9maWxlcwogICAgICAgIGlzX2RpcmVjdG9yeTogdHJ1ZQogICAgICAtCiAgICAgICAgdHlwZTogdm9sdW1lCiAgICAgICAgc291cmNlOiBkcnVwYWxfdGhlbWVzCiAgICAgICAgdGFyZ2V0OiAvdmFyL3d3dy9odG1sL3RoZW1lcwogICAgICAgIGlzX2RpcmVjdG9yeTogdHJ1ZQogICAgICAtCiAgICAgICAgdHlwZTogdm9sdW1lCiAgICAgICAgc291cmNlOiBkcnVwYWxfc2l0ZXMKICAgICAgICB0YXJnZXQ6IC92YXIvd3d3L2h0bWwvc2l0ZXMKICAgICAgICBpc19kaXJlY3Rvcnk6IHRydWUKICAgIGRlcGVuZHNfb246CiAgICAgIC0gcG9zdGdyZXMKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiBodHRwOi8vbG9jYWxob3N0OjgwIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNicKICAgIGVudmlyb25tZW50OgogICAgICAtIFBPU1RHUkVTX0RCPXBvc3RncmVzCiAgICAgIC0gUE9TVEdSRVNfVVNFUj1wb3N0Z3JlcwogICAgICAtIFBPU1RHUkVTX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDIwCg==",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "postgresql"
-        ],
-        "category": "cms",
-        "logo": "svgs/drupal.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "duplicati": {
         "documentation": "https://duplicati.readthedocs.io?utm_source=coolify.io",
         "slogan": "Duplicati is a backup solution, allowing you to make scheduled backups with encryption.",
@@ -1230,21 +1031,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "8200"
     },
-    "easyappointments": {
-        "documentation": "https://easyappointments.org/?utm_source=coolify.io",
-        "slogan": "Schedule Anything. Let's start with easy! Get the best free online appointment scheduler on your server, today.",
-        "compose": "c2VydmljZXM6CiAgZWFzeWFwcG9pbnRtZW50czoKICAgIGltYWdlOiAnYWxleHRzZWxlZ2lkaXMvZWFzeWFwcG9pbnRtZW50czpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fRUFTWUFQUE9JTlRNRU5UU184MAogICAgICAtICdCQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9FQVNZQVBQT0lOVE1FTlRTfScKICAgICAgLSBEQl9IT1NUPW15c3FsCiAgICAgIC0gREJfTkFNRT1lYXN5YXBwb2ludG1lbnRzCiAgICAgIC0gREJfVVNFUk5BTUU9cm9vdAogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfRUFTWUFQUE9JTlRNRU5UU30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIG15c3FsCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMzAKICBteXNxbDoKICAgIGltYWdlOiAnbXlzcWw6OCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Vhc3lhcHBvaW50bWVudHMtbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9FQVNZQVBQT0lOVE1FTlRTfScKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1lYXN5YXBwb2ludG1lbnRzCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "calendar",
-            "scheduling",
-            "database"
-        ],
-        "category": "productivity",
-        "logo": "svgs/easyappointments.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "elasticsearch-with-kibana": {
         "documentation": "https://www.elastic.co/docs/deploy-manage/deploy/self-managed/install-kibana-with-docker?utm_source=coolify.io",
         "slogan": "Elastic + Kibana is a Free and Open Source Search, Monitoring, and Visualization Stack",
@@ -1390,7 +1176,7 @@
         "category": "media",
         "logo": "svgs/ente-photos.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-22T16:05:17+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8080"
     },
     "ente-photos": {
@@ -1429,24 +1215,6 @@
         "template_last_updated_at": "2026-01-05T14:20:17+01:00",
         "port": "6052"
     },
-    "espocrm": {
-        "documentation": "https://docs.espocrm.com?utm_source=coolify.io",
-        "slogan": "EspoCRM is a free and open-source CRM platform.",
-        "compose": "c2VydmljZXM6CiAgZXNwb2NybToKICAgIGltYWdlOiAnZXNwb2NybS9lc3BvY3JtOjEwJwogICAgY29udGFpbmVyX25hbWU6IGVzcG9jcm0KICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9FU1BPQ1JNCiAgICAgIC0gJ0VTUE9DUk1fQURNSU5fVVNFUk5BTUU9JHtFU1BPQ1JNX0FETUlOX1VTRVJOQU1FOi1hZG1pbn0nCiAgICAgIC0gJ0VTUE9DUk1fQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSBFU1BPQ1JNX0RBVEFCQVNFX1BMQVRGT1JNPU15c3FsCiAgICAgIC0gRVNQT0NSTV9EQVRBQkFTRV9IT1NUPWVzcG9jcm0tZGIKICAgICAgLSAnRVNQT0NSTV9EQVRBQkFTRV9OQU1FPSR7TUFSSUFEQl9EQVRBQkFTRTotZXNwb2NybX0nCiAgICAgIC0gJ0VTUE9DUk1fREFUQUJBU0VfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnRVNQT0NSTV9EQVRBQkFTRV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ0VTUE9DUk1fU0lURV9VUkw9JHtTRVJWSUNFX0ZRRE5fRVNQT0NSTX0nCiAgICB2b2x1bWVzOgogICAgICAtICdlc3BvY3JtLWRhdGE6L3Zhci93d3cvaHRtbC9kYXRhJwogICAgICAtICdlc3BvY3JtLWN1c3RvbTovdmFyL3d3dy9odG1sL2N1c3RvbScKICAgICAgLSAnZXNwb2NybS1jdXN0b20tY2xpZW50Oi92YXIvd3d3L2h0bWwvY2xpZW50L2N1c3RvbScKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBkZXBlbmRzX29uOgogICAgICBlc3BvY3JtLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gYmluL2NvbW1hbmQKICAgICAgICAtIGFwcC1jaGVjawogICAgICBzdGFydF9wZXJpb2Q6IDIwcwogICAgICBpbnRlcnZhbDogNjBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAzCiAgZXNwb2NybS1kYWVtb246CiAgICBpbWFnZTogJ2VzcG9jcm0vZXNwb2NybToxMCcKICAgIGNvbnRhaW5lcl9uYW1lOiBlc3BvY3JtLWRhZW1vbgogICAgdm9sdW1lc19mcm9tOgogICAgICAtIGVzcG9jcm0KICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnRyeXBvaW50OiBkb2NrZXItZGFlbW9uLnNoCiAgICBkZXBlbmRzX29uOgogICAgICBlc3BvY3JtOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gYmluL2NvbW1hbmQKICAgICAgICAtIGFwcC1jaGVjawogICAgICBzdGFydF9wZXJpb2Q6IDIwcwogICAgICBpbnRlcnZhbDogMTgwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwogIGVzcG9jcm0td2Vic29ja2V0OgogICAgaW1hZ2U6ICdlc3BvY3JtL2VzcG9jcm06MTAnCiAgICBjb250YWluZXJfbmFtZTogZXNwb2NybS13ZWJzb2NrZXQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9FU1BPQ1JNX1dFQlNPQ0tFVF84MDgwCiAgICAgIC0gRVNQT0NSTV9DT05GSUdfVVNFX1dFQl9TT0NLRVQ9dHJ1ZQogICAgICAtIEVTUE9DUk1fQ09ORklHX1dFQl9TT0NLRVRfVVJMPSRTRVJWSUNFX0ZRRE5fRVNQT0NSTV9XRUJTT0NLRVQKICAgICAgLSAnRVNQT0NSTV9DT05GSUdfV0VCX1NPQ0tFVF9aRVJPX01fUV9TVUJTQ1JJQkVSX0RTTj10Y3A6Ly8qOjc3NzcnCiAgICAgIC0gJ0VTUE9DUk1fQ09ORklHX1dFQl9TT0NLRVRfWkVST19NX1FfU1VCTUlTU0lPTl9EU049dGNwOi8vZXNwb2NybS13ZWJzb2NrZXQ6Nzc3NycKICAgIHZvbHVtZXNfZnJvbToKICAgICAgLSBlc3BvY3JtCiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAogICAgZW50cnlwb2ludDogZG9ja2VyLXdlYnNvY2tldC5zaAogICAgZGVwZW5kc19vbjoKICAgICAgZXNwb2NybToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGJpbi9jb21tYW5kCiAgICAgICAgLSBhcHAtY2hlY2sKICAgICAgc3RhcnRfcGVyaW9kOiAyMHMKICAgICAgaW50ZXJ2YWw6IDE4MHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDMKICBlc3BvY3JtLWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjEyLjMnCiAgICBjb250YWluZXJfbmFtZTogZXNwb2NybS1kYgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01BUklBREJfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1lc3BvY3JtfScKICAgICAgLSAnTUFSSUFEQl9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNQVJJQURCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnTUFSSUFEQl9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2VzcG9jcm0tZGI6L3Zhci9saWIvbXlzcWwnCiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCg==",
-        "tags": [
-            "crm",
-            "self-hosted",
-            "open-source",
-            "workflow",
-            "automation",
-            "project management"
-        ],
-        "category": "productivity",
-        "logo": "svgs/espocrm.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-07-03T15:15:43+03:00",
-        "port": "80"
-    },
     "evolution-api": {
         "documentation": "https://doc.evolution-api.com/v2/en/get-started/introduction?utm_source=coolify.io",
         "slogan": "Multi-platform messaging (whatsapp and more) integration API",
@@ -1563,22 +1331,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "5000"
     },
-    "firefly": {
-        "documentation": "https://firefly-iii.org?utm_source=coolify.io",
-        "slogan": "A personal finances manager that can help you save money.",
-        "compose": "c2VydmljZXM6CiAgZmlyZWZseToKICAgIGltYWdlOiAnZmlyZWZseWlpaS9jb3JlOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GSVJFRkxZXzgwODAKICAgICAgLSBBUFBfS0VZPSRTRVJWSUNFX0JBU0U2NF9BUFBLRVkKICAgICAgLSBEQl9IT1NUPW15c3FsCiAgICAgIC0gREJfUE9SVD0zMzA2CiAgICAgIC0gREJfQ09OTkVDVElPTj1teXNxbAogICAgICAtICdEQl9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1maXJlZmx5fScKICAgICAgLSBEQl9VU0VSTkFNRT0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUwKICAgICAgLSBTVEFUSUNfQ1JPTl9UT0tFTj0kU0VSVklDRV9CQVNFNjRfQ1JPTlRPS0VOCiAgICAgIC0gJ1RSVVNURURfUFJPWElFUz0qJwogICAgdm9sdW1lczoKICAgICAgLSAnZmlyZWZseS11cGxvYWQ6L3Zhci93d3cvaHRtbC9zdG9yYWdlL3VwbG9hZCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgbXlzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBteXNxbDoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotZmlyZWZseX0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWFyaWFkYi1hZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgICAgLSAnLXVyb290JwogICAgICAgIC0gJy1wJHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ZpcmVmbHktbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICBjcm9uOgogICAgaW1hZ2U6IGFscGluZQogICAgZW50cnlwb2ludDoKICAgICAgLSAvZW50cnlwb2ludC5zaAogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2VudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL3NoXG4jIFN1YnN0aXR1dGUgdGhlIGVudmlyb25tZW50IHZhcmlhYmxlIGludG8gdGhlIGNyb24gY29tbWFuZFxuQ1JPTl9DT01NQU5EPVwiMCAzICogKiAqIHdnZXQgLXFPLSBodHRwOi8vZmlyZWZseTo4MDgwL2FwaS92MS9jcm9uLyR7U1RBVElDX0NST05fVE9LRU59XCJcbiMgQWRkIHRoZSBjcm9uIGNvbW1hbmQgdG8gdGhlIGNyb250YWJcbmVjaG8gXCIkQ1JPTl9DT01NQU5EXCIgfCBjcm9udGFiIC1cbiMgU3RhcnQgdGhlIGNyb24gZGFlbW9uIGluIHRoZSBmb3JlZ3JvdW5kIHdpdGggbG9nZ2luZyB0byBzdGRvdXRcbmNyb25kIC1mIC1MIC9kZXYvc3Rkb3V0IgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU1RBVElDX0NST05fVE9LRU49JFNFUlZJQ0VfQkFTRTY0X0NST05UT0tFTgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdscyAvZW50cnlwb2ludC5zaCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiA0MHMK",
-        "tags": [
-            "finance",
-            "money",
-            "personal",
-            "manager"
-        ],
-        "category": "finance",
-        "logo": "svgs/firefly.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T10:43:04+02:00",
-        "port": "8080"
-    },
     "firefox": {
         "documentation": "https://github.com/jlesage/docker-firefox?utm_source=coolify.io",
         "slogan": "Fast, private, and self-hosted secure browser for browsing without limits.",
@@ -1696,7 +1448,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-mysql": {
@@ -1714,7 +1466,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-postgresql": {
@@ -1732,7 +1484,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-runner-with-mariadb": {
@@ -1754,7 +1506,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-runner-with-mysql": {
@@ -1776,7 +1528,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-runner-with-postgresql": {
@@ -1798,7 +1550,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo-with-runner": {
@@ -1819,7 +1571,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "forgejo": {
@@ -1836,7 +1588,7 @@
         "category": "git",
         "logo": "svgs/forgejo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "formbricks": {
@@ -1852,7 +1604,7 @@
         "category": "productivity",
         "logo": "svgs/formbricks.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "foundryvtt": {
@@ -1872,78 +1624,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "30000"
     },
-    "freescout": {
-        "documentation": "https://github.com/freescout-help-desk/freescout/wiki/?utm_source=coolify.io",
-        "slogan": "FreeScout is the super lightweight and powerful free open source help desk and shared inbox written in PHP (Laravel framework).",
-        "compose": "c2VydmljZXM6CiAgZnJlZXNjb3V0OgogICAgaW1hZ2U6ICd0aXJlZG9maXQvZnJlZXNjb3V0OmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ZyZWVzY291dC1kYXRhOi9kYXRhJwogICAgICAtICdmcmVlc2NvdXQtbG9nczovd3d3L2xvZ3MnCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fRlJFRVNDT1VUXzgwCiAgICAgIC0gREJfSE9TVD1tYXJpYWRiCiAgICAgIC0gJ0RCX05BTUU9JHtNQVJJQURCX0RBVEFCQVNFOi1mcmVlc2NvdXR9JwogICAgICAtICdEQl9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREI6LWZyZWVzY291dH0nCiAgICAgIC0gJ0RCX1BBU1M9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtICdTSVRFX1VSTD0ke1NFUlZJQ0VfRlFETl9GUkVFU0NPVVR9JwogICAgICAtICdBRE1JTl9FTUFJTD0ke0FETUlOX0VNQUlMOi1hZG1pbkBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ0FETUlOX1BBU1M9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnRElTUExBWV9FUlJPUlM9JHtESVNQTEFZX0VSUk9SUzotRkFMU0V9JwogICAgICAtICdUSU1FWk9ORT0ke1RJTUVaT05FOi1VVEN9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xJwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbWFyaWFkYjoKICAgIGltYWdlOiBtYXJpYWRiCiAgICB2b2x1bWVzOgogICAgICAtICdtYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUFSSUFEQl9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgICAgLSAnTUFSSUFEQl9EQVRBQkFTRT0ke01BUklBREJfREFUQUJBU0V9JwogICAgICAtICdNQVJJQURCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01BUklBREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
-        "tags": [
-            "helpdesk",
-            "support",
-            "ticketing",
-            "customer-support"
-        ],
-        "category": "helpdesk",
-        "logo": "svgs/freescout.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "freshrss-with-mariadb": {
-        "documentation": "https://freshrss.org/index.html?utm_source=coolify.io",
-        "slogan": "A free, self-hostable feed aggregator.",
-        "compose": "c2VydmljZXM6CiAgZnJlc2hyc3M6CiAgICBpbWFnZTogJ2ZyZXNocnNzL2ZyZXNocnNzOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GUkVTSFJTU184MAogICAgICAtICdDUk9OX01JTj0ke0NST05fTUlOOi0xLDMxfScKICAgICAgLSAnTUFSSUFEQl9EQj0ke01BUklBREJfREFUQUJBU0U6LWZyZXNocnNzfScKICAgICAgLSAnTUFSSUFEQl9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNQVJJQURCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ZyZXNocnNzLWRhdGE6L3Zhci93d3cvRnJlc2hSU1MvZGF0YScKICAgICAgLSAnZnJlc2hyc3MtZXh0ZW5zaW9uczovdmFyL3d3dy9GcmVzaFJTUy9leHRlbnNpb25zJwogICAgZGVwZW5kc19vbjoKICAgICAgZnJlc2hyc3MtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAiYmFzaCAtYyAnOj4gL2Rldi90Y3AvMTI3LjAuMC4xLzgwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwogIGZyZXNocnNzLWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTVlTUUxfUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9ST09UCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TUFSSUFEQl9EQVRBQkFTRTotZnJlc2hyc3N9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "rss",
-            "feed"
-        ],
-        "category": "RSS",
-        "logo": "svgs/freshrss.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "freshrss-with-mysql": {
-        "documentation": "https://freshrss.org/index.html?utm_source=coolify.io",
-        "slogan": "A free, self-hostable feed aggregator.",
-        "compose": "c2VydmljZXM6CiAgZnJlc2hyc3M6CiAgICBpbWFnZTogJ2ZyZXNocnNzL2ZyZXNocnNzOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GUkVTSFJTU184MAogICAgICAtICdDUk9OX01JTj0ke0NST05fTUlOOi0xLDMxfScKICAgICAgLSAnTVlTUUxfREI9JHtNWVNRTF9EQVRBQkFTRTotZnJlc2hyc3N9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ZyZXNocnNzLWRhdGE6L3Zhci93d3cvRnJlc2hSU1MvZGF0YScKICAgICAgLSAnZnJlc2hyc3MtZXh0ZW5zaW9uczovdmFyL3d3dy9GcmVzaFJTUy9leHRlbnNpb25zJwogICAgZGVwZW5kc19vbjoKICAgICAgZnJlc2hyc3MtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAiYmFzaCAtYyAnOj4gL2Rldi90Y3AvMTI3LjAuMC4xLzgwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwogIGZyZXNocnNzLWRiOgogICAgaW1hZ2U6ICdteXNxbDo4JwogICAgdm9sdW1lczoKICAgICAgLSAnbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUk9PVAogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1mcmVzaHJzc30nCiAgICAgIC0gTVlTUUxfVVNFUj0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "rss",
-            "feed"
-        ],
-        "category": "RSS",
-        "logo": "svgs/freshrss.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "freshrss-with-postgresql": {
-        "documentation": "https://freshrss.org/index.html?utm_source=coolify.io",
-        "slogan": "A free, self-hostable feed aggregator.",
-        "compose": "c2VydmljZXM6CiAgZnJlc2hyc3M6CiAgICBpbWFnZTogJ2ZyZXNocnNzL2ZyZXNocnNzOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GUkVTSFJTU184MAogICAgICAtICdDUk9OX01JTj0ke0NST05fTUlOOi0xLDMxfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1mcmVzaHJzc30nCiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSBQT1NUR1JFU19IT1NUPWZyZXNocnNzLWRiCiAgICB2b2x1bWVzOgogICAgICAtICdmcmVzaHJzcy1kYXRhOi92YXIvd3d3L0ZyZXNoUlNTL2RhdGEnCiAgICAgIC0gJ2ZyZXNocnNzLWV4dGVuc2lvbnM6L3Zhci93d3cvRnJlc2hSU1MvZXh0ZW5zaW9ucycKICAgIGRlcGVuZHNfb246CiAgICAgIGZyZXNocnNzLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gImJhc2ggLWMgJzo+IC9kZXYvdGNwLzEyNy4wLjAuMS84MCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDMKICBmcmVzaHJzcy1kYjoKICAgIGltYWdlOiAncG9zdGdyZXM6MTYnCiAgICB2b2x1bWVzOgogICAgICAtICdmcmVzaHJzcy1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1mcmVzaHJzc30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "rss",
-            "feed"
-        ],
-        "category": "RSS",
-        "logo": "svgs/freshrss.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "freshrss": {
-        "documentation": "https://freshrss.org/index.html?utm_source=coolify.io",
-        "slogan": "A free, self-hostable feed aggregator.",
-        "compose": "c2VydmljZXM6CiAgZnJlc2hyc3M6CiAgICBpbWFnZTogJ2ZyZXNocnNzL2ZyZXNocnNzOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GUkVTSFJTU184MAogICAgICAtICdDUk9OX01JTj0ke0NST05fTUlOOi0xLDMxfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ZyZXNocnNzLWRhdGE6L3Zhci93d3cvRnJlc2hSU1MvZGF0YScKICAgICAgLSAnZnJlc2hyc3MtZXh0ZW5zaW9uczovdmFyL3d3dy9GcmVzaFJTUy9leHRlbnNpb25zJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc6PiAvZGV2L3RjcC8xMjcuMC4wLjEvODAnIHx8IGV4aXQgMSIKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAzCg==",
-        "tags": [
-            "rss",
-            "feed"
-        ],
-        "category": "RSS",
-        "logo": "svgs/freshrss.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
     "garage": {
         "documentation": "https://garagehq.deuxfleurs.fr/documentation/?utm_source=coolify.io",
         "slogan": "Garage is an S3-compatible distributed object storage service designed for self-hosting.",
@@ -2168,22 +1848,6 @@
         "template_last_updated_at": "2026-02-10T11:22:57+05:30",
         "port": "8000"
     },
-    "glpi": {
-        "documentation": "https://help.glpi-project.org/documentation?utm_source=coolify.io",
-        "slogan": "GLPI (Gestionnaire Libre de Parc Informatique) is a free, open-source IT Service Management (ITSM) platform used for IT asset management, helpdesk, and service desk operations.",
-        "compose": "c2VydmljZXM6CiAgZ2xwaToKICAgIGltYWdlOiAnZ2xwaS9nbHBpOjExJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0dMUElfODAKICAgICAgLSBHTFBJX0RCX0hPU1Q9Z2xwaS1kYgogICAgICAtIEdMUElfREJfUE9SVD0zMzA2CiAgICAgIC0gJ0dMUElfREJfTkFNRT0ke01ZU1FMX0RBVEFCQVNFOi1nbHBpLWRifScKICAgICAgLSAnR0xQSV9EQl9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnR0xQSV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgdm9sdW1lczoKICAgICAgLSAnZ2xwaS1kYXRhOi92YXIvZ2xwaTpydycKICAgIGRlcGVuZHNfb246CiAgICAgIGdscGktZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdC8nCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICBnbHBpLWRiOgogICAgaW1hZ2U6ICdteXNxbDo4JwogICAgdm9sdW1lczoKICAgICAgLSAnbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotZ2xwaS1kYn0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "helpdesk",
-            "ticketing",
-            "support",
-            "open-source"
-        ],
-        "category": "helpdesk",
-        "logo": "svgs/glpi.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-01-13T21:07:54+01:00",
-        "port": "80"
-    },
     "goatcounter": {
         "documentation": "https://www.goatcounter.com/help?utm_source=coolify.io",
         "slogan": "Lightweight web analytics platform.",
@@ -2327,23 +1991,6 @@
         "template_last_updated_at": "2026-02-16T15:13:50+02:00",
         "port": "8484"
     },
-    "grocy": {
-        "documentation": "https://github.com/grocy/grocy?utm_source=coolify.io",
-        "slogan": "Grocy is a web-based household management and grocery list application.",
-        "compose": "c2VydmljZXM6CiAgZ3JvY3k6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvZ3JvY3k6NC42LjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fR1JPQ1kKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSBUWj1FdXJvcGUvTWFkcmlkCiAgICB2b2x1bWVzOgogICAgICAtICdncm9jeS1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "groceries",
-            "household",
-            "management",
-            "grocery",
-            "shopping"
-        ],
-        "category": "productivity",
-        "logo": "svgs/grocy.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
         "slogan": "Hatchet allows you to run background tasks at scale with a high-throughput, low-latency computing service built on an open-source, fault-tolerant queue.",
@@ -2357,7 +2004,7 @@
         "category": "automation",
         "logo": "svgs/hatchet.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-10-15T22:51:15+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "80"
     },
     "healthchecks": {
@@ -2379,26 +2026,10 @@
         "template_last_updated_at": "2026-05-25T13:06:59-04:00",
         "port": "80000"
     },
-    "heimdall": {
-        "documentation": "https://github.com/linuxserver/Heimdall?utm_source=coolify.io",
-        "slogan": "Heimdall is a dashboard for managing and organizing your server applications.",
-        "compose": "c2VydmljZXM6CiAgaGVpbWRhbGw6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvaGVpbWRhbGw6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0hFSU1EQUxMCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gVFo9RXVyb3BlL01hZHJpZAogICAgdm9sdW1lczoKICAgICAgLSAnaGVpbWRhbGwtY29uZmlnOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
-        "tags": [
-            "dashboard",
-            "server",
-            "applications",
-            "interface"
-        ],
-        "category": "productivity",
-        "logo": "svgs/heimdall.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "hermes-agent-with-webui": {
         "documentation": "https://github.com/nesquena/hermes-webui?utm_source=coolify.io",
         "slogan": "Hermes Agent - autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
-        "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50OnYyMDI2LjYuNScKICAgIGNvbW1hbmQ6ICdnYXRld2F5IHJ1bicKICAgIGVudmlyb25tZW50OgogICAgICAtIEhFUk1FU19IT01FPS9ob21lL2hlcm1lcy8uaGVybWVzCiAgICAgIC0gV0lLSV9QQVRIPS9ob21lL2hlcm1lcy8uaGVybWVzL3dpa2kKICAgICAgLSBHQVRFV0FZX0FMTE9XX0FMTF9VU0VSUz10cnVlCiAgICAgIC0gSEVSTUVTX1JFREFDVF9TRUNSRVRTPXRydWUKICAgICAgLSBIRVJNRVNfVUlEPTEwMDAKICAgICAgLSBIRVJNRVNfR0lEPTEwMDAKICAgICAgLSAnSEVSTUVTX0VOQUJMRV9QUk9KRUNUX1BMVUdJTlM9JHtIRVJNRVNfRU5BQkxFX1BST0pFQ1RfUExVR0lOUzotdHJ1ZX0nCiAgICAgIC0gJ0hFUk1FU19PUFRJT05BTF9TS0lMTFM9JHtIRVJNRVNfT1BUSU9OQUxfU0tJTExTOi19JwogICAgICAtICdIRVJNRVNfQUxMT1dfUFJJVkFURV9VUkxTPSR7SEVSTUVTX0FMTE9XX1BSSVZBVEVfVVJMUzotZmFsc2V9JwogICAgICAtICdGSVJFQ1JBV0xfQVBJX0tFWT0ke0ZJUkVDUkFXTF9BUElfS0VZOi19JwogICAgICAtICdGSVJFQ1JBV0xfQVBJX1VSTD0ke0ZJUkVDUkFXTF9BUElfVVJMOi1odHRwczovL2FwaS5maXJlY3Jhd2wuZGV2fScKICAgICAgLSAnT1BFTlJPVVRFUl9BUElfS0VZPSR7T1BFTlJPVVRFUl9BUElfS0VZOi19JwogICAgICAtICdBTlRIUk9QSUNfQVBJX0tFWT0ke0FOVEhST1BJQ19BUElfS0VZOi19JwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZOi19JwogICAgICAtICdHT09HTEVfQVBJX0tFWT0ke0dPT0dMRV9BUElfS0VZOi19JwogICAgdm9sdW1lczoKICAgICAgLSAnaGVybWVzLWhvbWU6L2hvbWUvaGVybWVzLy5oZXJtZXMnCiAgICAgIC0gJ2hlcm1lcy1za2lsbHM6L2hvbWUvaGVybWVzLy5oZXJtZXMvc2tpbGxzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUxLjQ4OScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gaGVybWVzLWFnZW50CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fSEVSTUVTV0VCVUlfODc4NwogICAgICAtIFNFUlZJQ0VfVVNFUl9IRVJNRVNXRUJVSQogICAgICAtIFNFUlZJQ0VfUEFTU1dPUkRfSEVSTUVTV0VCVUkKICAgICAgLSBIRVJNRVNfV0VCVUlfSE9TVD0wLjAuMC4wCiAgICAgIC0gSEVSTUVTX1dFQlVJX1BPUlQ9ODc4NwogICAgICAtIEhFUk1FU19XRUJVSV9TVEFURV9ESVI9L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy93ZWJ1aQogICAgICAtIFdBTlRFRF9VSUQ9MTAwMAogICAgICAtIFdBTlRFRF9HSUQ9MTAwMAogICAgICAtICdIRVJNRVNfV0VCVUlfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfSEVSTUVTV0VCVUl9JwogICAgICAtICdIRVJNRVNfV0VCVUlfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0hFUk1FU1dFQlVJfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMnCiAgICAgIC0gJ2hlcm1lcy1hZ2VudC1zcmM6L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy9oZXJtZXMtYWdlbnQ6cm8nCiAgICAgIC0gJ2hlcm1lcy13b3Jrc3BhY2U6L3dvcmtzcGFjZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4Nzg3L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
+        "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50OnYyMDI2LjkuMjQnCiAgICBjb21tYW5kOiAnZ2F0ZXdheSBydW4nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBIRVJNRVNfSE9NRT0vaG9tZS9oZXJtZXMvLmhlcm1lcwogICAgICAtIFdJS0lfUEFUSD0vaG9tZS9oZXJtZXMvLmhlcm1lcy93aWtpCiAgICAgIC0gR0FURVdBWV9BTExPV19BTExfVVNFUlM9dHJ1ZQogICAgICAtIEhFUk1FU19SRURBQ1RfU0VDUkVUUz10cnVlCiAgICAgIC0gSEVSTUVTX1VJRD0xMDAwCiAgICAgIC0gSEVSTUVTX0dJRD0xMDAwCiAgICAgIC0gJ0hFUk1FU19FTkFCTEVfUFJPSkVDVF9QTFVHSU5TPSR7SEVSTUVTX0VOQUJMRV9QUk9KRUNUX1BMVUdJTlM6LXRydWV9JwogICAgICAtICdIRVJNRVNfT1BUSU9OQUxfU0tJTExTPSR7SEVSTUVTX09QVElPTkFMX1NLSUxMUzotfScKICAgICAgLSAnSEVSTUVTX0FMTE9XX1BSSVZBVEVfVVJMUz0ke0hFUk1FU19BTExPV19QUklWQVRFX1VSTFM6LWZhbHNlfScKICAgICAgLSAnRklSRUNSQVdMX0FQSV9LRVk9JHtGSVJFQ1JBV0xfQVBJX0tFWTotfScKICAgICAgLSAnRklSRUNSQVdMX0FQSV9VUkw9JHtGSVJFQ1JBV0xfQVBJX1VSTDotaHR0cHM6Ly9hcGkuZmlyZWNyYXdsLmRldn0nCiAgICAgIC0gJ09QRU5ST1VURVJfQVBJX0tFWT0ke09QRU5ST1VURVJfQVBJX0tFWTotfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWTotfScKICAgICAgLSAnT1BFTkFJX0FQSV9LRVk9JHtPUEVOQUlfQVBJX0tFWTotfScKICAgICAgLSAnR09PR0xFX0FQSV9LRVk9JHtHT09HTEVfQVBJX0tFWTotfScKICAgICAgLSBBUElfU0VSVkVSX0VOQUJMRUQ9dHJ1ZQogICAgICAtIEFQSV9TRVJWRVJfSE9TVD0wLjAuMC4wCiAgICAgIC0gJ0FQSV9TRVJWRVJfS0VZPSR7U0VSVklDRV9QQVNTV09SRF82NF9IRVJNRVNBUEl9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGVybWVzLWhvbWU6L2hvbWUvaGVybWVzLy5oZXJtZXMnCiAgICAgIC0gJ2hlcm1lcy1za2lsbHM6L2hvbWUvaGVybWVzLy5oZXJtZXMvc2tpbGxzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUyLjQ1OCcKICAgIGRlcGVuZHNfb246CiAgICAgIC0gaGVybWVzLWFnZW50CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fSEVSTUVTV0VCVUlfODc4NwogICAgICAtIFNFUlZJQ0VfVVNFUl9IRVJNRVNXRUJVSQogICAgICAtIFNFUlZJQ0VfUEFTU1dPUkRfSEVSTUVTV0VCVUkKICAgICAgLSBIRVJNRVNfV0VCVUlfSE9TVD0wLjAuMC4wCiAgICAgIC0gSEVSTUVTX1dFQlVJX1BPUlQ9ODc4NwogICAgICAtIEhFUk1FU19XRUJVSV9TVEFURV9ESVI9L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy93ZWJ1aQogICAgICAtIFdBTlRFRF9VSUQ9MTAwMAogICAgICAtIFdBTlRFRF9HSUQ9MTAwMAogICAgICAtICdIRVJNRVNfV0VCVUlfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfSEVSTUVTV0VCVUl9JwogICAgICAtICdIRVJNRVNfV0VCVUlfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0hFUk1FU1dFQlVJfScKICAgICAgLSAnSEVSTUVTX0FQSV9VUkw9aHR0cDovL2hlcm1lcy1hZ2VudDo4NjQyJwogICAgICAtICdIRVJNRVNfV0VCVUlfR0FURVdBWV9BUElfS0VZPSR7U0VSVklDRV9QQVNTV09SRF82NF9IRVJNRVNBUEl9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGVybWVzLWhvbWU6L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcycKICAgICAgLSAnaGVybWVzLWFnZW50LXNyYzovaG9tZS9oZXJtZXN3ZWJ1aS8uaGVybWVzL2hlcm1lcy1hZ2VudDpybycKICAgICAgLSAnaGVybWVzLXdvcmtzcGFjZTovd29ya3NwYWNlJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjg3ODcvaGVhbHRoJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMK",
         "tags": [
             "ai",
             "agent",
@@ -2412,7 +2043,7 @@
         "category": "ai",
         "logo": "svgs/hermes-agent.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-12T16:39:52+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8787"
     },
     "hermes-agent": {
@@ -2467,13 +2098,13 @@
         "category": "productivity",
         "logo": "svgs/homarr.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T19:03:43+02:00",
+        "template_last_updated_at": "2026-10-01T20:31:00+02:00",
         "port": "7575"
     },
     "home-assistant": {
         "documentation": "https://www.home-assistant.io/installation/linux#docker-compose?utm_source=coolify.io",
         "slogan": "Open source home automation that puts local control and privacy first.",
-        "compose": "c2VydmljZXM6CiAgaG9tZWFzc2lzdGFudDoKICAgIGltYWdlOiAnZ2hjci5pby9ob21lLWFzc2lzdGFudC9ob21lLWFzc2lzdGFudDoyMDI1LjEwLjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fSE9NRUFTU0lTVEFOVF84MTIzCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICAgIC0gJ0RJU0FCTEVfSkVNQUxMT0M9JHtESVNBQkxFX0pFTUFMTE9DOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdob21lYXNzaXN0YW50LWNvbmZpZzovY29uZmlnJwogICAgICAtICcvcnVuL2RidXM6L3J1bi9kYnVzOnJvJwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jb25maWd1cmF0aW9uLnlhbWwKICAgICAgICB0YXJnZXQ6IC9jb25maWcvY29uZmlndXJhdGlvbi55YW1sCiAgICAgICAgY29udGVudDogIiMgTG9hZHMgZGVmYXVsdCBzZXQgb2YgaW50ZWdyYXRpb25zLiBEbyBub3QgcmVtb3ZlLlxuZGVmYXVsdF9jb25maWc6XG5cbiMgQ29uZmlndXJhdGlvbiBmb3IgcmV2ZXJzZSBwcm94eSBzdXBwb3J0IChyZXF1aXJlZCBmb3IgQ29vbGlmeSlcbmh0dHA6XG4gIHVzZV94X2ZvcndhcmRlZF9mb3I6IHRydWVcbiAgdHJ1c3RlZF9wcm94aWVzOlxuICAgIC0gMTAuMC4wLjAvOFxuICAgIC0gMTcyLjE2LjAuMC8xMlxuICAgIC0gMTkyLjE2OC4wLjAvMTZcbiAgaXBfYmFuX2VuYWJsZWQ6IHRydWVcbiAgbG9naW5fYXR0ZW1wdHNfdGhyZXNob2xkOiA1IgogICAgcHJpdmlsZWdlZDogdHJ1ZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgxMjMnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiA2MHMK",
+        "compose": "c2VydmljZXM6CiAgaG9tZWFzc2lzdGFudDoKICAgIGltYWdlOiAnZ2hjci5pby9ob21lLWFzc2lzdGFudC9ob21lLWFzc2lzdGFudDoyMDI1LjEwLjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fSE9NRUFTU0lTVEFOVF84MTIzCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICAgIC0gJ0RJU0FCTEVfSkVNQUxMT0M9JHtESVNBQkxFX0pFTUFMTE9DOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdob21lYXNzaXN0YW50LWNvbmZpZzovY29uZmlnJwogICAgICAtICcvcnVuL2RidXM6L3J1bi9kYnVzOnJvJwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jb25maWd1cmF0aW9uLnlhbWwKICAgICAgICB0YXJnZXQ6IC9jb25maWcvY29uZmlndXJhdGlvbi55YW1sCiAgICAgICAgY29udGVudDogIiMgTG9hZHMgZGVmYXVsdCBzZXQgb2YgaW50ZWdyYXRpb25zLiBEbyBub3QgcmVtb3ZlLlxuZGVmYXVsdF9jb25maWc6XG5cbiMgQ29uZmlndXJhdGlvbiBmb3IgcmV2ZXJzZSBwcm94eSBzdXBwb3J0IChyZXF1aXJlZCBmb3IgQ29vbGlmeSlcbmh0dHA6XG4gIHVzZV94X2ZvcndhcmRlZF9mb3I6IHRydWVcbiAgdHJ1c3RlZF9wcm94aWVzOlxuICAgIC0gMTAuMC4wLjAvOFxuICAgIC0gMTcyLjE2LjAuMC8xMlxuICAgIC0gMTkyLjE2OC4wLjAvMTZcbiAgaXBfYmFuX2VuYWJsZWQ6IHRydWVcbiAgbG9naW5fYXR0ZW1wdHNfdGhyZXNob2xkOiA1XG4iCiAgICBwcml2aWxlZ2VkOiB0cnVlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODEyMycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDYwcwo=",
         "tags": [
             "home-automation",
             "iot",
@@ -2516,7 +2147,7 @@
         "category": "productivity",
         "logo": "svgs/homepage.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "template_last_updated_at": "2026-10-19T21:18:41+02:00",
         "port": "3000"
     },
     "honcho": {
@@ -2651,23 +2282,6 @@
         "template_last_updated_at": "2026-07-02T13:25:47+02:00",
         "port": "8288"
     },
-    "invoice-ninja": {
-        "documentation": "https://invoiceninja.github.io/selfhost.html?utm_source=coolify.io",
-        "slogan": "The leading open-source invoicing platform",
-        "compose": "c2VydmljZXM6CiAgaW52b2ljZS1uaW5qYToKICAgIGltYWdlOiAnaW52b2ljZW5pbmphL2ludm9pY2VuaW5qYTo1JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0lOVk9JQ0VOSU5KQQogICAgICAtICdBUFBfTkFNRT0ke0FQUF9OQU1FOi0iSW52b2ljZSBOaW5qYSJ9JwogICAgICAtICdBUFBfRU5WPSR7QVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ0FQUF9VUkw9JHtTRVJWSUNFX0ZRRE5fSU5WT0lDRU5JTkpBfScKICAgICAgLSAnQVBQX0tFWT1iYXNlNjQ6JHtTRVJWSUNFX1JFQUxCQVNFNjRfSU5WT0lDRU5JTkpBfScKICAgICAgLSAnQVBQX0RFQlVHPSR7QVBQX0RFQlVHOi1mYWxzZX0nCiAgICAgIC0gJ1JFUVVJUkVfSFRUUFM9JHtSRVFVSVJFX0hUVFBTOi1mYWxzZX0nCiAgICAgIC0gJ1BIQU5UT01KU19QREZfR0VORVJBVElPTj0ke1BIQU5UT01KU19QREZfR0VORVJBVElPTjotZmFsc2V9JwogICAgICAtICdQREZfR0VORVJBVE9SPSR7UERGX0dFTkVSQVRPUjotaG9zdGVkX25pbmphfScKICAgICAgLSAnVFJVU1RFRF9QUk9YSUVTPSR7VFJVU1RFRF9QUk9YSUVTOi0qfScKICAgICAgLSBDQUNIRV9EUklWRVI9cmVkaXMKICAgICAgLSAnUVVFVUVfQ09OTkVDVElPTj0ke1FVRVVFX0NPTk5FQ1RJT046LXJlZGlzfScKICAgICAgLSBTRVNTSU9OX0RSSVZFUj1yZWRpcwogICAgICAtICdSRURJU19IT1NUPSR7UkVESVNfSE9TVDotcmVkaXN9JwogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgICAtICdSRURJU19QT1JUPSR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ0RCX0hPU1Q9JHtEQl9IT1NUOi1tYXJpYWRifScKICAgICAgLSAnREJfUE9SVD0ke0RCX1BPUlQ6LTMzMDZ9JwogICAgICAtICdEQl9EQVRBQkFTRT0ke0RCX0RBVEFCQVNFOi1pbnZvaWNlbmluamF9JwogICAgICAtICdEQl9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtICdJTl9VU0VSX0VNQUlMPSR7SU5fVVNFUl9FTUFJTDotYWRtaW5AZXhhbXBsZS5jb219JwogICAgICAtICdJTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSU5WT0lDRU5JTkpBVVNFUn0nCiAgICAgIC0gJ01BSUxfTUFJTEVSPSR7TUFJTF9NQUlMRVI6LWxvZ30nCiAgICAgIC0gJ01BSUxfSE9TVD0ke01BSUxfSE9TVH0nCiAgICAgIC0gJ01BSUxfUE9SVD0ke01BSUxfUE9SVH0nCiAgICAgIC0gJ01BSUxfVVNFUk5BTUU9JHtNQUlMX1VTRVJOQU1FfScKICAgICAgLSAnTUFJTF9QQVNTV09SRD0ke01BSUxfUEFTU1dPUkR9JwogICAgICAtICdNQUlMX0VOQ1JZUFRJT049JHtNQUlMX0VOQ1JZUFRJT059JwogICAgICAtICdNQUlMX0ZST01fQUREUkVTUz0ke01BSUxfRlJPTV9BRERSRVNTfScKICAgICAgLSAnTUFJTF9GUk9NX05BTUU9JHtNQUlMX0ZST01fTkFNRX0nCiAgICAgIC0gJ0FXU19BQ0NFU1NfS0VZX0lEPSR7QVdTX0FDQ0VTU19LRVlfSUR9JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtBV1NfU0VDUkVUX0FDQ0VTU19LRVl9JwogICAgICAtICdBV1NfREVGQVVMVF9SRUdJT049JHtBV1NfREVGQVVMVF9SRUdJT059JwogICAgICAtICdBV1NfQlVDS0VUPSR7QVdTX0JVQ0tFVH0nCiAgICAgIC0gJ0FXU19VUkw9JHtBV1NfVVJMfScKICAgICAgLSAnQVdTX0VORFBPSU5UPSR7QVdTX0VORFBPSU5UfScKICAgICAgLSAnTk9SRElHRU5fU0VDUkVUX0lEPSR7Tk9SRElHRU5fU0VDUkVUX0lEfScKICAgICAgLSAnTk9SRElHRU5fU0VDUkVUX0tFWT0ke05PUkRJR0VOX1NFQ1JFVF9LRVl9JwogICAgICAtIElTX0RPQ0tFUj10cnVlCiAgICAgIC0gJ1NDT1VUX0RSSVZFUj0ke1NDT1VUX0RSSVZFUn0nCiAgICAgIC0gJ0xJQ0VOU0VfS0VZPSR7TElDRU5TRV9LRVl9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtIG9rCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ludm9pY2UtbmluamEtcHVibGljOi92YXIvd3d3L2FwcC9wdWJsaWMnCiAgICAgIC0gJ2ludm9pY2UtbmluamEtc3RvcmFnZTovdmFyL3d3dy9hcHAvc3RvcmFnZScKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vc3VwZXJ2aXNvcmQuY29uZgogICAgICAgIHRhcmdldDogL2V0Yy9zdXBlcnZpc29yZC5jb25mCiAgICAgICAgY29udGVudDogIltzdXBlcnZpc29yZF1cbm5vZGFlbW9uPXRydWVcbnBpZGZpbGU9L3RtcC9zdXBlcnZpc29yZC5waWRcbmxvZ2ZpbGU9L2Rldi9udWxsIDsgbm9kYWVtb24gd2lsbCBjYXVzZSBsb2dzIHRvIGdvIHRvIHN0ZG91dFxubG9nZmlsZV9tYXhieXRlcz0wXG5sb2dsZXZlbD1pbmZvXG5cbltwcm9ncmFtOnBocC1mcG1dXG5yZWRpcmVjdF9zdGRlcnI9dHJ1ZVxuc3Rkb3V0X2xvZ2ZpbGU9L2Rldi9zdGRvdXRcbnN0ZG91dF9sb2dmaWxlX21heGJ5dGVzPTBcbnN0ZGVycl9sb2dmaWxlPS9kZXYvc3RkZXJyXG5zdGRlcnJfbG9nZmlsZV9tYXhieXRlcz0wXG5jb21tYW5kPXBocCBhcnRpc2FuIHNlcnZlIC0taG9zdCAwLjAuMC4wIC0tcG9ydCA5MDAwXG5cbltwcm9ncmFtOnNjaGVkdWxlcl1cbmF1dG9yZXN0YXJ0PXRydWVcbnJlZGlyZWN0X3N0ZGVycj10cnVlXG5zdGRvdXRfbG9nZmlsZT0vZGV2L3N0ZG91dFxuc3Rkb3V0X2xvZ2ZpbGVfbWF4Ynl0ZXM9MFxuc3RkZXJyX2xvZ2ZpbGU9L2Rldi9zdGRlcnJcbnN0ZGVycl9sb2dmaWxlX21heGJ5dGVzPTBcbmNvbW1hbmQ9cGhwIGFydGlzYW4gc2NoZWR1bGU6d29ya1xuXG5bcHJvZ3JhbTpxdWV1ZS13b3JrZXJdXG5wcm9jZXNzX25hbWU9JShwcm9ncmFtX25hbWUpc18lKHByb2Nlc3NfbnVtKTAyZFxuYXV0b3Jlc3RhcnQ9dHJ1ZVxucmVkaXJlY3Rfc3RkZXJyPXRydWVcbnN0ZG91dF9sb2dmaWxlPS9kZXYvc3Rkb3V0XG5zdGRvdXRfbG9nZmlsZV9tYXhieXRlcz0wXG5zdGRlcnJfbG9nZmlsZT0vZGV2L3N0ZGVyclxuc3RkZXJyX2xvZ2ZpbGVfbWF4Ynl0ZXM9MFxubnVtcHJvY3M9MlxuY29tbWFuZD1waHAgYXJ0aXNhbiBxdWV1ZTp3b3JrIC0tc2xlZXA9MyAtLXRyaWVzPTEgLS1tZW1vcnk9MjU2IC0tdGltZW91dD0zNjAwXG5cbltldmVudGxpc3RlbmVyOnNodXRkb3duXVxuY29tbWFuZD1zaHV0ZG93bi5zaFxuZXZlbnRzPVBST0NFU1NfU1RBVEVfU1RPUFBFRCwgUFJPQ0VTU19TVEFURV9FWElURUQsIFBST0NFU1NfU1RBVEVfRkFUQUxcbnN0ZG91dF9sb2dmaWxlPS9kZXYvc3Rkb3V0XG5zdGRvdXRfbG9nZmlsZV9tYXhieXRlcz0wXG5zdGRlcnJfbG9nZmlsZT0vZGV2L3N0ZGVyclxuc3RkZXJyX2xvZ2ZpbGVfbWF4Ynl0ZXM9MFxuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9waHAuaW5pCiAgICAgICAgdGFyZ2V0OiAvdXNyL2xvY2FsL2V0Yy9waHAvcGhwLmluaQogICAgICAgIGNvbnRlbnQ6ICJzZXNzaW9uLmF1dG9fc3RhcnQgPSBPZmZcbnNob3J0X29wZW5fdGFnID0gT2ZmXG5cbmVycm9yX3JlcG9ydGluZyA9IEVfQUxMICYgfkVfTk9USUNFICYgfkVfV0FSTklORyAmIH5FX1NUUklDVCAmIH5FX0RFUFJFQ0FURURcblxuOyBvcGNhY2hlLmVuYWJsZT0xXG47IG9wY2FjaGUucHJlbG9hZD0vc3J2L3d3dy9pbnZvaWNlbmluamEvY3VycmVudC9wcmVsb2FkLnBocFxuOyBvcGNhY2hlLnByZWxvYWRfdXNlcj13d3ctZGF0YVxuXG47IDsgVGhlIE9QY2FjaGUgc2hhcmVkIG1lbW9yeSBzdG9yYWdlIHNpemUuXG47IG9wY2FjaGUubWF4X2FjY2VsZXJhdGVkX2ZpbGVzPTMwMDAwMFxuOyBvcGNhY2hlLnZhbGlkYXRlX3RpbWVzdGFtcHM9MVxuOyBvcGNhY2hlLnJldmFsaWRhdGVfZnJlcT0zMFxuOyBvcGNhY2hlLmppdF9idWZmZXJfc2l6ZT0yNTZNXG47IG9wY2FjaGUuaml0PTEyMDVcbjsgb3BjYWNoZS5tZW1vcnlfY29uc3VtcHRpb249MTAyNE1cblxucG9zdF9tYXhfc2l6ZSA9IDYwTVxudXBsb2FkX21heF9maWxlc2l6ZSA9IDUwTVxubWVtb3J5X2xpbWl0PTUxMk1cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vcGhwLWNsaS5pbmkKICAgICAgICB0YXJnZXQ6IC91c3IvbG9jYWwvZXRjL3BocC9waHAtY2xpLmluaQogICAgICAgIGNvbnRlbnQ6ICJzZXNzaW9uLmF1dG9fc3RhcnQgPSBPZmZcbnNob3J0X29wZW5fdGFnID0gT2ZmXG5cbmVycm9yX3JlcG9ydGluZyA9IEVfQUxMICYgfkVfTk9USUNFICYgfkVfV0FSTklORyAmIH5FX1NUUklDVCAmIH5FX0RFUFJFQ0FURURcblxuOyBvcGNhY2hlLmVuYWJsZV9jbGk9MVxuOyBvcGNhY2hlLmZhc3Rfc2h1dGRvd249MVxuOyBvcGNhY2hlLm1lbW9yeV9jb25zdW1wdGlvbj0yNTZcbjsgb3BjYWNoZS5pbnRlcm5lZF9zdHJpbmdzX2J1ZmZlcj04XG47IG9wY2FjaGUubWF4X2FjY2VsZXJhdGVkX2ZpbGVzPTQwMDBcbjsgb3BjYWNoZS5yZXZhbGlkYXRlX2ZyZXE9NjBcbjsgIyBodHRwOi8vc3ltZm9ueS5jb20vZG9jL2N1cnJlbnQvcGVyZm9ybWFuY2UuaHRtbFxuOyByZWFscGF0aF9jYWNoZV9zaXplID0gNDA5NktcbjsgcmVhbHBhdGhfY2FjaGVfdHRsID0gNjAwXG5cbm1lbW9yeV9saW1pdCA9IDJHXG5wb3N0X21heF9zaXplID0gNjBNXG51cGxvYWRfbWF4X2ZpbGVzaXplID0gNTBNXG4iCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21hcmlhZGItZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7REJfREFUQUJBU0U6LWludm9pY2VuaW5qYX0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLXJlcXVpcmVwYXNzICR7U0VSVklDRV9QQVNTV09SRF9SRURJU30nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ludm9pY2UtbmluamEtcmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtICctYScKICAgICAgICAtICcke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUK",
-        "tags": [
-            "invoicing",
-            "billing",
-            "accounting",
-            "finance",
-            "self-hosted"
-        ],
-        "category": "finance",
-        "logo": "svgs/invoiceninja.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "9000"
-    },
     "it-tools": {
         "documentation": "https://github.com/corentinth/it-tools?utm_source=coolify.io",
         "slogan": "IT Tools is a self-hosted solution for managing various IT tasks.",
@@ -2752,23 +2366,6 @@
         "template_last_updated_at": "2026-04-24T09:40:01+05:30",
         "port": "80"
     },
-    "joomla-with-mariadb": {
-        "documentation": "https://joomla.org?utm_source=coolify.io",
-        "slogan": "Joomla! is the mobile-ready and user-friendly way to build your website. Choose from thousands of features and designs. Joomla! is free and open source.",
-        "compose": "c2VydmljZXM6CiAgam9vbWxhOgogICAgaW1hZ2U6ICdqb29tbGE6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnam9vbWxhX2RhdGE6L3Zhci93d3cvaHRtbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9KT09NTEEKICAgICAgLSBKT09NTEFfREJfSE9TVD1tYXJpYWRiCiAgICAgIC0gJ0pPT01MQV9EQl9VU0VSPSR7U0VSVklDRV9VU0VSX0pPT01MQX0nCiAgICAgIC0gJ0pPT01MQV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSk9PTUxBfScKICAgICAgLSAnSk9PTUxBX0RCX05BTUU9JHtNWVNRTF9EQVRBQkFTRTotam9vbWxhLWRifScKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxMAogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICdqb29tbGFfbWFyaWFkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1qb29tbGEtZGJ9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX0pPT01MQX0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9KT09NTEF9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "mariadb"
-        ],
-        "category": "cms",
-        "logo": "svgs/joomla.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "joplin": {
         "documentation": "https://github.com/laurent22/joplin/blob/dev/packages/server/README.md?utm_source=coolify.io",
         "slogan": "Self-hosted sync server for Joplin",
@@ -2873,20 +2470,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "8080"
     },
-    "kimai": {
-        "documentation": "https://www.kimai.org/?utm_source=coolify.io",
-        "slogan": "Open source time-tracking app.",
-        "compose": "c2VydmljZXM6CiAgbXlzcWw6CiAgICBpbWFnZTogJ215c3FsOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdraW1haS1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWtpbWFpfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgY29tbWFuZDogJy0tZGVmYXVsdC1zdG9yYWdlLWVuZ2luZSBpbm5vZGInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBraW1haToKICAgIGltYWdlOiAna2ltYWkva2ltYWkyOmFwYWNoZScKICAgIGNvbnRhaW5lcl9uYW1lOiBraW1haQogICAgZGVwZW5kc19vbjoKICAgICAgbXlzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2tpbWFpLWRhdGE6L29wdC9raW1haS92YXIvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9LSU1BSV84MDAxCiAgICAgIC0gJ0FQUF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FQUFNFQ1JFVH0nCiAgICAgIC0gJ01BSUxFUl9GUk9NPSR7TUFJTEVSX0ZST006LWtpbWFpQGV4YW1wbGUuY29tfScKICAgICAgLSAnTUFJTEVSX1VSTD0ke01BSUxFUl9VUkw6LW51bGw6Ly9udWxsfScKICAgICAgLSAnQURNSU5NQUlMPSR7QURNSU5NQUlMOi1hZG1pbkBraW1haS5sb2NhbH0nCiAgICAgIC0gJ0FETUlOUEFTUz0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU5QQVNTfScKICAgICAgLSAnREFUQUJBU0VfVVJMPW15c3FsOi8vJHtTRVJWSUNFX1VTRVJfTVlTUUx9OiR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH1AbXlzcWwvJHtNWVNRTF9EQVRBQkFTRX0/Y2hhcnNldD11dGY4bWI0JnNlcnZlclZlcnNpb249OC4zLjAnCiAgICAgIC0gJ1RSVVNURURfSE9TVFM9JHtUUlVTVEVEX0hPU1RTfXxsb2NhbGhvc3R8MTI3LjAuMC4xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwMDEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
-        "tags": [
-            "time-tracking",
-            "open-source"
-        ],
-        "category": "productivity",
-        "logo": "svgs/kimai.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-01-27T21:11:35+01:00",
-        "port": "8001"
-    },
     "kuzzle": {
         "documentation": "https://kuzzle.io?utm_source=coolify.io",
         "slogan": "Kuzzle is a generic backend offering the basic building blocks common to every application.",
@@ -2978,27 +2561,9 @@
         "category": "ai",
         "logo": "svgs/langfuse.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-23T18:08:40+02:00",
+        "template_last_updated_at": "2026-10-19T17:18:16+02:00",
         "port": "3000"
     },
-    "leantime": {
-        "documentation": "https://leantime.io?utm_source=coolify.io",
-        "slogan": "Leantime is a goals focused project management system for non-project managers.",
-        "compose": "c2VydmljZXM6CiAgbGVhbnRpbWU6CiAgICBpbWFnZTogJ2xlYW50aW1lL2xlYW50aW1lOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9MRUFOVElNRV84MDgwCiAgICAgIC0gJ0xFQU5fQVBQX1VSTD0ke1NFUlZJQ0VfRlFETl9MRUFOVElNRX0nCiAgICAgIC0gTEVBTl9EQl9IT1NUPW15c3FsCiAgICAgIC0gJ0xFQU5fREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTERCfScKICAgICAgLSAnTEVBTl9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxEQn0nCiAgICAgIC0gJ0xFQU5fREJfREFUQUJBU0U9JHtEQl9OQU1FOi1sZWFudGltZS1kYn0nCiAgICAgIC0gJ0xFQU5fU0VTU0lPTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfU0FMVH0nCiAgICAgIC0gJ0xFQU5fU0VTU0lPTl9FWFBJUkFUSU9OPSR7U0VTU0lPTl9FWFBJUkFUSU9OOi0yODgwMH0nCiAgICAgIC0gJ0xFQU5fVVNFX1JFRElTPSR7VVNFX1JFRElTOi10cnVlfScKICAgICAgLSBMRUFOX1JFRElTX0hPU1Q9cmVkaXMKICAgICAgLSAnTEVBTl9SRURJU19QT1JUPSR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ0xFQU5fUkVESVNfU0NIRU1FPSR7UkVESVNfU0NIRU1FOi10Y3B9JwogICAgZGVwZW5kc19vbjoKICAgICAgbXlzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3B1YmxpYy11c2VyZmlsZXM6L3Zhci93d3cvaHRtbC9wdWJsaWMvdXNlcmZpbGVzJwogICAgICAtICd1c2VyZmlsZXM6L3Zhci93d3cvaHRtbC91c2VyZmlsZXMnCiAgICAgIC0gJ3BsdWdpbnM6L3Zhci93d3cvaHRtbC9hcHAvUGx1Z2lucycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgbXlzcWw6CiAgICBpbWFnZTogJ215c3FsOjguNCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2xlYW50aW1lX215c3FsX2RhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTERCfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMREJ9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke0RCX05BTUU6LWxlYW50aW1lLWRifScKICAgIGNvbW1hbmQ6ICctLWNoYXJhY3Rlci1zZXQtc2VydmVyPVVURjhNQjQgLS1jb2xsYXRpb24tc2VydmVyPVVURjhNQjRfdW5pY29kZV9jaScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSBsb2NhbGhvc3QKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LWFscGluZScKICAgIGNvbW1hbmQ6ICdyZWRpcy1zZXJ2ZXIgLS1hcHBlbmRvbmx5IHllcycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2xlYW50aW1lX3JlZGlzX2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
-        "tags": [
-            "project management",
-            "productivity",
-            "php",
-            "mysql",
-            "laravel",
-            "open source"
-        ],
-        "category": "productivity",
-        "logo": "svgs/leantime.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "8080"
-    },
     "librechat": {
         "documentation": "https://docs.librechat.ai/install/configuration/dotenv.html?utm_source=coolify.io",
         "slogan": "Self-hosted, powerful, and privacy-focused chat UI for multiple AI models",
@@ -3039,20 +2604,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "3000"
     },
-    "librespeed": {
-        "documentation": "https://github.com/librespeed/speedtest?utm_source=coolify.io",
-        "slogan": "Self-hosted lightweight Speed Test.",
-        "compose": "c2VydmljZXM6CiAgbGlicmVzcGVlZDoKICAgIGNvbnRhaW5lcl9uYW1lOiBsaWJyZXNwZWVkCiAgICBpbWFnZTogJ2doY3IuaW8vbGlicmVzcGVlZC9zcGVlZHRlc3Q6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0xJQlJFU1BFRURfODIKICAgICAgLSBNT0RFPXN0YW5kYWxvbmUKICAgICAgLSBURUxFTUVUUlk9ZmFsc2UKICAgICAgLSBESVNUQU5DRT1rbQogICAgICAtIFdFQlBPUlQ9ODIKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnY3VybCAxMjcuMC4wLjE6ODIgfHwgZXhpdCAxJwogICAgICB0aW1lb3V0OiAxcwogICAgICBpbnRlcnZhbDogMW0wcwogICAgICByZXRyaWVzOiAxCg==",
-        "tags": [
-            "speedtest",
-            "internet-speed"
-        ],
-        "category": "devtools",
-        "logo": "svgs/librespeed.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-02-25T23:48:15Z",
-        "port": "82"
-    },
     "libretranslate": {
         "documentation": "https://libretranslate.com/docs/?utm_source=coolify.io",
         "slogan": "Free and open-source machine translation API, entirely self-hosted.",
@@ -3067,22 +2618,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "5000"
     },
-    "limesurvey": {
-        "documentation": "https://www.limesurvey.org/manual/?utm_source=coolify.io",
-        "slogan": "Simple, quick and anonymous online survey tool that's bursting with juicy insights.",
-        "compose": "c2VydmljZXM6CiAgbGltZXN1cnZleToKICAgIGltYWdlOiAnYWRhbXphbW1pdC9saW1lc3VydmV5OmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9MSU1FU1VSVkVZXzgwCiAgICAgIC0gTElNRVNVUlZFWV9EQl9IT1NUPW1hcmlhZGIKICAgICAgLSAnTElNRVNVUlZFWV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdMSU1FU1VSVkVZX0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdMSU1FU1VSVkVZX0RCX05BTUU9JHtNWVNRTF9EQVRBQkFTRTotbGltZXN1cnZleS1kYn0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfQURNSU5fVVNFUj0ke0xJTUVTVVJWRVlfQURNSU5fVVNFUjotYWRtaW59JwogICAgICAtICdMSU1FU1VSVkVZX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfQURNSU5fTkFNRT0ke0xJTUVTVVJWRVlfQURNSU5fTkFNRTotQWRtaW59JwogICAgICAtICdMSU1FU1VSVkVZX0FETUlOX0VNQUlMPSR7TElNRVNVUlZFWV9BRE1JTl9FTUFJTDotYWRtaW5AZXhhbXBsZS5jb219JwogICAgICAtICdMSU1FU1VSVkVZX0ZST01fRU1BSUw9JHtMSU1FU1VSVkVZX0ZST01fRU1BSUx9JwogICAgICAtICdMSU1FU1VSVkVZX1NNVFBfSE9TVD0ke0xJTUVTVVJWRVlfU01UUF9IT1NUfScKICAgICAgLSAnTElNRVNVUlZFWV9TTVRQX1VTRVI9JHtMSU1FU1VSVkVZX1NNVFBfVVNFUn0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfU01UUF9QQVNTV09SRD0ke0xJTUVTVVJWRVlfU01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ0xJTUVTVVJWRVlfU01UUF9TU0w9JHtMSU1FU1VSVkVZX1NNVFBfU1NMfScKICAgICAgLSBMSU1FU1VSVkVZX1BIUF9TRVNTSU9OX1NBVkVfSEFORExFUj1yZWRpcwogICAgICAtICdMSU1FU1VSVkVZX1BIUF9TRVNTSU9OX1NBVkVfUEFUSD10Y3A6Ly9yZWRpczo2Mzc5JwogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL0phbWFpY2F9JwogICAgdm9sdW1lczoKICAgICAgLSAnbGltZXN1cnZleV9wbHVnaW5zX2RhdGE6L3Zhci93d3cvaHRtbC9wbHVnaW5zJwogICAgICAtICdsaW1lc3VydmV5X3VwbG9hZF9kYXRhOi92YXIvd3d3L2h0bWwvdXBsb2FkJwogICAgICAtICdsaW1lc3VydmV5X2NvbmZpZ19kYXRhOi92YXIvd3d3L2h0bWwvYXBwbGljYXRpb24vY29uZmlnJwogICAgICAtICdsaW1lc3VydmV5X3Nlc3Npb25zX2RhdGE6L3Zhci9saW1lL3Nlc3Npb25zJwogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotbGltZXN1cnZleS1kYn0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICB2b2x1bWVzOgogICAgICAtICdsaW1lc3VydmV5X21hcmlhZGJfZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LWFscGluZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDNzCiAgICAgIHJldHJpZXM6IDMK",
-        "tags": [
-            "online survey",
-            "forms",
-            "no code",
-            "open source"
-        ],
-        "category": "productivity",
-        "logo": "svgs/limesurvey.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "linkding-plus": {
         "documentation": "https://linkding.link/?utm_source=coolify.io",
         "slogan": "A self-hosted bookmark manager designed to be minimal, fast, and easy to set up. (Includes feature for archiving websites as HTML snapshots)",
@@ -3147,7 +2682,7 @@
     "litellm": {
         "documentation": "https://docs.litellm.ai?utm_source=coolify.io",
         "slogan": "Call all LLM APIs using the OpenAI format. Use Bedrock, Azure, OpenAI, Cohere, Anthropic, Ollama, Sagemaker, HuggingFace, Replicate, Groq (100+ LLMs)",
-        "compose": "c2VydmljZXM6CiAgbGl0ZWxsbToKICAgIGltYWdlOiAnZ2hjci5pby9iZXJyaWFpL2xpdGVsbG0tZGF0YWJhc2U6bWFpbi1zdGFibGUnCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0xJVEVMTE1fNDAwMAogICAgICAtICdMSVRFTExNX0xPRz0ke0xJVEVMTE1fTE9HOi1FUlJPUn0nCiAgICAgIC0gJ0xJVEVMTE1fTU9ERT0ke0xJVEVMTE1fTU9ERTotUFJPRFVDVElPTn0nCiAgICAgIC0gJ0xJVEVMTE1fTUFTVEVSX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFTVEVSS0VZfScKICAgICAgLSAnVUlfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfVUl9JwogICAgICAtICdVSV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfVUl9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXNxbDovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotbGl0ZWxsbX0nCiAgICAgIC0gJ1JFRElTX0hPU1Q9JHtSRURJU19IT1NUOi1yZWRpc30nCiAgICAgIC0gJ1JFRElTX1BPUlQ9JHtSRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LWxpdGVsbG19JwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSAnT1BFTkFJX0FQSV9CQVNFPSR7T1BFTkFJX0FQSV9CQVNFfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWX0nCiAgICAgIC0gJ0FOVEhST1BJQ19BUElfQkFTRT0ke0FOVEhST1BJQ19BUElfQkFTRX0nCiAgICAgIC0gJ1ZPWUFHRV9BUElfS0VZPSR7Vk9ZQUdFX0FQSV9LRVl9JwogICAgICAtICdWT1lBR0VfQVBJX0JBU0U9JHtWT1lBR0VfQVBJX0JBU0V9JwogICAgICAtICdTVE9SRV9NT0RFTF9JTl9EQj0ke1NUT1JFX01PREVMX0lOX0RCfScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2xpdGVsbG0tY29uZmlnLnlhbWwKICAgICAgICB0YXJnZXQ6IC9hcHAvY29uZmlnLnlhbWwKICAgICAgICBjb250ZW50OiAiZ2VuZXJhbF9zZXR0aW5nczpcbiAgcHJveHlfYmF0Y2hfd3JpdGVfYXQ6IDYwXG4gIHN0b3JlX3Byb21wdHNfaW5fc3BlbmRfbG9nczogZmFsc2Vcblxucm91dGVyX3NldHRpbmdzOlxuICByZWRpc19ob3N0OiBvcy5lbnZpcm9uL1JFRElTX0hPU1RcbiAgcmVkaXNfcG9ydDogb3MuZW52aXJvbi9SRURJU19QT1JUXG4gIHJlZGlzX3Bhc3N3b3JkOiBvcy5lbnZpcm9uL1JFRElTX1BBU1NXT1JEXG4gIGVuYWJsZV9wcmVfY2FsbF9jaGVjazogdHJ1ZVxuXG5saXRlbGxtX3NldHRpbmdzOlxuICBzZXRfdmVyYm9zZTogZmFsc2VcbiAganNvbl9sb2dzOiB0cnVlXG4gIGxvZ19yYXdfcmVxdWVzdF9yZXNwb25zZTogZmFsc2VcbiAgIyB0dXJuX29mZl9tZXNzYWdlX2xvZ2dpbmc6IGZhbHNlXG4gICMgcmVkYWN0X3VzZXJfYXBpX2tleV9pbmZvOiBmYWxzZVxuICBzZXJ2aWNlX2NhbGxiYWNrOiBbXCJwcm9tZXRoZXVzX3N5c3RlbVwiXVxuICBkcm9wX3BhcmFtczogdHJ1ZVxuICAjIG1heF9idWRnZXQ6IDEwMFxuICAjIGJ1ZGdldF9kdXJhdGlvbjogMzBkXG4gIG51bV9yZXRyaWVzOiAxXG4gIHJlcXVlc3RfdGltZW91dDogMTIwXG4gIHRlbGVtZXRyeTogZmFsc2VcbiAgY2FjaGU6IHRydWVcbiAgY2FjaGVfcGFyYW1zOlxuICAgIHR5cGU6IHJlZGlzXG4gICAgaG9zdDogb3MuZW52aXJvbi9SRURJU19IT1NUXG4gICAgcG9ydDogb3MuZW52aXJvbi9SRURJU19QT1JUXG4gICAgcGFzc3dvcmQ6IG9zLmVudmlyb24vUkVESVNfUEFTU1dPUkRcbiAgICBuYW1lc3BhY2U6IFwibGl0ZWxsbV9jYWNoZVwiXG4gICAgdHRsOiA2MDBcbiAgc3VjY2Vzc19jYWxsYmFjazpcbiAgICAjIC0gXCJsYW5nZnVzZVwiXG4gICAgLSBcInByb21ldGhldXNcIlxuICBmYWlsdXJlX2NhbGxiYWNrOlxuICAgICMgLSBcImxhbmdmdXNlXCJcbiAgICAtIFwicHJvbWV0aGV1c1wiXG5tb2RlbF9saXN0OlxuICAjIE9wZW5BSVxuICAtIG1vZGVsX25hbWU6IGdwdC00XG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogb3BlbmFpL2dwdC00XG4gICAgICBhcGlfa2V5OiBvcy5lbnZpcm9uL09QRU5BSV9BUElfS0VZXG4gICAgICBhcGlfYmFzZTogb3MuZW52aXJvbi9PUEVOQUlfQVBJX0JBU0VcbiAgLSBtb2RlbF9uYW1lOiBncHQtNG9cbiAgICBsaXRlbGxtX3BhcmFtczpcbiAgICAgIG1vZGVsOiBvcGVuYWkvZ3B0LTRvXG4gICAgICBhcGlfa2V5OiBvcy5lbnZpcm9uL09QRU5BSV9BUElfS0VZXG4gICAgICBhcGlfYmFzZTogb3MuZW52aXJvbi9PUEVOQUlfQVBJX0JBU0VcbiAgLSBtb2RlbF9uYW1lOiBncHQtNG8tbWluaVxuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IG9wZW5haS9ncHQtNG8tbWluaVxuICAgICAgYXBpX2tleTogb3MuZW52aXJvbi9PUEVOQUlfQVBJX0tFWVxuICAgICAgYXBpX2Jhc2U6IG9zLmVudmlyb24vT1BFTkFJX0FQSV9CQVNFXG4gICMgQW50aHJvcGljXG4gIC0gbW9kZWxfbmFtZTogY2xhdWRlLTMtaGFpa3VcbiAgICBsaXRlbGxtX3BhcmFtczpcbiAgICAgIG1vZGVsOiBjbGF1ZGUtMy1oYWlrdS0yMDI0MDMwN1xuICAgICAgYXBpX2tleTogXCJvcy5lbnZpcm9uL0FOVEhST1BJQ19BUElfS0VZXCJcbiAgICAgIGFwaV9iYXNlOiBcIm9zLmVudmlyb24vQU5USFJPUElDX0FQSV9CQVNFXCJcbiAgLSBtb2RlbF9uYW1lOiBjbGF1ZGUtMy41LXNvbm5ldFxuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IGNsYXVkZS0zLTUtc29ubmV0LTIwMjQwNjIwXG4gICAgICBhcGlfa2V5OiBcIm9zLmVudmlyb24vQU5USFJPUElDX0FQSV9LRVlcIlxuICAgICAgYXBpX2Jhc2U6IFwib3MuZW52aXJvbi9BTlRIUk9QSUNfQVBJX0JBU0VcIlxuICAjIFZveWFnZUFJXG4gIC0gbW9kZWxfbmFtZTogdm95YWdlLWxhdy0yXG4gICAgbW9kZWxfaW5mbzpcbiAgICAgIG91dHB1dF92ZWN0b3Jfc2l6ZTogMTAyNFxuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IHZveWFnZS92b3lhZ2UtbGF3LTJcbiAgICAgIGFwaV9rZXk6IFwib3MuZW52aXJvbi9WT1lBR0VfQVBJX0tFWVwiXG4gICAgICBhcGlfYmFzZTogXCJvcy5lbnZpcm9uL1ZPWUFHRV9BUElfQkFTRVwiXG4gICAgICAjIHJwbTogMzAwXG4gICAgICAjIHRwbTogMTAwMDAwMFxuICAtIG1vZGVsX25hbWU6IHZveWFnZS1tdWx0aWxpbmd1YWwtMlxuICAgIG1vZGVsX2luZm86XG4gICAgICBtb2RlOiBlbWJlZGRpbmdcbiAgICAgIG1heF90b2tlbnM6IDMyMDAwXG4gICAgICBtYXhfaW5wdXRfdG9rZW5zOiAzMjAwMFxuICAgICAgb3V0cHV0X3ZlY3Rvcl9zaXplOiAxMDI0XG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogdm95YWdlL3ZveWFnZS1tdWx0aWxpbmd1YWwtMlxuICAgICAgYXBpX2tleTogXCJvcy5lbnZpcm9uL1ZPWUFHRV9BUElfS0VZXCJcbiAgICAgIGFwaV9iYXNlOiBcIm9zLmVudmlyb24vVk9ZQUdFX0FQSV9CQVNFXCJcbiAgICAgIGlucHV0X2Nvc3RfcGVyX3Rva2VuOiAwLjAwMDAwMDEyXG4gICAgICBvdXRwdXRfY29zdF9wZXJfdG9rZW46IDBcbiAgICAgICMgcnBtOiAzMDBcbiAgICAgICMgdHBtOiAxMDAwMDAwIgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHB5dGhvbgogICAgICAgIC0gJy1jJwogICAgICAgIC0gImltcG9ydCB1cmxsaWIucmVxdWVzdDt1cmxsaWIucmVxdWVzdC51cmxvcGVuKCdodHRwOi8vMTI3LjAuMC4xOjQwMDAvaGVhbHRoL2xpdmVsaW5lc3MnLHRpbWVvdXQ9NSkiCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDMwcwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jb25maWcnCiAgICAgIC0gL2FwcC9jb25maWcueWFtbAogICAgICAtICctLXBvcnQnCiAgICAgIC0gJzQwMDAnCiAgICAgIC0gJy0tbnVtX3dvcmtlcnMnCiAgICAgIC0gJzInCiAgICAgIC0gJy0tcnVuX2d1bmljb3JuJwogICAgICAtICctLW1heF9yZXF1ZXN0c19iZWZvcmVfcmVzdGFydCcKICAgICAgLSAnMTAwMCcKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTYtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LWxpdGVsbG19JwogICAgICAtIFBPU1RHUkVTX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICB2b2x1bWVzOgogICAgICAtICdwZy1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtaCBsb2NhbGhvc3QgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LWFscGluZScKICAgIGNvbW1hbmQ6ICdyZWRpcy1zZXJ2ZXIgLS1hcHBlbmRvbmx5IHllcycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
+        "compose": "c2VydmljZXM6CiAgbGl0ZWxsbToKICAgIGltYWdlOiAnZ2hjci5pby9iZXJyaWFpL2xpdGVsbG0tZGF0YWJhc2U6bWFpbi1zdGFibGUnCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0xJVEVMTE1fNDAwMAogICAgICAtICdMSVRFTExNX0xPRz0ke0xJVEVMTE1fTE9HOi1FUlJPUn0nCiAgICAgIC0gJ0xJVEVMTE1fTU9ERT0ke0xJVEVMTE1fTU9ERTotUFJPRFVDVElPTn0nCiAgICAgIC0gJ0xJVEVMTE1fTUFTVEVSX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFTVEVSS0VZfScKICAgICAgLSAnVUlfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfVUl9JwogICAgICAtICdVSV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfVUl9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXNxbDovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotbGl0ZWxsbX0nCiAgICAgIC0gJ1JFRElTX0hPU1Q9JHtSRURJU19IT1NUOi1yZWRpc30nCiAgICAgIC0gJ1JFRElTX1BPUlQ9JHtSRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LWxpdGVsbG19JwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSAnT1BFTkFJX0FQSV9CQVNFPSR7T1BFTkFJX0FQSV9CQVNFfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWX0nCiAgICAgIC0gJ0FOVEhST1BJQ19BUElfQkFTRT0ke0FOVEhST1BJQ19BUElfQkFTRX0nCiAgICAgIC0gJ1ZPWUFHRV9BUElfS0VZPSR7Vk9ZQUdFX0FQSV9LRVl9JwogICAgICAtICdWT1lBR0VfQVBJX0JBU0U9JHtWT1lBR0VfQVBJX0JBU0V9JwogICAgICAtICdTVE9SRV9NT0RFTF9JTl9EQj0ke1NUT1JFX01PREVMX0lOX0RCfScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2xpdGVsbG0tY29uZmlnLnlhbWwKICAgICAgICB0YXJnZXQ6IC9hcHAvY29uZmlnLnlhbWwKICAgICAgICBjb250ZW50OiAiZ2VuZXJhbF9zZXR0aW5nczpcbiAgcHJveHlfYmF0Y2hfd3JpdGVfYXQ6IDYwXG4gIHN0b3JlX3Byb21wdHNfaW5fc3BlbmRfbG9nczogZmFsc2Vcblxucm91dGVyX3NldHRpbmdzOlxuICByZWRpc19ob3N0OiBvcy5lbnZpcm9uL1JFRElTX0hPU1RcbiAgcmVkaXNfcG9ydDogb3MuZW52aXJvbi9SRURJU19QT1JUXG4gIHJlZGlzX3Bhc3N3b3JkOiBvcy5lbnZpcm9uL1JFRElTX1BBU1NXT1JEXG4gIGVuYWJsZV9wcmVfY2FsbF9jaGVjazogdHJ1ZVxuXG5saXRlbGxtX3NldHRpbmdzOlxuICBzZXRfdmVyYm9zZTogZmFsc2VcbiAganNvbl9sb2dzOiB0cnVlXG4gIGxvZ19yYXdfcmVxdWVzdF9yZXNwb25zZTogZmFsc2VcbiAgIyB0dXJuX29mZl9tZXNzYWdlX2xvZ2dpbmc6IGZhbHNlXG4gICMgcmVkYWN0X3VzZXJfYXBpX2tleV9pbmZvOiBmYWxzZVxuICBzZXJ2aWNlX2NhbGxiYWNrOiBbXCJwcm9tZXRoZXVzX3N5c3RlbVwiXVxuICBkcm9wX3BhcmFtczogdHJ1ZVxuICAjIG1heF9idWRnZXQ6IDEwMFxuICAjIGJ1ZGdldF9kdXJhdGlvbjogMzBkXG4gIG51bV9yZXRyaWVzOiAxXG4gIHJlcXVlc3RfdGltZW91dDogMTIwXG4gIHRlbGVtZXRyeTogZmFsc2VcbiAgY2FjaGU6IHRydWVcbiAgY2FjaGVfcGFyYW1zOlxuICAgIHR5cGU6IHJlZGlzXG4gICAgaG9zdDogb3MuZW52aXJvbi9SRURJU19IT1NUXG4gICAgcG9ydDogb3MuZW52aXJvbi9SRURJU19QT1JUXG4gICAgcGFzc3dvcmQ6IG9zLmVudmlyb24vUkVESVNfUEFTU1dPUkRcbiAgICBuYW1lc3BhY2U6IFwibGl0ZWxsbV9jYWNoZVwiXG4gICAgdHRsOiA2MDBcbiAgc3VjY2Vzc19jYWxsYmFjazpcbiAgICAjIC0gXCJsYW5nZnVzZVwiXG4gICAgLSBcInByb21ldGhldXNcIlxuICBmYWlsdXJlX2NhbGxiYWNrOlxuICAgICMgLSBcImxhbmdmdXNlXCJcbiAgICAtIFwicHJvbWV0aGV1c1wiXG5tb2RlbF9saXN0OlxuICAjIE9wZW5BSVxuICAtIG1vZGVsX25hbWU6IGdwdC00XG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogb3BlbmFpL2dwdC00XG4gICAgICBhcGlfa2V5OiBvcy5lbnZpcm9uL09QRU5BSV9BUElfS0VZXG4gICAgICBhcGlfYmFzZTogb3MuZW52aXJvbi9PUEVOQUlfQVBJX0JBU0VcbiAgLSBtb2RlbF9uYW1lOiBncHQtNG9cbiAgICBsaXRlbGxtX3BhcmFtczpcbiAgICAgIG1vZGVsOiBvcGVuYWkvZ3B0LTRvXG4gICAgICBhcGlfa2V5OiBvcy5lbnZpcm9uL09QRU5BSV9BUElfS0VZXG4gICAgICBhcGlfYmFzZTogb3MuZW52aXJvbi9PUEVOQUlfQVBJX0JBU0VcbiAgLSBtb2RlbF9uYW1lOiBncHQtNG8tbWluaVxuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IG9wZW5haS9ncHQtNG8tbWluaVxuICAgICAgYXBpX2tleTogb3MuZW52aXJvbi9PUEVOQUlfQVBJX0tFWVxuICAgICAgYXBpX2Jhc2U6IG9zLmVudmlyb24vT1BFTkFJX0FQSV9CQVNFXG4gICMgQW50aHJvcGljXG4gIC0gbW9kZWxfbmFtZTogY2xhdWRlLTMtaGFpa3VcbiAgICBsaXRlbGxtX3BhcmFtczpcbiAgICAgIG1vZGVsOiBjbGF1ZGUtMy1oYWlrdS0yMDI0MDMwN1xuICAgICAgYXBpX2tleTogXCJvcy5lbnZpcm9uL0FOVEhST1BJQ19BUElfS0VZXCJcbiAgICAgIGFwaV9iYXNlOiBcIm9zLmVudmlyb24vQU5USFJPUElDX0FQSV9CQVNFXCJcbiAgLSBtb2RlbF9uYW1lOiBjbGF1ZGUtMy41LXNvbm5ldFxuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IGNsYXVkZS0zLTUtc29ubmV0LTIwMjQwNjIwXG4gICAgICBhcGlfa2V5OiBcIm9zLmVudmlyb24vQU5USFJPUElDX0FQSV9LRVlcIlxuICAgICAgYXBpX2Jhc2U6IFwib3MuZW52aXJvbi9BTlRIUk9QSUNfQVBJX0JBU0VcIlxuICAjIFZveWFnZUFJXG4gIC0gbW9kZWxfbmFtZTogdm95YWdlLWxhdy0yXG4gICAgbW9kZWxfaW5mbzpcbiAgICAgIG91dHB1dF92ZWN0b3Jfc2l6ZTogMTAyNFxuICAgIGxpdGVsbG1fcGFyYW1zOlxuICAgICAgbW9kZWw6IHZveWFnZS92b3lhZ2UtbGF3LTJcbiAgICAgIGFwaV9rZXk6IFwib3MuZW52aXJvbi9WT1lBR0VfQVBJX0tFWVwiXG4gICAgICBhcGlfYmFzZTogXCJvcy5lbnZpcm9uL1ZPWUFHRV9BUElfQkFTRVwiXG4gICAgICAjIHJwbTogMzAwXG4gICAgICAjIHRwbTogMTAwMDAwMFxuICAtIG1vZGVsX25hbWU6IHZveWFnZS1tdWx0aWxpbmd1YWwtMlxuICAgIG1vZGVsX2luZm86XG4gICAgICBtb2RlOiBlbWJlZGRpbmdcbiAgICAgIG1heF90b2tlbnM6IDMyMDAwXG4gICAgICBtYXhfaW5wdXRfdG9rZW5zOiAzMjAwMFxuICAgICAgb3V0cHV0X3ZlY3Rvcl9zaXplOiAxMDI0XG4gICAgbGl0ZWxsbV9wYXJhbXM6XG4gICAgICBtb2RlbDogdm95YWdlL3ZveWFnZS1tdWx0aWxpbmd1YWwtMlxuICAgICAgYXBpX2tleTogXCJvcy5lbnZpcm9uL1ZPWUFHRV9BUElfS0VZXCJcbiAgICAgIGFwaV9iYXNlOiBcIm9zLmVudmlyb24vVk9ZQUdFX0FQSV9CQVNFXCJcbiAgICAgIGlucHV0X2Nvc3RfcGVyX3Rva2VuOiAwLjAwMDAwMDEyXG4gICAgICBvdXRwdXRfY29zdF9wZXJfdG9rZW46IDBcbiAgICAgICMgcnBtOiAzMDBcbiAgICAgICMgdHBtOiAxMDAwMDAwXG4iCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcHl0aG9uCiAgICAgICAgLSAnLWMnCiAgICAgICAgLSAiaW1wb3J0IHVybGxpYi5yZXF1ZXN0O3VybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgvbGl2ZWxpbmVzcycsdGltZW91dD01KSIKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCiAgICBjb21tYW5kOgogICAgICAtICctLWNvbmZpZycKICAgICAgLSAvYXBwL2NvbmZpZy55YW1sCiAgICAgIC0gJy0tcG9ydCcKICAgICAgLSAnNDAwMCcKICAgICAgLSAnLS1udW1fd29ya2VycycKICAgICAgLSAnMicKICAgICAgLSAnLS1ydW5fZ3VuaWNvcm4nCiAgICAgIC0gJy0tbWF4X3JlcXVlc3RzX2JlZm9yZV9yZXN0YXJ0JwogICAgICAtICcxMDAwJwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbGl0ZWxsbX0nCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSBQT1NUR1JFU19VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3BnLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1oIGxvY2FsaG9zdCAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjctYWxwaW5lJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLWFwcGVuZG9ubHkgeWVzJwogICAgdm9sdW1lczoKICAgICAgLSAncmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMK",
         "tags": [
             "ai",
             "qdrant",
@@ -3299,7 +2834,7 @@
     "matrix-synapse-with-sqlite": {
         "documentation": "https://element-hq.github.io/synapse/latest/welcome_and_overview.html?utm_source=coolify.io",
         "slogan": "Chat securely with your family, friends, community, or build great apps with Matrix!",
-        "compose": "c2VydmljZXM6CiAgc3luYXBzZToKICAgIGltYWdlOiAnbWF0cml4ZG90b3JnL3N5bmFwc2U6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1NZTkFQU0VfODAwOAogICAgICAtICdTWU5BUFNFX1NFUlZFUl9OQU1FPSR7U1lOQVBTRV9TRVJWRVJfTkFNRTo/fScKICAgICAgLSAnU1lOQVBTRV9SRVBPUlRfU1RBVFM9JHtTWU5BUFNFX1JFUE9SVF9TVEFUUzotbm99JwogICAgICAtICdFTkFCTEVfUkVHSVNUUkFUSU9OPSR7RU5BQkxFX1JFR0lTVFJBVElPTjotZmFsc2V9JwogICAgICAtICdTRVJWSUNFX1VTRVJfQURNSU49JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdTRVJWSUNFX1BBU1NXT1JEX0FETUlOPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICB2b2x1bWVzOgogICAgICAtICdzeW5hcHNlLWRhdGE6L2RhdGEnCiAgICBlbnRyeXBvaW50OiAvYmluL2Jhc2gKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy1jJwogICAgICAtICIjIEdlbmVyYXRlIGNvbmZpZyBvbiBmaXJzdCBydW5cbmlmIFsgISAtZiAvZGF0YS9ob21lc2VydmVyLnlhbWwgXTsgdGhlblxuICAjIEdlbmVyYXRlIGRlZmF1bHQgY29uZmlnIHVzaW5nIFNZTkFQU0VfU0VSVkVSX05BTUUgKHBlcm1hbmVudCwgdXNlZCBpbiB1c2VyIElEcylcbiAgL3N0YXJ0LnB5IGdlbmVyYXRlXG5cbiAgIyBTZXQgcHVibGljX2Jhc2V1cmwgdG8gYWN0dWFsIGRlcGxveW1lbnQgVVJMIChtYXkgZGlmZmVyIGZyb20gc2VydmVyX25hbWUpXG4gICMgVGhpcyBhbGxvd3MgaG9zdGluZyBhdCBtYXRyaXguZXhhbXBsZS5vcmcgd2hpbGUgc2VydmVyX25hbWUgaXMgZXhhbXBsZS5vcmdcbiAgaWYgISBncmVwIC1xIFwicHVibGljX2Jhc2V1cmxcIiAvZGF0YS9ob21lc2VydmVyLnlhbWw7IHRoZW5cbiAgICBzZWQgLWkgXCIvXnNlcnZlcl9uYW1lOi9hIHB1YmxpY19iYXNldXJsOiAke1NFUlZJQ0VfRlFETl9TWU5BUFNFfS9cIiAvZGF0YS9ob21lc2VydmVyLnlhbWxcbiAgZmlcblxuICAjIENvbmZpZ3VyZSBsaXN0ZW5lciBmb3IgcmV2ZXJzZSBwcm94eVxuICBzZWQgLWkgJ3MvYmluZF9hZGRyZXNzZXM6IFxcWy4qXFxdL2JpbmRfYWRkcmVzc2VzOiBbXCIwLjAuMC4wXCJdLycgL2RhdGEvaG9tZXNlcnZlci55YW1sXG4gIHNlZCAtaSAnL3hfZm9yd2FyZGVkOi9kJyAvZGF0YS9ob21lc2VydmVyLnlhbWxcbiAgc2VkIC1pICcvdHlwZTogaHR0cC9hIFxcICAgIHhfZm9yd2FyZGVkOiB0cnVlJyAvZGF0YS9ob21lc2VydmVyLnlhbWxcblxuICAjIEVuYWJsZSByZWdpc3RyYXRpb24gaWYgcmVxdWVzdGVkXG4gIGlmIFsgXCIke0VOQUJMRV9SRUdJU1RSQVRJT059XCIgPSBcInRydWVcIiBdICYmICEgZ3JlcCAtcSBcImVuYWJsZV9yZWdpc3RyYXRpb25cIiAvZGF0YS9ob21lc2VydmVyLnlhbWw7IHRoZW5cbiAgICBlY2hvIFwiZW5hYmxlX3JlZ2lzdHJhdGlvbjogdHJ1ZVwiID4+IC9kYXRhL2hvbWVzZXJ2ZXIueWFtbFxuICBmaVxuZmlcblxuIyBSZWdpc3RlciBhZG1pbiB1c2VyIGlmIGNyZWRlbnRpYWxzIHByb3ZpZGVkXG5pZiBbIC1uIFwiJHtTRVJWSUNFX1VTRVJfQURNSU59XCIgXSAmJiBbIC1uIFwiJHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfVwiIF07IHRoZW5cbiAgKFxuICAgIHdoaWxlICEgY3VybCAtc2YgaHR0cDovL2xvY2FsaG9zdDo4MDA4L2hlYWx0aCA+IC9kZXYvbnVsbCAyPiYxOyBkb1xuICAgICAgc2xlZXAgMlxuICAgIGRvbmVcbiAgICByZWdpc3Rlcl9uZXdfbWF0cml4X3VzZXIgLWEgXFxcbiAgICAgIC11IFwiJHtTRVJWSUNFX1VTRVJfQURNSU59XCIgXFxcbiAgICAgIC1wIFwiJHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfVwiIFxcXG4gICAgICAtYyAvZGF0YS9ob21lc2VydmVyLnlhbWwgXFxcbiAgICAgIGh0dHA6Ly9sb2NhbGhvc3Q6ODAwOCAyPi9kZXYvbnVsbCB8fCB0cnVlXG4gICkgJlxuZmlcblxuZXhlYyAvc3RhcnQucHlcbiIKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDA4L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDIwcwo=",
+        "compose": "c2VydmljZXM6CiAgc3luYXBzZToKICAgIGltYWdlOiAnbWF0cml4ZG90b3JnL3N5bmFwc2U6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1NZTkFQU0VfODAwOAogICAgICAtICdTWU5BUFNFX1NFUlZFUl9OQU1FPSR7U1lOQVBTRV9TRVJWRVJfTkFNRTo/fScKICAgICAgLSAnU1lOQVBTRV9SRVBPUlRfU1RBVFM9JHtTWU5BUFNFX1JFUE9SVF9TVEFUUzotbm99JwogICAgICAtICdFTkFCTEVfUkVHSVNUUkFUSU9OPSR7RU5BQkxFX1JFR0lTVFJBVElPTjotZmFsc2V9JwogICAgICAtICdTRVJWSUNFX1VTRVJfQURNSU49JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdTRVJWSUNFX1BBU1NXT1JEX0FETUlOPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICB2b2x1bWVzOgogICAgICAtICdzeW5hcHNlLWRhdGE6L2RhdGEnCiAgICBlbnRyeXBvaW50OiAvYmluL2Jhc2gKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy1jJwogICAgICAtICIjIEdlbmVyYXRlIGNvbmZpZyBvbiBmaXJzdCBydW5cbmlmIFsgISAtZiAvZGF0YS9ob21lc2VydmVyLnlhbWwgXTsgdGhlblxuICAjIEdlbmVyYXRlIGRlZmF1bHQgY29uZmlnIHVzaW5nIFNZTkFQU0VfU0VSVkVSX05BTUUgKHBlcm1hbmVudCwgdXNlZCBpbiB1c2VyIElEcylcbiAgL3N0YXJ0LnB5IGdlbmVyYXRlXG5cbiAgIyBTZXQgcHVibGljX2Jhc2V1cmwgdG8gYWN0dWFsIGRlcGxveW1lbnQgVVJMIChtYXkgZGlmZmVyIGZyb20gc2VydmVyX25hbWUpXG4gICMgVGhpcyBhbGxvd3MgaG9zdGluZyBhdCBtYXRyaXguZXhhbXBsZS5vcmcgd2hpbGUgc2VydmVyX25hbWUgaXMgZXhhbXBsZS5vcmdcbiAgaWYgISBncmVwIC1xIFwicHVibGljX2Jhc2V1cmxcIiAvZGF0YS9ob21lc2VydmVyLnlhbWw7IHRoZW5cbiAgICBzZWQgLWkgXCIvXnNlcnZlcl9uYW1lOi9hIHB1YmxpY19iYXNldXJsOiAke1NFUlZJQ0VfRlFETl9TWU5BUFNFfS9cIiAvZGF0YS9ob21lc2VydmVyLnlhbWxcbiAgZmlcblxuICAjIENvbmZpZ3VyZSBsaXN0ZW5lciBmb3IgcmV2ZXJzZSBwcm94eVxuICBzZWQgLWkgJ3MvYmluZF9hZGRyZXNzZXM6IFxcWy4qXFxdL2JpbmRfYWRkcmVzc2VzOiBbXCIwLjAuMC4wXCJdLycgL2RhdGEvaG9tZXNlcnZlci55YW1sXG4gIHNlZCAtaSAnL3hfZm9yd2FyZGVkOi9kJyAvZGF0YS9ob21lc2VydmVyLnlhbWxcbiAgc2VkIC1pICcvdHlwZTogaHR0cC9hIFxcICAgIHhfZm9yd2FyZGVkOiB0cnVlJyAvZGF0YS9ob21lc2VydmVyLnlhbWxcblxuICAjIEVuYWJsZSByZWdpc3RyYXRpb24gaWYgcmVxdWVzdGVkXG4gIGlmIFsgXCIke0VOQUJMRV9SRUdJU1RSQVRJT059XCIgPSBcInRydWVcIiBdICYmICEgZ3JlcCAtcSBcImVuYWJsZV9yZWdpc3RyYXRpb25cIiAvZGF0YS9ob21lc2VydmVyLnlhbWw7IHRoZW5cbiAgICBlY2hvIFwiZW5hYmxlX3JlZ2lzdHJhdGlvbjogdHJ1ZVwiID4+IC9kYXRhL2hvbWVzZXJ2ZXIueWFtbFxuICBmaVxuZmlcblxuIyBSZWdpc3RlciBhZG1pbiB1c2VyIGlmIGNyZWRlbnRpYWxzIHByb3ZpZGVkXG5pZiBbIC1uIFwiJHtTRVJWSUNFX1VTRVJfQURNSU59XCIgXSAmJiBbIC1uIFwiJHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfVwiIF07IHRoZW5cbiAgKFxuICAgIHdoaWxlICEgY3VybCAtc2YgaHR0cDovL2xvY2FsaG9zdDo4MDA4L2hlYWx0aCA+IC9kZXYvbnVsbCAyPiYxOyBkb1xuICAgICAgc2xlZXAgMlxuICAgIGRvbmVcbiAgICByZWdpc3Rlcl9uZXdfbWF0cml4X3VzZXIgLWEgXFxcbiAgICAgIC11IFwiJHtTRVJWSUNFX1VTRVJfQURNSU59XCIgXFxcbiAgICAgIC1wIFwiJHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfVwiIFxcXG4gICAgICAtYyAvZGF0YS9ob21lc2VydmVyLnlhbWwgXFxcbiAgICAgIGh0dHA6Ly9sb2NhbGhvc3Q6ODAwOCAyPi9kZXYvbnVsbCB8fCB0cnVlXG4gICkgJlxuZmlcblxuZXhlYyAvc3RhcnQucHkiCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODAwOC9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAyMHMK",
         "tags": [
             "chat",
             "slack",
@@ -3349,21 +2884,6 @@
         "template_last_updated_at": "2026-05-12T09:22:15+02:00",
         "port": "9000"
     },
-    "mediawiki": {
-        "documentation": "https://www.mediawiki.org?utm_source=coolify.io",
-        "slogan": "MediaWiki is a collaboration and documentation platform brought to you by a vibrant community.",
-        "compose": "c2VydmljZXM6CiAgbWVkaWF3aWtpOgogICAgaW1hZ2U6ICdtZWRpYXdpa2k6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX01FRElBV0lLSV84MAogICAgdm9sdW1lczoKICAgICAgLSAnbWVkaWF3aWtpLWltYWdlczovdmFyL3d3dy9odG1sL2ltYWdlcycKICAgICAgLSAnbWVkaWF3aWtpLXNxbGl0ZTovdmFyL3d3dy9odG1sL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODAnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "wiki",
-            "collaboration",
-            "documentation"
-        ],
-        "category": "cms",
-        "logo": "svgs/mediawiki.ico",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "meilisearch": {
         "documentation": "https://www.meilisearch.com?utm_source=coolify.io",
         "slogan": "MeiliSearch is a powerful, fast, easy to use and deploy search engine.",
@@ -3494,45 +3014,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "8080"
     },
-    "mixpost": {
-        "documentation": "https://docs.mixpost.app/lite?utm_source=coolify.io",
-        "slogan": "Mixpost is a robust and versatile social media management software, designed to streamline social media operations and enhance content marketing strategies.",
-        "compose": "c2VydmljZXM6CiAgbWl4cG9zdDoKICAgIGltYWdlOiAnaW5vdmVjdG9yL21peHBvc3Q6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX01JWFBPU1QKICAgICAgLSBBUFBfTkFNRT1NaXhwb3N0CiAgICAgIC0gJ0FQUF9LRVk9JHtTRVJWSUNFX0JBU0U2NF9NSVhQT1NUfScKICAgICAgLSBBUFBfREVCVUc9ZmFsc2UKICAgICAgLSAnQVBQX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9NSVhQT1NUfScKICAgICAgLSAnQVBQX1VSTD0ke1NFUlZJQ0VfRlFETl9NSVhQT1NUfScKICAgICAgLSAnREJfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotbWl4cG9zdF9kYn0nCiAgICAgIC0gJ0RCX1VTRVJOQU1FPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnU1NMX0VNQUlMPSR7U1NMX0VNQUlMOi11c2VyQGV4YW1wbGUuY29tfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21peHBvc3Qtc3RvcmFnZTovdmFyL3d3dy9odG1sL3N0b3JhZ2UvYXBwJwogICAgICAtICdtaXhwb3N0LWxvZ3M6L3Zhci93d3cvaHRtbC9zdG9yYWdlL2xvZ3MnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG15c3FsCiAgICAgIC0gcmVkaXMKICBteXNxbDoKICAgIGltYWdlOiAnbXlzcWwvbXlzcWwtc2VydmVyOjguMCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1taXhwb3N0X2RifScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICB2b2x1bWVzOgogICAgICAtICdtaXhwb3N0LW15c3FsOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICAgIC0gJy11cm9vdCcKICAgICAgICAtICctcCR7U0VSVklDRV9QQVNTV09SRF9NWVNRTFJPT1R9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOmFscGluZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtICctLXJhdycKICAgICAgICAtIGluY3IKICAgICAgICAtIHBpbmcK",
-        "tags": [
-            "social media",
-            "marketing",
-            "content",
-            "management",
-            "automation",
-            "self-hosted"
-        ],
-        "category": "analytics",
-        "logo": "svgs/mixpost.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
-    "moodle": {
-        "documentation": "https://moodle.org?utm_source=coolify.io",
-        "slogan": "Moodle is the world\u2019s most customisable and trusted eLearning solution that empowers educators to improve our world.",
-        "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4xJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQUxMT1dfRU1QVFlfUEFTU1dPUkQ9bm8KICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1iaXRuYW1pX21vb2RsZQogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIE1BUklBREJfQ0hBUkFDVEVSX1NFVD11dGY4bWI0CiAgICAgIC0gTUFSSUFEQl9DT0xMQVRFPXV0ZjhtYjRfdW5pY29kZV9jaQogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc8L2Rldi90Y3AvbG9jYWxob3N0LzMzMDYnIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBtb29kbGU6CiAgICBpbWFnZTogJ2RvY2tlci5pby9iaXRuYW1pbGVnYWN5L21vb2RsZTo0LjMnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9NT09ETEVfODA4MAogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9IT1NUPW1hcmlhZGIKICAgICAgLSBNT09ETEVfREFUQUJBU0VfUE9SVF9OVU1CRVI9MzMwNgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9VU0VSPSRTRVJWSUNFX1VTRVJfTUFSSUFEQgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9OQU1FPWJpdG5hbWlfbW9vZGxlCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01BUklBREIKICAgICAgLSBBTExPV19FTVBUWV9QQVNTV09SRD1ubwogICAgICAtICdNT09ETEVfVVNFUk5BTUU9JHtNT09ETEVfVVNFUk5BTUU6LXVzZXJ9JwogICAgICAtIE1PT0RMRV9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NT09ETEUKICAgICAgLSBNT09ETEVfRU1BSUw9dXNlckBleGFtcGxlLmNvbQogICAgICAtICdNT09ETEVfU0lURV9OQU1FPSR7TU9PRExFX1NJVEVfTkFNRTotTmV3IFNpdGV9JwogICAgdm9sdW1lczoKICAgICAgLSAnbW9vZGxlLWRhdGE6L2JpdG5hbWkvbW9vZGxlJwogICAgICAtICdtb29kbGVkYXRhLWRhdGE6L2JpdG5hbWkvbW9vZGxlZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwaHAKICAgICAgICAtICctcicKICAgICAgICAtICJleGl0KGZpbGVfZXhpc3RzKCcvb3B0L2JpdG5hbWkvbW9vZGxlL2NvbmZpZy5waHAnKSA/IDAgOiAxKTsiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUK",
-        "tags": [
-            "moodle",
-            "elearning",
-            "education",
-            "lms",
-            "cms",
-            "open",
-            "source",
-            "low",
-            "code"
-        ],
-        "category": "cms",
-        "logo": "svgs/moodle.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-09T09:49:33+05:30",
-        "port": "8080"
-    },
     "mosquitto": {
         "documentation": "https://mosquitto.org/documentation/?utm_source=coolify.io",
         "slogan": "Mosquitto is lightweight and suitable for use on all devices, from low-power single-board computers to full servers.",
@@ -3703,74 +3184,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "3000"
     },
-    "nextcloud-with-mariadb": {
-        "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
-        "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TUFSSUFEQl9EQVRBQkFTRTotbmV4dGNsb3VkfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtIE1ZU1FMX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3N0YXR1cy5waHAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLW1hcmlhZGItZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gUElORwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDIwCg==",
-        "tags": [
-            "cloud",
-            "collaboration",
-            "communication",
-            "filestorage",
-            "data"
-        ],
-        "category": "storage",
-        "logo": "svgs/nextcloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-07T23:32:57+05:30",
-        "port": "80"
-    },
-    "nextcloud-with-mysql": {
-        "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
-        "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LW5leHRjbG91ZH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtIE1ZU1FMX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3N0YXR1cy5waHAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdteXNxbDo4LjQuMicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLXJlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMjAK",
-        "tags": [
-            "cloud",
-            "collaboration",
-            "communication",
-            "filestorage",
-            "data"
-        ],
-        "category": "storage",
-        "logo": "svgs/nextcloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-07T23:32:57+05:30",
-        "port": "80"
-    },
-    "nextcloud-with-postgres": {
-        "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
-        "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LW5leHRjbG91ZH0nCiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtIFBPU1RHUkVTX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3N0YXR1cy5waHAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtcG9zdGdyZXNxbC1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbmV4dGNsb3VkfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gUElORwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDIwCg==",
-        "tags": [
-            "cloud",
-            "collaboration",
-            "communication",
-            "filestorage",
-            "data"
-        ],
-        "category": "storage",
-        "logo": "svgs/nextcloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-07T23:32:57+05:30",
-        "port": "80"
-    },
-    "nextcloud": {
-        "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
-        "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9NYWRyaWR9JwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MC9zdGF0dXMucGhwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "cloud",
-            "collaboration",
-            "communication",
-            "filestorage",
-            "data"
-        ],
-        "category": "storage",
-        "logo": "svgs/nextcloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-07T23:32:57+05:30",
-        "port": "80"
-    },
     "nexus-arm": {
         "documentation": "https://help.sonatype.com/en/sonatype-nexus-repository.html?utm_source=coolify.io",
         "slogan": "Open source Universal Repository Manager (ARM version, community edition), default credentials: admin/admin123",
@@ -3914,24 +3327,10 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
-    "observium": {
-        "documentation": "https://docs.observium.org/?utm_source=coolify.io",
-        "slogan": "Observium is a comprehensive network monitoring platform designed to deliver powerful monitoring capabilities, combined with an elegant and intuitive user interface.",
-        "compose": "c2VydmljZXM6CiAgb2JzZXJ2aXVtOgogICAgaW1hZ2U6ICdtYml4dGVjaC9vYnNlcnZpdW06bGF0ZXN0JwogICAgcGxhdGZvcm06IGxpbnV4L2FtZDY0CiAgICB2b2x1bWVzOgogICAgICAtICdvYnNlcnZpdW1fbG9nczovb3B0L29ic2Vydml1bS9sb2dzJwogICAgICAtICdvYnNlcnZpdW1fcnJkOi9vcHQvb2JzZXJ2aXVtL3JyZCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdTRVJWSUNFX0ZRRE5fT0JTRVJWSVVNPSR7U0VSVklDRV9GUUROX09CU0VSVklVTX0nCiAgICAgIC0gJ09CU0VSVklVTV9BRE1JTl9QQVNTPSR7U0VSVklDRV9QQVNTV09SRF9PQlNFUlZJVU1BRE1JTn0nCiAgICAgIC0gJ09CU0VSVklVTV9BRE1JTl9VU0VSPSR7U0VSVklDRV9VU0VSX09CU0VSVklVTUFETUlOfScKICAgICAgLSBPQlNFUlZJVU1fREJfSE9TVD1tYXJpYWRiCiAgICAgIC0gJ09CU0VSVklVTV9EQl9OQU1FPSR7T0JTRVJWSVVNX0RCX05BTUU6LW9ic2Vydml1bS1kYn0nCiAgICAgIC0gJ09CU0VSVklVTV9EQl9QQVNTPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnT0JTRVJWSVVNX0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3QvJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogNXMKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOmx0cycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ29ic2Vydml1bV9tYXJpYWRiX2RhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUFSSUFEQl9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCUk9PVH0nCiAgICAgIC0gJ01BUklBREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnTUFSSUFEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ01BUklBREJfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1vYnNlcnZpdW0tZGJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMK",
-        "tags": [
-            "networking",
-            "monitoring"
-        ],
-        "category": "monitoring",
-        "logo": "svgs/observium.webp",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "obsidian-livesync": {
         "documentation": "https://github.com/vrtmrz/obsidian-livesync/blob/main/docs/setup_own_server.md?utm_source=coolify.io",
         "slogan": "Self-hosted sync backend for Obsidian LiveSync plugin using CouchDB",
-        "compose": "c2VydmljZXM6CiAgY291Y2hkYjoKICAgIGltYWdlOiAnY291Y2hkYjozLjQuMicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9DT1VDSERCXzU5ODQKICAgICAgLSAnQ09VQ0hEQl9VU0VSPSR7U0VSVklDRV9VU0VSX0NPVUNIREJ9JwogICAgICAtICdDT1VDSERCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9DT1VDSERCfScKICAgICAgLSAnTUFYX0RPQ1VNRU5UX1NJWkU9JHtNQVhfRE9DVU1FTlRfU0laRTotNTI0Mjg4MDB9JwogICAgICAtICdNQVhfSFRUUF9SRVFVRVNUX1NJWkU9JHtNQVhfSFRUUF9SRVFVRVNUX1NJWkU6LTY3MTA4ODY0fScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2xvY2FsLmluaQogICAgICAgIHRhcmdldDogL29wdC9jb3VjaGRiL2V0Yy9sb2NhbC5pbmkKICAgICAgICBjb250ZW50OiAiW2NvdWNoZGJdXG5zaW5nbGVfbm9kZT10cnVlXG5tYXhfZG9jdW1lbnRfc2l6ZSA9ICR7TUFYX0RPQ1VNRU5UX1NJWkV9XG5cbltjaHR0cGRdXG5yZXF1aXJlX3ZhbGlkX3VzZXIgPSB0cnVlXG5tYXhfaHR0cF9yZXF1ZXN0X3NpemUgPSAke01BWF9IVFRQX1JFUVVFU1RfU0laRX1cblxuW2NodHRwZF9hdXRoXVxucmVxdWlyZV92YWxpZF91c2VyID0gdHJ1ZVxuYXV0aGVudGljYXRpb25fcmVkaXJlY3QgPSAvX3V0aWxzL3Nlc3Npb24uaHRtbFxuXG5baHR0cGRdXG5XV1ctQXV0aGVudGljYXRlID0gQmFzaWMgcmVhbG09XCJjb3VjaGRiXCJcbmVuYWJsZV9jb3JzID0gdHJ1ZVxuXG5bY29yc11cbm9yaWdpbnMgPSBhcHA6Ly9vYnNpZGlhbi5tZCxjYXBhY2l0b3I6Ly9sb2NhbGhvc3QsaHR0cDovL2xvY2FsaG9zdFxuY3JlZGVudGlhbHMgPSB0cnVlXG5oZWFkZXJzID0gYWNjZXB0LCBhdXRob3JpemF0aW9uLCBjb250ZW50LXR5cGUsIG9yaWdpbiwgcmVmZXJlclxubWV0aG9kcyA9IEdFVCwgUFVULCBQT1NULCBIRUFELCBERUxFVEVcbm1heF9hZ2UgPSAzNjAwIgogICAgICAtICdjb3VjaGRiLWRhdGE6L29wdC9jb3VjaGRiL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLWYgLXUgIiQke0NPVUNIREJfVVNFUn06JCR7Q09VQ0hEQl9QQVNTV09SRH0iIGh0dHA6Ly9sb2NhbGhvc3Q6NTk4NC9fdXAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHN0YXJ0X3BlcmlvZDogNDBzCiAgICAgIHJldHJpZXM6IDMKdm9sdW1lczoKICBjb3VjaGRiLWRhdGE6IG51bGwK",
+        "compose": "c2VydmljZXM6CiAgY291Y2hkYjoKICAgIGltYWdlOiAnY291Y2hkYjozLjQuMicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9DT1VDSERCXzU5ODQKICAgICAgLSAnQ09VQ0hEQl9VU0VSPSR7U0VSVklDRV9VU0VSX0NPVUNIREJ9JwogICAgICAtICdDT1VDSERCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9DT1VDSERCfScKICAgICAgLSAnTUFYX0RPQ1VNRU5UX1NJWkU9JHtNQVhfRE9DVU1FTlRfU0laRTotNTI0Mjg4MDB9JwogICAgICAtICdNQVhfSFRUUF9SRVFVRVNUX1NJWkU9JHtNQVhfSFRUUF9SRVFVRVNUX1NJWkU6LTY3MTA4ODY0fScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2xvY2FsLmluaQogICAgICAgIHRhcmdldDogL29wdC9jb3VjaGRiL2V0Yy9sb2NhbC5pbmkKICAgICAgICBjb250ZW50OiAiW2NvdWNoZGJdXG5zaW5nbGVfbm9kZT10cnVlXG5tYXhfZG9jdW1lbnRfc2l6ZSA9ICR7TUFYX0RPQ1VNRU5UX1NJWkV9XG5cbltjaHR0cGRdXG5yZXF1aXJlX3ZhbGlkX3VzZXIgPSB0cnVlXG5tYXhfaHR0cF9yZXF1ZXN0X3NpemUgPSAke01BWF9IVFRQX1JFUVVFU1RfU0laRX1cblxuW2NodHRwZF9hdXRoXVxucmVxdWlyZV92YWxpZF91c2VyID0gdHJ1ZVxuYXV0aGVudGljYXRpb25fcmVkaXJlY3QgPSAvX3V0aWxzL3Nlc3Npb24uaHRtbFxuXG5baHR0cGRdXG5XV1ctQXV0aGVudGljYXRlID0gQmFzaWMgcmVhbG09XCJjb3VjaGRiXCJcbmVuYWJsZV9jb3JzID0gdHJ1ZVxuXG5bY29yc11cbm9yaWdpbnMgPSBhcHA6Ly9vYnNpZGlhbi5tZCxjYXBhY2l0b3I6Ly9sb2NhbGhvc3QsaHR0cDovL2xvY2FsaG9zdFxuY3JlZGVudGlhbHMgPSB0cnVlXG5oZWFkZXJzID0gYWNjZXB0LCBhdXRob3JpemF0aW9uLCBjb250ZW50LXR5cGUsIG9yaWdpbiwgcmVmZXJlclxubWV0aG9kcyA9IEdFVCwgUFVULCBQT1NULCBIRUFELCBERUxFVEVcbm1heF9hZ2UgPSAzNjAwXG4iCiAgICAgIC0gJ2NvdWNoZGItZGF0YTovb3B0L2NvdWNoZGIvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiAtdSAiJCR7Q09VQ0hEQl9VU0VSfTokJHtDT1VDSERCX1BBU1NXT1JEfSIgaHR0cDovL2xvY2FsaG9zdDo1OTg0L191cCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgc3RhcnRfcGVyaW9kOiA0MHMKICAgICAgcmV0cmllczogMwp2b2x1bWVzOgogIGNvdWNoZGItZGF0YTogbnVsbAo=",
         "tags": [
             "obsidian",
             "couchdb",
@@ -3981,7 +3380,7 @@
         "category": "productivity",
         "logo": "svgs/odoo.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "template_last_updated_at": "2026-10-19T21:46:16+02:00",
         "port": "8069"
     },
     "ollama-with-open-webui": {
@@ -4136,7 +3535,7 @@
     "openpanel": {
         "documentation": "https://openpanel.dev/docs?utm_source=coolify.io",
         "slogan": "Open source alternative to Mixpanel and Plausible for product analytics",
-        "compose": "c2VydmljZXM6CiAgb3BlbnBhbmVsLWRhc2hib2FyZDoKICAgIGltYWdlOiAnbGluZGVzdmFyZC9vcGVucGFuZWwtZGFzaGJvYXJkOjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gU0VMRl9IT1NURUQ9dHJ1ZQogICAgICAtIFNFUlZJQ0VfRlFETl9PUERBU0hCT0FSRF8zMDAwCiAgICAgIC0gJ0FQSV9VUkw9JHtTRVJWSUNFX0ZRRE5fT1BBUEl9JwogICAgICAtICdEQVNIQk9BUkRfVVJMPSR7U0VSVklDRV9GUUROX09QREFTSEJPQVJEfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke09QRU5QQU5FTF9QT1NUR1JFU19EQjotb3BlbnBhbmVsLWRifT9zY2hlbWE9cHVibGljJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9kZWZhdWx0OiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQ0xJQ0tIT1VTRV9VUkw9aHR0cDovL2NsaWNraG91c2U6ODEyMy9vcGVucGFuZWwnCiAgICBkZXBlbmRzX29uOgogICAgICBvcGVucGFuZWwtYXBpOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9wZW5wYW5lbC13b3JrZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mIGh0dHA6Ly9sb2NhbGhvc3Q6MzAwMC9hcGkvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxNXMKICBvcGVucGFuZWwtYXBpOgogICAgaW1hZ2U6ICdsaW5kZXN2YXJkL29wZW5wYW5lbC1hcGk6MicKICAgIGNvbW1hbmQ6ICJzaCAtYyBcIlxuICBlY2hvICdSdW5uaW5nIG1pZ3JhdGlvbnMuLi4nXG4gIENJPXRydWUgcG5wbSAtciBydW4gbWlncmF0ZTpkZXBsb3lcblxuICBwbnBtIHN0YXJ0XG5cIlxuIgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFNFTEZfSE9TVEVEPXRydWUKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1BBUEkKICAgICAgLSAnQVBJX1VSTD0ke1NFUlZJQ0VfRlFETl9PUEFQSX0nCiAgICAgIC0gJ0RBU0hCT0FSRF9VUkw9JHtTRVJWSUNFX0ZRRE5fT1BEQVNIQk9BUkR9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9P3NjaGVtYT1wdWJsaWMnCiAgICAgIC0gJ0RBVEFCQVNFX1VSTF9ESVJFQ1Q9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9P3NjaGVtYT1wdWJsaWMnCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpczovL2RlZmF1bHQ6JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfUByZWRpczo2Mzc5JwogICAgICAtICdDTElDS0hPVVNFX1VSTD1odHRwOi8vY2xpY2tob3VzZTo4MTIzL29wZW5wYW5lbCcKICAgICAgLSAnQ09PS0lFX1NFQ1JFVD0ke1NFUlZJQ0VfQkFTRTY0X0NPT0tJRVNFQ1JFVH0nCiAgICAgIC0gJ0FMTE9XX1JFR0lTVFJBVElPTj0ke09QRU5QQU5FTF9BTExPV19SRUdJU1RSQVRJT046LWZhbHNlfScKICAgICAgLSAnQUxMT1dfSU5WSVRBVElPTj0ke09QRU5QQU5FTF9BTExPV19JTlZJVEFUSU9OOi1mYWxzZX0nCiAgICAgIC0gJ0VNQUlMX1NFTkRFUj0ke09QRU5QQU5FTF9FTUFJTF9TRU5ERVJ9JwogICAgICAtICdSRVNFTkRfQVBJX0tFWT0ke1JFU0VORF9BUElfS0VZfScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiBodHRwOi8vbG9jYWxob3N0OjMwMDAvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBvcGVucGFuZWwtd29ya2VyOgogICAgaW1hZ2U6ICdsaW5kZXN2YXJkL29wZW5wYW5lbC13b3JrZXI6MicKICAgIGVudmlyb25tZW50OgogICAgICAtICdESVNBQkxFX0JVTExCT0FSRD0ke0RJU0FCTEVfQlVMTEJPQVJEOi0xfScKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gU0VMRl9IT1NURUQ9dHJ1ZQogICAgICAtIFNFUlZJQ0VfRlFETl9PUEJVTExCT0FSRAogICAgICAtICdBUElfVVJMPSR7U0VSVklDRV9GUUROX09QQVBJfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke09QRU5QQU5FTF9QT1NUR1JFU19EQjotb3BlbnBhbmVsLWRifT9zY2hlbWE9cHVibGljJwogICAgICAtICdEQVRBQkFTRV9VUkxfRElSRUNUPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke09QRU5QQU5FTF9QT1NUR1JFU19EQjotb3BlbnBhbmVsLWRifT9zY2hlbWE9cHVibGljJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9kZWZhdWx0OiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQ0xJQ0tIT1VTRV9VUkw9aHR0cDovL2NsaWNraG91c2U6ODEyMy9vcGVucGFuZWwnCiAgICBkZXBlbmRzX29uOgogICAgICBvcGVucGFuZWwtYXBpOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiBodHRwOi8vbG9jYWxob3N0OjMwMDAvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiA1cwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdvcGVucGFuZWxfcG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfREI9JHtPUEVOUEFORUxfUE9TVEdSRVNfREI6LW9wZW5wYW5lbC1kYn0nCiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjcuNC1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdvcGVucGFuZWxfcmVkaXNfZGF0YTovZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLXJlcXVpcmVwYXNzICR7U0VSVklDRV9QQVNTV09SRF9SRURJU30gLS1tYXhtZW1vcnktcG9saWN5IG5vZXZpY3Rpb24nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgY2xpY2tob3VzZToKICAgIGltYWdlOiAnY2xpY2tob3VzZS9jbGlja2hvdXNlLXNlcnZlcjoyNS4xMC4yLjY1JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQ0xJQ0tIT1VTRV9TS0lQX1VTRVJfU0VUVVA9MQogICAgdm9sdW1lczoKICAgICAgLSAnb3BlbnBhbmVsX2NsaWNraG91c2VfZGF0YTovdmFyL2xpYi9jbGlja2hvdXNlJwogICAgICAtICdvcGVucGFuZWxfY2xpY2tob3VzZV9sb2dzOi92YXIvbG9nL2NsaWNraG91c2Utc2VydmVyJwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlLWNvbmZpZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvb3AtY29uZmlnLnhtbAogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICI8Y2xpY2tob3VzZT5cbiAgICA8bG9nZ2VyPlxuICAgICAgICA8bGV2ZWw+d2FybmluZzwvbGV2ZWw+XG4gICAgICAgIDxjb25zb2xlPnRydWU8L2NvbnNvbGU+XG4gICAgPC9sb2dnZXI+XG4gICAgPGtlZXBfYWxpdmVfdGltZW91dD4xMDwva2VlcF9hbGl2ZV90aW1lb3V0PlxuICAgIDwhLS0gU3RvcCBhbGwgdGhlIHVubmVjZXNzYXJ5IGxvZ2dpbmcgLS0+XG4gICAgPHF1ZXJ5X3RocmVhZF9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxxdWVyeV9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDx0ZXh0X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHRyYWNlX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPG1ldHJpY19sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxhc3luY2hyb25vdXNfbWV0cmljX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHNlc3Npb25fbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8cGFydF9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxsaXN0ZW5faG9zdD4wLjAuMC4wPC9saXN0ZW5faG9zdD5cbiAgICA8aW50ZXJzZXJ2ZXJfbGlzdGVuX2hvc3Q+MC4wLjAuMDwvaW50ZXJzZXJ2ZXJfbGlzdGVuX2hvc3Q+XG4gICAgPGludGVyc2VydmVyX2h0dHBfaG9zdD5vcGNoPC9pbnRlcnNlcnZlcl9odHRwX2hvc3Q+XG4gICAgPCEtLSBEaXNhYmxlIGNncm91cCBtZW1vcnkgb2JzZXJ2ZXIgLS0+XG4gICAgPGNncm91cHNfbWVtb3J5X3VzYWdlX29ic2VydmVyX3dhaXRfdGltZT4wPC9jZ3JvdXBzX21lbW9yeV91c2FnZV9vYnNlcnZlcl93YWl0X3RpbWU+XG4gICAgPCEtLSBOb3QgdXNlZCBhbnltb3JlLCBidXQga2VwdCBmb3IgYmFja3dhcmRzIGNvbXBhdGliaWxpdHkgLS0+XG4gICAgPG1hY3Jvcz5cbiAgICAgICAgPHNoYXJkPjE8L3NoYXJkPlxuICAgICAgICA8cmVwbGljYT5yZXBsaWNhMTwvcmVwbGljYT5cbiAgICAgICAgPGNsdXN0ZXI+b3BlbnBhbmVsX2NsdXN0ZXI8L2NsdXN0ZXI+XG4gICAgPC9tYWNyb3M+XG48L2NsaWNraG91c2U+IgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlLXVzZXItY29uZmlnLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci91c2Vycy5kL29wLXVzZXItY29uZmlnLnhtbAogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICI8Y2xpY2tob3VzZT5cbiAgICA8cHJvZmlsZXM+XG4gICAgICAgIDxkZWZhdWx0PlxuICAgICAgICAgICAgPGxvZ19xdWVyaWVzPjA8L2xvZ19xdWVyaWVzPlxuICAgICAgICAgICAgPGxvZ19xdWVyeV90aHJlYWRzPjA8L2xvZ19xdWVyeV90aHJlYWRzPlxuICAgICAgICA8L2RlZmF1bHQ+XG4gICAgPC9wcm9maWxlcz5cbjwvY2xpY2tob3VzZT5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vaW5pdC1kYi5zaAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtZGIuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL3NoXG5zZXQgLWVcblxuY2xpY2tob3VzZSBjbGllbnQgLW4gPDwtRU9TUUxcbiAgQ1JFQVRFIERBVEFCQVNFIElGIE5PVCBFWElTVFMgb3BlbnBhbmVsO1xuRU9TUUwiCiAgICB1bGltaXRzOgogICAgICBub2ZpbGU6CiAgICAgICAgc29mdDogMjYyMTQ0CiAgICAgICAgaGFyZDogMjYyMTQ0CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2NsaWNraG91c2UtY2xpZW50IC0tcXVlcnkgIlNFTEVDVCAxIicKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1Cg==",
+        "compose": "c2VydmljZXM6CiAgb3BlbnBhbmVsLWRhc2hib2FyZDoKICAgIGltYWdlOiAnbGluZGVzdmFyZC9vcGVucGFuZWwtZGFzaGJvYXJkOjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gU0VMRl9IT1NURUQ9dHJ1ZQogICAgICAtIFNFUlZJQ0VfRlFETl9PUERBU0hCT0FSRF8zMDAwCiAgICAgIC0gJ0FQSV9VUkw9JHtTRVJWSUNFX0ZRRE5fT1BBUEl9JwogICAgICAtICdEQVNIQk9BUkRfVVJMPSR7U0VSVklDRV9GUUROX09QREFTSEJPQVJEfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke09QRU5QQU5FTF9QT1NUR1JFU19EQjotb3BlbnBhbmVsLWRifT9zY2hlbWE9cHVibGljJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9kZWZhdWx0OiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQ0xJQ0tIT1VTRV9VUkw9aHR0cDovL2NsaWNraG91c2U6ODEyMy9vcGVucGFuZWwnCiAgICBkZXBlbmRzX29uOgogICAgICBvcGVucGFuZWwtYXBpOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9wZW5wYW5lbC13b3JrZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mIGh0dHA6Ly9sb2NhbGhvc3Q6MzAwMC9hcGkvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxNXMKICBvcGVucGFuZWwtYXBpOgogICAgaW1hZ2U6ICdsaW5kZXN2YXJkL29wZW5wYW5lbC1hcGk6MicKICAgIGNvbW1hbmQ6ICJzaCAtYyBcIlxuICBlY2hvICdSdW5uaW5nIG1pZ3JhdGlvbnMuLi4nXG4gIENJPXRydWUgcG5wbSAtciBydW4gbWlncmF0ZTpkZXBsb3lcblxuICBwbnBtIHN0YXJ0XG5cIlxuIgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFNFTEZfSE9TVEVEPXRydWUKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1BBUEkKICAgICAgLSAnQVBJX1VSTD0ke1NFUlZJQ0VfRlFETl9PUEFQSX0nCiAgICAgIC0gJ0RBU0hCT0FSRF9VUkw9JHtTRVJWSUNFX0ZRRE5fT1BEQVNIQk9BUkR9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9P3NjaGVtYT1wdWJsaWMnCiAgICAgIC0gJ0RBVEFCQVNFX1VSTF9ESVJFQ1Q9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7T1BFTlBBTkVMX1BPU1RHUkVTX0RCOi1vcGVucGFuZWwtZGJ9P3NjaGVtYT1wdWJsaWMnCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpczovL2RlZmF1bHQ6JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfUByZWRpczo2Mzc5JwogICAgICAtICdDTElDS0hPVVNFX1VSTD1odHRwOi8vY2xpY2tob3VzZTo4MTIzL29wZW5wYW5lbCcKICAgICAgLSAnQ09PS0lFX1NFQ1JFVD0ke1NFUlZJQ0VfQkFTRTY0X0NPT0tJRVNFQ1JFVH0nCiAgICAgIC0gJ0FMTE9XX1JFR0lTVFJBVElPTj0ke09QRU5QQU5FTF9BTExPV19SRUdJU1RSQVRJT046LWZhbHNlfScKICAgICAgLSAnQUxMT1dfSU5WSVRBVElPTj0ke09QRU5QQU5FTF9BTExPV19JTlZJVEFUSU9OOi1mYWxzZX0nCiAgICAgIC0gJ0VNQUlMX1NFTkRFUj0ke09QRU5QQU5FTF9FTUFJTF9TRU5ERVJ9JwogICAgICAtICdSRVNFTkRfQVBJX0tFWT0ke1JFU0VORF9BUElfS0VZfScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiBodHRwOi8vbG9jYWxob3N0OjMwMDAvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBvcGVucGFuZWwtd29ya2VyOgogICAgaW1hZ2U6ICdsaW5kZXN2YXJkL29wZW5wYW5lbC13b3JrZXI6MicKICAgIGVudmlyb25tZW50OgogICAgICAtICdESVNBQkxFX0JVTExCT0FSRD0ke0RJU0FCTEVfQlVMTEJPQVJEOi0xfScKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gU0VMRl9IT1NURUQ9dHJ1ZQogICAgICAtIFNFUlZJQ0VfRlFETl9PUEJVTExCT0FSRAogICAgICAtICdBUElfVVJMPSR7U0VSVklDRV9GUUROX09QQVBJfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke09QRU5QQU5FTF9QT1NUR1JFU19EQjotb3BlbnBhbmVsLWRifT9zY2hlbWE9cHVibGljJwogICAgICAtICdEQVRBQkFTRV9VUkxfRElSRUNUPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke09QRU5QQU5FTF9QT1NUR1JFU19EQjotb3BlbnBhbmVsLWRifT9zY2hlbWE9cHVibGljJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9kZWZhdWx0OiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQ0xJQ0tIT1VTRV9VUkw9aHR0cDovL2NsaWNraG91c2U6ODEyMy9vcGVucGFuZWwnCiAgICBkZXBlbmRzX29uOgogICAgICBvcGVucGFuZWwtYXBpOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZiBodHRwOi8vbG9jYWxob3N0OjMwMDAvaGVhbHRoY2hlY2sgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiA1cwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdvcGVucGFuZWxfcG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfREI9JHtPUEVOUEFORUxfUE9TVEdSRVNfREI6LW9wZW5wYW5lbC1kYn0nCiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjcuNC1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdvcGVucGFuZWxfcmVkaXNfZGF0YTovZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLXJlcXVpcmVwYXNzICR7U0VSVklDRV9QQVNTV09SRF9SRURJU30gLS1tYXhtZW1vcnktcG9saWN5IG5vZXZpY3Rpb24nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgY2xpY2tob3VzZToKICAgIGltYWdlOiAnY2xpY2tob3VzZS9jbGlja2hvdXNlLXNlcnZlcjoyNS4xMC4yLjY1JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQ0xJQ0tIT1VTRV9TS0lQX1VTRVJfU0VUVVA9MQogICAgdm9sdW1lczoKICAgICAgLSAnb3BlbnBhbmVsX2NsaWNraG91c2VfZGF0YTovdmFyL2xpYi9jbGlja2hvdXNlJwogICAgICAtICdvcGVucGFuZWxfY2xpY2tob3VzZV9sb2dzOi92YXIvbG9nL2NsaWNraG91c2Utc2VydmVyJwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlLWNvbmZpZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvb3AtY29uZmlnLnhtbAogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICI8Y2xpY2tob3VzZT5cbiAgICA8bG9nZ2VyPlxuICAgICAgICA8bGV2ZWw+d2FybmluZzwvbGV2ZWw+XG4gICAgICAgIDxjb25zb2xlPnRydWU8L2NvbnNvbGU+XG4gICAgPC9sb2dnZXI+XG4gICAgPGtlZXBfYWxpdmVfdGltZW91dD4xMDwva2VlcF9hbGl2ZV90aW1lb3V0PlxuICAgIDwhLS0gU3RvcCBhbGwgdGhlIHVubmVjZXNzYXJ5IGxvZ2dpbmcgLS0+XG4gICAgPHF1ZXJ5X3RocmVhZF9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxxdWVyeV9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDx0ZXh0X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHRyYWNlX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPG1ldHJpY19sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxhc3luY2hyb25vdXNfbWV0cmljX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHNlc3Npb25fbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8cGFydF9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxsaXN0ZW5faG9zdD4wLjAuMC4wPC9saXN0ZW5faG9zdD5cbiAgICA8aW50ZXJzZXJ2ZXJfbGlzdGVuX2hvc3Q+MC4wLjAuMDwvaW50ZXJzZXJ2ZXJfbGlzdGVuX2hvc3Q+XG4gICAgPGludGVyc2VydmVyX2h0dHBfaG9zdD5vcGNoPC9pbnRlcnNlcnZlcl9odHRwX2hvc3Q+XG4gICAgPCEtLSBEaXNhYmxlIGNncm91cCBtZW1vcnkgb2JzZXJ2ZXIgLS0+XG4gICAgPGNncm91cHNfbWVtb3J5X3VzYWdlX29ic2VydmVyX3dhaXRfdGltZT4wPC9jZ3JvdXBzX21lbW9yeV91c2FnZV9vYnNlcnZlcl93YWl0X3RpbWU+XG4gICAgPCEtLSBOb3QgdXNlZCBhbnltb3JlLCBidXQga2VwdCBmb3IgYmFja3dhcmRzIGNvbXBhdGliaWxpdHkgLS0+XG4gICAgPG1hY3Jvcz5cbiAgICAgICAgPHNoYXJkPjE8L3NoYXJkPlxuICAgICAgICA8cmVwbGljYT5yZXBsaWNhMTwvcmVwbGljYT5cbiAgICAgICAgPGNsdXN0ZXI+b3BlbnBhbmVsX2NsdXN0ZXI8L2NsdXN0ZXI+XG4gICAgPC9tYWNyb3M+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2UtdXNlci1jb25maWcueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL3VzZXJzLmQvb3AtdXNlci1jb25maWcueG1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxwcm9maWxlcz5cbiAgICAgICAgPGRlZmF1bHQ+XG4gICAgICAgICAgICA8bG9nX3F1ZXJpZXM+MDwvbG9nX3F1ZXJpZXM+XG4gICAgICAgICAgICA8bG9nX3F1ZXJ5X3RocmVhZHM+MDwvbG9nX3F1ZXJ5X3RocmVhZHM+XG4gICAgICAgIDwvZGVmYXVsdD5cbiAgICA8L3Byb2ZpbGVzPlxuPC9jbGlja2hvdXNlPlxuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9pbml0LWRiLnNoCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvaW5pdC1kYi5zaAogICAgICAgIGNvbnRlbnQ6ICIjIS9iaW4vc2hcbnNldCAtZVxuXG5jbGlja2hvdXNlIGNsaWVudCAtbiA8PC1FT1NRTFxuICBDUkVBVEUgREFUQUJBU0UgSUYgTk9UIEVYSVNUUyBvcGVucGFuZWw7XG5FT1NRTFxuIgogICAgdWxpbWl0czoKICAgICAgbm9maWxlOgogICAgICAgIHNvZnQ6IDI2MjE0NAogICAgICAgIGhhcmQ6IDI2MjE0NAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjbGlja2hvdXNlLWNsaWVudCAtLXF1ZXJ5ICJTRUxFQ1QgMSInCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQo=",
         "tags": [
             "analytics",
             "insights",
@@ -4192,58 +3591,6 @@
         "template_last_updated_at": "2026-09-28T00:20:58+02:00",
         "port": "2785"
     },
-    "opnform": {
-        "documentation": "https://docs.opnform.com/introduction?utm_source=coolify.io",
-        "slogan": "OpnForm is an open-source form builder that lets you create beautiful forms and share them anywhere. It's super fast, you don't need to know how to code",
-        "compose": "eC1zaGFyZWQtZW52OgogIEFQUF9OQU1FOiBPcG5Gb3JtCiAgQVBQX0VOVjogcHJvZHVjdGlvbgogIEFQUF9LRVk6ICcke1NFUlZJQ0VfQkFTRTY0X0FQSUtFWX0nCiAgQVBQX0RFQlVHOiAnJHtBUFBfREVCVUc6LWZhbHNlfScKICBBUFBfVVJMOiAnJHtTRVJWSUNFX0ZRRE5fTkdJTlh9JwogIExPR19DSEFOTkVMOiBlcnJvcmxvZwogIExPR19MRVZFTDogJyR7TE9HX0xFVkVMOi1kZWJ1Z30nCiAgRklMRVNZU1RFTV9EUklWRVI6ICcke0ZJTEVTWVNURU1fRFJJVkVSOi1sb2NhbH0nCiAgTE9DQUxfRklMRVNZU1RFTV9WSVNJQklMSVRZOiBwdWJsaWMKICBDQUNIRV9EUklWRVI6IHJlZGlzCiAgUVVFVUVfQ09OTkVDVElPTjogcmVkaXMKICBTRVNTSU9OX0RSSVZFUjogcmVkaXMKICBTRVNTSU9OX0xJRkVUSU1FOiAxMjAKICBNQUlMX01BSUxFUjogJyR7TUFJTF9NQUlMRVI6LWxvZ30nCiAgTUFJTF9IT1NUOiAnJHtNQUlMX0hPU1R9JwogIE1BSUxfUE9SVDogJyR7TUFJTF9QT1JUfScKICBNQUlMX1VTRVJOQU1FOiAnJHtNQUlMX1VTRVJOQU1FOi15b3VyQGVtYWlsLmNvbX0nCiAgTUFJTF9QQVNTV09SRDogJyR7TUFJTF9QQVNTV09SRH0nCiAgTUFJTF9FTkNSWVBUSU9OOiAnJHtNQUlMX0VOQ1JZUFRJT059JwogIE1BSUxfRlJPTV9BRERSRVNTOiAnJHtNQUlMX0ZST01fQUREUkVTUzoteW91ckBlbWFpbC5jb219JwogIE1BSUxfRlJPTV9OQU1FOiAnJHtNQUlMX0ZST01fTkFNRTotT3BuRm9ybX0nCiAgQVdTX0FDQ0VTU19LRVlfSUQ6ICcke0FXU19BQ0NFU1NfS0VZX0lEfScKICBBV1NfU0VDUkVUX0FDQ0VTU19LRVk6ICcke0FXU19TRUNSRVRfQUNDRVNTX0tFWX0nCiAgQVdTX0RFRkFVTFRfUkVHSU9OOiAnJHtBV1NfREVGQVVMVF9SRUdJT046LXVzLWVhc3QtMX0nCiAgQVdTX0JVQ0tFVDogJyR7QVdTX0JVQ0tFVH0nCiAgT1BFTl9BSV9BUElfS0VZOiAnJHtPUEVOX0FJX0FQSV9LRVl9JwogIFRFTEVHUkFNX0JPVF9JRDogJyR7VEVMRUdSQU1fQk9UX0lEfScKICBURUxFR1JBTV9CT1RfVE9LRU46ICcke1RFTEVHUkFNX0JPVF9UT0tFTn0nCiAgUkVESVNfSE9TVDogcmVkaXMKICBSRURJU19QQVNTV09SRDogJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgREJfSE9TVDogcG9zdGdyZXNxbAogIERCX0RBVEFCQVNFOiAnJHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1vcG5mb3JtfScKICBEQl9VU0VSTkFNRTogJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTUUx9JwogIERCX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUx9JwogIERCX0NPTk5FQ1RJT046IHBnc3FsCiAgUEhQX01FTU9SWV9MSU1JVDogMUcKICBQSFBfTUFYX0VYRUNVVElPTl9USU1FOiAnNjAwJwogIFBIUF9VUExPQURfTUFYX0ZJTEVTSVpFOiA2NE0KICBQSFBfUE9TVF9NQVhfU0laRTogNjRNCiAgRlJPTlRfVVJMOiAnJHtTRVJWSUNFX0ZRRE5fTkdJTlh9JwogIEZST05UX0FQSV9TRUNSRVQ6ICcke1NFUlZJQ0VfUEFTU1dPUkRfRlJPTlRBUElTRUNSRVR9JwogIFBVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX01JTlVURTogJyR7UFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfTUlOVVRFOi0zMH0nCiAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjogJyR7UFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjotMzAwfScKc2VydmljZXM6CiAgb3BuZm9ybS1hcGk6CiAgICBpbWFnZTogJ2podW1hbmovb3BuZm9ybS1hcGk6Mi4yLjQnCiAgICB2b2x1bWVzOgogICAgICAtICdhcGktc3RvcmFnZTovdXNyL3NoYXJlL25naW54L2h0bWwvc3RvcmFnZScKICAgIGVudmlyb25tZW50OgogICAgICBBUFBfTkFNRTogT3BuRm9ybQogICAgICBBUFBfRU5WOiBwcm9kdWN0aW9uCiAgICAgIEFQUF9LRVk6ICcke1NFUlZJQ0VfQkFTRTY0X0FQSUtFWX0nCiAgICAgIEFQUF9ERUJVRzogJyR7QVBQX0RFQlVHOi1mYWxzZX0nCiAgICAgIEFQUF9VUkw6ICcke1NFUlZJQ0VfRlFETl9OR0lOWH0nCiAgICAgIExPR19DSEFOTkVMOiBlcnJvcmxvZwogICAgICBMT0dfTEVWRUw6ICcke0xPR19MRVZFTDotZGVidWd9JwogICAgICBGSUxFU1lTVEVNX0RSSVZFUjogJyR7RklMRVNZU1RFTV9EUklWRVI6LWxvY2FsfScKICAgICAgTE9DQUxfRklMRVNZU1RFTV9WSVNJQklMSVRZOiBwdWJsaWMKICAgICAgQ0FDSEVfRFJJVkVSOiByZWRpcwogICAgICBRVUVVRV9DT05ORUNUSU9OOiByZWRpcwogICAgICBTRVNTSU9OX0RSSVZFUjogcmVkaXMKICAgICAgU0VTU0lPTl9MSUZFVElNRTogMTIwCiAgICAgIE1BSUxfTUFJTEVSOiAnJHtNQUlMX01BSUxFUjotbG9nfScKICAgICAgTUFJTF9IT1NUOiAnJHtNQUlMX0hPU1R9JwogICAgICBNQUlMX1BPUlQ6ICcke01BSUxfUE9SVH0nCiAgICAgIE1BSUxfVVNFUk5BTUU6ICcke01BSUxfVVNFUk5BTUU6LXlvdXJAZW1haWwuY29tfScKICAgICAgTUFJTF9QQVNTV09SRDogJyR7TUFJTF9QQVNTV09SRH0nCiAgICAgIE1BSUxfRU5DUllQVElPTjogJyR7TUFJTF9FTkNSWVBUSU9OfScKICAgICAgTUFJTF9GUk9NX0FERFJFU1M6ICcke01BSUxfRlJPTV9BRERSRVNTOi15b3VyQGVtYWlsLmNvbX0nCiAgICAgIE1BSUxfRlJPTV9OQU1FOiAnJHtNQUlMX0ZST01fTkFNRTotT3BuRm9ybX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAnJHtBV1NfQUNDRVNTX0tFWV9JRH0nCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJyR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgQVdTX0RFRkFVTFRfUkVHSU9OOiAnJHtBV1NfREVGQVVMVF9SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIEFXU19CVUNLRVQ6ICcke0FXU19CVUNLRVR9JwogICAgICBPUEVOX0FJX0FQSV9LRVk6ICcke09QRU5fQUlfQVBJX0tFWX0nCiAgICAgIFRFTEVHUkFNX0JPVF9JRDogJyR7VEVMRUdSQU1fQk9UX0lEfScKICAgICAgVEVMRUdSQU1fQk9UX1RPS0VOOiAnJHtURUxFR1JBTV9CT1RfVE9LRU59JwogICAgICBSRURJU19IT1NUOiByZWRpcwogICAgICBSRURJU19QQVNTV09SRDogJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICAgIERCX0hPU1Q6IHBvc3RncmVzcWwKICAgICAgREJfREFUQUJBU0U6ICcke1BPU1RHUkVTUUxfREFUQUJBU0U6LW9wbmZvcm19JwogICAgICBEQl9VU0VSTkFNRTogJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTUUx9JwogICAgICBEQl9QQVNTV09SRDogJyR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgREJfQ09OTkVDVElPTjogcGdzcWwKICAgICAgUEhQX01FTU9SWV9MSU1JVDogMUcKICAgICAgUEhQX01BWF9FWEVDVVRJT05fVElNRTogJzYwMCcKICAgICAgUEhQX1VQTE9BRF9NQVhfRklMRVNJWkU6IDY0TQogICAgICBQSFBfUE9TVF9NQVhfU0laRTogNjRNCiAgICAgIEZST05UX1VSTDogJyR7U0VSVklDRV9GUUROX05HSU5YfScKICAgICAgRlJPTlRfQVBJX1NFQ1JFVDogJyR7U0VSVklDRV9QQVNTV09SRF9GUk9OVEFQSVNFQ1JFVH0nCiAgICAgIFBVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX01JTlVURTogJyR7UFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfTUlOVVRFOi0zMH0nCiAgICAgIFBVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX0hPVVI6ICcke1BVQkxJQ19VUExPQURTX1JBVEVfTElNSVRfUEVSX0hPVVI6LTMwMH0nCiAgICAgIEpXVF9UVEw6ICcke0pXVF9UVEw6LTE0NDB9JwogICAgICBKV1RfU0VDUkVUOiAnJHtTRVJWSUNFX1BBU1NXT1JEX0pXVFNFQ1JFVH0nCiAgICAgIEpXVF9TS0lQX0lQX1VBX1ZBTElEQVRJT046ICcke0pXVF9TS0lQX0lQX1VBX1ZBTElEQVRJT046LWZhbHNlfScKICAgICAgSF9DQVBUQ0hBX1NJVEVfS0VZOiAnJHtIX0NBUFRDSEFfU0lURV9LRVl9JwogICAgICBIX0NBUFRDSEFfU0VDUkVUX0tFWTogJyR7SF9DQVBUQ0hBX1NFQ1JFVF9LRVl9JwogICAgICBSRV9DQVBUQ0hBX1NJVEVfS0VZOiAnJHtSRV9DQVBUQ0hBX1NJVEVfS0VZfScKICAgICAgUkVfQ0FQVENIQV9TRUNSRVRfS0VZOiAnJHtSRV9DQVBUQ0hBX1NFQ1JFVF9LRVl9JwogICAgICBTSE9XX09GRklDSUFMX1RFTVBMQVRFUzogJyR7U0hPV19PRkZJQ0lBTF9URU1QTEFURVM6LXRydWV9JwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwaHAgL3Vzci9zaGFyZS9uZ2lueC9odG1sL2FydGlzYW4gYWJvdXQgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDE1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogNjBzCiAgYXBpLXdvcmtlcjoKICAgIGltYWdlOiAnamh1bWFuai9vcG5mb3JtLWFwaToyLjIuNCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwaS1zdG9yYWdlOi91c3Ivc2hhcmUvbmdpbngvaHRtbC9zdG9yYWdlJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9OQU1FOiBPcG5Gb3JtCiAgICAgIEFQUF9FTlY6IHByb2R1Y3Rpb24KICAgICAgQVBQX0tFWTogJyR7U0VSVklDRV9CQVNFNjRfQVBJS0VZfScKICAgICAgQVBQX0RFQlVHOiAnJHtBUFBfREVCVUc6LWZhbHNlfScKICAgICAgQVBQX1VSTDogJyR7U0VSVklDRV9GUUROX05HSU5YfScKICAgICAgTE9HX0NIQU5ORUw6IGVycm9ybG9nCiAgICAgIExPR19MRVZFTDogJyR7TE9HX0xFVkVMOi1kZWJ1Z30nCiAgICAgIEZJTEVTWVNURU1fRFJJVkVSOiAnJHtGSUxFU1lTVEVNX0RSSVZFUjotbG9jYWx9JwogICAgICBMT0NBTF9GSUxFU1lTVEVNX1ZJU0lCSUxJVFk6IHB1YmxpYwogICAgICBDQUNIRV9EUklWRVI6IHJlZGlzCiAgICAgIFFVRVVFX0NPTk5FQ1RJT046IHJlZGlzCiAgICAgIFNFU1NJT05fRFJJVkVSOiByZWRpcwogICAgICBTRVNTSU9OX0xJRkVUSU1FOiAxMjAKICAgICAgTUFJTF9NQUlMRVI6ICcke01BSUxfTUFJTEVSOi1sb2d9JwogICAgICBNQUlMX0hPU1Q6ICcke01BSUxfSE9TVH0nCiAgICAgIE1BSUxfUE9SVDogJyR7TUFJTF9QT1JUfScKICAgICAgTUFJTF9VU0VSTkFNRTogJyR7TUFJTF9VU0VSTkFNRToteW91ckBlbWFpbC5jb219JwogICAgICBNQUlMX1BBU1NXT1JEOiAnJHtNQUlMX1BBU1NXT1JEfScKICAgICAgTUFJTF9FTkNSWVBUSU9OOiAnJHtNQUlMX0VOQ1JZUFRJT059JwogICAgICBNQUlMX0ZST01fQUREUkVTUzogJyR7TUFJTF9GUk9NX0FERFJFU1M6LXlvdXJAZW1haWwuY29tfScKICAgICAgTUFJTF9GUk9NX05BTUU6ICcke01BSUxfRlJPTV9OQU1FOi1PcG5Gb3JtfScKICAgICAgQVdTX0FDQ0VTU19LRVlfSUQ6ICcke0FXU19BQ0NFU1NfS0VZX0lEfScKICAgICAgQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZOiAnJHtBV1NfU0VDUkVUX0FDQ0VTU19LRVl9JwogICAgICBBV1NfREVGQVVMVF9SRUdJT046ICcke0FXU19ERUZBVUxUX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgQVdTX0JVQ0tFVDogJyR7QVdTX0JVQ0tFVH0nCiAgICAgIE9QRU5fQUlfQVBJX0tFWTogJyR7T1BFTl9BSV9BUElfS0VZfScKICAgICAgVEVMRUdSQU1fQk9UX0lEOiAnJHtURUxFR1JBTV9CT1RfSUR9JwogICAgICBURUxFR1JBTV9CT1RfVE9LRU46ICcke1RFTEVHUkFNX0JPVF9UT0tFTn0nCiAgICAgIFJFRElTX0hPU1Q6IHJlZGlzCiAgICAgIFJFRElTX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgICAgREJfSE9TVDogcG9zdGdyZXNxbAogICAgICBEQl9EQVRBQkFTRTogJyR7UE9TVEdSRVNRTF9EQVRBQkFTRTotb3BuZm9ybX0nCiAgICAgIERCX1VTRVJOQU1FOiAnJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIERCX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUx9JwogICAgICBEQl9DT05ORUNUSU9OOiBwZ3NxbAogICAgICBQSFBfTUVNT1JZX0xJTUlUOiAxRwogICAgICBQSFBfTUFYX0VYRUNVVElPTl9USU1FOiAnNjAwJwogICAgICBQSFBfVVBMT0FEX01BWF9GSUxFU0laRTogNjRNCiAgICAgIFBIUF9QT1NUX01BWF9TSVpFOiA2NE0KICAgICAgRlJPTlRfVVJMOiAnJHtTRVJWSUNFX0ZRRE5fTkdJTlh9JwogICAgICBGUk9OVF9BUElfU0VDUkVUOiAnJHtTRVJWSUNFX1BBU1NXT1JEX0ZST05UQVBJU0VDUkVUfScKICAgICAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfTUlOVVRFOiAnJHtQVUJMSUNfVVBMT0FEU19SQVRFX0xJTUlUX1BFUl9NSU5VVEU6LTMwfScKICAgICAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjogJyR7UFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjotMzAwfScKICAgIGNvbW1hbmQ6CiAgICAgIC0gcGhwCiAgICAgIC0gYXJ0aXNhbgogICAgICAtICdxdWV1ZTp3b3JrJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwZ3JlcCAtZiAncGhwIGFydGlzYW4gcXVldWU6d29yaycgPiAvZGV2L251bGwgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogNjBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCiAgYXBpLXNjaGVkdWxlcjoKICAgIGltYWdlOiAnamh1bWFuai9vcG5mb3JtLWFwaToyLjIuNCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwaS1zdG9yYWdlOi91c3Ivc2hhcmUvbmdpbngvaHRtbC9zdG9yYWdlJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9OQU1FOiBPcG5Gb3JtCiAgICAgIEFQUF9FTlY6IHByb2R1Y3Rpb24KICAgICAgQVBQX0tFWTogJyR7U0VSVklDRV9CQVNFNjRfQVBJS0VZfScKICAgICAgQVBQX0RFQlVHOiAnJHtBUFBfREVCVUc6LWZhbHNlfScKICAgICAgQVBQX1VSTDogJyR7U0VSVklDRV9GUUROX05HSU5YfScKICAgICAgTE9HX0NIQU5ORUw6IGVycm9ybG9nCiAgICAgIExPR19MRVZFTDogJyR7TE9HX0xFVkVMOi1kZWJ1Z30nCiAgICAgIEZJTEVTWVNURU1fRFJJVkVSOiAnJHtGSUxFU1lTVEVNX0RSSVZFUjotbG9jYWx9JwogICAgICBMT0NBTF9GSUxFU1lTVEVNX1ZJU0lCSUxJVFk6IHB1YmxpYwogICAgICBDQUNIRV9EUklWRVI6IHJlZGlzCiAgICAgIFFVRVVFX0NPTk5FQ1RJT046IHJlZGlzCiAgICAgIFNFU1NJT05fRFJJVkVSOiByZWRpcwogICAgICBTRVNTSU9OX0xJRkVUSU1FOiAxMjAKICAgICAgTUFJTF9NQUlMRVI6ICcke01BSUxfTUFJTEVSOi1sb2d9JwogICAgICBNQUlMX0hPU1Q6ICcke01BSUxfSE9TVH0nCiAgICAgIE1BSUxfUE9SVDogJyR7TUFJTF9QT1JUfScKICAgICAgTUFJTF9VU0VSTkFNRTogJyR7TUFJTF9VU0VSTkFNRToteW91ckBlbWFpbC5jb219JwogICAgICBNQUlMX1BBU1NXT1JEOiAnJHtNQUlMX1BBU1NXT1JEfScKICAgICAgTUFJTF9FTkNSWVBUSU9OOiAnJHtNQUlMX0VOQ1JZUFRJT059JwogICAgICBNQUlMX0ZST01fQUREUkVTUzogJyR7TUFJTF9GUk9NX0FERFJFU1M6LXlvdXJAZW1haWwuY29tfScKICAgICAgTUFJTF9GUk9NX05BTUU6ICcke01BSUxfRlJPTV9OQU1FOi1PcG5Gb3JtfScKICAgICAgQVdTX0FDQ0VTU19LRVlfSUQ6ICcke0FXU19BQ0NFU1NfS0VZX0lEfScKICAgICAgQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZOiAnJHtBV1NfU0VDUkVUX0FDQ0VTU19LRVl9JwogICAgICBBV1NfREVGQVVMVF9SRUdJT046ICcke0FXU19ERUZBVUxUX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgQVdTX0JVQ0tFVDogJyR7QVdTX0JVQ0tFVH0nCiAgICAgIE9QRU5fQUlfQVBJX0tFWTogJyR7T1BFTl9BSV9BUElfS0VZfScKICAgICAgVEVMRUdSQU1fQk9UX0lEOiAnJHtURUxFR1JBTV9CT1RfSUR9JwogICAgICBURUxFR1JBTV9CT1RfVE9LRU46ICcke1RFTEVHUkFNX0JPVF9UT0tFTn0nCiAgICAgIFJFRElTX0hPU1Q6IHJlZGlzCiAgICAgIFJFRElTX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgICAgREJfSE9TVDogcG9zdGdyZXNxbAogICAgICBEQl9EQVRBQkFTRTogJyR7UE9TVEdSRVNRTF9EQVRBQkFTRTotb3BuZm9ybX0nCiAgICAgIERCX1VTRVJOQU1FOiAnJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIERCX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUx9JwogICAgICBEQl9DT05ORUNUSU9OOiBwZ3NxbAogICAgICBQSFBfTUVNT1JZX0xJTUlUOiAxRwogICAgICBQSFBfTUFYX0VYRUNVVElPTl9USU1FOiAnNjAwJwogICAgICBQSFBfVVBMT0FEX01BWF9GSUxFU0laRTogNjRNCiAgICAgIFBIUF9QT1NUX01BWF9TSVpFOiA2NE0KICAgICAgRlJPTlRfVVJMOiAnJHtTRVJWSUNFX0ZRRE5fTkdJTlh9JwogICAgICBGUk9OVF9BUElfU0VDUkVUOiAnJHtTRVJWSUNFX1BBU1NXT1JEX0ZST05UQVBJU0VDUkVUfScKICAgICAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfTUlOVVRFOiAnJHtQVUJMSUNfVVBMT0FEU19SQVRFX0xJTUlUX1BFUl9NSU5VVEU6LTMwfScKICAgICAgUFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjogJyR7UFVCTElDX1VQTE9BRFNfUkFURV9MSU1JVF9QRVJfSE9VUjotMzAwfScKICAgIGNvbW1hbmQ6CiAgICAgIC0gcGhwCiAgICAgIC0gYXJ0aXNhbgogICAgICAtICdzY2hlZHVsZTp3b3JrJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwaHAgL3Vzci9zaGFyZS9uZ2lueC9odG1sL2FydGlzYW4gYXBwOnNjaGVkdWxlci1zdGF0dXMgLS1tb2RlPWNoZWNrIC0tbWF4LW1pbnV0ZXM9MyB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiA2MHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiA3MHMKICBvcG5mb3JtLXVpOgogICAgaW1hZ2U6ICdqaHVtYW5qL29wbmZvcm0tY2xpZW50OjIuMi40JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTlVYVF9QVUJMSUNfQVBQX1VSTD0vCiAgICAgIC0gTlVYVF9QVUJMSUNfQVBJX0JBU0U9L2FwaQogICAgICAtICdOVVhUX1BSSVZBVEVfQVBJX0JBU0U9aHR0cDovL25naW54L2FwaScKICAgICAgLSBOVVhUX1BVQkxJQ19FTlY9cHJvZHVjdGlvbgogICAgICAtICdOVVhUX1BVQkxJQ19IX0NBUFRDSEFfU0lURV9LRVk9JHtIX0NBUFRDSEFfU0lURV9LRVl9JwogICAgICAtICdOVVhUX1BVQkxJQ19SRV9DQVBUQ0hBX1NJVEVfS0VZPSR7UkVfQ0FQVENIQV9TSVRFX0tFWX0nCiAgICAgIC0gJ05VWFRfQVBJX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfRlJPTlRBUElTRUNSRVR9JwogICAgICAtICdOVVhUX1BVQkxJQ19MSUNFTlNFX0FQSV9FTkRQT0lOVD0ke05VWFRfUFVCTElDX0xJQ0VOU0VfQVBJX0VORFBPSU5UOi1odHRwczovL2FwaS5vcG5mb3JtLmNvbX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3dnZXQgLS1zcGlkZXIgLXEgaHR0cDovL29wbmZvcm0tdWk6MzAwMC9sb2dpbiB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiA0NXMKICAgIGRlcGVuZHNfb246CiAgICAgIG9wbmZvcm0tYXBpOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgcG9zdGdyZXNxbDoKICAgIGltYWdlOiAncG9zdGdyZXM6MTgnCiAgICB2b2x1bWVzOgogICAgICAtICdvcG5mb3JtLXBvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1vcG5mb3JtfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6NycKICAgIGVudmlyb25tZW50OgogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9JwogICAgdm9sdW1lczoKICAgICAgLSAncmVkaXMtZGF0YTovZGF0YScKICAgIGNvbW1hbmQ6CiAgICAgIC0gcmVkaXMtc2VydmVyCiAgICAgIC0gJy0tcmVxdWlyZXBhc3MnCiAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgICAgICAtIFBJTkcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMwogIG5naW54OgogICAgaW1hZ2U6ICduZ2lueDoxLjMxLjMnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkdJTlgKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL25naW54L25naW54LmNvbmYKICAgICAgICB0YXJnZXQ6IC9ldGMvbmdpbngvY29uZi5kL2RlZmF1bHQuY29uZgogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICJtYXAgJG9yaWdpbmFsX3VyaSAkYXBpX3VyaSB7XG4gICAgfl4vYXBpKC8uKiQpICQxO1xuICAgIGRlZmF1bHQgJG9yaWdpbmFsX3VyaTtcbn1cblxuc2VydmVyIHtcbiAgICBsaXN0ZW4gODAgZGVmYXVsdF9zZXJ2ZXI7XG4gICAgcm9vdCAvdXNyL3NoYXJlL25naW54L2h0bWwvcHVibGljO1xuXG4gICAgYWNjZXNzX2xvZyAvZGV2L3N0ZG91dDtcbiAgICBlcnJvcl9sb2cgL2Rldi9zdGRlcnIgZXJyb3I7XG5cbiAgICBpbmRleCBpbmRleC5odG1sIGluZGV4Lmh0bSBpbmRleC5waHA7XG5cbiAgICBsb2NhdGlvbiAvIHtcbiAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTtcbiAgICAgICAgcHJveHlfcGFzcyBodHRwOi8vb3BuZm9ybS11aTozMDAwO1xuICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtUmVhbC1JUCAkcmVtb3RlX2FkZHI7XG4gICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtSG9zdCAkaG9zdDtcbiAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLUZvcndhcmRlZC1Qb3J0ICRzZXJ2ZXJfcG9ydDtcbiAgICAgICAgcHJveHlfc2V0X2hlYWRlciBVcGdyYWRlICRodHRwX3VwZ3JhZGU7XG4gICAgICAgIHByb3h5X3NldF9oZWFkZXIgQ29ubmVjdGlvbiBcIlVwZ3JhZGVcIjtcbiAgICB9XG5cbiAgICBsb2NhdGlvbiB+LyhhcGl8b3Blbnxsb2NhbFxcL3RlbXB8Zm9ybXNcXC9hc3NldHMpLyB7XG4gICAgICAgIHNldCAkb3JpZ2luYWxfdXJpICR1cmk7XG4gICAgICAgIHRyeV9maWxlcyAkdXJpICR1cmkvIC9pbmRleC5waHAkaXNfYXJncyRhcmdzO1xuICAgIH1cblxuICAgIGxvY2F0aW9uIH4gXFwucGhwJCB7XG4gICAgICAgIGZhc3RjZ2lfc3BsaXRfcGF0aF9pbmZvIF4oLitcXC5waHApKC8uKykkO1xuICAgICAgICBmYXN0Y2dpX3Bhc3Mgb3BuZm9ybS1hcGk6OTAwMDtcbiAgICAgICAgZmFzdGNnaV9pbmRleCBpbmRleC5waHA7XG4gICAgICAgIGluY2x1ZGUgZmFzdGNnaV9wYXJhbXM7XG4gICAgICAgIGZhc3RjZ2lfcGFyYW0gU0NSSVBUX0ZJTEVOQU1FIC91c3Ivc2hhcmUvbmdpbngvaHRtbC9wdWJsaWMvaW5kZXgucGhwO1xuICAgICAgICBmYXN0Y2dpX3BhcmFtIFJFUVVFU1RfVVJJICRhcGlfdXJpO1xuICAgIH1cbn0iCiAgICBkZXBlbmRzX29uOgogICAgICAtIG9wbmZvcm0tYXBpCiAgICAgIC0gb3BuZm9ybS11aQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5naW54CiAgICAgICAgLSAnLXQnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiA0MHMK",
-        "tags": [
-            "opnform",
-            "form",
-            "survey",
-            "cloud",
-            "open-source",
-            "self-hosted",
-            "docker",
-            "no-code",
-            "embeddable"
-        ],
-        "category": "productivity",
-        "logo": "svg/opnform.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T12:49:29+02:00",
-        "port": "80"
-    },
-    "orangehrm": {
-        "documentation": "https://starterhelp.orangehrm.com/hc/en-us?utm_source=coolify.io",
-        "slogan": "OrangeHRM open source HR management software.",
-        "compose": "c2VydmljZXM6CiAgb3JhbmdlaHJtOgogICAgaW1hZ2U6ICdvcmFuZ2Vocm0vb3JhbmdlaHJtOmxhdGVzdCcKICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX09SQU5HRUhSTV84MAogICAgICAtIE9SQU5HRUhSTV9EQVRBQkFTRV9IT1NUPW1hcmlhZGIKICAgICAgLSAnT1JBTkdFSFJNX0RBVEFCQVNFX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdPUkFOR0VIUk1fREFUQUJBU0VfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnT1JBTkdFSFJNX0RBVEFCQVNFX05BTUU9JHtNWVNRTF9EQVRBQkFTRTotb3JhbmdlaHJtLWRifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ29yYW5nZWhybS1kYXRhOi9vcmFuZ2Vocm0nCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnb3JhbmdlaHJtX21hcmlhZGJfZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTFJPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1vcmFuZ2Vocm0tZGJ9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "hr",
-            "hris",
-            "hrms",
-            "human resource management",
-            "orangehrm",
-            "hr management"
-        ],
-        "category": "productivity",
-        "logo": "svgs/orangehrm.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
-    "organizr": {
-        "documentation": "https://docs.organizr.app/?utm_source=coolify.io",
-        "slogan": "Homelab Services Organizer",
-        "compose": "c2VydmljZXM6CiAgb3JnYW5penI6CiAgICBpbWFnZTogJ29yZ2FuaXpyL29yZ2FuaXpyOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9PUkdBTklaUl84MAogICAgICAtICdicmFuY2g9JHticmFuY2g6LXYyLW1hc3Rlcn0nCiAgICB2b2x1bWVzOgogICAgICAtICdvcmdhbml6ci1kYXRhOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXNmIGh0dHA6Ly9sb2NhbGhvc3Q6ODAgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMK",
-        "tags": [
-            "tool"
-        ],
-        "category": "productivity",
-        "logo": "svgs/organizr.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "overseerr": {
         "documentation": "https://docs.overseerr.dev/getting-started/installation#docker?utm_source=coolify.io",
         "slogan": "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.",
@@ -4261,23 +3608,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "5055"
     },
-    "owncloud": {
-        "documentation": "https://owncloud.com/docs-guides/?utm_source=coolify.io",
-        "slogan": "OwnCloud with Open Web UI integrates file management with a powerful, user-friendly interface.",
-        "compose": "c2VydmljZXM6CiAgb3duY2xvdWQ6CiAgICBpbWFnZTogJ293bmNsb3VkL3NlcnZlcjpsYXRlc3QnCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1dOQ0xPVURfODA4MAogICAgICAtICdPV05DTE9VRF9ET01BSU49JHtTRVJWSUNFX0ZRRE5fT1dOQ0xPVUR9JwogICAgICAtICdPV05DTE9VRF9UUlVTVEVEX0RPTUFJTlM9JHtTRVJWSUNFX0ZRRE5fT1dOQ0xPVUR9JwogICAgICAtIE9XTkNMT1VEX0RCX1RZUEU9bXlzcWwKICAgICAgLSBPV05DTE9VRF9EQl9IT1NUPW1hcmlhZGIKICAgICAgLSAnT1dOQ0xPVURfREJfTkFNRT0ke0RCX05BTUU6LW93bmNsb3VkfScKICAgICAgLSAnT1dOQ0xPVURfREJfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ09XTkNMT1VEX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnT1dOQ0xPVURfQURNSU5fVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfT1dOQ0xPVUR9JwogICAgICAtICdPV05DTE9VRF9BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfT1dOQ0xPVUR9JwogICAgICAtICdPV05DTE9VRF9NWVNRTF9VVEY4TUI0PSR7TVlTUUxfVVRGOE1CNDotdHJ1ZX0nCiAgICAgIC0gJ09XTkNMT1VEX1JFRElTX0VOQUJMRUQ9JHtSRURJU19FTkFCTEVEOi10cnVlfScKICAgICAgLSBPV05DTE9VRF9SRURJU19IT1NUPXJlZGlzCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL3Vzci9iaW4vaGVhbHRoY2hlY2sKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQogICAgdm9sdW1lczoKICAgICAgLSAnb3duY2xvdWQtZGF0YTovbW50L2RhdGEnCiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQlJPT1R9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7REJfTkFNRTotb3duY2xvdWR9JwogICAgICAtIFRaPWF1dG8KICAgIGNvbW1hbmQ6CiAgICAgIC0gJy0tY2hhcmFjdGVyLXNldC1zZXJ2ZXI9dXRmOG1iNCcKICAgICAgLSAnLS1jb2xsYXRpb24tc2VydmVyPXV0ZjhtYjRfYmluJwogICAgICAtICctLW1heC1hbGxvd2VkLXBhY2tldD0xMjhNJwogICAgICAtICctLWlubm9kYi1sb2ctZmlsZS1zaXplPTY0TScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAnb3duY2xvdWQtbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6NicKICAgIGNvbW1hbmQ6CiAgICAgIC0gJy0tZGF0YWJhc2VzJwogICAgICAtICcxJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUK",
-        "tags": [
-            "owncloud",
-            "file-management",
-            "open-web-ui",
-            "integration",
-            "cloud"
-        ],
-        "category": "storage",
-        "logo": "svgs/owncloud.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-06-02T12:12:42+03:00",
-        "port": "8080"
-    },
     "pairdrop": {
         "documentation": "https://pairdrop.net/?utm_source=coolify.io",
         "slogan": "Pairdrop is a self-hosted file sharing and collaboration platform, offering secure file sharing and collaboration capabilities for efficient teamwork.",
@@ -4315,37 +3645,6 @@
         "template_last_updated_at": "2025-12-02T12:07:14+01:00",
         "port": "8000"
     },
-    "passbolt": {
-        "documentation": "https://www.passbolt.com/ce/docker?utm_source=coolify.io",
-        "slogan": "Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!",
-        "compose": "c2VydmljZXM6CiAgcGFzc2JvbHQ6CiAgICBpbWFnZTogJ3Bhc3Nib2x0L3Bhc3Nib2x0OmxhdGVzdC1jZScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9QQVNTQk9MVAogICAgICAtICdBUFBfRlVMTF9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9QQVNTQk9MVH0nCiAgICAgIC0gREFUQVNPVVJDRVNfREVGQVVMVF9IT1NUPW1hcmlhZGIKICAgICAgLSAnREFUQVNPVVJDRVNfREVGQVVMVF9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9QQVNTQk9MVH0nCiAgICAgIC0gJ0RBVEFTT1VSQ0VTX0RFRkFVTFRfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BBU1NCT0xUfScKICAgICAgLSAnREFUQVNPVVJDRVNfREVGQVVMVF9EQVRBQkFTRT0ke01ZU1FMX0RCOi1wYXNzYm9sdC1kYn0nCiAgICB2b2x1bWVzOgogICAgICAtICdncGdfdm9sdW1lOi9ldGMvcGFzc2JvbHQvZ3BnJwogICAgICAtICdqd3Rfdm9sdW1lOi9ldGMvcGFzc2JvbHQvand0JwogICAgY29tbWFuZDoKICAgICAgLSAvdXNyL2Jpbi93YWl0LWZvci5zaAogICAgICAtICctdCcKICAgICAgLSAnMCcKICAgICAgLSAnbWFyaWFkYjozMzA2JwogICAgICAtICctLScKICAgICAgLSAvZG9ja2VyLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUFSSUFEQl9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UTUFSSUFEQn0nCiAgICAgIC0gJ01BUklBREJfREFUQUJBU0U9JHtNWVNRTF9EQjotcGFzc2JvbHQtZGJ9JwogICAgICAtICdNQVJJQURCX1VTRVI9JHtTRVJWSUNFX1VTRVJfUEFTU0JPTFR9JwogICAgICAtICdNQVJJQURCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QQVNTQk9MVH0nCiAgICB2b2x1bWVzOgogICAgICAtICdwYXNzYm9sdF9tYXJpYWRiX2RhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "security",
-            "credentials",
-            "password-manager",
-            "open source"
-        ],
-        "category": "auth",
-        "logo": "svgs/passbolt.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
-    "paymenter": {
-        "documentation": "https://paymenter.org/docs/guides/docker?utm_source=coolify.io",
-        "slogan": "Open-Source Billing, Built for Hosting",
-        "compose": "c2VydmljZXM6CiAgcGF5bWVudGVyOgogICAgaW1hZ2U6ICdnaGNyLmlvL3BheW1lbnRlci9wYXltZW50ZXI6djEuNC41JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwX2xvZ3M6L2FwcC9zdG9yYWdlL2xvZ3MnCiAgICAgIC0gJ2V4dGVuc3Rpb25zOi9hcHAvZXh0ZW5zaW9ucycKICAgICAgLSAndGhlbWVzOi9hcHAvdGhlbWVzJwogICAgICAtICdhcHBfc3RvcmFnZTovYXBwL3N0b3JhZ2UvYXBwJwogICAgICAtICdhcHBfcHVibGljX3N0b3JhZ2U6L2FwcC9zdG9yYWdlL2FwcC9wdWJsaWMnCiAgICBlbnZpcm9ubWVudDoKICAgICAgU0VSVklDRV9GUUROX1BBWU1FTlRFUjogJyR7U0VSVklDRV9GUUROX1BBWU1FTlRFUl84MH0nCiAgICAgIERCX0RBVEFCQVNFOiAnJHtNWVNRTF9EQVRBQkFTRTotcGF5bWVudGVyLWRifScKICAgICAgREJfUEFTU1dPUkQ6ICcke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICBEQl9VU0VSTkFNRTogJyR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgQVBQX0VOVjogcHJvZHVjdGlvbgogICAgICBDQUNIRV9TVE9SRTogcmVkaXMKICAgICAgU0VTU0lPTl9EUklWRVI6IHJlZGlzCiAgICAgIFFVRVVFX0NPTk5FQ1RJT046IHJlZGlzCiAgICAgIFJFRElTX0hPU1Q6IHJlZGlzCiAgICAgIFJFRElTX1VTRVJOQU1FOiBkZWZhdWx0CiAgICAgIFJFRElTX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgICAgREJfQ09OTkVDVElPTjogbWFyaWFkYgogICAgICBEQl9IT1NUOiBtYXJpYWRiCiAgICAgIERCX1BPUlQ6IDMzMDYKICAgICAgQVBQX0tFWTogJyR7U0VSVklDRV9CQVNFNjRfS0VZfScKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtc2YgaHR0cDovL2xvY2FsaG9zdDo4MCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMXMKICAgICAgcmV0cmllczogMwogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEuOCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3BheW1lbnRlcl9tYXJpYWRiX2RhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotcGF5bWVudGVyLWRifScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6YWxwaW5lJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdyZWRpcy1jbGkgcGluZyB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMXMKICAgICAgcmV0cmllczogMwo=",
-        "tags": [
-            "automation",
-            "billing",
-            "open source"
-        ],
-        "category": "finance",
-        "logo": "svgs/paymenter.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "80"
-    },
     "peertube": {
         "documentation": "https://docs.joinpeertube.org/install/docker?utm_source=coolify.io",
         "slogan": "Free, open-source and decentralized video platform.",
@@ -4379,7 +3678,7 @@
         "category": "productivity",
         "logo": "svgs/penpot.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-11-29T15:56:03+05:30",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8080"
     },
     "penpot": {
@@ -4428,19 +3727,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "8085"
     },
-    "phpmyadmin": {
-        "documentation": "https://phpmyadmin.net?utm_source=coolify.io",
-        "slogan": "phpMyAdmin is a web-based database management tool for administering your MySQL and MariaDB databases through a user-friendly interface.",
-        "compose": "c2VydmljZXM6CiAgcGhwbXlhZG1pbjoKICAgIGltYWdlOiAnbHNjci5pby9saW51eHNlcnZlci9waHBteWFkbWluOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9QSFBNWUFETUlOCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gVFo9RXVyb3BlL01hZHJpZAogICAgICAtIFBNQV9BUkJJVFJBUlk9MQogICAgICAtIFBNQV9BQlNPTFVURV9VUkk9JFNFUlZJQ0VfRlFETl9QSFBNWUFETUlOCiAgICB2b2x1bWVzOgogICAgICAtICdwaHBteWFkbWluLWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
-        "tags": [
-            "database management"
-        ],
-        "category": "database",
-        "logo": "svgs/phpmyadmin.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "pi-hole": {
         "documentation": "https://pi-hole.net/?utm_source=coolify.io",
         "slogan": "Network-wide Ad Blocking",
@@ -4478,7 +3764,7 @@
         "category": "productivity",
         "logo": "svgs/plane.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-10-15T22:51:15+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "80"
     },
     "plex": {
@@ -4638,20 +3924,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "4200"
     },
-    "privatebin": {
-        "documentation": "https://github.com/PrivateBin/PrivateBin/blob/master/doc/README.md?utm_source=coolify.io",
-        "slogan": "PrivateBin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data.",
-        "compose": "c2VydmljZXM6CiAgcHJpdmF0ZWJpbjoKICAgIGltYWdlOiBwcml2YXRlYmluL25naW54LWZwbS1hbHBpbmUKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9QUklWQVRFQklOXzgwODAKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3ByaXZhdGViaW5fZGF0YTovc3J2L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3dnZXQgLXFPLSBodHRwOi8vMTI3LjAuMC4xOjgwODAvJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "text",
-            "sharing"
-        ],
-        "category": "security",
-        "logo": "svgs/privatebin.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "8080"
-    },
     "prowlarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/prowlarr?utm_source=coolify.io",
         "slogan": "Prowlarr\u2060 is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
@@ -4687,40 +3959,6 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "9159"
     },
-    "pterodactyl-panel": {
-        "documentation": "https://pterodactyl.io/?utm_source=coolify.io",
-        "slogan": "Pterodactyl is a free, open-source game server management panel",
-        "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS44JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdoZWFsdGhjaGVjay5zaCAtLWNvbm5lY3QgLS1pbm5vZGJfaW5pdGlhbGl6ZWQgfHwgZXhpdCAxJwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9cHRlcm9kYWN0eWwtZGIKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgdm9sdW1lczoKICAgICAgLSAncHRlcm9kYWN0eWwtZGI6L3Zhci9saWIvbXlzcWwnCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOmFscGluZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncmVkaXMtY2xpIHBpbmcgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICBwdGVyb2RhY3R5bDoKICAgIGltYWdlOiAnZ2hjci5pby9wdGVyb2RhY3R5bC9wYW5lbDp2MS4xMi4zJwogICAgdm9sdW1lczoKICAgICAgLSAncGFuZWwtdmFyOi9hcHAvdmFyLycKICAgICAgLSAncGFuZWwtbmdpbng6L2V0Yy9uZ2lueC9odHRwLmQvJwogICAgICAtICdwYW5lbC1jZXJ0czovZXRjL2xldHNlbmNyeXB0LycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZXRjL2VudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9lbnRyeXBvaW50LnNoCiAgICAgICAgbW9kZTogJzA3NTUnCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuc2V0IC1lXG5cbiBlY2hvIFwiU2V0dGluZyBsb2dzIHBlcm1pc3Npb25zLi4uXCJcbiBjaG93biAtUiBuZ2lueDogL2FwcC9zdG9yYWdlL2xvZ3MvXG5cbiBVU0VSX0VYSVNUUz0kKHBocCBhcnRpc2FuIHRpbmtlciAtLW5vLWFuc2kgLS1leGVjdXRlPSdlY2hvIFxcUHRlcm9kYWN0eWxcXE1vZGVsc1xcVXNlcjo6d2hlcmUoXCJlbWFpbFwiLCBcIidcIiRBRE1JTl9FTUFJTFwiJ1wiKS0+ZXhpc3RzKCkgPyBcIjFcIiA6IFwiMFwiOycpXG5cbiBpZiBbIFwiJFVTRVJfRVhJU1RTXCIgPSBcIjBcIiBdOyB0aGVuXG4gICBlY2hvIFwiQWRtaW4gVXNlciBkb2VzIG5vdCBleGlzdCwgY3JlYXRpbmcgdXNlciBub3cuXCJcbiAgIHBocCBhcnRpc2FuIHA6dXNlcjptYWtlIC0tbm8taW50ZXJhY3Rpb24gXFxcbiAgICAgLS1hZG1pbj0xIFxcXG4gICAgIC0tZW1haWw9XCIkQURNSU5fRU1BSUxcIiBcXFxuICAgICAtLXVzZXJuYW1lPVwiJEFETUlOX1VTRVJOQU1FXCIgXFxcbiAgICAgLS1uYW1lLWZpcnN0PVwiJEFETUlOX0ZJUlNUTkFNRVwiIFxcXG4gICAgIC0tbmFtZS1sYXN0PVwiJEFETUlOX0xBU1ROQU1FXCIgXFxcbiAgICAgLS1wYXNzd29yZD1cIiRBRE1JTl9QQVNTV09SRFwiXG4gICBlY2hvIFwiQWRtaW4gdXNlciBjcmVhdGVkIHN1Y2Nlc3NmdWxseSFcIlxuIGVsc2VcbiAgIGVjaG8gXCJBZG1pbiBVc2VyIGFscmVhZHkgZXhpc3RzLCBza2lwcGluZyBjcmVhdGlvbi5cIlxuIGZpXG5cbiBleGVjIHN1cGVydmlzb3JkIC0tbm9kYWVtb25cbiIKICAgIGNvbW1hbmQ6CiAgICAgIC0gL2VudHJ5cG9pbnQuc2gKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtc2YgaHR0cDovL2xvY2FsaG9zdDo4MCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEFTSElEU19TQUxUPSRTRVJWSUNFX1BBU1NXT1JEX0hBU0hJRFMKICAgICAgLSBIQVNISURTX0xFTkdUSD04CiAgICAgIC0gU0VSVklDRV9GUUROX1BURVJPREFDVFlMXzgwCiAgICAgIC0gJ0FETUlOX0VNQUlMPSR7QURNSU5fRU1BSUw6LWFkbWluQGV4YW1wbGUuY29tfScKICAgICAgLSAnQURNSU5fVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdBRE1JTl9GSVJTVE5BTUU9JHtBRE1JTl9GSVJTVE5BTUU6LUFkbWlufScKICAgICAgLSAnQURNSU5fTEFTVE5BTUU9JHtBRE1JTl9MQVNUTkFNRTotVXNlcn0nCiAgICAgIC0gJ0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gJ1BURVJPREFDVFlMX0hUVFBTPSR7UFRFUk9EQUNUWUxfSFRUUFM6LWZhbHNlfScKICAgICAgLSBBUFBfRU5WPXByb2R1Y3Rpb24KICAgICAgLSBBUFBfRU5WSVJPTk1FTlRfT05MWT1mYWxzZQogICAgICAtIEFQUF9VUkw9JFNFUlZJQ0VfRlFETl9QVEVST0RBQ1RZTAogICAgICAtICdBUFBfVElNRVpPTkU9JHtUSU1FWk9ORTotVVRDfScKICAgICAgLSAnQVBQX1NFUlZJQ0VfQVVUSE9SPSR7QVBQX1NFUlZJQ0VfQVVUSE9SOi1hdXRob3JAZXhhbXBsZS5jb219JwogICAgICAtICdMT0dfTEVWRUw9JHtMT0dfTEVWRUw6LWRlYnVnfScKICAgICAgLSBDQUNIRV9EUklWRVI9cmVkaXMKICAgICAgLSBTRVNTSU9OX0RSSVZFUj1yZWRpcwogICAgICAtIFFVRVVFX0RSSVZFUj1yZWRpcwogICAgICAtIFJFRElTX0hPU1Q9cmVkaXMKICAgICAgLSBEQl9EQVRBQkFTRT1wdGVyb2RhY3R5bC1kYgogICAgICAtIERCX1VTRVJOQU1FPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBEQl9IT1NUPW1hcmlhZGIKICAgICAgLSBEQl9QT1JUPTMzMDYKICAgICAgLSBEQl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgICAtIE1BSUxfRlJPTT0kTUFJTF9GUk9NCiAgICAgIC0gTUFJTF9EUklWRVI9JE1BSUxfRFJJVkVSCiAgICAgIC0gTUFJTF9IT1NUPSRNQUlMX0hPU1QKICAgICAgLSBNQUlMX1BPUlQ9JE1BSUxfUE9SVAogICAgICAtIE1BSUxfVVNFUk5BTUU9JE1BSUxfVVNFUk5BTUUKICAgICAgLSBNQUlMX1BBU1NXT1JEPSRNQUlMX1BBU1NXT1JECiAgICAgIC0gTUFJTF9FTkNSWVBUSU9OPSRNQUlMX0VOQ1JZUFRJT04K",
-        "tags": [
-            "game",
-            "game server",
-            "management",
-            "panel",
-            "minecraft"
-        ],
-        "category": "media",
-        "logo": "svgs/pterodactyl.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T18:06:35+02:00",
-        "port": "80"
-    },
-    "pterodactyl-with-wings": {
-        "documentation": "https://pterodactyl.io/?utm_source=coolify.io",
-        "slogan": "Pterodactyl is a free, open-source game server management panel",
-        "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS44JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdoZWFsdGhjaGVjay5zaCAtLWNvbm5lY3QgLS1pbm5vZGJfaW5pdGlhbGl6ZWQgfHwgZXhpdCAxJwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9cHRlcm9kYWN0eWwtZGIKICAgICAgLSBNWVNRTF9VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgdm9sdW1lczoKICAgICAgLSAncHRlcm9kYWN0eWwtZGI6L3Zhci9saWIvbXlzcWwnCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOmFscGluZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncmVkaXMtY2xpIHBpbmcgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDFzCiAgICAgIHJldHJpZXM6IDMKICBwdGVyb2RhY3R5bDoKICAgIGltYWdlOiAnZ2hjci5pby9wdGVyb2RhY3R5bC9wYW5lbDp2MS4xMi4zJwogICAgdm9sdW1lczoKICAgICAgLSAncGFuZWwtdmFyOi9hcHAvdmFyLycKICAgICAgLSAncGFuZWwtbmdpbng6L2V0Yy9uZ2lueC9odHRwLmQvJwogICAgICAtICdwYW5lbC1jZXJ0czovZXRjL2xldHNlbmNyeXB0LycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZXRjL2VudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9lbnRyeXBvaW50LnNoCiAgICAgICAgbW9kZTogJzA3NTUnCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuc2V0IC1lXG5cbiBlY2hvIFwiU2V0dGluZyBsb2dzIHBlcm1pc3Npb25zLi4uXCJcbiBjaG93biAtUiBuZ2lueDogL2FwcC9zdG9yYWdlL2xvZ3MvXG5cbiBVU0VSX0VYSVNUUz0kKHBocCBhcnRpc2FuIHRpbmtlciAtLW5vLWFuc2kgLS1leGVjdXRlPSdlY2hvIFxcUHRlcm9kYWN0eWxcXE1vZGVsc1xcVXNlcjo6d2hlcmUoXCJlbWFpbFwiLCBcIidcIiRBRE1JTl9FTUFJTFwiJ1wiKS0+ZXhpc3RzKCkgPyBcIjFcIiA6IFwiMFwiOycpXG5cbiBpZiBbIFwiJFVTRVJfRVhJU1RTXCIgPSBcIjBcIiBdOyB0aGVuXG4gICBlY2hvIFwiQWRtaW4gVXNlciBkb2VzIG5vdCBleGlzdCwgY3JlYXRpbmcgdXNlciBub3cuXCJcbiAgIHBocCBhcnRpc2FuIHA6dXNlcjptYWtlIC0tbm8taW50ZXJhY3Rpb24gXFxcbiAgICAgLS1hZG1pbj0xIFxcXG4gICAgIC0tZW1haWw9XCIkQURNSU5fRU1BSUxcIiBcXFxuICAgICAtLXVzZXJuYW1lPVwiJEFETUlOX1VTRVJOQU1FXCIgXFxcbiAgICAgLS1uYW1lLWZpcnN0PVwiJEFETUlOX0ZJUlNUTkFNRVwiIFxcXG4gICAgIC0tbmFtZS1sYXN0PVwiJEFETUlOX0xBU1ROQU1FXCIgXFxcbiAgICAgLS1wYXNzd29yZD1cIiRBRE1JTl9QQVNTV09SRFwiXG4gICBlY2hvIFwiQWRtaW4gdXNlciBjcmVhdGVkIHN1Y2Nlc3NmdWxseSFcIlxuIGVsc2VcbiAgIGVjaG8gXCJBZG1pbiBVc2VyIGFscmVhZHkgZXhpc3RzLCBza2lwcGluZyBjcmVhdGlvbi5cIlxuIGZpXG5cbiBleGVjIHN1cGVydmlzb3JkIC0tbm9kYWVtb25cbiIKICAgIGNvbW1hbmQ6CiAgICAgIC0gL2VudHJ5cG9pbnQuc2gKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtc2YgaHR0cDovL2xvY2FsaG9zdDo4MCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEFTSElEU19TQUxUPSRTRVJWSUNFX1BBU1NXT1JEX0hBU0hJRFMKICAgICAgLSBIQVNISURTX0xFTkdUSD04CiAgICAgIC0gU0VSVklDRV9GUUROX1BURVJPREFDVFlMXzgwCiAgICAgIC0gJ0FETUlOX0VNQUlMPSR7QURNSU5fRU1BSUw6LWFkbWluQGV4YW1wbGUuY29tfScKICAgICAgLSAnQURNSU5fVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdBRE1JTl9GSVJTVE5BTUU9JHtBRE1JTl9GSVJTVE5BTUU6LUFkbWlufScKICAgICAgLSAnQURNSU5fTEFTVE5BTUU9JHtBRE1JTl9MQVNUTkFNRTotVXNlcn0nCiAgICAgIC0gJ0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gJ1BURVJPREFDVFlMX0hUVFBTPSR7UFRFUk9EQUNUWUxfSFRUUFM6LWZhbHNlfScKICAgICAgLSBBUFBfRU5WPXByb2R1Y3Rpb24KICAgICAgLSBBUFBfRU5WSVJPTk1FTlRfT05MWT1mYWxzZQogICAgICAtIEFQUF9VUkw9JFNFUlZJQ0VfRlFETl9QVEVST0RBQ1RZTAogICAgICAtICdBUFBfVElNRVpPTkU9JHtUSU1FWk9ORTotVVRDfScKICAgICAgLSAnQVBQX1NFUlZJQ0VfQVVUSE9SPSR7QVBQX1NFUlZJQ0VfQVVUSE9SOi1hdXRob3JAZXhhbXBsZS5jb219JwogICAgICAtICdMT0dfTEVWRUw9JHtMT0dfTEVWRUw6LWRlYnVnfScKICAgICAgLSBDQUNIRV9EUklWRVI9cmVkaXMKICAgICAgLSBTRVNTSU9OX0RSSVZFUj1yZWRpcwogICAgICAtIFFVRVVFX0RSSVZFUj1yZWRpcwogICAgICAtIFJFRElTX0hPU1Q9cmVkaXMKICAgICAgLSBEQl9EQVRBQkFTRT1wdGVyb2RhY3R5bC1kYgogICAgICAtIERCX1VTRVJOQU1FPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBEQl9IT1NUPW1hcmlhZGIKICAgICAgLSBEQl9QT1JUPTMzMDYKICAgICAgLSBEQl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgICAtIE1BSUxfRlJPTT0kTUFJTF9GUk9NCiAgICAgIC0gTUFJTF9EUklWRVI9JE1BSUxfRFJJVkVSCiAgICAgIC0gTUFJTF9IT1NUPSRNQUlMX0hPU1QKICAgICAgLSBNQUlMX1BPUlQ9JE1BSUxfUE9SVAogICAgICAtIE1BSUxfVVNFUk5BTUU9JE1BSUxfVVNFUk5BTUUKICAgICAgLSBNQUlMX1BBU1NXT1JEPSRNQUlMX1BBU1NXT1JECiAgICAgIC0gTUFJTF9FTkNSWVBUSU9OPSRNQUlMX0VOQ1JZUFRJT04KICB3aW5nczoKICAgIGltYWdlOiAnZ2hjci5pby9wdGVyb2RhY3R5bC93aW5nczp2MS4xMi4xJwogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICAgIHBvcnRzOgogICAgICAtICcyMDIyOjIwMjInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fV0lOR1NfODQ0MwogICAgICAtICdUWj0ke1RJTUVaT05FOi1VVEN9JwogICAgICAtIFdJTkdTX1VTRVJOQU1FPXB0ZXJvZGFjdHlsCiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnL3Zhci9saWIvZG9ja2VyL2NvbnRhaW5lcnMvOi92YXIvbGliL2RvY2tlci9jb250YWluZXJzLycKICAgICAgLSAnL3Zhci9saWIvcHRlcm9kYWN0eWwvOi92YXIvbGliL3B0ZXJvZGFjdHlsLycKICAgICAgLSAnL3RtcC9wdGVyb2RhY3R5bC86L3RtcC9wdGVyb2RhY3R5bC8nCiAgICAgIC0gJ3dpbmdzLWxvZ3M6L3Zhci9sb2cvcHRlcm9kYWN0eWwvJwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9ldGMvY29uZmlnLnltbAogICAgICAgIHRhcmdldDogL2V0Yy9wdGVyb2RhY3R5bC9jb25maWcueW1sCiAgICAgICAgY29udGVudDogImRlYnVnOiBmYWxzZVxudXVpZDogUkVQTEFDRSBGUk9NIENPTkZJRyAjZXhhbXBsZTogYWJjOWFiYzgtYWJjNy1hYmM2LWFiYzUtYWJjNGFiYzNhYmMyXG50b2tlbl9pZDogUkVQTEFDRSBGUk9NIENPTkZJRyAjZXhhbXBsZTogYWJjMWFiYzJhYmMzYWJjNFxudG9rZW46IFJFUExBQ0UgRlJPTSBDT05GSUcgICNleGFtcGxlOiBhYmMxYWJjMmFiYzNhYmM0YWJjNWFiYzZhYmM3YWJjOGFiYzlhYmMxMGFiYzExYWJjMTJhYmMxM2FiYzE0YWJjMTVhYmMxNlxuYXBpOlxuICBob3N0OiAwLjAuMC4wXG4gIHBvcnQ6IDg0NDMgIyB1c2UgcG9ydCA0NDMgSU4gVEhFIFBBTkVMIGR1cmluZyBub2RlIHNldHVwXG4gIHNzbDpcbiAgICBlbmFibGVkOiBmYWxzZVxuICAgIGNlcnQ6IFJFUExBQ0UgRlJPTSBDT05GSUcgI2V4YW1wbGU6IC9ldGMvbGV0c2VuY3J5cHQvbGl2ZS93aW5ncy1hYmNhYmNhYmNhYmNhYmMuZXhhbXBsZS5jb20vZnVsbGNoYWluLnBlbVxuICAgIGtleTogUkVQTEFDRSBGUk9NIENPTkZJRyAjZXhhbXBsZTogL2V0Yy9sZXRzZW5jcnlwdC9saXZlL3dpbmdzLWFiY2FiY2FiY2FiY2FiYy5leGFtcGxlLmNvbS9wcml2a2V5LnBlbVxuICBkaXNhYmxlX3JlbW90ZV9kb3dubG9hZDogZmFsc2VcbiAgdXBsb2FkX2xpbWl0OiAxMDBcbiAgdHJ1c3RlZF9wcm94aWVzOiBbXVxuc3lzdGVtOlxuICByb290X2RpcmVjdG9yeTogL3Zhci9saWIvcHRlcm9kYWN0eWxcbiAgbG9nX2RpcmVjdG9yeTogL3Zhci9sb2cvcHRlcm9kYWN0eWxcbiAgZGF0YTogL3Zhci9saWIvcHRlcm9kYWN0eWwvdm9sdW1lc1xuICBhcmNoaXZlX2RpcmVjdG9yeTogL3Zhci9saWIvcHRlcm9kYWN0eWwvYXJjaGl2ZXNcbiAgYmFja3VwX2RpcmVjdG9yeTogL3Zhci9saWIvcHRlcm9kYWN0eWwvYmFja3Vwc1xuICB0bXBfZGlyZWN0b3J5OiAvdG1wL3B0ZXJvZGFjdHlsXG4gIHVzZXJuYW1lOiBwdGVyb2RhY3R5bFxuICB0aW1lem9uZTogVVRDXG4gIHVzZXI6XG4gICAgcm9vdGxlc3M6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICAgICAgY29udGFpbmVyX3VpZDogMFxuICAgICAgY29udGFpbmVyX2dpZDogMFxuICAgIHVpZDogOTg4XG4gICAgZ2lkOiA5ODhcbiAgZGlza19jaGVja19pbnRlcnZhbDogMTUwXG4gIGFjdGl2aXR5X3NlbmRfaW50ZXJ2YWw6IDYwXG4gIGFjdGl2aXR5X3NlbmRfY291bnQ6IDEwMFxuICBjaGVja19wZXJtaXNzaW9uc19vbl9ib290OiB0cnVlXG4gIGVuYWJsZV9sb2dfcm90YXRlOiB0cnVlXG4gIHdlYnNvY2tldF9sb2dfY291bnQ6IDE1MFxuICBzZnRwOlxuICAgIGJpbmRfYWRkcmVzczogMC4wLjAuMFxuICAgIGJpbmRfcG9ydDogMjAyMlxuICAgIHJlYWRfb25seTogZmFsc2VcbiAgY3Jhc2hfZGV0ZWN0aW9uOlxuICAgIGVuYWJsZWQ6IHRydWVcbiAgICBkZXRlY3RfY2xlYW5fZXhpdF9hc19jcmFzaDogdHJ1ZVxuICAgIHRpbWVvdXQ6IDYwXG4gIGJhY2t1cHM6XG4gICAgd3JpdGVfbGltaXQ6IDBcbiAgICBjb21wcmVzc2lvbl9sZXZlbDogYmVzdF9zcGVlZFxuICB0cmFuc2ZlcnM6XG4gICAgZG93bmxvYWRfbGltaXQ6IDBcbiAgb3BlbmF0X21vZGU6IGF1dG9cbmRvY2tlcjpcbiAgbmV0d29yazpcbiAgICBpbnRlcmZhY2U6IDE3Mi4yOC4wLjFcbiAgICBkbnM6XG4gICAgICAtIDEuMS4xLjFcbiAgICAgIC0gMS4wLjAuMVxuICAgIG5hbWU6IHB0ZXJvZGFjdHlsX253XG4gICAgaXNwbjogZmFsc2VcbiAgICBkcml2ZXI6IGJyaWRnZVxuICAgIG5ldHdvcmtfbW9kZTogcHRlcm9kYWN0eWxfbndcbiAgICBpc19pbnRlcm5hbDogZmFsc2VcbiAgICBlbmFibGVfaWNjOiB0cnVlXG4gICAgbmV0d29ya19tdHU6IDE1MDBcbiAgICBpbnRlcmZhY2VzOlxuICAgICAgdjQ6XG4gICAgICAgIHN1Ym5ldDogMTcyLjI4LjAuMC8xNlxuICAgICAgICBnYXRld2F5OiAxNzIuMjguMC4xXG4gICAgICB2NjpcbiAgICAgICAgc3VibmV0OiBmZGJhOjE3Yzg6NmM5NDo6LzY0XG4gICAgICAgIGdhdGV3YXk6IGZkYmE6MTdjODo2Yzk0OjoxMDExXG4gIGRvbWFpbm5hbWU6IFwiXCJcbiAgcmVnaXN0cmllczoge31cbiAgdG1wZnNfc2l6ZTogMTAwXG4gIGNvbnRhaW5lcl9waWRfbGltaXQ6IDUxMlxuICBpbnN0YWxsZXJfbGltaXRzOlxuICAgIG1lbW9yeTogMTAyNFxuICAgIGNwdTogMTAwXG4gIG92ZXJoZWFkOlxuICAgIG92ZXJyaWRlOiBmYWxzZVxuICAgIGRlZmF1bHRfbXVsdGlwbGllcjogMS4wNVxuICAgIG11bHRpcGxpZXJzOiB7fVxuICB1c2VfcGVyZm9ybWFudF9pbnNwZWN0OiB0cnVlXG4gIHVzZXJuc19tb2RlOiBcIlwiXG4gIGxvZ19jb25maWc6XG4gICAgdHlwZTogbG9jYWxcbiAgICBjb25maWc6XG4gICAgICBjb21wcmVzczogXCJmYWxzZVwiXG4gICAgICBtYXgtZmlsZTogXCIxXCJcbiAgICAgIG1heC1zaXplOiA1bVxuICAgICAgbW9kZTogbm9uLWJsb2NraW5nXG50aHJvdHRsZXM6XG4gIGVuYWJsZWQ6IHRydWVcbiAgbGluZXM6IDIwMDBcbiAgbGluZV9yZXNldF9pbnRlcnZhbDogMTAwXG5yZW1vdGU6IGh0dHA6Ly9wdGVyb2RhY3R5bDo4MFxucmVtb3RlX3F1ZXJ5OlxuICB0aW1lb3V0OiAzMFxuICBib290X3NlcnZlcnNfcGVyX3BhZ2U6IDUwXG5hbGxvd2VkX21vdW50czogW11cbmFsbG93ZWRfb3JpZ2luczpcbiAgLSBodHRwOi8vcHRlcm9kYWN0eWw6ODBcbiAgLSBQQU5FTCBET01BSU4gIyBleGFtcGxlOiBodHRwczovL3B0ZXJvZGFjdHlsLWFiY2FiY2FiY2FiY2F2Yy5leGFtcGxlLmNvbVxuYWxsb3dfY29yc19wcml2YXRlX25ldHdvcms6IGZhbHNlXG5pZ25vcmVfcGFuZWxfY29uZmlnX3VwZGF0ZXM6IGZhbHNlIgo=",
-        "tags": [
-            "game",
-            "game server",
-            "management",
-            "panel",
-            "minecraft"
-        ],
-        "category": "media",
-        "logo": "svgs/pterodactyl.png",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-10T18:06:35+02:00",
-        "port": "80, 8443"
-    },
     "qbittorrent": {
         "documentation": "https://docs.linuxserver.io/images/docker-qbittorrent/?utm_source=coolify.io",
         "slogan": "The qBittorrent project aims to provide an open-source software alternative to \u03bcTorrent.",
@@ -4772,7 +4010,7 @@
         "category": "messaging",
         "logo": "svgs/rabbitmq.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "15672"
     },
     "radarr": {
@@ -4820,7 +4058,7 @@
         "category": "productivity",
         "logo": "svgs/rxresume.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-01-27T21:30:50+01:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "3000"
     },
     "readeck": {
@@ -4924,7 +4162,7 @@
     "rybbit": {
         "documentation": "https://rybbit.io/docs?utm_source=coolify.io",
         "slogan": "Open-source, privacy-first web analytics.",
-        "compose": "c2VydmljZXM6CiAgcnliYml0OgogICAgaW1hZ2U6ICdnaGNyLmlvL3J5YmJpdC1pby9yeWJiaXQtY2xpZW50OnYyLjIuMycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9SWUJCSVRfMzAwMgogICAgICAtIE5PREVfRU5WPXByb2R1Y3Rpb24KICAgICAgLSAnTkVYVF9QVUJMSUNfQkFDS0VORF9VUkw9JHtTRVJWSUNFX0ZRRE5fUllCQklUfScKICAgICAgLSAnTkVYVF9QVUJMSUNfRElTQUJMRV9TSUdOVVA9JHtESVNBQkxFX1NJR05VUDotZmFsc2V9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSByeWJiaXRfYmFja2VuZAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICduYyAteiAxMjcuMC4wLjEgMzAwMicKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIHJ5YmJpdF9iYWNrZW5kOgogICAgaW1hZ2U6ICdnaGNyLmlvL3J5YmJpdC1pby9yeWJiaXQtYmFja2VuZDp2Mi4yLjMnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gVFJVU1RfUFJPWFk9dHJ1ZQogICAgICAtICdCQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9SWUJCSVR9JwogICAgICAtICdDTElDS0hPVVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnQkVUVEVSX0FVVEhfU0VDUkVUPSR7U0VSVklDRV9CQVNFNjRfNjRfQkFDS0VORH0nCiAgICAgIC0gJ0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgICAgLSAnRElTQUJMRV9URUxFTUVUUlk9JHtESVNBQkxFX1RFTEVNRVRSWTotdHJ1ZX0nCiAgICAgIC0gJ0NMSUNLSE9VU0VfSE9TVD1odHRwOi8vcnliYml0X2NsaWNraG91c2U6ODEyMycKICAgICAgLSAnQ0xJQ0tIT1VTRV9VU0VSPSR7Q0xJQ0tIT1VTRV9VU0VSOi1kZWZhdWx0fScKICAgICAgLSAnQ0xJQ0tIT1VTRV9EQj0ke0NMSUNLSE9VU0VfREI6LWFuYWx5dGljc30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1yeWJiaXRfcG9zdGdyZXMKICAgICAgLSBQT1NUR1JFU19QT1JUPTU0MzIKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYW5hbHl0aWNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1BPU1RHUkVTX1VTRVI6LWZyb2d9JwogICAgZGVwZW5kc19vbjoKICAgICAgcnliYml0X2NsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcnliYml0X3Bvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAxL2FwaS9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByeWJiaXRfcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3LjQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYW5hbHl0aWNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1BPU1RHUkVTX1VTRVI6LWZyb2d9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgcnliYml0X2NsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjUuNC4yJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0NMSUNLSE9VU0VfREI9JHtDTElDS0hPVVNFX0RCOi1hbmFseXRpY3N9JwogICAgICAtICdDTElDS0hPVVNFX1VTRVI9JHtDTElDS0hPVVNFX1VTRVI6LWRlZmF1bHR9JwogICAgICAtICdDTElDS0hPVVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgxMjMvcGluZycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgdm9sdW1lczoKICAgICAgLSAnY2xpY2tob3VzZV9kYXRhOi92YXIvbGliL2NsaWNraG91c2UnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL2VuYWJsZV9qc29uLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9lbmFibGVfanNvbi54bWwKICAgICAgICBjb250ZW50OiAiPGNsaWNraG91c2U+XG4gICAgPHNldHRpbmdzPlxuICAgICAgICA8ZW5hYmxlX2pzb25fdHlwZT4xPC9lbmFibGVfanNvbl90eXBlPlxuICAgIDwvc2V0dGluZ3M+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL2xvZ2dpbmdfcnVsZXMueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL2NvbmZpZy5kL2xvZ2dpbmdfcnVsZXMueG1sCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxsb2dnZXI+XG4gICAgICAgIDxsZXZlbD53YXJuaW5nPC9sZXZlbD5cbiAgICAgICAgPGNvbnNvbGU+dHJ1ZTwvY29uc29sZT5cbiAgICA8L2xvZ2dlcj5cbiAgICA8cXVlcnlfdGhyZWFkX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHF1ZXJ5X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHRleHRfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8dHJhY2VfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8bWV0cmljX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPGFzeW5jaHJvbm91c19tZXRyaWNfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8c2Vzc2lvbl9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxwYXJ0X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPGxhdGVuY3lfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8cHJvY2Vzc29yc19wcm9maWxlX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG48L2NsaWNraG91c2U+IgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlX2NvbmZpZy9uZXR3b3JrLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9uZXR3b3JrLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8Y2xpY2tob3VzZT5cbiAgICA8bGlzdGVuX2hvc3Q+MC4wLjAuMDwvbGlzdGVuX2hvc3Q+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL3VzZXJfbG9nZ2luZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvdXNlcl9sb2dnaW5nLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8Y2xpY2tob3VzZT5cbiAgICA8cHJvZmlsZXM+XG4gICAgICAgIDxkZWZhdWx0PlxuICAgICAgICAgICAgPGxvZ19xdWVyaWVzPjA8L2xvZ19xdWVyaWVzPlxuICAgICAgICAgICAgPGxvZ19xdWVyeV90aHJlYWRzPjA8L2xvZ19xdWVyeV90aHJlYWRzPlxuICAgICAgICAgICAgPGxvZ19wcm9jZXNzb3JzX3Byb2ZpbGVzPjA8L2xvZ19wcm9jZXNzb3JzX3Byb2ZpbGVzPlxuICAgICAgICA8L2RlZmF1bHQ+XG4gICAgPC9wcm9maWxlcz5cbjwvY2xpY2tob3VzZT5cbiIK",
+        "compose": "c2VydmljZXM6CiAgcnliYml0OgogICAgaW1hZ2U6ICdnaGNyLmlvL3J5YmJpdC1pby9yeWJiaXQtY2xpZW50OnYyLjIuMycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9SWUJCSVRfMzAwMgogICAgICAtIE5PREVfRU5WPXByb2R1Y3Rpb24KICAgICAgLSAnTkVYVF9QVUJMSUNfQkFDS0VORF9VUkw9JHtTRVJWSUNFX0ZRRE5fUllCQklUfScKICAgICAgLSAnTkVYVF9QVUJMSUNfRElTQUJMRV9TSUdOVVA9JHtESVNBQkxFX1NJR05VUDotZmFsc2V9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSByeWJiaXRfYmFja2VuZAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICduYyAteiAxMjcuMC4wLjEgMzAwMicKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIHJ5YmJpdF9iYWNrZW5kOgogICAgaW1hZ2U6ICdnaGNyLmlvL3J5YmJpdC1pby9yeWJiaXQtYmFja2VuZDp2Mi4yLjMnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gVFJVU1RfUFJPWFk9dHJ1ZQogICAgICAtICdCQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9SWUJCSVR9JwogICAgICAtICdDTElDS0hPVVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnQkVUVEVSX0FVVEhfU0VDUkVUPSR7U0VSVklDRV9CQVNFNjRfNjRfQkFDS0VORH0nCiAgICAgIC0gJ0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgICAgLSAnRElTQUJMRV9URUxFTUVUUlk9JHtESVNBQkxFX1RFTEVNRVRSWTotdHJ1ZX0nCiAgICAgIC0gJ0NMSUNLSE9VU0VfSE9TVD1odHRwOi8vcnliYml0X2NsaWNraG91c2U6ODEyMycKICAgICAgLSAnQ0xJQ0tIT1VTRV9VU0VSPSR7Q0xJQ0tIT1VTRV9VU0VSOi1kZWZhdWx0fScKICAgICAgLSAnQ0xJQ0tIT1VTRV9EQj0ke0NMSUNLSE9VU0VfREI6LWFuYWx5dGljc30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1yeWJiaXRfcG9zdGdyZXMKICAgICAgLSBQT1NUR1JFU19QT1JUPTU0MzIKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYW5hbHl0aWNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1BPU1RHUkVTX1VTRVI6LWZyb2d9JwogICAgZGVwZW5kc19vbjoKICAgICAgcnliYml0X2NsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcnliYml0X3Bvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAxL2FwaS9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByeWJiaXRfcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3LjQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYW5hbHl0aWNzfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1BPU1RHUkVTX1VTRVI6LWZyb2d9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgcnliYml0X2NsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjUuNC4yJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0NMSUNLSE9VU0VfREI9JHtDTElDS0hPVVNFX0RCOi1hbmFseXRpY3N9JwogICAgICAtICdDTElDS0hPVVNFX1VTRVI9JHtDTElDS0hPVVNFX1VTRVI6LWRlZmF1bHR9JwogICAgICAtICdDTElDS0hPVVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgxMjMvcGluZycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgdm9sdW1lczoKICAgICAgLSAnY2xpY2tob3VzZV9kYXRhOi92YXIvbGliL2NsaWNraG91c2UnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL2VuYWJsZV9qc29uLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9lbmFibGVfanNvbi54bWwKICAgICAgICBjb250ZW50OiAiPGNsaWNraG91c2U+XG4gICAgPHNldHRpbmdzPlxuICAgICAgICA8ZW5hYmxlX2pzb25fdHlwZT4xPC9lbmFibGVfanNvbl90eXBlPlxuICAgIDwvc2V0dGluZ3M+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL2xvZ2dpbmdfcnVsZXMueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL2NvbmZpZy5kL2xvZ2dpbmdfcnVsZXMueG1sCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxsb2dnZXI+XG4gICAgICAgIDxsZXZlbD53YXJuaW5nPC9sZXZlbD5cbiAgICAgICAgPGNvbnNvbGU+dHJ1ZTwvY29uc29sZT5cbiAgICA8L2xvZ2dlcj5cbiAgICA8cXVlcnlfdGhyZWFkX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHF1ZXJ5X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPHRleHRfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8dHJhY2VfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8bWV0cmljX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPGFzeW5jaHJvbm91c19tZXRyaWNfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8c2Vzc2lvbl9sb2cgcmVtb3ZlPVwicmVtb3ZlXCIvPlxuICAgIDxwYXJ0X2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG4gICAgPGxhdGVuY3lfbG9nIHJlbW92ZT1cInJlbW92ZVwiLz5cbiAgICA8cHJvY2Vzc29yc19wcm9maWxlX2xvZyByZW1vdmU9XCJyZW1vdmVcIi8+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2VfY29uZmlnL25ldHdvcmsueG1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL2NsaWNraG91c2Utc2VydmVyL2NvbmZpZy5kL25ldHdvcmsueG1sCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxsaXN0ZW5faG9zdD4wLjAuMC4wPC9saXN0ZW5faG9zdD5cbjwvY2xpY2tob3VzZT5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZV9jb25maWcvdXNlcl9sb2dnaW5nLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC91c2VyX2xvZ2dpbmcueG1sCiAgICAgICAgY29udGVudDogIjxjbGlja2hvdXNlPlxuICAgIDxwcm9maWxlcz5cbiAgICAgICAgPGRlZmF1bHQ+XG4gICAgICAgICAgICA8bG9nX3F1ZXJpZXM+MDwvbG9nX3F1ZXJpZXM+XG4gICAgICAgICAgICA8bG9nX3F1ZXJ5X3RocmVhZHM+MDwvbG9nX3F1ZXJ5X3RocmVhZHM+XG4gICAgICAgICAgICA8bG9nX3Byb2Nlc3NvcnNfcHJvZmlsZXM+MDwvbG9nX3Byb2Nlc3NvcnNfcHJvZmlsZXM+XG4gICAgICAgIDwvZGVmYXVsdD5cbiAgICA8L3Byb2ZpbGVzPlxuPC9jbGlja2hvdXNlPlxuIgo=",
         "tags": [
             "analytics",
             "web",
@@ -4987,7 +4225,7 @@
         "category": "storage",
         "logo": "svgs/seafile.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-23T08:56:51+05:30",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "80"
     },
     "searxng": {
@@ -5077,29 +4315,10 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "8080"
     },
-    "shlink": {
-        "documentation": "https://shlink.io/?utm_source=coolify.io",
-        "slogan": "The definitive self-hosted URL shortener",
-        "compose": "c2VydmljZXM6CiAgc2hsaW5rOgogICAgaW1hZ2U6ICdzaGxpbmtpby9zaGxpbms6c3RhYmxlJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1NITElOS184MDgwCiAgICAgIC0gJ0RFRkFVTFRfRE9NQUlOPSR7U0VSVklDRV9GUUROX1NITElOS30nCiAgICAgIC0gSVNfSFRUUFNfRU5BQkxFRD1mYWxzZQogICAgICAtICdJTklUSUFMX0FQSV9LRVk9JHtTRVJWSUNFX0JBU0U2NF9TSExJTktBUElLRVl9JwogICAgdm9sdW1lczoKICAgICAgLSAnc2hsaW5rLWRhdGE6L2V0Yy9zaGxpbmsvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwL3Jlc3QvdjMvaGVhbHRoJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgc2hsaW5rLXdlYjoKICAgIGltYWdlOiBzaGxpbmtpby9zaGxpbmstd2ViLWNsaWVudAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1NITElOS1dFQl84MDgwCiAgICAgIC0gJ1NITElOS19TRVJWRVJfQVBJX0tFWT0ke1NFUlZJQ0VfQkFTRTY0X1NITElOS0FQSUtFWX0nCiAgICAgIC0gJ1NITElOS19TRVJWRVJfVVJMPSR7U0VSVklDRV9GUUROX1NITElOS30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "links",
-            "shortener",
-            "sharing",
-            "url",
-            "short",
-            "link",
-            "sharing"
-        ],
-        "category": "productivity",
-        "logo": "svgs/default.webp",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-02T19:40:32+02:00",
-        "port": "8080"
-    },
     "signoz": {
         "documentation": "https://signoz.io/docs/introduction/?utm_source=coolify.io",
         "slogan": "An observability platform native to OpenTelemetry with logs, traces and metrics.",
-        "compose": "c2VydmljZXM6CiAgaW5pdC1jbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI1LjEyLjUtYWxwaW5lJwogICAgY29tbWFuZDoKICAgICAgLSBiYXNoCiAgICAgIC0gJy1jJwogICAgICAtICJ2ZXJzaW9uPVwidjAuMC4xXCJcbm5vZGVfb3M9JCQodW5hbWUgLXMgfCB0ciAnWzp1cHBlcjpdJyAnWzpsb3dlcjpdJylcbm5vZGVfYXJjaD0kJCh1bmFtZSAtbSB8IHNlZCBzL2FhcmNoNjQvYXJtNjQvIHwgc2VkIHMveDg2XzY0L2FtZDY0LylcbmVjaG8gXCJGZXRjaGluZyBoaXN0b2dyYW0tYmluYXJ5IGZvciAkJHtub2RlX29zfS8kJHtub2RlX2FyY2h9XCJcbmNkIC90bXBcbndnZXQgLU8gaGlzdG9ncmFtLXF1YW50aWxlLnRhci5neiBcImh0dHBzOi8vZ2l0aHViLmNvbS9TaWdOb3ovc2lnbm96L3JlbGVhc2VzL2Rvd25sb2FkL2hpc3RvZ3JhbS1xdWFudGlsZSUyRiQke3ZlcnNpb259L2hpc3RvZ3JhbS1xdWFudGlsZV8kJHtub2RlX29zfV8kJHtub2RlX2FyY2h9LnRhci5nelwiXG50YXIgLXh2emYgaGlzdG9ncmFtLXF1YW50aWxlLnRhci5nelxubXYgaGlzdG9ncmFtLXF1YW50aWxlIC92YXIvbGliL2NsaWNraG91c2UvdXNlcl9zY3JpcHRzL2hpc3RvZ3JhbVF1YW50aWxlXG4iCiAgICByZXN0YXJ0OiBvbi1mYWlsdXJlCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGxvZ2dpbmc6CiAgICAgIG9wdGlvbnM6CiAgICAgICAgbWF4LXNpemU6IDUwbQogICAgICAgIG1heC1maWxlOiAnMycKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiB2b2x1bWUKICAgICAgICBzb3VyY2U6IHVzZXItc2NyaXB0cwogICAgICAgIHRhcmdldDogL3Zhci9saWIvY2xpY2tob3VzZS91c2VyX3NjcmlwdHMKICB6b29rZWVwZXI6CiAgICBpbWFnZTogJ3NpZ25vei96b29rZWVwZXI6My45LjMnCiAgICB1c2VyOiByb290CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXMgLW0gMiBodHRwOi8vbG9jYWxob3N0OjgwODAvY29tbWFuZHMvcnVvayB8IGdyZXAgZXJyb3IgfCBncmVwIG51bGwnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgdm9sdW1lczoKICAgICAgLSAnem9va2VlcGVyOi9iaXRuYW1pL3pvb2tlZXBlcicKICAgIGVudmlyb25tZW50OgogICAgICAtICdBTExPV19BTk9OWU1PVVNfTE9HSU49JHtaT09fQUxMT1dfQU5PTllNT1VTX0xPR0lOOi15ZXN9JwogICAgICAtICdaT09fQVVUT1BVUkdFX0lOVEVSVkFMPSR7Wk9PX0FVVE9QVVJHRV9JTlRFUlZBTDotMX0nCiAgICAgIC0gJ1pPT19FTkFCTEVfUFJPTUVUSEVVU19NRVRSSUNTPSR7Wk9PX0VOQUJMRV9QUk9NRVRIRVVTX01FVFJJQ1M6LXllc30nCiAgICAgIC0gJ1pPT19QUk9NRVRIRVVTX01FVFJJQ1NfUE9SVF9OVU1CRVI9JHtaT09fUFJPTUVUSEVVU19NRVRSSUNTX1BPUlRfTlVNQkVSOi05MTQxfScKICBjbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI1LjEyLjUtYWxwaW5lJwogICAgdHR5OiB0cnVlCiAgICBkZXBlbmRzX29uOgogICAgICBpbml0LWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgem9va2VlcGVyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy1PLScKICAgICAgICAtICcwLjAuMC4wOjgxMjMvcGluZycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICB1bGltaXRzOgogICAgICBucHJvYzogNjU1MzUKICAgICAgbm9maWxlOgogICAgICAgIHNvZnQ6IDI2MjE0NAogICAgICAgIGhhcmQ6IDI2MjE0NAogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQ0xJQ0tIT1VTRV9TS0lQX1VTRVJfU0VUVVA9MQogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogY2xpY2tob3VzZQogICAgICAgIHRhcmdldDogL3Zhci9saWIvY2xpY2tob3VzZS8KICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogdXNlci1zY3JpcHRzCiAgICAgICAgdGFyZ2V0OiAvdmFyL2xpYi9jbGlja2hvdXNlL3VzZXJfc2NyaXB0cwogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlL2N1c3RvbS1mdW5jdGlvbi54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY3VzdG9tLWZ1bmN0aW9uLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8ZnVuY3Rpb25zPlxuICAgIDxmdW5jdGlvbj5cbiAgICAgICAgPHR5cGU+ZXhlY3V0YWJsZTwvdHlwZT5cbiAgICAgICAgPG5hbWU+aGlzdG9ncmFtUXVhbnRpbGU8L25hbWU+XG4gICAgICAgIDxyZXR1cm5fdHlwZT5GbG9hdDY0PC9yZXR1cm5fdHlwZT5cbiAgICAgICAgPGFyZ3VtZW50PlxuICAgICAgICAgICAgPHR5cGU+QXJyYXkoRmxvYXQ2NCk8L3R5cGU+XG4gICAgICAgICAgICA8bmFtZT5idWNrZXRzPC9uYW1lPlxuICAgICAgICA8L2FyZ3VtZW50PlxuICAgICAgICA8YXJndW1lbnQ+XG4gICAgICAgICAgICA8dHlwZT5BcnJheShGbG9hdDY0KTwvdHlwZT5cbiAgICAgICAgICAgIDxuYW1lPmNvdW50czwvbmFtZT5cbiAgICAgICAgPC9hcmd1bWVudD5cbiAgICAgICAgPGFyZ3VtZW50PlxuICAgICAgICAgICAgPHR5cGU+RmxvYXQ2NDwvdHlwZT5cbiAgICAgICAgICAgIDxuYW1lPnF1YW50aWxlPC9uYW1lPlxuICAgICAgICA8L2FyZ3VtZW50PlxuICAgICAgICA8Zm9ybWF0PkNTVjwvZm9ybWF0PlxuICAgICAgICA8Y29tbWFuZD4uL2hpc3RvZ3JhbVF1YW50aWxlPC9jb21tYW5kPlxuICAgIDwvZnVuY3Rpb24+XG48L2Z1bmN0aW9ucz5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS9jbHVzdGVyLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9jbHVzdGVyLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8P3htbCB2ZXJzaW9uPVwiMS4wXCI/PlxuPGNsaWNraG91c2U+XG4gICAgPHpvb2tlZXBlcj5cbiAgICAgICAgPG5vZGUgaW5kZXg9XCIxXCI+XG4gICAgICAgICAgICA8aG9zdD56b29rZWVwZXI8L2hvc3Q+XG4gICAgICAgICAgICA8cG9ydD4yMTgxPC9wb3J0PlxuICAgICAgICA8L25vZGU+XG4gICAgPC96b29rZWVwZXI+XG4gICAgPHJlbW90ZV9zZXJ2ZXJzPlxuICAgICAgICA8Y2x1c3Rlcj5cbiAgICAgICAgICAgIDxzaGFyZD5cbiAgICAgICAgICAgICAgICA8cmVwbGljYT5cbiAgICAgICAgICAgICAgICAgICAgPGhvc3Q+Y2xpY2tob3VzZTwvaG9zdD5cbiAgICAgICAgICAgICAgICAgICAgPHBvcnQ+OTAwMDwvcG9ydD5cbiAgICAgICAgICAgICAgICA8L3JlcGxpY2E+XG4gICAgICAgICAgICA8L3NoYXJkPlxuICAgICAgICA8L2NsdXN0ZXI+XG4gICAgPC9yZW1vdGVfc2VydmVycz5cbiAgICA8bWFjcm9zPlxuICAgICAgICA8c2hhcmQ+MDE8L3NoYXJkPlxuICAgICAgICA8cmVwbGljYT5yZXBsaWNhMDE8L3JlcGxpY2E+XG4gICAgPC9tYWNyb3M+XG4gICAgPHVzZXJfc2NyaXB0c19wYXRoPi92YXIvbGliL2NsaWNraG91c2UvdXNlcl9zY3JpcHRzLzwvdXNlcl9zY3JpcHRzX3BhdGg+XG4gICAgPHVzZXJfZGVmaW5lZF9leGVjdXRhYmxlX2Z1bmN0aW9uc19jb25maWc+KmZ1bmN0aW9uLnhtbDwvdXNlcl9kZWZpbmVkX2V4ZWN1dGFibGVfZnVuY3Rpb25zX2NvbmZpZz5cbjwvY2xpY2tob3VzZT5cbiIKICBzaWdub3o6CiAgICBpbWFnZTogJ3NpZ25vei9zaWdub3o6djAuMTM3LjEnCiAgICBkZXBlbmRzX29uOgogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHRlbGVtZXRyeXN0b3JlLW1pZ3JhdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICBsb2dnaW5nOgogICAgICBvcHRpb25zOgogICAgICAgIG1heC1zaXplOiA1MG0KICAgICAgICBtYXgtZmlsZTogJzMnCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogdm9sdW1lCiAgICAgICAgc291cmNlOiBzcWxpdGUKICAgICAgICB0YXJnZXQ6IC92YXIvbGliL3NpZ25vei8KICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9TSUdOT1pfODA4MAogICAgICAtICdTSUdOT1pfVE9LRU5JWkVSX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1JFQUxCQVNFNjRfSldUU0VDUkVUfScKICAgICAgLSBTSUdOT1pfU1FMU1RPUkVfUFJPVklERVI9c3FsaXRlCiAgICAgIC0gU0lHTk9aX1NRTFNUT1JFX1NRTElURV9QQVRIPS92YXIvbGliL3NpZ25vei9zaWdub3ouZGIKICAgICAgLSBTSUdOT1pfVEVMRU1FVFJZU1RPUkVfUFJPVklERVI9Y2xpY2tob3VzZQogICAgICAtICdTSUdOT1pfVEVMRU1FVFJZU1RPUkVfQ0xJQ0tIT1VTRV9EU049dGNwOi8vY2xpY2tob3VzZTo5MDAwJwogICAgICAtIEdPREVCVUc9bmV0ZG5zPWdvCiAgICAgIC0gREVQTE9ZTUVOVF9UWVBFPWRvY2tlci1zdGFuZGFsb25lLWFtZAogICAgICAtICdTSUdOT1pfU1RBVFNSRVBPUlRFUl9FTkFCTEVEPSR7U0lHTk9aX1NUQVRTUkVQT1JURVJfRU5BQkxFRDotdHJ1ZX0nCiAgICAgIC0gJ1NJR05PWl9FTUFJTElOR19FTkFCTEVEPSR7U0lHTk9aX0VNQUlMSU5HX0VOQUJMRUQ6LWZhbHNlfScKICAgICAgLSAnU0lHTk9aX0VNQUlMSU5HX1NNVFBfQUREUkVTUz0ke1NJR05PWl9FTUFJTElOR19TTVRQX0FERFJFU1N9JwogICAgICAtICdTSUdOT1pfRU1BSUxJTkdfU01UUF9GUk9NPSR7U0lHTk9aX0VNQUlMSU5HX1NNVFBfRlJPTX0nCiAgICAgIC0gJ1NJR05PWl9FTUFJTElOR19TTVRQX0FVVEhfVVNFUk5BTUU9JHtTSUdOT1pfRU1BSUxJTkdfU01UUF9BVVRIX1VTRVJOQU1FfScKICAgICAgLSAnU0lHTk9aX0VNQUlMSU5HX1NNVFBfQVVUSF9QQVNTV09SRD0ke1NJR05PWl9FTUFJTElOR19TTVRQX0FVVEhfUEFTU1dPUkR9JwogICAgICAtIFNJR05PWl9BTEVSVE1BTkFHRVJfUFJPVklERVI9c2lnbm96CiAgICAgIC0gJ1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19BVVRIX19QQVNTV09SRD0ke1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19BVVRIX19QQVNTV09SRH0nCiAgICAgIC0gJ1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19BVVRIX19VU0VSTkFNRT0ke1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19BVVRIX19VU0VSTkFNRX0nCiAgICAgIC0gJ1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19GUk9NPSR7U0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0ZST019JwogICAgICAtICdTSUdOT1pfQUxFUlRNQU5BR0VSX1NJR05PWl9HTE9CQUxfU01UUF9fU01BUlRIT1NUPSR7U0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX1NNQVJUSE9TVH0nCiAgICAgIC0gRE9UX01FVFJJQ1NfRU5BQkxFRD10cnVlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJy1xJwogICAgICAgIC0gJ2xvY2FsaG9zdDo4MDgwL2FwaS92MS9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIHRlbGVtZXRyeXN0b3JlLW1pZ3JhdG9yOgogICAgaW1hZ2U6ICdzaWdub3ovc2lnbm96LW90ZWwtY29sbGVjdG9yOnYwLjE0NC44JwogICAgZGVwZW5kc19vbjoKICAgICAgY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDoKICAgICAgLSAvYmluL3NoCiAgICAgIC0gJy1jJwogICAgY29tbWFuZDoKICAgICAgLSAiL3NpZ25vei1vdGVsLWNvbGxlY3RvciBtaWdyYXRlIGJvb3RzdHJhcCAtLWNsaWNraG91c2UtZHNuIHRjcDovL2NsaWNraG91c2U6OTAwMCAmJlxuL3NpZ25vei1vdGVsLWNvbGxlY3RvciBtaWdyYXRlIHN5bmMgdXAgLS1jbGlja2hvdXNlLWRzbiB0Y3A6Ly9jbGlja2hvdXNlOjkwMDAgJiZcbi9zaWdub3otb3RlbC1jb2xsZWN0b3IgbWlncmF0ZSBhc3luYyB1cCAtLWNsaWNraG91c2UtZHNuIHRjcDovL2NsaWNraG91c2U6OTAwMFxuIgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1NJR05PWl9PVEVMX0NPTExFQ1RPUl9DTElDS0hPVVNFX0RTTj10Y3A6Ly9jbGlja2hvdXNlOjkwMDAnCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfQ0xVU1RFUj1jbHVzdGVyCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfUkVQTElDQVRJT049dHJ1ZQogICAgICAtIFNJR05PWl9PVEVMX0NPTExFQ1RPUl9USU1FT1VUPTEwbQogICAgcmVzdGFydDogb24tZmFpbHVyZQogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgICBsb2dnaW5nOgogICAgICBvcHRpb25zOgogICAgICAgIG1heC1zaXplOiA1MG0KICAgICAgICBtYXgtZmlsZTogJzMnCiAgb3RlbC1jb2xsZWN0b3I6CiAgICBpbWFnZTogJ3NpZ25vei9zaWdub3otb3RlbC1jb2xsZWN0b3I6djAuMTQ0LjgnCiAgICBkZXBlbmRzX29uOgogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHRlbGVtZXRyeXN0b3JlLW1pZ3JhdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICAgIHNpZ25vejoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgZW50cnlwb2ludDoKICAgICAgLSAvYmluL3NoCiAgICBjb21tYW5kOgogICAgICAtICctYycKICAgICAgLSAic2V0IC1lXG5jYXQgPiAvdG1wL290ZWwtY29uZmlnLnlhbWwgPDwnU0lHTk9aX0NGRydcbmNvbm5lY3RvcnM6XG4gIHNpZ25vem1ldGVyOlxuICAgIG1ldHJpY3NfZmx1c2hfaW50ZXJ2YWw6IDFoXG4gICAgZGltZW5zaW9uczpcbiAgICAgIC0gbmFtZTogc2VydmljZS5uYW1lXG4gICAgICAtIG5hbWU6IGRlcGxveW1lbnQuZW52aXJvbm1lbnRcbiAgICAgIC0gbmFtZTogaG9zdC5uYW1lXG5yZWNlaXZlcnM6XG4gIG90bHA6XG4gICAgcHJvdG9jb2xzOlxuICAgICAgZ3JwYzpcbiAgICAgICAgZW5kcG9pbnQ6IDAuMC4wLjA6NDMxN1xuICAgICAgaHR0cDpcbiAgICAgICAgZW5kcG9pbnQ6IDAuMC4wLjA6NDMxOFxuICAgICAgICBhdXRoOlxuICAgICAgICAgIGF1dGhlbnRpY2F0b3I6IGJhc2ljYXV0aC9zZXJ2ZXJcbnByb2Nlc3NvcnM6XG4gIGJhdGNoOlxuICAgIHNlbmRfYmF0Y2hfc2l6ZTogNTAwMDBcbiAgICBzZW5kX2JhdGNoX21heF9zaXplOiA1NTAwMFxuICAgIHRpbWVvdXQ6IDVzXG4gIGJhdGNoL21ldGVyOlxuICAgIHNlbmRfYmF0Y2hfc2l6ZTogMjAwMDBcbiAgICBzZW5kX2JhdGNoX21heF9zaXplOiAyNTAwMFxuICAgIHRpbWVvdXQ6IDVzXG4gIHNpZ25venNwYW5tZXRyaWNzL2RlbHRhOlxuICAgIG1ldHJpY3NfZXhwb3J0ZXI6IHNpZ25vemNsaWNraG91c2VtZXRyaWNzXG4gICAgbWV0cmljc19mbHVzaF9pbnRlcnZhbDogNjBzXG4gICAgbGF0ZW5jeV9oaXN0b2dyYW1fYnVja2V0czogWzEwMHVzLCAxbXMsIDJtcywgNm1zLCAxMG1zLCA1MG1zLCAxMDBtcywgMjUwbXMsIDUwMG1zLCAxMDAwbXMsIDE0MDBtcywgMjAwMG1zLCA1cywgMTBzLCAyMHMsIDQwcywgNjBzXVxuICAgIGRpbWVuc2lvbnNfY2FjaGVfc2l6ZTogMTAwMDAwXG4gICAgYWdncmVnYXRpb25fdGVtcG9yYWxpdHk6IEFHR1JFR0FUSU9OX1RFTVBPUkFMSVRZX0RFTFRBXG4gICAgZW5hYmxlX2V4cF9oaXN0b2dyYW06IHRydWVcbiAgICBkaW1lbnNpb25zOlxuICAgICAgLSBuYW1lOiBzZXJ2aWNlLm5hbWVzcGFjZVxuICAgICAgICBkZWZhdWx0OiBkZWZhdWx0XG4gICAgICAtIG5hbWU6IGRlcGxveW1lbnQuZW52aXJvbm1lbnRcbiAgICAgICAgZGVmYXVsdDogZGVmYXVsdFxuICAgICAgIyBUaGlzIGlzIGFkZGVkIHRvIGVuc3VyZSB0aGUgdW5pcXVlbmVzcyBvZiB0aGUgdGltZXNlcmllc1xuICAgICAgIyBPdGhlcndpc2UsIGlkZW50aWNhbCB0aW1lc2VyaWVzIHByb2R1Y2VkIGJ5IG11bHRpcGxlIHJlcGxpY2FzIG9mXG4gICAgICAjIGNvbGxlY3RvcnMgcmVzdWx0IGluIGluY29ycmVjdCBBUE0gbWV0cmljc1xuICAgICAgLSBuYW1lOiBzaWdub3ouY29sbGVjdG9yLmlkXG4gICAgICAtIG5hbWU6IHNlcnZpY2UudmVyc2lvblxuZXhwb3J0ZXJzOlxuICBjbGlja2hvdXNldHJhY2VzOlxuICAgIGRhdGFzb3VyY2U6IHRjcDovL2NsaWNraG91c2U6OTAwMC9zaWdub3pfdHJhY2VzXG4gICAgbG93X2NhcmRpbmFsX2V4Y2VwdGlvbl9ncm91cGluZzogZmFsc2VcbiAgICB1c2VfbmV3X3NjaGVtYTogdHJ1ZVxuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIHNlbmRpbmdfcXVldWU6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICBzaWdub3pjbGlja2hvdXNlbWV0cmljczpcbiAgICBkc246IHRjcDovL2NsaWNraG91c2U6OTAwMC9zaWdub3pfbWV0cmljc1xuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIHNlbmRpbmdfcXVldWU6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICBjbGlja2hvdXNlbG9nc2V4cG9ydGVyOlxuICAgIGRzbjogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel9sb2dzXG4gICAgdXNlX25ld19zY2hlbWE6IHRydWVcbiAgICB0aW1lb3V0OiA0NXNcbiAgICBzZW5kaW5nX3F1ZXVlOlxuICAgICAgZW5hYmxlZDogZmFsc2VcbiAgc2lnbm96Y2xpY2tob3VzZW1ldGVyOlxuICAgIGRzbjogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel9tZXRlclxuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIHNlbmRpbmdfcXVldWU6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICBtZXRhZGF0YWV4cG9ydGVyOlxuICAgIGVuYWJsZWQ6IHRydWVcbiAgICBkc246IHRjcDovL2NsaWNraG91c2U6OTAwMC9zaWdub3pfbWV0YWRhdGFcbiAgICB0aW1lb3V0OiA0NXNcbiAgICBjYWNoZTpcbiAgICAgIHByb3ZpZGVyOiBpbl9tZW1vcnlcbmV4dGVuc2lvbnM6XG4gIHNpZ25vel9oZWFsdGhfY2hlY2s6XG4gICAgZW5kcG9pbnQ6IDAuMC4wLjA6MTMxMzNcbiAgcHByb2Y6XG4gICAgZW5kcG9pbnQ6IDAuMC4wLjA6MTc3N1xuICBiYXNpY2F1dGgvc2VydmVyOlxuICAgIGh0cGFzc3dkOlxuICAgICAgaW5saW5lOiBcIiQke2VudjpPVEVMX0JBU0lDX0FVVEh9XFxuXCJcbnNlcnZpY2U6XG4gIHRlbGVtZXRyeTpcbiAgICBsb2dzOlxuICAgICAgZW5jb2Rpbmc6IGpzb25cbiAgZXh0ZW5zaW9uczpcbiAgICAtIHNpZ25vel9oZWFsdGhfY2hlY2tcbiAgICAtIHBwcm9mXG4gICAgLSBiYXNpY2F1dGgvc2VydmVyXG4gIHBpcGVsaW5lczpcbiAgICB0cmFjZXM6XG4gICAgICByZWNlaXZlcnM6IFtvdGxwXVxuICAgICAgcHJvY2Vzc29yczogW3NpZ25venNwYW5tZXRyaWNzL2RlbHRhLCBiYXRjaF1cbiAgICAgIGV4cG9ydGVyczogW2NsaWNraG91c2V0cmFjZXMsIHNpZ25vem1ldGVyLCBtZXRhZGF0YWV4cG9ydGVyXVxuICAgIG1ldHJpY3M6XG4gICAgICByZWNlaXZlcnM6IFtvdGxwXVxuICAgICAgcHJvY2Vzc29yczogW2JhdGNoXVxuICAgICAgZXhwb3J0ZXJzOiBbc2lnbm96Y2xpY2tob3VzZW1ldHJpY3MsIHNpZ25vem1ldGVyLCBtZXRhZGF0YWV4cG9ydGVyXVxuICAgIGxvZ3M6XG4gICAgICByZWNlaXZlcnM6IFtvdGxwXVxuICAgICAgcHJvY2Vzc29yczogW2JhdGNoXVxuICAgICAgZXhwb3J0ZXJzOiBbY2xpY2tob3VzZWxvZ3NleHBvcnRlciwgc2lnbm96bWV0ZXIsIG1ldGFkYXRhZXhwb3J0ZXJdXG4gICAgbWV0cmljcy9tZXRlcjpcbiAgICAgIHJlY2VpdmVyczogW3NpZ25vem1ldGVyXVxuICAgICAgcHJvY2Vzc29yczogW2JhdGNoL21ldGVyXVxuICAgICAgZXhwb3J0ZXJzOiBbc2lnbm96Y2xpY2tob3VzZW1ldGVyXVxuU0lHTk9aX0NGR1xuY2F0ID4gL3RtcC9vcGFtcC1jb25maWcueWFtbCA8PCdTSUdOT1pfT1BBTVAnXG5zZXJ2ZXJfZW5kcG9pbnQ6IHdzOi8vc2lnbm96OjQzMjAvdjEvb3BhbXBcblNJR05PWl9PUEFNUFxuL3NpZ25vei1vdGVsLWNvbGxlY3RvciBtaWdyYXRlIHN5bmMgY2hlY2tcbmV4ZWMgL3NpZ25vei1vdGVsLWNvbGxlY3RvciAtLWNvbmZpZz0vdG1wL290ZWwtY29uZmlnLnlhbWwgLS1tYW5hZ2VyLWNvbmZpZz0vdG1wL29wYW1wLWNvbmZpZy55YW1sIC0tY29weS1wYXRoPS92YXIvdG1wL2NvbGxlY3Rvci1jb25maWcueWFtbFxuIgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX09URUxDT0xMRUNUT1JIVFRQXzQzMTgKICAgICAgLSAnT1RFTF9SRVNPVVJDRV9BVFRSSUJVVEVTPWhvc3QubmFtZT1zaWdub3otaG9zdCxvcy50eXBlPWxpbnV4JwogICAgICAtIExPV19DQVJESU5BTF9FWENFUFRJT05fR1JPVVBJTkc9ZmFsc2UKICAgICAgLSAnU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfRFNOPXRjcDovL2NsaWNraG91c2U6OTAwMCcKICAgICAgLSBTSUdOT1pfT1RFTF9DT0xMRUNUT1JfQ0xJQ0tIT1VTRV9DTFVTVEVSPWNsdXN0ZXIKICAgICAgLSBTSUdOT1pfT1RFTF9DT0xMRUNUT1JfQ0xJQ0tIT1VTRV9SRVBMSUNBVElPTj10cnVlCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX1RJTUVPVVQ9MTBtCiAgICAgIC0gJ09URUxfQkFTSUNfQVVUSD1zaWdub3o6JHtTRVJWSUNFX1BBU1NXT1JEXzY0X09URUxBVVRIfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnYmFzaCAtYyAiZXhlYyA2PD4gL2Rldi90Y3AvbG9jYWxob3N0LzEzMTMzIicKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
+        "compose": "c2VydmljZXM6CiAgaW5pdC1jbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI1LjEyLjUtYWxwaW5lJwogICAgY29tbWFuZDoKICAgICAgLSBiYXNoCiAgICAgIC0gJy1jJwogICAgICAtICJ2ZXJzaW9uPVwidjAuMC4xXCJcbm5vZGVfb3M9JCQodW5hbWUgLXMgfCB0ciAnWzp1cHBlcjpdJyAnWzpsb3dlcjpdJylcbm5vZGVfYXJjaD0kJCh1bmFtZSAtbSB8IHNlZCBzL2FhcmNoNjQvYXJtNjQvIHwgc2VkIHMveDg2XzY0L2FtZDY0LylcbmVjaG8gXCJGZXRjaGluZyBoaXN0b2dyYW0tYmluYXJ5IGZvciAkJHtub2RlX29zfS8kJHtub2RlX2FyY2h9XCJcbmNkIC90bXBcbndnZXQgLU8gaGlzdG9ncmFtLXF1YW50aWxlLnRhci5neiBcImh0dHBzOi8vZ2l0aHViLmNvbS9TaWdOb3ovc2lnbm96L3JlbGVhc2VzL2Rvd25sb2FkL2hpc3RvZ3JhbS1xdWFudGlsZSUyRiQke3ZlcnNpb259L2hpc3RvZ3JhbS1xdWFudGlsZV8kJHtub2RlX29zfV8kJHtub2RlX2FyY2h9LnRhci5nelwiXG50YXIgLXh2emYgaGlzdG9ncmFtLXF1YW50aWxlLnRhci5nelxubXYgaGlzdG9ncmFtLXF1YW50aWxlIC92YXIvbGliL2NsaWNraG91c2UvdXNlcl9zY3JpcHRzL2hpc3RvZ3JhbVF1YW50aWxlXG4iCiAgICByZXN0YXJ0OiBvbi1mYWlsdXJlCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGxvZ2dpbmc6CiAgICAgIG9wdGlvbnM6CiAgICAgICAgbWF4LXNpemU6IDUwbQogICAgICAgIG1heC1maWxlOiAnMycKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiB2b2x1bWUKICAgICAgICBzb3VyY2U6IHVzZXItc2NyaXB0cwogICAgICAgIHRhcmdldDogL3Zhci9saWIvY2xpY2tob3VzZS91c2VyX3NjcmlwdHMKICB6b29rZWVwZXI6CiAgICBpbWFnZTogJ3NpZ25vei96b29rZWVwZXI6My45LjMnCiAgICB1c2VyOiByb290CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXMgLW0gMiBodHRwOi8vbG9jYWxob3N0OjgwODAvY29tbWFuZHMvcnVvayB8IGdyZXAgZXJyb3IgfCBncmVwIG51bGwnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgdm9sdW1lczoKICAgICAgLSAnem9va2VlcGVyOi9iaXRuYW1pL3pvb2tlZXBlcicKICAgIGVudmlyb25tZW50OgogICAgICAtICdBTExPV19BTk9OWU1PVVNfTE9HSU49JHtaT09fQUxMT1dfQU5PTllNT1VTX0xPR0lOOi15ZXN9JwogICAgICAtICdaT09fQVVUT1BVUkdFX0lOVEVSVkFMPSR7Wk9PX0FVVE9QVVJHRV9JTlRFUlZBTDotMX0nCiAgICAgIC0gJ1pPT19FTkFCTEVfUFJPTUVUSEVVU19NRVRSSUNTPSR7Wk9PX0VOQUJMRV9QUk9NRVRIRVVTX01FVFJJQ1M6LXllc30nCiAgICAgIC0gJ1pPT19QUk9NRVRIRVVTX01FVFJJQ1NfUE9SVF9OVU1CRVI9JHtaT09fUFJPTUVUSEVVU19NRVRSSUNTX1BPUlRfTlVNQkVSOi05MTQxfScKICBjbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI1LjEyLjUtYWxwaW5lJwogICAgdHR5OiB0cnVlCiAgICBkZXBlbmRzX29uOgogICAgICBpbml0LWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgem9va2VlcGVyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy1PLScKICAgICAgICAtICcwLjAuMC4wOjgxMjMvcGluZycKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICB1bGltaXRzOgogICAgICBucHJvYzogNjU1MzUKICAgICAgbm9maWxlOgogICAgICAgIHNvZnQ6IDI2MjE0NAogICAgICAgIGhhcmQ6IDI2MjE0NAogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQ0xJQ0tIT1VTRV9TS0lQX1VTRVJfU0VUVVA9MQogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogY2xpY2tob3VzZQogICAgICAgIHRhcmdldDogL3Zhci9saWIvY2xpY2tob3VzZS8KICAgICAgLQogICAgICAgIHR5cGU6IHZvbHVtZQogICAgICAgIHNvdXJjZTogdXNlci1zY3JpcHRzCiAgICAgICAgdGFyZ2V0OiAvdmFyL2xpYi9jbGlja2hvdXNlL3VzZXJfc2NyaXB0cwogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlL2N1c3RvbS1mdW5jdGlvbi54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY3VzdG9tLWZ1bmN0aW9uLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8ZnVuY3Rpb25zPlxuICAgIDxmdW5jdGlvbj5cbiAgICAgICAgPHR5cGU+ZXhlY3V0YWJsZTwvdHlwZT5cbiAgICAgICAgPG5hbWU+aGlzdG9ncmFtUXVhbnRpbGU8L25hbWU+XG4gICAgICAgIDxyZXR1cm5fdHlwZT5GbG9hdDY0PC9yZXR1cm5fdHlwZT5cbiAgICAgICAgPGFyZ3VtZW50PlxuICAgICAgICAgICAgPHR5cGU+QXJyYXkoRmxvYXQ2NCk8L3R5cGU+XG4gICAgICAgICAgICA8bmFtZT5idWNrZXRzPC9uYW1lPlxuICAgICAgICA8L2FyZ3VtZW50PlxuICAgICAgICA8YXJndW1lbnQ+XG4gICAgICAgICAgICA8dHlwZT5BcnJheShGbG9hdDY0KTwvdHlwZT5cbiAgICAgICAgICAgIDxuYW1lPmNvdW50czwvbmFtZT5cbiAgICAgICAgPC9hcmd1bWVudD5cbiAgICAgICAgPGFyZ3VtZW50PlxuICAgICAgICAgICAgPHR5cGU+RmxvYXQ2NDwvdHlwZT5cbiAgICAgICAgICAgIDxuYW1lPnF1YW50aWxlPC9uYW1lPlxuICAgICAgICA8L2FyZ3VtZW50PlxuICAgICAgICA8Zm9ybWF0PkNTVjwvZm9ybWF0PlxuICAgICAgICA8Y29tbWFuZD4uL2hpc3RvZ3JhbVF1YW50aWxlPC9jb21tYW5kPlxuICAgIDwvZnVuY3Rpb24+XG48L2Z1bmN0aW9ucz5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS9jbHVzdGVyLnhtbAogICAgICAgIHRhcmdldDogL2V0Yy9jbGlja2hvdXNlLXNlcnZlci9jb25maWcuZC9jbHVzdGVyLnhtbAogICAgICAgIGNvbnRlbnQ6ICI8P3htbCB2ZXJzaW9uPVwiMS4wXCI/PlxuPGNsaWNraG91c2U+XG4gICAgPHpvb2tlZXBlcj5cbiAgICAgICAgPG5vZGUgaW5kZXg9XCIxXCI+XG4gICAgICAgICAgICA8aG9zdD56b29rZWVwZXI8L2hvc3Q+XG4gICAgICAgICAgICA8cG9ydD4yMTgxPC9wb3J0PlxuICAgICAgICA8L25vZGU+XG4gICAgPC96b29rZWVwZXI+XG4gICAgPHJlbW90ZV9zZXJ2ZXJzPlxuICAgICAgICA8Y2x1c3Rlcj5cbiAgICAgICAgICAgIDxzaGFyZD5cbiAgICAgICAgICAgICAgICA8cmVwbGljYT5cbiAgICAgICAgICAgICAgICAgICAgPGhvc3Q+Y2xpY2tob3VzZTwvaG9zdD5cbiAgICAgICAgICAgICAgICAgICAgPHBvcnQ+OTAwMDwvcG9ydD5cbiAgICAgICAgICAgICAgICA8L3JlcGxpY2E+XG4gICAgICAgICAgICA8L3NoYXJkPlxuICAgICAgICA8L2NsdXN0ZXI+XG4gICAgPC9yZW1vdGVfc2VydmVycz5cbiAgICA8bWFjcm9zPlxuICAgICAgICA8c2hhcmQ+MDE8L3NoYXJkPlxuICAgICAgICA8cmVwbGljYT5yZXBsaWNhMDE8L3JlcGxpY2E+XG4gICAgPC9tYWNyb3M+XG4gICAgPHVzZXJfc2NyaXB0c19wYXRoPi92YXIvbGliL2NsaWNraG91c2UvdXNlcl9zY3JpcHRzLzwvdXNlcl9zY3JpcHRzX3BhdGg+XG4gICAgPHVzZXJfZGVmaW5lZF9leGVjdXRhYmxlX2Z1bmN0aW9uc19jb25maWc+KmZ1bmN0aW9uLnhtbDwvdXNlcl9kZWZpbmVkX2V4ZWN1dGFibGVfZnVuY3Rpb25zX2NvbmZpZz5cbjwvY2xpY2tob3VzZT5cbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vY2xpY2tob3VzZS9zeXN0ZW0tbG9ncy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvc3lzdGVtLWxvZ3MueG1sCiAgICAgICAgY29udGVudDogIjw/eG1sIHZlcnNpb249XCIxLjBcIj8+XG48Y2xpY2tob3VzZT5cbiAgICA8cXVlcnlfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICAgICAgPGZsdXNoX2ludGVydmFsX21pbGxpc2Vjb25kcz4zMDAwMDwvZmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPlxuICAgIDwvcXVlcnlfbG9nPlxuICAgIDxxdWVyeV90aHJlYWRfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICA8L3F1ZXJ5X3RocmVhZF9sb2c+XG4gICAgPHF1ZXJ5X21ldHJpY19sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgIDwvcXVlcnlfbWV0cmljX2xvZz5cbiAgICA8cXVlcnlfdmlld3NfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICA8L3F1ZXJ5X3ZpZXdzX2xvZz5cbiAgICA8cGFydF9sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgIDwvcGFydF9sb2c+XG4gICAgPG1ldHJpY19sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgICAgICA8Zmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPjMwMDAwPC9mbHVzaF9pbnRlcnZhbF9taWxsaXNlY29uZHM+XG4gICAgPC9tZXRyaWNfbG9nPlxuICAgIDxhc3luY2hyb25vdXNfbWV0cmljX2xvZz5cbiAgICAgICAgPHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgMSBEQVkgREVMRVRFPC90dGw+XG4gICAgPC9hc3luY2hyb25vdXNfbWV0cmljX2xvZz5cbiAgICA8dHJhY2VfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICAgICAgPGZsdXNoX2ludGVydmFsX21pbGxpc2Vjb25kcz4zMDAwMDwvZmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPlxuICAgIDwvdHJhY2VfbG9nPlxuICAgIDxlcnJvcl9sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgIDwvZXJyb3JfbG9nPlxuICAgIDxwcm9jZXNzb3JzX3Byb2ZpbGVfbG9nPlxuICAgICAgICA8dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxIERBWSBERUxFVEU8L3R0bD5cbiAgICAgICAgPGZsdXNoX2ludGVydmFsX21pbGxpc2Vjb25kcz4zMDAwMDwvZmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPlxuICAgIDwvcHJvY2Vzc29yc19wcm9maWxlX2xvZz5cbiAgICA8dGV4dF9sb2c+XG4gICAgICAgIDx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDEgREFZIERFTEVURTwvdHRsPlxuICAgICAgICA8Zmx1c2hfaW50ZXJ2YWxfbWlsbGlzZWNvbmRzPjMwMDAwPC9mbHVzaF9pbnRlcnZhbF9taWxsaXNlY29uZHM+XG4gICAgPC90ZXh0X2xvZz5cbjwvY2xpY2tob3VzZT5cbiIKICBzaWdub3o6CiAgICBpbWFnZTogJ3NpZ25vei9zaWdub3o6djAuMTM3LjEnCiAgICBkZXBlbmRzX29uOgogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHRlbGVtZXRyeXN0b3JlLW1pZ3JhdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICBsb2dnaW5nOgogICAgICBvcHRpb25zOgogICAgICAgIG1heC1zaXplOiA1MG0KICAgICAgICBtYXgtZmlsZTogJzMnCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogdm9sdW1lCiAgICAgICAgc291cmNlOiBzcWxpdGUKICAgICAgICB0YXJnZXQ6IC92YXIvbGliL3NpZ25vei8KICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9TSUdOT1pfODA4MAogICAgICAtICdTSUdOT1pfVE9LRU5JWkVSX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1JFQUxCQVNFNjRfSldUU0VDUkVUfScKICAgICAgLSBTSUdOT1pfU1FMU1RPUkVfUFJPVklERVI9c3FsaXRlCiAgICAgIC0gU0lHTk9aX1NRTFNUT1JFX1NRTElURV9QQVRIPS92YXIvbGliL3NpZ25vei9zaWdub3ouZGIKICAgICAgLSBTSUdOT1pfVEVMRU1FVFJZU1RPUkVfUFJPVklERVI9Y2xpY2tob3VzZQogICAgICAtICdTSUdOT1pfVEVMRU1FVFJZU1RPUkVfQ0xJQ0tIT1VTRV9EU049dGNwOi8vY2xpY2tob3VzZTo5MDAwJwogICAgICAtIEdPREVCVUc9bmV0ZG5zPWdvCiAgICAgIC0gREVQTE9ZTUVOVF9UWVBFPWRvY2tlci1zdGFuZGFsb25lLWFtZAogICAgICAtICdTSUdOT1pfU1RBVFNSRVBPUlRFUl9FTkFCTEVEPSR7U0lHTk9aX1NUQVRTUkVQT1JURVJfRU5BQkxFRDotdHJ1ZX0nCiAgICAgIC0gJ1NJR05PWl9FTUFJTElOR19FTkFCTEVEPSR7U0lHTk9aX0VNQUlMSU5HX0VOQUJMRUQ6LWZhbHNlfScKICAgICAgLSAnU0lHTk9aX0VNQUlMSU5HX1NNVFBfQUREUkVTUz0ke1NJR05PWl9FTUFJTElOR19TTVRQX0FERFJFU1N9JwogICAgICAtICdTSUdOT1pfRU1BSUxJTkdfU01UUF9GUk9NPSR7U0lHTk9aX0VNQUlMSU5HX1NNVFBfRlJPTX0nCiAgICAgIC0gJ1NJR05PWl9FTUFJTElOR19TTVRQX0FVVEhfVVNFUk5BTUU9JHtTSUdOT1pfRU1BSUxJTkdfU01UUF9BVVRIX1VTRVJOQU1FfScKICAgICAgLSAnU0lHTk9aX0VNQUlMSU5HX1NNVFBfQVVUSF9QQVNTV09SRD0ke1NJR05PWl9FTUFJTElOR19TTVRQX0FVVEhfUEFTU1dPUkR9JwogICAgICAtIFNJR05PWl9BTEVSVE1BTkFHRVJfUFJPVklERVI9c2lnbm96CiAgICAgIC0gJ1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19BVVRIX19QQVNTV09SRD0ke1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19BVVRIX19QQVNTV09SRH0nCiAgICAgIC0gJ1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19BVVRIX19VU0VSTkFNRT0ke1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19BVVRIX19VU0VSTkFNRX0nCiAgICAgIC0gJ1NJR05PWl9BTEVSVE1BTkFHRVJfU0lHTk9aX0dMT0JBTF9TTVRQX19GUk9NPSR7U0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX0ZST019JwogICAgICAtICdTSUdOT1pfQUxFUlRNQU5BR0VSX1NJR05PWl9HTE9CQUxfU01UUF9fU01BUlRIT1NUPSR7U0lHTk9aX0FMRVJUTUFOQUdFUl9TSUdOT1pfR0xPQkFMX1NNVFBfX1NNQVJUSE9TVH0nCiAgICAgIC0gRE9UX01FVFJJQ1NfRU5BQkxFRD10cnVlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJy1xJwogICAgICAgIC0gJ2xvY2FsaG9zdDo4MDgwL2FwaS92MS9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIHRlbGVtZXRyeXN0b3JlLW1pZ3JhdG9yOgogICAgaW1hZ2U6ICdzaWdub3ovc2lnbm96LW90ZWwtY29sbGVjdG9yOnYwLjE0NC44JwogICAgZGVwZW5kc19vbjoKICAgICAgY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDoKICAgICAgLSAvYmluL3NoCiAgICAgIC0gJy1jJwogICAgY29tbWFuZDoKICAgICAgLSAiL3NpZ25vei1vdGVsLWNvbGxlY3RvciBtaWdyYXRlIGJvb3RzdHJhcCAtLWNsaWNraG91c2UtZHNuIHRjcDovL2NsaWNraG91c2U6OTAwMCAmJlxuL3NpZ25vei1vdGVsLWNvbGxlY3RvciBtaWdyYXRlIHN5bmMgdXAgLS1jbGlja2hvdXNlLWRzbiB0Y3A6Ly9jbGlja2hvdXNlOjkwMDAgJiZcbi9zaWdub3otb3RlbC1jb2xsZWN0b3IgbWlncmF0ZSBhc3luYyB1cCAtLWNsaWNraG91c2UtZHNuIHRjcDovL2NsaWNraG91c2U6OTAwMFxuIgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1NJR05PWl9PVEVMX0NPTExFQ1RPUl9DTElDS0hPVVNFX0RTTj10Y3A6Ly9jbGlja2hvdXNlOjkwMDAnCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfQ0xVU1RFUj1jbHVzdGVyCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfUkVQTElDQVRJT049dHJ1ZQogICAgICAtIFNJR05PWl9PVEVMX0NPTExFQ1RPUl9USU1FT1VUPTEwbQogICAgcmVzdGFydDogb24tZmFpbHVyZQogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgICBsb2dnaW5nOgogICAgICBvcHRpb25zOgogICAgICAgIG1heC1zaXplOiA1MG0KICAgICAgICBtYXgtZmlsZTogJzMnCiAgb3RlbC1jb2xsZWN0b3I6CiAgICBpbWFnZTogJ3NpZ25vei9zaWdub3otb3RlbC1jb2xsZWN0b3I6djAuMTQ0LjgnCiAgICBkZXBlbmRzX29uOgogICAgICBjbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHRlbGVtZXRyeXN0b3JlLW1pZ3JhdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICAgIHNpZ25vejoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgbG9nZ2luZzoKICAgICAgb3B0aW9uczoKICAgICAgICBtYXgtc2l6ZTogNTBtCiAgICAgICAgbWF4LWZpbGU6ICczJwogICAgZW50cnlwb2ludDoKICAgICAgLSAvYmluL3NoCiAgICBjb21tYW5kOgogICAgICAtICctYycKICAgICAgLSAic2V0IC1lXG5jYXQgPiAvdG1wL290ZWwtY29uZmlnLnlhbWwgPDwnU0lHTk9aX0NGRydcbmNvbm5lY3RvcnM6XG4gIHNpZ25vem1ldGVyOlxuICAgIG1ldHJpY3NfZmx1c2hfaW50ZXJ2YWw6IDFoXG4gICAgZGltZW5zaW9uczpcbiAgICAgIC0gbmFtZTogc2VydmljZS5uYW1lXG4gICAgICAtIG5hbWU6IGRlcGxveW1lbnQuZW52aXJvbm1lbnRcbiAgICAgIC0gbmFtZTogaG9zdC5uYW1lXG5yZWNlaXZlcnM6XG4gIG90bHA6XG4gICAgcHJvdG9jb2xzOlxuICAgICAgZ3JwYzpcbiAgICAgICAgZW5kcG9pbnQ6IDAuMC4wLjA6NDMxN1xuICAgICAgaHR0cDpcbiAgICAgICAgZW5kcG9pbnQ6IDAuMC4wLjA6NDMxOFxuICAgICAgICBhdXRoOlxuICAgICAgICAgIGF1dGhlbnRpY2F0b3I6IGJhc2ljYXV0aC9zZXJ2ZXJcbnByb2Nlc3NvcnM6XG4gIGJhdGNoOlxuICAgIHNlbmRfYmF0Y2hfc2l6ZTogNTAwMDBcbiAgICBzZW5kX2JhdGNoX21heF9zaXplOiA1NTAwMFxuICAgIHRpbWVvdXQ6IDVzXG4gIGJhdGNoL21ldGVyOlxuICAgIHNlbmRfYmF0Y2hfc2l6ZTogMjAwMDBcbiAgICBzZW5kX2JhdGNoX21heF9zaXplOiAyNTAwMFxuICAgIHRpbWVvdXQ6IDVzXG4gIHNpZ25venNwYW5tZXRyaWNzL2RlbHRhOlxuICAgIG1ldHJpY3NfZXhwb3J0ZXI6IHNpZ25vemNsaWNraG91c2VtZXRyaWNzXG4gICAgbWV0cmljc19mbHVzaF9pbnRlcnZhbDogNjBzXG4gICAgbGF0ZW5jeV9oaXN0b2dyYW1fYnVja2V0czogWzEwMHVzLCAxbXMsIDJtcywgNm1zLCAxMG1zLCA1MG1zLCAxMDBtcywgMjUwbXMsIDUwMG1zLCAxMDAwbXMsIDE0MDBtcywgMjAwMG1zLCA1cywgMTBzLCAyMHMsIDQwcywgNjBzXVxuICAgIGRpbWVuc2lvbnNfY2FjaGVfc2l6ZTogMTAwMDAwXG4gICAgYWdncmVnYXRpb25fdGVtcG9yYWxpdHk6IEFHR1JFR0FUSU9OX1RFTVBPUkFMSVRZX0RFTFRBXG4gICAgZW5hYmxlX2V4cF9oaXN0b2dyYW06IHRydWVcbiAgICBkaW1lbnNpb25zOlxuICAgICAgLSBuYW1lOiBzZXJ2aWNlLm5hbWVzcGFjZVxuICAgICAgICBkZWZhdWx0OiBkZWZhdWx0XG4gICAgICAtIG5hbWU6IGRlcGxveW1lbnQuZW52aXJvbm1lbnRcbiAgICAgICAgZGVmYXVsdDogZGVmYXVsdFxuICAgICAgIyBUaGlzIGlzIGFkZGVkIHRvIGVuc3VyZSB0aGUgdW5pcXVlbmVzcyBvZiB0aGUgdGltZXNlcmllc1xuICAgICAgIyBPdGhlcndpc2UsIGlkZW50aWNhbCB0aW1lc2VyaWVzIHByb2R1Y2VkIGJ5IG11bHRpcGxlIHJlcGxpY2FzIG9mXG4gICAgICAjIGNvbGxlY3RvcnMgcmVzdWx0IGluIGluY29ycmVjdCBBUE0gbWV0cmljc1xuICAgICAgLSBuYW1lOiBzaWdub3ouY29sbGVjdG9yLmlkXG4gICAgICAtIG5hbWU6IHNlcnZpY2UudmVyc2lvblxuZXhwb3J0ZXJzOlxuICBjbGlja2hvdXNldHJhY2VzOlxuICAgIGRhdGFzb3VyY2U6IHRjcDovL2NsaWNraG91c2U6OTAwMC9zaWdub3pfdHJhY2VzXG4gICAgbG93X2NhcmRpbmFsX2V4Y2VwdGlvbl9ncm91cGluZzogZmFsc2VcbiAgICB1c2VfbmV3X3NjaGVtYTogdHJ1ZVxuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIHNlbmRpbmdfcXVldWU6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICBzaWdub3pjbGlja2hvdXNlbWV0cmljczpcbiAgICBkc246IHRjcDovL2NsaWNraG91c2U6OTAwMC9zaWdub3pfbWV0cmljc1xuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIHNlbmRpbmdfcXVldWU6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICBjbGlja2hvdXNlbG9nc2V4cG9ydGVyOlxuICAgIGRzbjogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel9sb2dzXG4gICAgdXNlX25ld19zY2hlbWE6IHRydWVcbiAgICB0aW1lb3V0OiA0NXNcbiAgICBzZW5kaW5nX3F1ZXVlOlxuICAgICAgZW5hYmxlZDogZmFsc2VcbiAgc2lnbm96Y2xpY2tob3VzZW1ldGVyOlxuICAgIGRzbjogdGNwOi8vY2xpY2tob3VzZTo5MDAwL3NpZ25vel9tZXRlclxuICAgIHRpbWVvdXQ6IDQ1c1xuICAgIHNlbmRpbmdfcXVldWU6XG4gICAgICBlbmFibGVkOiBmYWxzZVxuICBtZXRhZGF0YWV4cG9ydGVyOlxuICAgIGVuYWJsZWQ6IHRydWVcbiAgICBkc246IHRjcDovL2NsaWNraG91c2U6OTAwMC9zaWdub3pfbWV0YWRhdGFcbiAgICB0aW1lb3V0OiA0NXNcbiAgICBjYWNoZTpcbiAgICAgIHByb3ZpZGVyOiBpbl9tZW1vcnlcbmV4dGVuc2lvbnM6XG4gIHNpZ25vel9oZWFsdGhfY2hlY2s6XG4gICAgZW5kcG9pbnQ6IDAuMC4wLjA6MTMxMzNcbiAgcHByb2Y6XG4gICAgZW5kcG9pbnQ6IDAuMC4wLjA6MTc3N1xuICBiYXNpY2F1dGgvc2VydmVyOlxuICAgIGh0cGFzc3dkOlxuICAgICAgaW5saW5lOiBcIiQke2VudjpPVEVMX0JBU0lDX0FVVEh9XFxuXCJcbnNlcnZpY2U6XG4gIHRlbGVtZXRyeTpcbiAgICBsb2dzOlxuICAgICAgZW5jb2Rpbmc6IGpzb25cbiAgZXh0ZW5zaW9uczpcbiAgICAtIHNpZ25vel9oZWFsdGhfY2hlY2tcbiAgICAtIHBwcm9mXG4gICAgLSBiYXNpY2F1dGgvc2VydmVyXG4gIHBpcGVsaW5lczpcbiAgICB0cmFjZXM6XG4gICAgICByZWNlaXZlcnM6IFtvdGxwXVxuICAgICAgcHJvY2Vzc29yczogW3NpZ25venNwYW5tZXRyaWNzL2RlbHRhLCBiYXRjaF1cbiAgICAgIGV4cG9ydGVyczogW2NsaWNraG91c2V0cmFjZXMsIHNpZ25vem1ldGVyLCBtZXRhZGF0YWV4cG9ydGVyXVxuICAgIG1ldHJpY3M6XG4gICAgICByZWNlaXZlcnM6IFtvdGxwXVxuICAgICAgcHJvY2Vzc29yczogW2JhdGNoXVxuICAgICAgZXhwb3J0ZXJzOiBbc2lnbm96Y2xpY2tob3VzZW1ldHJpY3MsIHNpZ25vem1ldGVyLCBtZXRhZGF0YWV4cG9ydGVyXVxuICAgIGxvZ3M6XG4gICAgICByZWNlaXZlcnM6IFtvdGxwXVxuICAgICAgcHJvY2Vzc29yczogW2JhdGNoXVxuICAgICAgZXhwb3J0ZXJzOiBbY2xpY2tob3VzZWxvZ3NleHBvcnRlciwgc2lnbm96bWV0ZXIsIG1ldGFkYXRhZXhwb3J0ZXJdXG4gICAgbWV0cmljcy9tZXRlcjpcbiAgICAgIHJlY2VpdmVyczogW3NpZ25vem1ldGVyXVxuICAgICAgcHJvY2Vzc29yczogW2JhdGNoL21ldGVyXVxuICAgICAgZXhwb3J0ZXJzOiBbc2lnbm96Y2xpY2tob3VzZW1ldGVyXVxuU0lHTk9aX0NGR1xuY2F0ID4gL3RtcC9vcGFtcC1jb25maWcueWFtbCA8PCdTSUdOT1pfT1BBTVAnXG5zZXJ2ZXJfZW5kcG9pbnQ6IHdzOi8vc2lnbm96OjQzMjAvdjEvb3BhbXBcblNJR05PWl9PUEFNUFxuL3NpZ25vei1vdGVsLWNvbGxlY3RvciBtaWdyYXRlIHN5bmMgY2hlY2tcbmV4ZWMgL3NpZ25vei1vdGVsLWNvbGxlY3RvciAtLWNvbmZpZz0vdG1wL290ZWwtY29uZmlnLnlhbWwgLS1tYW5hZ2VyLWNvbmZpZz0vdG1wL29wYW1wLWNvbmZpZy55YW1sIC0tY29weS1wYXRoPS92YXIvdG1wL2NvbGxlY3Rvci1jb25maWcueWFtbFxuIgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX09URUxDT0xMRUNUT1JIVFRQXzQzMTgKICAgICAgLSAnT1RFTF9SRVNPVVJDRV9BVFRSSUJVVEVTPWhvc3QubmFtZT1zaWdub3otaG9zdCxvcy50eXBlPWxpbnV4JwogICAgICAtIExPV19DQVJESU5BTF9FWENFUFRJT05fR1JPVVBJTkc9ZmFsc2UKICAgICAgLSAnU0lHTk9aX09URUxfQ09MTEVDVE9SX0NMSUNLSE9VU0VfRFNOPXRjcDovL2NsaWNraG91c2U6OTAwMCcKICAgICAgLSBTSUdOT1pfT1RFTF9DT0xMRUNUT1JfQ0xJQ0tIT1VTRV9DTFVTVEVSPWNsdXN0ZXIKICAgICAgLSBTSUdOT1pfT1RFTF9DT0xMRUNUT1JfQ0xJQ0tIT1VTRV9SRVBMSUNBVElPTj10cnVlCiAgICAgIC0gU0lHTk9aX09URUxfQ09MTEVDVE9SX1RJTUVPVVQ9MTBtCiAgICAgIC0gJ09URUxfQkFTSUNfQVVUSD1zaWdub3o6JHtTRVJWSUNFX1BBU1NXT1JEXzY0X09URUxBVVRIfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnYmFzaCAtYyAiZXhlYyA2PD4gL2Rldi90Y3AvbG9jYWxob3N0LzEzMTMzIicKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
         "tags": [
             "telemetry",
             "server",
@@ -5113,7 +4332,7 @@
         "category": "monitoring",
         "logo": "svgs/signoz.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-08T19:22:39+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8080"
     },
     "silverbullet": {
@@ -5165,38 +4384,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "5231"
     },
-    "snapdrop": {
-        "documentation": "https://github.com/RobinLinus/snapdrop?utm_source=coolify.io",
-        "slogan": "A self-hosted file-sharing service for secure and convenient file transfers, whether on a local network or the internet.",
-        "compose": "c2VydmljZXM6CiAgc25hcGRyb3A6CiAgICBpbWFnZTogJ2xpbnV4c2VydmVyL3NuYXBkcm9wOnZlcnNpb24tYjhiNzhjYzInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU05BUERST1AKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSBUWj1FdXJvcGUvTWFkcmlkCiAgICB2b2x1bWVzOgogICAgICAtICdzbmFwZHJvcC1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
-        "tags": [
-            "file",
-            "sharing",
-            "transfer",
-            "local",
-            "network",
-            "internet"
-        ],
-        "category": "productivity",
-        "logo": "svgs/default.webp",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "snipe-it": {
-        "documentation": "https://snipe-it.readme.io/docs/introduction?utm_source=coolify.io",
-        "slogan": "Snipe-IT is an open-source asset management platform built for IT departments.",
-        "compose": "c2VydmljZXM6CiAgYXBwOgogICAgaW1hZ2U6ICdzbmlwZS9zbmlwZS1pdDp2OC43LjEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU05JUEVJVF84MAogICAgICAtIEFQUF9FTlY9cHJvZHVjdGlvbgogICAgICAtIEFQUF9ERUJVRz1mYWxzZQogICAgICAtICdBUFBfS0VZPWJhc2U2NDoke1NFUlZJQ0VfUkVBTEJBU0U2NF8zMl9BUFBLRVl9JwogICAgICAtICdBUFBfVVJMPSR7U0VSVklDRV9GUUROX1NOSVBFSVR9JwogICAgICAtICdBUFBfVElNRVpPTkU9JHtBUFBfVElNRVpPTkU6LVVUQ30nCiAgICAgIC0gJ0FQUF9MT0NBTEU9JHtBUFBfTE9DQUxFOi1lbi1VU30nCiAgICAgIC0gREJfQ09OTkVDVElPTj1teXNxbAogICAgICAtIERCX0hPU1Q9bWFyaWFkYgogICAgICAtIERCX1BPUlQ9MzMwNgogICAgICAtICdEQl9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1zbmlwZWl0fScKICAgICAgLSAnREJfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnTUFJTF9NQUlMRVI9JHtNQUlMX01BSUxFUjotc210cH0nCiAgICAgIC0gJ01BSUxfSE9TVD0ke01BSUxfSE9TVDotbnVsbH0nCiAgICAgIC0gJ01BSUxfUE9SVD0ke01BSUxfUE9SVDotMTAyNX0nCiAgICAgIC0gJ01BSUxfVVNFUk5BTUU9JHtNQUlMX1VTRVJOQU1FOi1udWxsfScKICAgICAgLSAnTUFJTF9QQVNTV09SRD0ke01BSUxfUEFTU1dPUkQ6LW51bGx9JwogICAgICAtICdNQUlMX0ZST01fQUREUj0ke01BSUxfRlJPTV9BRERSOi15b3VAZXhhbXBsZS5jb219JwogICAgICAtICdNQUlMX0ZST01fTkFNRT0ke01BSUxfRlJPTV9OQU1FOi1TbmlwZS1JVH0nCiAgICB2b2x1bWVzOgogICAgICAtICdzdG9yYWdlOi92YXIvbGliL3NuaXBlaXQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3QvaGVhbHRoJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAzMHMKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExLjgnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotc25pcGVpdH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICB2b2x1bWVzOgogICAgICAtICdkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMXMKICAgICAgcmV0cmllczogNQo=",
-        "tags": [
-            "inventory",
-            "open-source"
-        ],
-        "category": "productivity",
-        "logo": "svgs/snipe-it.webp",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-08-17T14:08:10+02:00",
-        "port": "80"
-    },
     "soju": {
         "documentation": "https://soju.im/?utm_source=coolify.io",
         "slogan": "A user-friendly IRC bouncer with a modern web interface",
@@ -5214,22 +4401,6 @@
         "template_last_updated_at": "2025-12-09T00:35:53+03:00",
         "port": "80"
     },
-    "soketi-app-manager": {
-        "documentation": "https://github.com/rahulhaque/soketi-app-manager-filament?utm_source=coolify.io",
-        "slogan": "Manage soketi websocket server and apps with ease.",
-        "compose": "c2VydmljZXM6CiAgc29rZXRpLWFwcC1tYW5hZ2VyOgogICAgaW1hZ2U6ICdnaGNyLmlvL3JhaHVsaGFxdWUvc29rZXRpLWFwcC1tYW5hZ2VyLWZpbGFtZW50LWFscGluZTpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU09LRVRJQVBQTUFOQUdFUl84MDgwCiAgICAgIC0gQVVUT1JVTl9FTkFCTEVEPXRydWUKICAgICAgLSAnQVVUT1JVTl9MQVJBVkVMX01JR1JBVElPTj0ke0FVVE9SVU5fTEFSQVZFTF9NSUdSQVRJT046LXRydWV9JwogICAgICAtICdBUFBfREVCVUc9JHtBUFBfREVCVUc6LWZhbHNlfScKICAgICAgLSBBUFBfVVJMPSRTRVJWSUNFX0ZRRE5fU09LRVRJQVBQTUFOQUdFUgogICAgICAtIEFQUF9LRVk9JEFQUF9LRVkKICAgICAgLSBEQl9DT05ORUNUSU9OPSREQl9DT05ORUNUSU9OCiAgICAgIC0gREJfSE9TVD0kREJfSE9TVAogICAgICAtIERCX1BPUlQ9JERCX1BPUlQKICAgICAgLSBEQl9EQVRBQkFTRT0kREJfREFUQUJBU0UKICAgICAgLSBEQl9VU0VSTkFNRT0kREJfVVNFUk5BTUUKICAgICAgLSBEQl9QQVNTV09SRD0kREJfUEFTU1dPUkQKICAgICAgLSBQVVNIRVJfSE9TVD0kUFVTSEVSX0hPU1QKICAgICAgLSBQVVNIRVJfUE9SVD0kUFVTSEVSX1BPUlQKICAgICAgLSBQVVNIRVJfU0NIRU1FPSRQVVNIRVJfU0NIRU1FCiAgICAgIC0gUFVTSEVSX0FQUF9DTFVTVEVSPSRQVVNIRVJfQVBQX0NMVVNURVIKICAgICAgLSBTT0tFVElfREJfUkVESVNfVVNFUk5BTUU9JFNPS0VUSV9EQl9SRURJU19VU0VSTkFNRQogICAgICAtIFNPS0VUSV9EQl9SRURJU19QQVNTV09SRD0kU09LRVRJX0RCX1JFRElTX1BBU1NXT1JECiAgICAgIC0gTUVUUklDU19IT1NUPSRNRVRSSUNTX0hPU1QKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwaHAtZnBtLWhlYWx0aGNoZWNrCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCg==",
-        "tags": [
-            "soketi",
-            "websockets",
-            "app-manager",
-            "dashboard"
-        ],
-        "category": "devtools",
-        "logo": "svgs/soketi-app-manager.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
-        "port": "8080"
-    },
     "soketi": {
         "documentation": "https://docs.soketi.app?utm_source=coolify.io",
         "slogan": "Soketi is your simple, fast, and resilient open-source WebSockets server.",
@@ -5377,7 +4548,7 @@
     "supabase": {
         "documentation": "https://supabase.io?utm_source=coolify.io",
         "slogan": "The open source Firebase alternative.",
-        "compose": "c2VydmljZXM6CiAgc3VwYWJhc2Uta29uZzoKICAgIGltYWdlOiAna29uZy9rb25nOjMuOS4xJwogICAgZW50cnlwb2ludDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGtvbmcKICAgICAgICAtIGhlYWx0aAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1NVUEFCQVNFS09OR184MDAwCiAgICAgIC0gJ0tPTkdfUE9SVF9NQVBTPTQ0Mzo4MDAwJwogICAgICAtICdKV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIEtPTkdfREFUQUJBU0U9b2ZmCiAgICAgIC0gS09OR19ERUNMQVJBVElWRV9DT05GSUc9L3Vzci9sb2NhbC9rb25nL2tvbmcueW1sCiAgICAgIC0gJ0tPTkdfRE5TX09SREVSPUxBU1QsQSxDTkFNRScKICAgICAgLSBLT05HX0ROU19OT1RfRk9VTkRfVFRMPTEKICAgICAgLSAnS09OR19QTFVHSU5TPXJlcXVlc3QtdHJhbnNmb3JtZXIsY29ycyxrZXktYXV0aCxhY2wsYmFzaWMtYXV0aCxyZXF1ZXN0LXRlcm1pbmF0aW9uLGlwLXJlc3RyaWN0aW9uLHBvc3QtZnVuY3Rpb24nCiAgICAgIC0gS09OR19OR0lOWF9QUk9YWV9QUk9YWV9CVUZGRVJfU0laRT0xNjBrCiAgICAgIC0gJ0tPTkdfTkdJTlhfUFJPWFlfUFJPWFlfQlVGRkVSUz02NCAxNjBrJwogICAgICAtICdLT05HX1BST1hZX0FDQ0VTU19MT0c9L2Rldi9zdGRvdXQgY29tYmluZWQnCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFU0VSVklDRV9LRVl9JwogICAgICAtICdTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVk9JHtTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVk6LX0nCiAgICAgIC0gJ1NVUEFCQVNFX1NFQ1JFVF9LRVk9JHtTVVBBQkFTRV9TRUNSRVRfS0VZOi19JwogICAgICAtICdBTk9OX0tFWV9BU1lNTUVUUklDPSR7QU5PTl9LRVlfQVNZTU1FVFJJQzotfScKICAgICAgLSAnU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDPSR7U0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDOi19JwogICAgICAtICdEQVNIQk9BUkRfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdEQVNIQk9BUkRfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnS09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9DT05ORUNUX1RJTUVPVVQ6LTYwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1dSSVRFX1RJTUVPVVQ9JHtLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVDotMzYwMH0nCiAgICAgIC0gJ0tPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVQ9JHtLT05HX1NUT1JBR0VfUkVBRF9USU1FT1VUOi0zNjAwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HPSR7S09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HOi1mYWxzZX0nCiAgICAgIC0gJ0tPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkc9JHtLT05HX1NUT1JBR0VfUkVTUE9OU0VfQlVGRkVSSU5HOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2FwaS9rb25nLWVudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9ob21lL2tvbmcva29uZy1lbnRyeXBvaW50LnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9iYXNoXG4jIEN1c3RvbSBlbnRyeXBvaW50IGZvciBLb25nIHRoYXQgYnVpbGRzIEx1YSBleHByZXNzaW9ucyBmb3IgcmVxdWVzdC10cmFuc2Zvcm1lclxuIyBhbmQgcGVyZm9ybXMgZW52aXJvbm1lbnQgdmFyaWFibGUgc3Vic3RpdHV0aW9uIGluIHRoZSBkZWNsYXJhdGl2ZSBjb25maWcuXG5cbmlmIFsgLW4gXCIkU1VQQUJBU0VfU0VDUkVUX0tFWVwiIF0gJiYgWyAtbiBcIiRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVlcIiBdOyB0aGVuXG4gICAgZXhwb3J0IExVQV9BVVRIX0VYUFI9XCJcXCQoKGhlYWRlcnMuYXV0aG9yaXphdGlvbiB+PSBuaWwgYW5kIGhlYWRlcnMuYXV0aG9yaXphdGlvbjpzdWIoMSwgMTApIH49ICdCZWFyZXIgc2JfJyBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uKSBvciAoaGVhZGVycy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9TRUNSRVRfS0VZJyBhbmQgJ0JlYXJlciAkU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDJykgb3IgKGhlYWRlcnMuYXBpa2V5ID09ICckU1VQQUJBU0VfUFVCTElTSEFCTEVfS0VZJyBhbmQgJ0JlYXJlciAkQU5PTl9LRVlfQVNZTU1FVFJJQycpIG9yIGhlYWRlcnMuYXBpa2V5KVwiXG4gICAgZXhwb3J0IExVQV9SVF9XU19FWFBSPVwiXFwkKChxdWVyeV9wYXJhbXMuYXBpa2V5ID09ICckU1VQQUJBU0VfU0VDUkVUX0tFWScgYW5kICckU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDJykgb3IgKHF1ZXJ5X3BhcmFtcy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVknIGFuZCAnJEFOT05fS0VZX0FTWU1NRVRSSUMnKSBvciBxdWVyeV9wYXJhbXMuYXBpa2V5KVwiXG5lbHNlXG4gICAgZXhwb3J0IExVQV9BVVRIX0VYUFI9XCJcXCQoKGhlYWRlcnMuYXV0aG9yaXphdGlvbiB+PSBuaWwgYW5kIGhlYWRlcnMuYXV0aG9yaXphdGlvbjpzdWIoMSwgMTApIH49ICdCZWFyZXIgc2JfJyBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uKSBvciBoZWFkZXJzLmFwaWtleSlcIlxuICAgIGV4cG9ydCBMVUFfUlRfV1NfRVhQUj1cIlxcJChxdWVyeV9wYXJhbXMuYXBpa2V5KVwiXG5maVxuXG5hd2sgJ3tcbiAgcmVzdWx0ID0gXCJcIlxuICByZXN0ID0gJDBcbiAgd2hpbGUgKG1hdGNoKHJlc3QsIC9cXCRbQS1aYS16X11bQS1aYS16XzAtOV0qLykpIHtcbiAgICB2YXJuYW1lID0gc3Vic3RyKHJlc3QsIFJTVEFSVCArIDEsIFJMRU5HVEggLSAxKVxuICAgIGlmICh2YXJuYW1lIGluIEVOVklST04pIHtcbiAgICAgIHJlc3VsdCA9IHJlc3VsdCBzdWJzdHIocmVzdCwgMSwgUlNUQVJUIC0gMSkgRU5WSVJPTlt2YXJuYW1lXVxuICAgIH0gZWxzZSB7XG4gICAgICByZXN1bHQgPSByZXN1bHQgc3Vic3RyKHJlc3QsIDEsIFJTVEFSVCArIFJMRU5HVEggLSAxKVxuICAgIH1cbiAgICByZXN0ID0gc3Vic3RyKHJlc3QsIFJTVEFSVCArIFJMRU5HVEgpXG4gIH1cbiAgcHJpbnQgcmVzdWx0IHJlc3Rcbn0nIC9ob21lL2tvbmcvdGVtcC55bWwgPiBcIiRLT05HX0RFQ0xBUkFUSVZFX0NPTkZJR1wiXG5cbnNlZCAtaSAnL15bWzpzcGFjZTpdXSotIGtleTpbWzpzcGFjZTpdXSokL2QnIFwiJEtPTkdfREVDTEFSQVRJVkVfQ09ORklHXCJcblxuZXhlYyAvZW50cnlwb2ludC5zaCBrb25nIGRvY2tlci1zdGFydFxuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2FwaS9rb25nLnltbAogICAgICAgIHRhcmdldDogL2hvbWUva29uZy90ZW1wLnltbAogICAgICAgIGNvbnRlbnQ6ICJfZm9ybWF0X3ZlcnNpb246ICcyLjEnXG5fdHJhbnNmb3JtOiB0cnVlXG5cbiMjI1xuIyMjIENvbnN1bWVycyAvIFVzZXJzXG4jIyNcbmNvbnN1bWVyczpcbiAgLSB1c2VybmFtZTogREFTSEJPQVJEXG4gIC0gdXNlcm5hbWU6IGFub25cbiAgICBrZXlhdXRoX2NyZWRlbnRpYWxzOlxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9BTk9OX0tFWVxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVlcbiAgLSB1c2VybmFtZTogc2VydmljZV9yb2xlXG4gICAga2V5YXV0aF9jcmVkZW50aWFsczpcbiAgICAgIC0ga2V5OiAkU1VQQUJBU0VfU0VSVklDRV9LRVlcbiAgICAgIC0ga2V5OiAkU1VQQUJBU0VfU0VDUkVUX0tFWVxuXG4jIyNcbiMjIyBBY2Nlc3MgQ29udHJvbCBMaXN0XG4jIyNcbmFjbHM6XG4gIC0gY29uc3VtZXI6IGFub25cbiAgICBncm91cDogYW5vblxuICAtIGNvbnN1bWVyOiBzZXJ2aWNlX3JvbGVcbiAgICBncm91cDogYWRtaW5cblxuIyMjXG4jIyMgRGFzaGJvYXJkIGNyZWRlbnRpYWxzXG4jIyNcbmJhc2ljYXV0aF9jcmVkZW50aWFsczpcbi0gY29uc3VtZXI6IERBU0hCT0FSRFxuICB1c2VybmFtZTogJyREQVNIQk9BUkRfVVNFUk5BTUUnXG4gIHBhc3N3b3JkOiAnJERBU0hCT0FSRF9QQVNTV09SRCdcblxuXG4jIyNcbiMjIyBBUEkgUm91dGVzXG4jIyNcbnNlcnZpY2VzOlxuXG4gICMjIE9wZW4gQXV0aCByb3V0ZXNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW5cbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvdmVyaWZ5XG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW5cbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL3ZlcmlmeVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tY2FsbGJhY2tcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvY2FsbGJhY2tcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1jYWxsYmFja1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvY2FsbGJhY2tcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gIC0gbmFtZTogYXV0aC12MS1vcGVuLWF1dGhvcml6ZVxuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9hdXRob3JpemVcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1hdXRob3JpemVcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL2F1dGhvcml6ZVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tandrc1xuICAgIF9jb21tZW50OiAnQXV0aDogL2F1dGgvdjEvLndlbGwta25vd24vandrcy5qc29uIC0+IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvLndlbGwta25vd24vandrcy5qc29uJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9qd2tzLmpzb25cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1qd2tzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS8ud2VsbC1rbm93bi9qd2tzLmpzb25cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLWFjc1xuICAgIHVybDogXCJodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L3Nzby9zYW1sL2Fjc1wiXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLWFjc1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAtIC9zc28vc2FtbC9hY3NcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLW1ldGFkYXRhXG4gICAgdXJsOiBcImh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvc3NvL3NhbWwvbWV0YWRhdGFcIlxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLXNzby1tZXRhZGF0YVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAtIC9zc28vc2FtbC9tZXRhZGF0YVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBTZWN1cmUgQXV0aCByb3V0ZXNcbiAgLSBuYW1lOiBhdXRoLXYxXG4gICAgX2NvbW1lbnQ6ICdHb1RydWU6IC9hdXRoL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8qJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU2VjdXJlIFJFU1Qgcm91dGVzXG4gIC0gbmFtZTogcmVzdC12MVxuICAgIF9jb21tZW50OiAnUG9zdGdSRVNUOiAvcmVzdC92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiByZXN0LXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3Jlc3QvdjEvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgICAgICByZXBsYWNlOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuXG4gICMjIFNlY3VyZSBHcmFwaFFMIHJvdXRlc1xuICAtIG5hbWU6IGdyYXBocWwtdjFcbiAgICBfY29tbWVudDogJ1Bvc3RnUkVTVDogL2dyYXBocWwvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2UtcmVzdDozMDAwL3JwYy9ncmFwaHFsJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC9ycGMvZ3JhcGhxbFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogZ3JhcGhxbC12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9ncmFwaHFsL3YxXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkNvbnRlbnQtUHJvZmlsZTogZ3JhcGhxbF9wdWJsaWNcIlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQ29udGVudC1Qcm9maWxlOiBncmFwaHFsX3B1YmxpY1wiXG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTZWN1cmUgUmVhbHRpbWUgcm91dGVzXG4gIC0gbmFtZTogcmVhbHRpbWUtdjEtd3NcbiAgICBfY29tbWVudDogJ1JlYWx0aW1lOiAvcmVhbHRpbWUvdjEvKiAtPiB3czovL3JlYWx0aW1lOjQwMDAvc29ja2V0LyonXG4gICAgdXJsOiBodHRwOi8vcmVhbHRpbWUtZGV2OjQwMDAvc29ja2V0XG4gICAgcHJvdG9jb2w6IHdzXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiByZWFsdGltZS12MS13c1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3JlYWx0aW1lL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIHF1ZXJ5c3RyaW5nOlxuICAgICAgICAgICAgICAtIFwiYXBpa2V5OiAkTFVBX1JUX1dTX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBxdWVyeXN0cmluZzpcbiAgICAgICAgICAgICAgLSBcImFwaWtleTogJExVQV9SVF9XU19FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuICAtIG5hbWU6IHJlYWx0aW1lLXYxLXJlc3RcbiAgICBfY29tbWVudDogJ1JlYWx0aW1lOiAvcmVhbHRpbWUvdjEvYXBpLyogLT4gaHR0cDovL3JlYWx0aW1lOjQwMDAvYXBpLyonXG4gICAgdXJsOiBodHRwOi8vcmVhbHRpbWUtZGV2OjQwMDAvYXBpXG4gICAgcHJvdG9jb2w6IGh0dHBcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlYWx0aW1lLXYxLXJlc3RcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9yZWFsdGltZS92MS9hcGlcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU3RvcmFnZSBBUEkgZW5kcG9pbnRcbiAgIyMgTm8ga2V5LWF1dGggLSBTMyBwcm90b2NvbCByZXF1ZXN0cyBkb24ndCBjYXJyeSBhbiBhcGlrZXkgaGVhZGVyLlxuICAtIG5hbWU6IHN0b3JhZ2UtdjFcbiAgICBfY29tbWVudDogJ1N0b3JhZ2U6IC9zdG9yYWdlL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLXN0b3JhZ2U6NTAwMC8qJ1xuICAgIGNvbm5lY3RfdGltZW91dDogJEtPTkdfU1RPUkFHRV9DT05ORUNUX1RJTUVPVVRcbiAgICB3cml0ZV90aW1lb3V0OiAkS09OR19TVE9SQUdFX1dSSVRFX1RJTUVPVVRcbiAgICByZWFkX3RpbWVvdXQ6ICRLT05HX1NUT1JBR0VfUkVBRF9USU1FT1VUXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3RvcmFnZTo1MDAwL1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogc3RvcmFnZS12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9zdG9yYWdlL3YxL1xuICAgICAgICByZXF1ZXN0X2J1ZmZlcmluZzogJEtPTkdfU1RPUkFHRV9SRVFVRVNUX0JVRkZFUklOR1xuICAgICAgICByZXNwb25zZV9idWZmZXJpbmc6ICRLT05HX1NUT1JBR0VfUkVTUE9OU0VfQlVGRkVSSU5HXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBwb3N0LWZ1bmN0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhY2Nlc3M6XG4gICAgICAgICAgICAtIHxcbiAgICAgICAgICAgICAgbG9jYWwgYXV0aCA9IGtvbmcucmVxdWVzdC5nZXRfaGVhZGVyKFwiYXV0aG9yaXphdGlvblwiKVxuICAgICAgICAgICAgICBpZiBhdXRoID09IG5pbCBvciBhdXRoID09IFwiXCIgb3IgYXV0aDpmaW5kKFwiXiVzKiRcIikgdGhlblxuICAgICAgICAgICAgICAgIGtvbmcuc2VydmljZS5yZXF1ZXN0LmNsZWFyX2hlYWRlcihcImF1dGhvcml6YXRpb25cIilcbiAgICAgICAgICAgICAgZW5kXG5cbiAgIyMgRWRnZSBGdW5jdGlvbnMgcm91dGVzXG4gIC0gbmFtZTogZnVuY3Rpb25zLXYxXG4gICAgX2NvbW1lbnQ6ICdFZGdlIEZ1bmN0aW9uczogL2Z1bmN0aW9ucy92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczo5MDAwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtZWRnZS1mdW5jdGlvbnM6OTAwMC9cbiAgICByZWFkX3RpbWVvdXQ6IDE1MDAwMFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogZnVuY3Rpb25zLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2Z1bmN0aW9ucy92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgIyMgT0F1dGggMi4wIEF1dGhvcml6YXRpb24gU2VydmVyIE1ldGFkYXRhIChSRkMgODQxNClcbiAgLSBuYW1lOiB3ZWxsLWtub3duLW9hdXRoXG4gICAgX2NvbW1lbnQ6ICdBdXRoOiAvLndlbGwta25vd24vb2F1dGgtYXV0aG9yaXphdGlvbi1zZXJ2ZXIgLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlcidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvLndlbGwta25vd24vb2F1dGgtYXV0aG9yaXphdGlvbi1zZXJ2ZXJcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHdlbGwta25vd24tb2F1dGhcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlclxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBBbmFseXRpY3Mgcm91dGVzXG4gICMjIE5vdCB1c2VkIC0gU3R1ZGlvIGFuZCBWZWN0b3IgdGFsayBkaXJlY3RseSB0byBhbmFseXRpY3MgdmlhIERvY2tlciBuZXR3b3JraW5nLlxuICAjIC0gbmFtZTogYW5hbHl0aWNzLXYxXG4gICMgICBfY29tbWVudDogJ0FuYWx5dGljczogL2FuYWx5dGljcy92MS8qIC0+IGh0dHA6Ly9sb2dmbGFyZTo0MDAwLyonXG4gICMgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9cbiAgIyAgIHJvdXRlczpcbiAgIyAgICAgLSBuYW1lOiBhbmFseXRpY3MtdjEtYWxsXG4gICMgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAjICAgICAgIHBhdGhzOlxuICAjICAgICAgICAgLSAvYW5hbHl0aWNzL3YxL1xuXG4gICMjIFNlY3VyZSBEYXRhYmFzZSByb3V0ZXNcbiAgLSBuYW1lOiBtZXRhXG4gICAgX2NvbW1lbnQ6ICdwZy1tZXRhOiAvcGcvKiAtPiBodHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwL1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogbWV0YS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9wZy9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cblxuICAjIyBCbG9jayBhY2Nlc3MgdG8gL2FwaS9tY3BcbiAgLSBuYW1lOiBtY3AtYmxvY2tlclxuICAgIF9jb21tZW50OiAnQmxvY2sgZGlyZWN0IGFjY2VzcyB0byAvYXBpL21jcCdcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9hcGkvbWNwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtY3AtYmxvY2tlci1yb3V0ZVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2FwaS9tY3BcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRlcm1pbmF0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBzdGF0dXNfY29kZTogNDAzXG4gICAgICAgICAgbWVzc2FnZTogXCJBY2Nlc3MgaXMgZm9yYmlkZGVuLlwiXG5cbiAgIyMgTUNQIGVuZHBvaW50IC0gbG9jYWwgYWNjZXNzXG4gIC0gbmFtZTogbWNwXG4gICAgX2NvbW1lbnQ6ICdNQ1A6IC9tY3AgLT4gaHR0cDovL3N1cGFiYXNlLXN0dWRpbzozMDAwL2FwaS9tY3AgKGxvY2FsIGFjY2VzcyknXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvYXBpL21jcFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogbWNwXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvbWNwXG4gICAgcGx1Z2luczpcbiAgICAgICMgQmxvY2sgYWNjZXNzIHRvIC9tY3AgYnkgZGVmYXVsdFxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRlcm1pbmF0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBzdGF0dXNfY29kZTogNDAzXG4gICAgICAgICAgbWVzc2FnZTogXCJBY2Nlc3MgaXMgZm9yYmlkZGVuLlwiXG4gICAgICAjIEVuYWJsZSBsb2NhbCBhY2Nlc3MgKGRhbmdlciB6b25lISlcbiAgICAgICMgMS4gQ29tbWVudCBvdXQgdGhlICdyZXF1ZXN0LXRlcm1pbmF0aW9uJyBzZWN0aW9uIGFib3ZlXG4gICAgICAjIDIuIFVuY29tbWVudCB0aGUgZW50aXJlIHNlY3Rpb24gYmVsb3csIGluY2x1ZGluZyAnZGVueSdcbiAgICAgICMgMy4gQWRkIHlvdXIgbG9jYWwgSVBzIHRvIHRoZSAnYWxsb3cnIGxpc3RcbiAgICAgICMtIG5hbWU6IGNvcnNcbiAgICAgICMtIG5hbWU6IGlwLXJlc3RyaWN0aW9uXG4gICAgICAjICBjb25maWc6XG4gICAgICAjICAgIGFsbG93OlxuICAgICAgIyAgICAgIC0gMTI3LjAuMC4xXG4gICAgICAjICAgICAgLSA6OjFcbiAgICAgICMgICAgZGVueTogW11cblxuICAjIyBQcm90ZWN0ZWQgRGFzaGJvYXJkIC0gY2F0Y2ggYWxsIHJlbWFpbmluZyByb3V0ZXNcbiAgLSBuYW1lOiBkYXNoYm9hcmRcbiAgICBfY29tbWVudDogJ1N0dWRpbzogLyogLT4gaHR0cDovL3N0dWRpbzozMDAwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBkYXNoYm9hcmQtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBiYXNpYy1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiB0cnVlXG4iCiAgc3VwYWJhc2Utc3R1ZGlvOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdHVkaW86MjAyNi4wMy4xNi1zaGEtNTUyODgxNycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAiZmV0Y2goJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMC9hcGkvcGxhdGZvcm0vcHJvZmlsZScpLnRoZW4oKHIpID0+IHtpZiAoci5zdGF0dXMgIT09IDIwMCkgdGhyb3cgbmV3IEVycm9yKHIuc3RhdHVzKX0pIgogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBIT1NUTkFNRT0wLjAuMC4wCiAgICAgIC0gJ1NUVURJT19QR19NRVRBX1VSTD1odHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwJwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19IT1NUPSR7UE9TVEdSRVNfSE9TVDotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnUEdSU1RfREJfU0NIRU1BUz0ke1BHUlNUX0RCX1NDSEVNQVM6LXB1YmxpYyxzdG9yYWdlLGdyYXBocWxfcHVibGljfScKICAgICAgLSAnUEdSU1RfREJfTUFYX1JPV1M9JHtQR1JTVF9EQl9NQVhfUk9XUzotMTAwMH0nCiAgICAgIC0gJ1BHUlNUX0RCX0VYVFJBX1NFQVJDSF9QQVRIPSR7UEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg6LXB1YmxpY30nCiAgICAgIC0gJ0RFRkFVTFRfT1JHQU5JWkFUSU9OX05BTUU9JHtTVFVESU9fREVGQVVMVF9PUkdBTklaQVRJT046LURlZmF1bHQgT3JnYW5pemF0aW9ufScKICAgICAgLSAnREVGQVVMVF9QUk9KRUNUX05BTUU9JHtTVFVESU9fREVGQVVMVF9QUk9KRUNUOi1EZWZhdWx0IFByb2plY3R9JwogICAgICAtICdTVVBBQkFTRV9VUkw9aHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMCcKICAgICAgLSAnU1VQQUJBU0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9JwogICAgICAtICdTVVBBQkFTRV9BTk9OX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VBTk9OX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX1NFUlZJQ0VfS0VZPSR7U0VSVklDRV9TVVBBQkFTRVNFUlZJQ0VfS0VZfScKICAgICAgLSAnQVVUSF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdQR19NRVRBX0NSWVBUT19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1BHTUVUQUNSWVBUT30nCiAgICAgIC0gJ0xPR0ZMQVJFX0FQSV9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFfScKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgICAtICdMT0dGTEFSRV9QUklWQVRFX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkVQUklWQVRFfScKICAgICAgLSAnTE9HRkxBUkVfVVJMPWh0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMCcKICAgICAgLSAnTkVYVF9QVUJMSUNfU1VQQUJBU0VfVVJMPSR7U0VSVklDRV9GUUROX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSBORVhUX1BVQkxJQ19FTkFCTEVfTE9HUz10cnVlCiAgICAgIC0gTkVYVF9BTkFMWVRJQ1NfQkFDS0VORF9QUk9WSURFUj1wb3N0Z3JlcwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSBTTklQUEVUU19NQU5BR0VNRU5UX0ZPTERFUj0vYXBwL3NuaXBwZXRzCiAgICAgIC0gRURHRV9GVU5DVElPTlNfTUFOQUdFTUVOVF9GT0xERVI9L2FwcC9lZGdlLWZ1bmN0aW9ucwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3NuaXBwZXRzOi9hcHAvc25pcHBldHMnCiAgICAgIC0gJy4vdm9sdW1lcy9mdW5jdGlvbnM6L2FwcC9lZGdlLWZ1bmN0aW9ucycKICBzdXBhYmFzZS1kYjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXM6MTUuOC4xLjA4NScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncGdfaXNyZWFkeSAtVSBwb3N0Z3JlcyAtaCAxMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtdmVjdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBjb21tYW5kOgogICAgICAtIHBvc3RncmVzCiAgICAgIC0gJy1jJwogICAgICAtIGNvbmZpZ19maWxlPS9ldGMvcG9zdGdyZXNxbC9wb3N0Z3Jlc3FsLmNvbmYKICAgICAgLSAnLWMnCiAgICAgIC0gbG9nX21pbl9tZXNzYWdlcz1mYXRhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSE9TVD0vdmFyL3J1bi9wb3N0Z3Jlc3FsCiAgICAgIC0gJ1BHUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUEdEQVRBQkFTRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwYWJhc2UtZGItZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvcmVhbHRpbWUuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85OS1yZWFsdGltZS5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxuY3JlYXRlIHNjaGVtYSBpZiBub3QgZXhpc3RzIF9yZWFsdGltZTtcbmFsdGVyIHNjaGVtYSBfcmVhbHRpbWUgb3duZXIgdG8gOnBndXNlcjtcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9kYi9fc3VwYWJhc2Uuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85Ny1fc3VwYWJhc2Uuc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cbkNSRUFURSBEQVRBQkFTRSBfc3VwYWJhc2UgV0lUSCBPV05FUiA6cGd1c2VyO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3Bvb2xlci5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LXBvb2xlci5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxcYyBfc3VwYWJhc2VcbmNyZWF0ZSBzY2hlbWEgaWYgbm90IGV4aXN0cyBfc3VwYXZpc29yO1xuYWx0ZXIgc2NoZW1hIF9zdXBhdmlzb3Igb3duZXIgdG8gOnBndXNlcjtcblxcYyBwb3N0Z3Jlc1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3dlYmhvb2tzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OC13ZWJob29rcy5zcWwKICAgICAgICBjb250ZW50OiAiQkVHSU47XG4tLSBDcmVhdGUgcGdfbmV0IGV4dGVuc2lvblxuQ1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHBnX25ldCBTQ0hFTUEgZXh0ZW5zaW9ucztcbi0tIENyZWF0ZSBzdXBhYmFzZV9mdW5jdGlvbnMgc2NoZW1hXG5DUkVBVEUgU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBBVVRIT1JJWkFUSU9OIHN1cGFiYXNlX2FkbWluO1xuR1JBTlQgVVNBR0UgT04gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFRBQkxFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIEZVTkNUSU9OUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFNFUVVFTkNFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLm1pZ3JhdGlvbnMgZGVmaW5pdGlvblxuQ1JFQVRFIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5taWdyYXRpb25zIChcbiAgdmVyc2lvbiB0ZXh0IFBSSU1BUlkgS0VZLFxuICBpbnNlcnRlZF9hdCB0aW1lc3RhbXB0eiBOT1QgTlVMTCBERUZBVUxUIE5PVygpXG4pO1xuLS0gSW5pdGlhbCBzdXBhYmFzZV9mdW5jdGlvbnMgbWlncmF0aW9uXG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnaW5pdGlhbCcpO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLmhvb2tzIGRlZmluaXRpb25cbkNSRUFURSBUQUJMRSBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgKFxuICBpZCBiaWdzZXJpYWwgUFJJTUFSWSBLRVksXG4gIGhvb2tfdGFibGVfaWQgaW50ZWdlciBOT1QgTlVMTCxcbiAgaG9va19uYW1lIHRleHQgTk9UIE5VTEwsXG4gIGNyZWF0ZWRfYXQgdGltZXN0YW1wdHogTk9UIE5VTEwgREVGQVVMVCBOT1coKSxcbiAgcmVxdWVzdF9pZCBiaWdpbnRcbik7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX3JlcXVlc3RfaWRfaWR4IE9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBVU0lORyBidHJlZSAocmVxdWVzdF9pZCk7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX2hfdGFibGVfaWRfaF9uYW1lX2lkeCBPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgVVNJTkcgYnRyZWUgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSk7XG5DT01NRU5UIE9OIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBJUyAnU3VwYWJhc2UgRnVuY3Rpb25zIEhvb2tzOiBBdWRpdCB0cmFpbCBmb3IgdHJpZ2dlcmVkIGhvb2tzLic7XG5DUkVBVEUgRlVOQ1RJT04gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpXG4gIFJFVFVSTlMgdHJpZ2dlclxuICBMQU5HVUFHRSBwbHBnc3FsXG4gIEFTICRmdW5jdGlvbiRcbiAgREVDTEFSRVxuICAgIHJlcXVlc3RfaWQgYmlnaW50O1xuICAgIHBheWxvYWQganNvbmI7XG4gICAgdXJsIHRleHQgOj0gVEdfQVJHVlswXTo6dGV4dDtcbiAgICBtZXRob2QgdGV4dCA6PSBUR19BUkdWWzFdOjp0ZXh0O1xuICAgIGhlYWRlcnMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICBwYXJhbXMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICB0aW1lb3V0X21zIGludGVnZXIgREVGQVVMVCAxMDAwO1xuICBCRUdJTlxuICAgIElGIHVybCBJUyBOVUxMIE9SIHVybCA9ICdudWxsJyBUSEVOXG4gICAgICBSQUlTRSBFWENFUFRJT04gJ3VybCBhcmd1bWVudCBpcyBtaXNzaW5nJztcbiAgICBFTkQgSUY7XG5cbiAgICBJRiBtZXRob2QgSVMgTlVMTCBPUiBtZXRob2QgPSAnbnVsbCcgVEhFTlxuICAgICAgUkFJU0UgRVhDRVBUSU9OICdtZXRob2QgYXJndW1lbnQgaXMgbWlzc2luZyc7XG4gICAgRU5EIElGO1xuXG4gICAgSUYgVEdfQVJHVlsyXSBJUyBOVUxMIE9SIFRHX0FSR1ZbMl0gPSAnbnVsbCcgVEhFTlxuICAgICAgaGVhZGVycyA9ICd7XCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCJ9Jzo6anNvbmI7XG4gICAgRUxTRVxuICAgICAgaGVhZGVycyA9IFRHX0FSR1ZbMl06Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbM10gSVMgTlVMTCBPUiBUR19BUkdWWzNdID0gJ251bGwnIFRIRU5cbiAgICAgIHBhcmFtcyA9ICd7fSc6Ompzb25iO1xuICAgIEVMU0VcbiAgICAgIHBhcmFtcyA9IFRHX0FSR1ZbM106Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbNF0gSVMgTlVMTCBPUiBUR19BUkdWWzRdID0gJ251bGwnIFRIRU5cbiAgICAgIHRpbWVvdXRfbXMgPSAxMDAwO1xuICAgIEVMU0VcbiAgICAgIHRpbWVvdXRfbXMgPSBUR19BUkdWWzRdOjppbnRlZ2VyO1xuICAgIEVORCBJRjtcblxuICAgIENBU0VcbiAgICAgIFdIRU4gbWV0aG9kID0gJ0dFVCcgVEhFTlxuICAgICAgICBTRUxFQ1QgaHR0cF9nZXQgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfZ2V0KFxuICAgICAgICAgIHVybCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBXSEVOIG1ldGhvZCA9ICdQT1NUJyBUSEVOXG4gICAgICAgIHBheWxvYWQgPSBqc29uYl9idWlsZF9vYmplY3QoXG4gICAgICAgICAgJ29sZF9yZWNvcmQnLCBPTEQsXG4gICAgICAgICAgJ3JlY29yZCcsIE5FVyxcbiAgICAgICAgICAndHlwZScsIFRHX09QLFxuICAgICAgICAgICd0YWJsZScsIFRHX1RBQkxFX05BTUUsXG4gICAgICAgICAgJ3NjaGVtYScsIFRHX1RBQkxFX1NDSEVNQVxuICAgICAgICApO1xuXG4gICAgICAgIFNFTEVDVCBodHRwX3Bvc3QgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfcG9zdChcbiAgICAgICAgICB1cmwsXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBFTFNFXG4gICAgICAgIFJBSVNFIEVYQ0VQVElPTiAnbWV0aG9kIGFyZ3VtZW50ICUgaXMgaW52YWxpZCcsIG1ldGhvZDtcbiAgICBFTkQgQ0FTRTtcblxuICAgIElOU0VSVCBJTlRPIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rc1xuICAgICAgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSwgcmVxdWVzdF9pZClcbiAgICBWQUxVRVNcbiAgICAgIChUR19SRUxJRCwgVEdfTkFNRSwgcmVxdWVzdF9pZCk7XG5cbiAgICBSRVRVUk4gTkVXO1xuICBFTkRcbiRmdW5jdGlvbiQ7XG4tLSBTdXBhYmFzZSBzdXBlciBhZG1pblxuRE9cbiQkXG5CRUdJTlxuICBJRiBOT1QgRVhJU1RTIChcbiAgICBTRUxFQ1QgMVxuICAgIEZST00gcGdfcm9sZXNcbiAgICBXSEVSRSByb2xuYW1lID0gJ3N1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbidcbiAgKVxuICBUSEVOXG4gICAgQ1JFQVRFIFVTRVIgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIE5PSU5IRVJJVCBDUkVBVEVST0xFIExPR0lOIE5PUkVQTElDQVRJT047XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBTQ0hFTUEgc3VwYWJhc2VfZnVuY3Rpb25zIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkdSQU5UIEFMTCBQUklWSUxFR0VTIE9OIEFMTCBUQUJMRVMgSU4gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBBTEwgU0VRVUVOQ0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gU0VUIHNlYXJjaF9wYXRoID0gXCJzdXBhYmFzZV9mdW5jdGlvbnNcIjtcbkFMVEVSIHRhYmxlIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIubWlncmF0aW9ucyBPV05FUiBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5BTFRFUiB0YWJsZSBcInN1cGFiYXNlX2Z1bmN0aW9uc1wiLmhvb2tzIE9XTkVSIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkFMVEVSIGZ1bmN0aW9uIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIuaHR0cF9yZXF1ZXN0KCkgT1dORVIgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuR1JBTlQgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIFRPIHBvc3RncmVzO1xuLS0gUmVtb3ZlIHVudXNlZCBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gcm9sZVxuRE9cbiQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19yb2xlc1xuICAgIFdIRVJFIHJvbG5hbWUgPSAnc3VwYWJhc2VfcGdfbmV0X2FkbWluJ1xuICApXG4gIFRIRU5cbiAgICBSRUFTU0lHTiBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gVE8gc3VwYWJhc2VfYWRtaW47XG4gICAgRFJPUCBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW47XG4gICAgRFJPUCBST0xFIHN1cGFiYXNlX3BnX25ldF9hZG1pbjtcbiAgRU5EIElGO1xuRU5EXG4kJDtcbi0tIHBnX25ldCBncmFudHMgd2hlbiBleHRlbnNpb24gaXMgYWxyZWFkeSBlbmFibGVkXG5ET1xuJCRcbkJFR0lOXG4gIElGIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V4dGVuc2lvblxuICAgIFdIRVJFIGV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG4tLSBFdmVudCB0cmlnZ2VyIGZvciBwZ19uZXRcbkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIGV4dGVuc2lvbnMuZ3JhbnRfcGdfbmV0X2FjY2VzcygpXG5SRVRVUk5TIGV2ZW50X3RyaWdnZXJcbkxBTkdVQUdFIHBscGdzcWxcbkFTICQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19ldmVudF90cmlnZ2VyX2RkbF9jb21tYW5kcygpIEFTIGV2XG4gICAgSk9JTiBwZ19leHRlbnNpb24gQVMgZXh0XG4gICAgT04gZXYub2JqaWQgPSBleHQub2lkXG4gICAgV0hFUkUgZXh0LmV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORDtcbiQkO1xuQ09NTUVOVCBPTiBGVU5DVElPTiBleHRlbnNpb25zLmdyYW50X3BnX25ldF9hY2Nlc3MgSVMgJ0dyYW50cyBhY2Nlc3MgdG8gcGdfbmV0JztcbkRPXG4kJFxuQkVHSU5cbiAgSUYgTk9UIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V2ZW50X3RyaWdnZXJcbiAgICBXSEVSRSBldnRuYW1lID0gJ2lzc3VlX3BnX25ldF9hY2Nlc3MnXG4gICkgVEhFTlxuICAgIENSRUFURSBFVkVOVCBUUklHR0VSIGlzc3VlX3BnX25ldF9hY2Nlc3MgT04gZGRsX2NvbW1hbmRfZW5kIFdIRU4gVEFHIElOICgnQ1JFQVRFIEVYVEVOU0lPTicpXG4gICAgRVhFQ1VURSBQUk9DRURVUkUgZXh0ZW5zaW9ucy5ncmFudF9wZ19uZXRfYWNjZXNzKCk7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnMjAyMTA4MDkxODM0MjNfdXBkYXRlX2dyYW50cycpO1xuQUxURVIgZnVuY3Rpb24gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpIFNFQ1VSSVRZIERFRklORVI7XG5BTFRFUiBmdW5jdGlvbiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgU0VUIHNlYXJjaF9wYXRoID0gc3VwYWJhc2VfZnVuY3Rpb25zO1xuUkVWT0tFIEFMTCBPTiBGVU5DVElPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgRlJPTSBQVUJMSUM7XG5HUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5odHRwX3JlcXVlc3QoKSBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQ09NTUlUO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3JvbGVzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OS1yb2xlcy5zcWwKICAgICAgICBjb250ZW50OiAiLS0gTk9URTogY2hhbmdlIHRvIHlvdXIgb3duIHBhc3N3b3JkcyBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHNcbiBcXHNldCBwZ3Bhc3MgYGVjaG8gXCIkUE9TVEdSRVNfUEFTU1dPUkRcImBcblxuIEFMVEVSIFVTRVIgYXV0aGVudGljYXRvciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHBnYm91bmNlciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHN1cGFiYXNlX2F1dGhfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9zdG9yYWdlX2FkbWluIFdJVEggUEFTU1dPUkQgOidwZ3Bhc3MnO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL2p3dC5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LXNjcmlwdHMvOTktand0LnNxbAogICAgICAgIGNvbnRlbnQ6ICJcXHNldCBqd3Rfc2VjcmV0IGBlY2hvIFwiJEpXVF9TRUNSRVRcImBcblxcc2V0IGp3dF9leHAgYGVjaG8gXCIkSldUX0VYUFwiYFxuXFxzZXQgZGJfbmFtZSBgZWNobyBcIiR7UE9TVEdSRVNfREI6LXBvc3RncmVzfVwiYFxuXG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X3NlY3JldFwiIFRPIDonand0X3NlY3JldCc7XG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X2V4cFwiIFRPIDonand0X2V4cCc7XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvbG9ncy5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LWxvZ3Muc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cXGMgX3N1cGFiYXNlXG5jcmVhdGUgc2NoZW1hIGlmIG5vdCBleGlzdHMgX2FuYWx5dGljcztcbmFsdGVyIHNjaGVtYSBfYW5hbHl0aWNzIG93bmVyIHRvIDpwZ3VzZXI7XG5cXGMgcG9zdGdyZXNcbiIKICAgICAgLSAnc3VwYWJhc2UtZGItY29uZmlnOi9ldGMvcG9zdGdyZXNxbC1jdXN0b20nCiAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9sb2dmbGFyZToxLjMxLjInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIExPR0ZMQVJFX05PREVfSE9TVD0xMjcuMC4wLjEKICAgICAgLSBEQl9VU0VSTkFNRT1zdXBhYmFzZV9hZG1pbgogICAgICAtIERCX0RBVEFCQVNFPV9zdXBhYmFzZQogICAgICAtICdEQl9IT1NUTkFNRT0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBEQl9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BSSVZBVEVfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRVBSSVZBVEV9JwogICAgICAtIExPR0ZMQVJFX1NJTkdMRV9URU5BTlQ9dHJ1ZQogICAgICAtIExPR0ZMQVJFX1NVUEFCQVNFX01PREU9dHJ1ZQogICAgICAtICdQT1NUR1JFU19CQUNLRU5EX1VSTD1wb3N0Z3Jlc3FsOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gUE9TVEdSRVNfQkFDS0VORF9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtIExPR0ZMQVJFX0ZFQVRVUkVfRkxBR19PVkVSUklERT1tdWx0aWJhY2tlbmQ9dHJ1ZQogIHN1cGFiYXNlLXZlY3RvcjoKICAgIGltYWdlOiAndGltYmVyaW8vdmVjdG9yOjAuNTMuMC1hbHBpbmUnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovL3N1cGFiYXNlLXZlY3Rvcjo5MDAxL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvbG9ncy92ZWN0b3IueW1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogImFwaTpcbiAgZW5hYmxlZDogdHJ1ZVxuICBhZGRyZXNzOiAwLjAuMC4wOjkwMDFcblxuc291cmNlczpcbiAgZG9ja2VyX2hvc3Q6XG4gICAgdHlwZTogZG9ja2VyX2xvZ3NcbiAgICBleGNsdWRlX2NvbnRhaW5lcnM6XG4gICAgICAtIHN1cGFiYXNlLXZlY3RvclxuXG50cmFuc2Zvcm1zOlxuICBwcm9qZWN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIGRvY2tlcl9ob3N0XG4gICAgc291cmNlOiB8LVxuICAgICAgLnByb2plY3QgPSBcImRlZmF1bHRcIlxuICAgICAgLmV2ZW50X21lc3NhZ2UgPSBkZWwoLm1lc3NhZ2UpXG4gICAgICAuYXBwbmFtZSA9IGRlbCguY29udGFpbmVyX25hbWUpXG4gICAgICBkZWwoLmNvbnRhaW5lcl9jcmVhdGVkX2F0KVxuICAgICAgZGVsKC5jb250YWluZXJfaWQpXG4gICAgICBkZWwoLnNvdXJjZV90eXBlKVxuICAgICAgZGVsKC5zdHJlYW0pXG4gICAgICBkZWwoLmxhYmVsKVxuICAgICAgZGVsKC5pbWFnZSlcbiAgICAgIGRlbCguaG9zdClcbiAgICAgIGRlbCguc3RyZWFtKVxuICByb3V0ZXI6XG4gICAgdHlwZTogcm91dGVcbiAgICBpbnB1dHM6XG4gICAgICAtIHByb2plY3RfbG9nc1xuICAgIHJvdXRlOlxuICAgICAga29uZzogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWtvbmdcIiknXG4gICAgICBhdXRoOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtYXV0aFwiKSdcbiAgICAgIHJlc3Q6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZXN0XCIpJ1xuICAgICAgcmVhbHRpbWU6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJyZWFsdGltZS1kZXZcIiknXG4gICAgICBzdG9yYWdlOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2Utc3RvcmFnZVwiKSdcbiAgICAgIGZ1bmN0aW9uczogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zXCIpJ1xuICAgICAgZGI6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1kYlwiKSdcbiAgIyBJZ25vcmVzIG5vbiBuZ2lueCBlcnJvcnMgc2luY2UgdGhleSBhcmUgcmVsYXRlZCB3aXRoIGtvbmcgYm9vdGluZyB1cFxuICBrb25nX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5rb25nXG4gICAgc291cmNlOiB8LVxuICAgICAgcmVxLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiY29tYmluZWRcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcmVxLnRpbWVzdGFtcFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMucmVmZXJlciA9IHJlcS5yZWZlcmVyXG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy51c2VyX2FnZW50ID0gcmVxLmFnZW50XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5jZl9jb25uZWN0aW5nX2lwID0gcmVxLmNsaWVudFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IHJlcS5zdGF0dXNcbiAgICAgICAgICB1cmwsIHNwbGl0X2VyciA9IHNwbGl0KHJlcS5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBzcGxpdF9lcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIElnbm9yZXMgbm9uIG5naW54IGVycm9ycyBzaW5jZSB0aGV5IGFyZSByZWxhdGVkIHdpdGgga29uZyBib290aW5nIHVwXG4gIGtvbmdfZXJyOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIua29uZ1xuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IFwiR0VUXCJcbiAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IDIwMFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiZXJyb3JcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcGFyc2VkLnRpbWVzdGFtcFxuICAgICAgICAgIC5zZXZlcml0eSA9IHBhcnNlZC5zZXZlcml0eVxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lmhvc3QgPSBwYXJzZWQuaG9zdFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMuY2ZfY29ubmVjdGluZ19pcCA9IHBhcnNlZC5jbGllbnRcbiAgICAgICAgICB1cmwsIGVyciA9IHNwbGl0KHBhcnNlZC5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIEdvdHJ1ZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIGpzb24gc3RyaW5ncyB3aGljaCBmcm9udGVuZCBwYXJzZXMgZGlyZWN0bHkuIEJ1dCB3ZSBrZWVwIG1ldGFkYXRhIGZvciBjb25zaXN0ZW5jeS5cbiAgYXV0aF9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuYXV0aFxuICAgIHNvdXJjZTogfC1cbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEgPSBtZXJnZSEoLm1ldGFkYXRhLCBwYXJzZWQpXG4gICAgICB9XG4gICMgUG9zdGdSRVNUIGxvZ3MgYXJlIHN0cnVjdHVyZWQgc28gd2Ugc2VwYXJhdGUgdGltZXN0YW1wIGZyb20gbWVzc2FnZSB1c2luZyByZWdleFxuICByZXN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5yZXN0XG4gICAgc291cmNlOiB8LVxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcideKD9QPHRpbWU+LiopOiAoP1A8bXNnPi4qKSQnKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5ldmVudF9tZXNzYWdlID0gcGFyc2VkLm1zZ1xuICAgICAgICAgIC50aW1lc3RhbXAgPSBwYXJzZV90aW1lc3RhbXAhKHZhbHVlOiBwYXJzZWQudGltZSwgZm9ybWF0OiBcIiVkLyViLyVZOiVIOiVNOiVTICV6XCIpXG4gICAgICAgICAgLm1ldGFkYXRhLmhvc3QgPSAucHJvamVjdFxuICAgICAgfVxuICAjIEZpbHRlciBvdXQgaGVhbHRoY2hlY2sgbG9ncyBmcm9tIFJlYWx0aW1lXG4gIHJlYWx0aW1lX2xvZ3NfZmlsdGVyZWQ6XG4gICAgdHlwZTogZmlsdGVyXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIucmVhbHRpbWVcbiAgICBjb25kaXRpb246ICchY29udGFpbnMoc3RyaW5nISguZXZlbnRfbWVzc2FnZSksIFwiL2hlYWx0aFwiKSdcbiAgIyBSZWFsdGltZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIHNvIHdlIHBhcnNlIHRoZSBzZXZlcml0eSBsZXZlbCB1c2luZyByZWdleCAoaWdub3JlIHRpbWUgYmVjYXVzZSBpdCBoYXMgbm8gZGF0ZSlcbiAgcmVhbHRpbWVfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcmVhbHRpbWVfbG9nc19maWx0ZXJlZFxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLmV4dGVybmFsX2lkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfcmVnZXgoLmV2ZW50X21lc3NhZ2UsIHInXig/UDx0aW1lPlxcZCs6XFxkKzpcXGQrXFwuXFxkKykgXFxbKD9QPGxldmVsPlxcdyspXFxdICg/UDxtc2c+LiopJCcpXG4gICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgLmV2ZW50X21lc3NhZ2UgPSBwYXJzZWQubXNnXG4gICAgICAgICAgLm1ldGFkYXRhLmxldmVsID0gcGFyc2VkLmxldmVsXG4gICAgICB9XG4gICMgU3RvcmFnZSBsb2dzIG1heSBjb250YWluIGpzb24gb2JqZWN0cyBzbyB3ZSBwYXJzZSB0aGVtIGZvciBjb21wbGV0ZW5lc3NcbiAgc3RvcmFnZV9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuc3RvcmFnZVxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLnRlbmFudElkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAuZXZlbnRfbWVzc2FnZSA9IHBhcnNlZC5tc2dcbiAgICAgICAgICAubWV0YWRhdGEubGV2ZWwgPSBwYXJzZWQubGV2ZWxcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEuY29udGV4dFswXS5ob3N0ID0gcGFyc2VkLmhvc3RuYW1lXG4gICAgICAgICAgLm1ldGFkYXRhLmNvbnRleHRbMF0ucGlkID0gcGFyc2VkLnBpZFxuICAgICAgfVxuICAjIEZ1bmN0aW9uIGxvZ3MgYXJlIHVuc3RydWN0dXJlZCBtZXNzYWdlcyBvbiBzdGRlcnJcbiAgZnVuY3Rpb25zX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5mdW5jdGlvbnNcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEucHJvamVjdF9yZWYgPSBkZWwoLnByb2plY3QpXG4gICMgUG9zdGdyZXMgbG9ncyBzb21lIG1lc3NhZ2VzIHRvIHN0ZGVyciB3aGljaCB3ZSBtYXAgdG8gd2FybmluZyBzZXZlcml0eSBsZXZlbFxuICBkYl9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuZGJcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEuaG9zdCA9IFwiZGItZGVmYXVsdFwiXG4gICAgICAubWV0YWRhdGEucGFyc2VkLnRpbWVzdGFtcCA9IC50aW1lc3RhbXBcblxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcicuKig/UDxsZXZlbD5JTkZPfE5PVElDRXxXQVJOSU5HfEVSUk9SfExPR3xGQVRBTHxQQU5JQz8pOi4qJywgbnVtZXJpY19ncm91cHM6IHRydWUpXG5cbiAgICAgIGlmIGVyciAhPSBudWxsIHx8IHBhcnNlZCA9PSBudWxsIHtcbiAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwiaW5mb1wiXG4gICAgICB9XG4gICAgICBpZiBwYXJzZWQubGV2ZWwgIT0gbnVsbCB7XG4gICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IHBhcnNlZC5sZXZlbFxuICAgICAgfVxuICAgICAgaWYgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9PSBcImluZm9cIiB7XG4gICAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwibG9nXCJcbiAgICAgIH1cbiAgICAgIC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkgPSB1cGNhc2UhKC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkpXG5cbnNpbmtzOlxuICBsb2dmbGFyZV9hdXRoOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gYXV0aF9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1nb3RydWUubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9yZWFsdGltZTpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlYWx0aW1lX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXJlYWx0aW1lLmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfcmVzdDpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlc3RfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9cG9zdGdSRVNULmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfZGI6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBkYl9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1wb3N0Z3Jlcy5sb2dzJ1xuICBsb2dmbGFyZV9mdW5jdGlvbnM6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBmdW5jdGlvbnNfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9ZGVuby1yZWxheS1sb2dzJ1xuICBsb2dmbGFyZV9zdG9yYWdlOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gc3RvcmFnZV9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1zdG9yYWdlLmxvZ3MucHJvZC4yJ1xuICBsb2dmbGFyZV9rb25nOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0ga29uZ19sb2dzXG4gICAgICAtIGtvbmdfZXJyXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1jbG91ZGZsYXJlLmxvZ3MucHJvZCdcbiIKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2s6cm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jb25maWcnCiAgICAgIC0gL2V0Yy92ZWN0b3IvdmVjdG9yLnltbAogIHN1cGFiYXNlLXJlc3Q6CiAgICBpbWFnZTogJ3Bvc3RncmVzdC9wb3N0Z3Jlc3Q6djE0LjYnCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQR1JTVF9EQl9VUkk9cG9zdGdyZXM6Ly9hdXRoZW50aWNhdG9yOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSBQR1JTVF9EQl9BTk9OX1JPTEU9YW5vbgogICAgICAtICdQR1JTVF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIFBHUlNUX0RCX1VTRV9MRUdBQ1lfR1VDUz1mYWxzZQogICAgICAtICdQR1JTVF9BUFBfU0VUVElOR1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdSU1RfQVBQX1NFVFRJTkdTX0pXVF9FWFA9JHtKV1RfRVhQSVJZOi0zNjAwfScKICAgIGNvbW1hbmQ6IHBvc3RncmVzdAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgc3VwYWJhc2UtYXV0aDoKICAgIGltYWdlOiAnc3VwYWJhc2UvZ290cnVlOnYyLjE4Ni4wJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo5OTk5L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIEdPVFJVRV9BUElfSE9TVD0wLjAuMC4wCiAgICAgIC0gR09UUlVFX0FQSV9QT1JUPTk5OTkKICAgICAgLSAnQVBJX0VYVEVSTkFMX1VSTD0ke0FQSV9FWFRFUk5BTF9VUkw6LWh0dHA6Ly9zdXBhYmFzZS1rb25nOjgwMDB9JwogICAgICAtIEdPVFJVRV9EQl9EUklWRVI9cG9zdGdyZXMKICAgICAgLSAnR09UUlVFX0RCX0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovL3N1cGFiYXNlX2F1dGhfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0dPVFJVRV9TSVRFX1VSTD0ke0dPVFJVRV9TSVRFX1VSTDotJHtTRVJWSUNFX0ZRRE5fU1VQQUJBU0VLT05HfX0nCiAgICAgIC0gJ0dPVFJVRV9VUklfQUxMT1dfTElTVD0ke0FERElUSU9OQUxfUkVESVJFQ1RfVVJMU30nCiAgICAgIC0gJ0dPVFJVRV9ESVNBQkxFX1NJR05VUD0ke0RJU0FCTEVfU0lHTlVQOi1mYWxzZX0nCiAgICAgIC0gR09UUlVFX0pXVF9BRE1JTl9ST0xFUz1zZXJ2aWNlX3JvbGUKICAgICAgLSBHT1RSVUVfSldUX0FVRD1hdXRoZW50aWNhdGVkCiAgICAgIC0gR09UUlVFX0pXVF9ERUZBVUxUX0dST1VQX05BTUU9YXV0aGVudGljYXRlZAogICAgICAtICdHT1RSVUVfSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgICAtICdHT1RSVUVfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnR09UUlVFX0VYVEVSTkFMX0VNQUlMX0VOQUJMRUQ9JHtFTkFCTEVfRU1BSUxfU0lHTlVQOi10cnVlfScKICAgICAgLSAnR09UUlVFX0VYVEVSTkFMX0FOT05ZTU9VU19VU0VSU19FTkFCTEVEPSR7RU5BQkxFX0FOT05ZTU9VU19VU0VSUzotZmFsc2V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX0FVVE9DT05GSVJNPSR7RU5BQkxFX0VNQUlMX0FVVE9DT05GSVJNOi1mYWxzZX0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX0FETUlOX0VNQUlMPSR7U01UUF9BRE1JTl9FTUFJTH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX0hPU1Q9JHtTTVRQX0hPU1R9JwogICAgICAtICdHT1RSVUVfU01UUF9QT1JUPSR7U01UUF9QT1JUOi01ODd9JwogICAgICAtICdHT1RSVUVfU01UUF9VU0VSPSR7U01UUF9VU0VSfScKICAgICAgLSAnR09UUlVFX1NNVFBfUEFTUz0ke1NNVFBfUEFTU30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1NFTkRFUl9OQU1FPSR7U01UUF9TRU5ERVJfTkFNRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfSU5WSVRFPSR7TUFJTEVSX1VSTFBBVEhTX0lOVklURTotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19DT05GSVJNQVRJT049JHtNQUlMRVJfVVJMUEFUSFNfQ09ORklSTUFUSU9OOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX1JFQ09WRVJZPSR7TUFJTEVSX1VSTFBBVEhTX1JFQ09WRVJZOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0VNQUlMX0NIQU5HRT0ke01BSUxFUl9VUkxQQVRIU19FTUFJTF9DSEFOR0U6LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX0lOVklURT0ke01BSUxFUl9URU1QTEFURVNfSU5WSVRFfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfQ09ORklSTUFUSU9OPSR7TUFJTEVSX1RFTVBMQVRFU19DT05GSVJNQVRJT059JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19SRUNPVkVSWT0ke01BSUxFUl9URU1QTEFURVNfUkVDT1ZFUll9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19NQUdJQ19MSU5LPSR7TUFJTEVSX1RFTVBMQVRFU19NQUdJQ19MSU5LfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1RFTVBMQVRFU19FTUFJTF9DSEFOR0V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0NPTkZJUk1BVElPTj0ke01BSUxFUl9TVUJKRUNUU19DT05GSVJNQVRJT059JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX1JFQ09WRVJZPSR7TUFJTEVSX1NVQkpFQ1RTX1JFQ09WRVJZfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9TVUJKRUNUU19NQUdJQ19MSU5LPSR7TUFJTEVSX1NVQkpFQ1RTX01BR0lDX0xJTkt9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0VNQUlMX0NIQU5HRT0ke01BSUxFUl9TVUJKRUNUU19FTUFJTF9DSEFOR0V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0lOVklURT0ke01BSUxFUl9TVUJKRUNUU19JTlZJVEV9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfUEhPTkVfRU5BQkxFRD0ke0VOQUJMRV9QSE9ORV9TSUdOVVA6LXRydWV9JwogICAgICAtICdHT1RSVUVfU01TX0FVVE9DT05GSVJNPSR7RU5BQkxFX1BIT05FX0FVVE9DT05GSVJNOi10cnVlfScKICByZWFsdGltZS1kZXY6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3JlYWx0aW1lOnYyLjc2LjUnCiAgICBjb250YWluZXJfbmFtZTogcmVhbHRpbWUtZGV2LnN1cGFiYXNlLXJlYWx0aW1lCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLXNTZkwnCiAgICAgICAgLSAnLS1oZWFkJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjQwMDAvYXBpL3RlbmFudHMvcmVhbHRpbWUtZGV2L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgIGVudmlyb25tZW50OgogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdEQl9IT1NUPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnREJfUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtIERCX1VTRVI9c3VwYWJhc2VfYWRtaW4KICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0RCX0FGVEVSX0NPTk5FQ1RfUVVFUlk9U0VUIHNlYXJjaF9wYXRoIFRPIF9yZWFsdGltZScKICAgICAgLSBEQl9FTkNfS0VZPXN1cGFiYXNlcmVhbHRpbWUKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NFQ1JFVF9LRVlfQkFTRT0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVBTFRJTUV9JwogICAgICAtICdNRVRSSUNTX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0VSTF9BRkxBR1M9LXByb3RvX2Rpc3QgaW5ldF90Y3AnCiAgICAgIC0gIkROU19OT0RFUz0nJyIKICAgICAgLSBSTElNSVRfTk9GSUxFPTEwMDAwCiAgICAgIC0gQVBQX05BTUU9cmVhbHRpbWUKICAgICAgLSBTRUVEX1NFTEZfSE9TVD10cnVlCiAgICAgIC0gTE9HX0xFVkVMPWVycm9yCiAgICAgIC0gUlVOX0pBTklUT1I9dHJ1ZQogICAgICAtIEpBTklUT1JfSU5URVJWQUw9NjAwMDAKICAgICAgLSBESVNBQkxFX0hFQUxUSENIRUNLX0xPR0dJTkc9dHJ1ZQogICAgY29tbWFuZDogInNoIC1jIFwiL2FwcC9iaW4vbWlncmF0ZSAmJiAvYXBwL2Jpbi9yZWFsdGltZSBldmFsICdSZWFsdGltZS5SZWxlYXNlLnNlZWRzKFJlYWx0aW1lLlJlcG8pJyAmJiAvYXBwL2Jpbi9zZXJ2ZXJcIlxuIgogIHN1cGFiYXNlLW1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgY29tbWFuZDogJ3NlcnZlciAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiIC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3N0b3JhZ2U6L2RhdGEnCiAgbWluaW8tY3JlYXRlYnVja2V0OgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICByZXN0YXJ0OiAnbm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudHJ5cG9pbnQ6CiAgICAgIC0gL2VudHJ5cG9pbnQuc2gKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2VudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9lbnRyeXBvaW50LnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuL3Vzci9iaW4vbWMgYWxpYXMgc2V0IHN1cGFiYXNlLW1pbmlvIGh0dHA6Ly9zdXBhYmFzZS1taW5pbzo5MDAwICR7TUlOSU9fUk9PVF9VU0VSfSAke01JTklPX1JPT1RfUEFTU1dPUkR9O1xuL3Vzci9iaW4vbWMgbWIgLS1pZ25vcmUtZXhpc3Rpbmcgc3VwYWJhc2UtbWluaW8vc3R1YjtcbmV4aXQgMFxuIgogIHN1cGFiYXNlLXN0b3JhZ2U6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N0b3JhZ2UtYXBpOnYxLjQ0LjInCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1yZXN0OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICAgIGltZ3Byb3h5OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo1MDAwL3N0YXR1cycKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZFUl9QT1JUPTUwMDAKICAgICAgLSBTRVJWRVJfUkVHSU9OPWxvY2FsCiAgICAgIC0gTVVMVElfVEVOQU5UPWZhbHNlCiAgICAgIC0gJ0FVVEhfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vc3VwYWJhc2Vfc3RvcmFnZV9hZG1pbjoke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QCR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifToke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9LyR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSBEQl9JTlNUQUxMX1JPTEVTPWZhbHNlCiAgICAgIC0gU1RPUkFHRV9CQUNLRU5EPXMzCiAgICAgIC0gU1RPUkFHRV9TM19CVUNLRVQ9c3R1YgogICAgICAtICdTVE9SQUdFX1MzX0VORFBPSU5UPWh0dHA6Ly9zdXBhYmFzZS1taW5pbzo5MDAwJwogICAgICAtIFNUT1JBR0VfUzNfRk9SQ0VfUEFUSF9TVFlMRT10cnVlCiAgICAgIC0gU1RPUkFHRV9TM19SRUdJT049dXMtZWFzdC0xCiAgICAgIC0gJ0FXU19BQ0NFU1NfS0VZX0lEPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gVVBMT0FEX0ZJTEVfU0laRV9MSU1JVD01MjQyODgwMDAKICAgICAgLSBVUExPQURfRklMRV9TSVpFX0xJTUlUX1NUQU5EQVJEPTUyNDI4ODAwMAogICAgICAtIFVQTE9BRF9TSUdORURfVVJMX0VYUElSQVRJT05fVElNRT0xMjAKICAgICAgLSBUVVNfVVJMX1BBVEg9L3VwbG9hZC9yZXN1bWFibGUKICAgICAgLSBUVVNfTUFYX1NJWkU9MzYwMDAwMAogICAgICAtIEVOQUJMRV9JTUFHRV9UUkFOU0ZPUk1BVElPTj10cnVlCiAgICAgIC0gJ0lNR1BST1hZX1VSTD1odHRwOi8vaW1ncHJveHk6ODA4MCcKICAgICAgLSBJTUdQUk9YWV9SRVFVRVNUX1RJTUVPVVQ9MTUKICAgICAgLSBEQVRBQkFTRV9TRUFSQ0hfUEFUSD1zdG9yYWdlCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFJFUVVFU1RfQUxMT1dfWF9GT1JXQVJERURfUEFUSD10cnVlCiAgICAgIC0gJ0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU0VSVklDRV9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFU0VSVklDRV9LRVl9JwogICAgICAtICdQT1NUR1JFU1RfVVJMPWh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAnCiAgICAgIC0gJ1BHUlNUX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NUT1JBR0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9JwogICAgICAtICdURU5BTlRfSUQ9JHtTVE9SQUdFX1RFTkFOVF9JRDotc3RvcmFnZS1zaW5nbGUtdGVuYW50fScKICAgIHZvbHVtZXM6CiAgICAgIC0gJy4vdm9sdW1lcy9zdG9yYWdlOi92YXIvbGliL3N0b3JhZ2UnCiAgaW1ncHJveHk6CiAgICBpbWFnZTogJ2RhcnRoc2ltL2ltZ3Byb3h5OnYzLjMwLjEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaW1ncHJveHkKICAgICAgICAtIGhlYWx0aAogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0lNR1BST1hZX0JJTkQ9OjgwODAnCiAgICAgIC0gSU1HUFJPWFlfTE9DQUxfRklMRVNZU1RFTV9ST09UPS8KICAgICAgLSBJTUdQUk9YWV9VU0VfRVRBRz10cnVlCiAgICAgIC0gJ0lNR1BST1hZX0FVVE9fV0VCUD0ke0lNR1BST1hZX0FVVE9fV0VCUDotdHJ1ZX0nCiAgICAgIC0gSU1HUFJPWFlfTUFYX1NSQ19SRVNPTFVUSU9OPTE2LjgKICAgIHZvbHVtZXM6CiAgICAgIC0gJy4vdm9sdW1lcy9zdG9yYWdlOi92YXIvbGliL3N0b3JhZ2UnCiAgc3VwYWJhc2UtbWV0YToKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXMtbWV0YTp2MC45NS4yJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQR19NRVRBX1BPUlQ9ODA4MAogICAgICAtICdQR19NRVRBX0RCX0hPU1Q9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQR19NRVRBX0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUEdfTUVUQV9EQl9OQU1FPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSBQR19NRVRBX0RCX1VTRVI9c3VwYWJhc2VfYWRtaW4KICAgICAgLSAnUEdfTUVUQV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdDUllQVE9fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9QR01FVEFDUllQVE99JwogIHN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9lZGdlLXJ1bnRpbWU6djEuNzEuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdFZGdlIEZ1bmN0aW9ucyBpcyBoZWFsdGh5JwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NVUEFCQVNFX1VSTD1odHRwOi8vc3VwYWJhc2Uta29uZzo4MDAwJwogICAgICAtICdTVVBBQkFTRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9GUUROX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9ST0xFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX0RCX1VSTD1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXM6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1ZFUklGWV9KV1Q9JHtGVU5DVElPTlNfVkVSSUZZX0pXVDotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL2Z1bmN0aW9uczovaG9tZS9kZW5vL2Z1bmN0aW9ucycKICAgICAgLSAnZGVuby1jYWNoZTovcm9vdC8uY2FjaGUvZGVubycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICJpbXBvcnQgKiBhcyBqb3NlIGZyb20gJ2h0dHBzOi8vZGVuby5sYW5kL3gvam9zZUB2NC4xNC40L2luZGV4LnRzJ1xuXG5jb25zb2xlLmxvZygnbWFpbiBmdW5jdGlvbiBzdGFydGVkJylcblxuY29uc3QgSldUX1NFQ1JFVCA9IERlbm8uZW52LmdldCgnSldUX1NFQ1JFVCcpXG5jb25zdCBTVVBBQkFTRV9VUkwgPSBEZW5vLmVudi5nZXQoJ1NVUEFCQVNFX1VSTCcpXG5jb25zdCBWRVJJRllfSldUID0gRGVuby5lbnYuZ2V0KCdWRVJJRllfSldUJykgPT09ICd0cnVlJ1xuXG4vLyBDcmVhdGUgSldLUyBmb3IgRVMyNTYvUlMyNTYgdG9rZW5zIChuZXdlciB0b2tlbnMpXG5sZXQgU1VQQUJBU0VfSldUX0tFWVM6IFJldHVyblR5cGU8dHlwZW9mIGpvc2UuY3JlYXRlUmVtb3RlSldLU2V0PiB8IG51bGwgPSBudWxsXG5pZiAoU1VQQUJBU0VfVVJMKSB7XG4gIHRyeSB7XG4gICAgU1VQQUJBU0VfSldUX0tFWVMgPSBqb3NlLmNyZWF0ZVJlbW90ZUpXS1NldChcbiAgICAgIG5ldyBVUkwoJy9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvbicsIFNVUEFCQVNFX1VSTClcbiAgICApXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdGYWlsZWQgdG8gZmV0Y2ggSldLUyBmcm9tIFNVUEFCQVNFX1VSTDonLCBlKVxuICB9XG59XG5cbmZ1bmN0aW9uIGdldEF1dGhUb2tlbihyZXE6IFJlcXVlc3QpIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmdldCgnYXV0aG9yaXphdGlvbicpXG4gIGlmICghYXV0aEhlYWRlcikge1xuICAgIHRocm93IG5ldyBFcnJvcignTWlzc2luZyBhdXRob3JpemF0aW9uIGhlYWRlcicpXG4gIH1cbiAgY29uc3QgW2JlYXJlciwgdG9rZW5dID0gYXV0aEhlYWRlci5zcGxpdCgnICcpXG4gIGlmIChiZWFyZXIgIT09ICdCZWFyZXInKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBBdXRoIGhlYWRlciBpcyBub3QgJ0JlYXJlciB7dG9rZW59J2ApXG4gIH1cbiAgcmV0dXJuIHRva2VuXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGlzVmFsaWRMZWdhY3lKV1Qoand0OiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFKV1RfU0VDUkVUKSB7XG4gICAgY29uc29sZS5lcnJvcignSldUX1NFQ1JFVCBub3QgYXZhaWxhYmxlIGZvciBIUzI1NiB0b2tlbiB2ZXJpZmljYXRpb24nKVxuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgY29uc3QgZW5jb2RlciA9IG5ldyBUZXh0RW5jb2RlcigpO1xuICBjb25zdCBzZWNyZXRLZXkgPSBlbmNvZGVyLmVuY29kZShKV1RfU0VDUkVUKVxuXG4gIHRyeSB7XG4gICAgYXdhaXQgam9zZS5qd3RWZXJpZnkoand0LCBzZWNyZXRLZXkpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcignU3ltbWV0cmljIExlZ2FjeSBKV1QgdmVyaWZpY2F0aW9uIGVycm9yJywgZSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGlmICghU1VQQUJBU0VfSldUX0tFWVMpIHtcbiAgICBjb25zb2xlLmVycm9yKCdKV0tTIG5vdCBhdmFpbGFibGUgZm9yIEVTMjU2L1JTMjU2IHRva2VuIHZlcmlmaWNhdGlvbicpXG4gICAgcmV0dXJuIGZhbHNlXG4gIH1cblxuICB0cnkge1xuICAgIGF3YWl0IGpvc2Uuand0VmVyaWZ5KGp3dCwgU1VQQUJBU0VfSldUX0tFWVMpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdBc3ltbWV0cmljIEpXVCB2ZXJpZmljYXRpb24gZXJyb3InLCBlKTtcbiAgICByZXR1cm4gZmFsc2VcbiAgfVxuXG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSHlicmlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHsgYWxnOiBqd3RBbGdvcml0aG0gfSA9IGpvc2UuZGVjb2RlUHJvdGVjdGVkSGVhZGVyKGp3dClcblxuICBpZiAoand0QWxnb3JpdGhtID09PSAnSFMyNTYnKSB7XG4gICAgY29uc29sZS5sb2coYExlZ2FjeSB0b2tlbiB0eXBlIGRldGVjdGVkLCBhdHRlbXB0aW5nICR7and0QWxnb3JpdGhtfSB2ZXJpZmljYXRpb24uYClcblxuICAgIHJldHVybiBhd2FpdCBpc1ZhbGlkTGVnYWN5SldUKGp3dClcbiAgfVxuXG4gIGlmIChqd3RBbGdvcml0aG0gPT09ICdFUzI1NicgfHwgand0QWxnb3JpdGhtID09PSAnUlMyNTYnKSB7XG4gICAgcmV0dXJuIGF3YWl0IGlzVmFsaWRKV1Qoand0KVxuICB9XG5cbiAgcmV0dXJuIGZhbHNlO1xufVxuXG5EZW5vLnNlcnZlKGFzeW5jIChyZXE6IFJlcXVlc3QpID0+IHtcbiAgaWYgKHJlcS5tZXRob2QgIT09ICdPUFRJT05TJyAmJiBWRVJJRllfSldUKSB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRva2VuID0gZ2V0QXV0aFRva2VuKHJlcSlcbiAgICAgIGNvbnN0IGlzVmFsaWRKV1QgPSBhd2FpdCBpc1ZhbGlkSHlicmlkSldUKHRva2VuKTtcblxuICAgICAgaWYgKCFpc1ZhbGlkSldUKSB7XG4gICAgICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoeyBtc2c6ICdJbnZhbGlkIEpXVCcgfSksIHtcbiAgICAgICAgICBzdGF0dXM6IDQwMSxcbiAgICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICBjb25zb2xlLmVycm9yKGUpXG4gICAgICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KHsgbXNnOiBlLnRvU3RyaW5nKCkgfSksIHtcbiAgICAgICAgc3RhdHVzOiA0MDEsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgfSlcbiAgICB9XG4gIH1cblxuICBjb25zdCB1cmwgPSBuZXcgVVJMKHJlcS51cmwpXG4gIGNvbnN0IHsgcGF0aG5hbWUgfSA9IHVybFxuICBjb25zdCBwYXRoX3BhcnRzID0gcGF0aG5hbWUuc3BsaXQoJy8nKVxuICBjb25zdCBzZXJ2aWNlX25hbWUgPSBwYXRoX3BhcnRzWzFdXG5cbiAgaWYgKCFzZXJ2aWNlX25hbWUgfHwgc2VydmljZV9uYW1lID09PSAnJykge1xuICAgIGNvbnN0IGVycm9yID0geyBtc2c6ICdtaXNzaW5nIGZ1bmN0aW9uIG5hbWUgaW4gcmVxdWVzdCcgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDQwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cblxuICBjb25zdCBzZXJ2aWNlUGF0aCA9IGAvaG9tZS9kZW5vL2Z1bmN0aW9ucy8ke3NlcnZpY2VfbmFtZX1gXG4gIGNvbnNvbGUuZXJyb3IoYHNlcnZpbmcgdGhlIHJlcXVlc3Qgd2l0aCAke3NlcnZpY2VQYXRofWApXG5cbiAgY29uc3QgbWVtb3J5TGltaXRNYiA9IDE1MFxuICBjb25zdCB3b3JrZXJUaW1lb3V0TXMgPSAxICogNjAgKiAxMDAwXG4gIGNvbnN0IG5vTW9kdWxlQ2FjaGUgPSBmYWxzZVxuICBjb25zdCBpbXBvcnRNYXBQYXRoID0gbnVsbFxuICBjb25zdCBlbnZWYXJzT2JqID0gRGVuby5lbnYudG9PYmplY3QoKVxuICBjb25zdCBlbnZWYXJzID0gT2JqZWN0LmtleXMoZW52VmFyc09iaikubWFwKChrKSA9PiBbaywgZW52VmFyc09ialtrXV0pXG5cbiAgdHJ5IHtcbiAgICBjb25zdCB3b3JrZXIgPSBhd2FpdCBFZGdlUnVudGltZS51c2VyV29ya2Vycy5jcmVhdGUoe1xuICAgICAgc2VydmljZVBhdGgsXG4gICAgICBtZW1vcnlMaW1pdE1iLFxuICAgICAgd29ya2VyVGltZW91dE1zLFxuICAgICAgbm9Nb2R1bGVDYWNoZSxcbiAgICAgIGltcG9ydE1hcFBhdGgsXG4gICAgICBlbnZWYXJzLFxuICAgIH0pXG4gICAgcmV0dXJuIGF3YWl0IHdvcmtlci5mZXRjaChyZXEpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zdCBlcnJvciA9IHsgbXNnOiBlLnRvU3RyaW5nKCkgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDUwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cbn0pIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2Z1bmN0aW9ucy9oZWxsby9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvaGVsbG8vaW5kZXgudHMKICAgICAgICBjb250ZW50OiAiLy8gRm9sbG93IHRoaXMgc2V0dXAgZ3VpZGUgdG8gaW50ZWdyYXRlIHRoZSBEZW5vIGxhbmd1YWdlIHNlcnZlciB3aXRoIHlvdXIgZWRpdG9yOlxuLy8gaHR0cHM6Ly9kZW5vLmxhbmQvbWFudWFsL2dldHRpbmdfc3RhcnRlZC9zZXR1cF95b3VyX2Vudmlyb25tZW50XG4vLyBUaGlzIGVuYWJsZXMgYXV0b2NvbXBsZXRlLCBnbyB0byBkZWZpbml0aW9uLCBldGMuXG5cbkRlbm8uc2VydmUoYXN5bmMgKCkgPT4ge1xuICByZXR1cm4gbmV3IFJlc3BvbnNlKFxuICAgIGBcIkhlbGxvIGZyb20gRWRnZSBGdW5jdGlvbnMhXCJgLFxuICAgIHsgaGVhZGVyczogeyBcIkNvbnRlbnQtVHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9IH0sXG4gIClcbn0pXG5cbi8vIFRvIGludm9rZTpcbi8vIGN1cmwgJ2h0dHA6Ly9sb2NhbGhvc3Q6PEtPTkdfSFRUUF9QT1JUPi9mdW5jdGlvbnMvdjEvaGVsbG8nIFxcXG4vLyAgIC0taGVhZGVyICdBdXRob3JpemF0aW9uOiBCZWFyZXIgPGFub24vc2VydmljZV9yb2xlIEFQSSBrZXk+J1xuIgogICAgY29tbWFuZDoKICAgICAgLSBzdGFydAogICAgICAtICctLW1haW4tc2VydmljZScKICAgICAgLSAvaG9tZS9kZW5vL2Z1bmN0aW9ucy9tYWluCiAgc3VwYWJhc2Utc3VwYXZpc29yOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdXBhdmlzb3I6Mi43LjQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1zU2ZMJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo0MDAwL2FwaS9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgICBzdGFydF9wZXJpb2Q6IDMwcwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9PTEVSX1RFTkFOVF9JRD0ke1BPT0xFUl9URU5BTlRfSUQ6LWRldl90ZW5hbnR9JwogICAgICAtIFBPT0xFUl9QT09MX01PREU9dHJhbnNhY3Rpb24KICAgICAgLSAnUE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFPSR7UE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFOi0yMH0nCiAgICAgIC0gJ1BPT0xFUl9NQVhfQ0xJRU5UX0NPTk49JHtQT09MRVJfTUFYX0NMSUVOVF9DT05OOi0xMDB9JwogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1ROQU1FPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQVRBQkFTRV9VUkw9ZWN0bzovL3N1cGFiYXNlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vX3N1cGFiYXNlJwogICAgICAtIENMVVNURVJfUE9TVEdSRVM9dHJ1ZQogICAgICAtICdTRUNSRVRfS0VZX0JBU0U9JHtTRVJWSUNFX1BBU1NXT1JEX1NVUEFWSVNPUlNFQ1JFVH0nCiAgICAgIC0gJ1ZBVUxUX0VOQ19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1ZBVUxURU5DfScKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSBSRUdJT049bG9jYWwKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAnREJfUE9PTF9TSVpFPSR7UE9PTEVSX0RCX1BPT0xfU0laRTotNX0nCiAgICAgIC0gR0xPQkFMX0RPV05TVFJFQU1fQ0VSVF9QQVRIPS9ldGMvc3NsL3NlcnZlci5jcnQKICAgICAgLSBHTE9CQUxfRE9XTlNUUkVBTV9LRVlfUEFUSD0vZXRjL3NzbC9zZXJ2ZXIua2V5CiAgICBjb21tYW5kOgogICAgICAtIC9iaW4vc2gKICAgICAgLSAnLWMnCiAgICAgIC0gImlmIFsgISAtZiAvZXRjL3NzbC9zZXJ2ZXIuY3J0IF07IHRoZW5cbiAgb3BlbnNzbCByZXEgLXg1MDkgLW5vZGVzIC1kYXlzIDM2NTAgLW5ld2tleSByc2E6MjA0OCBcXFxuICAgIC1rZXlvdXQgL2V0Yy9zc2wvc2VydmVyLmtleSAtb3V0IC9ldGMvc3NsL3NlcnZlci5jcnQgXFxcbiAgICAtc3ViaiBcIi9DTj1zdXBhYmFzZS1wb29sZXJcIlxuZmlcbi9hcHAvYmluL21pZ3JhdGUgJiYgL2FwcC9iaW4vc3VwYXZpc29yIGV2YWwgXCIkJChjYXQgL2V0Yy9wb29sZXIvcG9vbGVyLmV4cylcIiAmJiAvYXBwL2Jpbi9zZXJ2ZXJcbiIKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICB0YXJnZXQ6IC9ldGMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICBjb250ZW50OiAiezpvaywgX30gPSBBcHBsaWNhdGlvbi5lbnN1cmVfYWxsX3N0YXJ0ZWQoOnN1cGF2aXNvcilcbns6b2ssIHZlcnNpb259ID1cbiAgICBjYXNlIFN1cGF2aXNvci5SZXBvLnF1ZXJ5IShcInNlbGVjdCB2ZXJzaW9uKClcIikgZG9cbiAgICAle3Jvd3M6IFtbdmVyXV19IC0+IFN1cGF2aXNvci5IZWxwZXJzLnBhcnNlX3BnX3ZlcnNpb24odmVyKVxuICAgIF8gLT4gbmlsXG4gICAgZW5kXG5wYXJhbXMgPSAle1xuICAgIFwiZXh0ZXJuYWxfaWRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9URU5BTlRfSURcIiksXG4gICAgXCJkYl9ob3N0XCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19IT1NUTkFNRVwiKSxcbiAgICBcImRiX3BvcnRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BPUlRcIikgfD4gU3RyaW5nLnRvX2ludGVnZXIoKSxcbiAgICBcImRiX2RhdGFiYXNlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19EQlwiKSxcbiAgICBcInJlcXVpcmVfdXNlclwiID0+IGZhbHNlLFxuICAgIFwiYXV0aF9xdWVyeVwiID0+IFwiU0VMRUNUICogRlJPTSBwZ2JvdW5jZXIuZ2V0X2F1dGgoJDEpXCIsXG4gICAgXCJkZWZhdWx0X21heF9jbGllbnRzXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfTUFYX0NMSUVOVF9DT05OXCIpLFxuICAgIFwiZGVmYXVsdF9wb29sX3NpemVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9ERUZBVUxUX1BPT0xfU0laRVwiKSxcbiAgICBcImRlZmF1bHRfcGFyYW1ldGVyX3N0YXR1c1wiID0+ICV7XCJzZXJ2ZXJfdmVyc2lvblwiID0+IHZlcnNpb259LFxuICAgIFwidXNlcnNcIiA9PiBbJXtcbiAgICBcImRiX3VzZXJcIiA9PiBcInBnYm91bmNlclwiLFxuICAgIFwiZGJfcGFzc3dvcmRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BBU1NXT1JEXCIpLFxuICAgIFwibW9kZV90eXBlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfUE9PTF9NT0RFXCIpLFxuICAgIFwicG9vbF9zaXplXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfREVGQVVMVF9QT09MX1NJWkVcIiksXG4gICAgXCJpc19tYW5hZ2VyXCIgPT4gdHJ1ZVxuICAgIH1dXG59XG5cbnRlbmFudCA9IFN1cGF2aXNvci5UZW5hbnRzLmdldF90ZW5hbnRfYnlfZXh0ZXJuYWxfaWQocGFyYW1zW1wiZXh0ZXJuYWxfaWRcIl0pXG5cbmlmIHRlbmFudCBkb1xuICB7Om9rLCBffSA9IFN1cGF2aXNvci5UZW5hbnRzLnVwZGF0ZV90ZW5hbnQodGVuYW50LCBwYXJhbXMpXG5lbHNlXG4gIHs6b2ssIF99ID0gU3VwYXZpc29yLlRlbmFudHMuY3JlYXRlX3RlbmFudChwYXJhbXMpXG5lbmRcbiIK",
+        "compose": "c2VydmljZXM6CiAgc3VwYWJhc2Uta29uZzoKICAgIGltYWdlOiAna29uZy9rb25nOjMuOS4xJwogICAgZW50cnlwb2ludDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGtvbmcKICAgICAgICAtIGhlYWx0aAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1NVUEFCQVNFS09OR184MDAwCiAgICAgIC0gJ0tPTkdfUE9SVF9NQVBTPTQ0Mzo4MDAwJwogICAgICAtICdKV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIEtPTkdfREFUQUJBU0U9b2ZmCiAgICAgIC0gS09OR19ERUNMQVJBVElWRV9DT05GSUc9L3Vzci9sb2NhbC9rb25nL2tvbmcueW1sCiAgICAgIC0gJ0tPTkdfRE5TX09SREVSPUxBU1QsQSxDTkFNRScKICAgICAgLSBLT05HX0ROU19OT1RfRk9VTkRfVFRMPTEKICAgICAgLSAnS09OR19QTFVHSU5TPXJlcXVlc3QtdHJhbnNmb3JtZXIsY29ycyxrZXktYXV0aCxhY2wsYmFzaWMtYXV0aCxyZXF1ZXN0LXRlcm1pbmF0aW9uLGlwLXJlc3RyaWN0aW9uLHBvc3QtZnVuY3Rpb24nCiAgICAgIC0gS09OR19OR0lOWF9QUk9YWV9QUk9YWV9CVUZGRVJfU0laRT0xNjBrCiAgICAgIC0gJ0tPTkdfTkdJTlhfUFJPWFlfUFJPWFlfQlVGRkVSUz02NCAxNjBrJwogICAgICAtICdLT05HX1BST1hZX0FDQ0VTU19MT0c9L2Rldi9zdGRvdXQgY29tYmluZWQnCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFU0VSVklDRV9LRVl9JwogICAgICAtICdTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVk9JHtTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVk6LX0nCiAgICAgIC0gJ1NVUEFCQVNFX1NFQ1JFVF9LRVk9JHtTVVBBQkFTRV9TRUNSRVRfS0VZOi19JwogICAgICAtICdBTk9OX0tFWV9BU1lNTUVUUklDPSR7QU5PTl9LRVlfQVNZTU1FVFJJQzotfScKICAgICAgLSAnU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDPSR7U0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDOi19JwogICAgICAtICdEQVNIQk9BUkRfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdEQVNIQk9BUkRfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnS09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9DT05ORUNUX1RJTUVPVVQ6LTYwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1dSSVRFX1RJTUVPVVQ9JHtLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVDotMzYwMH0nCiAgICAgIC0gJ0tPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVQ9JHtLT05HX1NUT1JBR0VfUkVBRF9USU1FT1VUOi0zNjAwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HPSR7S09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HOi1mYWxzZX0nCiAgICAgIC0gJ0tPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkc9JHtLT05HX1NUT1JBR0VfUkVTUE9OU0VfQlVGRkVSSU5HOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2FwaS9rb25nLWVudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9ob21lL2tvbmcva29uZy1lbnRyeXBvaW50LnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9iYXNoXG4jIEN1c3RvbSBlbnRyeXBvaW50IGZvciBLb25nIHRoYXQgYnVpbGRzIEx1YSBleHByZXNzaW9ucyBmb3IgcmVxdWVzdC10cmFuc2Zvcm1lclxuIyBhbmQgcGVyZm9ybXMgZW52aXJvbm1lbnQgdmFyaWFibGUgc3Vic3RpdHV0aW9uIGluIHRoZSBkZWNsYXJhdGl2ZSBjb25maWcuXG5cbmlmIFsgLW4gXCIkU1VQQUJBU0VfU0VDUkVUX0tFWVwiIF0gJiYgWyAtbiBcIiRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVlcIiBdOyB0aGVuXG4gICAgZXhwb3J0IExVQV9BVVRIX0VYUFI9XCJcXCQoKGhlYWRlcnMuYXV0aG9yaXphdGlvbiB+PSBuaWwgYW5kIGhlYWRlcnMuYXV0aG9yaXphdGlvbjpzdWIoMSwgMTApIH49ICdCZWFyZXIgc2JfJyBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uKSBvciAoaGVhZGVycy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9TRUNSRVRfS0VZJyBhbmQgJ0JlYXJlciAkU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDJykgb3IgKGhlYWRlcnMuYXBpa2V5ID09ICckU1VQQUJBU0VfUFVCTElTSEFCTEVfS0VZJyBhbmQgJ0JlYXJlciAkQU5PTl9LRVlfQVNZTU1FVFJJQycpIG9yIGhlYWRlcnMuYXBpa2V5KVwiXG4gICAgZXhwb3J0IExVQV9SVF9XU19FWFBSPVwiXFwkKChxdWVyeV9wYXJhbXMuYXBpa2V5ID09ICckU1VQQUJBU0VfU0VDUkVUX0tFWScgYW5kICckU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDJykgb3IgKHF1ZXJ5X3BhcmFtcy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVknIGFuZCAnJEFOT05fS0VZX0FTWU1NRVRSSUMnKSBvciBxdWVyeV9wYXJhbXMuYXBpa2V5KVwiXG5lbHNlXG4gICAgZXhwb3J0IExVQV9BVVRIX0VYUFI9XCJcXCQoKGhlYWRlcnMuYXV0aG9yaXphdGlvbiB+PSBuaWwgYW5kIGhlYWRlcnMuYXV0aG9yaXphdGlvbjpzdWIoMSwgMTApIH49ICdCZWFyZXIgc2JfJyBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uKSBvciBoZWFkZXJzLmFwaWtleSlcIlxuICAgIGV4cG9ydCBMVUFfUlRfV1NfRVhQUj1cIlxcJChxdWVyeV9wYXJhbXMuYXBpa2V5KVwiXG5maVxuXG5hd2sgJ3tcbiAgcmVzdWx0ID0gXCJcIlxuICByZXN0ID0gJDBcbiAgd2hpbGUgKG1hdGNoKHJlc3QsIC9cXCRbQS1aYS16X11bQS1aYS16XzAtOV0qLykpIHtcbiAgICB2YXJuYW1lID0gc3Vic3RyKHJlc3QsIFJTVEFSVCArIDEsIFJMRU5HVEggLSAxKVxuICAgIGlmICh2YXJuYW1lIGluIEVOVklST04pIHtcbiAgICAgIHJlc3VsdCA9IHJlc3VsdCBzdWJzdHIocmVzdCwgMSwgUlNUQVJUIC0gMSkgRU5WSVJPTlt2YXJuYW1lXVxuICAgIH0gZWxzZSB7XG4gICAgICByZXN1bHQgPSByZXN1bHQgc3Vic3RyKHJlc3QsIDEsIFJTVEFSVCArIFJMRU5HVEggLSAxKVxuICAgIH1cbiAgICByZXN0ID0gc3Vic3RyKHJlc3QsIFJTVEFSVCArIFJMRU5HVEgpXG4gIH1cbiAgcHJpbnQgcmVzdWx0IHJlc3Rcbn0nIC9ob21lL2tvbmcvdGVtcC55bWwgPiBcIiRLT05HX0RFQ0xBUkFUSVZFX0NPTkZJR1wiXG5cbnNlZCAtaSAnL15bWzpzcGFjZTpdXSotIGtleTpbWzpzcGFjZTpdXSokL2QnIFwiJEtPTkdfREVDTEFSQVRJVkVfQ09ORklHXCJcblxuZXhlYyAvZW50cnlwb2ludC5zaCBrb25nIGRvY2tlci1zdGFydFxuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2FwaS9rb25nLnltbAogICAgICAgIHRhcmdldDogL2hvbWUva29uZy90ZW1wLnltbAogICAgICAgIGNvbnRlbnQ6ICJfZm9ybWF0X3ZlcnNpb246ICcyLjEnXG5fdHJhbnNmb3JtOiB0cnVlXG5cbiMjI1xuIyMjIENvbnN1bWVycyAvIFVzZXJzXG4jIyNcbmNvbnN1bWVyczpcbiAgLSB1c2VybmFtZTogREFTSEJPQVJEXG4gIC0gdXNlcm5hbWU6IGFub25cbiAgICBrZXlhdXRoX2NyZWRlbnRpYWxzOlxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9BTk9OX0tFWVxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVlcbiAgLSB1c2VybmFtZTogc2VydmljZV9yb2xlXG4gICAga2V5YXV0aF9jcmVkZW50aWFsczpcbiAgICAgIC0ga2V5OiAkU1VQQUJBU0VfU0VSVklDRV9LRVlcbiAgICAgIC0ga2V5OiAkU1VQQUJBU0VfU0VDUkVUX0tFWVxuXG4jIyNcbiMjIyBBY2Nlc3MgQ29udHJvbCBMaXN0XG4jIyNcbmFjbHM6XG4gIC0gY29uc3VtZXI6IGFub25cbiAgICBncm91cDogYW5vblxuICAtIGNvbnN1bWVyOiBzZXJ2aWNlX3JvbGVcbiAgICBncm91cDogYWRtaW5cblxuIyMjXG4jIyMgRGFzaGJvYXJkIGNyZWRlbnRpYWxzXG4jIyNcbmJhc2ljYXV0aF9jcmVkZW50aWFsczpcbi0gY29uc3VtZXI6IERBU0hCT0FSRFxuICB1c2VybmFtZTogJyREQVNIQk9BUkRfVVNFUk5BTUUnXG4gIHBhc3N3b3JkOiAnJERBU0hCT0FSRF9QQVNTV09SRCdcblxuXG4jIyNcbiMjIyBBUEkgUm91dGVzXG4jIyNcbnNlcnZpY2VzOlxuXG4gICMjIE9wZW4gQXV0aCByb3V0ZXNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW5cbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvdmVyaWZ5XG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW5cbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL3ZlcmlmeVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tY2FsbGJhY2tcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvY2FsbGJhY2tcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1jYWxsYmFja1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvY2FsbGJhY2tcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gIC0gbmFtZTogYXV0aC12MS1vcGVuLWF1dGhvcml6ZVxuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9hdXRob3JpemVcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1hdXRob3JpemVcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL2F1dGhvcml6ZVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tandrc1xuICAgIF9jb21tZW50OiAnQXV0aDogL2F1dGgvdjEvLndlbGwta25vd24vandrcy5qc29uIC0+IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvLndlbGwta25vd24vandrcy5qc29uJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9qd2tzLmpzb25cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1qd2tzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS8ud2VsbC1rbm93bi9qd2tzLmpzb25cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLWFjc1xuICAgIHVybDogXCJodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L3Nzby9zYW1sL2Fjc1wiXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLWFjc1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAtIC9zc28vc2FtbC9hY3NcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLW1ldGFkYXRhXG4gICAgdXJsOiBcImh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvc3NvL3NhbWwvbWV0YWRhdGFcIlxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLXNzby1tZXRhZGF0YVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAtIC9zc28vc2FtbC9tZXRhZGF0YVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBTZWN1cmUgQXV0aCByb3V0ZXNcbiAgLSBuYW1lOiBhdXRoLXYxXG4gICAgX2NvbW1lbnQ6ICdHb1RydWU6IC9hdXRoL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8qJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU2VjdXJlIFJFU1Qgcm91dGVzXG4gIC0gbmFtZTogcmVzdC12MVxuICAgIF9jb21tZW50OiAnUG9zdGdSRVNUOiAvcmVzdC92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiByZXN0LXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3Jlc3QvdjEvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgICAgICByZXBsYWNlOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuXG4gICMjIFNlY3VyZSBHcmFwaFFMIHJvdXRlc1xuICAtIG5hbWU6IGdyYXBocWwtdjFcbiAgICBfY29tbWVudDogJ1Bvc3RnUkVTVDogL2dyYXBocWwvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2UtcmVzdDozMDAwL3JwYy9ncmFwaHFsJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC9ycGMvZ3JhcGhxbFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogZ3JhcGhxbC12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9ncmFwaHFsL3YxXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkNvbnRlbnQtUHJvZmlsZTogZ3JhcGhxbF9wdWJsaWNcIlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQ29udGVudC1Qcm9maWxlOiBncmFwaHFsX3B1YmxpY1wiXG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTZWN1cmUgUmVhbHRpbWUgcm91dGVzXG4gIC0gbmFtZTogcmVhbHRpbWUtdjEtd3NcbiAgICBfY29tbWVudDogJ1JlYWx0aW1lOiAvcmVhbHRpbWUvdjEvKiAtPiB3czovL3JlYWx0aW1lOjQwMDAvc29ja2V0LyonXG4gICAgdXJsOiBodHRwOi8vcmVhbHRpbWUtZGV2OjQwMDAvc29ja2V0XG4gICAgcHJvdG9jb2w6IHdzXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiByZWFsdGltZS12MS13c1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3JlYWx0aW1lL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIHF1ZXJ5c3RyaW5nOlxuICAgICAgICAgICAgICAtIFwiYXBpa2V5OiAkTFVBX1JUX1dTX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBxdWVyeXN0cmluZzpcbiAgICAgICAgICAgICAgLSBcImFwaWtleTogJExVQV9SVF9XU19FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuICAtIG5hbWU6IHJlYWx0aW1lLXYxLXJlc3RcbiAgICBfY29tbWVudDogJ1JlYWx0aW1lOiAvcmVhbHRpbWUvdjEvYXBpLyogLT4gaHR0cDovL3JlYWx0aW1lOjQwMDAvYXBpLyonXG4gICAgdXJsOiBodHRwOi8vcmVhbHRpbWUtZGV2OjQwMDAvYXBpXG4gICAgcHJvdG9jb2w6IGh0dHBcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlYWx0aW1lLXYxLXJlc3RcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9yZWFsdGltZS92MS9hcGlcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU3RvcmFnZSBBUEkgZW5kcG9pbnRcbiAgIyMgTm8ga2V5LWF1dGggLSBTMyBwcm90b2NvbCByZXF1ZXN0cyBkb24ndCBjYXJyeSBhbiBhcGlrZXkgaGVhZGVyLlxuICAtIG5hbWU6IHN0b3JhZ2UtdjFcbiAgICBfY29tbWVudDogJ1N0b3JhZ2U6IC9zdG9yYWdlL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLXN0b3JhZ2U6NTAwMC8qJ1xuICAgIGNvbm5lY3RfdGltZW91dDogJEtPTkdfU1RPUkFHRV9DT05ORUNUX1RJTUVPVVRcbiAgICB3cml0ZV90aW1lb3V0OiAkS09OR19TVE9SQUdFX1dSSVRFX1RJTUVPVVRcbiAgICByZWFkX3RpbWVvdXQ6ICRLT05HX1NUT1JBR0VfUkVBRF9USU1FT1VUXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3RvcmFnZTo1MDAwL1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogc3RvcmFnZS12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9zdG9yYWdlL3YxL1xuICAgICAgICByZXF1ZXN0X2J1ZmZlcmluZzogJEtPTkdfU1RPUkFHRV9SRVFVRVNUX0JVRkZFUklOR1xuICAgICAgICByZXNwb25zZV9idWZmZXJpbmc6ICRLT05HX1NUT1JBR0VfUkVTUE9OU0VfQlVGRkVSSU5HXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBwb3N0LWZ1bmN0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhY2Nlc3M6XG4gICAgICAgICAgICAtIHxcbiAgICAgICAgICAgICAgbG9jYWwgYXV0aCA9IGtvbmcucmVxdWVzdC5nZXRfaGVhZGVyKFwiYXV0aG9yaXphdGlvblwiKVxuICAgICAgICAgICAgICBpZiBhdXRoID09IG5pbCBvciBhdXRoID09IFwiXCIgb3IgYXV0aDpmaW5kKFwiXiVzKiRcIikgdGhlblxuICAgICAgICAgICAgICAgIGtvbmcuc2VydmljZS5yZXF1ZXN0LmNsZWFyX2hlYWRlcihcImF1dGhvcml6YXRpb25cIilcbiAgICAgICAgICAgICAgZW5kXG5cbiAgIyMgRWRnZSBGdW5jdGlvbnMgcm91dGVzXG4gIC0gbmFtZTogZnVuY3Rpb25zLXYxXG4gICAgX2NvbW1lbnQ6ICdFZGdlIEZ1bmN0aW9uczogL2Z1bmN0aW9ucy92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczo5MDAwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtZWRnZS1mdW5jdGlvbnM6OTAwMC9cbiAgICByZWFkX3RpbWVvdXQ6IDE1MDAwMFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogZnVuY3Rpb25zLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2Z1bmN0aW9ucy92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgIyMgT0F1dGggMi4wIEF1dGhvcml6YXRpb24gU2VydmVyIE1ldGFkYXRhIChSRkMgODQxNClcbiAgLSBuYW1lOiB3ZWxsLWtub3duLW9hdXRoXG4gICAgX2NvbW1lbnQ6ICdBdXRoOiAvLndlbGwta25vd24vb2F1dGgtYXV0aG9yaXphdGlvbi1zZXJ2ZXIgLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlcidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvLndlbGwta25vd24vb2F1dGgtYXV0aG9yaXphdGlvbi1zZXJ2ZXJcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHdlbGwta25vd24tb2F1dGhcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlclxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBBbmFseXRpY3Mgcm91dGVzXG4gICMjIE5vdCB1c2VkIC0gU3R1ZGlvIGFuZCBWZWN0b3IgdGFsayBkaXJlY3RseSB0byBhbmFseXRpY3MgdmlhIERvY2tlciBuZXR3b3JraW5nLlxuICAjIC0gbmFtZTogYW5hbHl0aWNzLXYxXG4gICMgICBfY29tbWVudDogJ0FuYWx5dGljczogL2FuYWx5dGljcy92MS8qIC0+IGh0dHA6Ly9sb2dmbGFyZTo0MDAwLyonXG4gICMgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9cbiAgIyAgIHJvdXRlczpcbiAgIyAgICAgLSBuYW1lOiBhbmFseXRpY3MtdjEtYWxsXG4gICMgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAjICAgICAgIHBhdGhzOlxuICAjICAgICAgICAgLSAvYW5hbHl0aWNzL3YxL1xuXG4gICMjIFNlY3VyZSBEYXRhYmFzZSByb3V0ZXNcbiAgLSBuYW1lOiBtZXRhXG4gICAgX2NvbW1lbnQ6ICdwZy1tZXRhOiAvcGcvKiAtPiBodHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwL1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogbWV0YS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9wZy9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cblxuICAjIyBCbG9jayBhY2Nlc3MgdG8gL2FwaS9tY3BcbiAgLSBuYW1lOiBtY3AtYmxvY2tlclxuICAgIF9jb21tZW50OiAnQmxvY2sgZGlyZWN0IGFjY2VzcyB0byAvYXBpL21jcCdcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9hcGkvbWNwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtY3AtYmxvY2tlci1yb3V0ZVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2FwaS9tY3BcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRlcm1pbmF0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBzdGF0dXNfY29kZTogNDAzXG4gICAgICAgICAgbWVzc2FnZTogXCJBY2Nlc3MgaXMgZm9yYmlkZGVuLlwiXG5cbiAgIyMgTUNQIGVuZHBvaW50IC0gbG9jYWwgYWNjZXNzXG4gIC0gbmFtZTogbWNwXG4gICAgX2NvbW1lbnQ6ICdNQ1A6IC9tY3AgLT4gaHR0cDovL3N1cGFiYXNlLXN0dWRpbzozMDAwL2FwaS9tY3AgKGxvY2FsIGFjY2VzcyknXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvYXBpL21jcFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogbWNwXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvbWNwXG4gICAgcGx1Z2luczpcbiAgICAgICMgQmxvY2sgYWNjZXNzIHRvIC9tY3AgYnkgZGVmYXVsdFxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRlcm1pbmF0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBzdGF0dXNfY29kZTogNDAzXG4gICAgICAgICAgbWVzc2FnZTogXCJBY2Nlc3MgaXMgZm9yYmlkZGVuLlwiXG4gICAgICAjIEVuYWJsZSBsb2NhbCBhY2Nlc3MgKGRhbmdlciB6b25lISlcbiAgICAgICMgMS4gQ29tbWVudCBvdXQgdGhlICdyZXF1ZXN0LXRlcm1pbmF0aW9uJyBzZWN0aW9uIGFib3ZlXG4gICAgICAjIDIuIFVuY29tbWVudCB0aGUgZW50aXJlIHNlY3Rpb24gYmVsb3csIGluY2x1ZGluZyAnZGVueSdcbiAgICAgICMgMy4gQWRkIHlvdXIgbG9jYWwgSVBzIHRvIHRoZSAnYWxsb3cnIGxpc3RcbiAgICAgICMtIG5hbWU6IGNvcnNcbiAgICAgICMtIG5hbWU6IGlwLXJlc3RyaWN0aW9uXG4gICAgICAjICBjb25maWc6XG4gICAgICAjICAgIGFsbG93OlxuICAgICAgIyAgICAgIC0gMTI3LjAuMC4xXG4gICAgICAjICAgICAgLSA6OjFcbiAgICAgICMgICAgZGVueTogW11cblxuICAjIyBQcm90ZWN0ZWQgRGFzaGJvYXJkIC0gY2F0Y2ggYWxsIHJlbWFpbmluZyByb3V0ZXNcbiAgLSBuYW1lOiBkYXNoYm9hcmRcbiAgICBfY29tbWVudDogJ1N0dWRpbzogLyogLT4gaHR0cDovL3N0dWRpbzozMDAwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBkYXNoYm9hcmQtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBiYXNpYy1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiB0cnVlXG4iCiAgc3VwYWJhc2Utc3R1ZGlvOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdHVkaW86MjAyNi4wMy4xNi1zaGEtNTUyODgxNycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAiZmV0Y2goJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMC9hcGkvcGxhdGZvcm0vcHJvZmlsZScpLnRoZW4oKHIpID0+IHtpZiAoci5zdGF0dXMgIT09IDIwMCkgdGhyb3cgbmV3IEVycm9yKHIuc3RhdHVzKX0pIgogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBIT1NUTkFNRT0wLjAuMC4wCiAgICAgIC0gJ1NUVURJT19QR19NRVRBX1VSTD1odHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwJwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19IT1NUPSR7UE9TVEdSRVNfSE9TVDotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnUEdSU1RfREJfU0NIRU1BUz0ke1BHUlNUX0RCX1NDSEVNQVM6LXB1YmxpYyxzdG9yYWdlLGdyYXBocWxfcHVibGljfScKICAgICAgLSAnUEdSU1RfREJfTUFYX1JPV1M9JHtQR1JTVF9EQl9NQVhfUk9XUzotMTAwMH0nCiAgICAgIC0gJ1BHUlNUX0RCX0VYVFJBX1NFQVJDSF9QQVRIPSR7UEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg6LXB1YmxpY30nCiAgICAgIC0gJ0RFRkFVTFRfT1JHQU5JWkFUSU9OX05BTUU9JHtTVFVESU9fREVGQVVMVF9PUkdBTklaQVRJT046LURlZmF1bHQgT3JnYW5pemF0aW9ufScKICAgICAgLSAnREVGQVVMVF9QUk9KRUNUX05BTUU9JHtTVFVESU9fREVGQVVMVF9QUk9KRUNUOi1EZWZhdWx0IFByb2plY3R9JwogICAgICAtICdTVVBBQkFTRV9VUkw9aHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMCcKICAgICAgLSAnU1VQQUJBU0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9JwogICAgICAtICdTVVBBQkFTRV9BTk9OX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VBTk9OX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX1NFUlZJQ0VfS0VZPSR7U0VSVklDRV9TVVBBQkFTRVNFUlZJQ0VfS0VZfScKICAgICAgLSAnQVVUSF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdQR19NRVRBX0NSWVBUT19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1BHTUVUQUNSWVBUT30nCiAgICAgIC0gJ0xPR0ZMQVJFX0FQSV9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFfScKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgICAtICdMT0dGTEFSRV9QUklWQVRFX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkVQUklWQVRFfScKICAgICAgLSAnTE9HRkxBUkVfVVJMPWh0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMCcKICAgICAgLSAnTkVYVF9QVUJMSUNfU1VQQUJBU0VfVVJMPSR7U0VSVklDRV9GUUROX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSBORVhUX1BVQkxJQ19FTkFCTEVfTE9HUz10cnVlCiAgICAgIC0gTkVYVF9BTkFMWVRJQ1NfQkFDS0VORF9QUk9WSURFUj1wb3N0Z3JlcwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSBTTklQUEVUU19NQU5BR0VNRU5UX0ZPTERFUj0vYXBwL3NuaXBwZXRzCiAgICAgIC0gRURHRV9GVU5DVElPTlNfTUFOQUdFTUVOVF9GT0xERVI9L2FwcC9lZGdlLWZ1bmN0aW9ucwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3NuaXBwZXRzOi9hcHAvc25pcHBldHMnCiAgICAgIC0gJy4vdm9sdW1lcy9mdW5jdGlvbnM6L2FwcC9lZGdlLWZ1bmN0aW9ucycKICBzdXBhYmFzZS1kYjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXM6MTUuOC4xLjA4NScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncGdfaXNyZWFkeSAtVSBwb3N0Z3JlcyAtaCAxMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtdmVjdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBjb21tYW5kOgogICAgICAtIHBvc3RncmVzCiAgICAgIC0gJy1jJwogICAgICAtIGNvbmZpZ19maWxlPS9ldGMvcG9zdGdyZXNxbC9wb3N0Z3Jlc3FsLmNvbmYKICAgICAgLSAnLWMnCiAgICAgIC0gbG9nX21pbl9tZXNzYWdlcz1mYXRhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSE9TVD0vdmFyL3J1bi9wb3N0Z3Jlc3FsCiAgICAgIC0gJ1BHUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUEdEQVRBQkFTRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwYWJhc2UtZGItZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvcmVhbHRpbWUuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85OS1yZWFsdGltZS5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxuY3JlYXRlIHNjaGVtYSBpZiBub3QgZXhpc3RzIF9yZWFsdGltZTtcbmFsdGVyIHNjaGVtYSBfcmVhbHRpbWUgb3duZXIgdG8gOnBndXNlcjtcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9kYi9fc3VwYWJhc2Uuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85Ny1fc3VwYWJhc2Uuc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cbkNSRUFURSBEQVRBQkFTRSBfc3VwYWJhc2UgV0lUSCBPV05FUiA6cGd1c2VyO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3Bvb2xlci5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LXBvb2xlci5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxcYyBfc3VwYWJhc2VcbmNyZWF0ZSBzY2hlbWEgaWYgbm90IGV4aXN0cyBfc3VwYXZpc29yO1xuYWx0ZXIgc2NoZW1hIF9zdXBhdmlzb3Igb3duZXIgdG8gOnBndXNlcjtcblxcYyBwb3N0Z3Jlc1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3dlYmhvb2tzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OC13ZWJob29rcy5zcWwKICAgICAgICBjb250ZW50OiAiQkVHSU47XG4tLSBDcmVhdGUgcGdfbmV0IGV4dGVuc2lvblxuQ1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHBnX25ldCBTQ0hFTUEgZXh0ZW5zaW9ucztcbi0tIENyZWF0ZSBzdXBhYmFzZV9mdW5jdGlvbnMgc2NoZW1hXG5DUkVBVEUgU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBBVVRIT1JJWkFUSU9OIHN1cGFiYXNlX2FkbWluO1xuR1JBTlQgVVNBR0UgT04gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFRBQkxFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIEZVTkNUSU9OUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFNFUVVFTkNFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLm1pZ3JhdGlvbnMgZGVmaW5pdGlvblxuQ1JFQVRFIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5taWdyYXRpb25zIChcbiAgdmVyc2lvbiB0ZXh0IFBSSU1BUlkgS0VZLFxuICBpbnNlcnRlZF9hdCB0aW1lc3RhbXB0eiBOT1QgTlVMTCBERUZBVUxUIE5PVygpXG4pO1xuLS0gSW5pdGlhbCBzdXBhYmFzZV9mdW5jdGlvbnMgbWlncmF0aW9uXG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnaW5pdGlhbCcpO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLmhvb2tzIGRlZmluaXRpb25cbkNSRUFURSBUQUJMRSBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgKFxuICBpZCBiaWdzZXJpYWwgUFJJTUFSWSBLRVksXG4gIGhvb2tfdGFibGVfaWQgaW50ZWdlciBOT1QgTlVMTCxcbiAgaG9va19uYW1lIHRleHQgTk9UIE5VTEwsXG4gIGNyZWF0ZWRfYXQgdGltZXN0YW1wdHogTk9UIE5VTEwgREVGQVVMVCBOT1coKSxcbiAgcmVxdWVzdF9pZCBiaWdpbnRcbik7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX3JlcXVlc3RfaWRfaWR4IE9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBVU0lORyBidHJlZSAocmVxdWVzdF9pZCk7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX2hfdGFibGVfaWRfaF9uYW1lX2lkeCBPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgVVNJTkcgYnRyZWUgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSk7XG5DT01NRU5UIE9OIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBJUyAnU3VwYWJhc2UgRnVuY3Rpb25zIEhvb2tzOiBBdWRpdCB0cmFpbCBmb3IgdHJpZ2dlcmVkIGhvb2tzLic7XG5DUkVBVEUgRlVOQ1RJT04gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpXG4gIFJFVFVSTlMgdHJpZ2dlclxuICBMQU5HVUFHRSBwbHBnc3FsXG4gIEFTICRmdW5jdGlvbiRcbiAgREVDTEFSRVxuICAgIHJlcXVlc3RfaWQgYmlnaW50O1xuICAgIHBheWxvYWQganNvbmI7XG4gICAgdXJsIHRleHQgOj0gVEdfQVJHVlswXTo6dGV4dDtcbiAgICBtZXRob2QgdGV4dCA6PSBUR19BUkdWWzFdOjp0ZXh0O1xuICAgIGhlYWRlcnMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICBwYXJhbXMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICB0aW1lb3V0X21zIGludGVnZXIgREVGQVVMVCAxMDAwO1xuICBCRUdJTlxuICAgIElGIHVybCBJUyBOVUxMIE9SIHVybCA9ICdudWxsJyBUSEVOXG4gICAgICBSQUlTRSBFWENFUFRJT04gJ3VybCBhcmd1bWVudCBpcyBtaXNzaW5nJztcbiAgICBFTkQgSUY7XG5cbiAgICBJRiBtZXRob2QgSVMgTlVMTCBPUiBtZXRob2QgPSAnbnVsbCcgVEhFTlxuICAgICAgUkFJU0UgRVhDRVBUSU9OICdtZXRob2QgYXJndW1lbnQgaXMgbWlzc2luZyc7XG4gICAgRU5EIElGO1xuXG4gICAgSUYgVEdfQVJHVlsyXSBJUyBOVUxMIE9SIFRHX0FSR1ZbMl0gPSAnbnVsbCcgVEhFTlxuICAgICAgaGVhZGVycyA9ICd7XCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCJ9Jzo6anNvbmI7XG4gICAgRUxTRVxuICAgICAgaGVhZGVycyA9IFRHX0FSR1ZbMl06Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbM10gSVMgTlVMTCBPUiBUR19BUkdWWzNdID0gJ251bGwnIFRIRU5cbiAgICAgIHBhcmFtcyA9ICd7fSc6Ompzb25iO1xuICAgIEVMU0VcbiAgICAgIHBhcmFtcyA9IFRHX0FSR1ZbM106Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbNF0gSVMgTlVMTCBPUiBUR19BUkdWWzRdID0gJ251bGwnIFRIRU5cbiAgICAgIHRpbWVvdXRfbXMgPSAxMDAwO1xuICAgIEVMU0VcbiAgICAgIHRpbWVvdXRfbXMgPSBUR19BUkdWWzRdOjppbnRlZ2VyO1xuICAgIEVORCBJRjtcblxuICAgIENBU0VcbiAgICAgIFdIRU4gbWV0aG9kID0gJ0dFVCcgVEhFTlxuICAgICAgICBTRUxFQ1QgaHR0cF9nZXQgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfZ2V0KFxuICAgICAgICAgIHVybCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBXSEVOIG1ldGhvZCA9ICdQT1NUJyBUSEVOXG4gICAgICAgIHBheWxvYWQgPSBqc29uYl9idWlsZF9vYmplY3QoXG4gICAgICAgICAgJ29sZF9yZWNvcmQnLCBPTEQsXG4gICAgICAgICAgJ3JlY29yZCcsIE5FVyxcbiAgICAgICAgICAndHlwZScsIFRHX09QLFxuICAgICAgICAgICd0YWJsZScsIFRHX1RBQkxFX05BTUUsXG4gICAgICAgICAgJ3NjaGVtYScsIFRHX1RBQkxFX1NDSEVNQVxuICAgICAgICApO1xuXG4gICAgICAgIFNFTEVDVCBodHRwX3Bvc3QgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfcG9zdChcbiAgICAgICAgICB1cmwsXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBFTFNFXG4gICAgICAgIFJBSVNFIEVYQ0VQVElPTiAnbWV0aG9kIGFyZ3VtZW50ICUgaXMgaW52YWxpZCcsIG1ldGhvZDtcbiAgICBFTkQgQ0FTRTtcblxuICAgIElOU0VSVCBJTlRPIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rc1xuICAgICAgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSwgcmVxdWVzdF9pZClcbiAgICBWQUxVRVNcbiAgICAgIChUR19SRUxJRCwgVEdfTkFNRSwgcmVxdWVzdF9pZCk7XG5cbiAgICBSRVRVUk4gTkVXO1xuICBFTkRcbiRmdW5jdGlvbiQ7XG4tLSBTdXBhYmFzZSBzdXBlciBhZG1pblxuRE9cbiQkXG5CRUdJTlxuICBJRiBOT1QgRVhJU1RTIChcbiAgICBTRUxFQ1QgMVxuICAgIEZST00gcGdfcm9sZXNcbiAgICBXSEVSRSByb2xuYW1lID0gJ3N1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbidcbiAgKVxuICBUSEVOXG4gICAgQ1JFQVRFIFVTRVIgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIE5PSU5IRVJJVCBDUkVBVEVST0xFIExPR0lOIE5PUkVQTElDQVRJT047XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBTQ0hFTUEgc3VwYWJhc2VfZnVuY3Rpb25zIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkdSQU5UIEFMTCBQUklWSUxFR0VTIE9OIEFMTCBUQUJMRVMgSU4gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBBTEwgU0VRVUVOQ0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gU0VUIHNlYXJjaF9wYXRoID0gXCJzdXBhYmFzZV9mdW5jdGlvbnNcIjtcbkFMVEVSIHRhYmxlIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIubWlncmF0aW9ucyBPV05FUiBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5BTFRFUiB0YWJsZSBcInN1cGFiYXNlX2Z1bmN0aW9uc1wiLmhvb2tzIE9XTkVSIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkFMVEVSIGZ1bmN0aW9uIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIuaHR0cF9yZXF1ZXN0KCkgT1dORVIgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuR1JBTlQgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIFRPIHBvc3RncmVzO1xuLS0gUmVtb3ZlIHVudXNlZCBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gcm9sZVxuRE9cbiQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19yb2xlc1xuICAgIFdIRVJFIHJvbG5hbWUgPSAnc3VwYWJhc2VfcGdfbmV0X2FkbWluJ1xuICApXG4gIFRIRU5cbiAgICBSRUFTU0lHTiBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gVE8gc3VwYWJhc2VfYWRtaW47XG4gICAgRFJPUCBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW47XG4gICAgRFJPUCBST0xFIHN1cGFiYXNlX3BnX25ldF9hZG1pbjtcbiAgRU5EIElGO1xuRU5EXG4kJDtcbi0tIHBnX25ldCBncmFudHMgd2hlbiBleHRlbnNpb24gaXMgYWxyZWFkeSBlbmFibGVkXG5ET1xuJCRcbkJFR0lOXG4gIElGIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V4dGVuc2lvblxuICAgIFdIRVJFIGV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG4tLSBFdmVudCB0cmlnZ2VyIGZvciBwZ19uZXRcbkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIGV4dGVuc2lvbnMuZ3JhbnRfcGdfbmV0X2FjY2VzcygpXG5SRVRVUk5TIGV2ZW50X3RyaWdnZXJcbkxBTkdVQUdFIHBscGdzcWxcbkFTICQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19ldmVudF90cmlnZ2VyX2RkbF9jb21tYW5kcygpIEFTIGV2XG4gICAgSk9JTiBwZ19leHRlbnNpb24gQVMgZXh0XG4gICAgT04gZXYub2JqaWQgPSBleHQub2lkXG4gICAgV0hFUkUgZXh0LmV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORDtcbiQkO1xuQ09NTUVOVCBPTiBGVU5DVElPTiBleHRlbnNpb25zLmdyYW50X3BnX25ldF9hY2Nlc3MgSVMgJ0dyYW50cyBhY2Nlc3MgdG8gcGdfbmV0JztcbkRPXG4kJFxuQkVHSU5cbiAgSUYgTk9UIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V2ZW50X3RyaWdnZXJcbiAgICBXSEVSRSBldnRuYW1lID0gJ2lzc3VlX3BnX25ldF9hY2Nlc3MnXG4gICkgVEhFTlxuICAgIENSRUFURSBFVkVOVCBUUklHR0VSIGlzc3VlX3BnX25ldF9hY2Nlc3MgT04gZGRsX2NvbW1hbmRfZW5kIFdIRU4gVEFHIElOICgnQ1JFQVRFIEVYVEVOU0lPTicpXG4gICAgRVhFQ1VURSBQUk9DRURVUkUgZXh0ZW5zaW9ucy5ncmFudF9wZ19uZXRfYWNjZXNzKCk7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnMjAyMTA4MDkxODM0MjNfdXBkYXRlX2dyYW50cycpO1xuQUxURVIgZnVuY3Rpb24gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpIFNFQ1VSSVRZIERFRklORVI7XG5BTFRFUiBmdW5jdGlvbiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgU0VUIHNlYXJjaF9wYXRoID0gc3VwYWJhc2VfZnVuY3Rpb25zO1xuUkVWT0tFIEFMTCBPTiBGVU5DVElPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgRlJPTSBQVUJMSUM7XG5HUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5odHRwX3JlcXVlc3QoKSBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQ09NTUlUO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3JvbGVzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OS1yb2xlcy5zcWwKICAgICAgICBjb250ZW50OiAiLS0gTk9URTogY2hhbmdlIHRvIHlvdXIgb3duIHBhc3N3b3JkcyBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHNcbiBcXHNldCBwZ3Bhc3MgYGVjaG8gXCIkUE9TVEdSRVNfUEFTU1dPUkRcImBcblxuIEFMVEVSIFVTRVIgYXV0aGVudGljYXRvciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHBnYm91bmNlciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHN1cGFiYXNlX2F1dGhfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9zdG9yYWdlX2FkbWluIFdJVEggUEFTU1dPUkQgOidwZ3Bhc3MnO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL2p3dC5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LXNjcmlwdHMvOTktand0LnNxbAogICAgICAgIGNvbnRlbnQ6ICJcXHNldCBqd3Rfc2VjcmV0IGBlY2hvIFwiJEpXVF9TRUNSRVRcImBcblxcc2V0IGp3dF9leHAgYGVjaG8gXCIkSldUX0VYUFwiYFxuXFxzZXQgZGJfbmFtZSBgZWNobyBcIiR7UE9TVEdSRVNfREI6LXBvc3RncmVzfVwiYFxuXG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X3NlY3JldFwiIFRPIDonand0X3NlY3JldCc7XG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X2V4cFwiIFRPIDonand0X2V4cCc7XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvbG9ncy5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LWxvZ3Muc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cXGMgX3N1cGFiYXNlXG5jcmVhdGUgc2NoZW1hIGlmIG5vdCBleGlzdHMgX2FuYWx5dGljcztcbmFsdGVyIHNjaGVtYSBfYW5hbHl0aWNzIG93bmVyIHRvIDpwZ3VzZXI7XG5cXGMgcG9zdGdyZXNcbiIKICAgICAgLSAnc3VwYWJhc2UtZGItY29uZmlnOi9ldGMvcG9zdGdyZXNxbC1jdXN0b20nCiAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9sb2dmbGFyZToxLjMxLjInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIExPR0ZMQVJFX05PREVfSE9TVD0xMjcuMC4wLjEKICAgICAgLSBEQl9VU0VSTkFNRT1zdXBhYmFzZV9hZG1pbgogICAgICAtIERCX0RBVEFCQVNFPV9zdXBhYmFzZQogICAgICAtICdEQl9IT1NUTkFNRT0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBEQl9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BSSVZBVEVfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRVBSSVZBVEV9JwogICAgICAtIExPR0ZMQVJFX1NJTkdMRV9URU5BTlQ9dHJ1ZQogICAgICAtIExPR0ZMQVJFX1NVUEFCQVNFX01PREU9dHJ1ZQogICAgICAtICdQT1NUR1JFU19CQUNLRU5EX1VSTD1wb3N0Z3Jlc3FsOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gUE9TVEdSRVNfQkFDS0VORF9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtIExPR0ZMQVJFX0ZFQVRVUkVfRkxBR19PVkVSUklERT1tdWx0aWJhY2tlbmQ9dHJ1ZQogIHN1cGFiYXNlLXZlY3RvcjoKICAgIGltYWdlOiAndGltYmVyaW8vdmVjdG9yOjAuNTMuMC1hbHBpbmUnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovL3N1cGFiYXNlLXZlY3Rvcjo5MDAxL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvbG9ncy92ZWN0b3IueW1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogImFwaTpcbiAgZW5hYmxlZDogdHJ1ZVxuICBhZGRyZXNzOiAwLjAuMC4wOjkwMDFcblxuc291cmNlczpcbiAgZG9ja2VyX2hvc3Q6XG4gICAgdHlwZTogZG9ja2VyX2xvZ3NcbiAgICBleGNsdWRlX2NvbnRhaW5lcnM6XG4gICAgICAtIHN1cGFiYXNlLXZlY3RvclxuXG50cmFuc2Zvcm1zOlxuICBwcm9qZWN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIGRvY2tlcl9ob3N0XG4gICAgc291cmNlOiB8LVxuICAgICAgLnByb2plY3QgPSBcImRlZmF1bHRcIlxuICAgICAgLmV2ZW50X21lc3NhZ2UgPSBkZWwoLm1lc3NhZ2UpXG4gICAgICAuYXBwbmFtZSA9IGRlbCguY29udGFpbmVyX25hbWUpXG4gICAgICBkZWwoLmNvbnRhaW5lcl9jcmVhdGVkX2F0KVxuICAgICAgZGVsKC5jb250YWluZXJfaWQpXG4gICAgICBkZWwoLnNvdXJjZV90eXBlKVxuICAgICAgZGVsKC5zdHJlYW0pXG4gICAgICBkZWwoLmxhYmVsKVxuICAgICAgZGVsKC5pbWFnZSlcbiAgICAgIGRlbCguaG9zdClcbiAgICAgIGRlbCguc3RyZWFtKVxuICByb3V0ZXI6XG4gICAgdHlwZTogcm91dGVcbiAgICBpbnB1dHM6XG4gICAgICAtIHByb2plY3RfbG9nc1xuICAgIHJvdXRlOlxuICAgICAga29uZzogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWtvbmdcIiknXG4gICAgICBhdXRoOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtYXV0aFwiKSdcbiAgICAgIHJlc3Q6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZXN0XCIpJ1xuICAgICAgcmVhbHRpbWU6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJyZWFsdGltZS1kZXZcIiknXG4gICAgICBzdG9yYWdlOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2Utc3RvcmFnZVwiKSdcbiAgICAgIGZ1bmN0aW9uczogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zXCIpJ1xuICAgICAgZGI6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1kYlwiKSdcbiAgIyBJZ25vcmVzIG5vbiBuZ2lueCBlcnJvcnMgc2luY2UgdGhleSBhcmUgcmVsYXRlZCB3aXRoIGtvbmcgYm9vdGluZyB1cFxuICBrb25nX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5rb25nXG4gICAgc291cmNlOiB8LVxuICAgICAgcmVxLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiY29tYmluZWRcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcmVxLnRpbWVzdGFtcFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMucmVmZXJlciA9IHJlcS5yZWZlcmVyXG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy51c2VyX2FnZW50ID0gcmVxLmFnZW50XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5jZl9jb25uZWN0aW5nX2lwID0gcmVxLmNsaWVudFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IHJlcS5zdGF0dXNcbiAgICAgICAgICB1cmwsIHNwbGl0X2VyciA9IHNwbGl0KHJlcS5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBzcGxpdF9lcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIElnbm9yZXMgbm9uIG5naW54IGVycm9ycyBzaW5jZSB0aGV5IGFyZSByZWxhdGVkIHdpdGgga29uZyBib290aW5nIHVwXG4gIGtvbmdfZXJyOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIua29uZ1xuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IFwiR0VUXCJcbiAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IDIwMFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiZXJyb3JcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcGFyc2VkLnRpbWVzdGFtcFxuICAgICAgICAgIC5zZXZlcml0eSA9IHBhcnNlZC5zZXZlcml0eVxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lmhvc3QgPSBwYXJzZWQuaG9zdFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMuY2ZfY29ubmVjdGluZ19pcCA9IHBhcnNlZC5jbGllbnRcbiAgICAgICAgICB1cmwsIGVyciA9IHNwbGl0KHBhcnNlZC5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIEdvdHJ1ZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIGpzb24gc3RyaW5ncyB3aGljaCBmcm9udGVuZCBwYXJzZXMgZGlyZWN0bHkuIEJ1dCB3ZSBrZWVwIG1ldGFkYXRhIGZvciBjb25zaXN0ZW5jeS5cbiAgYXV0aF9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuYXV0aFxuICAgIHNvdXJjZTogfC1cbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEgPSBtZXJnZSEoLm1ldGFkYXRhLCBwYXJzZWQpXG4gICAgICB9XG4gICMgUG9zdGdSRVNUIGxvZ3MgYXJlIHN0cnVjdHVyZWQgc28gd2Ugc2VwYXJhdGUgdGltZXN0YW1wIGZyb20gbWVzc2FnZSB1c2luZyByZWdleFxuICByZXN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5yZXN0XG4gICAgc291cmNlOiB8LVxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcideKD9QPHRpbWU+LiopOiAoP1A8bXNnPi4qKSQnKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5ldmVudF9tZXNzYWdlID0gcGFyc2VkLm1zZ1xuICAgICAgICAgIC50aW1lc3RhbXAgPSBwYXJzZV90aW1lc3RhbXAhKHZhbHVlOiBwYXJzZWQudGltZSwgZm9ybWF0OiBcIiVkLyViLyVZOiVIOiVNOiVTICV6XCIpXG4gICAgICAgICAgLm1ldGFkYXRhLmhvc3QgPSAucHJvamVjdFxuICAgICAgfVxuICAjIEZpbHRlciBvdXQgaGVhbHRoY2hlY2sgbG9ncyBmcm9tIFJlYWx0aW1lXG4gIHJlYWx0aW1lX2xvZ3NfZmlsdGVyZWQ6XG4gICAgdHlwZTogZmlsdGVyXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIucmVhbHRpbWVcbiAgICBjb25kaXRpb246ICchY29udGFpbnMoc3RyaW5nISguZXZlbnRfbWVzc2FnZSksIFwiL2hlYWx0aFwiKSdcbiAgIyBSZWFsdGltZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIHNvIHdlIHBhcnNlIHRoZSBzZXZlcml0eSBsZXZlbCB1c2luZyByZWdleCAoaWdub3JlIHRpbWUgYmVjYXVzZSBpdCBoYXMgbm8gZGF0ZSlcbiAgcmVhbHRpbWVfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcmVhbHRpbWVfbG9nc19maWx0ZXJlZFxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLmV4dGVybmFsX2lkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfcmVnZXgoLmV2ZW50X21lc3NhZ2UsIHInXig/UDx0aW1lPlxcZCs6XFxkKzpcXGQrXFwuXFxkKykgXFxbKD9QPGxldmVsPlxcdyspXFxdICg/UDxtc2c+LiopJCcpXG4gICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgLmV2ZW50X21lc3NhZ2UgPSBwYXJzZWQubXNnXG4gICAgICAgICAgLm1ldGFkYXRhLmxldmVsID0gcGFyc2VkLmxldmVsXG4gICAgICB9XG4gICMgU3RvcmFnZSBsb2dzIG1heSBjb250YWluIGpzb24gb2JqZWN0cyBzbyB3ZSBwYXJzZSB0aGVtIGZvciBjb21wbGV0ZW5lc3NcbiAgc3RvcmFnZV9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuc3RvcmFnZVxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLnRlbmFudElkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAuZXZlbnRfbWVzc2FnZSA9IHBhcnNlZC5tc2dcbiAgICAgICAgICAubWV0YWRhdGEubGV2ZWwgPSBwYXJzZWQubGV2ZWxcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEuY29udGV4dFswXS5ob3N0ID0gcGFyc2VkLmhvc3RuYW1lXG4gICAgICAgICAgLm1ldGFkYXRhLmNvbnRleHRbMF0ucGlkID0gcGFyc2VkLnBpZFxuICAgICAgfVxuICAjIEZ1bmN0aW9uIGxvZ3MgYXJlIHVuc3RydWN0dXJlZCBtZXNzYWdlcyBvbiBzdGRlcnJcbiAgZnVuY3Rpb25zX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5mdW5jdGlvbnNcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEucHJvamVjdF9yZWYgPSBkZWwoLnByb2plY3QpXG4gICMgUG9zdGdyZXMgbG9ncyBzb21lIG1lc3NhZ2VzIHRvIHN0ZGVyciB3aGljaCB3ZSBtYXAgdG8gd2FybmluZyBzZXZlcml0eSBsZXZlbFxuICBkYl9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuZGJcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEuaG9zdCA9IFwiZGItZGVmYXVsdFwiXG4gICAgICAubWV0YWRhdGEucGFyc2VkLnRpbWVzdGFtcCA9IC50aW1lc3RhbXBcblxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcicuKig/UDxsZXZlbD5JTkZPfE5PVElDRXxXQVJOSU5HfEVSUk9SfExPR3xGQVRBTHxQQU5JQz8pOi4qJywgbnVtZXJpY19ncm91cHM6IHRydWUpXG5cbiAgICAgIGlmIGVyciAhPSBudWxsIHx8IHBhcnNlZCA9PSBudWxsIHtcbiAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwiaW5mb1wiXG4gICAgICB9XG4gICAgICBpZiBwYXJzZWQubGV2ZWwgIT0gbnVsbCB7XG4gICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IHBhcnNlZC5sZXZlbFxuICAgICAgfVxuICAgICAgaWYgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9PSBcImluZm9cIiB7XG4gICAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwibG9nXCJcbiAgICAgIH1cbiAgICAgIC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkgPSB1cGNhc2UhKC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkpXG5cbnNpbmtzOlxuICBsb2dmbGFyZV9hdXRoOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gYXV0aF9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1nb3RydWUubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9yZWFsdGltZTpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlYWx0aW1lX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXJlYWx0aW1lLmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfcmVzdDpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlc3RfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9cG9zdGdSRVNULmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfZGI6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBkYl9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1wb3N0Z3Jlcy5sb2dzJ1xuICBsb2dmbGFyZV9mdW5jdGlvbnM6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBmdW5jdGlvbnNfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9ZGVuby1yZWxheS1sb2dzJ1xuICBsb2dmbGFyZV9zdG9yYWdlOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gc3RvcmFnZV9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1zdG9yYWdlLmxvZ3MucHJvZC4yJ1xuICBsb2dmbGFyZV9rb25nOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0ga29uZ19sb2dzXG4gICAgICAtIGtvbmdfZXJyXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1jbG91ZGZsYXJlLmxvZ3MucHJvZCdcbiIKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2s6cm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jb25maWcnCiAgICAgIC0gL2V0Yy92ZWN0b3IvdmVjdG9yLnltbAogIHN1cGFiYXNlLXJlc3Q6CiAgICBpbWFnZTogJ3Bvc3RncmVzdC9wb3N0Z3Jlc3Q6djE0LjYnCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQR1JTVF9EQl9VUkk9cG9zdGdyZXM6Ly9hdXRoZW50aWNhdG9yOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSBQR1JTVF9EQl9BTk9OX1JPTEU9YW5vbgogICAgICAtICdQR1JTVF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIFBHUlNUX0RCX1VTRV9MRUdBQ1lfR1VDUz1mYWxzZQogICAgICAtICdQR1JTVF9BUFBfU0VUVElOR1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdSU1RfQVBQX1NFVFRJTkdTX0pXVF9FWFA9JHtKV1RfRVhQSVJZOi0zNjAwfScKICAgIGNvbW1hbmQ6IHBvc3RncmVzdAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgc3VwYWJhc2UtYXV0aDoKICAgIGltYWdlOiAnc3VwYWJhc2UvZ290cnVlOnYyLjE4Ni4wJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo5OTk5L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIEdPVFJVRV9BUElfSE9TVD0wLjAuMC4wCiAgICAgIC0gR09UUlVFX0FQSV9QT1JUPTk5OTkKICAgICAgLSAnQVBJX0VYVEVSTkFMX1VSTD0ke0FQSV9FWFRFUk5BTF9VUkw6LWh0dHA6Ly9zdXBhYmFzZS1rb25nOjgwMDB9JwogICAgICAtIEdPVFJVRV9EQl9EUklWRVI9cG9zdGdyZXMKICAgICAgLSAnR09UUlVFX0RCX0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovL3N1cGFiYXNlX2F1dGhfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0dPVFJVRV9TSVRFX1VSTD0ke0dPVFJVRV9TSVRFX1VSTDotJHtTRVJWSUNFX0ZRRE5fU1VQQUJBU0VLT05HfX0nCiAgICAgIC0gJ0dPVFJVRV9VUklfQUxMT1dfTElTVD0ke0FERElUSU9OQUxfUkVESVJFQ1RfVVJMU30nCiAgICAgIC0gJ0dPVFJVRV9ESVNBQkxFX1NJR05VUD0ke0RJU0FCTEVfU0lHTlVQOi1mYWxzZX0nCiAgICAgIC0gR09UUlVFX0pXVF9BRE1JTl9ST0xFUz1zZXJ2aWNlX3JvbGUKICAgICAgLSBHT1RSVUVfSldUX0FVRD1hdXRoZW50aWNhdGVkCiAgICAgIC0gR09UUlVFX0pXVF9ERUZBVUxUX0dST1VQX05BTUU9YXV0aGVudGljYXRlZAogICAgICAtICdHT1RSVUVfSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgICAtICdHT1RSVUVfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnR09UUlVFX0VYVEVSTkFMX0VNQUlMX0VOQUJMRUQ9JHtFTkFCTEVfRU1BSUxfU0lHTlVQOi10cnVlfScKICAgICAgLSAnR09UUlVFX0VYVEVSTkFMX0FOT05ZTU9VU19VU0VSU19FTkFCTEVEPSR7RU5BQkxFX0FOT05ZTU9VU19VU0VSUzotZmFsc2V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX0FVVE9DT05GSVJNPSR7RU5BQkxFX0VNQUlMX0FVVE9DT05GSVJNOi1mYWxzZX0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX0FETUlOX0VNQUlMPSR7U01UUF9BRE1JTl9FTUFJTH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX0hPU1Q9JHtTTVRQX0hPU1R9JwogICAgICAtICdHT1RSVUVfU01UUF9QT1JUPSR7U01UUF9QT1JUOi01ODd9JwogICAgICAtICdHT1RSVUVfU01UUF9VU0VSPSR7U01UUF9VU0VSfScKICAgICAgLSAnR09UUlVFX1NNVFBfUEFTUz0ke1NNVFBfUEFTU30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1NFTkRFUl9OQU1FPSR7U01UUF9TRU5ERVJfTkFNRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfSU5WSVRFPSR7TUFJTEVSX1VSTFBBVEhTX0lOVklURTotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19DT05GSVJNQVRJT049JHtNQUlMRVJfVVJMUEFUSFNfQ09ORklSTUFUSU9OOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX1JFQ09WRVJZPSR7TUFJTEVSX1VSTFBBVEhTX1JFQ09WRVJZOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0VNQUlMX0NIQU5HRT0ke01BSUxFUl9VUkxQQVRIU19FTUFJTF9DSEFOR0U6LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX0lOVklURT0ke01BSUxFUl9URU1QTEFURVNfSU5WSVRFfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfQ09ORklSTUFUSU9OPSR7TUFJTEVSX1RFTVBMQVRFU19DT05GSVJNQVRJT059JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19SRUNPVkVSWT0ke01BSUxFUl9URU1QTEFURVNfUkVDT1ZFUll9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19NQUdJQ19MSU5LPSR7TUFJTEVSX1RFTVBMQVRFU19NQUdJQ19MSU5LfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1RFTVBMQVRFU19FTUFJTF9DSEFOR0V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0NPTkZJUk1BVElPTj0ke01BSUxFUl9TVUJKRUNUU19DT05GSVJNQVRJT059JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX1JFQ09WRVJZPSR7TUFJTEVSX1NVQkpFQ1RTX1JFQ09WRVJZfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9TVUJKRUNUU19NQUdJQ19MSU5LPSR7TUFJTEVSX1NVQkpFQ1RTX01BR0lDX0xJTkt9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0VNQUlMX0NIQU5HRT0ke01BSUxFUl9TVUJKRUNUU19FTUFJTF9DSEFOR0V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0lOVklURT0ke01BSUxFUl9TVUJKRUNUU19JTlZJVEV9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfUEhPTkVfRU5BQkxFRD0ke0VOQUJMRV9QSE9ORV9TSUdOVVA6LXRydWV9JwogICAgICAtICdHT1RSVUVfU01TX0FVVE9DT05GSVJNPSR7RU5BQkxFX1BIT05FX0FVVE9DT05GSVJNOi10cnVlfScKICByZWFsdGltZS1kZXY6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3JlYWx0aW1lOnYyLjc2LjUnCiAgICBjb250YWluZXJfbmFtZTogcmVhbHRpbWUtZGV2LnN1cGFiYXNlLXJlYWx0aW1lCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLXNTZkwnCiAgICAgICAgLSAnLS1oZWFkJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjQwMDAvYXBpL3RlbmFudHMvcmVhbHRpbWUtZGV2L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgIGVudmlyb25tZW50OgogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdEQl9IT1NUPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnREJfUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtIERCX1VTRVI9c3VwYWJhc2VfYWRtaW4KICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0RCX0FGVEVSX0NPTk5FQ1RfUVVFUlk9U0VUIHNlYXJjaF9wYXRoIFRPIF9yZWFsdGltZScKICAgICAgLSBEQl9FTkNfS0VZPXN1cGFiYXNlcmVhbHRpbWUKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NFQ1JFVF9LRVlfQkFTRT0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVBTFRJTUV9JwogICAgICAtICdNRVRSSUNTX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0VSTF9BRkxBR1M9LXByb3RvX2Rpc3QgaW5ldF90Y3AnCiAgICAgIC0gIkROU19OT0RFUz0nJyIKICAgICAgLSBSTElNSVRfTk9GSUxFPTEwMDAwCiAgICAgIC0gQVBQX05BTUU9cmVhbHRpbWUKICAgICAgLSBTRUVEX1NFTEZfSE9TVD10cnVlCiAgICAgIC0gTE9HX0xFVkVMPWVycm9yCiAgICAgIC0gUlVOX0pBTklUT1I9dHJ1ZQogICAgICAtIEpBTklUT1JfSU5URVJWQUw9NjAwMDAKICAgICAgLSBESVNBQkxFX0hFQUxUSENIRUNLX0xPR0dJTkc9dHJ1ZQogICAgY29tbWFuZDogInNoIC1jIFwiL2FwcC9iaW4vbWlncmF0ZSAmJiAvYXBwL2Jpbi9yZWFsdGltZSBldmFsICdSZWFsdGltZS5SZWxlYXNlLnNlZWRzKFJlYWx0aW1lLlJlcG8pJyAmJiAvYXBwL2Jpbi9zZXJ2ZXJcIlxuIgogIHN1cGFiYXNlLW1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgY29tbWFuZDogJ3NlcnZlciAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiIC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3N0b3JhZ2U6L2RhdGEnCiAgbWluaW8tY3JlYXRlYnVja2V0OgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICByZXN0YXJ0OiAnbm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudHJ5cG9pbnQ6CiAgICAgIC0gL2VudHJ5cG9pbnQuc2gKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2VudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9lbnRyeXBvaW50LnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuL3Vzci9iaW4vbWMgYWxpYXMgc2V0IHN1cGFiYXNlLW1pbmlvIGh0dHA6Ly9zdXBhYmFzZS1taW5pbzo5MDAwICR7TUlOSU9fUk9PVF9VU0VSfSAke01JTklPX1JPT1RfUEFTU1dPUkR9O1xuL3Vzci9iaW4vbWMgbWIgLS1pZ25vcmUtZXhpc3Rpbmcgc3VwYWJhc2UtbWluaW8vc3R1YjtcbmV4aXQgMFxuIgogIHN1cGFiYXNlLXN0b3JhZ2U6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N0b3JhZ2UtYXBpOnYxLjQ0LjInCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1yZXN0OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICAgIGltZ3Byb3h5OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo1MDAwL3N0YXR1cycKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZFUl9QT1JUPTUwMDAKICAgICAgLSBTRVJWRVJfUkVHSU9OPWxvY2FsCiAgICAgIC0gTVVMVElfVEVOQU5UPWZhbHNlCiAgICAgIC0gJ0FVVEhfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vc3VwYWJhc2Vfc3RvcmFnZV9hZG1pbjoke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QCR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifToke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9LyR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSBEQl9JTlNUQUxMX1JPTEVTPWZhbHNlCiAgICAgIC0gU1RPUkFHRV9CQUNLRU5EPXMzCiAgICAgIC0gU1RPUkFHRV9TM19CVUNLRVQ9c3R1YgogICAgICAtICdTVE9SQUdFX1MzX0VORFBPSU5UPWh0dHA6Ly9zdXBhYmFzZS1taW5pbzo5MDAwJwogICAgICAtIFNUT1JBR0VfUzNfRk9SQ0VfUEFUSF9TVFlMRT10cnVlCiAgICAgIC0gU1RPUkFHRV9TM19SRUdJT049dXMtZWFzdC0xCiAgICAgIC0gJ0FXU19BQ0NFU1NfS0VZX0lEPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gVVBMT0FEX0ZJTEVfU0laRV9MSU1JVD01MjQyODgwMDAKICAgICAgLSBVUExPQURfRklMRV9TSVpFX0xJTUlUX1NUQU5EQVJEPTUyNDI4ODAwMAogICAgICAtIFVQTE9BRF9TSUdORURfVVJMX0VYUElSQVRJT05fVElNRT0xMjAKICAgICAgLSBUVVNfVVJMX1BBVEg9L3VwbG9hZC9yZXN1bWFibGUKICAgICAgLSBUVVNfTUFYX1NJWkU9MzYwMDAwMAogICAgICAtIEVOQUJMRV9JTUFHRV9UUkFOU0ZPUk1BVElPTj10cnVlCiAgICAgIC0gJ0lNR1BST1hZX1VSTD1odHRwOi8vaW1ncHJveHk6ODA4MCcKICAgICAgLSBJTUdQUk9YWV9SRVFVRVNUX1RJTUVPVVQ9MTUKICAgICAgLSBEQVRBQkFTRV9TRUFSQ0hfUEFUSD1zdG9yYWdlCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFJFUVVFU1RfQUxMT1dfWF9GT1JXQVJERURfUEFUSD10cnVlCiAgICAgIC0gJ0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU0VSVklDRV9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFU0VSVklDRV9LRVl9JwogICAgICAtICdQT1NUR1JFU1RfVVJMPWh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAnCiAgICAgIC0gJ1BHUlNUX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NUT1JBR0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9JwogICAgICAtICdURU5BTlRfSUQ9JHtTVE9SQUdFX1RFTkFOVF9JRDotc3RvcmFnZS1zaW5nbGUtdGVuYW50fScKICAgIHZvbHVtZXM6CiAgICAgIC0gJy4vdm9sdW1lcy9zdG9yYWdlOi92YXIvbGliL3N0b3JhZ2UnCiAgaW1ncHJveHk6CiAgICBpbWFnZTogJ2RhcnRoc2ltL2ltZ3Byb3h5OnYzLjMwLjEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaW1ncHJveHkKICAgICAgICAtIGhlYWx0aAogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0lNR1BST1hZX0JJTkQ9OjgwODAnCiAgICAgIC0gSU1HUFJPWFlfTE9DQUxfRklMRVNZU1RFTV9ST09UPS8KICAgICAgLSBJTUdQUk9YWV9VU0VfRVRBRz10cnVlCiAgICAgIC0gJ0lNR1BST1hZX0FVVE9fV0VCUD0ke0lNR1BST1hZX0FVVE9fV0VCUDotdHJ1ZX0nCiAgICAgIC0gSU1HUFJPWFlfTUFYX1NSQ19SRVNPTFVUSU9OPTE2LjgKICAgIHZvbHVtZXM6CiAgICAgIC0gJy4vdm9sdW1lcy9zdG9yYWdlOi92YXIvbGliL3N0b3JhZ2UnCiAgc3VwYWJhc2UtbWV0YToKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXMtbWV0YTp2MC45NS4yJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQR19NRVRBX1BPUlQ9ODA4MAogICAgICAtICdQR19NRVRBX0RCX0hPU1Q9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQR19NRVRBX0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUEdfTUVUQV9EQl9OQU1FPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSBQR19NRVRBX0RCX1VTRVI9c3VwYWJhc2VfYWRtaW4KICAgICAgLSAnUEdfTUVUQV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdDUllQVE9fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9QR01FVEFDUllQVE99JwogIHN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9lZGdlLXJ1bnRpbWU6djEuNzEuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdFZGdlIEZ1bmN0aW9ucyBpcyBoZWFsdGh5JwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NVUEFCQVNFX1VSTD1odHRwOi8vc3VwYWJhc2Uta29uZzo4MDAwJwogICAgICAtICdTVVBBQkFTRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9GUUROX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9ST0xFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX0RCX1VSTD1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXM6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1ZFUklGWV9KV1Q9JHtGVU5DVElPTlNfVkVSSUZZX0pXVDotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL2Z1bmN0aW9uczovaG9tZS9kZW5vL2Z1bmN0aW9ucycKICAgICAgLSAnZGVuby1jYWNoZTovcm9vdC8uY2FjaGUvZGVubycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICJpbXBvcnQgKiBhcyBqb3NlIGZyb20gJ2h0dHBzOi8vZGVuby5sYW5kL3gvam9zZUB2NC4xNC40L2luZGV4LnRzJ1xuXG5jb25zb2xlLmxvZygnbWFpbiBmdW5jdGlvbiBzdGFydGVkJylcblxuY29uc3QgSldUX1NFQ1JFVCA9IERlbm8uZW52LmdldCgnSldUX1NFQ1JFVCcpXG5jb25zdCBTVVBBQkFTRV9VUkwgPSBEZW5vLmVudi5nZXQoJ1NVUEFCQVNFX1VSTCcpXG5jb25zdCBWRVJJRllfSldUID0gRGVuby5lbnYuZ2V0KCdWRVJJRllfSldUJykgPT09ICd0cnVlJ1xuXG4vLyBDcmVhdGUgSldLUyBmb3IgRVMyNTYvUlMyNTYgdG9rZW5zIChuZXdlciB0b2tlbnMpXG5sZXQgU1VQQUJBU0VfSldUX0tFWVM6IFJldHVyblR5cGU8dHlwZW9mIGpvc2UuY3JlYXRlUmVtb3RlSldLU2V0PiB8IG51bGwgPSBudWxsXG5pZiAoU1VQQUJBU0VfVVJMKSB7XG4gIHRyeSB7XG4gICAgU1VQQUJBU0VfSldUX0tFWVMgPSBqb3NlLmNyZWF0ZVJlbW90ZUpXS1NldChcbiAgICAgIG5ldyBVUkwoJy9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvbicsIFNVUEFCQVNFX1VSTClcbiAgICApXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdGYWlsZWQgdG8gZmV0Y2ggSldLUyBmcm9tIFNVUEFCQVNFX1VSTDonLCBlKVxuICB9XG59XG5cbmZ1bmN0aW9uIGdldEF1dGhUb2tlbihyZXE6IFJlcXVlc3QpIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmdldCgnYXV0aG9yaXphdGlvbicpXG4gIGlmICghYXV0aEhlYWRlcikge1xuICAgIHRocm93IG5ldyBFcnJvcignTWlzc2luZyBhdXRob3JpemF0aW9uIGhlYWRlcicpXG4gIH1cbiAgY29uc3QgW2JlYXJlciwgdG9rZW5dID0gYXV0aEhlYWRlci5zcGxpdCgnICcpXG4gIGlmIChiZWFyZXIgIT09ICdCZWFyZXInKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBBdXRoIGhlYWRlciBpcyBub3QgJ0JlYXJlciB7dG9rZW59J2ApXG4gIH1cbiAgcmV0dXJuIHRva2VuXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGlzVmFsaWRMZWdhY3lKV1Qoand0OiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFKV1RfU0VDUkVUKSB7XG4gICAgY29uc29sZS5lcnJvcignSldUX1NFQ1JFVCBub3QgYXZhaWxhYmxlIGZvciBIUzI1NiB0b2tlbiB2ZXJpZmljYXRpb24nKVxuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgY29uc3QgZW5jb2RlciA9IG5ldyBUZXh0RW5jb2RlcigpO1xuICBjb25zdCBzZWNyZXRLZXkgPSBlbmNvZGVyLmVuY29kZShKV1RfU0VDUkVUKVxuXG4gIHRyeSB7XG4gICAgYXdhaXQgam9zZS5qd3RWZXJpZnkoand0LCBzZWNyZXRLZXkpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcignU3ltbWV0cmljIExlZ2FjeSBKV1QgdmVyaWZpY2F0aW9uIGVycm9yJywgZSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGlmICghU1VQQUJBU0VfSldUX0tFWVMpIHtcbiAgICBjb25zb2xlLmVycm9yKCdKV0tTIG5vdCBhdmFpbGFibGUgZm9yIEVTMjU2L1JTMjU2IHRva2VuIHZlcmlmaWNhdGlvbicpXG4gICAgcmV0dXJuIGZhbHNlXG4gIH1cblxuICB0cnkge1xuICAgIGF3YWl0IGpvc2Uuand0VmVyaWZ5KGp3dCwgU1VQQUJBU0VfSldUX0tFWVMpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdBc3ltbWV0cmljIEpXVCB2ZXJpZmljYXRpb24gZXJyb3InLCBlKTtcbiAgICByZXR1cm4gZmFsc2VcbiAgfVxuXG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSHlicmlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHsgYWxnOiBqd3RBbGdvcml0aG0gfSA9IGpvc2UuZGVjb2RlUHJvdGVjdGVkSGVhZGVyKGp3dClcblxuICBpZiAoand0QWxnb3JpdGhtID09PSAnSFMyNTYnKSB7XG4gICAgY29uc29sZS5sb2coYExlZ2FjeSB0b2tlbiB0eXBlIGRldGVjdGVkLCBhdHRlbXB0aW5nICR7and0QWxnb3JpdGhtfSB2ZXJpZmljYXRpb24uYClcblxuICAgIHJldHVybiBhd2FpdCBpc1ZhbGlkTGVnYWN5SldUKGp3dClcbiAgfVxuXG4gIGlmIChqd3RBbGdvcml0aG0gPT09ICdFUzI1NicgfHwgand0QWxnb3JpdGhtID09PSAnUlMyNTYnKSB7XG4gICAgcmV0dXJuIGF3YWl0IGlzVmFsaWRKV1Qoand0KVxuICB9XG5cbiAgcmV0dXJuIGZhbHNlO1xufVxuXG5EZW5vLnNlcnZlKGFzeW5jIChyZXE6IFJlcXVlc3QpID0+IHtcbiAgaWYgKHJlcS5tZXRob2QgIT09ICdPUFRJT05TJyAmJiBWRVJJRllfSldUKSB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRva2VuID0gZ2V0QXV0aFRva2VuKHJlcSlcbiAgICAgIGNvbnN0IGlzVmFsaWRKV1QgPSBhd2FpdCBpc1ZhbGlkSHlicmlkSldUKHRva2VuKTtcblxuICAgICAgaWYgKCFpc1ZhbGlkSldUKSB7XG4gICAgICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoeyBtc2c6ICdJbnZhbGlkIEpXVCcgfSksIHtcbiAgICAgICAgICBzdGF0dXM6IDQwMSxcbiAgICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICBjb25zb2xlLmVycm9yKGUpXG4gICAgICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KHsgbXNnOiBlLnRvU3RyaW5nKCkgfSksIHtcbiAgICAgICAgc3RhdHVzOiA0MDEsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgfSlcbiAgICB9XG4gIH1cblxuICBjb25zdCB1cmwgPSBuZXcgVVJMKHJlcS51cmwpXG4gIGNvbnN0IHsgcGF0aG5hbWUgfSA9IHVybFxuICBjb25zdCBwYXRoX3BhcnRzID0gcGF0aG5hbWUuc3BsaXQoJy8nKVxuICBjb25zdCBzZXJ2aWNlX25hbWUgPSBwYXRoX3BhcnRzWzFdXG5cbiAgaWYgKCFzZXJ2aWNlX25hbWUgfHwgc2VydmljZV9uYW1lID09PSAnJykge1xuICAgIGNvbnN0IGVycm9yID0geyBtc2c6ICdtaXNzaW5nIGZ1bmN0aW9uIG5hbWUgaW4gcmVxdWVzdCcgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDQwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cblxuICBjb25zdCBzZXJ2aWNlUGF0aCA9IGAvaG9tZS9kZW5vL2Z1bmN0aW9ucy8ke3NlcnZpY2VfbmFtZX1gXG4gIGNvbnNvbGUuZXJyb3IoYHNlcnZpbmcgdGhlIHJlcXVlc3Qgd2l0aCAke3NlcnZpY2VQYXRofWApXG5cbiAgY29uc3QgbWVtb3J5TGltaXRNYiA9IDE1MFxuICBjb25zdCB3b3JrZXJUaW1lb3V0TXMgPSAxICogNjAgKiAxMDAwXG4gIGNvbnN0IG5vTW9kdWxlQ2FjaGUgPSBmYWxzZVxuICBjb25zdCBpbXBvcnRNYXBQYXRoID0gbnVsbFxuICBjb25zdCBlbnZWYXJzT2JqID0gRGVuby5lbnYudG9PYmplY3QoKVxuICBjb25zdCBlbnZWYXJzID0gT2JqZWN0LmtleXMoZW52VmFyc09iaikubWFwKChrKSA9PiBbaywgZW52VmFyc09ialtrXV0pXG5cbiAgdHJ5IHtcbiAgICBjb25zdCB3b3JrZXIgPSBhd2FpdCBFZGdlUnVudGltZS51c2VyV29ya2Vycy5jcmVhdGUoe1xuICAgICAgc2VydmljZVBhdGgsXG4gICAgICBtZW1vcnlMaW1pdE1iLFxuICAgICAgd29ya2VyVGltZW91dE1zLFxuICAgICAgbm9Nb2R1bGVDYWNoZSxcbiAgICAgIGltcG9ydE1hcFBhdGgsXG4gICAgICBlbnZWYXJzLFxuICAgIH0pXG4gICAgcmV0dXJuIGF3YWl0IHdvcmtlci5mZXRjaChyZXEpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zdCBlcnJvciA9IHsgbXNnOiBlLnRvU3RyaW5nKCkgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDUwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cbn0pXG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZnVuY3Rpb25zL2hlbGxvL2luZGV4LnRzCiAgICAgICAgdGFyZ2V0OiAvaG9tZS9kZW5vL2Z1bmN0aW9ucy9oZWxsby9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICIvLyBGb2xsb3cgdGhpcyBzZXR1cCBndWlkZSB0byBpbnRlZ3JhdGUgdGhlIERlbm8gbGFuZ3VhZ2Ugc2VydmVyIHdpdGggeW91ciBlZGl0b3I6XG4vLyBodHRwczovL2Rlbm8ubGFuZC9tYW51YWwvZ2V0dGluZ19zdGFydGVkL3NldHVwX3lvdXJfZW52aXJvbm1lbnRcbi8vIFRoaXMgZW5hYmxlcyBhdXRvY29tcGxldGUsIGdvIHRvIGRlZmluaXRpb24sIGV0Yy5cblxuRGVuby5zZXJ2ZShhc3luYyAoKSA9PiB7XG4gIHJldHVybiBuZXcgUmVzcG9uc2UoXG4gICAgYFwiSGVsbG8gZnJvbSBFZGdlIEZ1bmN0aW9ucyFcImAsXG4gICAgeyBoZWFkZXJzOiB7IFwiQ29udGVudC1UeXBlXCI6IFwiYXBwbGljYXRpb24vanNvblwiIH0gfSxcbiAgKVxufSlcblxuLy8gVG8gaW52b2tlOlxuLy8gY3VybCAnaHR0cDovL2xvY2FsaG9zdDo8S09OR19IVFRQX1BPUlQ+L2Z1bmN0aW9ucy92MS9oZWxsbycgXFxcbi8vICAgLS1oZWFkZXIgJ0F1dGhvcml6YXRpb246IEJlYXJlciA8YW5vbi9zZXJ2aWNlX3JvbGUgQVBJIGtleT4nXG4iCiAgICBjb21tYW5kOgogICAgICAtIHN0YXJ0CiAgICAgIC0gJy0tbWFpbi1zZXJ2aWNlJwogICAgICAtIC9ob21lL2Rlbm8vZnVuY3Rpb25zL21haW4KICBzdXBhYmFzZS1zdXBhdmlzb3I6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N1cGF2aXNvcjoyLjcuNCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLXNTZkwnCiAgICAgICAgLSAnLW8nCiAgICAgICAgLSAvZGV2L251bGwKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjQwMDAvYXBpL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDEwCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT09MRVJfVEVOQU5UX0lEPSR7UE9PTEVSX1RFTkFOVF9JRDotZGV2X3RlbmFudH0nCiAgICAgIC0gUE9PTEVSX1BPT0xfTU9ERT10cmFuc2FjdGlvbgogICAgICAtICdQT09MRVJfREVGQVVMVF9QT09MX1NJWkU9JHtQT09MRVJfREVGQVVMVF9QT09MX1NJWkU6LTIwfScKICAgICAgLSAnUE9PTEVSX01BWF9DTElFTlRfQ09OTj0ke1BPT0xFUl9NQVhfQ0xJRU5UX0NPTk46LTEwMH0nCiAgICAgIC0gUE9SVD00MDAwCiAgICAgIC0gJ1BPU1RHUkVTX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUE9TVEdSRVNfSE9TVE5BTUU9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1lY3RvOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gQ0xVU1RFUl9QT1NUR1JFUz10cnVlCiAgICAgIC0gJ1NFQ1JFVF9LRVlfQkFTRT0ke1NFUlZJQ0VfUEFTU1dPUkRfU1VQQVZJU09SU0VDUkVUfScKICAgICAgLSAnVkFVTFRfRU5DX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfVkFVTFRFTkN9JwogICAgICAtICdBUElfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnTUVUUklDU19KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIFJFR0lPTj1sb2NhbAogICAgICAtICdFUkxfQUZMQUdTPS1wcm90b19kaXN0IGluZXRfdGNwJwogICAgICAtICdEQl9QT09MX1NJWkU9JHtQT09MRVJfREJfUE9PTF9TSVpFOi01fScKICAgICAgLSBHTE9CQUxfRE9XTlNUUkVBTV9DRVJUX1BBVEg9L2V0Yy9zc2wvc2VydmVyLmNydAogICAgICAtIEdMT0JBTF9ET1dOU1RSRUFNX0tFWV9QQVRIPS9ldGMvc3NsL3NlcnZlci5rZXkKICAgIGNvbW1hbmQ6CiAgICAgIC0gL2Jpbi9zaAogICAgICAtICctYycKICAgICAgLSAiaWYgWyAhIC1mIC9ldGMvc3NsL3NlcnZlci5jcnQgXTsgdGhlblxuICBvcGVuc3NsIHJlcSAteDUwOSAtbm9kZXMgLWRheXMgMzY1MCAtbmV3a2V5IHJzYToyMDQ4IFxcXG4gICAgLWtleW91dCAvZXRjL3NzbC9zZXJ2ZXIua2V5IC1vdXQgL2V0Yy9zc2wvc2VydmVyLmNydCBcXFxuICAgIC1zdWJqIFwiL0NOPXN1cGFiYXNlLXBvb2xlclwiXG5maVxuL2FwcC9iaW4vbWlncmF0ZSAmJiAvYXBwL2Jpbi9zdXBhdmlzb3IgZXZhbCBcIiQkKGNhdCAvZXRjL3Bvb2xlci9wb29sZXIuZXhzKVwiICYmIC9hcHAvYmluL3NlcnZlclxuIgogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9wb29sZXIvcG9vbGVyLmV4cwogICAgICAgIHRhcmdldDogL2V0Yy9wb29sZXIvcG9vbGVyLmV4cwogICAgICAgIGNvbnRlbnQ6ICJ7Om9rLCBffSA9IEFwcGxpY2F0aW9uLmVuc3VyZV9hbGxfc3RhcnRlZCg6c3VwYXZpc29yKVxuezpvaywgdmVyc2lvbn0gPVxuICAgIGNhc2UgU3VwYXZpc29yLlJlcG8ucXVlcnkhKFwic2VsZWN0IHZlcnNpb24oKVwiKSBkb1xuICAgICV7cm93czogW1t2ZXJdXX0gLT4gU3VwYXZpc29yLkhlbHBlcnMucGFyc2VfcGdfdmVyc2lvbih2ZXIpXG4gICAgXyAtPiBuaWxcbiAgICBlbmRcbnBhcmFtcyA9ICV7XG4gICAgXCJleHRlcm5hbF9pZFwiID0+IFN5c3RlbS5nZXRfZW52KFwiUE9PTEVSX1RFTkFOVF9JRFwiKSxcbiAgICBcImRiX2hvc3RcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX0hPU1ROQU1FXCIpLFxuICAgIFwiZGJfcG9ydFwiID0+IFN5c3RlbS5nZXRfZW52KFwiUE9TVEdSRVNfUE9SVFwiKSB8PiBTdHJpbmcudG9faW50ZWdlcigpLFxuICAgIFwiZGJfZGF0YWJhc2VcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX0RCXCIpLFxuICAgIFwicmVxdWlyZV91c2VyXCIgPT4gZmFsc2UsXG4gICAgXCJhdXRoX3F1ZXJ5XCIgPT4gXCJTRUxFQ1QgKiBGUk9NIHBnYm91bmNlci5nZXRfYXV0aCgkMSlcIixcbiAgICBcImRlZmF1bHRfbWF4X2NsaWVudHNcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9NQVhfQ0xJRU5UX0NPTk5cIiksXG4gICAgXCJkZWZhdWx0X3Bvb2xfc2l6ZVwiID0+IFN5c3RlbS5nZXRfZW52KFwiUE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFXCIpLFxuICAgIFwiZGVmYXVsdF9wYXJhbWV0ZXJfc3RhdHVzXCIgPT4gJXtcInNlcnZlcl92ZXJzaW9uXCIgPT4gdmVyc2lvbn0sXG4gICAgXCJ1c2Vyc1wiID0+IFsle1xuICAgIFwiZGJfdXNlclwiID0+IFwicGdib3VuY2VyXCIsXG4gICAgXCJkYl9wYXNzd29yZFwiID0+IFN5c3RlbS5nZXRfZW52KFwiUE9TVEdSRVNfUEFTU1dPUkRcIiksXG4gICAgXCJtb2RlX3R5cGVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9QT09MX01PREVcIiksXG4gICAgXCJwb29sX3NpemVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9ERUZBVUxUX1BPT0xfU0laRVwiKSxcbiAgICBcImlzX21hbmFnZXJcIiA9PiB0cnVlXG4gICAgfV1cbn1cblxudGVuYW50ID0gU3VwYXZpc29yLlRlbmFudHMuZ2V0X3RlbmFudF9ieV9leHRlcm5hbF9pZChwYXJhbXNbXCJleHRlcm5hbF9pZFwiXSlcblxuaWYgdGVuYW50IGRvXG4gIHs6b2ssIF99ID0gU3VwYXZpc29yLlRlbmFudHMudXBkYXRlX3RlbmFudCh0ZW5hbnQsIHBhcmFtcylcbmVsc2VcbiAgezpvaywgX30gPSBTdXBhdmlzb3IuVGVuYW50cy5jcmVhdGVfdGVuYW50KHBhcmFtcylcbmVuZFxuIgo=",
         "tags": [
             "firebase",
             "alternative",
@@ -5386,13 +4557,13 @@
         "category": "backend",
         "logo": "svgs/supabase.svg",
         "minversion": "4.0.0-beta.228",
-        "template_last_updated_at": "2026-10-15T23:15:19+02:00",
+        "template_last_updated_at": "2026-10-18T23:43:20+02:00",
         "port": "8000"
     },
     "superset-with-postgresql": {
         "documentation": "https://github.com/amancevice/docker-superset?utm_source=coolify.io",
         "slogan": "Modern data exploration and visualization platform (unofficial community docker image)",
-        "compose": "c2VydmljZXM6CiAgc3VwZXJzZXQ6CiAgICBpbWFnZTogJ2FtYW5jZXZpY2Uvc3VwZXJzZXQ6Ni4wLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU1VQRVJTRVRfODA4OAogICAgICAtICdTRUNSRVRfS0VZPSR7U0VSVklDRV9CQVNFNjRfNjRfU1VQRVJTRVRTRUNSRVRLRVl9JwogICAgICAtICdNQVBCT1hfQVBJX0tFWT0ke01BUEJPWF9BUElfS0VZfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXN1cGVyc2V0LWRifScKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3N1cGVyc2V0L3N1cGVyc2V0X2NvbmZpZy5weQogICAgICAgIHRhcmdldDogL2V0Yy9zdXBlcnNldC9zdXBlcnNldF9jb25maWcucHkKICAgICAgICBjb250ZW50OiAiXCJcIlwiXG5Gb3IgbW9yZSBjb25maWd1cmF0aW9uIG9wdGlvbnMsIHNlZTpcbi0gaHR0cHM6Ly9zdXBlcnNldC5hcGFjaGUub3JnL2RvY3MvY29uZmlndXJhdGlvbi9jb25maWd1cmluZy1zdXBlcnNldFxuXCJcIlwiXG5cbmltcG9ydCBvc1xuXG5TRUNSRVRfS0VZID0gb3MuZ2V0ZW52KFwiU0VDUkVUX0tFWVwiKVxuTUFQQk9YX0FQSV9LRVkgPSBvcy5nZXRlbnYoXCJNQVBCT1hfQVBJX0tFWVwiLCBcIlwiKVxuXG5DQUNIRV9DT05GSUcgPSB7XG4gIFwiQ0FDSEVfVFlQRVwiOiBcIlJlZGlzQ2FjaGVcIixcbiAgXCJDQUNIRV9ERUZBVUxUX1RJTUVPVVRcIjogMzAwLFxuICBcIkNBQ0hFX0tFWV9QUkVGSVhcIjogXCJzdXBlcnNldF9cIixcbiAgXCJDQUNIRV9SRURJU19IT1NUXCI6IFwicmVkaXNcIixcbiAgXCJDQUNIRV9SRURJU19QT1JUXCI6IDYzNzksXG4gIFwiQ0FDSEVfUkVESVNfREJcIjogMSxcbiAgXCJDQUNIRV9SRURJU19VUkxcIjogZlwicmVkaXM6Ly86e29zLmdldGVudignUkVESVNfUEFTU1dPUkQnKX1AcmVkaXM6NjM3OS8xXCIsXG59XG5cbkZJTFRFUl9TVEFURV9DQUNIRV9DT05GSUcgPSB7KipDQUNIRV9DT05GSUcsIFwiQ0FDSEVfS0VZX1BSRUZJWFwiOiBcInN1cGVyc2V0X2ZpbHRlcl9cIn1cbkVYUExPUkVfRk9STV9EQVRBX0NBQ0hFX0NPTkZJRyA9IHsqKkNBQ0hFX0NPTkZJRywgXCJDQUNIRV9LRVlfUFJFRklYXCI6IFwic3VwZXJzZXRfZXhwbG9yZV9mb3JtX1wifVxuXG5TUUxBTENIRU1ZX1RSQUNLX01PRElGSUNBVElPTlMgPSBUcnVlXG5TUUxBTENIRU1ZX0RBVEFCQVNFX1VSSSA9IGZcInBvc3RncmVzcWwrcHN5Y29wZzI6Ly97b3MuZ2V0ZW52KCdQT1NUR1JFU19VU0VSJyl9Ontvcy5nZXRlbnYoJ1BPU1RHUkVTX1BBU1NXT1JEJyl9QHBvc3RncmVzOjU0MzIve29zLmdldGVudignUE9TVEdSRVNfREInKX1cIlxuXG4jIFVuY29tbWVudCBpZiB5b3Ugd2FudCB0byBsb2FkIGV4YW1wbGUgZGF0YSAodXNpbmcgXCJzdXBlcnNldCBsb2FkX2V4YW1wbGVzXCIpIGF0IHRoZVxuIyBzYW1lIGxvY2F0aW9uIGFzIHlvdXIgbWV0YWRhdGEgcG9zdGdyZXNxbCBpbnN0YW5jZS4gT3RoZXJ3aXNlLCB0aGUgZGVmYXVsdCBzcWxpdGVcbiMgd2lsbCBiZSB1c2VkLCB3aGljaCB3aWxsIG5vdCBwZXJzaXN0IGluIHZvbHVtZSB3aGVuIHJlc3RhcnRpbmcgc3VwZXJzZXQgYnkgZGVmYXVsdC5cbiNTUUxBTENIRU1ZX0VYQU1QTEVTX1VSSSA9IFNRTEFMQ0hFTVlfREFUQUJBU0VfVVJJIgogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDg4L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxOCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotc3VwZXJzZXQtZGJ9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwZXJzZXRfcG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo4JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwZXJzZXRfcmVkaXNfZGF0YTovZGF0YScKICAgIGNvbW1hbmQ6ICdyZWRpcy1zZXJ2ZXIgLS1yZXF1aXJlcGFzcyAke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdyZWRpcy1jbGkgcGluZycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
+        "compose": "c2VydmljZXM6CiAgc3VwZXJzZXQ6CiAgICBpbWFnZTogJ2FtYW5jZXZpY2Uvc3VwZXJzZXQ6Ni4wLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU1VQRVJTRVRfODA4OAogICAgICAtICdTRUNSRVRfS0VZPSR7U0VSVklDRV9CQVNFNjRfNjRfU1VQRVJTRVRTRUNSRVRLRVl9JwogICAgICAtICdNQVBCT1hfQVBJX0tFWT0ke01BUEJPWF9BUElfS0VZfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXN1cGVyc2V0LWRifScKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3N1cGVyc2V0L3N1cGVyc2V0X2NvbmZpZy5weQogICAgICAgIHRhcmdldDogL2V0Yy9zdXBlcnNldC9zdXBlcnNldF9jb25maWcucHkKICAgICAgICBjb250ZW50OiAiXCJcIlwiXG5Gb3IgbW9yZSBjb25maWd1cmF0aW9uIG9wdGlvbnMsIHNlZTpcbi0gaHR0cHM6Ly9zdXBlcnNldC5hcGFjaGUub3JnL2RvY3MvY29uZmlndXJhdGlvbi9jb25maWd1cmluZy1zdXBlcnNldFxuXCJcIlwiXG5cbmltcG9ydCBvc1xuXG5TRUNSRVRfS0VZID0gb3MuZ2V0ZW52KFwiU0VDUkVUX0tFWVwiKVxuTUFQQk9YX0FQSV9LRVkgPSBvcy5nZXRlbnYoXCJNQVBCT1hfQVBJX0tFWVwiLCBcIlwiKVxuXG5DQUNIRV9DT05GSUcgPSB7XG4gIFwiQ0FDSEVfVFlQRVwiOiBcIlJlZGlzQ2FjaGVcIixcbiAgXCJDQUNIRV9ERUZBVUxUX1RJTUVPVVRcIjogMzAwLFxuICBcIkNBQ0hFX0tFWV9QUkVGSVhcIjogXCJzdXBlcnNldF9cIixcbiAgXCJDQUNIRV9SRURJU19IT1NUXCI6IFwicmVkaXNcIixcbiAgXCJDQUNIRV9SRURJU19QT1JUXCI6IDYzNzksXG4gIFwiQ0FDSEVfUkVESVNfREJcIjogMSxcbiAgXCJDQUNIRV9SRURJU19VUkxcIjogZlwicmVkaXM6Ly86e29zLmdldGVudignUkVESVNfUEFTU1dPUkQnKX1AcmVkaXM6NjM3OS8xXCIsXG59XG5cbkZJTFRFUl9TVEFURV9DQUNIRV9DT05GSUcgPSB7KipDQUNIRV9DT05GSUcsIFwiQ0FDSEVfS0VZX1BSRUZJWFwiOiBcInN1cGVyc2V0X2ZpbHRlcl9cIn1cbkVYUExPUkVfRk9STV9EQVRBX0NBQ0hFX0NPTkZJRyA9IHsqKkNBQ0hFX0NPTkZJRywgXCJDQUNIRV9LRVlfUFJFRklYXCI6IFwic3VwZXJzZXRfZXhwbG9yZV9mb3JtX1wifVxuXG5TUUxBTENIRU1ZX1RSQUNLX01PRElGSUNBVElPTlMgPSBUcnVlXG5TUUxBTENIRU1ZX0RBVEFCQVNFX1VSSSA9IGZcInBvc3RncmVzcWwrcHN5Y29wZzI6Ly97b3MuZ2V0ZW52KCdQT1NUR1JFU19VU0VSJyl9Ontvcy5nZXRlbnYoJ1BPU1RHUkVTX1BBU1NXT1JEJyl9QHBvc3RncmVzOjU0MzIve29zLmdldGVudignUE9TVEdSRVNfREInKX1cIlxuXG4jIFVuY29tbWVudCBpZiB5b3Ugd2FudCB0byBsb2FkIGV4YW1wbGUgZGF0YSAodXNpbmcgXCJzdXBlcnNldCBsb2FkX2V4YW1wbGVzXCIpIGF0IHRoZVxuIyBzYW1lIGxvY2F0aW9uIGFzIHlvdXIgbWV0YWRhdGEgcG9zdGdyZXNxbCBpbnN0YW5jZS4gT3RoZXJ3aXNlLCB0aGUgZGVmYXVsdCBzcWxpdGVcbiMgd2lsbCBiZSB1c2VkLCB3aGljaCB3aWxsIG5vdCBwZXJzaXN0IGluIHZvbHVtZSB3aGVuIHJlc3RhcnRpbmcgc3VwZXJzZXQgYnkgZGVmYXVsdC5cbiNTUUxBTENIRU1ZX0VYQU1QTEVTX1VSSSA9IFNRTEFMQ0hFTVlfREFUQUJBU0VfVVJJXG4iCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwODgvaGVhbHRoJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE4JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1zdXBlcnNldC1kYn0nCiAgICB2b2x1bWVzOgogICAgICAtICdzdXBlcnNldF9wb3N0Z3Jlc19kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdzdXBlcnNldF9yZWRpc19kYXRhOi9kYXRhJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLXJlcXVpcmVwYXNzICR7U0VSVklDRV9QQVNTV09SRF9SRURJU30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ3JlZGlzLWNsaSBwaW5nJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "analytics",
             "bi",
@@ -5467,7 +4638,7 @@
         "category": "finance",
         "logo": "svgs/sure.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-02-05T06:44:13+01:00",
+        "template_last_updated_at": "2026-10-19T21:30:29+02:00",
         "port": "3000"
     },
     "swetrix": {
@@ -5636,7 +4807,7 @@
     "trigger": {
         "documentation": "https://trigger.dev/docs/self-hosting/overview?utm_source=coolify.io",
         "slogan": "The open source background jobs platform for developers",
-        "compose": "c2VydmljZXM6CiAgdHJpZ2dlcjoKICAgIGltYWdlOiAnZ2hjci5pby90cmlnZ2VyZG90ZGV2L3RyaWdnZXIuZGV2OnY0LjMuMCcKICAgIHVzZXI6IHJvb3QKICAgIGNvbW1hbmQ6ICJzaCAtYyBcImNob3duIC1SIG5vZGU6bm9kZSAvaG9tZS9ub2RlL3NoYXJlZCAmJiBleGVjIC4vc2NyaXB0cy9lbnRyeXBvaW50LnNoXCJcbiIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9UUklHR0VSXzMwMDAKICAgICAgLSAnQVBQX09SSUdJTj0ke1NFUlZJQ0VfRlFETl9UUklHR0VSXzMwMDB9JwogICAgICAtICdMT0dJTl9PUklHSU49JHtTRVJWSUNFX0ZRRE5fVFJJR0dFUl8zMDAwfScKICAgICAgLSAnQVBJX09SSUdJTj0ke1NFUlZJQ0VfRlFETl9UUklHR0VSXzMwMDB9JwogICAgICAtICdTRVNTSU9OX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfU0VTU0lPTn0nCiAgICAgIC0gJ01BR0lDX0xJTktfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9NQUdJQ0xJTkt9JwogICAgICAtICdFTkNSWVBUSU9OX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfRU5DUllQVElPTktFWX0nCiAgICAgIC0gJ01BTkFHRURfV09SS0VSX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfV09SS0VSU0VDUkVUfScKICAgICAgLSAnVFJJR0dFUl9XT1JLRVJfVE9LRU49JHtUUklHR0VSX1dPUktFUl9UT0tFTn0nCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIEFQUF9MT0dfTEVWRUw9aW5mbwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXNxbDovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzcWw6NTQzMi8ke1BPU1RHUkVTX0RCOi10cmlnZ2VyLWRifT9zY2hlbWE9cHVibGljJnNzbG1vZGU9ZGlzYWJsZScKICAgICAgLSAnRElSRUNUX1VSTD1wb3N0Z3Jlc3FsOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXNxbDo1NDMyLyR7UE9TVEdSRVNfREI6LXRyaWdnZXItZGJ9P3NjaGVtYT1wdWJsaWMmc3NsbW9kZT1kaXNhYmxlJwogICAgICAtIFJFRElTX0hPU1Q9cmVkaXMKICAgICAgLSBSRURJU19QT1JUPTYzNzkKICAgICAgLSBSRURJU19UTFNfRElTQUJMRUQ9dHJ1ZQogICAgICAtICdFTEVDVFJJQ19PUklHSU49aHR0cDovL2VsZWN0cmljOjMwMDAnCiAgICAgIC0gJ0RFVl9PVEVMX0VYUE9SVEVSX09UTFBfRU5EUE9JTlQ9JHtERVZfT1RFTF9FWFBPUlRFUl9PVExQX0VORFBPSU5UOi19JwogICAgICAtICdERVBMT1lfUkVHSVNUUllfSE9TVD0ke0RFUExPWV9SRUdJU1RSWV9IT1NUOi1naGNyLmlvfScKICAgICAgLSAnREVQTE9ZX1JFR0lTVFJZX1BST1RPQ09MPSR7REVQTE9ZX1JFR0lTVFJZX1BST1RPQ09MOi1odHRwc30nCiAgICAgIC0gJ0RFUExPWV9SRUdJU1RSWV9OQU1FU1BBQ0U9JHtERVBMT1lfUkVHSVNUUllfTkFNRVNQQUNFOi10cmlnZ2VyfScKICAgICAgLSAnVjRfREVQTE9ZX1JFR0lTVFJZX05BTUVTUEFDRT0ke0RFUExPWV9SRUdJU1RSWV9OQU1FU1BBQ0U6LXRyaWdnZXJ9JwogICAgICAtICdPQkpFQ1RfU1RPUkVfQkFTRV9VUkw9JHtPQkpFQ1RfU1RPUkVfQkFTRV9VUkx9JwogICAgICAtICdPQkpFQ1RfU1RPUkVfQUNDRVNTX0tFWV9JRD0ke09CSkVDVF9TVE9SRV9BQ0NFU1NfS0VZX0lEfScKICAgICAgLSAnT0JKRUNUX1NUT1JFX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7T0JKRUNUX1NUT1JFX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgLSAnQ0xJQ0tIT1VTRV9VUkw9aHR0cDovLyR7U0VSVklDRV9VU0VSX0NMSUNLSE9VU0V9OiR7U0VSVklDRV9QQVNTV09SRF82NF9DTElDS0hPVVNFfUBjbGlja2hvdXNlOjgxMjM/c2VjdXJlPWZhbHNlJwogICAgICAtIENMSUNLSE9VU0VfTE9HX0xFVkVMPWluZm8KICAgICAgLSBSVU5fUkVQTElDQVRJT05fRU5BQkxFRD0xCiAgICAgIC0gJ1JVTl9SRVBMSUNBVElPTl9DTElDS0hPVVNFX1VSTD1odHRwOi8vJHtTRVJWSUNFX1VTRVJfQ0xJQ0tIT1VTRX06JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0NMSUNLSE9VU0V9QGNsaWNraG91c2U6ODEyMycKICAgICAgLSBSVU5fUkVQTElDQVRJT05fTE9HX0xFVkVMPWluZm8KICAgICAgLSBUUklHR0VSX0JPT1RTVFJBUF9FTkFCTEVEPTEKICAgICAgLSBUUklHR0VSX0JPT1RTVFJBUF9XT1JLRVJfR1JPVVBfTkFNRT1ib290c3RyYXAKICAgICAgLSBUUklHR0VSX0JPT1RTVFJBUF9XT1JLRVJfVE9LRU5fUEFUSD0vaG9tZS9ub2RlL3NoYXJlZC93b3JrZXJfdG9rZW4KICAgICAgLSAnREVGQVVMVF9PUkdfRVhFQ1VUSU9OX0NPTkNVUlJFTkNZX0xJTUlUPSR7REVGQVVMVF9PUkdfRVhFQ1VUSU9OX0NPTkNVUlJFTkNZX0xJTUlUOi0zMDB9JwogICAgICAtICdERUZBVUxUX0VOVl9FWEVDVVRJT05fQ09OQ1VSUkVOQ1lfTElNSVQ9JHtERUZBVUxUX0VOVl9FWEVDVVRJT05fQ09OQ1VSUkVOQ1lfTElNSVQ6LTEwMH0nCiAgICAgIC0gJ0FVVEhfR0lUSFVCX0NMSUVOVF9JRD0ke0FVVEhfR0lUSFVCX0NMSUVOVF9JRDotfScKICAgICAgLSAnQVVUSF9HSVRIVUJfQ0xJRU5UX1NFQ1JFVD0ke0FVVEhfR0lUSFVCX0NMSUVOVF9TRUNSRVQ6LX0nCiAgICAgIC0gJ0VNQUlMX1RSQU5TUE9SVD0ke0VNQUlMX1RSQU5TUE9SVDotc210cH0nCiAgICAgIC0gJ1JFU0VORF9BUElfS0VZPSR7UkVTRU5EX0FQSV9LRVl9JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1R9JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlR9JwogICAgICAtICdTTVRQX1VTRVI9JHtTTVRQX1VTRVJ9JwogICAgICAtICdTTVRQX1BBU1NXT1JEPSR7U01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ1NNVFBfU0VDVVJFPSR7U01UUF9TRUNVUkV9JwogICAgICAtICdGUk9NX0VNQUlMPSR7RlJPTV9FTUFJTH0nCiAgICAgIC0gJ1JFUExZX1RPX0VNQUlMPSR7UkVQTFlfVE9fRU1BSUx9JwogICAgICAtICdXSElURUxJU1RFRF9FTUFJTFM9JHtXSElURUxJU1RFRF9FTUFJTFN9JwogICAgICAtICdBRE1JTl9FTUFJTFM9JHtBRE1JTl9FTUFJTFN9JwogICAgICAtIEdSQUNFRlVMX1NIVVRET1dOX1RJTUVPVVQ9MTAwMAogICAgICAtICdJTlRFUk5BTF9PVEVMX1RSQUNFX0xPR0dJTkdfRU5BQkxFRD0ke0lOVEVSTkFMX09URUxfVFJBQ0VfTE9HR0lOR19FTkFCTEVEOi0wfScKICAgICAgLSAnVFJJR0dFUl9URUxFTUVUUllfRElTQUJMRUQ9JHtUUklHR0VSX1RFTEVNRVRSWV9ESVNBQkxFRDotdHJ1ZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdzaGFyZWQtZGF0YTovaG9tZS9ub2RlL3NoYXJlZCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAicmVxdWlyZSgnaHR0cCcpLmdldCgnaHR0cDovLzEyNy4wLjAuMTozMDAwL2hlYWx0aGNoZWNrJywocik9PnByb2Nlc3MuZXhpdChyLnN0YXR1c0NvZGU9PT0yMDA/MDoxKSkub24oJ2Vycm9yJywoKT0+cHJvY2Vzcy5leGl0KDEpKSIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGVsZWN0cmljOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBzdXBlcnZpc29yOgogICAgaW1hZ2U6ICdnaGNyLmlvL3RyaWdnZXJkb3RkZXYvc3VwZXJ2aXNvcjp2NC4zLjAnCiAgICB1c2VyOiByb290CiAgICBjb21tYW5kOiAic2ggLWMgXCJjaG93biAtUiBub2RlOm5vZGUgL2hvbWUvbm9kZS9zaGFyZWQgJiYgZXhlYyAvdXNyL2Jpbi9kdW1iLWluaXQgLS0gcG5wbSBydW4gLS1maWx0ZXIgc3VwZXJ2aXNvciBzdGFydFwiXG4iCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnVFJJR0dFUl9BUElfVVJMPWh0dHA6Ly90cmlnZ2VyOjMwMDAnCiAgICAgIC0gJ09URUxfRVhQT1JURVJfT1RMUF9FTkRQT0lOVD1odHRwOi8vdHJpZ2dlcjozMDAwL290ZWwnCiAgICAgIC0gJ1RSSUdHRVJfV09SS0VSX1RPS0VOPSR7VFJJR0dFUl9XT1JLRVJfVE9LRU46LWZpbGU6Ly8vaG9tZS9ub2RlL3NoYXJlZC93b3JrZXJfdG9rZW59JwogICAgICAtICdNQU5BR0VEX1dPUktFUl9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1dPUktFUlNFQ1JFVH0nCiAgICAgIC0gJ1RSSUdHRVJfV09SS0xPQURfQVBJX0RPTUFJTj0ke1RSSUdHRVJfV09SS0xPQURfQVBJX0RPTUFJTn0nCiAgICAgIC0gVFJJR0dFUl9XT1JLTE9BRF9BUElfUE9SVF9FWFRFUk5BTD04MDIwCiAgICAgIC0gJ0RPQ0tFUl9IT1NUPXRjcDovL2RvY2tlci1wcm94eToyMzc1JwogICAgICAtICdET0NLRVJfUlVOTkVSX05FVFdPUktTPSR7RE9DS0VSX1JVTk5FUl9ORVRXT1JLU30nCiAgICAgIC0gJ0RPQ0tFUl9BVVRPUkVNT1ZFX0VYSVRFRF9DT05UQUlORVJTPSR7RE9DS0VSX0FVVE9SRU1PVkVfRVhJVEVEX0NPTlRBSU5FUlM6LTF9JwogICAgICAtICdET0NLRVJfUkVHSVNUUllfVVJMPWh0dHBzOi8vJHtERVBMT1lfUkVHSVNUUllfSE9TVDotZ2hjci5pb30nCiAgICAgIC0gJ0RPQ0tFUl9SRUdJU1RSWV9VU0VSTkFNRT0ke0RFUExPWV9SRUdJU1RSWV9VU0VSTkFNRX0nCiAgICAgIC0gJ0RPQ0tFUl9SRUdJU1RSWV9QQVNTV09SRD0ke0RFUExPWV9SRUdJU1RSWV9QQVNTV09SRH0nCiAgICAgIC0gRU5GT1JDRV9NQUNISU5FX1BSRVNFVFM9MQogICAgICAtIFRSSUdHRVJfREVRVUVVRV9JTlRFUlZBTF9NUz0xMDAwCiAgICAgIC0gJ0RFQlVHPSR7U1VQRVJWSVNPUl9ERUJVRzotMH0nCiAgICB2b2x1bWVzOgogICAgICAtICdzaGFyZWQtZGF0YTovaG9tZS9ub2RlL3NoYXJlZCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAicmVxdWlyZSgnaHR0cCcpLmdldCgnaHR0cDovLzEyNy4wLjAuMTo4MDIwL2hlYWx0aCcsKHIpPT5wcm9jZXNzLmV4aXQoci5zdGF0dXNDb2RlPT09MjAwPzA6MSkpLm9uKCdlcnJvcicsKCk9PnByb2Nlc3MuZXhpdCgxKSkiCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZGVwZW5kc19vbjoKICAgICAgdHJpZ2dlcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBkb2NrZXItcHJveHk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBkb2NrZXItcHJveHk6CiAgICBpbWFnZTogJ3RlY25hdGl2YS9kb2NrZXItc29ja2V0LXByb3h5OnYwLjQuMicKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrOnJvJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTE9HX0xFVkVMPWluZm8KICAgICAgLSAnUE9TVD0ke1BPU1Q6LTF9JwogICAgICAtICdDT05UQUlORVJTPSR7Q09OVEFJTkVSUzotMX0nCiAgICAgIC0gJ0lNQUdFUz0ke0lNQUdFUzotMX0nCiAgICAgIC0gJ0lORk89JHtJTkZPOi0xfScKICAgICAgLSAnTkVUV09SS1M9JHtORVRXT1JLUzotMX0nCiAgICAgIC0gJ0FVVEg9JHtBVVRIOi0xfScKICAgICAgLSAnRElTVFJJQlVUSU9OPSR7RElTVFJJQlVUSU9OOi0xfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnbmMgLXogMTI3LjAuMC4xIDIzNzUgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBwb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICBjb21tYW5kOgogICAgICAtICctYycKICAgICAgLSB3YWxfbGV2ZWw9bG9naWNhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi10cmlnZ2VyLWRifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjctYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAncmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgZWxlY3RyaWM6CiAgICBpbWFnZTogJ2VsZWN0cmljc3FsL2VsZWN0cmljOjEuMi45JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3Jlc3FsOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXNxbDo1NDMyLyR7UE9TVEdSRVNfREI6LXRyaWdnZXItZGJ9P3NzbG1vZGU9ZGlzYWJsZScKICAgICAgLSAnRUxFQ1RSSUNfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9FTEVDVFJJQ30nCiAgICAgIC0gRUxFQ1RSSUNfVVNBR0VfUkVQT1JUSU5HPWZhbHNlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6MzAwMC92MS9oZWFsdGgnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIGNsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjUuOCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdDTElDS0hPVVNFX1VTRVI9JHtTRVJWSUNFX1VTRVJfQ0xJQ0tIT1VTRX0nCiAgICAgIC0gJ0NMSUNLSE9VU0VfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0NMSUNLSE9VU0V9JwogICAgICAtIENMSUNLSE9VU0VfREVGQVVMVF9BQ0NFU1NfTUFOQUdFTUVOVD0xCiAgICB2b2x1bWVzOgogICAgICAtICdjbGlja2hvdXNlLWRhdGE6L3Zhci9saWIvY2xpY2tob3VzZScKICAgICAgLSAnY2xpY2tob3VzZS1sb2dzOi92YXIvbG9nL2NsaWNraG91c2Utc2VydmVyJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd3Z2V0IC0tbm8tdmVyYm9zZSAtLXRyaWVzPTEgLS1zcGlkZXIgaHR0cDovL2xvY2FsaG9zdDo4MTIzL3BpbmcgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUK",
+        "compose": "c2VydmljZXM6CiAgdHJpZ2dlcjoKICAgIGltYWdlOiAnZ2hjci5pby90cmlnZ2VyZG90ZGV2L3RyaWdnZXIuZGV2OnY0LjMuMCcKICAgIHVzZXI6IHJvb3QKICAgIGNvbW1hbmQ6ICJzaCAtYyBcImNob3duIC1SIG5vZGU6bm9kZSAvaG9tZS9ub2RlL3NoYXJlZCAmJiBleGVjIC4vc2NyaXB0cy9lbnRyeXBvaW50LnNoXCJcbiIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9UUklHR0VSXzMwMDAKICAgICAgLSAnQVBQX09SSUdJTj0ke1NFUlZJQ0VfRlFETl9UUklHR0VSfScKICAgICAgLSAnTE9HSU5fT1JJR0lOPSR7U0VSVklDRV9GUUROX1RSSUdHRVJ9JwogICAgICAtICdBUElfT1JJR0lOPSR7U0VSVklDRV9GUUROX1RSSUdHRVJ9JwogICAgICAtICdTRVNTSU9OX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfU0VTU0lPTn0nCiAgICAgIC0gJ01BR0lDX0xJTktfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9NQUdJQ0xJTkt9JwogICAgICAtICdFTkNSWVBUSU9OX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfRU5DUllQVElPTktFWX0nCiAgICAgIC0gJ01BTkFHRURfV09SS0VSX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfV09SS0VSU0VDUkVUfScKICAgICAgLSAnVFJJR0dFUl9XT1JLRVJfVE9LRU49JHtUUklHR0VSX1dPUktFUl9UT0tFTn0nCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIEFQUF9MT0dfTEVWRUw9aW5mbwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXNxbDovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzcWw6NTQzMi8ke1BPU1RHUkVTX0RCOi10cmlnZ2VyLWRifT9zY2hlbWE9cHVibGljJnNzbG1vZGU9ZGlzYWJsZScKICAgICAgLSAnRElSRUNUX1VSTD1wb3N0Z3Jlc3FsOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXNxbDo1NDMyLyR7UE9TVEdSRVNfREI6LXRyaWdnZXItZGJ9P3NjaGVtYT1wdWJsaWMmc3NsbW9kZT1kaXNhYmxlJwogICAgICAtIFJFRElTX0hPU1Q9cmVkaXMKICAgICAgLSBSRURJU19QT1JUPTYzNzkKICAgICAgLSBSRURJU19UTFNfRElTQUJMRUQ9dHJ1ZQogICAgICAtICdFTEVDVFJJQ19PUklHSU49aHR0cDovL2VsZWN0cmljOjMwMDAnCiAgICAgIC0gJ0RFVl9PVEVMX0VYUE9SVEVSX09UTFBfRU5EUE9JTlQ9JHtERVZfT1RFTF9FWFBPUlRFUl9PVExQX0VORFBPSU5UOi19JwogICAgICAtICdERVBMT1lfUkVHSVNUUllfSE9TVD0ke0RFUExPWV9SRUdJU1RSWV9IT1NUOi1naGNyLmlvfScKICAgICAgLSAnREVQTE9ZX1JFR0lTVFJZX1BST1RPQ09MPSR7REVQTE9ZX1JFR0lTVFJZX1BST1RPQ09MOi1odHRwc30nCiAgICAgIC0gJ0RFUExPWV9SRUdJU1RSWV9OQU1FU1BBQ0U9JHtERVBMT1lfUkVHSVNUUllfTkFNRVNQQUNFOi10cmlnZ2VyfScKICAgICAgLSAnVjRfREVQTE9ZX1JFR0lTVFJZX05BTUVTUEFDRT0ke0RFUExPWV9SRUdJU1RSWV9OQU1FU1BBQ0U6LXRyaWdnZXJ9JwogICAgICAtICdPQkpFQ1RfU1RPUkVfQkFTRV9VUkw9JHtPQkpFQ1RfU1RPUkVfQkFTRV9VUkx9JwogICAgICAtICdPQkpFQ1RfU1RPUkVfQUNDRVNTX0tFWV9JRD0ke09CSkVDVF9TVE9SRV9BQ0NFU1NfS0VZX0lEfScKICAgICAgLSAnT0JKRUNUX1NUT1JFX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7T0JKRUNUX1NUT1JFX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgLSAnQ0xJQ0tIT1VTRV9VUkw9aHR0cDovLyR7U0VSVklDRV9VU0VSX0NMSUNLSE9VU0V9OiR7U0VSVklDRV9QQVNTV09SRF82NF9DTElDS0hPVVNFfUBjbGlja2hvdXNlOjgxMjM/c2VjdXJlPWZhbHNlJwogICAgICAtIENMSUNLSE9VU0VfTE9HX0xFVkVMPWluZm8KICAgICAgLSBSVU5fUkVQTElDQVRJT05fRU5BQkxFRD0xCiAgICAgIC0gJ1JVTl9SRVBMSUNBVElPTl9DTElDS0hPVVNFX1VSTD1odHRwOi8vJHtTRVJWSUNFX1VTRVJfQ0xJQ0tIT1VTRX06JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0NMSUNLSE9VU0V9QGNsaWNraG91c2U6ODEyMycKICAgICAgLSBSVU5fUkVQTElDQVRJT05fTE9HX0xFVkVMPWluZm8KICAgICAgLSBUUklHR0VSX0JPT1RTVFJBUF9FTkFCTEVEPTEKICAgICAgLSBUUklHR0VSX0JPT1RTVFJBUF9XT1JLRVJfR1JPVVBfTkFNRT1ib290c3RyYXAKICAgICAgLSBUUklHR0VSX0JPT1RTVFJBUF9XT1JLRVJfVE9LRU5fUEFUSD0vaG9tZS9ub2RlL3NoYXJlZC93b3JrZXJfdG9rZW4KICAgICAgLSAnREVGQVVMVF9PUkdfRVhFQ1VUSU9OX0NPTkNVUlJFTkNZX0xJTUlUPSR7REVGQVVMVF9PUkdfRVhFQ1VUSU9OX0NPTkNVUlJFTkNZX0xJTUlUOi0zMDB9JwogICAgICAtICdERUZBVUxUX0VOVl9FWEVDVVRJT05fQ09OQ1VSUkVOQ1lfTElNSVQ9JHtERUZBVUxUX0VOVl9FWEVDVVRJT05fQ09OQ1VSUkVOQ1lfTElNSVQ6LTEwMH0nCiAgICAgIC0gJ0FVVEhfR0lUSFVCX0NMSUVOVF9JRD0ke0FVVEhfR0lUSFVCX0NMSUVOVF9JRDotfScKICAgICAgLSAnQVVUSF9HSVRIVUJfQ0xJRU5UX1NFQ1JFVD0ke0FVVEhfR0lUSFVCX0NMSUVOVF9TRUNSRVQ6LX0nCiAgICAgIC0gJ0VNQUlMX1RSQU5TUE9SVD0ke0VNQUlMX1RSQU5TUE9SVDotc210cH0nCiAgICAgIC0gJ1JFU0VORF9BUElfS0VZPSR7UkVTRU5EX0FQSV9LRVl9JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1R9JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlR9JwogICAgICAtICdTTVRQX1VTRVI9JHtTTVRQX1VTRVJ9JwogICAgICAtICdTTVRQX1BBU1NXT1JEPSR7U01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ1NNVFBfU0VDVVJFPSR7U01UUF9TRUNVUkV9JwogICAgICAtICdGUk9NX0VNQUlMPSR7RlJPTV9FTUFJTH0nCiAgICAgIC0gJ1JFUExZX1RPX0VNQUlMPSR7UkVQTFlfVE9fRU1BSUx9JwogICAgICAtICdXSElURUxJU1RFRF9FTUFJTFM9JHtXSElURUxJU1RFRF9FTUFJTFN9JwogICAgICAtICdBRE1JTl9FTUFJTFM9JHtBRE1JTl9FTUFJTFN9JwogICAgICAtIEdSQUNFRlVMX1NIVVRET1dOX1RJTUVPVVQ9MTAwMAogICAgICAtICdJTlRFUk5BTF9PVEVMX1RSQUNFX0xPR0dJTkdfRU5BQkxFRD0ke0lOVEVSTkFMX09URUxfVFJBQ0VfTE9HR0lOR19FTkFCTEVEOi0wfScKICAgICAgLSAnVFJJR0dFUl9URUxFTUVUUllfRElTQUJMRUQ9JHtUUklHR0VSX1RFTEVNRVRSWV9ESVNBQkxFRDotdHJ1ZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdzaGFyZWQtZGF0YTovaG9tZS9ub2RlL3NoYXJlZCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAicmVxdWlyZSgnaHR0cCcpLmdldCgnaHR0cDovLzEyNy4wLjAuMTozMDAwL2hlYWx0aGNoZWNrJywocik9PnByb2Nlc3MuZXhpdChyLnN0YXR1c0NvZGU9PT0yMDA/MDoxKSkub24oJ2Vycm9yJywoKT0+cHJvY2Vzcy5leGl0KDEpKSIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGVsZWN0cmljOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBzdXBlcnZpc29yOgogICAgaW1hZ2U6ICdnaGNyLmlvL3RyaWdnZXJkb3RkZXYvc3VwZXJ2aXNvcjp2NC4zLjAnCiAgICB1c2VyOiByb290CiAgICBjb21tYW5kOiAic2ggLWMgXCJjaG93biAtUiBub2RlOm5vZGUgL2hvbWUvbm9kZS9zaGFyZWQgJiYgZXhlYyAvdXNyL2Jpbi9kdW1iLWluaXQgLS0gcG5wbSBydW4gLS1maWx0ZXIgc3VwZXJ2aXNvciBzdGFydFwiXG4iCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnVFJJR0dFUl9BUElfVVJMPWh0dHA6Ly90cmlnZ2VyOjMwMDAnCiAgICAgIC0gJ09URUxfRVhQT1JURVJfT1RMUF9FTkRQT0lOVD1odHRwOi8vdHJpZ2dlcjozMDAwL290ZWwnCiAgICAgIC0gJ1RSSUdHRVJfV09SS0VSX1RPS0VOPSR7VFJJR0dFUl9XT1JLRVJfVE9LRU46LWZpbGU6Ly8vaG9tZS9ub2RlL3NoYXJlZC93b3JrZXJfdG9rZW59JwogICAgICAtICdNQU5BR0VEX1dPUktFUl9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1dPUktFUlNFQ1JFVH0nCiAgICAgIC0gJ1RSSUdHRVJfV09SS0xPQURfQVBJX0RPTUFJTj0ke1RSSUdHRVJfV09SS0xPQURfQVBJX0RPTUFJTn0nCiAgICAgIC0gVFJJR0dFUl9XT1JLTE9BRF9BUElfUE9SVF9FWFRFUk5BTD04MDIwCiAgICAgIC0gJ0RPQ0tFUl9IT1NUPXRjcDovL2RvY2tlci1wcm94eToyMzc1JwogICAgICAtICdET0NLRVJfUlVOTkVSX05FVFdPUktTPSR7RE9DS0VSX1JVTk5FUl9ORVRXT1JLU30nCiAgICAgIC0gJ0RPQ0tFUl9BVVRPUkVNT1ZFX0VYSVRFRF9DT05UQUlORVJTPSR7RE9DS0VSX0FVVE9SRU1PVkVfRVhJVEVEX0NPTlRBSU5FUlM6LTF9JwogICAgICAtICdET0NLRVJfUkVHSVNUUllfVVJMPWh0dHBzOi8vJHtERVBMT1lfUkVHSVNUUllfSE9TVDotZ2hjci5pb30nCiAgICAgIC0gJ0RPQ0tFUl9SRUdJU1RSWV9VU0VSTkFNRT0ke0RFUExPWV9SRUdJU1RSWV9VU0VSTkFNRX0nCiAgICAgIC0gJ0RPQ0tFUl9SRUdJU1RSWV9QQVNTV09SRD0ke0RFUExPWV9SRUdJU1RSWV9QQVNTV09SRH0nCiAgICAgIC0gRU5GT1JDRV9NQUNISU5FX1BSRVNFVFM9MQogICAgICAtIFRSSUdHRVJfREVRVUVVRV9JTlRFUlZBTF9NUz0xMDAwCiAgICAgIC0gJ0RFQlVHPSR7U1VQRVJWSVNPUl9ERUJVRzotMH0nCiAgICB2b2x1bWVzOgogICAgICAtICdzaGFyZWQtZGF0YTovaG9tZS9ub2RlL3NoYXJlZCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAicmVxdWlyZSgnaHR0cCcpLmdldCgnaHR0cDovLzEyNy4wLjAuMTo4MDIwL2hlYWx0aCcsKHIpPT5wcm9jZXNzLmV4aXQoci5zdGF0dXNDb2RlPT09MjAwPzA6MSkpLm9uKCdlcnJvcicsKCk9PnByb2Nlc3MuZXhpdCgxKSkiCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZGVwZW5kc19vbjoKICAgICAgdHJpZ2dlcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBkb2NrZXItcHJveHk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBkb2NrZXItcHJveHk6CiAgICBpbWFnZTogJ3RlY25hdGl2YS9kb2NrZXItc29ja2V0LXByb3h5OnYwLjQuMicKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrOnJvJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTE9HX0xFVkVMPWluZm8KICAgICAgLSAnUE9TVD0ke1BPU1Q6LTF9JwogICAgICAtICdDT05UQUlORVJTPSR7Q09OVEFJTkVSUzotMX0nCiAgICAgIC0gJ0lNQUdFUz0ke0lNQUdFUzotMX0nCiAgICAgIC0gJ0lORk89JHtJTkZPOi0xfScKICAgICAgLSAnTkVUV09SS1M9JHtORVRXT1JLUzotMX0nCiAgICAgIC0gJ0FVVEg9JHtBVVRIOi0xfScKICAgICAgLSAnRElTVFJJQlVUSU9OPSR7RElTVFJJQlVUSU9OOi0xfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnbmMgLXogMTI3LjAuMC4xIDIzNzUgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBwb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICBjb21tYW5kOgogICAgICAtICctYycKICAgICAgLSB3YWxfbGV2ZWw9bG9naWNhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi10cmlnZ2VyLWRifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjctYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAncmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgZWxlY3RyaWM6CiAgICBpbWFnZTogJ2VsZWN0cmljc3FsL2VsZWN0cmljOjEuMi45JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3Jlc3FsOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXNxbDo1NDMyLyR7UE9TVEdSRVNfREI6LXRyaWdnZXItZGJ9P3NzbG1vZGU9ZGlzYWJsZScKICAgICAgLSAnRUxFQ1RSSUNfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9FTEVDVFJJQ30nCiAgICAgIC0gRUxFQ1RSSUNfVVNBR0VfUkVQT1JUSU5HPWZhbHNlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6MzAwMC92MS9oZWFsdGgnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIGNsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjUuOCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdDTElDS0hPVVNFX1VTRVI9JHtTRVJWSUNFX1VTRVJfQ0xJQ0tIT1VTRX0nCiAgICAgIC0gJ0NMSUNLSE9VU0VfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0NMSUNLSE9VU0V9JwogICAgICAtIENMSUNLSE9VU0VfREVGQVVMVF9BQ0NFU1NfTUFOQUdFTUVOVD0xCiAgICB2b2x1bWVzOgogICAgICAtICdjbGlja2hvdXNlLWRhdGE6L3Zhci9saWIvY2xpY2tob3VzZScKICAgICAgLSAnY2xpY2tob3VzZS1sb2dzOi92YXIvbG9nL2NsaWNraG91c2Utc2VydmVyJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd3Z2V0IC0tbm8tdmVyYm9zZSAtLXRyaWVzPTEgLS1zcGlkZXIgaHR0cDovL2xvY2FsaG9zdDo4MTIzL3BpbmcgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUK",
         "tags": [
             "background-jobs",
             "typescript",
@@ -5650,7 +4821,7 @@
         "category": "automation",
         "logo": "svgs/trigger.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-01-07T19:01:32+01:00",
+        "template_last_updated_at": "2026-10-19T21:05:49+02:00",
         "port": "3000"
     },
     "triliumnext": {
@@ -5683,7 +4854,7 @@
         "category": "productivity",
         "logo": "svgs/twenty.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-03T17:29:34+02:00",
+        "template_last_updated_at": "2026-10-19T21:18:52+02:00",
         "port": "3000"
     },
     "typesense": {
@@ -5926,72 +5097,6 @@
         "template_last_updated_at": "2026-08-17T11:10:01+02:00",
         "port": "3456"
     },
-    "vvveb-with-mariadb": {
-        "documentation": "https://docs.vvveb.com?utm_source=coolify.io",
-        "slogan": "Powerful and easy to use cms to build websites, blogs or ecommerce stores.",
-        "compose": "c2VydmljZXM6CiAgdnZ2ZWI6CiAgICBpbWFnZTogJ3Z2dmViL3Z2dmViY21zOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Z2dmViLWRhdGE6L3Zhci93d3cvaHRtbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9WVlZFQl84MAogICAgICAtIERCX0VOR0lORT1teXNxbGkKICAgICAgLSBEQl9IT1NUPW1hcmlhZGIKICAgICAgLSAnREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9WVlZFQn0nCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9WVlZFQn0nCiAgICAgIC0gJ0RCX05BTUU9JHtNQVJJQURCX0RBVEFCQVNFOi12dnZlYn0nCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAndnZ2ZWItbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01BUklBREJfREFUQUJBU0U6LXZ2dmVifScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9WVlZFQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9WVlZFQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "ecommerce",
-            "page-builder",
-            "nocode",
-            "mysql",
-            "sqlite",
-            "pgsql"
-        ],
-        "category": "cms",
-        "logo": "svgs/vvveb.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
-    "vvveb-with-mysql": {
-        "documentation": "https://docs.vvveb.com?utm_source=coolify.io",
-        "slogan": "Powerful and easy to use cms to build websites, blogs or ecommerce stores.",
-        "compose": "c2VydmljZXM6CiAgdnZ2ZWI6CiAgICBpbWFnZTogJ3Z2dmViL3Z2dmViY21zOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Z2dmViLWRhdGE6L3Zhci93d3cvaHRtbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9WVlZFQl84MAogICAgICAtIERCX0VOR0lORT1teXNxbGkKICAgICAgLSBEQl9IT1NUPW15c3FsCiAgICAgIC0gJ0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfVlZWRUJ9JwogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfVlZWRUJ9JwogICAgICAtICdEQl9OQU1FPSR7TVlTUUxfREFUQUJBU0U6LXZ2dmVifScKICAgIGRlcGVuZHNfb246CiAgICAgIG15c3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAKICBteXNxbDoKICAgIGltYWdlOiAnbXlzcWw6OC40LjInCiAgICB2b2x1bWVzOgogICAgICAtICd2dnZlYi1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi12dnZlYn0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfVlZWRUJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfVlZWRUJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "ecommerce",
-            "page-builder",
-            "nocode",
-            "mysql",
-            "sqlite",
-            "pgsql"
-        ],
-        "category": "cms",
-        "logo": "svgs/vvveb.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
-    "vvveb": {
-        "documentation": "https://docs.vvveb.com?utm_source=coolify.io",
-        "slogan": "Powerful and easy to use cms to build websites, blogs or ecommerce stores.",
-        "compose": "c2VydmljZXM6CiAgdnZ2ZWI6CiAgICBpbWFnZTogJ3Z2dmViL3Z2dmViY21zOmxhdGVzdCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Z2dmViLWRhdGE6L3Zhci93d3cvaHRtbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9WVlZFQl84MAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "ecommerce",
-            "page-builder",
-            "nocode",
-            "mysql",
-            "sqlite",
-            "pgsql"
-        ],
-        "category": "cms",
-        "logo": "svgs/vvveb.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "80"
-    },
     "wakapi": {
         "documentation": "https://wakapi.dev/?utm_source=coolify.io",
         "slogan": "A minimalist, self-hosted WakaTime-compatible backend for coding statistics",
@@ -6064,7 +5169,7 @@
         "category": "productivity",
         "logo": "svgs/weblate.webp",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-12-31T17:36:41+02:00",
+        "template_last_updated_at": "2026-10-19T21:18:38+02:00",
         "port": "8080"
     },
     "whoogle": {
@@ -6096,23 +5201,6 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
-    "windmill": {
-        "documentation": "https://www.windmill.dev/docs/?utm_source=coolify.io",
-        "slogan": "Windmill is a developer platform to build production-grade multi-steps automations and internal apps.",
-        "compose": "c2VydmljZXM6CiAgZGI6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2JwogICAgc2htX3NpemU6IDFnCiAgICB2b2x1bWVzOgogICAgICAtICdkYi1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotd2luZG1pbGwtZGJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgd2luZG1pbGwtc2VydmVyOgogICAgaW1hZ2U6ICdnaGNyLmlvL3dpbmRtaWxsLWxhYnMvd2luZG1pbGw6bWFpbicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9XSU5ETUlMTF84MDAwCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QGRiLyR7UE9TVEdSRVNfREI6LXdpbmRtaWxsLWRifScKICAgICAgLSBNT0RFPXNlcnZlcgogICAgICAtICdCQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9XSU5ETUlMTH0nCiAgICBkZXBlbmRzX29uOgogICAgICBkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgdm9sdW1lczoKICAgICAgLSAnd29ya2VyLWxvZ3M6L3RtcC93aW5kbWlsbC9sb2dzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwMDAvaGVhbHRoJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgd2luZG1pbGwtd29ya2VyLTE6CiAgICBpbWFnZTogJ2doY3IuaW8vd2luZG1pbGwtbGFicy93aW5kbWlsbDptYWluJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QGRiLyR7UE9TVEdSRVNfREI6LXdpbmRtaWxsLWRifScKICAgICAgLSBNT0RFPXdvcmtlcgogICAgICAtIFdPUktFUl9HUk9VUD1kZWZhdWx0CiAgICBkZXBlbmRzX29uOgogICAgICBkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgdm9sdW1lczoKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICAgIC0gJ3dvcmtlci1kZXBlbmRlbmN5LWNhY2hlOi90bXAvd2luZG1pbGwvY2FjaGUnCiAgICAgIC0gJ3dvcmtlci1sb2dzOi90bXAvd2luZG1pbGwvbG9ncycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnZXhpdCAwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgd2luZG1pbGwtd29ya2VyLTI6CiAgICBpbWFnZTogJ2doY3IuaW8vd2luZG1pbGwtbGFicy93aW5kbWlsbDptYWluJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QGRiLyR7UE9TVEdSRVNfREI6LXdpbmRtaWxsLWRifScKICAgICAgLSBNT0RFPXdvcmtlcgogICAgICAtIFdPUktFUl9HUk9VUD1kZWZhdWx0CiAgICBkZXBlbmRzX29uOgogICAgICBkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgdm9sdW1lczoKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICAgIC0gJ3dvcmtlci1kZXBlbmRlbmN5LWNhY2hlOi90bXAvd2luZG1pbGwvY2FjaGUnCiAgICAgIC0gJ3dvcmtlci1sb2dzOi90bXAvd2luZG1pbGwvbG9ncycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnZXhpdCAwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgd2luZG1pbGwtd29ya2VyLTM6CiAgICBpbWFnZTogJ2doY3IuaW8vd2luZG1pbGwtbGFicy93aW5kbWlsbDptYWluJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QGRiLyR7UE9TVEdSRVNfREI6LXdpbmRtaWxsLWRifScKICAgICAgLSBNT0RFPXdvcmtlcgogICAgICAtIFdPUktFUl9HUk9VUD1kZWZhdWx0CiAgICBkZXBlbmRzX29uOgogICAgICBkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgdm9sdW1lczoKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICAgIC0gJ3dvcmtlci1kZXBlbmRlbmN5LWNhY2hlOi90bXAvd2luZG1pbGwvY2FjaGUnCiAgICAgIC0gJ3dvcmtlci1sb2dzOi90bXAvd2luZG1pbGwvbG9ncycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnZXhpdCAwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgd2luZG1pbGwtd29ya2VyLW5hdGl2ZToKICAgIGltYWdlOiAnZ2hjci5pby93aW5kbWlsbC1sYWJzL3dpbmRtaWxsOm1haW4nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AZGIvJHtQT1NUR1JFU19EQjotd2luZG1pbGwtZGJ9JwogICAgICAtIE1PREU9d29ya2VyCiAgICAgIC0gV09SS0VSX0dST1VQPW5hdGl2ZQogICAgICAtIE5VTV9XT1JLRVJTPTgKICAgICAgLSBTTEVFUF9RVUVVRT0yMDAKICAgIGRlcGVuZHNfb246CiAgICAgIGRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICB2b2x1bWVzOgogICAgICAtICd3b3JrZXItbG9nczovdG1wL3dpbmRtaWxsL2xvZ3MnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2V4aXQgMCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogIGxzcDoKICAgIGltYWdlOiAnZ2hjci5pby93aW5kbWlsbC1sYWJzL3dpbmRtaWxsLWxzcDpsYXRlc3QnCiAgICB2b2x1bWVzOgogICAgICAtICdsc3AtY2FjaGU6L3Jvb3QvLmNhY2hlJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdleGl0IDAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAyMHMK",
-        "tags": [
-            "windmill",
-            "workflow",
-            "automation",
-            "developer",
-            "platform"
-        ],
-        "category": "automation",
-        "logo": "svgs/windmill.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
-        "port": "8000"
-    },
     "wings": {
         "documentation": "https://pterodactyl.io/?utm_source=coolify.io",
         "slogan": "The server control plane for Pterodactyl Panel. Written from the ground-up with security, speed, and stability in mind.",
@@ -6146,56 +5234,6 @@
         "template_last_updated_at": "2026-01-05T15:54:25+01:00",
         "port": "8000"
     },
-    "wordpress-with-mariadb": {
-        "documentation": "https://wordpress.org?utm_source=coolify.io",
-        "slogan": "WordPress is open source software you can use to create a beautiful website, blog, or app.",
-        "compose": "c2VydmljZXM6CiAgd29yZHByZXNzOgogICAgaW1hZ2U6ICd3b3JkcHJlc3M6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnd29yZHByZXNzLWZpbGVzOi92YXIvd3d3L2h0bWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fV09SRFBSRVNTCiAgICAgIC0gV09SRFBSRVNTX0RCX0hPU1Q9bWFyaWFkYgogICAgICAtIFdPUkRQUkVTU19EQl9VU0VSPSRTRVJWSUNFX1VTRVJfV09SRFBSRVNTCiAgICAgIC0gV09SRFBSRVNTX0RCX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1dPUkRQUkVTUwogICAgICAtIFdPUkRQUkVTU19EQl9OQU1FPXdvcmRwcmVzcwogICAgZGVwZW5kc19vbjoKICAgICAgLSBtYXJpYWRiCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTVlTUUxfUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9ST09UCiAgICAgIC0gTVlTUUxfREFUQUJBU0U9d29yZHByZXNzCiAgICAgIC0gTVlTUUxfVVNFUj0kU0VSVklDRV9VU0VSX1dPUkRQUkVTUwogICAgICAtIE1ZU1FMX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1dPUkRQUkVTUwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "mariadb"
-        ],
-        "category": "cms",
-        "logo": "svgs/wordpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "wordpress-with-mysql": {
-        "documentation": "https://wordpress.org?utm_source=coolify.io",
-        "slogan": "WordPress is open source software you can use to create a beautiful website, blog, or app.",
-        "compose": "c2VydmljZXM6CiAgd29yZHByZXNzOgogICAgaW1hZ2U6ICd3b3JkcHJlc3M6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnd29yZHByZXNzLWZpbGVzOi92YXIvd3d3L2h0bWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fV09SRFBSRVNTCiAgICAgIC0gV09SRFBSRVNTX0RCX0hPU1Q9bXlzcWwKICAgICAgLSBXT1JEUFJFU1NfREJfVVNFUj0kU0VSVklDRV9VU0VSX1dPUkRQUkVTUwogICAgICAtIFdPUkRQUkVTU19EQl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9XT1JEUFJFU1MKICAgICAgLSBXT1JEUFJFU1NfREJfTkFNRT13b3JkcHJlc3MKICAgIGRlcGVuZHNfb246CiAgICAgIC0gbXlzcWwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMScKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxMAogIG15c3FsOgogICAgaW1hZ2U6ICdteXNxbDo4JwogICAgdm9sdW1lczoKICAgICAgLSAnbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUk9PVAogICAgICAtIE1ZU1FMX0RBVEFCQVNFPXdvcmRwcmVzcwogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9XT1JEUFJFU1MKICAgICAgLSBNWVNRTF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9XT1JEUFJFU1MKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management",
-            "mysql"
-        ],
-        "category": "cms",
-        "logo": "svgs/wordpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
-    "wordpress-without-database": {
-        "documentation": "https://wordpress.org?utm_source=coolify.io",
-        "slogan": "WordPress is open source software you can use to create a beautiful website, blog, or app.",
-        "compose": "c2VydmljZXM6CiAgd29yZHByZXNzOgogICAgaW1hZ2U6ICd3b3JkcHJlc3M6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnd29yZHByZXNzLWZpbGVzOi92YXIvd3d3L2h0bWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fV09SRFBSRVNTCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "cms",
-            "blog",
-            "content",
-            "management"
-        ],
-        "category": "cms",
-        "logo": "svgs/wordpress.svg",
-        "minversion": "0.0.0",
-        "template_last_updated_at": "2026-09-02T19:39:19+02:00",
-        "port": "80"
-    },
     "yamtrack-with-postgresql": {
         "documentation": "https://github.com/FuzzyGrim/Yamtrack/wiki?utm_source=coolify.io",
         "slogan": "Yamtrack is a self hosted media tracker for movies, tv shows, anime, manga, video games and books.",
diff --git a/tests/Feature/AdvisorySecurityRegressionTest.php b/tests/Feature/AdvisorySecurityRegressionTest.php
index 4c14ce379e..00e8098197 100644
--- a/tests/Feature/AdvisorySecurityRegressionTest.php
+++ b/tests/Feature/AdvisorySecurityRegressionTest.php
@@ -4,7 +4,6 @@ use App\Http\Controllers\Api\DatabasesController;
 use App\Http\Controllers\Api\ServiceApplicationsController;
 use App\Http\Controllers\Webhook\Concerns\MatchesManualWebhookApplications;
 use App\Http\Middleware\ApiAllowed;
-use App\Http\Middleware\ApiIpAllowed;
 use App\Models\EnvironmentVariable;
 use App\Models\InstanceSettings;
 use App\Models\Service;
@@ -59,9 +58,9 @@ it('applies only the IP allow-list, not the REST API switch, to MCP and MCP swit
         ->and($mcp->gatherMiddleware())->not->toContain(ApiAllowed::class)
         ->and($enable->gatherMiddleware())->not->toContain(ApiAllowed::class)
         ->and($disable->gatherMiddleware())->not->toContain(ApiAllowed::class)
-        ->and($mcp->gatherMiddleware())->toContain(ApiIpAllowed::class)
-        ->and($enable->gatherMiddleware())->toContain(ApiIpAllowed::class)
-        ->and($disable->gatherMiddleware())->toContain(ApiIpAllowed::class);
+        ->and($mcp->gatherMiddleware())->toContain('api.ip.allowed')
+        ->and($enable->gatherMiddleware())->toContain('api.ip.allowed')
+        ->and($disable->gatherMiddleware())->toContain('api.ip.allowed');
 });
 
 it('throttles only failed authentication on manual webhook routes', function (string $provider) {
diff --git a/tests/Feature/Api/ApplicationRollbackImagesApiTest.php b/tests/Feature/Api/ApplicationRollbackImagesApiTest.php
index 4e61000ba7..ac94113353 100644
--- a/tests/Feature/Api/ApplicationRollbackImagesApiTest.php
+++ b/tests/Feature/Api/ApplicationRollbackImagesApiTest.php
@@ -1,21 +1,13 @@
 <?php
 
-use App\Http\Controllers\Api\ApplicationsController;
-
-function currentRollbackImageTag(string $imageReference): ?string
-{
-    $method = new ReflectionMethod(ApplicationsController::class, 'currentRollbackImageTag');
-    $method->setAccessible(true);
-
-    return $method->invoke(null, $imageReference);
-}
+use App\Actions\Application\GetRollbackImages;
 
 it('extracts the current rollback image tag when the registry includes a port', function () {
-    expect(currentRollbackImageTag('registry.example.com:5000/team/application:commit-sha'))
+    expect(GetRollbackImages::imageTag('registry.example.com:5000/team/application:commit-sha'))
         ->toBe('commit-sha');
 });
 
 it('does not treat a digest as the current rollback image tag', function () {
-    expect(currentRollbackImageTag('registry.example.com:5000/team/application@sha256:'.str_repeat('a', 64)))
+    expect(GetRollbackImages::imageTag('registry.example.com:5000/team/application@sha256:'.str_repeat('a', 64)))
         ->toBeNull();
 });
diff --git a/tests/Feature/Api/ApplicationSettingsApiTest.php b/tests/Feature/Api/ApplicationSettingsApiTest.php
index 0b32f5bf07..6e46957222 100644
--- a/tests/Feature/Api/ApplicationSettingsApiTest.php
+++ b/tests/Feature/Api/ApplicationSettingsApiTest.php
@@ -295,6 +295,35 @@ test('deployment parsing keeps commas in raw custom label values', function () {
         ->and($this->application->fresh()->custom_labels)->toBe(base64_encode($labels));
 });
 
+test('http basic auth hash settings are saved and applied to managed labels', function () {
+    $this->application->update([
+        'fqdn' => 'https://app.example.com',
+        'is_http_basic_auth_enabled' => true,
+        'http_basic_auth_username' => 'api-user',
+        'http_basic_auth_password' => 'api-password',
+    ]);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", ['http_basic_auth_bcrypt_cost' => 4])
+        ->assertOk();
+
+    expect($this->application->fresh()->parseContainerLabels())->toContain('.basicauth.users=api-user:$2y$04$');
+});
+
+test('rejects http basic auth settings that are not supported', function (string $field, mixed $value) {
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [$field => $value])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors($field);
+})->with([
+    'Argon2id on a proxy without it' => ['http_basic_auth_hash_algorithm', 'argon2id'],
+    'unknown algorithm' => ['http_basic_auth_hash_algorithm', 'md5'],
+    'bcrypt cost above 14' => ['http_basic_auth_bcrypt_cost', 15],
+    'Argon2id memory above 256 MiB' => ['http_basic_auth_argon2id_memory_cost', 262145],
+    'Argon2id iterations above 12' => ['http_basic_auth_argon2id_time_cost', 13],
+    'password longer than 72 characters' => ['http_basic_auth_password', str_repeat('a', 73)],
+]);
+
 test('rejects invalid boolean application settings', function () {
     $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
         ->patchJson("/api/v1/applications/{$this->application->uuid}", [
diff --git a/tests/Feature/Api/BackupS3DestinationsApiTest.php b/tests/Feature/Api/BackupS3DestinationsApiTest.php
new file mode 100644
index 0000000000..5428dd51b7
--- /dev/null
+++ b/tests/Feature/Api/BackupS3DestinationsApiTest.php
@@ -0,0 +1,292 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $user = User::factory()->create();
+    $this->team->members()->attach($user->id, ['role' => 'owner']);
+
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 's3-destinations-test',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->headers = ['Authorization' => 'Bearer '.$token->getKey().'|'.$plainTextToken];
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->database = StandalonePostgresql::create([
+        'name' => 'db',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'app',
+        'image' => 'postgres:16',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $this->volume = LocalPersistentVolume::create([
+        'name' => 'data',
+        'mount_path' => '/data',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    $this->firstS3 = createBackupDestinationS3($this->team, 'first');
+    $this->secondS3 = createBackupDestinationS3($this->team, 'second');
+    $this->otherTeamS3 = createBackupDestinationS3(Team::factory()->create(), 'foreign');
+});
+
+function createBackupDestinationS3(Team $team, string $name): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => $name.'-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+}
+
+/**
+ * @return list<string>
+ */
+function backupDestinationUuids(ScheduledDatabaseBackup|ScheduledVolumeBackup $backup): array
+{
+    return $backup->refresh()->selectedS3Storages()->pluck('uuid')->all();
+}
+
+describe('database backups', function () {
+    test('creates a backup with several destinations and lists them primary first', function () {
+        $response = $this->withHeaders($this->headers)->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_uuids' => [$this->firstS3->uuid, $this->secondS3->uuid],
+            's3_storage_uuid' => $this->secondS3->uuid,
+        ])->assertCreated();
+
+        $backup = ScheduledDatabaseBackup::where('uuid', $response->json('uuid'))->sole();
+        expect($backup->s3_storage_id)->toBe($this->secondS3->id)
+            ->and(backupDestinationUuids($backup))->toBe([$this->secondS3->uuid, $this->firstS3->uuid]);
+
+        $this->withHeaders($this->headers)->getJson("/api/v1/databases/{$this->database->uuid}/backups")
+            ->assertOk()
+            ->assertJsonPath('0.s3_storage_uuid', $this->secondS3->uuid)
+            ->assertJsonPath('0.s3_storage_uuids', [$this->secondS3->uuid, $this->firstS3->uuid])
+            ->assertJsonMissingPath('0.s3_storages')
+            ->assertJsonMissingPath('0.s3');
+    });
+
+    test('uses the first listed destination as primary when s3_storage_uuid is not sent', function () {
+        $response = $this->withHeaders($this->headers)->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_uuids' => [$this->secondS3->uuid, $this->firstS3->uuid],
+        ])->assertCreated();
+
+        expect(ScheduledDatabaseBackup::where('uuid', $response->json('uuid'))->sole()->s3_storage_id)->toBe($this->secondS3->id);
+    });
+
+    test('a single s3_storage_uuid that is already a destination becomes primary and keeps the others', function () {
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'save_s3' => true,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+        $backup->syncS3Storages([$this->firstS3->id, $this->secondS3->id]);
+
+        $this->withHeaders($this->headers)->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+            'save_s3' => true,
+            's3_storage_uuid' => $this->secondS3->uuid,
+        ])->assertOk();
+
+        expect(backupDestinationUuids($backup))->toBe([$this->secondS3->uuid, $this->firstS3->uuid])
+            ->and($backup->s3_storage_id)->toBe($this->secondS3->id);
+    });
+
+    test('a single new s3_storage_uuid replaces every destination', function () {
+        $thirdS3 = createBackupDestinationS3($this->team, 'third');
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'save_s3' => true,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+        $backup->syncS3Storages([$this->firstS3->id, $this->secondS3->id]);
+
+        $this->withHeaders($this->headers)->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+            's3_storage_uuid' => $thirdS3->uuid,
+        ])->assertOk();
+
+        expect(backupDestinationUuids($backup))->toBe([$thirdS3->uuid])
+            ->and($backup->s3_storage_id)->toBe($thirdS3->id);
+    });
+
+    test('updates the destination list', function () {
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $this->withHeaders($this->headers)->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+            'save_s3' => true,
+            's3_storage_uuids' => [$this->firstS3->uuid, $this->secondS3->uuid],
+        ])->assertOk();
+
+        expect(backupDestinationUuids($backup))->toBe([$this->firstS3->uuid, $this->secondS3->uuid])
+            ->and((bool) $backup->save_s3)->toBeTrue();
+    });
+
+    test('rejects an S3 storage of another team without changing the backup', function () {
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_id' => $this->firstS3->id,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+        $backup->syncS3Storages([$this->firstS3->id]);
+
+        $this->withHeaders($this->headers)->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+            's3_storage_uuids' => [$this->firstS3->uuid, $this->otherTeamS3->uuid],
+        ])->assertUnprocessable()
+            ->assertJsonValidationErrors(['s3_storage_uuids'])
+            ->assertDontSee($this->otherTeamS3->name);
+
+        expect(backupDestinationUuids($backup))->toBe([$this->firstS3->uuid]);
+    });
+
+    test('rejects invalid destination combinations', function (array $payload, string $errorField) {
+        $payload = array_map(fn ($value) => is_array($value)
+            ? array_map(fn (string $name) => $this->{$name}->uuid, $value)
+            : (is_string($value) && property_exists($this, $value) ? $this->{$value}->uuid : $value), $payload);
+
+        $this->withHeaders($this->headers)->postJson("/api/v1/databases/{$this->database->uuid}/backups", ['frequency' => 'daily', ...$payload])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors([$errorField]);
+
+        expect(ScheduledDatabaseBackup::count())->toBe(0);
+    })->with([
+        'primary outside the list' => [['s3_storage_uuids' => ['firstS3'], 's3_storage_uuid' => 'secondS3'], 's3_storage_uuid'],
+        'save_s3 without destinations' => [['save_s3' => true, 's3_storage_uuids' => []], 's3_storage_uuid'],
+        'foreign storage in the list' => [['save_s3' => true, 's3_storage_uuids' => ['firstS3', 'otherTeamS3']], 's3_storage_uuids'],
+    ]);
+
+    test('rejects clearing the destinations of a backup that saves to S3', function () {
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_id' => $this->firstS3->id,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $this->withHeaders($this->headers)->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+            's3_storage_uuids' => [],
+        ])->assertUnprocessable();
+
+        expect($backup->refresh()->s3_storage_id)->toBe($this->firstS3->id);
+    });
+});
+
+describe('volume backups', function () {
+    test('sets several destinations and returns them primary first', function () {
+        $this->withHeaders($this->headers)
+            ->putJson("/api/v1/applications/{$this->application->uuid}/storages/{$this->volume->uuid}/backups", [
+                'frequency' => 'daily',
+                'save_s3' => true,
+                's3_storage_uuids' => [$this->firstS3->uuid, $this->secondS3->uuid],
+                's3_storage_uuid' => $this->secondS3->uuid,
+            ])
+            ->assertCreated()
+            ->assertJsonPath('s3_storage_uuid', $this->secondS3->uuid)
+            ->assertJsonPath('s3_storage_uuids', [$this->secondS3->uuid, $this->firstS3->uuid]);
+
+        expect(backupDestinationUuids(ScheduledVolumeBackup::sole()))->toBe([$this->secondS3->uuid, $this->firstS3->uuid]);
+    });
+
+    test('a single s3_storage_uuid replaces every destination', function () {
+        $url = "/api/v1/applications/{$this->application->uuid}/storages/{$this->volume->uuid}/backups";
+        $this->withHeaders($this->headers)->putJson($url, [
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_uuids' => [$this->firstS3->uuid, $this->secondS3->uuid],
+        ])->assertCreated();
+
+        $this->withHeaders($this->headers)->putJson($url, [
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_uuid' => $this->secondS3->uuid,
+        ])->assertOk()->assertJsonPath('s3_storage_uuids', [$this->secondS3->uuid]);
+
+        expect(backupDestinationUuids(ScheduledVolumeBackup::sole()))->toBe([$this->secondS3->uuid]);
+    });
+
+    test('rejects an S3 storage of another team', function () {
+        $this->withHeaders($this->headers)
+            ->putJson("/api/v1/applications/{$this->application->uuid}/storages/{$this->volume->uuid}/backups", [
+                'frequency' => 'daily',
+                'save_s3' => true,
+                's3_storage_uuids' => [$this->firstS3->uuid, $this->otherTeamS3->uuid],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors(['s3_storage_uuids'])
+            ->assertDontSee($this->otherTeamS3->name);
+
+        expect(ScheduledVolumeBackup::count())->toBe(0);
+    });
+
+    test('rejects a primary destination outside the list', function () {
+        $this->withHeaders($this->headers)
+            ->putJson("/api/v1/applications/{$this->application->uuid}/storages/{$this->volume->uuid}/backups", [
+                'frequency' => 'daily',
+                'save_s3' => true,
+                's3_storage_uuids' => [$this->firstS3->uuid],
+                's3_storage_uuid' => $this->secondS3->uuid,
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors(['s3_storage_uuid']);
+    });
+});
diff --git a/tests/Feature/Api/NotificationsApiTest.php b/tests/Feature/Api/NotificationsApiTest.php
index d6bb96d15a..d5f4908ed8 100644
--- a/tests/Feature/Api/NotificationsApiTest.php
+++ b/tests/Feature/Api/NotificationsApiTest.php
@@ -192,6 +192,31 @@ describe('PATCH /api/v1/notifications/*', function () {
             ->and($settings->deployment_failure_email_notifications)->toBeFalse();
     });
 
+    test('updates the deployment commit details email setting', function () {
+        $this->withHeaders(authHeaders($this->bearerToken))
+            ->getJson('/api/v1/notifications/email')
+            ->assertSuccessful()
+            ->assertJsonPath('deployment_commit_details_email_notifications', false);
+
+        $this->withHeaders(authHeaders($this->bearerToken))
+            ->patchJson('/api/v1/notifications/email', [
+                'deployment_commit_details_email_notifications' => true,
+            ])
+            ->assertSuccessful()
+            ->assertJsonPath('deployment_commit_details_email_notifications', true);
+
+        expect(EmailNotificationSettings::query()->where('team_id', $this->team->id)->value('deployment_commit_details_email_notifications'))->toBeTruthy();
+    });
+
+    test('validates the deployment commit details email setting', function () {
+        $this->withHeaders(authHeaders($this->bearerToken))
+            ->patchJson('/api/v1/notifications/email', [
+                'deployment_commit_details_email_notifications' => 'not-a-boolean',
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('deployment_commit_details_email_notifications');
+    });
+
     test('validates the smtp ehlo domain', function () {
         $this->withHeaders(authHeaders($this->bearerToken))
             ->patchJson('/api/v1/notifications/email', [
diff --git a/tests/Feature/Api/PrivateKeyUpdateApiTest.php b/tests/Feature/Api/PrivateKeyUpdateApiTest.php
new file mode 100644
index 0000000000..a525d872d4
--- /dev/null
+++ b/tests/Feature/Api/PrivateKeyUpdateApiTest.php
@@ -0,0 +1,64 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Testing\TestResponse;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    config()->set('cache.default', 'array');
+
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $this->keyMaterial = generateSSHKey('ed25519')['private'];
+    $this->key = PrivateKey::create(['name' => 'Old name', 'private_key' => $this->keyMaterial, 'team_id' => $this->team->id]);
+
+    $token = $this->user->createToken('write-token', ['write']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    $this->bearerToken = $token->plainTextToken;
+});
+
+function patchPrivateKeyUpdateApi(object $test, string $uuid, string $bearerToken, array $payload): TestResponse
+{
+    return $test->withHeaders(['Authorization' => 'Bearer '.$bearerToken])
+        ->patchJson('/api/v1/security/keys/'.$uuid, $payload);
+}
+
+test('a private key can be renamed without sending the key again', function () {
+    patchPrivateKeyUpdateApi($this, $this->key->uuid, $this->bearerToken, ['name' => 'New name', 'description' => 'Renamed'])
+        ->assertCreated();
+
+    $fresh = $this->key->fresh();
+    expect($fresh->name)->toBe('New name')
+        ->and($fresh->description)->toBe('Renamed')
+        ->and($fresh->private_key)->toBe($this->key->private_key)
+        ->and($fresh->fingerprint)->toBe($this->key->fingerprint);
+});
+
+test('a private key update still replaces and validates the key when it is sent', function () {
+    $newKey = generateSSHKey('ed25519')['private'];
+
+    patchPrivateKeyUpdateApi($this, $this->key->uuid, $this->bearerToken, ['private_key' => $newKey])->assertCreated();
+    expect($this->key->fresh()->fingerprint)->toBe(PrivateKey::generateFingerprint($newKey));
+
+    patchPrivateKeyUpdateApi($this, $this->key->uuid, $this->bearerToken, ['private_key' => 'not a key'])->assertUnprocessable();
+    expect($this->key->fresh()->fingerprint)->toBe(PrivateKey::generateFingerprint($newKey));
+});
+
+test('a private key of another team cannot be renamed', function () {
+    $otherTeam = Team::factory()->create();
+    $foreign = PrivateKey::create(['name' => 'Theirs', 'private_key' => generateSSHKey('ed25519')['private'], 'team_id' => $otherTeam->id]);
+
+    patchPrivateKeyUpdateApi($this, $foreign->uuid, $this->bearerToken, ['name' => 'Hijacked'])->assertNotFound();
+    expect($foreign->fresh()->name)->toBe('Theirs');
+});
diff --git a/tests/Feature/Api/ServerSubsystemsApiTest.php b/tests/Feature/Api/ServerSubsystemsApiTest.php
index 631ae83241..a131bf22ab 100644
--- a/tests/Feature/Api/ServerSubsystemsApiTest.php
+++ b/tests/Feature/Api/ServerSubsystemsApiTest.php
@@ -240,6 +240,89 @@ describe('Log drains API', function () {
         expect($this->server->settings->fresh()->logdrain_custom_config)->toBe("[OUTPUT]\n    Name stdout");
     });
 
+    test('PATCH enables the Amazon CloudWatch Logs drain', function () {
+        Queue::fake();
+
+        $this->withHeaders(serverSubsystemsHeaders())
+            ->patchJson("/api/v1/servers/{$this->server->uuid}/log-drains", [
+                'is_logdrain_cloudwatch_enabled' => true,
+                'logdrain_cloudwatch_group' => '/coolify/prod',
+                'logdrain_cloudwatch_region' => 'us-east-1',
+                'logdrain_cloudwatch_stream_prefix' => 'docker/',
+            ])
+            ->assertOk()
+            ->assertJsonPath('is_logdrain_cloudwatch_enabled', true)
+            ->assertJsonPath('logdrain_cloudwatch_group', '/coolify/prod')
+            ->assertJsonPath('logdrain_cloudwatch_stream_prefix', 'docker/');
+
+        $settings = $this->server->settings->fresh();
+        expect($settings->is_logdrain_cloudwatch_enabled)->toBeTrue()
+            ->and($settings->logdrain_cloudwatch_region)->toBe('us-east-1');
+    });
+
+    test('PATCH rejects enabling CloudWatch without a log group', function () {
+        Queue::fake();
+
+        $this->withHeaders(serverSubsystemsHeaders())
+            ->patchJson("/api/v1/servers/{$this->server->uuid}/log-drains", [
+                'is_logdrain_cloudwatch_enabled' => true,
+                'logdrain_cloudwatch_region' => 'us-east-1',
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('logdrain_cloudwatch_group');
+
+        expect($this->server->settings->fresh()->is_logdrain_cloudwatch_enabled)->toBeFalse();
+    });
+
+    test('PATCH rejects enabling CloudWatch without a region', function () {
+        Queue::fake();
+
+        $this->withHeaders(serverSubsystemsHeaders())
+            ->patchJson("/api/v1/servers/{$this->server->uuid}/log-drains", [
+                'is_logdrain_cloudwatch_enabled' => true,
+                'logdrain_cloudwatch_group' => 'coolify',
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('logdrain_cloudwatch_region');
+
+        expect($this->server->settings->fresh()->is_logdrain_cloudwatch_enabled)->toBeFalse();
+    });
+
+    test('PATCH rejects CloudWatch values that could break the compose file', function (string $field, mixed $value) {
+        Queue::fake();
+
+        $this->withHeaders(serverSubsystemsHeaders())
+            ->patchJson("/api/v1/servers/{$this->server->uuid}/log-drains", [
+                $field => $value,
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors($field);
+    })->with([
+        'prefix with interpolation' => ['logdrain_cloudwatch_stream_prefix', 'docker/${HOME}'],
+        'prefix with colon' => ['logdrain_cloudwatch_stream_prefix', 'docker:'],
+        'prefix with template braces' => ['logdrain_cloudwatch_stream_prefix', '{{.ID}}'],
+        'invalid region' => ['logdrain_cloudwatch_region', 'not a region'],
+        'group with spaces' => ['logdrain_cloudwatch_group', 'my group'],
+    ]);
+
+    test('PATCH rejects enabling CloudWatch together with another log drain', function () {
+        Queue::fake();
+        $this->server->settings->update([
+            'is_logdrain_axiom_enabled' => true,
+            'logdrain_axiom_dataset_name' => 'ds',
+            'logdrain_axiom_api_key' => 'key',
+        ]);
+
+        $this->withHeaders(serverSubsystemsHeaders())
+            ->patchJson("/api/v1/servers/{$this->server->uuid}/log-drains", [
+                'is_logdrain_cloudwatch_enabled' => true,
+                'logdrain_cloudwatch_group' => 'coolify',
+                'logdrain_cloudwatch_region' => 'us-east-1',
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('is_logdrain_cloudwatch_enabled');
+    });
+
     test('other-team log drains endpoints return 404', function () {
         $this->withHeaders(serverSubsystemsHeaders())
             ->getJson("/api/v1/servers/{$this->otherServer->uuid}/log-drains")
diff --git a/tests/Feature/Api/ServerTransferApiTest.php b/tests/Feature/Api/ServerTransferApiTest.php
index ad1f6d4387..c1d9aa536a 100644
--- a/tests/Feature/Api/ServerTransferApiTest.php
+++ b/tests/Feature/Api/ServerTransferApiTest.php
@@ -1,8 +1,13 @@
 <?php
 
+use App\Enums\ApplicationDeploymentStatus;
+use App\Jobs\MigrateServerToInstanceJob;
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Project;
@@ -10,18 +15,21 @@ use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
-use App\Services\ServerTransfer\ServerTransferBundle;
-use App\Services\ServerTransfer\ServerTransferClaimer;
 use App\Services\ServerTransfer\ServerTransferExporter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Once;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    config(['app.env' => 'local']);
-
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
     Storage::fake('ssh-keys');
 
     InstanceSettings::forceCreate([
@@ -38,6 +46,7 @@ beforeEach(function () {
     $this->sensitiveToken = $this->user->createToken('transfer-sensitive', ['*', 'read:sensitive'])->plainTextToken;
     $this->readToken = $this->user->createToken('transfer-read', ['read'])->plainTextToken;
     $this->writeToken = $this->user->createToken('transfer-write', ['read', 'write'])->plainTextToken;
+    $this->importToken = $this->user->createToken('transfer-import', ['read', 'write', 'deploy'])->plainTextToken;
 
     $this->privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
     $this->server = Server::factory()->create([
@@ -78,19 +87,19 @@ beforeEach(function () {
     });
 });
 
-test('server transfer API is unavailable outside development mode', function (string $method, string $uri) {
+test('server transfer API is available in production', function () {
     config(['app.env' => 'production']);
 
     $this->withHeaders(transferHeaders($this->sensitiveToken))
-        ->json($method, str_replace('{uuid}', $this->server->uuid, $uri))
-        ->assertNotFound();
-})->with([
-    ['POST', '/api/v1/servers/import'],
-    ['GET', '/api/v1/servers/{uuid}/export'],
-    ['POST', '/api/v1/servers/{uuid}/export/mailbox'],
-    ['POST', '/api/v1/servers/{uuid}/transfer/complete'],
-    ['POST', '/api/v1/servers/{uuid}/migrate'],
-]);
+        ->getJson("/api/v1/servers/{$this->server->uuid}/transfer")
+        ->assertOk()
+        ->assertJsonPath('server_uuid', $this->server->uuid);
+});
+
+function transferExportForApiTest(Server $server): array
+{
+    return app(ServerTransferExporter::class)->export($server);
+}
 
 function transferHeaders(string $token): array
 {
@@ -101,53 +110,15 @@ function transferHeaders(string $token): array
     ];
 }
 
-describe('GET /api/v1/servers/{uuid}/export', function () {
-    test('exports bundle with sensitive token', function () {
-        $response = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export");
-
-        $response->assertOk()
-            ->assertJsonPath('schema_version', ServerTransferBundle::SCHEMA_VERSION)
-            ->assertJsonPath('server.uuid', $this->server->uuid)
-            ->assertJsonPath('server.ip', '10.66.0.20');
-
-        $envs = collect($response->json('projects.0.environments.0.applications.0.environment_variables'));
-        $tokenEnv = $envs->firstWhere('key', 'API_TOKEN');
-
-        expect($response->json('private_key.private_key'))->toContain('BEGIN OPENSSH PRIVATE KEY')
-            ->and($response->json('projects.0.environments.0.applications.0.uuid'))->toBe($this->application->uuid)
-            ->and($tokenEnv)->not->toBeNull()
-            ->and($tokenEnv['value'])->toBe('token-value-123');
-    });
-
-    test('rejects token without read:sensitive', function () {
-        $this->withHeaders(transferHeaders($this->readToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->assertForbidden();
-    });
-
-    test('returns 404 for unknown or other team server uuid', function () {
-        $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson('/api/v1/servers/not-a-real-server-uuid/export')
-            ->assertNotFound();
-    });
-
-    test('can return passphrase-encrypted envelope', function () {
-        $response = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export?encrypt=1&passphrase=secret-pass");
-
-        $response->assertOk()
-            ->assertJsonPath('encrypted', true);
-
-        expect($response->json('payload'))->toBeString()->not->toBeEmpty();
-    });
-});
+test('the manual export endpoints no longer exist', function (string $path) {
+    $this->withHeaders(transferHeaders($this->sensitiveToken))
+        ->postJson("/api/v1/servers/{$this->server->uuid}{$path}", ['passphrase' => 'correct horse battery'])
+        ->assertNotFound();
+})->with(['/export', '/export/mailbox']);
 
 describe('POST /api/v1/servers/import', function () {
     test('dry run does not create resources', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $before = Server::count();
 
@@ -164,9 +135,7 @@ describe('POST /api/v1/servers/import', function () {
     });
 
     test('imports after source handoff and preserves application uuid', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $appUuid = $this->application->uuid;
         $serverUuid = $this->server->uuid;
@@ -195,51 +164,63 @@ describe('POST /api/v1/servers/import', function () {
             ->toBe('claimed');
     });
 
-    test('imports encrypted bundle with passphrase', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
-        $encrypted = ServerTransferBundle::encryptWithPassphrase($export, 'mailbox-pass');
-
-        $this->application->forceDelete();
-        $this->server->forceDelete();
-        $this->privateKey->delete();
-
-        $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->postJson('/api/v1/servers/import', [
-                'bundle' => $encrypted,
-                'passphrase' => 'mailbox-pass',
-            ])
-            ->assertCreated()
-            ->assertJsonPath('server_uuid', $export['server']['uuid']);
-    });
-
-    test('rejects encrypted bundle without passphrase', function () {
-        $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->postJson('/api/v1/servers/import', [
-                'bundle' => ['encrypted' => true, 'payload' => 'abc', 'schema_version' => 1],
-            ])
-            ->assertStatus(422);
-    });
-
     test('rejects import when ip still exists', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $this->withHeaders(transferHeaders($this->sensitiveToken))
             ->postJson('/api/v1/servers/import', ['bundle' => $export])
             ->assertStatus(422)
-            ->assertJsonPath('message', fn ($m) => str_contains($m, 'already exists') || str_contains(json_encode($m), 'already exists') || true);
+            ->assertJsonValidationErrors(['server.uuid']);
+    });
+
+    test('does not reveal the server of another team when the ip exists', function () {
+        $export = transferExportForApiTest($this->server);
+        $this->application->forceDelete();
+        $this->server->forceDelete();
+        $otherServer = Server::factory()->create([
+            'team_id' => Team::factory()->create()->id,
+            'private_key_id' => $this->privateKey->id,
+            'ip' => '10.66.0.20',
+        ]);
+
+        $response = $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson('/api/v1/servers/import', ['bundle' => $export])
+            ->assertStatus(422);
+
+        expect($response->getContent())->toContain('already exists')
+            ->not->toContain($otherServer->uuid);
+    });
+
+    test('rejects a bundle from a newer Coolify version', function () {
+        $export = transferExportForApiTest($this->server);
+        $export['coolify_version'] = '99.0.0';
+        $this->application->forceDelete();
+        $this->server->forceDelete();
+
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson('/api/v1/servers/import', ['bundle' => $export])
+            ->assertStatus(422)
+            ->assertJsonPath('errors.bundle.0', fn ($message) => str_contains($message, 'Upgrade this instance'));
+
+        expect(Server::where('uuid', $export['server']['uuid'])->exists())->toBeFalse();
+    });
+
+    test('adopt mode requires the original uuids', function () {
+        $export = transferExportForApiTest($this->server);
+        $this->application->forceDelete();
+        $this->server->forceDelete();
+
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson('/api/v1/servers/import', ['bundle' => $export, 'preserve_uuids' => false, 'adopt_mode' => true])
+            ->assertStatus(422)
+            ->assertJsonValidationErrors(['preserve_uuids']);
     });
 
     test('rejects import when the destination team is at its cloud server limit', function () {
         config()->set('constants.coolify.self_hosted', false);
         $this->team->update(['custom_server_limit' => 1]);
 
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $this->server->forceDelete();
         Server::factory()->create([
@@ -259,9 +240,7 @@ describe('POST /api/v1/servers/import', function () {
 
 describe('POST /api/v1/servers/import claim', function () {
     test('import takes management of the server and rebinds Sentinel', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $this->application->forceDelete();
         $this->server->forceDelete();
@@ -315,10 +294,7 @@ describe('POST /api/v1/servers/{uuid}/transfer/complete', function () {
 
 describe('full transfer flow A to B on same process', function () {
     test('export complete import sequence', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->assertOk()
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $this->withHeaders(transferHeaders($this->sensitiveToken))
             ->postJson("/api/v1/servers/{$this->server->uuid}/transfer/complete", [
@@ -358,15 +334,151 @@ describe('full transfer flow A to B on same process', function () {
     });
 });
 
-describe('ServerTransferClaimer unit-ish via container', function () {
-    test('writeMailbox returns path even when remote fails in tests', function () {
-        $claimer = app(ServerTransferClaimer::class);
-        $exporter = app(ServerTransferExporter::class);
-        $bundle = $exporter->export($this->server);
+describe('POST /api/v1/servers/{uuid}/migrate', function () {
+    test('starts the transfer in a queued job', function () {
+        Queue::fake();
+        Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
 
-        $result = $claimer->writeMailbox($this->server, $bundle, 'pass');
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/migrate", [
+                'target_url' => 'https://8.8.8.8',
+                'target_token' => 'target-token',
+            ])
+            ->assertStatus(202)
+            ->assertJsonPath('migration.status', 'running');
 
-        expect($result['path'])->toContain('/data/coolify/exports/server-transfer-')
-            ->and($result)->toHaveKey('written');
+        Queue::assertPushed(MigrateServerToInstanceJob::class, fn ($job) => $job->server->is($this->server) && $job->targetToken === 'target-token');
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->getJson("/api/v1/servers/{$this->server->uuid}/transfer")
+            ->assertOk()
+            ->assertJsonPath('migration.status', 'running')
+            ->assertJsonPath('migration.target_url', 'https://8.8.8.8');
+    });
+
+    test('rejects a target without https', function () {
+        Queue::fake();
+
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/migrate", [
+                'target_url' => 'http://8.8.8.8',
+                'target_token' => 'target-token',
+            ])
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'https'));
+
+        Queue::assertNothingPushed();
+    });
+
+    test('rejects a transfer while a deployment runs on the server', function () {
+        Queue::fake();
+        ApplicationDeploymentQueue::create([
+            'application_id' => (string) $this->application->id,
+            'deployment_uuid' => new_public_id(),
+            'server_id' => $this->server->id,
+            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
+        ]);
+
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/migrate", [
+                'target_url' => 'https://8.8.8.8',
+                'target_token' => 'target-token',
+            ])
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'deployment'));
+
+        Queue::assertNothingPushed();
     });
 });
+
+describe('GET /api/v1/servers/import/check', function () {
+    test('accepts a server that this instance can import and reach', function () {
+        $listener = stream_socket_server('tcp://127.0.0.1:0');
+        $port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+
+        $this->withHeaders(transferHeaders($this->importToken))
+            ->getJson("/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&port={$port}")
+            ->assertOk()
+            ->assertJsonPath('checks', fn ($checks) => collect($checks)->every(fn ($check) => $check['ok'] === true)
+                && collect($checks)->pluck('label')->contains("the target can reach the SSH port of the server (127.0.0.1:{$port})"));
+
+        fclose($listener);
+    });
+
+    test('rejects a server whose SSH port this instance cannot reach', function () {
+        $listener = stream_socket_server('tcp://127.0.0.1:0');
+        $port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+        fclose($listener);
+
+        $this->withHeaders(transferHeaders($this->importToken))
+            ->getJson("/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&port={$port}")
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'cannot reach the server at 127.0.0.1'));
+    });
+
+    test('rejects a target that is not an IP address or hostname before it opens a socket', function (string $ip) {
+        $this->withHeaders(transferHeaders($this->importToken))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip='.urlencode($ip))
+            ->assertStatus(422)
+            ->assertJsonValidationErrors('ip')
+            ->assertJsonMissingPath('checks');
+    })->with(['tcp://127.0.0.1', 'unix:///var/run/docker.sock', 'ssl://example.com']);
+
+    test('rejects another transfer bundle version', function () {
+        $this->withHeaders(transferHeaders($this->importToken))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&schema_version=999')
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'Upgrade both instances'));
+    });
+
+    test('lists every check with its result when a server already exists on this instance', function () {
+        $listener = stream_socket_server('tcp://127.0.0.1:0');
+        $port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+        $this->server->forceFill(['ip' => '127.0.0.1'])->save();
+
+        $checks = $this->withHeaders(transferHeaders($this->importToken))
+            ->getJson("/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&port={$port}")
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'already exists on this instance'))
+            ->json('checks');
+
+        expect(collect($checks)->pluck('ok', 'label')->all())->toMatchArray([
+            'the transfer bundle version is supported' => true,
+            'no server with the same UUID exists' => true,
+            'no server with the same IP exists' => false,
+            "the target can reach the SSH port of the server (127.0.0.1:{$port})" => true,
+        ]);
+        fclose($listener);
+    });
+
+    test('rejects a token without the write permission', function () {
+        $this->withHeaders(transferHeaders($this->readToken))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=10.66.0.99')
+            ->assertForbidden();
+    });
+
+    test('rejects a token without the deploy permission that the import needs', function () {
+        $this->withHeaders(transferHeaders($this->writeToken))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=10.66.0.99')
+            ->assertForbidden();
+    });
+
+    test('rejects an invalid token', function () {
+        $this->withHeaders(transferHeaders('1|not-a-real-token'))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=10.66.0.99')
+            ->assertUnauthorized();
+    });
+});
+
+test('the import check lists the system-wide git sources that this instance does not have', function () {
+    $present = GithubApp::create(['name' => 'present', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'team_id' => 0, 'is_system_wide' => true]);
+    $listener = stream_socket_server('tcp://127.0.0.1:0');
+    $port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+
+    $this->withHeaders(transferHeaders($this->importToken))
+        ->getJson("/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&port={$port}&system_github_apps[]={$present->uuid}&system_github_apps[]=missing-uuid&system_gitlab_apps[]=other-missing")
+        ->assertOk()
+        ->assertJsonPath('missing_system_sources.github', ['missing-uuid'])
+        ->assertJsonPath('missing_system_sources.gitlab', ['other-missing']);
+
+    fclose($listener);
+});
diff --git a/tests/Feature/Api/StateChangingRoutesUsePostTest.php b/tests/Feature/Api/StateChangingRoutesUsePostTest.php
index f48722d8fd..a44eb7d7ec 100644
--- a/tests/Feature/Api/StateChangingRoutesUsePostTest.php
+++ b/tests/Feature/Api/StateChangingRoutesUsePostTest.php
@@ -14,7 +14,6 @@ it('uses POST for state changes and keeps GET as a non-mutating compatibility re
         ->and($getRoute)->not->toBeNull()
         ->and($getRoute->getActionName())->toBe(OtherController::class.'@post_required');
 })->with([
-    'enable API' => 'api/v1/enable',
     'disable API' => 'api/v1/disable',
     'deploy' => 'api/v1/deploy',
     'validate server' => 'api/v1/servers/{uuid}/validate',
diff --git a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
index 7a57b91a2e..f17a59e5df 100644
--- a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
+++ b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
@@ -155,7 +155,7 @@ it('keeps deployment logging available if value formatting fails', function () {
     [$application, $server] = makeDeploymentControlVarFixture();
     $variable = new class extends EnvironmentVariable
     {
-        public function logRedactionValues(): array
+        public function logRedactionValues(?Collection $sharedVariables = null): array
         {
             throw new RuntimeException('Harmless formatting failure');
         }
@@ -1546,7 +1546,7 @@ it('builds railpack variables from generic buildtime vars railpack vars and cool
     expect($variables->get('APP_ENV'))->toBe('production');
     expect($variables->get('RAILPACK_NODE_VERSION'))->toBe('20');
     expect($variables->get('RAILPACK_INSTALL_CMD'))->toBe('pnpm install --frozen-lockfile');
-    expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('curl wget');
+    expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('... curl wget');
     expect($variables->get('COOLIFY_RESOURCE_UUID'))->toBe($application->uuid);
     expect($variables->has('NIXPACKS_NODE_VERSION'))->toBeFalse();
     expect($variables->has('RUNTIME_ONLY'))->toBeFalse();
@@ -1631,7 +1631,7 @@ it('builds preview railpack variables without leaking stale nixpacks vars', func
 
     expect($variables->get('PREVIEW_BUILD_FLAG'))->toBe('enabled');
     expect($variables->get('RAILPACK_NODE_VERSION'))->toBe('20');
-    expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('curl wget');
+    expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('... curl wget');
     expect($variables->get('COOLIFY_RESOURCE_UUID'))->toBe($application->uuid);
     expect($variables->has('NIXPACKS_NODE_VERSION'))->toBeFalse();
     expect($variables->has('PREVIEW_RUNTIME_ONLY'))->toBeFalse();
diff --git a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
index d842d7c546..3d163f1a81 100644
--- a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
+++ b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
@@ -122,6 +122,26 @@ test('switching from railpack to compose preserves the existing application doma
         ->toBe('https://example.com,https://www.example.com');
 });
 
+test('Dockerfile location defaults to the Dockerfile only for the Dockerfile build pack', function (string $buildPack, ?string $expected) {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => $buildPack,
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->assertSuccessful()
+        ->assertSet('dockerfileLocation', $expected);
+})->with([
+    'Dockerfile' => ['dockerfile', '/Dockerfile'],
+    'Nixpacks' => ['nixpacks', null],
+]);
+
 test('networking section hints that internal ports can be set per domain', function () {
     $application = Application::factory()->create([
         'environment_id' => $this->environment->id,
diff --git a/tests/Feature/ApplicationGpuSettingsTest.php b/tests/Feature/ApplicationGpuSettingsTest.php
new file mode 100644
index 0000000000..0f32b3f8b2
--- /dev/null
+++ b/tests/Feature/ApplicationGpuSettingsTest.php
@@ -0,0 +1,175 @@
+<?php
+
+use App\Livewire\Project\Application\Advanced;
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\Environment;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function createApplicationForGpuSettingsTest(): Application
+{
+    $team = Team::factory()->create();
+    $team->members()->attach(auth()->id(), ['role' => 'owner']);
+    session(['currentTeam' => $team]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    return Application::create([
+        'name' => 'gpu-settings-test-app',
+        'git_repository' => 'https://github.com/coollabsio/coolify',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $server->standaloneDockers()->firstOrFail()->id,
+        'destination_type' => $server->standaloneDockers()->firstOrFail()->getMorphClass(),
+    ]);
+}
+
+it('builds a valid compose device request from the GPU settings', function (array $settings, array $expected) {
+    $setting = new ApplicationSetting(['gpu_driver' => 'nvidia', ...$settings]);
+
+    expect($setting->gpuDeviceReservation())->toBe($expected);
+})->with([
+    'all gpus' => [[], ['capabilities' => ['gpu'], 'driver' => 'nvidia']],
+    'count' => [['gpu_count' => '2'], ['capabilities' => ['gpu'], 'driver' => 'nvidia', 'count' => 2]],
+    'count all' => [['gpu_count' => 'all'], ['capabilities' => ['gpu'], 'driver' => 'nvidia', 'count' => 'all']],
+    'device ids' => [['gpu_device_ids' => '0, 2,'], ['capabilities' => ['gpu'], 'driver' => 'nvidia', 'device_ids' => ['0', '2']]],
+    'count wins over device ids' => [['gpu_count' => '1', 'gpu_device_ids' => '0'], ['capabilities' => ['gpu'], 'driver' => 'nvidia', 'count' => 1]],
+    'blank driver' => [['gpu_driver' => ''], ['capabilities' => ['gpu']]],
+    'key=value options' => [['gpu_options' => "virtualization=false\nfoo = bar"], ['capabilities' => ['gpu'], 'driver' => 'nvidia', 'options' => ['virtualization' => 'false', 'foo' => 'bar']]],
+    'option value with commas' => [['gpu_options' => 'capabilities=compute,utility'], ['capabilities' => ['gpu'], 'driver' => 'nvidia', 'options' => ['capabilities' => 'compute,utility']]],
+    'yaml options' => [['gpu_options' => "virtualization: false\nlevel: 2"], ['capabilities' => ['gpu'], 'driver' => 'nvidia', 'options' => ['virtualization' => 'false', 'level' => '2']]],
+    'empty options' => [['gpu_options' => ''], ['capabilities' => ['gpu'], 'driver' => 'nvidia']],
+    'invalid options are left out' => [['gpu_options' => 'not an option'], ['capabilities' => ['gpu'], 'driver' => 'nvidia']],
+]);
+
+describe('advanced GPU form', function () {
+    beforeEach(function () {
+        $this->actingAs(User::factory()->create());
+    });
+
+    it('saves valid GPU options', function () {
+        $application = createApplicationForGpuSettingsTest();
+
+        Livewire::test(Advanced::class, ['application' => $application])
+            ->set('gpuCount', '2')
+            ->set('gpuOptions', 'virtualization=false')
+            ->call('submit')
+            ->assertDispatched('success');
+
+        $settings = $application->settings()->first();
+        expect($settings->gpu_count)->toBe('2')
+            ->and($settings->gpu_options)->toBe('virtualization=false');
+    });
+
+    it('rejects invalid GPU values', function (string $property, string $value) {
+        $application = createApplicationForGpuSettingsTest();
+
+        Livewire::test(Advanced::class, ['application' => $application])
+            ->set($property, $value)
+            ->call('submit')
+            ->assertDispatched('error')
+            ->assertNotDispatched('success');
+    })->with([
+        'count' => ['gpuCount', 'two'],
+        'options' => ['gpuOptions', 'not an option'],
+    ]);
+
+    it('does not block other settings when a stored GPU value is invalid', function () {
+        $application = createApplicationForGpuSettingsTest();
+        $application->settings->update(['gpu_options' => 'legacy value', 'gpu_count' => 'some']);
+
+        Livewire::test(Advanced::class, ['application' => $application->fresh()])
+            ->set('includeSourceCommitInBuild', true)
+            ->call('submit')
+            ->assertDispatched('success');
+
+        expect($application->settings()->first()->include_source_commit_in_build)->toBeTrue();
+    });
+
+    it('keeps a stored GPU count and device IDs pair when other settings are saved', function () {
+        $application = createApplicationForGpuSettingsTest();
+        $application->settings->update(['gpu_count' => '1', 'gpu_device_ids' => '0']);
+
+        Livewire::test(Advanced::class, ['application' => $application->fresh()])
+            ->set('includeSourceCommitInBuild', true)
+            ->call('submit')
+            ->assertDispatched('success');
+
+        $settings = $application->settings()->first();
+        expect($settings->gpu_count)->toBe('1')
+            ->and($settings->gpu_device_ids)->toBe('0')
+            ->and($settings->include_source_commit_in_build)->toBeTrue();
+    });
+
+    it('refreshes the GPUs of the application server', function () {
+        $application = createApplicationForGpuSettingsTest();
+        $server = $application->destination->server;
+        $server->update(['private_key_id' => PrivateKey::factory()->create(['team_id' => $server->team_id])->id]);
+        $server->settings->update(['is_reachable' => true, 'is_usable' => true]);
+        Process::fake(['*' => Process::result(output: "---GPUS---\n0, GPU-1a2b, 81559, NVIDIA H100\n---NVIDIA_TOOLKIT---\n/usr/bin/nvidia-ctk")]);
+
+        Livewire::test(Advanced::class, ['application' => $application])
+            ->call('refreshGpus')
+            ->assertDispatched('success')
+            ->assertSee('NVIDIA H100');
+
+        expect($server->fresh()->detectedGpus())->toBe([['index' => '0', 'uuid' => 'GPU-1a2b', 'memory_mb' => 81559, 'name' => 'NVIDIA H100']]);
+    });
+
+    it('does not refresh GPUs when no server is validated', function () {
+        $application = createApplicationForGpuSettingsTest();
+        $application->destination->server->settings->update(['is_reachable' => false, 'is_usable' => false]);
+        Process::fake();
+
+        Livewire::test(Advanced::class, ['application' => $application])
+            ->call('refreshGpus')
+            ->assertDispatched('error')
+            ->assertNotDispatched('success');
+
+        Process::assertNothingRan();
+    });
+
+    it('does not let a team member refresh GPUs', function () {
+        $application = createApplicationForGpuSettingsTest();
+        $server = $application->destination->server;
+        $server->settings->update(['is_reachable' => true, 'is_usable' => true]);
+        $member = User::factory()->create();
+        $application->team()->members()->attach($member->id, ['role' => 'member']);
+        $this->actingAs($member);
+        Process::fake();
+
+        Livewire::test(Advanced::class, ['application' => $application])
+            ->call('refreshGpus')
+            ->assertNotDispatched('success');
+
+        Process::assertNothingRan();
+        expect($server->fresh()->detectedGpus())->toBeNull();
+    });
+
+    it('rejects a change that sets both GPU count and device IDs without clearing stored values', function () {
+        $application = createApplicationForGpuSettingsTest();
+        $application->settings->update(['gpu_device_ids' => '0']);
+
+        Livewire::test(Advanced::class, ['application' => $application->fresh()])
+            ->set('gpuCount', '2')
+            ->call('submit')
+            ->assertDispatched('error')
+            ->assertNotDispatched('success');
+
+        $settings = $application->settings()->first();
+        expect($settings->gpu_count)->toBeNull()
+            ->and($settings->gpu_device_ids)->toBe('0');
+    });
+});
diff --git a/tests/Feature/ApplicationHttpBasicAuthUiTest.php b/tests/Feature/ApplicationHttpBasicAuthUiTest.php
index 78d42bd481..666cddec44 100644
--- a/tests/Feature/ApplicationHttpBasicAuthUiTest.php
+++ b/tests/Feature/ApplicationHttpBasicAuthUiTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Enums\ProxyTypes;
 use App\Livewire\Project\Application\General;
 use App\Models\Application;
 use App\Models\Environment;
@@ -16,6 +17,7 @@ use Livewire\Livewire;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    Server::flushIdentityMap();
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
@@ -47,9 +49,12 @@ uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
         ?? StandaloneDocker::factory()->create(['server_id' => $this->server->id, 'network' => 'coolify-test']);
 });
 
+afterEach(fn () => Server::flushIdentityMap());
+
 function createApplicationForHttpBasicAuth(array $overrides = []): Application
 {
     return Application::factory()->create(array_merge([
+        'name' => 'Basic Auth App',
         'environment_id' => test()->environment->id,
         'destination_id' => test()->destination->id,
         'destination_type' => StandaloneDocker::class,
@@ -112,3 +117,68 @@ test('disabling http basic auth is saved instantly', function () {
 
     expect((bool) $application->is_http_basic_auth_enabled)->toBeFalse();
 });
+
+function useCaddyProxyForHttpBasicAuth(string $image): void
+{
+    test()->server->forceFill(['proxy' => [
+        'type' => ProxyTypes::CADDY->value,
+        'status' => 'running',
+        'last_saved_settings' => 'applied',
+        'last_applied_settings' => 'applied',
+        'last_saved_proxy_configuration' => "services:\n  caddy:\n    image: '{$image}'\n",
+    ]])->save();
+}
+
+test('changing the bcrypt cost factor is saved instantly and applied to the proxy labels', function () {
+    $application = createApplicationForHttpBasicAuth(['fqdn' => 'https://app.example.com']);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->set('httpBasicAuthBcryptCost', 4)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $application->refresh();
+
+    expect($application->http_basic_auth_bcrypt_cost)->toBe(4)
+        ->and(base64_decode($application->custom_labels))->toContain('.basicauth.users=admin:$2y$04$');
+});
+
+test('selecting Argon2id is saved instantly and applied to the Caddy labels', function () {
+    useCaddyProxyForHttpBasicAuth('lucaslorentz/caddy-docker-proxy:2.13-alpine');
+    $application = createApplicationForHttpBasicAuth(['fqdn' => 'https://app.example.com']);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->set('httpBasicAuthHashAlgorithm', 'argon2id')
+        ->set('httpBasicAuthArgon2idMemoryCost', 8192)
+        ->call('instantSave')
+        ->assertDispatched('success')
+        ->assertSee('Iterations')
+        ->assertDontSee('Cost factor');
+
+    expect(base64_decode($application->refresh()->custom_labels))
+        ->toContain('caddy_0.basic_auth=argon2id', 'caddy_0.basic_auth.admin="$argon2id$v=19$m=8192,t=4,p=1$');
+});
+
+test('http basic auth form explains why Argon2id cannot be selected', function (?string $image, string $reason) {
+    if ($image !== null) {
+        useCaddyProxyForHttpBasicAuth($image);
+    }
+
+    Livewire::test(General::class, ['application' => createApplicationForHttpBasicAuth()])
+        ->assertSee($reason);
+})->with([
+    'Traefik' => [null, 'Only supported by the Caddy proxy'],
+    'Caddy 2.10' => ['lucaslorentz/caddy-docker-proxy:2.10-alpine', 'Needs Caddy 2.11 or newer on this server'],
+]);
+
+test('an unsupported http basic auth setting is rejected', function (string $property, mixed $value) {
+    Livewire::test(General::class, ['application' => createApplicationForHttpBasicAuth()])
+        ->set($property, $value)
+        ->call('instantSave')
+        ->assertDispatched('error')
+        ->assertNotDispatched('success');
+})->with([
+    'Argon2id on a proxy without it' => ['httpBasicAuthHashAlgorithm', 'argon2id'],
+    'bcrypt cost above 14' => ['httpBasicAuthBcryptCost', 15],
+    'password longer than 72 characters' => ['httpBasicAuthPassword', str_repeat('a', 73)],
+]);
diff --git a/tests/Feature/ApplicationSourceCrossTeamTest.php b/tests/Feature/ApplicationSourceCrossTeamTest.php
index 5d6fd1c3dc..9dd7633d0f 100644
--- a/tests/Feature/ApplicationSourceCrossTeamTest.php
+++ b/tests/Feature/ApplicationSourceCrossTeamTest.php
@@ -3,6 +3,7 @@
 use App\Livewire\Project\Application\Source;
 use App\Models\Application;
 use App\Models\Environment;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
@@ -242,3 +243,47 @@ describe('after the user switches the session team', function () {
         expect($this->applicationA->refresh()->source_id)->toBe($this->systemWideGithubApp->id);
     });
 });
+
+function applicationSourceGiteaAppForTeam(int $teamId, string $name): GiteaApp
+{
+    // Http::GitSource() pins DNS before Http::fake() answers, so use an IP literal.
+    return GiteaApp::create([
+        'name' => $name,
+        'team_id' => $teamId,
+        'api_url' => 'https://1.1.1.1/api/v1',
+        'html_url' => 'https://1.1.1.1',
+        'access_token' => 'gitea-access-token',
+        'refresh_token' => 'gitea-refresh-token',
+        'expires_at' => time() + 3600,
+        'is_public' => false,
+    ]);
+}
+
+test('changeSource switches to an owned GiteaApp and stores the Gitea repository id', function () {
+    Http::fake([
+        '1.1.1.1/api/v1/repos/acme/web' => Http::response(['id' => 314, 'full_name' => 'acme/web']),
+    ]);
+    $source = applicationSourceGiteaAppForTeam($this->teamA->id, 'own-gitea-app');
+    $this->applicationA->update(['git_repository' => 'acme/web']);
+
+    Livewire::test(Source::class, ['application' => $this->applicationA->fresh()])
+        ->call('changeSource', $source->id, GiteaApp::class)
+        ->assertDispatched('configurationChanged');
+
+    $this->applicationA->refresh();
+    expect($this->applicationA->source_type)->toBe(GiteaApp::class)
+        ->and($this->applicationA->source_id)->toBe($source->id)
+        ->and($this->applicationA->repository_project_id)->toBe(314);
+});
+
+test('changeSource rejects a GiteaApp owned by another team', function () {
+    Http::fake();
+    $victimSource = applicationSourceGiteaAppForTeam($this->teamB->id, 'victim-gitea-app');
+
+    Livewire::test(Source::class, ['application' => $this->applicationA])
+        ->call('changeSource', $victimSource->id, GiteaApp::class);
+
+    $this->applicationA->refresh();
+    expect($this->applicationA->source_type)->not->toBe(GiteaApp::class);
+    Http::assertNothingSent();
+});
diff --git a/tests/Feature/Auth/PasskeyAccessTest.php b/tests/Feature/Auth/PasskeyAccessTest.php
new file mode 100644
index 0000000000..8d2a9d5fca
--- /dev/null
+++ b/tests/Feature/Auth/PasskeyAccessTest.php
@@ -0,0 +1,98 @@
+<?php
+
+use App\Models\AuditEvent;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Once;
+use Laravel\Passkeys\Events\PasskeyDeleted;
+use Laravel\Passkeys\Events\PasskeyRegistered;
+use Laravel\Passkeys\Events\PasskeyVerified;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+    $this->withoutVite();
+    Log::spy();
+
+    $this->user = User::factory()->create(['name' => 'Passkey User']);
+    $this->team = $this->user->teams()->sole();
+});
+
+it('allows the authenticated passkey paths for unsubscribed and boarding accounts', function () {
+    expect(allowedPathsForBoardingAccounts())->toContain(
+        'user/passkeys',
+        'user/passkeys/options',
+        'passkeys/confirm',
+        'passkeys/confirm/options',
+        'profile/passkeys/confirm',
+    );
+});
+
+it('sets the session team after a login that did not set one', function () {
+    $this->actingAs($this->user)->get('/profile')->assertOk();
+
+    expect(session('currentTeam')->id)->toBe($this->team->id);
+});
+
+it('sends a multi team user without a stored team to the team selection', function () {
+    $other = Team::factory()->create();
+    $other->members()->attach($this->user->id, ['role' => 'member']);
+
+    $this->actingAs($this->user)->get('/profile')->assertRedirect(route('team.select'));
+});
+
+it('asks for the password before the add passkey form opens', function () {
+    $this->actingAs($this->user)
+        ->withSession(['currentTeam' => $this->team])
+        ->get(route('profile.passkeys.confirm'))
+        ->assertRedirect(route('password.confirm'));
+
+    $this->actingAs($this->user)
+        ->withSession(['currentTeam' => $this->team, 'auth.password_confirmed_at' => time()])
+        ->get(route('profile.passkeys.confirm'))
+        ->assertRedirect(route('profile'))
+        ->assertSessionHas('status', 'passkey-add');
+});
+
+it('lets restricted accounts confirm their password before adding a passkey', function (bool $selfHosted) {
+    config()->set('constants.coolify.self_hosted', $selfHosted);
+    $this->team->update(['show_boarding' => true]);
+    $this->actingAs($this->user)->withSession(['currentTeam' => $this->team]);
+
+    $this->get(route('profile.passkeys.confirm'))->assertRedirect(route('password.confirm'));
+    $this->get(route('password.confirm'))->assertOk();
+    $this->post(route('password.confirm.store'), ['password' => 'wrong-password'])
+        ->assertSessionHasErrors('password');
+    expect(session('auth.password_confirmed_at'))->toBeNull();
+
+    $this->post(route('password.confirm.store'), ['password' => 'password'])
+        ->assertRedirect(route('profile.passkeys.confirm'));
+    expect(session('auth.password_confirmed_at'))->toBeInt();
+    $this->get(route('profile.passkeys.confirm'))
+        ->assertRedirect(route('profile'))
+        ->assertSessionHas('status', 'passkey-add');
+    $this->getJson(route('passkey.registration-options'))->assertOk();
+})->with(['onboarding' => true, 'cloud without a subscription' => false]);
+
+it('records audit events for passkey changes', function (string $eventClass, string $auditName) {
+    $passkey = $this->user->passkeys()->create([
+        'name' => 'Laptop',
+        'credential_id' => 'credential-1',
+        'credential' => ['aaguid' => '00000000-0000-0000-0000-000000000000'],
+    ]);
+
+    event(new $eventClass($this->user, $passkey));
+
+    expect(AuditEvent::query()->where('event', $auditName)->count())->toBe(1);
+})->with([
+    [PasskeyRegistered::class, 'auth.user.passkey_registered'],
+    [PasskeyVerified::class, 'auth.user.passkey_verified'],
+    [PasskeyDeleted::class, 'auth.user.passkey_deleted'],
+]);
diff --git a/tests/Feature/Auth/PasskeyInstanceToggleTest.php b/tests/Feature/Auth/PasskeyInstanceToggleTest.php
new file mode 100644
index 0000000000..facac26208
--- /dev/null
+++ b/tests/Feature/Auth/PasskeyInstanceToggleTest.php
@@ -0,0 +1,39 @@
+<?php
+
+use App\Livewire\Settings\Advanced;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+});
+
+it('lets an instance admin turn passkeys off and keeps stored passkeys', function () {
+    $rootTeam = Team::factory()->create(['id' => 0]);
+    $admin = User::factory()->create();
+    $rootTeam->members()->attach($admin->id, ['role' => 'owner']);
+    $admin->passkeys()->create([
+        'name' => 'Laptop',
+        'credential_id' => 'credential-1',
+        'credential' => ['aaguid' => '00000000-0000-0000-0000-000000000000'],
+    ]);
+
+    $this->actingAs($admin);
+    session(['currentTeam' => $rootTeam]);
+
+    Livewire::test(Advanced::class)
+        ->assertSet('is_passkey_enabled', true)
+        ->set('is_passkey_enabled', false)
+        ->call('instantSave');
+
+    expect(InstanceSettings::findOrFail(0)->is_passkey_enabled)->toBeFalse()
+        ->and($admin->passkeys()->count())->toBe(1);
+});
diff --git a/tests/Feature/Auth/PasskeyRelyingPartyTest.php b/tests/Feature/Auth/PasskeyRelyingPartyTest.php
new file mode 100644
index 0000000000..d6008717e1
--- /dev/null
+++ b/tests/Feature/Auth/PasskeyRelyingPartyTest.php
@@ -0,0 +1,100 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\User;
+use App\Support\PasskeyRelyingParty;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+    $this->withoutVite();
+});
+
+function setPasskeyInstance(?string $fqdn, string $appUrl, bool $enabled = true): void
+{
+    InstanceSettings::query()->where('id', 0)->update(['fqdn' => $fqdn, 'is_passkey_enabled' => $enabled]);
+    config()->set('app.url', $appUrl);
+    Once::flush();
+}
+
+it('resolves the relying party', function (?string $fqdn, string $appUrl, string $requestUrl, ?array $expected) {
+    setPasskeyInstance($fqdn, $appUrl);
+
+    expect(PasskeyRelyingParty::resolve(Request::create($requestUrl)))->toBe($expected);
+})->with([
+    'https fqdn' => ['https://coolify.example.com', 'http://localhost', 'https://coolify.example.com/login',
+        ['id' => 'coolify.example.com', 'origins' => ['https://coolify.example.com']]],
+    'fqdn behind http proxy' => ['https://coolify.example.com', 'http://localhost', 'http://coolify.example.com/login',
+        ['id' => 'coolify.example.com', 'origins' => ['https://coolify.example.com']]],
+    'app url fallback keeps the port' => [null, 'https://dev.example.ts.net:8443', 'https://dev.example.ts.net:8443/login',
+        ['id' => 'dev.example.ts.net', 'origins' => ['https://dev.example.ts.net:8443']]],
+    'localhost uses the request origin' => [null, 'http://localhost', 'http://localhost:8000/login',
+        ['id' => 'localhost', 'origins' => ['http://localhost:8000']]],
+    'fqdn on a custom port' => ['https://coolify.example.com', 'http://localhost', 'https://coolify.example.com:8443/login',
+        ['id' => 'coolify.example.com', 'origins' => ['https://coolify.example.com', 'https://coolify.example.com:8443']]],
+    'fqdn with uppercase letters' => ['https://Coolify.Example.com', 'http://localhost', 'https://coolify.example.com/login',
+        ['id' => 'coolify.example.com', 'origins' => ['https://coolify.example.com']]],
+    'http fqdn' => ['http://coolify.example.com', 'http://localhost', 'http://coolify.example.com/login', null],
+    'raw ip' => [null, 'https://203.0.113.10', 'https://203.0.113.10/login', null],
+]);
+
+it('is not available on a host that is not the instance host', function () {
+    setPasskeyInstance('https://coolify.example.com', 'http://localhost');
+
+    expect(PasskeyRelyingParty::isAvailable(Request::create('http://203.0.113.10:8000/login')))->toBeFalse();
+});
+
+it('is not available when the instance toggle is off', function () {
+    setPasskeyInstance(null, 'http://localhost', enabled: false);
+
+    expect(PasskeyRelyingParty::isAvailable(Request::create('http://localhost/login')))->toBeFalse();
+});
+
+it('returns login options with the resolved relying party', function () {
+    setPasskeyInstance('https://coolify.example.com', 'http://localhost');
+
+    $this->getJson('https://coolify.example.com/passkeys/login/options')
+        ->assertOk()
+        ->assertJsonPath('options.rpId', 'coolify.example.com');
+});
+
+it('returns 404 on passkey routes when passkeys are not available', function (bool $enabled, string $url) {
+    setPasskeyInstance(null, 'http://localhost', $enabled);
+
+    $this->getJson($url)->assertNotFound();
+})->with([
+    'toggle off' => [false, 'http://localhost/passkeys/login/options'],
+    'raw ip host' => [true, 'http://203.0.113.10:8000/passkeys/login/options'],
+]);
+
+it('keeps the password login page reachable when passkeys are not available', function () {
+    setPasskeyInstance(null, 'http://localhost', enabled: false);
+    User::factory()->create();
+
+    $this->get('http://203.0.113.10:8000/login')->assertOk();
+});
+
+it('rate limits the passkey routes by client ip', function () {
+    setPasskeyInstance(null, 'http://localhost');
+
+    foreach (range(1, 30) as $attempt) {
+        $this->getJson('/passkeys/login/options')->assertOk();
+    }
+
+    $this->getJson('/passkeys/login/options')->assertStatus(429);
+});
+
+it('does not need the instance settings on other fortify routes', function () {
+    InstanceSettings::query()->delete();
+    Once::flush();
+
+    $this->post('/login', ['email' => 'nobody@example.com', 'password' => 'wrong-password'])
+        ->assertRedirect()
+        ->assertSessionHasErrors('email');
+});
diff --git a/tests/Feature/Auth/PasskeySetupTest.php b/tests/Feature/Auth/PasskeySetupTest.php
new file mode 100644
index 0000000000..edd2b39c62
--- /dev/null
+++ b/tests/Feature/Auth/PasskeySetupTest.php
@@ -0,0 +1,42 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+});
+
+it('registers the fortify passkey routes', function () {
+    expect(Route::has('passkey.login-options'))->toBeTrue()
+        ->and(Route::has('passkey.login'))->toBeTrue()
+        ->and(Route::has('passkey.confirm'))->toBeTrue()
+        ->and(Route::has('passkey.store'))->toBeTrue();
+});
+
+it('returns a stable 64 character hex user handle', function () {
+    $user = User::factory()->create();
+
+    $handle = $user->getPasskeyUserHandle();
+
+    expect($handle)->toMatch('/^[0-9a-f]{64}$/')
+        ->and(User::find($user->id)->getPasskeyUserHandle())->toBe($handle);
+});
+
+it('enables passkeys by default and stores passkeys for a user', function () {
+    $user = User::factory()->create();
+    $user->passkeys()->create([
+        'name' => 'Laptop',
+        'credential_id' => 'credential-1',
+        'credential' => ['aaguid' => '00000000-0000-0000-0000-000000000000'],
+    ]);
+
+    expect(instanceSettings()->is_passkey_enabled)->toBeTrue()
+        ->and($user->hasPasskeysEnabled())->toBeTrue();
+});
diff --git a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
index 54943eb9e5..2102223333 100644
--- a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
+++ b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
@@ -3,15 +3,20 @@
 use App\Livewire\Project\Shared\EnvironmentVariable\All as EnvironmentVariableAll;
 use App\Livewire\Project\Shared\EnvironmentVariable\Show as EnvironmentVariableShow;
 use App\Models\Application;
+use App\Models\AuditEvent;
 use App\Models\EnvironmentVariable;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
+use App\Models\Service;
 use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Str;
 use Livewire\Livewire;
 
@@ -344,3 +349,181 @@ test('member keeps isValueHidden after switching to a team they own', function (
 
     expect($component->get('isValueHidden'))->toBeTrue();
 });
+
+test('admin can limit log redaction to locked values for one application', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EnvironmentVariableAll::class, ['resource' => $this->application])
+        ->assertSet('redact_all_env_values_in_logs', true)
+        ->assertSee('Environment values in logs')
+        ->set('redact_all_env_values_in_logs', false)
+        ->call('saveLogRedactionSetting')
+        ->assertHasNoErrors();
+
+    expect($this->application->settings->fresh()->redact_all_env_values_in_logs)->toBeFalse();
+});
+
+test('admin can limit log redaction to locked values for one service', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    Livewire::test(EnvironmentVariableAll::class, ['resource' => $service])
+        ->assertSet('redact_all_env_values_in_logs', true)
+        ->set('redact_all_env_values_in_logs', false)
+        ->call('saveLogRedactionSetting');
+
+    expect($service->fresh()->redact_all_env_values_in_logs)->toBeFalse();
+});
+
+test('admin can limit log redaction to locked values for one database and a member cannot', function () {
+    $database = StandalonePostgresql::query()->create([
+        'name' => 'log-redaction-database',
+        'postgres_password' => 'database-password',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    session(['currentTeam' => $this->team]);
+
+    $this->actingAs($this->member);
+    Livewire::test(EnvironmentVariableAll::class, ['resource' => $database])
+        ->assertSee('Environment values in logs')
+        ->set('redact_all_env_values_in_logs', false)
+        ->call('saveLogRedactionSetting')
+        ->assertSet('redact_all_env_values_in_logs', true)
+        ->assertNotDispatched('success');
+    expect($database->fresh()->redact_all_env_values_in_logs)->toBeTrue();
+
+    $this->actingAs($this->admin);
+    Livewire::test(EnvironmentVariableAll::class, ['resource' => $database])
+        ->assertSet('redact_all_env_values_in_logs', true)
+        ->set('redact_all_env_values_in_logs', false)
+        ->call('saveLogRedactionSetting')
+        ->assertDispatched('success');
+    expect($database->fresh()->redact_all_env_values_in_logs)->toBeFalse();
+});
+
+test('member cannot change log redaction and the control returns to the stored value', function (string $resourceType, bool $storedValue) {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    $resource = $resourceType === 'application' ? $this->application : Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $settings = $resource instanceof Application ? $resource->settings : $resource;
+    $settings->update(['redact_all_env_values_in_logs' => $storedValue]);
+
+    Livewire::test(EnvironmentVariableAll::class, ['resource' => $resource])
+        ->set('redact_all_env_values_in_logs', ! $storedValue)
+        ->call('saveLogRedactionSetting')
+        ->assertSet('redact_all_env_values_in_logs', $storedValue)
+        ->assertNotDispatched('success');
+
+    expect($settings->fresh()->redact_all_env_values_in_logs)->toBe($storedValue);
+})->with(['application', 'service'])->with([true, false]);
+
+test('log redaction control returns to the stored value after a write failure', function (string $resourceType, bool $storedValue) {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $resource = $resourceType === 'application' ? $this->application : Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $settings = $resource instanceof Application ? $resource->settings : $resource;
+    $settings->update(['redact_all_env_values_in_logs' => $storedValue]);
+    $component = Livewire::test(EnvironmentVariableAll::class, ['resource' => $resource]);
+    $event = 'eloquent.saving: '.get_class($settings);
+    Event::listen($event, function () {
+        throw new RuntimeException('Saving the log redaction setting failed.');
+    });
+
+    try {
+        $component->set('redact_all_env_values_in_logs', ! $storedValue)
+            ->call('saveLogRedactionSetting')
+            ->assertSet('redact_all_env_values_in_logs', $storedValue)
+            ->assertNotDispatched('success');
+
+        expect($settings->fresh()->redact_all_env_values_in_logs)->toBe($storedValue);
+    } finally {
+        Event::forget($event);
+    }
+})->with(['application', 'service'])->with([true, false]);
+
+test('saving the log redaction setting records an audit event for the application', function () {
+    $this->withoutDefer();
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EnvironmentVariableAll::class, ['resource' => $this->application])
+        ->set('redact_all_env_values_in_logs', false)
+        ->call('saveLogRedactionSetting');
+
+    $event = AuditEvent::query()->where('event', 'ui.application.settings_updated')->sole();
+
+    expect($event->metadata['changed_fields'])->toBe(['redact_all_env_values_in_logs'])
+        ->and($event->team_id)->toBe($this->team->id);
+});
+
+test('saving the log redaction setting records an audit event for the service', function () {
+    $this->withoutDefer();
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    Livewire::test(EnvironmentVariableAll::class, ['resource' => $service])
+        ->set('redact_all_env_values_in_logs', false)
+        ->call('saveLogRedactionSetting');
+
+    expect(AuditEvent::query()->where('event', 'ui.service.updated')->get()->pluck('metadata.changed_fields')->all())
+        ->toContain(['redact_all_env_values_in_logs']);
+});
+
+test('member of the resource team cannot change log redaction after switching to a team they own', function () {
+    $ownTeam = Team::factory()->create();
+    $this->member->teams()->attach($ownTeam, ['role' => 'owner']);
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableAll::class, ['resource' => $this->application]);
+
+    session(['currentTeam' => $ownTeam]);
+    Cache::flush();
+
+    $component->set('redact_all_env_values_in_logs', false)
+        ->call('saveLogRedactionSetting');
+
+    expect($this->application->settings->fresh()->redact_all_env_values_in_logs)->toBeTrue();
+});
+
+test('admin of the resource team can change log redaction after switching to a team where they are a member', function () {
+    $otherTeam = Team::factory()->create();
+    $this->admin->teams()->attach($otherTeam, ['role' => 'member']);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableAll::class, ['resource' => $this->application]);
+
+    session(['currentTeam' => $otherTeam]);
+    Cache::flush();
+
+    $component->set('redact_all_env_values_in_logs', false)
+        ->call('saveLogRedactionSetting');
+
+    expect($this->application->settings->fresh()->redact_all_env_values_in_logs)->toBeFalse();
+});
diff --git a/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php b/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php
index 229848220a..99b8715aa3 100644
--- a/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php
+++ b/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php
@@ -110,7 +110,7 @@ test('admin sees deploy controls for application', function () {
     session(['currentTeam' => $this->team]);
 
     Livewire::test(ApplicationHeading::class, ['application' => $this->application])
-        ->assertSee('Deploy')
+        ->assertSee('Redeploy')
         ->assertSee('Restart')
         ->assertSee('Stop');
 });
diff --git a/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php b/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php
index 2d37fd00d9..16ff1e9947 100644
--- a/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php
@@ -222,6 +222,16 @@ test('admin sees terminal link for service', function () {
         ->assertSee('Terminal');
 });
 
+test('service configuration page sidebar links to the file browser', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Team::query()->update(['show_boarding' => false]);
+
+    $this->get(route('project.service.configuration', $this->serviceParams))
+        ->assertOk()
+        ->assertSee(route('project.service.files', $this->serviceParams), false);
+});
+
 test('admin sees deploy button for service', function () {
     $this->actingAs($this->admin);
     session(['currentTeam' => $this->team]);
diff --git a/tests/Feature/BackupAndNotificationRedactionTest.php b/tests/Feature/BackupAndNotificationRedactionTest.php
new file mode 100644
index 0000000000..d27cb48ddc
--- /dev/null
+++ b/tests/Feature/BackupAndNotificationRedactionTest.php
@@ -0,0 +1,263 @@
+<?php
+
+use App\Events\BackupCreated;
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\SendMessageToTelegramJob;
+use App\Jobs\SendWebhookJob;
+use App\Jobs\VolumeBackupJob;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneMysql;
+use App\Models\Team;
+use App\Models\User;
+use App\Notifications\Database\BackupFailed;
+use App\Notifications\Internal\GeneralNotification;
+use App\Notifications\VolumeBackup\BackupFailed as VolumeBackupFailed;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Storage::fake('ssh-keys');
+    Storage::fake('ssh-mux');
+    config(['constants.ssh.mux_enabled' => false]);
+    Event::fake([BackupCreated::class]);
+    Notification::fake();
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    InstanceSettings::query()->whereKey(0)->update(['is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    // The notification fake only records notifications that have at least one enabled channel.
+    $this->team->emailNotificationSettings->update(['smtp_enabled' => true, 'backup_failure_email_notifications' => true]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $this->environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $this->team->id])->id]);
+    $this->s3 = S3Storage::create([
+        'name' => 'Backups',
+        'region' => 'us-east-1',
+        'key' => 'redaction-s3-access-key',
+        'secret' => 'redaction-s3-secret-value',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $this->team->id,
+        'is_usable' => true,
+    ]);
+});
+
+function redactionMysqlBackup(Team $team, Environment $environment, StandaloneDocker $destination, ?S3Storage $s3 = null): ScheduledDatabaseBackup
+{
+    $database = create_standalone_mysql($environment->id, $destination, [
+        'mysql_root_password' => str_repeat('x', 5),
+        'mysql_database' => 'app',
+        'status' => 'running:healthy',
+    ]);
+
+    return ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => $s3 !== null,
+        's3_storage_id' => $s3?->id,
+        'database_type' => StandaloneMysql::class,
+        'database_id' => $database->id,
+        'team_id' => $team->id,
+        'databases_to_backup' => 'app',
+    ]);
+}
+
+/**
+ * @return array<string, string>
+ */
+function backupRedactionToken(User $user, Team $team, array $abilities): array
+{
+    session(['currentTeam' => $team]);
+    $token = $user->createToken('backup-redaction', $abilities);
+    DB::table('personal_access_tokens')->where('id', $token->accessToken->id)->update(['team_id' => $team->id]);
+
+    return ['Authorization' => 'Bearer '.$token->plainTextToken];
+}
+
+it('redacts the database password from the stored execution and the failure notification', function () {
+    $backup = redactionMysqlBackup($this->team, $this->environment, $this->destination);
+    $password = $backup->database->mysql_root_password;
+    Process::fake(function ($process) use ($password) {
+        $command = is_array($process->command) ? implode(' ', $process->command) : $process->command;
+        if (str_contains($command, 'mysqldump')) {
+            return Process::result(errorOutput: "mysqldump: Got error: 1045: Access denied for user 'root' with password {$password}", exitCode: 1);
+        }
+
+        return Process::result(output: '');
+    });
+
+    (new DatabaseBackupJob($backup))->handle();
+
+    $execution = $backup->executions()->latest('id')->firstOrFail();
+    expect($execution->status)->toBe('failed')
+        ->and($execution->message)->toContain('Access denied')
+        ->and($execution->message)->not->toContain($password);
+    Notification::assertSentTo($this->team, BackupFailed::class, fn (BackupFailed $notification) => str_contains((string) $notification->output, 'Access denied')
+        && ! str_contains((string) $notification->output, $password));
+});
+
+it('redacts the S3 key and secret from a permanently failed database backup', function () {
+    $backup = redactionMysqlBackup($this->team, $this->environment, $this->destination, $this->s3);
+    ScheduledDatabaseBackupExecution::create([
+        'uuid' => 'redaction-run',
+        'scheduled_database_backup_id' => $backup->id,
+        'database_name' => 'app',
+        'status' => 'running',
+    ]);
+    $job = new DatabaseBackupJob($backup);
+    $job->executionUuidPrefix = 'redaction-run';
+
+    $job->failed(new RuntimeException('mc: alias set failed for key redaction-s3-access-key and secret redaction-s3-secret-value'));
+
+    $message = $backup->executions()->sole()->message;
+    expect($message)->toContain('mc: alias set failed')
+        ->and($message)->not->toContain('redaction-s3-access-key')
+        ->and($message)->not->toContain('redaction-s3-secret-value');
+    Notification::assertSentTo($this->team, BackupFailed::class, fn (BackupFailed $notification) => ! str_contains((string) $notification->output, 'redaction-s3-secret-value')
+        && ! str_contains((string) $notification->output, 'redaction-s3-access-key'));
+});
+
+it('redacts the S3 key and secret from a failed volume backup', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $this->team->id,
+        's3_storage_id' => $this->s3->id,
+        'save_s3' => true,
+        'frequency' => '0 0 * * *',
+    ]);
+    $execution = $backup->executions()->create(['s3_storage_id' => $this->s3->id]);
+
+    (new VolumeBackupJob($backup))->failed(new RuntimeException('mc: upload failed with secret redaction-s3-secret-value'));
+
+    expect($execution->fresh()->message)->toContain('mc: upload failed')
+        ->and($execution->fresh()->message)->not->toContain('redaction-s3-secret-value');
+    Notification::assertSentTo($this->team, VolumeBackupFailed::class, fn (VolumeBackupFailed $notification) => str_contains($notification->output, 'mc: upload failed')
+        && ! str_contains($notification->output, 'redaction-s3-secret-value'));
+});
+
+it('does not put the telegram bot token into the connection error', function () {
+    Http::fake(['*' => Http::failedConnection()]);
+
+    try {
+        (new SendMessageToTelegramJob('Message', [], '123456:telegram-bot-secret-token', '42'))->handle();
+        $this->fail('The connection error was not reported.');
+    } catch (RuntimeException $exception) {
+        expect($exception->getMessage())->toContain('https://api.telegram.org')
+            ->and($exception->getMessage())->not->toContain('telegram-bot-secret-token')
+            ->and($exception->getPrevious())->toBeNull();
+    }
+});
+
+it('does not put the secret webhook path into the connection error', function () {
+    Http::fake(['*' => Http::failedConnection()]);
+
+    try {
+        (new SendWebhookJob(['event' => 'test'], 'https://example.com/hooks/webhook-secret-path'))->handle();
+        $this->fail('The connection error was not reported.');
+    } catch (RuntimeException $exception) {
+        expect($exception->getMessage())->toContain('https://example.com')
+            ->and($exception->getMessage())->not->toContain('webhook-secret-path')
+            ->and($exception->getPrevious())->toBeNull();
+    }
+});
+
+it('does not share the provider response body when a channel is disabled', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    foreach ([$rootTeam, $this->team] as $team) {
+        $team->discordNotificationSettings->update(['discord_enabled' => true, 'discord_webhook_url' => 'https://example.com/discord']);
+    }
+    $settings = tap($this->team->telegramNotificationSettings)->update(['telegram_enabled' => true, 'telegram_token' => 'token', 'telegram_chat_id' => '123']);
+    Http::fake(['*' => Http::response(['ok' => false, 'description' => 'Unauthorized provider-body-marker'], 401)]);
+
+    foreach (range(1, 3) as $attempt) {
+        (new SendMessageToTelegramJob('Message', [], 'token', '123', null, $settings->fresh()))->handle();
+    }
+
+    expect($settings->fresh()->telegram_enabled)->toBeFalse();
+    Notification::assertSentTo($rootTeam, GeneralNotification::class, fn (GeneralNotification $notification) => str_contains($notification->message, 'HTTP 401')
+        && ! str_contains($notification->message, 'provider-body-marker'));
+    Notification::assertSentTo($this->team, GeneralNotification::class, fn (GeneralNotification $notification) => ! str_contains($notification->message, 'provider-body-marker'));
+});
+
+it('redacts secrets from server validation logs', function () {
+    $this->server->update(['validation_logs' => 'Could not connect: postgres://coolify:validation-db-secret@10.0.0.5/app']);
+
+    expect($this->server->fresh()->validation_logs)->toContain('Could not connect')
+        ->and($this->server->fresh()->validation_logs)->not->toContain('validation-db-secret');
+});
+
+describe('backup executions api', function () {
+    beforeEach(function () {
+        $this->owner = User::factory()->create();
+        $this->team->members()->attach($this->owner, ['role' => 'owner']);
+        $this->backup = redactionMysqlBackup($this->team, $this->environment, $this->destination);
+        ScheduledDatabaseBackupExecution::create([
+            'scheduled_database_backup_id' => $this->backup->id,
+            'database_name' => 'app',
+            'status' => 'failed',
+            'message' => 'dump failed: mysql://root:api-db-secret@db:3306/app',
+        ]);
+        $this->executionsUrl = "/api/v1/databases/{$this->backup->database->uuid}/backups/{$this->backup->uuid}/executions";
+        $this->backupsUrl = "/api/v1/databases/{$this->backup->database->uuid}/backups";
+    });
+
+    it('hides the execution message from a token without read:sensitive', function () {
+        $headers = backupRedactionToken($this->owner, $this->team, ['read']);
+
+        $executions = $this->withHeaders($headers)->getJson($this->executionsUrl)->assertOk();
+        $backups = $this->withHeaders($headers)->getJson($this->backupsUrl)->assertOk();
+
+        expect($executions->json('executions.0.status'))->toBe('failed')
+            ->and($executions->json('executions.0.message'))->toBeNull()
+            ->and($backups->json('0.executions.0.message'))->toBeNull()
+            ->and($executions->getContent().$backups->getContent())->not->toContain('dump failed');
+    });
+
+    it('returns the redacted execution message to a token with read:sensitive', function () {
+        $headers = backupRedactionToken($this->owner, $this->team, ['read', 'read:sensitive']);
+
+        $message = $this->withHeaders($headers)->getJson($this->executionsUrl)->assertOk()->json('executions.0.message');
+
+        expect($message)->toContain('dump failed')
+            ->and($message)->not->toContain('api-db-secret');
+    });
+
+    it('does not return executions of another team', function () {
+        $otherTeam = Team::factory()->create();
+        $otherTeam->members()->attach($this->owner, ['role' => 'owner']);
+        $headers = backupRedactionToken($this->owner, $otherTeam, ['read', 'read:sensitive']);
+
+        $this->withHeaders($headers)->getJson($this->executionsUrl)->assertNotFound();
+    });
+});
diff --git a/tests/Feature/BackupEditValidationTest.php b/tests/Feature/BackupEditValidationTest.php
index 66643ffc46..93d38c78e5 100644
--- a/tests/Feature/BackupEditValidationTest.php
+++ b/tests/Feature/BackupEditValidationTest.php
@@ -86,7 +86,6 @@ it('enables and disables S3 backups from the S3 title action', function () {
     $component = Livewire::test(BackupEdit::class, [
         'backup' => $backup->fresh(),
         'availableS3Storages' => $this->team->s3s,
-        'section' => 's3',
     ])
         ->assertSee('Enable S3')
         ->call('toggleS3')
@@ -117,7 +116,6 @@ it('shows and saves S3 retention while S3 backups are disabled', function () {
     Livewire::test(BackupEdit::class, [
         'backup' => $backup->fresh(),
         'availableS3Storages' => $this->team->s3s,
-        'section' => 'retention',
     ])
         ->assertSee('S3 backups')
         ->set('databaseBackupRetentionAmountS3', 12)
@@ -147,34 +145,18 @@ it('splits standalone database backup settings and executions across dedicated u
     $this->get($generalUrl)
         ->assertOk()
         ->assertSee('General')
-        ->assertSee('S3 storage')
-        ->assertSee('Retention')
         ->assertSee('Executions')
         ->assertSee('Danger Zone')
         ->assertSee('Frequency')
-        ->assertDontSee('Enable S3')
-        ->assertDontSee('Disable S3')
-        ->assertDontSee('Backups to keep')
-        ->assertDontSee('Clean failed backups')
-        ->assertDontSee('Delete schedule');
-
-    $this->get($generalUrl.'/s3')
-        ->assertOk()
         ->assertSeeText('No validated S3 storage')
-        ->assertDontSee('Local copy')
-        ->assertDontSee('Enable S3')
-        ->assertDontSee('Disable S3')
-        ->assertDontSee('Backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Clean failed backups');
-
-    $this->get($generalUrl.'/retention')
-        ->assertOk()
         ->assertSee('Local backups')
         ->assertSee('S3 backups')
         ->assertSee('Backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Clean failed backups');
+        ->assertDontSee('Clean failed backups')
+        ->assertDontSee('Delete schedule');
+
+    $this->get($generalUrl.'/s3')->assertRedirect($generalUrl);
+    $this->get($generalUrl.'/retention')->assertRedirect($generalUrl);
 
     $this->get($generalUrl.'/executions')
         ->assertOk()
@@ -424,7 +406,7 @@ it('defaults to the first available storage when multiple storages are available
     ]);
 
     Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
-        ->assertSet('s3StorageId', $firstS3->id)
+        ->assertSet('s3StorageIds', [$firstS3->id])
         ->set('saveS3', true)
         ->call('instantSave')
         ->assertDispatched('success');
@@ -461,7 +443,7 @@ it('accepts a root team S3 storage for the instance database backup', function (
 
     Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => collect([$s3])])
         ->set('saveS3', true)
-        ->set('s3StorageId', $s3->id)
+        ->set('s3StorageIds', [$s3->id])
         ->call('instantSave')
         ->assertDispatched('success');
 
@@ -478,22 +460,21 @@ it('shows available S3 storages even when S3 backup is disabled', function () {
         's3_storage_id' => null,
     ]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s, 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         ->assertSee('First S3')
         ->assertSee('Second S3');
 });
 
-it('shows only an empty S3 state when no storages are available', function () {
+it('shows an empty S3 state when no storages are available', function () {
     $backup = createBackupForEditValidationTest($this->team, [
         'save_s3' => false,
         's3_storage_id' => null,
     ]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s, 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         ->assertSeeText('No validated S3 storage')
         ->assertSeeHtml('href="'.route('storage.index').'"')
         ->assertSeeText('Open S3 storage')
-        ->assertDontSee('Save')
         ->assertDontSee('Enable S3')
         ->assertDontSee('Disable S3')
         ->assertDontSee('S3 Storage')
@@ -510,7 +491,6 @@ it('allows S3 backups to be disabled when no usable storage remains', function (
     $component = Livewire::test(BackupEdit::class, [
         'backup' => $backup->fresh(),
         'availableS3Storages' => collect(),
-        'section' => 's3',
     ])
         ->assertSet('saveS3', true)
         ->assertSeeText('No validated S3 storage')
@@ -532,7 +512,7 @@ it('shows when S3 backups are currently disabled', function () {
         's3_storage_id' => null,
     ]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s, 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         // Disabled S3 backups are indicated by the "Enable S3" title action
         ->assertSee('S3 storage')
         ->assertSee('Enable S3')
@@ -548,7 +528,7 @@ it('saves selected S3 storage immediately when it changes', function () {
     ]);
 
     Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
-        ->set('s3StorageId', $secondS3->id)
+        ->set('s3StorageIds', [$secondS3->id])
         ->assertDispatched('success');
 
     $backup->refresh();
@@ -617,3 +597,84 @@ it('disables Back up now after refresh when the database stops', function () {
 
     expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
 });
+
+it('shows the backup actions in the header bar on every database backup page', function () {
+    config(['cache.default' => 'array', 'app.maintenance.driver' => 'file']);
+    $backup = createBackupForEditValidationTest($this->team);
+    $database = $backup->database;
+    $database->update(['status' => 'running:healthy']);
+    $generalUrl = route('project.database.backup.execution', [
+        'project_uuid' => $database->project()->uuid,
+        'environment_uuid' => $database->environment->uuid,
+        'database_uuid' => $database->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]);
+
+    foreach (['', '/executions', '/danger'] as $suffix) {
+        expect($this->get($generalUrl.$suffix)->assertOk()->getContent())
+            ->toMatch('/x-teleport="#resource-action-hud-slot".*?wire:click="toggleEnabled".*?Disable backup.*?wire:click="backupNow"/s');
+    }
+});
+
+it('hides the header Back up now button from team members', function () {
+    config(['cache.default' => 'array', 'app.maintenance.driver' => 'file']);
+    $backup = createBackupForEditValidationTest($this->team);
+    $database = $backup->database;
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+
+    $this->get(route('project.database.backup.executions', [
+        'project_uuid' => $database->project()->uuid,
+        'environment_uuid' => $database->environment->uuid,
+        'database_uuid' => $database->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]))
+        ->assertOk()
+        ->assertDontSee('wire:click="backupNow"', false);
+});
+
+it('denies Back up now for team members', function () {
+    Queue::fake();
+    $backup = createBackupForEditValidationTest($this->team);
+    $backup->database->update(['status' => 'running:healthy']);
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+
+    Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+    ])
+        ->call('backupNow')
+        ->assertNoRedirect();
+
+    Queue::assertNotPushed(DatabaseBackupJob::class);
+});
+
+it('syncs the backup form when the header toggles the schedule', function () {
+    $backup = createBackupForEditValidationTest($this->team, ['enabled' => true]);
+
+    $component = Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+    ])->assertSet('backupEnabled', true);
+
+    $backup->update(['enabled' => false]);
+
+    $component->dispatch('backupEnabledChanged')
+        ->assertSet('backupEnabled', false)
+        ->call('submit');
+
+    expect((bool) $backup->fresh()->enabled)->toBeFalse();
+});
+
+it('toggles the schedule from the form and notifies the page header', function () {
+    $backup = createBackupForEditValidationTest($this->team, ['enabled' => true]);
+
+    Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+    ])
+        ->call('toggleEnabled')
+        ->assertSet('backupEnabled', false)
+        ->assertDispatched('backupEnabledChanged');
+
+    expect((bool) $backup->fresh()->enabled)->toBeFalse();
+});
diff --git a/tests/Feature/BackupExecutionMessageRedactionApiTest.php b/tests/Feature/BackupExecutionMessageRedactionApiTest.php
new file mode 100644
index 0000000000..82c02338cb
--- /dev/null
+++ b/tests/Feature/BackupExecutionMessageRedactionApiTest.php
@@ -0,0 +1,70 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+const BACKUP_MESSAGE_DB_PASSWORD = 'supersecretdbpw';
+
+beforeEach(function () {
+    Queue::fake();
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $this->team->id])->id]);
+
+    $this->database = StandalonePostgresql::query()->create([
+        'name' => 'backup-message-database',
+        'postgres_password' => BACKUP_MESSAGE_DB_PASSWORD,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $this->backup = ScheduledDatabaseBackup::query()->create([
+        'team_id' => $this->team->id,
+        'frequency' => '0 0 * * *',
+        'database_type' => $this->database->getMorphClass(),
+        'database_id' => $this->database->id,
+    ]);
+    ScheduledDatabaseBackupExecution::query()->create([
+        'scheduled_database_backup_id' => $this->backup->id,
+        'status' => 'failed',
+        'message' => 'pg_dump failed: password '.BACKUP_MESSAGE_DB_PASSWORD.' rejected',
+    ]);
+
+    $user = User::factory()->create();
+    $this->team->members()->attach($user->id, ['role' => 'owner']);
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'test-token',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['read', 'read:sensitive'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->bearer = $token->getKey().'|'.$plainTextToken;
+});
+
+it('redacts the database password from backup execution messages', function (Closure $path, string $messageKey) {
+    $response = $this->withToken($this->bearer)->getJson($path())->assertOk();
+
+    expect($response->json($messageKey))->toBe('pg_dump failed: password '.REDACTED.' rejected');
+})->with([
+    'database list' => [fn () => '/api/v1/databases', '0.backup_configs.0.latest_log.message'],
+    'database backups' => [fn () => '/api/v1/databases/'.test()->database->uuid.'/backups', '0.executions.0.message'],
+    'backup executions' => [fn () => '/api/v1/databases/'.test()->database->uuid.'/backups/'.test()->backup->uuid.'/executions', 'executions.0.message'],
+]);
diff --git a/tests/Feature/BackupNowAvailabilityTest.php b/tests/Feature/BackupNowAvailabilityTest.php
index 3d03994201..c1a35d979b 100644
--- a/tests/Feature/BackupNowAvailabilityTest.php
+++ b/tests/Feature/BackupNowAvailabilityTest.php
@@ -114,16 +114,23 @@ it('checks current database status before queuing from a stale page', function (
     Queue::assertNotPushed(DatabaseBackupJob::class);
 })->with('database backup controls');
 
-it('refreshes service backup buttons when the service status check completes', function () {
+it('refreshes service backup buttons when the service status changes', function (string $componentClass, string $event) {
     $database = $this->databases['service'];
     $database->update(['status' => 'exited:unhealthy']);
-    $component = Livewire::test(Index::class, ['service' => $this->service]);
+    $parameters = $componentClass === Index::class
+        ? ['service' => $this->service]
+        : ['backup' => $this->backups['service']->fresh(), 'availableS3Storages' => collect()];
+    $component = Livewire::test($componentClass, $parameters);
+    $disabledButton = '/<button\s+disabled[^>]*wire:click(\.stop)?="backupNow/s';
     $database->update(['status' => 'running:healthy']);
 
-    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
-    expect($component->html())->not->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
+    $component->dispatch('echo-private:team.'.currentTeam()->id.','.$event);
+    expect($component->html())->not->toMatch($disabledButton);
 
     $database->update(['status' => 'exited:unhealthy']);
-    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
-    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
-});
+    $component->dispatch('echo-private:team.'.currentTeam()->id.','.$event);
+    expect($component->html())->toMatch($disabledButton);
+})->with([
+    'service list' => Index::class,
+    'service settings' => BackupEdit::class,
+])->with(['ServiceChecked', 'ServiceStatusChanged']);
diff --git a/tests/Feature/BackupRetentionAndStaleDetectionTest.php b/tests/Feature/BackupRetentionAndStaleDetectionTest.php
index 97e45599ff..8e235a6501 100644
--- a/tests/Feature/BackupRetentionAndStaleDetectionTest.php
+++ b/tests/Feature/BackupRetentionAndStaleDetectionTest.php
@@ -276,6 +276,8 @@ test('database S3 retention remains best effort when deletion fails', function (
     ]);
     ScheduledDatabaseBackupExecution::whereKey($newestExecution->id)->update(['created_at' => now()]);
     ScheduledDatabaseBackupExecution::whereKey($oldExecution->id)->update(['created_at' => now()->subDay()]);
+    $newestExecution->s3Replicas()->create(['s3_storage_id' => $s3->id, 's3_uploaded' => true]);
+    $oldExecution->s3Replicas()->create(['s3_storage_id' => $s3->id, 's3_uploaded' => true]);
     $disk = Mockery::mock();
     $disk->shouldReceive('delete')->once()->with(['/backup/old.dmp'])->andReturnFalse();
     Storage::shouldReceive('build')->once()->andReturn($disk);
diff --git a/tests/Feature/BackupRunSafetyTest.php b/tests/Feature/BackupRunSafetyTest.php
index 7f3475d846..5a19a72a45 100644
--- a/tests/Feature/BackupRunSafetyTest.php
+++ b/tests/Feature/BackupRunSafetyTest.php
@@ -269,7 +269,7 @@ it('stores service database backups in the folder of earlier releases', function
         'status' => 'running:healthy',
     ]);
     $backup = backupRunSafetySchedule($database, $this->team);
-    backupRunSafetyFakeRemoteCommands(['env | grep POSTGRES_' => "POSTGRES_USER=rallly\nPOSTGRES_DB=rallly"]);
+    backupRunSafetyFakeRemoteCommands(['| grep -E' => "POSTGRES_USER=rallly\nPOSTGRES_DB=rallly"]);
 
     (new DatabaseBackupJob($backup))->handle();
 
@@ -277,6 +277,32 @@ it('stores service database backups in the folder of earlier releases', function
         ->toContain("/rallly-rallly_db-{$service->uuid}/pg-dump-rallly-");
 });
 
+it('backs up a service PostgreSQL database as the user from PGUSER or POSTGRESQL_USERNAME', function (string $env, string $user) {
+    $service = Service::factory()->create([
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'environment_id' => $this->environment->id,
+    ]);
+    $database = ServiceDatabase::create([
+        'service_id' => $service->id,
+        'name' => 'app_db',
+        'image' => 'postgres:16-alpine',
+        'status' => 'running:healthy',
+    ]);
+    $backup = backupRunSafetySchedule($database, $this->team);
+    $commands = backupRunSafetyFakeRemoteCommands(['| grep -E' => $env."\nPOSTGRES_DB=app"]);
+
+    (new DatabaseBackupJob($backup))->handle();
+
+    expect($commands->first(fn (string $command) => str_contains($command, 'pg_dump')))
+        ->toContain("--username '\\''{$user}'\\''");
+})->with([
+    'PGUSER' => ['PGUSER=pguser', 'pguser'],
+    'Bitnami POSTGRESQL_USERNAME' => ['POSTGRESQL_USERNAME=bitnami', 'bitnami'],
+    'POSTGRES_USER wins' => ["POSTGRES_USER=app\nPGUSER=pguser", 'app'],
+]);
+
 function backupRunSafetyServiceDatabase(Server $server, StandaloneDocker $destination, Environment $environment, string $image): ServiceDatabase
 {
     $service = Service::factory()->create([
diff --git a/tests/Feature/BackupS3DestinationRedactionTest.php b/tests/Feature/BackupS3DestinationRedactionTest.php
new file mode 100644
index 0000000000..709bc05023
--- /dev/null
+++ b/tests/Feature/BackupS3DestinationRedactionTest.php
@@ -0,0 +1,168 @@
+<?php
+
+use App\Events\BackupCreated;
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\VolumeBackupJob;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneMysql;
+use App\Models\Team;
+use App\Notifications\Database\BackupSuccessWithS3Warning;
+use App\Notifications\VolumeBackup\BackupSuccess as VolumeBackupSuccess;
+use Illuminate\Filesystem\FilesystemAdapter;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+const S3_DESTINATION_SECRETS = [
+    'first-access-id-7731',
+    'first-hidden-value-9921',
+    'second-access-id-4482',
+    'second-hidden-value-5513',
+];
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Storage::fake('ssh-mux');
+    config(['constants.ssh.mux_enabled' => false, 'broadcasting.default' => 'null']);
+    defined('CURLOPT_RESOLVE') || define('CURLOPT_RESOLVE', 10203);
+    Event::fake([BackupCreated::class]);
+    Notification::fake();
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    // The notification fake only records notifications that have at least one enabled channel.
+    $this->team->emailNotificationSettings->update(['smtp_enabled' => true, 'backup_failure_email_notifications' => true]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id,
+        'ip' => '203.0.113.10',
+    ]);
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $this->environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $this->team->id])->id]);
+    $this->storages = collect(['first', 'second'])->map(fn (string $name): S3Storage => S3Storage::create([
+        'name' => "{$name} storage",
+        'region' => 'us-east-1',
+        'key' => "{$name}-access-id-".($name === 'first' ? '7731' : '4482'),
+        'secret' => "{$name}-hidden-value-".($name === 'first' ? '9921' : '5513'),
+        'bucket' => "{$name}-bucket",
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $this->team->id,
+        'is_usable' => true,
+    ]));
+    $this->uploadError = 'mc: upload rejected for '.implode(' / ', S3_DESTINATION_SECRETS);
+});
+
+function expectNoS3DestinationSecrets(?string $text): void
+{
+    foreach (S3_DESTINATION_SECRETS as $secret) {
+        expect((string) $text)->not->toContain($secret);
+    }
+}
+
+it('redacts the credentials of every S3 destination from a database backup upload failure', function () {
+    $database = create_standalone_mysql($this->environment->id, $this->destination, [
+        'mysql_root_password' => str_repeat('x', 5),
+        'mysql_database' => 'app',
+        'status' => 'running:healthy',
+    ]);
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        's3_storage_id' => $this->storages[0]->id,
+        'database_type' => StandaloneMysql::class,
+        'database_id' => $database->id,
+        'team_id' => $this->team->id,
+        'databases_to_backup' => 'app',
+    ]);
+    $backup->syncS3Storages($this->storages->pluck('id')->all());
+    Process::fake(function ($process) {
+        $command = is_array($process->command) ? implode(' ', $process->command) : $process->command;
+
+        return Process::result(output: str_contains($command, 'du -b') ? '128' : '');
+    });
+    $uploadError = $this->uploadError;
+    $job = Mockery::mock(DatabaseBackupJob::class.'[upload_to_s3]', [$backup->fresh()])->shouldAllowMockingProtectedMethods();
+    $job->shouldReceive('upload_to_s3')->andReturnUsing(fn () => throw new RuntimeException($uploadError));
+
+    $job->handle();
+
+    $execution = $backup->executions()->sole();
+    expect($execution->status)->toBe('success')
+        ->and($execution->message)->toContain('mc: upload rejected')
+        ->and($execution->s3Replicas()->count())->toBe(2);
+    expectNoS3DestinationSecrets($execution->message);
+    $execution->s3Replicas()->get()->each(function ($replica) {
+        expect($replica->message)->toContain('mc: upload rejected');
+        expectNoS3DestinationSecrets($replica->message);
+    });
+    Notification::assertSentTo($this->team, BackupSuccessWithS3Warning::class, function (BackupSuccessWithS3Warning $notification) {
+        expect($notification->s3_error)->toContain('mc: upload rejected');
+        expectNoS3DestinationSecrets($notification->s3_error);
+
+        return true;
+    });
+});
+
+it('redacts the credentials of every S3 destination from a volume backup upload failure', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+    ]);
+    $backup->syncS3Storages($this->storages->pluck('id')->all());
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->zeroOrMoreTimes()->andReturn([]);
+    $disk->shouldReceive('delete')->zeroOrMoreTimes()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->zeroOrMoreTimes()->andReturn($disk);
+    Process::fake([
+        '*du -b*' => '128',
+        '*mc cp*' => Process::result(errorOutput: $this->uploadError, exitCode: 1),
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup->fresh()))->handle();
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    expect($execution->status)->toBe('success')
+        ->and($execution->message)->toContain('mc: upload rejected')
+        ->and($execution->s3Replicas()->count())->toBe(2);
+    expectNoS3DestinationSecrets($execution->message);
+    $execution->s3Replicas()->get()->each(function ($replica) {
+        expect($replica->message)->toContain('mc: upload rejected');
+        expectNoS3DestinationSecrets($replica->message);
+    });
+    Notification::assertSentTo($this->team, VolumeBackupSuccess::class, function (VolumeBackupSuccess $notification) {
+        expect($notification->warning)->toContain('mc: upload rejected');
+        expectNoS3DestinationSecrets($notification->warning);
+
+        return true;
+    });
+});
diff --git a/tests/Feature/BackupS3DestinationsFormTest.php b/tests/Feature/BackupS3DestinationsFormTest.php
new file mode 100644
index 0000000000..61098268f7
--- /dev/null
+++ b/tests/Feature/BackupS3DestinationsFormTest.php
@@ -0,0 +1,322 @@
+<?php
+
+use App\Livewire\Project\Database\BackupEdit;
+use App\Livewire\Project\Database\BackupExecutions;
+use App\Livewire\Project\Shared\Storages\VolumeBackups;
+use App\Livewire\Storage\Resources as StorageResources;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function createS3StorageForDestinationsFormTest(Team $team, string $name): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => str($name)->slug()->toString(),
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => $team->id,
+    ]);
+}
+
+/**
+ * @return array{0: Application, 1: LocalPersistentVolume, 2: StandalonePostgresql}
+ */
+function createResourcesForDestinationsFormTest(Team $team): array
+{
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    $server = Server::factory()->create(['team_id' => $team->id, 'private_key_id' => $privateKey->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $database = StandalonePostgresql::create([
+        'name' => 'pg-destinations',
+        'image' => 'postgres:16-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    return [$application, $volume, $database];
+}
+
+function createDatabaseBackupForDestinationsFormTest(StandalonePostgresql $database, array $overrides = []): ScheduledDatabaseBackup
+{
+    return ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => $database->getMorphClass(),
+        'database_id' => $database->id,
+        'team_id' => $database->team()->id,
+        ...$overrides,
+    ]);
+}
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->otherTeam = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'admin']);
+    $this->user->teams()->attach($this->otherTeam, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    [$this->application, $this->volume, $this->database] = createResourcesForDestinationsFormTest($this->team);
+    $this->firstStorage = createS3StorageForDestinationsFormTest($this->team, 'First S3');
+    $this->secondStorage = createS3StorageForDestinationsFormTest($this->team, 'Second S3');
+    $this->foreignStorage = createS3StorageForDestinationsFormTest($this->otherTeam, 'Foreign S3');
+});
+
+it('saves two S3 destinations for a database backup schedule', function () {
+    $backup = createDatabaseBackupForDestinationsFormTest($this->database);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSee('First S3')
+        ->assertSee('Second S3')
+        ->assertSet('s3StorageIds', [$this->firstStorage->id])
+        ->set('saveS3', true)
+        ->set('s3StorageIds', [(string) $this->firstStorage->id, (string) $this->secondStorage->id])
+        ->call('submit')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeTruthy()
+        ->and($backup->s3_storage_id)->toBe($this->firstStorage->id)
+        ->and($backup->s3Storages()->pluck('s3_storages.id')->sort()->values()->all())
+        ->toBe([$this->firstStorage->id, $this->secondStorage->id]);
+});
+
+it('saves two S3 destinations for a volume backup schedule', function () {
+    Livewire::test(VolumeBackups::class, ['storage' => $this->volume, 'resource' => $this->application])
+        ->set('frequency', 'daily')
+        ->set('saveToS3', true)
+        ->set('s3StorageIds', [(string) $this->secondStorage->id, (string) $this->firstStorage->id])
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    $backup = ScheduledVolumeBackup::query()->sole();
+    expect($backup->save_s3)->toBeTrue()
+        ->and($backup->s3_storage_id)->toBe($this->secondStorage->id)
+        ->and($backup->s3Storages()->pluck('s3_storages.id')->sort()->values()->all())
+        ->toBe([$this->firstStorage->id, $this->secondStorage->id]);
+});
+
+it('drops S3 storages of another team after a team switch', function () {
+    $backup = createDatabaseBackupForDestinationsFormTest($this->database, [
+        'save_s3' => true,
+        's3_storage_id' => $this->firstStorage->id,
+    ]);
+    $backup->syncS3Storages([$this->firstStorage->id]);
+
+    $databaseComponent = Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s]);
+    $volumeComponent = Livewire::test(VolumeBackups::class, ['storage' => $this->volume, 'resource' => $this->application]);
+    session(['currentTeam' => $this->otherTeam]);
+
+    $databaseComponent->set('s3StorageIds', [$this->foreignStorage->id])
+        ->assertHasErrors('s3StorageIds');
+    expect($backup->fresh()->s3Storages()->pluck('s3_storages.id')->all())->toBe([$this->firstStorage->id]);
+
+    $databaseComponent->set('s3StorageIds', [$this->secondStorage->id, $this->foreignStorage->id])
+        ->assertHasNoErrors();
+    expect($backup->fresh()->s3_storage_id)->toBe($this->secondStorage->id)
+        ->and($backup->fresh()->s3Storages()->pluck('s3_storages.id')->all())->toBe([$this->secondStorage->id]);
+
+    $volumeComponent->set('frequency', 'daily')
+        ->set('saveToS3', true)
+        ->set('s3StorageIds', [$this->foreignStorage->id])
+        ->assertHasErrors('s3StorageIds');
+    expect(ScheduledVolumeBackup::query()->count())->toBe(0);
+
+    $volumeComponent->set('s3StorageIds', [$this->firstStorage->id, $this->foreignStorage->id])
+        ->assertHasNoErrors();
+    expect(ScheduledVolumeBackup::query()->sole()->s3Storages()->pluck('s3_storages.id')->all())
+        ->toBe([$this->firstStorage->id]);
+});
+
+it('rejects S3 backups without a destination', function () {
+    $backup = createDatabaseBackupForDestinationsFormTest($this->database, [
+        'save_s3' => true,
+        's3_storage_id' => $this->firstStorage->id,
+    ]);
+    $backup->syncS3Storages([$this->firstStorage->id]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->set('s3StorageIds', [])
+        ->call('submit')
+        ->assertHasErrors('s3StorageIds')
+        ->assertDispatched('error');
+
+    expect($backup->fresh()->save_s3)->toBeTruthy()
+        ->and($backup->fresh()->s3Storages()->pluck('s3_storages.id')->all())->toBe([$this->firstStorage->id]);
+
+    Livewire::test(VolumeBackups::class, ['storage' => $this->volume, 'resource' => $this->application])
+        ->set('frequency', 'daily')
+        ->set('saveToS3', true)
+        ->set('s3StorageIds', [])
+        ->call('save')
+        ->assertHasErrors('s3StorageIds');
+
+    expect(ScheduledVolumeBackup::query()->count())->toBe(0);
+});
+
+it('moves and removes one destination of a multi-destination schedule from the storage page', function () {
+    $thirdStorage = createS3StorageForDestinationsFormTest($this->team, 'Third S3');
+    $databaseBackup = createDatabaseBackupForDestinationsFormTest($this->database, ['save_s3' => true]);
+    $databaseBackup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
+    $volumeBackup = ScheduledVolumeBackup::create([
+        'backupable_type' => $this->volume->getMorphClass(),
+        'backupable_id' => $this->volume->id,
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'enabled' => true,
+        'save_s3' => true,
+    ]);
+    $volumeBackup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
+
+    Livewire::test(StorageResources::class, ['storage' => $this->secondStorage])
+        ->assertSet("selectedStorages.{$databaseBackup->id}", $this->secondStorage->id)
+        ->assertSet("selectedVolumeStorages.{$volumeBackup->id}", $this->secondStorage->id)
+        ->assertSee('pg-destinations')
+        ->assertSee('app-data');
+
+    Livewire::test(StorageResources::class, ['storage' => $this->firstStorage])
+        ->set("selectedStorages.{$databaseBackup->id}", $thirdStorage->id)
+        ->call('moveBackup', $databaseBackup->id)
+        ->set("selectedVolumeStorages.{$volumeBackup->id}", $thirdStorage->id)
+        ->call('moveVolumeBackup', $volumeBackup->id);
+
+    foreach ([$databaseBackup, $volumeBackup] as $backup) {
+        $backup->refresh();
+        expect($backup->s3_storage_id)->toBe($thirdStorage->id)
+            ->and($backup->s3Storages()->pluck('s3_storages.id')->sort()->values()->all())
+            ->toBe([$this->secondStorage->id, $thirdStorage->id]);
+    }
+
+    Livewire::test(StorageResources::class, ['storage' => $this->secondStorage])
+        ->call('disableS3', $databaseBackup->id)
+        ->call('disableVolumeS3', $volumeBackup->id);
+
+    foreach ([$databaseBackup, $volumeBackup] as $backup) {
+        $backup->refresh();
+        expect($backup->save_s3)->toBeTruthy()
+            ->and($backup->s3_storage_id)->toBe($thirdStorage->id)
+            ->and($backup->s3Storages()->pluck('s3_storages.id')->all())->toBe([$thirdStorage->id]);
+    }
+
+    Livewire::test(StorageResources::class, ['storage' => $thirdStorage])
+        ->call('disableS3', $databaseBackup->id)
+        ->call('disableVolumeS3', $volumeBackup->id);
+
+    foreach ([$databaseBackup, $volumeBackup] as $backup) {
+        $backup->refresh();
+        expect($backup->save_s3)->toBeFalsy()
+            ->and($backup->s3_storage_id)->toBeNull()
+            ->and($backup->s3Storages()->count())->toBe(0);
+    }
+});
+
+it('shows the copy status of each destination in the execution lists', function () {
+    $databaseBackup = createDatabaseBackupForDestinationsFormTest($this->database, ['save_s3' => true]);
+    $databaseBackup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
+    $databaseExecution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $databaseBackup->id,
+        'status' => 'success',
+        'filename' => '/backups/dump.dmp',
+        's3_uploaded' => false,
+    ]);
+    $volumeBackup = ScheduledVolumeBackup::create([
+        'backupable_type' => $this->volume->getMorphClass(),
+        'backupable_id' => $this->volume->id,
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+    ]);
+    $volumeBackup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
+    $volumeExecution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $volumeBackup->id,
+        'status' => 'success',
+        'filename' => '/backups/volume.tar.gz',
+        's3_uploaded' => false,
+    ]);
+    foreach ([$databaseExecution, $volumeExecution] as $execution) {
+        $execution->s3Replicas()->create(['s3_storage_id' => $this->firstStorage->id, 's3_uploaded' => true]);
+        $execution->s3Replicas()->create(['s3_storage_id' => $this->secondStorage->id, 's3_uploaded' => false, 'message' => 'Access denied']);
+    }
+
+    Livewire::test(BackupExecutions::class, ['backup' => $databaseBackup])
+        ->assertSeeInOrder(['First S3', 'Second S3 failed'])
+        ->assertSee('Access denied')
+        ->assertSee('Delete the selected backup permanently from every S3 storage');
+
+    Livewire::test(VolumeBackups::class, ['storage' => $this->volume, 'resource' => $this->application, 'section' => 'executions'])
+        ->assertSeeInOrder(['First S3', 'Second S3 failed'])
+        ->assertSee('Delete the selected backup permanently from every S3 storage');
+});
+
+it('keeps a selected destination that is unusable for a while when other settings are saved', function () {
+    $databaseBackup = createDatabaseBackupForDestinationsFormTest($this->database, ['save_s3' => true]);
+    $databaseBackup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
+    $volumeBackup = ScheduledVolumeBackup::create([
+        'backupable_type' => $this->volume->getMorphClass(),
+        'backupable_id' => $this->volume->id,
+        'team_id' => $this->team->id,
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+    ]);
+    $volumeBackup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
+    $this->secondStorage->update(['is_usable' => false]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $databaseBackup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSee('Second S3 (unavailable)')
+        ->set('timeout', 7200)
+        ->call('submit')
+        ->assertHasNoErrors();
+    Livewire::test(VolumeBackups::class, ['storage' => $this->volume, 'resource' => $this->application])
+        ->assertSee('Second S3 (unavailable)')
+        ->set('stopDuringBackup', true)
+        ->call('save')
+        ->assertHasNoErrors();
+
+    expect($databaseBackup->s3Storages()->pluck('s3_storages.id')->sort()->values()->all())
+        ->toBe([$this->firstStorage->id, $this->secondStorage->id])
+        ->and($volumeBackup->s3Storages()->pluck('s3_storages.id')->sort()->values()->all())
+        ->toBe([$this->firstStorage->id, $this->secondStorage->id]);
+});
diff --git a/tests/Feature/BackupS3DownloadFallbackTest.php b/tests/Feature/BackupS3DownloadFallbackTest.php
new file mode 100644
index 0000000000..5eccab54b6
--- /dev/null
+++ b/tests/Feature/BackupS3DownloadFallbackTest.php
@@ -0,0 +1,183 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.driver' => 'file']);
+    Server::flushIdentityMap();
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->otherTeam = Team::factory()->create();
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $environment = Environment::factory()->create([
+        'project_id' => Project::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+    $database = StandalonePostgresql::create([
+        'name' => 's3-download-pg',
+        'image' => 'postgres:16-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+
+    $this->primaryS3 = createS3ForDownloadFallbackTest($this->team, 'primary');
+    $this->replicaS3 = createS3ForDownloadFallbackTest($this->team, 'replica');
+
+    $this->databaseBackup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $this->primaryS3->id,
+        'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(),
+    ]);
+    $this->databaseExecution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $this->databaseBackup->id,
+        'status' => 'success',
+        'database_name' => 'postgres',
+        'filename' => '/data/coolify/backups/databases/team/pg/pg-dump-postgres-1.dmp',
+        'local_storage_deleted' => true,
+    ]);
+
+    $this->volumeBackup = $volume->scheduledBackups()->create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+    ]);
+    $this->volumeExecution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $this->volumeBackup->id,
+        's3_storage_id' => $this->primaryS3->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/volumes/team/app/volume-app-data-1.tar.gz',
+        'local_storage_deleted' => true,
+    ]);
+});
+
+function createS3ForDownloadFallbackTest(Team $team, string $name, bool $isUsable = true): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => "{$name}-{$team->id}-bucket",
+        'endpoint' => 'https://1.1.1.1',
+        'team_id' => $team->id,
+        'is_usable' => $isUsable,
+    ]);
+}
+
+function signInForDownloadFallbackTest($testCase, Team $team, string $role = 'owner'): void
+{
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
+    $testCase->actingAs($user);
+    session(['currentTeam' => $team]);
+}
+
+/**
+ * @return array{0: string, 1: ScheduledDatabaseBackupExecution|ScheduledVolumeBackupExecution}
+ */
+function downloadFallbackTarget($testCase, string $type): array
+{
+    return $type === 'database'
+        ? ['download.backup', $testCase->databaseExecution]
+        : ['download.volume-backup', $testCase->volumeExecution];
+}
+
+function assertPresignedBackupRedirect($response, S3Storage $storage, string $filename): void
+{
+    $location = $response->assertRedirect()->headers->get('Location');
+    $url = parse_url($location);
+    parse_str($url['query'], $query);
+
+    expect("{$url['scheme']}://{$url['host']}{$url['path']}")->toBe("https://1.1.1.1/{$storage->bucket}".$filename)
+        ->and($query)->toHaveKeys(['X-Amz-Signature', 'X-Amz-Expires'])
+        ->and((int) $query['X-Amz-Expires'])->toBeLessThanOrEqual(15 * 60)
+        ->and($query['response-content-disposition'])->toContain('attachment; filename="'.basename($filename).'"');
+}
+
+it('redirects to a presigned URL of the primary S3 copy when no local copy exists', function (string $type) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->replicaS3->id, 's3_uploaded' => true]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->primaryS3->id, 's3_uploaded' => true]);
+    signInForDownloadFallbackTest($this, $this->team);
+
+    assertPresignedBackupRedirect($this->get(route($route, $execution->id)), $this->primaryS3, $execution->filename);
+})->with(['database', 'volume']);
+
+it('uses a replica when the primary S3 copy is deleted or its storage is unusable', function (string $type, bool $primaryDeleted) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    if (! $primaryDeleted) {
+        $this->primaryS3->update(['is_usable' => false]);
+    }
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->primaryS3->id, 's3_uploaded' => true, 's3_storage_deleted' => $primaryDeleted]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->replicaS3->id, 's3_uploaded' => true]);
+    signInForDownloadFallbackTest($this, $this->team);
+
+    assertPresignedBackupRedirect($this->get(route($route, $execution->id)), $this->replicaS3, $execution->filename);
+})->with(['database', 'volume'])->with(['primary deleted' => true, 'primary unusable' => false]);
+
+it('keeps the not found message when no usable S3 copy exists', function (string $type, string $message) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->primaryS3->id, 's3_uploaded' => false]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->replicaS3->id, 's3_uploaded' => true, 's3_storage_deleted' => true]);
+    signInForDownloadFallbackTest($this, $this->team);
+
+    $this->get(route($route, $execution->id))->assertNotFound()->assertJson(['message' => $message]);
+})->with([
+    'database' => ['database', 'Backup not available locally, but available on S3.'],
+    'volume' => ['volume', 'Backup not found locally on the server.'],
+]);
+
+it('never uses an S3 storage of another team', function (string $type) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    $foreignS3 = createS3ForDownloadFallbackTest($this->otherTeam, 'foreign');
+    $execution->s3Replicas()->create(['s3_storage_id' => $foreignS3->id, 's3_uploaded' => true]);
+    signInForDownloadFallbackTest($this, $this->team);
+
+    $this->get(route($route, $execution->id))->assertNotFound();
+})->with(['database', 'volume']);
+
+it('forbids members and other teams from getting a presigned URL', function (string $type, string $user) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->primaryS3->id, 's3_uploaded' => true]);
+    $user === 'member'
+        ? signInForDownloadFallbackTest($this, $this->team, 'member')
+        : signInForDownloadFallbackTest($this, $this->otherTeam);
+
+    $this->get(route($route, $execution->id))->assertForbidden();
+})->with(['database', 'volume'])->with(['member', 'other team owner']);
diff --git a/tests/Feature/BackupS3DownloadTest.php b/tests/Feature/BackupS3DownloadTest.php
new file mode 100644
index 0000000000..a04d90950e
--- /dev/null
+++ b/tests/Feature/BackupS3DownloadTest.php
@@ -0,0 +1,287 @@
+<?php
+
+use App\Jobs\DeleteFileDownloadJob;
+use App\Jobs\PrepareFileDownloadJob;
+use App\Livewire\Project\Database\BackupExecutions;
+use App\Livewire\Project\Service\BackupExecutions as ServiceBackupExecutions;
+use App\Livewire\Project\Shared\Storages\VolumeBackups;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+const BACKUP_S3_DOWNLOAD_FILE = '/data/coolify/backups/databases/orders/pg-dump-orders-1.dmp';
+
+beforeEach(function () {
+    config(['app.maintenance.driver' => 'file', 'constants.ssh.mux_enabled' => false]);
+    Storage::fake('ssh-keys');
+    Server::flushIdentityMap();
+    Once::flush();
+    InstanceSettings::forceCreate(['id' => 0]);
+    Team::factory()->create(['id' => 0]);
+    $this->downloadStorage = S3Storage::create([
+        'name' => 'Downloads',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'downloads',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => 0,
+    ]);
+    InstanceSettings::find(0)->update(['file_download_s3_storage_id' => $this->downloadStorage->id]);
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->otherTeam = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $privateKey->id]);
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $this->team->id])->id]);
+    $this->database = StandalonePostgresql::create([
+        'name' => 'orders-db', 'postgres_user' => 'postgres', 'postgres_password' => 'password', 'postgres_db' => 'db',
+        'image' => 'postgres:17', 'environment_id' => $environment->id,
+        'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass(),
+    ]);
+    $this->backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'database_id' => $this->database->id,
+        'database_type' => $this->database->getMorphClass(),
+    ]);
+    $this->execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $this->backup->id,
+        'status' => 'success',
+        'filename' => BACKUP_S3_DOWNLOAD_FILE,
+    ]);
+    $this->service = Service::factory()->create([
+        'server_id' => $this->server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'environment_id' => $environment->id,
+    ]);
+
+    $this->user = User::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'admin']);
+    $this->user->teams()->attach($this->otherTeam, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    Bus::fake([PrepareFileDownloadJob::class]);
+});
+
+function fakeBackupFileSize(int|string $size): void
+{
+    Process::fake(['*' => Process::result(output: (string) $size)]);
+}
+
+it('uploads a database backup through S3 for an admin of its team after a team switch', function () {
+    fakeBackupFileSize(1024);
+    $component = Livewire::test(BackupExecutions::class, ['backup' => $this->backup]);
+    session(['currentTeam' => $this->otherTeam]);
+
+    $component->call('download_file', $this->execution->id)
+        ->assertDispatched('info')
+        ->assertNotDispatched('open-backup-download')
+        ->assertCount('pendingDownloads', 1);
+
+    Bus::assertDispatched(PrepareFileDownloadJob::class, fn (PrepareFileDownloadJob $job) => $job->container === null
+        && $job->path === BACKUP_S3_DOWNLOAD_FILE
+        && $job->serverId === $this->server->id
+        && $job->downloadName === 'pg-dump-orders-1.dmp'
+        && $job->s3StorageId === $this->downloadStorage->id
+        && $job->userId === $this->user->id);
+});
+
+it('streams through the download route when no download storage is set', function () {
+    InstanceSettings::find(0)->update(['file_download_s3_storage_id' => null]);
+    Once::flush();
+    Process::fake();
+
+    Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $this->execution->id)
+        ->assertDispatched('open-backup-download', url: route('download.backup', $this->execution->id));
+
+    Process::assertNothingRan();
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('streams through the download route when the backup is larger than one S3 upload', function () {
+    fakeBackupFileSize(FileDownloadStorageService::MAX_SIZE + 1);
+
+    Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $this->execution->id)
+        ->assertDispatched('open-backup-download', url: route('download.backup', $this->execution->id));
+
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('lets the download route answer when the backup file is not on the server', function () {
+    fakeBackupFileSize('');
+
+    Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $this->execution->id)
+        ->assertDispatched('open-backup-download', url: route('download.backup', $this->execution->id));
+
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('refuses team members', function () {
+    Process::fake();
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+    $this->user->unsetRelation('teams');
+    $component = Livewire::test(BackupExecutions::class, ['backup' => $this->backup]);
+
+    $component->call('download_file', $this->execution->id)
+        ->assertNotDispatched('open-backup-download');
+
+    Process::assertNothingRan();
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('does not download an execution of another backup', function () {
+    Process::fake();
+    $foreignBackup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->otherTeam->id,
+        'frequency' => 'daily',
+        'database_id' => $this->database->id + 1000,
+        'database_type' => $this->database->getMorphClass(),
+    ]);
+    $foreignExecution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $foreignBackup->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/databases/other/secret.dmp',
+    ]);
+
+    Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $foreignExecution->id)
+        ->assertDispatched('error', 'Backup execution not found.')
+        ->assertNotDispatched('open-backup-download');
+
+    Process::assertNothingRan();
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('uploads a volume backup through S3 and refuses members', function () {
+    fakeBackupFileSize(2048);
+    $application = Application::factory()->create([
+        'environment_id' => $this->database->environment_id,
+        'destination_id' => $this->database->destination_id,
+        'destination_type' => $this->database->destination_type,
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $backup = $volume->scheduledBackups()->create(['team_id' => $this->team->id, 'frequency' => 'daily']);
+    $execution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $backup->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/volumes/app/archive.tar.gz',
+    ]);
+    $component = Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application]);
+    session(['currentTeam' => $this->otherTeam]);
+
+    $component->call('downloadBackup', $execution->id)->assertCount('pendingDownloads', 1);
+    Bus::assertDispatched(PrepareFileDownloadJob::class, fn (PrepareFileDownloadJob $job) => $job->container === null
+        && $job->path === '/data/coolify/backups/volumes/app/archive.tar.gz'
+        && $job->serverId === $this->server->id);
+
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+    $this->user->unsetRelation('teams');
+    $component->call('downloadBackup', $execution->id)->assertForbidden();
+    Bus::assertDispatchedTimes(PrepareFileDownloadJob::class, 1);
+});
+
+it('uploads a service database backup through S3', function () {
+    fakeBackupFileSize(1024);
+    $serviceDatabase = ServiceDatabase::create([
+        'service_id' => $this->service->id,
+        'name' => 'service-db',
+        'image' => 'postgres:16-alpine',
+        'custom_type' => 'postgresql',
+    ]);
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'database_id' => $serviceDatabase->id,
+        'database_type' => $serviceDatabase->getMorphClass(),
+    ]);
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/service/db.dmp',
+    ]);
+
+    Livewire::test(ServiceBackupExecutions::class, ['service' => $this->service])
+        ->call('downloadExecution', $execution->uuid)
+        ->assertCount('pendingDownloads', 1);
+
+    Bus::assertDispatched(PrepareFileDownloadJob::class, fn (PrepareFileDownloadJob $job) => $job->container === null
+        && $job->path === '/data/coolify/backups/service/db.dmp');
+});
+
+it('opens a finished link only for the user who asked for it', function () {
+    fakeBackupFileSize(1024);
+    $component = Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $this->execution->id);
+    $downloadId = $component->get('pendingDownloads')[0];
+
+    Cache::put(PrepareFileDownloadJob::cacheKey($downloadId), ['user_id' => $this->user->id + 1, 'status' => 'ready', 'url' => 'https://s3.example.com/other']);
+    $component->call('checkDownloads')->assertNotDispatched('open-backup-download')->assertCount('pendingDownloads', 1);
+
+    Cache::put(PrepareFileDownloadJob::cacheKey($downloadId), ['user_id' => $this->user->id, 'status' => 'ready', 'url' => 'https://s3.example.com/get']);
+    $component->call('checkDownloads')
+        ->assertDispatched('open-backup-download', url: 'https://s3.example.com/get')
+        ->assertCount('pendingDownloads', 0);
+});
+
+it('uploads the backup file from the server host with curl', function () {
+    Bus::fake([DeleteFileDownloadJob::class]);
+    Process::fake(['*' => Process::result(output: '')]);
+    $downloads = Mockery::mock(FileDownloadStorageService::class);
+    $downloads->shouldReceive('uploadUrl')->andReturn(['url' => 'https://s3.example.com/put?X-Amz-Signature=abc&x=1', 'headers' => ['Content-Disposition' => 'attachment']]);
+    $downloads->shouldReceive('downloadUrl')->andReturn('https://s3.example.com/get');
+
+    (new PrepareFileDownloadJob('dl-host', $this->user->id, $this->server->id, null, BACKUP_S3_DOWNLOAD_FILE, false, 'pg.dmp', $this->downloadStorage->id))->handle($downloads);
+
+    expect(Cache::get(PrepareFileDownloadJob::cacheKey('dl-host')))->toMatchArray(['status' => 'ready', 'url' => 'https://s3.example.com/get']);
+    Process::assertRan(fn ($process) => str_contains($process->command, 'curl -fsS')
+        && str_contains($process->command, BACKUP_S3_DOWNLOAD_FILE)
+        && str_contains($process->command, 'X-Amz-Signature=abc&x=1')
+        && ! str_contains($process->command, 'docker exec'));
+});
+
+it('builds host file commands that the non-root sudo parser keeps whole', function () {
+    $nonRoot = Server::factory()->make(['user' => 'deploy']);
+    $upload = FileDownloadStorageService::buildHostFileUploadCommand("/data/it's.dmp", 'https://s3.example.com/put?a=1&b=2', ['Content-Disposition' => 'attachment']);
+    $size = FileDownloadStorageService::buildHostFileSizeCommand("/data/it's.dmp");
+
+    expect(parseCommandsByLineForSudo(collect([$upload, $size]), $nonRoot))->toBe(['sudo '.$upload, 'sudo '.$size])
+        ->and(fn () => FileDownloadStorageService::buildHostFileSizeCommand('/data/a;rm -rf /'))->toThrow(Exception::class);
+});
diff --git a/tests/Feature/BackupS3StorageListResourceTeamTest.php b/tests/Feature/BackupS3StorageListResourceTeamTest.php
index 90f87493b4..d4b61b16b4 100644
--- a/tests/Feature/BackupS3StorageListResourceTeamTest.php
+++ b/tests/Feature/BackupS3StorageListResourceTeamTest.php
@@ -112,7 +112,7 @@ test('database backup page offers only usable S3 storages of the database team',
         'database_id' => $this->postgres->id,
         'database_type' => $this->postgres->getMorphClass(),
     ]);
-    $url = route('project.database.backup.s3', [
+    $url = route('project.database.backup.execution', [
         'project_uuid' => $this->project->uuid,
         'environment_uuid' => $this->environment->uuid,
         'database_uuid' => $this->postgres->uuid,
diff --git a/tests/Feature/BoardingActionsLayoutTest.php b/tests/Feature/BoardingActionsLayoutTest.php
new file mode 100644
index 0000000000..71e7b824e4
--- /dev/null
+++ b/tests/Feature/BoardingActionsLayoutTest.php
@@ -0,0 +1,84 @@
+<?php
+
+test('boarding utility actions are centered', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+
+    expect($view)->toContain('class="mx-auto mt-6 flex w-full max-w-3xl flex-col items-center gap-3"');
+});
+
+test('server validation opens in the centered process dialog', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+
+    expect($view)
+        ->toContain('<x-process-dialog closeWithX size="xl">')
+        ->toContain('@click="processDialogOpen = true"')
+        ->not->toContain('<x-slide-over closeWithX fullScreen>');
+});
+
+test('DigitalOcean is available as an onboarding server provider', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+
+    expect($view)
+        ->toContain('<x-modal-input title="Connect a DigitalOcean Server" isFullWidth>')
+        ->toContain('<x-digital-ocean-icon class="size-10 shrink-0" />')
+        ->toContain('Deploy servers directly from your DigitalOcean account.')
+        ->toContain('<livewire:server.new.by-digital-ocean :limit_reached="false" :from_onboarding="true" />');
+});
+
+test('Hostinger is available as an onboarding server provider', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+
+    expect($view)
+        ->toContain('<x-modal-input title="Connect a Hostinger Server" isFullWidth>')
+        ->toContain('<x-hostinger-icon class="size-10 shrink-0 text-[#673de6]" />')
+        ->toContain('Deploy servers directly from your Hostinger account.')
+        ->toContain('<livewire:server.new.by-hostinger :limit_reached="false" :from_onboarding="true" />');
+});
+
+test('server type details are shown on the relevant cards instead of a technical details panel', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+
+    expect($view)
+        ->toContain('aria-label="About this machine"')
+        ->toContain('aria-label="About remote servers"')
+        ->toContain('Not recommended for production workloads due to resource contention.')
+        ->toContain('Any SSH-accessible server, including cloud VPS, bare metal, and self-hosted infrastructure.')
+        ->not->toContain('<x-highlighted text="Servers" />')
+        ->not->toContain('<x-highlighted text="Localhost:" />')
+        ->not->toContain('<x-highlighted text="Remote Server:" />');
+});
+
+test('server type cards use the standard card hover treatment', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+    $hoverClasses = 'shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:shadow-md';
+    preg_match_all('/min-h-36[^\"]*'.preg_quote($hoverClasses, '/').'/', $view, $matches);
+
+    expect($matches[0])->toHaveCount(6)
+        ->and(substr_count($view, 'group relative cursor-pointer'))->toBe(6)
+        ->and($view)->not->toContain('hover:border-coollabs/35 hover:bg-coollabs/[0.03]')
+        ->and($view)->not->toContain('dark:hover:border-warning/25 dark:hover:bg-warning/[0.04]');
+});
+
+test('existing SSH key selection does not show a redundant value tooltip', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+
+    expect($view)->toContain('label="Existing SSH key" :options="$privateKeyOptions" :tooltip="false"');
+});
+
+test('server connection step does not render a technical details panel', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+
+    expect($view)
+        ->not->toContain('<x-highlighted text="Connection Requirements:" />')
+        ->not->toContain('<x-highlighted text="Hostname Resolution:" />')
+        ->not->toContain('<x-highlighted text="User Permissions:" />');
+});
+
+test('project step does not render a technical details panel', function () {
+    $view = file_get_contents(resource_path('views/livewire/boarding/index.blade.php'));
+
+    expect($view)
+        ->not->toContain('<x-highlighted text="Project Organization:" />')
+        ->not->toContain('<x-highlighted text="Environments:" />')
+        ->not->toContain('<x-highlighted text="Team Access:" />');
+});
diff --git a/tests/Feature/CloudProviderLinkDropdownTest.php b/tests/Feature/CloudProviderLinkDropdownTest.php
index 1f14482cf6..714b896e01 100644
--- a/tests/Feature/CloudProviderLinkDropdownTest.php
+++ b/tests/Feature/CloudProviderLinkDropdownTest.php
@@ -59,19 +59,66 @@ it('shows link cloud provider dropdown with available unlinked providers', funct
         'name' => 'Test DigitalOcean Token',
     ]);
 
+    CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+        'token' => 'test-hostinger-token',
+        'name' => 'Test Hostinger Token',
+    ]);
+
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
         ->assertSee('Link provider')
         ->assertSee('Hetzner')
         ->assertSee('DigitalOcean')
         ->assertSee('Vultr')
+        ->assertSee('Hostinger')
         ->assertSee('Hetzner Token')
         ->assertSee('DigitalOcean Token')
         ->assertSee('Vultr Token')
+        ->assertSee('Hostinger Token')
         ->assertSee('Server ID')
         ->assertSee('Droplet ID')
         ->assertSee('Instance ID')
+        ->assertSee('Virtual Machine ID')
         ->assertSee('Search by server IP')
-        ->assertSee('Search');
+        ->assertSee('Search ID');
+});
+
+it('links a manually added server to a Hostinger VPS by IP', function () {
+    $token = CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+        'token' => 'test-hostinger-token',
+        'name' => 'Test Hostinger Token',
+    ]);
+
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            [
+                'id' => 17923,
+                'hostname' => 'hostinger.example.com',
+                'state' => 'running',
+                'ipv4' => [['address' => '1.2.3.4']],
+            ],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'id' => 17923,
+            'hostname' => 'hostinger.example.com',
+            'state' => 'running',
+            'ipv4' => [['address' => '1.2.3.4']],
+        ]),
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->set('selectedHostingerTokenId', $token->id)
+        ->call('searchHostingerVirtualMachine')
+        ->assertSet('matchedHostingerVirtualMachine.id', 17923)
+        ->call('linkToHostinger')
+        ->assertDispatched('success');
+
+    expect($this->server->fresh()->hostinger_virtual_machine_id)->toBe(17923)
+        ->and($this->server->fresh()->hostinger_virtual_machine_status)->toBe('running')
+        ->and($this->server->fresh()->cloud_provider_token_id)->toBe($token->id);
 });
 
 it('hides link cloud provider dropdown when no providers can be linked', function () {
diff --git a/tests/Feature/CloudProviderTokenShowTest.php b/tests/Feature/CloudProviderTokenShowTest.php
index fad6be2287..1c657c644c 100644
--- a/tests/Feature/CloudProviderTokenShowTest.php
+++ b/tests/Feature/CloudProviderTokenShowTest.php
@@ -49,6 +49,24 @@ test('server cloud provider token cards show token descriptions', function () {
         ->assertSee('Used for production servers in the EU region.');
 });
 
+test('server cloud provider token page supports Hostinger VPS servers', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'hostinger_virtual_machine_id' => 17923,
+    ]);
+
+    CloudProviderToken::factory()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+        'name' => 'Production Hostinger',
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $server->uuid])
+        ->assertSet('provider', 'hostinger')
+        ->assertSet('providerName', 'Hostinger')
+        ->assertSee('Production Hostinger');
+});
+
 describe('after the user switches the session team', function () {
     beforeEach(function () {
         $this->withoutDefer();
diff --git a/tests/Feature/CloudflareTunnelApiSetupTest.php b/tests/Feature/CloudflareTunnelApiSetupTest.php
new file mode 100644
index 0000000000..3597e7f0dc
--- /dev/null
+++ b/tests/Feature/CloudflareTunnelApiSetupTest.php
@@ -0,0 +1,470 @@
+<?php
+
+use App\Actions\Server\ConfigureCloudflared;
+use App\Livewire\Security\IntegrationTokenEditor;
+use App\Livewire\Security\IntegrationTokenForm;
+use App\Livewire\Server\CloudflareTunnel;
+use App\Models\DnsProviderZone;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\CloudflareTokenValidator;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\Request;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+use Illuminate\Support\Sleep;
+use Livewire\Livewire;
+use Spatie\Activitylog\Models\Activity;
+
+uses(RefreshDatabase::class);
+
+const CF_TUNNEL_API = '/client/v4/accounts/acc-1/cfd_tunnel';
+const CF_TUNNEL_DNS = '/client/v4/zones/zone-1/dns_records';
+
+beforeEach(function () {
+    $this->withoutDefer();
+    $this->withoutVite();
+    Server::flushIdentityMap();
+    Queue::fake();
+    config(['constants.ssh.mux_enabled' => false]);
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'port' => 2222]);
+    $this->server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+
+    $this->token = IntegrationToken::factory()->for($this->team)->create([
+        'name' => 'Cloudflare tunnel', 'token' => 'cf-api-secret', 'capabilities' => ['dns', 'tunnel'],
+    ]);
+    DnsProviderZone::factory()->for($this->token)->create([
+        'provider_zone_id' => 'zone-1', 'name' => 'example.com', 'account_id' => 'acc-1',
+    ]);
+    $this->tunnelName = "coolify-{$this->server->uuid}";
+});
+
+afterEach(function () {
+    Server::flushIdentityMap();
+});
+
+/**
+ * Fakes Cloudflare by "METHOD path" routes; any other request fails the test.
+ *
+ * @param  array<string, mixed>  $routes
+ */
+function fakeCloudflareTunnelApi(array $routes): void
+{
+    Http::fake(function (Request $request) use ($routes) {
+        $key = $request->method().' '.parse_url($request->url(), PHP_URL_PATH);
+        if (! array_key_exists($key, $routes)) {
+            throw new RuntimeException("Unexpected Cloudflare request: {$key}");
+        }
+
+        return $routes[$key];
+    });
+}
+
+function newCloudflareTunnelRoutes(array $overrides = []): array
+{
+    return array_merge([
+        'GET '.CF_TUNNEL_API => Http::response(['success' => true, 'result' => []]),
+        'POST '.CF_TUNNEL_API => Http::response(['success' => true, 'result' => ['id' => 'tun-1', 'token' => 'tunnel-secret']]),
+        'PUT '.CF_TUNNEL_API.'/tun-1/configurations' => Http::response(['success' => true, 'result' => []]),
+        'GET '.CF_TUNNEL_DNS => Http::response(['success' => true, 'result' => []]),
+        'POST '.CF_TUNNEL_DNS => Http::response(['success' => true, 'result' => ['id' => 'rec-1']]),
+    ], $overrides);
+}
+
+function fakeCloudflaredActivity(string $expectedTunnelToken): void
+{
+    $activity = Activity::create(['log_name' => 'default', 'description' => 'queued', 'properties' => ['status' => 'queued']]);
+    ConfigureCloudflared::shouldRun()->once()
+        ->withArgs(fn (Server $server, string $tunnelToken, string $hostname) => $tunnelToken === $expectedTunnelToken && $hostname === 'ssh.example.com')
+        ->andReturn($activity);
+}
+
+test('a new tunnel is created, routed to the server ssh port, and gets a proxied cname', function () {
+    fakeCloudflareTunnelApi(newCloudflareTunnelRoutes());
+    fakeCloudflaredActivity('tunnel-secret');
+
+    Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+        ->set('cloudflare_integration_token_id', $this->token->id)
+        ->set('api_ssh_domain', 'https://SSH.example.com/')
+        ->call('apiCloudflareConfig')
+        ->assertHasNoErrors()
+        ->assertDispatched('activityMonitor');
+
+    Http::assertSent(fn (Request $request) => $request->method() === 'POST'
+        && str_ends_with($request->url(), CF_TUNNEL_API)
+        && $request['name'] === $this->tunnelName && $request['config_src'] === 'cloudflare'
+        && $request->hasHeader('Authorization', 'Bearer cf-api-secret'));
+    Http::assertSent(fn (Request $request) => $request->method() === 'PUT'
+        && $request['config']['ingress'] === [
+            ['hostname' => 'ssh.example.com', 'service' => 'ssh://localhost:2222'],
+            ['service' => 'http_status:404'],
+        ]);
+    Http::assertSent(fn (Request $request) => $request->method() === 'POST'
+        && str_ends_with($request->url(), CF_TUNNEL_DNS)
+        && $request['type'] === 'CNAME' && $request['content'] === 'tun-1.cfargotunnel.com' && $request['proxied'] === true);
+
+    $settings = $this->server->settings->fresh();
+    $record = ManagedDnsRecord::query()->sole();
+    expect($settings->cloudflare_tunnel_id)->toBe('tun-1')
+        ->and($settings->cloudflare_tunnel_account_id)->toBe('acc-1')
+        ->and($settings->cloudflare_tunnel_integration_token_id)->toBe($this->token->id)
+        ->and($record->owned)->toBeTrue()
+        ->and($record->references()->sole()->resource_id)->toBe($this->server->id);
+});
+
+test('a re-run reuses the existing tunnel and its dns record', function () {
+    $record = ManagedDnsRecord::factory()->create([
+        'team_id' => $this->team->id, 'integration_token_id' => $this->token->id,
+        'dns_provider_zone_id' => DnsProviderZone::query()->sole()->id, 'provider_record_id' => 'rec-1',
+        'type' => 'CNAME', 'name' => 'ssh.example.com', 'content' => 'tun-1.cfargotunnel.com', 'owned' => true,
+    ]);
+    fakeCloudflareTunnelApi(newCloudflareTunnelRoutes([
+        'GET '.CF_TUNNEL_API => Http::response(['success' => true, 'result' => [['id' => 'tun-1', 'name' => $this->tunnelName]]]),
+        'GET '.CF_TUNNEL_API.'/tun-1/token' => Http::response(['success' => true, 'result' => 'tunnel-secret-again']),
+        'GET '.CF_TUNNEL_DNS => Http::response(['success' => true, 'result' => [[
+            'id' => 'rec-1', 'type' => 'CNAME', 'name' => 'ssh.example.com', 'content' => 'tun-1.cfargotunnel.com',
+            'proxied' => true, 'comment' => $record->ownershipComment(),
+        ]]]),
+    ]));
+    fakeCloudflaredActivity('tunnel-secret-again');
+
+    Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+        ->set('cloudflare_integration_token_id', $this->token->id)
+        ->set('api_ssh_domain', 'ssh.example.com')
+        ->call('apiCloudflareConfig')
+        ->assertHasNoErrors();
+
+    Http::assertNotSent(fn (Request $request) => $request->method() === 'POST');
+    expect($record->fresh()->owned)->toBeTrue()
+        ->and($this->server->settings->fresh()->cloudflare_tunnel_id)->toBe('tun-1');
+});
+
+test('an existing dns record is replaced only after confirmation', function () {
+    fakeCloudflareTunnelApi(newCloudflareTunnelRoutes([
+        'GET '.CF_TUNNEL_DNS => Http::response(['success' => true, 'result' => [[
+            'id' => 'rec-old', 'type' => 'A', 'name' => 'ssh.example.com', 'content' => '203.0.113.10', 'proxied' => false,
+        ]]]),
+        'PATCH '.CF_TUNNEL_DNS.'/rec-old' => Http::response(['success' => true, 'result' => ['id' => 'rec-old']]),
+        'DELETE '.CF_TUNNEL_API.'/tun-1' => Http::response(['success' => true, 'result' => ['id' => 'tun-1']]),
+    ]));
+
+    $component = Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+        ->set('cloudflare_integration_token_id', $this->token->id)
+        ->set('api_ssh_domain', 'ssh.example.com')
+        ->call('apiCloudflareConfig')
+        ->assertSet('dnsConflict.current', '203.0.113.10')
+        ->assertSee('ssh.example.com already points to 203.0.113.10.');
+
+    Http::assertNotSent(fn (Request $request) => in_array($request->method(), ['PATCH', 'POST'], true) && str_contains($request->url(), 'dns_records'));
+    Http::assertSent(fn (Request $request) => $request->method() === 'DELETE' && str_ends_with($request->url(), CF_TUNNEL_API.'/tun-1'));
+    expect($this->server->settings->fresh()->cloudflare_tunnel_id)->toBeNull();
+
+    fakeCloudflaredActivity('tunnel-secret');
+    $component->call('replaceDnsAndConfigure')->assertSet('dnsConflict', null);
+
+    Http::assertSent(fn (Request $request) => $request->method() === 'PATCH'
+        && $request->data() === ['content' => 'tun-1.cfargotunnel.com', 'type' => 'CNAME', 'proxied' => true]);
+    expect($this->server->settings->fresh()->cloudflare_tunnel_id)->toBe('tun-1');
+});
+
+test('a token added from the tunnel page is selected when it is the only tunnel token', function () {
+    $this->token->update(['capabilities' => ['dns']]);
+
+    $component = Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Add Cloudflare token');
+
+    $this->token->update(['capabilities' => ['dns', 'tunnel']]);
+
+    $component->dispatch('integrationTokenAdded')
+        ->assertSet('cloudflare_integration_token_id', $this->token->id)
+        ->assertDontSee('Add Cloudflare token');
+});
+
+test('a missing tunnel permission is reported and nothing is saved', function () {
+    fakeCloudflareTunnelApi(newCloudflareTunnelRoutes([
+        'GET '.CF_TUNNEL_API => Http::response(['success' => false, 'errors' => [['code' => 10000, 'message' => 'Authentication error']]], 403),
+    ]));
+    ConfigureCloudflared::shouldRun()->never();
+
+    Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+        ->set('cloudflare_integration_token_id', $this->token->id)
+        ->set('api_ssh_domain', 'ssh.example.com')
+        ->call('apiCloudflareConfig')
+        ->assertDispatched('error', 'The Cloudflare token needs the Account → Cloudflare Tunnel → Edit permission.');
+
+    expect($this->server->settings->fresh()->cloudflare_tunnel_id)->toBeNull()
+        ->and(ManagedDnsRecord::query()->count())->toBe(0);
+});
+
+test('a failed dns step deletes only a tunnel that the same run created', function (bool $tunnelExists, bool $deleted) {
+    fakeCloudflareTunnelApi(newCloudflareTunnelRoutes([
+        'GET '.CF_TUNNEL_API => Http::response(['success' => true, 'result' => $tunnelExists ? [['id' => 'tun-1', 'name' => $this->tunnelName]] : []]),
+        'GET '.CF_TUNNEL_API.'/tun-1/token' => Http::response(['success' => true, 'result' => 'tunnel-secret']),
+        'POST '.CF_TUNNEL_DNS => Http::response(['success' => false], 403),
+        'DELETE '.CF_TUNNEL_API.'/tun-1' => Http::response(['success' => true, 'result' => ['id' => 'tun-1']]),
+    ]));
+    ConfigureCloudflared::shouldRun()->never();
+
+    Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+        ->set('cloudflare_integration_token_id', $this->token->id)
+        ->set('api_ssh_domain', 'ssh.example.com')
+        ->call('apiCloudflareConfig')
+        ->assertDispatched('error', 'The Cloudflare token needs the Zone → DNS → Edit permission.');
+
+    $deleteSent = fn (Request $request) => $request->method() === 'DELETE' && str_ends_with($request->url(), CF_TUNNEL_API.'/tun-1');
+    $deleted ? Http::assertSent($deleteSent) : Http::assertNotSent($deleteSent);
+    expect($this->server->settings->fresh()->cloudflare_tunnel_id)->toBeNull();
+})->with([
+    'new tunnel' => [false, true],
+    'existing tunnel' => [true, false],
+]);
+
+describe('disable', function () {
+    beforeEach(function () {
+        Process::fake();
+        Sleep::fake();
+        Storage::fake('ssh-keys');
+        Storage::fake('ssh-mux');
+        $this->server->update(['private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id]);
+        $this->server->settings->update([
+            'is_cloudflare_tunnel' => true, 'cloudflare_tunnel_id' => 'tun-1',
+            'cloudflare_tunnel_account_id' => 'acc-1', 'cloudflare_tunnel_integration_token_id' => $this->token->id,
+        ]);
+        $this->record = ManagedDnsRecord::factory()->create([
+            'team_id' => $this->team->id, 'integration_token_id' => $this->token->id,
+            'dns_provider_zone_id' => DnsProviderZone::query()->sole()->id, 'provider_record_id' => 'rec-1',
+            'type' => 'CNAME', 'name' => 'ssh.example.com', 'content' => 'tun-1.cfargotunnel.com', 'owned' => true,
+        ]);
+        $this->record->addReference($this->server);
+        $this->server->update(['ip' => 'ssh.example.com', 'ip_previous' => '203.0.113.20']);
+    });
+
+    test('deletes the tunnel and the owned dns record', function () {
+        fakeCloudflareTunnelApi([
+            'DELETE '.CF_TUNNEL_API.'/tun-1/connections' => Http::response(['success' => true, 'result' => null]),
+            'DELETE '.CF_TUNNEL_API.'/tun-1' => Http::response(['success' => true, 'result' => ['id' => 'tun-1']]),
+            'GET '.CF_TUNNEL_DNS.'/rec-1' => Http::response(['success' => true, 'result' => [
+                'id' => 'rec-1', 'type' => 'CNAME', 'name' => 'ssh.example.com', 'content' => 'tun-1.cfargotunnel.com',
+                'comment' => $this->record->ownershipComment(),
+            ]]),
+            'DELETE '.CF_TUNNEL_DNS.'/rec-1' => Http::response(['success' => true, 'result' => ['id' => 'rec-1']]),
+        ]);
+
+        Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+            ->call('toggleCloudflareTunnels')
+            ->assertNotDispatched('warning');
+
+        // Detached, so stopping cloudflared does not cut the SSH session that runs through the tunnel.
+        Process::assertRan(fn ($process) => str_contains($process->command, "nohup setsid sh -c 'sleep 2; docker rm -f coolify-cloudflared' > /dev/null 2>&1 < /dev/null &"));
+        Sleep::assertNeverSlept();
+
+        Http::assertSent(fn (Request $request) => $request->method() === 'DELETE' && str_ends_with($request->url(), CF_TUNNEL_API.'/tun-1'));
+        Http::assertSent(fn (Request $request) => $request->method() === 'DELETE' && str_ends_with($request->url(), CF_TUNNEL_DNS.'/rec-1'));
+
+        $settings = $this->server->settings->fresh();
+        expect($settings->is_cloudflare_tunnel)->toBeFalsy()
+            ->and($settings->cloudflare_tunnel_id)->toBeNull()
+            ->and($settings->cloudflare_tunnel_integration_token_id)->toBeNull()
+            ->and(ManagedDnsRecord::query()->count())->toBe(0);
+    });
+
+    test('still disables locally and warns when cloudflare fails', function () {
+        fakeCloudflareTunnelApi([
+            'DELETE '.CF_TUNNEL_API.'/tun-1/connections' => Http::response([], 500),
+            'DELETE '.CF_TUNNEL_API.'/tun-1' => Http::response([], 500),
+            'GET '.CF_TUNNEL_DNS.'/rec-1' => Http::response([], 500),
+        ]);
+
+        Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+            ->call('toggleCloudflareTunnels')
+            ->assertDispatched('warning', "Cloudflare could not delete the tunnel {$this->tunnelName}. Delete it in Cloudflare.")
+            ->assertDispatched('warning', 'The DNS record ssh.example.com could not be deleted. Delete it in Cloudflare.');
+
+        $settings = $this->server->settings->fresh();
+        expect($settings->is_cloudflare_tunnel)->toBeFalsy()
+            ->and($settings->cloudflare_tunnel_id)->toBeNull();
+        Sleep::assertSleptTimes(4);
+    });
+
+    test('waits until the stopping connector disconnects before the tunnel is deleted', function () {
+        $deletes = 0;
+        Http::fake(function (Request $request) use (&$deletes) {
+            $path = parse_url($request->url(), PHP_URL_PATH);
+
+            return match (true) {
+                $request->method() === 'DELETE' && $path === CF_TUNNEL_API.'/tun-1' => ++$deletes === 1
+                    ? Http::response(['success' => false, 'errors' => [['code' => 1022, 'message' => 'Cannot delete tunnel because it has active connections']]], 400)
+                    : Http::response(['success' => true, 'result' => ['id' => 'tun-1']]),
+                $request->method() === 'GET' && $path === CF_TUNNEL_DNS.'/rec-1' => Http::response(['success' => true, 'result' => [
+                    'id' => 'rec-1', 'type' => 'CNAME', 'name' => 'ssh.example.com', 'content' => 'tun-1.cfargotunnel.com',
+                    'comment' => $this->record->ownershipComment(),
+                ]]),
+                default => Http::response(['success' => true, 'result' => null]),
+            };
+        });
+
+        Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+            ->call('toggleCloudflareTunnels')
+            ->assertNotDispatched('warning');
+
+        expect($deletes)->toBe(2);
+        Sleep::assertSleptTimes(1);
+    });
+
+    test('stops cloudflared detached for a non-root ssh user', function () {
+        $this->server->update(['user' => 'ubuntu']);
+        Http::fake(['*' => Http::response(['success' => true, 'result' => null])]);
+
+        Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+            ->call('toggleCloudflareTunnels');
+
+        Process::assertRan(fn ($process) => str_contains($process->command,
+            "sudo bash -c 'nohup setsid sh -c '\\''sleep 2; docker rm -f coolify-cloudflared'\\'' > /dev/null 2>&1 < /dev/null &'"));
+    });
+
+    test('a tunnel that coolify did not create is disabled without cloudflare calls', function () {
+        Http::fake();
+        $this->server->settings->update(['cloudflare_tunnel_id' => null, 'cloudflare_tunnel_account_id' => null]);
+
+        Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+            ->call('toggleCloudflareTunnels');
+
+        Http::assertNothingSent();
+        expect($this->server->settings->fresh()->is_cloudflare_tunnel)->toBeFalsy();
+    });
+});
+
+describe('authorization', function () {
+    test('members without update rights cannot start the setup', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        $this->actingAs($member);
+        Http::fake();
+
+        Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+            ->set('cloudflare_integration_token_id', $this->token->id)
+            ->set('api_ssh_domain', 'ssh.example.com')
+            ->call('apiCloudflareConfig')
+            ->assertForbidden();
+
+        Http::assertNothingSent();
+    });
+
+    test('a token of another team is rejected', function () {
+        $otherToken = IntegrationToken::factory()->create(['capabilities' => ['dns', 'tunnel']]);
+        Http::fake();
+
+        Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+            ->set('cloudflare_integration_token_id', $otherToken->id)
+            ->set('api_ssh_domain', 'ssh.example.com')
+            ->call('apiCloudflareConfig')
+            ->assertHasErrors('cloudflare_integration_token_id');
+
+        Http::assertNothingSent();
+    });
+
+    test('a token without the tunnel capability is not listed or accepted', function () {
+        $this->token->update(['capabilities' => ['dns']]);
+        Http::fake();
+
+        Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid])
+            ->assertSee('Enable the Cloudflare Tunnel capability on a Cloudflare token')
+            ->set('cloudflare_integration_token_id', $this->token->id)
+            ->set('api_ssh_domain', 'ssh.example.com')
+            ->call('apiCloudflareConfig')
+            ->assertHasErrors('cloudflare_integration_token_id');
+
+        Http::assertNothingSent();
+    });
+
+    test('the server team decides the tokens after the session team changes', function () {
+        $admin = User::factory()->create();
+        $this->team->members()->attach($admin->id, ['role' => 'admin']);
+        $otherTeam = Team::factory()->create();
+        $otherTeam->members()->attach($admin->id, ['role' => 'owner']);
+        $otherTeamToken = IntegrationToken::factory()->for($otherTeam)->create(['capabilities' => ['dns', 'tunnel']]);
+        $this->actingAs($admin);
+
+        $component = Livewire::test(CloudflareTunnel::class, ['server_uuid' => $this->server->uuid]);
+        session(['currentTeam' => $otherTeam]);
+
+        fakeCloudflareTunnelApi(newCloudflareTunnelRoutes());
+        $component->set('cloudflare_integration_token_id', $otherTeamToken->id)
+            ->set('api_ssh_domain', 'ssh.example.com')
+            ->call('apiCloudflareConfig')
+            ->assertHasErrors('cloudflare_integration_token_id');
+        Http::assertNothingSent();
+
+        fakeCloudflaredActivity('tunnel-secret');
+        $component->set('cloudflare_integration_token_id', $this->token->id)
+            ->call('apiCloudflareConfig')
+            ->assertHasNoErrors();
+
+        expect($this->server->settings->fresh()->cloudflare_tunnel_id)->toBe('tun-1');
+    });
+});
+
+describe('tunnel capability', function () {
+    test('the validator checks tunnel access of the zone account', function (int $tunnelStatus, bool $valid) {
+        Http::fake([
+            'api.cloudflare.com/client/v4/user/tokens/verify' => Http::response(['result' => ['status' => 'active']]),
+            'api.cloudflare.com/client/v4/zones/zone-1/dns_records*' => Http::response(['success' => true, 'result' => []]),
+            'api.cloudflare.com/client/v4/zones*' => Http::response(['success' => true, 'result' => [['id' => 'zone-1', 'account' => ['id' => 'acc-1']]]]),
+            'api.cloudflare.com/client/v4/accounts/acc-1/cfd_tunnel*' => Http::response(['success' => $valid], $tunnelStatus),
+        ]);
+
+        expect(app(CloudflareTokenValidator::class)->validate('cf-api-secret', ['dns', 'tunnel']))->toBe($valid);
+    })->with([
+        'permitted' => [200, true],
+        'missing permission' => [403, false],
+    ]);
+
+    test('selecting the tunnel capability also selects dns', function () {
+        Livewire::test(IntegrationTokenForm::class)
+            ->set('capabilities', [])
+            ->set('capabilities', ['tunnel'])
+            ->assertSet('capabilities', ['tunnel', 'dns']);
+
+        $this->token->update(['capabilities' => ['dns']]);
+        Livewire::test(IntegrationTokenEditor::class, ['integration_token_uuid' => $this->token->uuid])
+            ->set('capabilities', ['tunnel'])
+            ->assertSet('capabilities', ['tunnel', 'dns']);
+    });
+});
+
+describe('cloudflare token template url', function () {
+    $permissionsOf = function (string $url): array {
+        parse_str(parse_url($url, PHP_URL_QUERY), $query);
+
+        return json_decode($query['permissionGroupKeys'], true);
+    };
+
+    test('a dns token asks for dns edit and zone read', function () use ($permissionsOf) {
+        expect($permissionsOf(IntegrationToken::cloudflareTokenTemplateUrl(['dns'])))->toBe([
+            ['key' => 'dns', 'type' => 'edit'],
+            ['key' => 'zone', 'type' => 'read'],
+        ]);
+    });
+
+    test('a tunnel token also asks for cloudflare tunnel edit', function () use ($permissionsOf) {
+        expect($permissionsOf(IntegrationToken::cloudflareTokenTemplateUrl(['dns', 'tunnel'])))
+            ->toContain(['key' => 'argotunnel', 'type' => 'edit']);
+    });
+});
diff --git a/tests/Feature/ContainerFilesystemServiceTest.php b/tests/Feature/ContainerFilesystemServiceTest.php
new file mode 100644
index 0000000000..3d89dfdb26
--- /dev/null
+++ b/tests/Feature/ContainerFilesystemServiceTest.php
@@ -0,0 +1,381 @@
+<?php
+
+use App\Data\FileEntry;
+use App\Models\LocalFileVolume;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Services\ContainerFilesystemService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Storage::fake('ssh-keys');
+    // Disable SSH multiplexing so each instant_remote_process is exactly one
+    // faked Process call (mux setup would run extra calls and desync sequences).
+    config(['constants.ssh.mux_enabled' => false]);
+});
+
+function fsService(): ContainerFilesystemService
+{
+    $server = Server::factory()->make(['id' => 999]);
+
+    return new ContainerFilesystemService($server, 'app-123');
+}
+
+function fsServer(): Server
+{
+    $team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+
+    return Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $privateKey->id,
+        'ip' => '203.0.113.10',
+    ]);
+}
+
+it('sorts directories before files, then by name case-insensitively', function () {
+    $entries = [
+        new FileEntry('README.md', 'file', 10, 100),
+        new FileEntry('src', 'dir', 0, 100),
+        new FileEntry('.env', 'file', 5, 100),
+        new FileEntry('assets', 'dir', 0, 100),
+    ];
+
+    $names = array_map(fn (FileEntry $e) => $e->name, FileEntry::sort($entries));
+
+    expect($names)->toBe(['assets', 'src', '.env', 'README.md']);
+});
+
+it('builds a listing command with a single stat call, escaped path and container name', function () {
+    $cmd = fsService()->buildListCommand('/var/www/html');
+
+    expect($cmd)
+        ->toContain('docker exec')
+        ->toContain('app-123')
+        ->toContain('stat -c')
+        ->toContain(escapeshellarg('/var/www/html'))
+        // Must embed a REAL tab, not a literal backslash-t: stat -c does not
+        // expand \t, so a literal escape would break the tab-delimited parse.
+        ->toContain("%F\t%s")
+        ->not->toContain('%F\\t%s')
+        // find batches names, so a huge folder cannot overflow the argument limit like a glob.
+        ->toContain('find . ! -name . -prune -exec stat -c')
+        ->not->toContain('* .*');
+});
+
+it('rejects an unsafe listing path', function () {
+    fsService()->buildListCommand('/tmp/$(reboot)');
+})->throws(Exception::class);
+
+it('parses a tab-delimited listing into sorted FileEntry rows', function () {
+    $raw = implode("\n", [
+        "file\t10\t1700000000\tREADME.md",
+        "dir\t0\t1700000001\tsrc",
+        "file\t5\t1700000002\t.env",
+    ]);
+
+    $entries = fsService()->parseListing($raw);
+
+    expect($entries)->toHaveCount(3);
+    expect($entries[0]->name)->toBe('src');
+    expect($entries[0]->type)->toBe('dir');
+    expect($entries[1]->name)->toBe('.env');
+    expect($entries[2]->name)->toBe('README.md');
+});
+
+it('strips the ./ prefix that find adds to listed names', function () {
+    $raw = implode("\n", [
+        "directory\t0\t1\t755\troot\troot\t./src",
+        "regular file\t5\t2\t644\troot\troot\t./.env",
+    ]);
+
+    $names = array_map(fn ($entry) => $entry->name, fsService()->parseListing($raw));
+
+    expect($names)->toBe(['src', '.env']);
+});
+
+it('parses an empty listing to an empty array', function () {
+    expect(fsService()->parseListing(null))->toBe([]);
+    expect(fsService()->parseListing(''))->toBe([]);
+});
+
+it('lists a directory by running the built command over SSH', function () {
+    Process::fake(['*' => Process::result(output: "dir\t0\t1\tsrc\nfile\t10\t2\tREADME.md")]);
+
+    $server = fsServer();
+    $entries = (new ContainerFilesystemService($server, 'app-123'))->list('/app');
+
+    expect($entries)->toHaveCount(2);
+    expect($entries[0]->name)->toBe('src');
+});
+
+it('falls back to / when the container has no WorkingDir', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+
+    $server = fsServer();
+    expect((new ContainerFilesystemService($server, 'app-123'))->defaultRoot())->toBe('/');
+});
+
+it('refuses to read a file larger than the edit cap', function () {
+    // The combined read command emits TOOBIG in a single round trip.
+    Process::fake(['*' => Process::result(output: 'TOOBIG')]);
+
+    $server = fsServer();
+    (new ContainerFilesystemService($server, 'app-123'))->read('/app/big.bin');
+})->throws(RuntimeException::class);
+
+it('refuses to read a binary file', function () {
+    Process::fake(['*' => Process::result(output: 'BINARY')]);
+
+    $server = fsServer();
+    (new ContainerFilesystemService($server, 'app-123'))->read('/app/a.bin');
+})->throws(RuntimeException::class);
+
+it('reads an editable text file in a single round trip', function () {
+    // "OK" header line then the base64 payload, from one docker exec.
+    Process::fake(['*' => Process::result(output: "OK\n".base64_encode("hello world\n"))]);
+
+    $server = fsServer();
+    $content = (new ContainerFilesystemService($server, 'app-123'))->read('/app/a.txt');
+
+    expect($content)->toBe("hello world\n");
+});
+
+it('treats an empty file as editable text', function () {
+    // Empty file => "OK" header with no payload.
+    Process::fake(['*' => Process::result(output: 'OK')]);
+
+    $server = fsServer();
+
+    expect((new ContainerFilesystemService($server, 'app-123'))->read('/app/empty.txt'))->toBe('');
+});
+
+it('writes content near or above the shell argument limit via docker cp', function (int $size) {
+    Process::fake(['*' => Process::result(output: '')]);
+    $server = fsServer();
+
+    (new ContainerFilesystemService($server, 'app-123'))->write('/app/big.txt', str_repeat('a', $size));
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'docker cp'));
+})->with([96 * 1024, 200_000]);
+
+it('base64-encodes content in the write command', function () {
+    $cmd = fsService()->buildWriteCommand('/app/a.txt', "hi\n");
+
+    expect($cmd)
+        ->toContain('base64 -d')
+        ->toContain(base64_encode("hi\n"))
+        ->toContain(escapeshellarg('/app/a.txt'));
+});
+
+it('builds mkdir, rename and delete commands with escaped paths', function () {
+    $svc = fsService();
+
+    expect($svc->buildMkdirCommand('/app/new dir'))
+        ->toContain('mkdir -p')
+        ->toContain(escapeshellarg('/app/new dir'));
+    expect($svc->buildRenameCommand('/app/a', '/app/b'))
+        ->toContain('mv')
+        ->toContain(escapeshellarg('/app/a'))
+        ->toContain(escapeshellarg('/app/b'));
+    expect($svc->buildDeleteCommand('/app/x'))
+        ->toContain('rm -rf')
+        ->toContain(escapeshellarg('/app/x'));
+});
+
+it('rejects unsafe paths in mutating builders', function () {
+    fsService()->buildDeleteCommand('/app/$(reboot)');
+})->throws(Exception::class);
+
+it('parses the 7-field stat listing with owner and group, mapping the file type', function () {
+    $raw = implode("\n", [
+        "directory\t4096\t1700000000\t755\troot\troot\t.",
+        "directory\t4096\t1700000000\t755\troot\troot\t..",
+        "regular file\t497\t1700000001\t644\twww-data\twww-data\t50x.html",
+        "directory\t4096\t1700000002\t755\tapp\tapp\tassets",
+        "symbolic link\t11\t1700000003\t777\troot\troot\tlink",
+    ]);
+
+    $entries = fsService()->parseListing($raw);
+
+    // The stat . and .. rows are dropped.
+    expect($entries)->toHaveCount(3);
+    expect($entries[0]->name)->toBe('assets');
+    expect($entries[0]->type)->toBe('dir');
+    expect($entries[0]->owner)->toBe('app');
+    expect($entries[0]->group)->toBe('app');
+    expect($entries[1]->name)->toBe('50x.html');
+    expect($entries[1]->type)->toBe('file');
+    expect($entries[1]->owner)->toBe('www-data');
+    expect($entries[2]->name)->toBe('link');
+    expect($entries[2]->type)->toBe('symlink');
+});
+
+it('parses permissions from the 5-field listing format', function () {
+    $raw = "file\t497\t1700000000\t644\t50x.html\ndir\t0\t1700000001\t755\tassets";
+
+    $entries = fsService()->parseListing($raw);
+
+    expect($entries[0]->name)->toBe('assets');
+    expect($entries[0]->perms)->toBe('755');
+    expect($entries[1]->name)->toBe('50x.html');
+    expect($entries[1]->perms)->toBe('644');
+});
+
+it('builds a create-file command that does not truncate an existing file', function () {
+    $cmd = fsService()->buildCreateFileCommand('/app/new file.txt');
+
+    expect($cmd)
+        ->toContain('[ -e')
+        ->toContain(': >')
+        ->toContain(escapeshellarg('/app/new file.txt'));
+});
+
+it('builds a chmod command with a validated octal mode', function () {
+    $cmd = fsService()->buildChmodCommand('/app/x.sh', '0755');
+
+    expect($cmd)
+        ->toContain('chmod 0755 --')
+        ->toContain(escapeshellarg('/app/x.sh'));
+});
+
+it('rejects a non-octal chmod mode', function () {
+    fsService()->buildChmodCommand('/app/x.sh', 'rwx');
+})->throws(InvalidArgumentException::class);
+
+it('rejects an unsafe path in the chmod builder', function () {
+    fsService()->buildChmodCommand('/app/$(reboot)', '644');
+})->throws(Exception::class);
+
+it('uploads by scp-ing to the server then docker cp into the container', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+    $server = fsServer();
+    $local = tempnam(sys_get_temp_dir(), 'up');
+    file_put_contents($local, 'data');
+
+    (new ContainerFilesystemService($server, 'app-123'))->upload($local, '/app/plugins/x.jar');
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'docker cp')
+        && str_contains($process->command, 'app-123'));
+    @unlink($local);
+});
+
+it('rejects failed or corrupt read responses', function (string $output) {
+    Process::fake(['*' => Process::result(output: $output)]);
+    (new ContainerFilesystemService(fsServer(), 'app-123'))->read('/app/a.txt');
+})->with(['', 'ERROR', "OK\n!!!"])->throws(RuntimeException::class);
+
+it('executes read guards for real file bytes through the non-root sudo parser', function (string $content, bool $editable) {
+    $server = fsServer();
+    $server->update(['user' => 'deploy']);
+    $path = tempnam(sys_get_temp_dir(), 'fs-read-');
+    file_put_contents($path, $content);
+    Process::fake(function ($process) {
+        $lines = explode("\n", $process->command);
+        $body = implode("\n", array_slice($lines, 1, -1));
+        $local = new Symfony\Component\Process\Process([
+            'bash', '-c',
+            'sudo() { "$@"; }; docker() { shift 2; "$@"; }; export -f sudo docker;'."\n".$body,
+        ]);
+        $local->run();
+
+        return Process::result(output: $local->getOutput(), errorOutput: $local->getErrorOutput(), exitCode: $local->getExitCode());
+    });
+    try {
+        $service = new ContainerFilesystemService($server, 'app-123');
+        if ($editable) {
+            expect($service->read($path))->toBe($content);
+        } else {
+            expect(fn () => $service->read($path))->toThrow(RuntimeException::class);
+        }
+    } finally {
+        @unlink($path);
+    }
+})->with([
+    'empty' => ['', true],
+    'newline only' => ["\n\n", true],
+    'text' => ["hello\n", true],
+    'binary' => ["hello\0world", false],
+]);
+
+it('rejects a symlink to an oversized file before reading its content', function () {
+    $server = fsServer();
+    $path = tempnam(sys_get_temp_dir(), 'fs-size-');
+    $link = $path.'-link';
+    $handle = fopen($path, 'w');
+    ftruncate($handle, LocalFileVolume::MAX_CONTENT_SIZE + 1);
+    fclose($handle);
+    symlink($path, $link);
+    Process::fake(function ($process) {
+        $body = implode("\n", array_slice(explode("\n", $process->command), 1, -1));
+        $local = new Symfony\Component\Process\Process(['bash', '-c', 'sudo() { "$@"; }; docker() { shift 2; "$@"; }; export -f sudo docker;'."\n".$body]);
+        $local->run();
+
+        return Process::result(output: $local->getOutput(), exitCode: $local->getExitCode());
+    });
+    try {
+        expect(fn () => (new ContainerFilesystemService($server, 'app-123'))->read($link))
+            ->toThrow(RuntimeException::class, 'File is not editable');
+    } finally {
+        @unlink($link);
+        @unlink($path);
+    }
+});
+
+it('reads download type and size in one round trip', function (string $output, bool $isDir, int $size) {
+    Process::fake(['*' => Process::result(output: $output)]);
+
+    $info = (new ContainerFilesystemService(fsServer(), 'app-123'))->downloadInfo('/app/target');
+
+    expect($info)->toBe(['isDir' => $isDir, 'size' => $size]);
+    Process::assertRanTimes(fn () => true, 1);
+})->with([
+    'file' => ['file 497', false, 497],
+    'folder in KiB' => ['dir 4', true, 4096],
+]);
+
+it('rejects a download target that does not exist', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+
+    (new ContainerFilesystemService(fsServer(), 'app-123'))->downloadInfo('/app/missing');
+})->throws(RuntimeException::class, 'File not found.');
+
+it('builds download commands that write to stdout instead of a temp file', function () {
+    $svc = fsService();
+
+    expect($svc->buildDownloadCommand("/app/it's.txt", false))
+        ->toBe("docker exec 'app-123' cat -- ".escapeshellarg("/app/it's.txt"));
+    expect($svc->buildDownloadCommand('/app/dir', true))
+        ->toBe("docker exec 'app-123' tar czf - -C '/app/dir' .");
+});
+
+it('streams the remote command output to the writer in chunks', function () {
+    $server = fsServer();
+    $svc = new class($server, 'app-123') extends ContainerFilesystemService
+    {
+        public ?string $remoteCommand = null;
+
+        protected function sshCommand(string $command): string
+        {
+            $this->remoteCommand = $command;
+
+            return 'head -c 200000 /dev/zero';
+        }
+    };
+    $received = '';
+    $chunks = 0;
+
+    $svc->streamDownload('/app/a.bin', false, function (string $chunk) use (&$received, &$chunks) {
+        $received .= $chunk;
+        $chunks++;
+    });
+
+    expect($svc->remoteCommand)->toEndWith("docker exec 'app-123' cat -- '/app/a.bin'");
+    expect(strlen($received))->toBe(200000);
+    expect($chunks)->toBeGreaterThan(1);
+});
diff --git a/tests/Feature/DashboardCanvasTest.php b/tests/Feature/DashboardCanvasTest.php
new file mode 100644
index 0000000000..9204b3e77a
--- /dev/null
+++ b/tests/Feature/DashboardCanvasTest.php
@@ -0,0 +1,132 @@
+<?php
+
+use App\Enums\ApplicationDeploymentStatus;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'name' => 'web-server']);
+    $this->environment = Environment::factory()->create([
+        'project_id' => Project::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+});
+
+function dashboardCanvasApp(Environment $environment, Server $server, string $name): Application
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+
+    return Application::factory()->create([
+        'name' => $name,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+function dashboardCanvasDeployment(Application $application, Server $server, ApplicationDeploymentStatus $status): ApplicationDeploymentQueue
+{
+    return ApplicationDeploymentQueue::query()->forceCreate([
+        'application_id' => (string) $application->id,
+        'application_name' => $application->name,
+        'deployment_uuid' => (string) str()->uuid(),
+        'deployment_url' => '/deployment/'.$status->value,
+        'server_id' => $server->id,
+        'server_name' => $server->name,
+        'status' => $status->value,
+    ]);
+}
+
+function dashboardCanvasSession(object $test, User $user, Team $team): object
+{
+    return $test->actingAs($user)->withSession(['currentTeam' => $team])
+        ->withHeader('X-Canvas-Team', (string) $team->id);
+}
+
+test('the dashboard canvas marks applications with an active deployment and lists recent deployments', function () {
+    $deploying = dashboardCanvasApp($this->environment, $this->server, 'storefront');
+    $queued = dashboardCanvasApp($this->environment, $this->server, 'orders-api');
+    $idle = dashboardCanvasApp($this->environment, $this->server, 'docs');
+    dashboardCanvasDeployment($deploying, $this->server, ApplicationDeploymentStatus::IN_PROGRESS);
+    dashboardCanvasDeployment($queued, $this->server, ApplicationDeploymentStatus::QUEUED);
+    dashboardCanvasDeployment($idle, $this->server, ApplicationDeploymentStatus::FINISHED);
+
+    $response = dashboardCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/dashboard/canvas')
+        ->assertOk()
+        ->assertJsonPath('title', 'Dashboard')
+        ->assertJsonPath('zones.0.id', $this->server->uuid);
+    $nodes = collect($response->json('nodes'))->keyBy('id');
+
+    expect($nodes[$deploying->uuid]['deployment'])->toBe(['status' => 'in_progress', 'link' => '/deployment/in_progress', 'pull_request_id' => null])
+        ->and($nodes[$queued->uuid]['deployment']['status'])->toBe('queued')
+        ->and($nodes[$idle->uuid])->not->toHaveKey('deployment')
+        // The deployment panel lists running and queued deployments first, then the finished ones.
+        ->and(collect($response->json('deployments'))->map(fn (array $row) => [$row['application'], $row['status']])->all())->toBe([
+            [$deploying->uuid, 'in_progress'],
+            [$queued->uuid, 'queued'],
+            [$idle->uuid, 'finished'],
+        ]);
+});
+
+test('the dashboard canvas never shows another team servers, resources, or deployments', function () {
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $outsider = User::factory()->create();
+    $otherTeam->members()->attach($outsider->id, ['role' => 'owner']);
+    $this->team->members()->attach($outsider->id, ['role' => 'member']);
+    $app = dashboardCanvasApp($this->environment, $this->server, 'storefront');
+    dashboardCanvasDeployment($app, $this->server, ApplicationDeploymentStatus::IN_PROGRESS);
+
+    $response = dashboardCanvasSession($this, $outsider, $otherTeam)
+        ->getJson('/canvas/api/dashboard/canvas')
+        ->assertOk();
+
+    expect($response->json('zones'))->toBe([])
+        ->and($response->json('nodes'))->toBe([])
+        ->and($response->json('deployments'))->toBe([]);
+});
+
+test('the dashboard opens the canvas again when the user left it there', function () {
+    $cookie = "coolify_{$this->admin->id}_dashboard_view";
+
+    dashboardCanvasSession($this, $this->admin, $this->team)
+        ->withoutVite()
+        ->get(route('dashboard.canvas'))
+        ->assertOk()
+        ->assertSee('data-endpoint="/dashboard/canvas"', false)
+        ->assertCookie($cookie, 'canvas');
+
+    dashboardCanvasSession($this, $this->admin, $this->team)
+        ->withCookie($cookie, 'canvas')
+        ->get(route('dashboard'))
+        ->assertRedirect(route('dashboard.canvas'));
+
+    // The list link on the canvas opens the list and makes it the remembered view.
+    dashboardCanvasSession($this, $this->admin, $this->team)
+        ->withCookie($cookie, 'canvas')
+        ->get(route('dashboard', ['view' => 'list']))
+        ->assertOk()
+        ->assertCookie($cookie, 'list');
+});
diff --git a/tests/Feature/DashboardDeploymentsTest.php b/tests/Feature/DashboardDeploymentsTest.php
index 805aa49af8..d949a62e7e 100644
--- a/tests/Feature/DashboardDeploymentsTest.php
+++ b/tests/Feature/DashboardDeploymentsTest.php
@@ -55,9 +55,8 @@ function createDashboardDeployment(array $overrides = []): ApplicationDeployment
 
 it('hides the deployments section when there is nothing to show', function () {
     Livewire::test(ActiveDeployments::class)
-        ->assertDontSee('Active and recent deployment activity')
         ->assertDontSee('Running or queued right now')
-        ->assertDontSee('Latest completed deployments')
+        ->assertDontSee('Recent deployments')
         ->assertDontSee('No active deployments')
         ->assertDontSee('No recent deployments');
 });
@@ -72,7 +71,7 @@ it('shows only the active section when there are active deployments', function (
         ->assertSee('Deployments')
         ->assertSee('Running or queued right now')
         ->assertSee('Running Now')
-        ->assertDontSee('Latest completed deployments')
+        ->assertDontSee('Recent deployments')
         ->assertDontSee('No active deployments')
         ->assertDontSee('No recent deployments');
 });
@@ -85,7 +84,7 @@ it('shows only the recent section when there are recent deployments', function (
 
     Livewire::test(ActiveDeployments::class)
         ->assertSee('Deployments')
-        ->assertSee('Latest completed deployments')
+        ->assertSee('Recent deployments')
         ->assertSee('Finished Earlier')
         ->assertDontSee('Running or queued right now')
         ->assertDontSee('No active deployments')
diff --git a/tests/Feature/DashboardViewModeTest.php b/tests/Feature/DashboardViewModeTest.php
new file mode 100644
index 0000000000..008907103e
--- /dev/null
+++ b/tests/Feature/DashboardViewModeTest.php
@@ -0,0 +1,55 @@
+<?php
+
+use App\Livewire\Dashboard;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cookie;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('shows the projects and servers sections as tables by default', function () {
+    Livewire::test(Dashboard::class)
+        ->assertSee("viewMode: 'table'", false)
+        ->assertDontSee("viewMode: 'grid'", false);
+});
+
+it('remembers the view of each dashboard section on its own', function () {
+    Livewire::test(Dashboard::class)->call('saveListView', 'dashboard_projects', 'grid');
+
+    expect(Cookie::queued("coolify_{$this->user->id}_dashboard_projects_view")?->getValue())->toBe('grid')
+        ->and(Cookie::queued("coolify_{$this->user->id}_dashboard_servers_view"))->toBeNull();
+
+    $this->withCookie("coolify_{$this->user->id}_dashboard_projects_view", 'grid')
+        ->get(route('dashboard'))
+        ->assertOk()
+        ->assertSee("viewMode: 'grid'", false)
+        ->assertSee("viewMode: 'table'", false);
+});
+
+it('links to all projects only when the dashboard hides some of them', function () {
+    Project::factory()->count(8)->create(['team_id' => $this->team->id]);
+
+    Livewire::test(Dashboard::class)->assertDontSee(route('project.index'), false);
+
+    Project::factory()->create(['team_id' => $this->team->id]);
+
+    Livewire::test(Dashboard::class)->assertSee(route('project.index'), false);
+});
diff --git a/tests/Feature/DatabaseBackupMultipleS3DestinationsTest.php b/tests/Feature/DatabaseBackupMultipleS3DestinationsTest.php
new file mode 100644
index 0000000000..0191aa09d7
--- /dev/null
+++ b/tests/Feature/DatabaseBackupMultipleS3DestinationsTest.php
@@ -0,0 +1,434 @@
+<?php
+
+use App\Events\BackupCreated;
+use App\Jobs\DatabaseBackupJob;
+use App\Models\DatabaseBackupS3Replica;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+});
+
+function multiS3Storage(Team $team, string $name): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => strtolower($name).'-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+    ]);
+}
+
+function multiS3Execution(ScheduledDatabaseBackup $backup, string $name, array $attributes = []): ScheduledDatabaseBackupExecution
+{
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'uuid' => $name,
+        'database_name' => 'app',
+        'filename' => "/backup/{$name}.dmp",
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        's3_uploaded' => true,
+        'local_storage_deleted' => true,
+        ...$attributes,
+    ]);
+
+    return $execution;
+}
+
+/**
+ * Records the files that deleteBackupsS3() removes, keyed by bucket.
+ */
+function fakeMultiS3Deletes(): Collection
+{
+    $deleted = collect();
+    Storage::shouldReceive('build')->andReturnUsing(function (array $config) use ($deleted) {
+        $disk = Mockery::mock();
+        $disk->shouldReceive('delete')->andReturnUsing(function (array $files) use ($config, $deleted) {
+            $deleted->put($config['bucket'], [...$deleted->get($config['bucket'], []), ...$files]);
+
+            return true;
+        });
+
+        return $disk;
+    });
+
+    return $deleted;
+}
+
+/**
+ * Runs a backup with two S3 destinations, failing the upload to the storages named in $failingStorages.
+ *
+ * @return array{0: ScheduledDatabaseBackupExecution, 1: Collection<int, string>}
+ */
+function runMultiS3BackupJob(array $failingStorages): array
+{
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+    $server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $team->id])->id]);
+    $database = create_standalone_postgresql($environment->id, $destination, ['status' => 'running:healthy']);
+    $first = multiS3Storage($team, 'First');
+    $second = multiS3Storage($team, 'Second');
+    $backup = new ScheduledDatabaseBackup;
+    $backup->forceFill([
+        'enabled' => true,
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $first->id,
+        'frequency' => 'daily',
+        'databases_to_backup' => 'app',
+        'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(),
+        'team_id' => $team->id,
+    ])->save();
+    $backup->syncS3Storages([$first->id, $second->id]);
+    $commands = collect();
+    Process::fake(function ($process) use ($commands) {
+        $command = is_array($process->command) ? implode(' ', $process->command) : $process->command;
+        $commands->push($command);
+
+        return Process::result(output: str_contains($command, 'du -b') ? '128' : '');
+    });
+
+    $job = Mockery::mock(DatabaseBackupJob::class.'[upload_to_s3]', [$backup->fresh()])->shouldAllowMockingProtectedMethods();
+    $job->shouldReceive('upload_to_s3')->andReturnUsing(function (S3Storage $storage) use ($failingStorages) {
+        if (in_array($storage->name, $failingStorages, true)) {
+            throw new RuntimeException('access denied');
+        }
+    });
+    $job->handle();
+
+    return [ScheduledDatabaseBackupExecution::query()->sole(), $commands];
+}
+
+it('applies S3 retention to each destination separately', function () {
+    $team = Team::factory()->create();
+    $first = multiS3Storage($team, 'First');
+    $second = multiS3Storage($team, 'Second');
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+        'database_backup_retention_amount_s3' => 1,
+    ]);
+    $backup->syncS3Storages([$first->id, $second->id]);
+    $old = multiS3Execution($backup, 'old');
+    $new = multiS3Execution($backup, 'new', ['s3_uploaded' => false]);
+    ScheduledDatabaseBackupExecution::whereKey($old->id)->update(['created_at' => now()->subDay()]);
+    $old->s3Replicas()->create(['s3_storage_id' => $first->id, 's3_uploaded' => true]);
+    $old->s3Replicas()->create(['s3_storage_id' => $second->id, 's3_uploaded' => true]);
+    $new->s3Replicas()->create(['s3_storage_id' => $first->id, 's3_uploaded' => true]);
+    $new->s3Replicas()->create(['s3_storage_id' => $second->id, 's3_uploaded' => false, 'message' => 'denied']);
+    $deleted = fakeMultiS3Deletes();
+
+    removeOldBackups($backup);
+
+    expect($deleted->all())->toBe(['first-bucket' => ['/backup/old.dmp']])
+        ->and($old->s3Replicas()->where('s3_storage_id', $first->id)->sole()->s3_storage_deleted)->toBeTrue()
+        ->and($old->s3Replicas()->where('s3_storage_id', $second->id)->sole()->s3_storage_deleted)->toBeFalse()
+        ->and($old->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($backup->executions()->count())->toBe(2);
+});
+
+it('deletes the execution record when its last S3 copy expires', function () {
+    $team = Team::factory()->create();
+    $first = multiS3Storage($team, 'First');
+    $second = multiS3Storage($team, 'Second');
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+        'database_backup_retention_amount_s3' => 1,
+    ]);
+    $backup->syncS3Storages([$first->id, $second->id]);
+    $old = multiS3Execution($backup, 'old');
+    $new = multiS3Execution($backup, 'new');
+    ScheduledDatabaseBackupExecution::whereKey($old->id)->update(['created_at' => now()->subDay()]);
+    foreach ([$old, $new] as $execution) {
+        $execution->s3Replicas()->create(['s3_storage_id' => $first->id, 's3_uploaded' => true]);
+        $execution->s3Replicas()->create(['s3_storage_id' => $second->id, 's3_uploaded' => true]);
+    }
+    $deleted = fakeMultiS3Deletes();
+
+    removeOldBackups($backup);
+
+    expect($deleted->all())->toBe(['first-bucket' => ['/backup/old.dmp'], 'second-bucket' => ['/backup/old.dmp']])
+        ->and($old->fresh())->toBeNull()
+        ->and(DatabaseBackupS3Replica::where('execution_id', $old->id)->exists())->toBeFalse()
+        ->and($new->fresh())->not->toBeNull();
+});
+
+it('marks copies in a deleted storage as gone without calling S3', function () {
+    $team = Team::factory()->create();
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+    ]);
+    $execution = multiS3Execution($backup, 'orphaned');
+    $execution->s3Replicas()->create(['s3_storage_id' => null, 's3_uploaded' => true]);
+    Storage::shouldReceive('build')->never();
+
+    removeOldBackups($backup);
+
+    expect($execution->fresh())->toBeNull();
+});
+
+it('keeps an execution whose local file still exists after its S3 copies expire', function () {
+    $team = Team::factory()->create();
+    $storage = multiS3Storage($team, 'First');
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+    ]);
+    $execution = multiS3Execution($backup, 'local-copy', ['local_storage_deleted' => false]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $storage->id, 's3_uploaded' => true, 's3_storage_deleted' => true]);
+
+    removeOldBackups($backup);
+
+    expect($execution->fresh())->not->toBeNull();
+});
+
+it('deletes the S3 copies of an execution from every destination that has one', function () {
+    $team = Team::factory()->create();
+    $first = multiS3Storage($team, 'First');
+    $second = multiS3Storage($team, 'Second');
+    $failed = multiS3Storage($team, 'Failed');
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+    ]);
+    $execution = multiS3Execution($backup, 'manual', ['s3_uploaded' => false]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $first->id, 's3_uploaded' => true]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $second->id, 's3_uploaded' => true]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $failed->id, 's3_uploaded' => false]);
+    $deleted = fakeMultiS3Deletes();
+
+    $execution->deleteS3Copies();
+
+    expect($deleted->keys()->sort()->values()->all())->toBe(['first-bucket', 'second-bucket'])
+        ->and($execution->fresh()->s3_storage_deleted)->toBeTrue()
+        ->and($execution->hasLiveS3Copies())->toBeFalse();
+});
+
+describe('backup job', function () {
+    beforeEach(function () {
+        Storage::fake('ssh-keys');
+        Storage::fake('ssh-mux');
+        Event::fake([BackupCreated::class]);
+        Notification::fake();
+        InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+    });
+
+    it('uploads to every destination and deletes the local file when all uploads succeed', function () {
+        [$execution, $commands] = runMultiS3BackupJob([]);
+
+        expect($execution->status)->toBe('success')
+            ->and($execution->s3_uploaded)->toBeTrue()
+            ->and($execution->local_storage_deleted)->toBeTrue()
+            ->and($execution->s3Replicas()->pluck('s3_uploaded')->all())->toBe([true, true])
+            ->and($commands->contains(fn (string $command) => str_contains($command, 'rm -f') && str_contains($command, $execution->filename)))->toBeTrue();
+    });
+
+    it('continues to later destinations and keeps the local file when a replica write fails', function (array $failingStorages) {
+        $event = 'eloquent.creating: '.DatabaseBackupS3Replica::class;
+        Event::listen($event, function (DatabaseBackupS3Replica $replica): void {
+            if (S3Storage::find($replica->s3_storage_id)?->name === 'First') {
+                throw new RuntimeException('replica persistence failed');
+            }
+        });
+
+        try {
+            [$execution, $commands] = runMultiS3BackupJob($failingStorages);
+        } finally {
+            Event::forget($event);
+        }
+
+        $replica = $execution->s3Replicas()->with('s3')->sole();
+        expect($replica->s3->name)->toBe('Second')
+            ->and($replica->s3_uploaded)->toBeTrue()
+            ->and($execution->s3_storage_deleted)->toBeFalse()
+            ->and($execution->s3_uploaded)->toBeFalse()
+            ->and($execution->local_storage_deleted)->toBeFalse()
+            ->and($execution->message)->toContain('First: replica persistence failed')
+            ->and($commands->contains(fn (string $command) => str_contains($command, 'rm -f') && str_contains($command, $execution->filename)))->toBeFalse();
+
+        if ($failingStorages !== []) {
+            expect($execution->message)->toContain('First: access denied');
+        }
+    })->with([
+        'successful upload' => [[]],
+        'failed upload' => [['First']],
+    ]);
+
+    it('keeps the local file and names the failed destination when one upload fails', function () {
+        [$execution, $commands] = runMultiS3BackupJob(['Second']);
+
+        $replicas = $execution->s3Replicas()->with('s3')->get()->keyBy(fn ($replica) => $replica->s3->name);
+        expect($execution->status)->toBe('success')
+            ->and($execution->s3_uploaded)->toBeFalse()
+            ->and($execution->local_storage_deleted)->toBeFalse()
+            ->and($execution->message)->toContain('Second: access denied')
+            ->and($replicas['First']->s3_uploaded)->toBeTrue()
+            ->and($replicas['Second']->s3_uploaded)->toBeFalse()
+            ->and($replicas['Second']->message)->toBe('access denied')
+            ->and($commands->contains(fn (string $command) => str_contains($command, 'rm -f') && str_contains($command, $execution->filename)))->toBeFalse();
+    });
+});
+
+it('deletes an execution from every S3 destination through the API', function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+    $sshKeys = Storage::fake('ssh-keys');
+    $sshMux = Storage::fake('ssh-mux');
+    Process::fake();
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $team->members()->attach($user, ['role' => 'owner']);
+    session(['currentTeam' => $team]);
+    $token = $user->createToken('test-token', ['*'])->plainTextToken;
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+    $server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $team->id])->id]);
+    $database = create_standalone_postgresql($environment->id, $destination);
+    $first = multiS3Storage($team, 'First');
+    $second = multiS3Storage($team, 'Second');
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        'database_type' => $database->getMorphClass(),
+        'database_id' => $database->id,
+        'team_id' => $team->id,
+    ]);
+    $backup->syncS3Storages([$first->id, $second->id]);
+    $execution = multiS3Execution($backup, 'api', ['local_storage_deleted' => false]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $first->id, 's3_uploaded' => true]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $second->id, 's3_uploaded' => true]);
+    $deleted = fakeMultiS3Deletes();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshKeys);
+    Storage::shouldReceive('disk')->with('ssh-mux')->andReturn($sshMux);
+
+    $this->withHeaders(['Authorization' => 'Bearer '.$token])
+        ->deleteJson("/api/v1/databases/{$database->uuid}/backups/{$backup->uuid}/executions/{$execution->uuid}?delete_s3=true")
+        ->assertOk();
+
+    expect($deleted->all())->toBe(['first-bucket' => ['/backup/api.dmp'], 'second-bucket' => ['/backup/api.dmp']])
+        ->and($execution->fresh())->toBeNull();
+});
+
+it('copies the destinations of the same team to a cloned schedule', function () {
+    $team = Team::factory()->create();
+    $otherTeam = Team::factory()->create();
+    $first = multiS3Storage($team, 'First');
+    $second = multiS3Storage($team, 'Second');
+    $foreign = multiS3Storage($otherTeam, 'Foreign');
+    $attributes = [
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+    ];
+    $backup = ScheduledDatabaseBackup::create($attributes);
+    $backup->syncS3Storages([$first->id, $second->id]);
+    $backup->s3Storages()->attach($foreign->id);
+    $copy = ScheduledDatabaseBackup::create($attributes);
+
+    $backup->copyS3StoragesTo($copy);
+
+    expect($copy->s3Storages()->pluck('s3_storages.id')->sort()->values()->all())->toBe([$first->id, $second->id]);
+});
+
+it('requires a live S3 copy for local retention only when local backups are disabled', function (bool $disabled, ?array $replica, bool $deleted) {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+    $server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $team->id])->id]);
+    $database = create_standalone_postgresql($environment->id, $destination);
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        'disable_local_backup' => $disabled,
+        'database_backup_retention_amount_locally' => 1,
+        'database_type' => $database->getMorphClass(),
+        'database_id' => $database->id,
+        'team_id' => $team->id,
+    ]);
+    $older = multiS3Execution($backup, 'older', ['local_storage_deleted' => false, 'created_at' => now()->subDay()]);
+    $newer = multiS3Execution($backup, 'newer', ['local_storage_deleted' => false]);
+    if ($replica !== null) {
+        $storage = multiS3Storage($team, 'Retention');
+        foreach ([$older, $newer] as $execution) {
+            $execution->s3Replicas()->create(['s3_storage_id' => $storage->id, ...$replica]);
+        }
+    }
+    $commands = collect();
+    Process::fake(function ($process) use ($commands) {
+        $commands->push(is_array($process->command) ? implode(' ', $process->command) : $process->command);
+
+        return Process::result();
+    });
+
+    removeOldBackups($backup);
+
+    expect($commands->contains(fn (string $command): bool => str_contains($command, '/backup/older.dmp')))->toBe($deleted);
+    if ($deleted && $replica === null) {
+        $this->assertModelMissing($older);
+    } else {
+        expect($older->fresh()->local_storage_deleted)->toBe($deleted);
+    }
+    expect($newer->fresh()->local_storage_deleted)->toBeFalse();
+})->with([
+    'no replica' => [true, null, false],
+    'failed upload' => [true, ['s3_uploaded' => false], false],
+    'deleted replica' => [true, ['s3_uploaded' => true, 's3_storage_deleted' => true], false],
+    'live replica' => [true, ['s3_uploaded' => true, 's3_storage_deleted' => false], true],
+    'normal local retention' => [false, null, true],
+]);
diff --git a/tests/Feature/DatabaseFlushTest.php b/tests/Feature/DatabaseFlushTest.php
new file mode 100644
index 0000000000..476aed154d
--- /dev/null
+++ b/tests/Feature/DatabaseFlushTest.php
@@ -0,0 +1,112 @@
+<?php
+
+use App\Livewire\Project\Shared\Danger;
+use App\Models\AuditEvent;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $this->withoutDefer();
+});
+
+function createFlushableDatabase(string $model, array $attributes = []): StandaloneRedis|StandaloneKeydb|StandaloneDragonfly
+{
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+        'user' => 'deploy',
+    ]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+
+    return $model::create([
+        'name' => 'cache',
+        'image' => 'redis:7',
+        'environment_id' => Environment::factory()->create(['project_id' => $project->id])->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        ...$attributes,
+    ]);
+}
+
+function actingAsFlushUser(Team $team, string $role): void
+{
+    $user = User::factory()->create();
+    $team->members()->attach($user->id, ['role' => $role]);
+    test()->actingAs($user);
+    session(['currentTeam' => $team]);
+}
+
+it('flushes every key with the engine CLI', function (string $model, array $attributes, string $cli) {
+    $database = createFlushableDatabase($model, $attributes);
+    actingAsFlushUser($database->team(), 'owner');
+    Process::fake(['*' => Process::result(output: 'OK')]);
+
+    Livewire::test(Danger::class, ['resource' => $database])
+        ->call('flush', 'password')
+        ->assertReturned(true)
+        ->assertDispatched('success');
+
+    Process::assertRan(fn ($process) => str_contains($process->command, "sudo bash -c 'docker exec {$database->uuid} sh -c '\\''REDISCLI_AUTH=\"\$REDIS_PASSWORD\" {$cli} FLUSHALL ASYNC'\\'''"));
+    expect(AuditEvent::query()->where('event', 'ui.database.flushed')->where('resource_uuid', $database->uuid)->exists())->toBeTrue();
+})->with([
+    'redis' => [StandaloneRedis::class, [], 'redis-cli'],
+    'keydb' => [StandaloneKeydb::class, ['keydb_password' => 'secret'], 'keydb-cli'],
+    'dragonfly with tls' => [StandaloneDragonfly::class, ['dragonfly_password' => 'secret', 'enable_ssl' => true], 'redis-cli --tls --cacert /etc/dragonfly/certs/coolify-ca.crt --cert /etc/dragonfly/certs/server.crt --key /etc/dragonfly/certs/server.key'],
+]);
+
+it('reports an error when the database does not reply OK', function () {
+    $database = createFlushableDatabase(StandaloneRedis::class);
+    actingAsFlushUser($database->team(), 'owner');
+    Process::fake(['*' => Process::result(output: 'NOAUTH Authentication required.')]);
+
+    Livewire::test(Danger::class, ['resource' => $database])
+        ->call('flush', 'password')
+        ->assertReturned(false)
+        ->assertDispatched('error', 'NOAUTH Authentication required.');
+
+    expect(AuditEvent::query()->where('event', 'ui.database.flushed')->exists())->toBeFalse();
+});
+
+it('rejects an incorrect password without flushing', function () {
+    $database = createFlushableDatabase(StandaloneRedis::class);
+    actingAsFlushUser($database->team(), 'owner');
+    Process::fake();
+
+    Livewire::test(Danger::class, ['resource' => $database])
+        ->call('flush', 'wrong-password')
+        ->assertReturned('The provided password is incorrect.');
+
+    Process::assertNothingRan();
+});
+
+it('forbids flushing without permission to manage the database', function (string $role, bool $sameTeam) {
+    $database = createFlushableDatabase(StandaloneRedis::class);
+    actingAsFlushUser($sameTeam ? $database->team() : Team::factory()->create(), $role);
+    Process::fake();
+
+    Livewire::test(Danger::class, ['resource' => $database])
+        ->call('flush', 'password')
+        ->assertDispatched('error');
+
+    Process::assertNothingRan();
+})->with([
+    'team member' => ['member', true],
+    'admin of another team' => ['admin', false],
+]);
diff --git a/tests/Feature/DeployCanvasPageTest.php b/tests/Feature/DeployCanvasPageTest.php
new file mode 100644
index 0000000000..7b79b9cc98
--- /dev/null
+++ b/tests/Feature/DeployCanvasPageTest.php
@@ -0,0 +1,172 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'canvas-team-project']);
+    $this->otherProject = Project::factory()->create(['team_id' => $this->otherTeam->id, 'name' => 'canvas-other-project']);
+    $this->user = User::factory()->create();
+});
+
+function actingInCanvasTeam(object $test, Team $team): object
+{
+    return $test->actingAs($test->user)->withSession(['currentTeam' => $team])
+        ->withHeader('X-Canvas-Team', (string) $team->id);
+}
+
+test('guests are sent to the login page', function () {
+    $this->get('/canvas')->assertRedirect('/login');
+});
+
+test('team members can open the deploy canvas', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+
+    actingInCanvasTeam($this, $this->team)
+        ->withoutVite()
+        ->get('/canvas')
+        ->assertOk()
+        ->assertSee('data-deploy-canvas', false);
+});
+
+test('the deploy canvas page lists the service template logos for the service step', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+    $template = get_service_templates()->first(fn ($template) => filled(data_get($template, 'logo')) && basename(data_get($template, 'logo')) !== 'default.webp');
+    $key = get_service_templates()->search($template);
+
+    $html = actingInCanvasTeam($this, $this->team)->withoutVite()->get('/canvas')->assertOk()->getContent();
+
+    preg_match('/<script type="application\/json" data-deploy-canvas-service-logos>(.*?)<\/script>/s', $html, $matches);
+    $logos = json_decode($matches[1] ?? '', true);
+    expect($logos[$key][0])->toBe(service_logo_urls(data_get($template, 'logo'))['logo']);
+});
+
+test('guests cannot call the canvas api', function () {
+    $this->getJson('/canvas/api/projects')->assertUnauthorized();
+});
+
+test('the canvas api works with the session and only shows the session team', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'admin']);
+
+    actingInCanvasTeam($this, $this->team)
+        ->getJson('/canvas/api/projects')
+        ->assertOk()
+        ->assertJsonFragment(['name' => 'canvas-team-project'])
+        ->assertJsonMissing(['name' => 'canvas-other-project']);
+});
+
+test('the canvas api uses the team of the open page, not the session team', function () {
+    // Member of the page's team, owner of the team the session switched to in another tab.
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+    $this->otherTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $page = fn () => $this->actingAs($this->user)->withSession(['currentTeam' => $this->otherTeam])
+        ->withHeader('X-Canvas-Team', (string) $this->team->id);
+
+    $page()->getJson('/canvas/api/projects')
+        ->assertOk()
+        ->assertJsonFragment(['name' => 'canvas-team-project'])
+        ->assertJsonMissing(['name' => 'canvas-other-project']);
+    // The role in the page's team applies: no owner rights from the session team.
+    $page()->postJson('/canvas/api/applications/dockerimage', ['docker_registry_image_name' => 'nginx'])
+        ->assertForbidden();
+});
+
+test('the canvas api refuses a missing team or a team the user is not a member of', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user)->withSession(['currentTeam' => $this->team])
+        ->getJson('/canvas/api/projects')
+        ->assertStatus(400);
+    $this->actingAs($this->user)->withSession(['currentTeam' => $this->team])
+        ->withHeader('X-Canvas-Team', (string) $this->otherTeam->id)
+        ->getJson('/canvas/api/projects')
+        ->assertUnauthorized();
+});
+
+test('the deploy canvas page keeps the team it was opened with', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+
+    actingInCanvasTeam($this, $this->team)
+        ->withoutVite()
+        ->get('/canvas')
+        ->assertOk()
+        ->assertSee('data-team="'.$this->team->id.'"', false);
+});
+
+test('admins can create resources through the canvas api', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'admin']);
+
+    // Passes the permission checks and reaches the controller's validation.
+    actingInCanvasTeam($this, $this->team)
+        ->postJson('/canvas/api/applications/dockerimage', ['docker_registry_image_name' => 'nginx'])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors(['project_uuid']);
+});
+
+test('members only get read access through the canvas api', function () {
+    // Owner of another team, but only a member of the session team.
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+    $this->otherTeam->members()->attach($this->user->id, ['role' => 'owner']);
+
+    actingInCanvasTeam($this, $this->team)
+        ->getJson('/canvas/api/projects')
+        ->assertOk()
+        ->assertJsonFragment(['name' => 'canvas-team-project'])
+        ->assertJsonMissing(['name' => 'canvas-other-project']);
+
+    actingInCanvasTeam($this, $this->team)
+        ->postJson('/canvas/api/applications/dockerimage', ['docker_registry_image_name' => 'nginx'])
+        ->assertForbidden();
+
+    actingInCanvasTeam($this, $this->team)
+        ->postJson('/canvas/api/deploy', ['uuid' => 'anything'])
+        ->assertForbidden();
+});
+
+test('admins can add projects and environments through the canvas api', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'admin']);
+
+    $projectUuid = actingInCanvasTeam($this, $this->team)
+        ->postJson('/canvas/api/projects', ['name' => 'canvas-new-project'])
+        ->assertCreated()
+        ->json('uuid');
+
+    $project = Project::query()->where('uuid', $projectUuid)->firstOrFail();
+    expect($project->team_id)->toBe($this->team->id)
+        ->and($project->environments()->pluck('name')->all())->toBe(['production']);
+
+    $environmentUuid = actingInCanvasTeam($this, $this->team)
+        ->postJson("/canvas/api/projects/{$projectUuid}/environments", ['name' => 'staging'])
+        ->assertCreated()
+        ->json('uuid');
+
+    expect($project->environments()->where('uuid', $environmentUuid)->value('name'))->toBe('staging');
+});
+
+test('members cannot add projects or environments, and nobody can add to another team project', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+    $this->otherTeam->members()->attach($this->user->id, ['role' => 'owner']);
+
+    actingInCanvasTeam($this, $this->team)
+        ->postJson('/canvas/api/projects', ['name' => 'canvas-member-project'])
+        ->assertForbidden();
+    actingInCanvasTeam($this, $this->team)
+        ->postJson("/canvas/api/projects/{$this->project->uuid}/environments", ['name' => 'staging'])
+        ->assertForbidden();
+
+    // As owner of the other team, the session team's projects are out of reach.
+    actingInCanvasTeam($this, $this->otherTeam)
+        ->postJson("/canvas/api/projects/{$this->project->uuid}/environments", ['name' => 'staging'])
+        ->assertNotFound();
+
+    expect(Project::query()->where('name', 'canvas-member-project')->exists())->toBeFalse()
+        ->and($this->project->environments()->where('name', 'staging')->exists())->toBeFalse();
+});
diff --git a/tests/Feature/DeploymentCancellationCleanupTest.php b/tests/Feature/DeploymentCancellationCleanupTest.php
index 6912ae604a..0721fbc4d2 100644
--- a/tests/Feature/DeploymentCancellationCleanupTest.php
+++ b/tests/Feature/DeploymentCancellationCleanupTest.php
@@ -179,3 +179,16 @@ test('cancelling after switching to another team still cleans up and starts the
     assertCancelCleanupRanCorrectly($this->remoteCommands, $this->deployment);
     expect($queued->fresh()->status)->toBe(ApplicationDeploymentStatus::IN_PROGRESS->value);
 });
+
+test('cancelling a Railpack deployment stops the idle Railpack builder on the build server', function (string $buildPack, bool $stopsBuilder) {
+    $this->application->update(['build_pack' => $buildPack]);
+    $this->actingAs($this->user);
+
+    Livewire::test(DeploymentNavbar::class, ['application_deployment_queue' => $this->deployment])
+        ->call('cancel');
+
+    expect(cancelCleanupCommandsOn($this->remoteCommands, '203.0.113.20', 'docker buildx stop coolify-railpack') !== [])->toBe($stopsBuilder);
+})->with([
+    'railpack' => ['railpack', true],
+    'nixpacks' => ['nixpacks', false],
+]);
diff --git a/tests/Feature/DeploymentEmailCommitDetailsTest.php b/tests/Feature/DeploymentEmailCommitDetailsTest.php
new file mode 100644
index 0000000000..bbba70f796
--- /dev/null
+++ b/tests/Feature/DeploymentEmailCommitDetailsTest.php
@@ -0,0 +1,319 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Livewire\Notifications\Email as NotificationEmail;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Notifications\Application\DeploymentFailed;
+use App\Notifications\Application\DeploymentSuccess;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Notification;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+const DEPLOYMENT_EMAIL_COMMIT_SHA = '3f9c2a7b1d4e5f60718293a4b5c6d7e8f9012345';
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::factory()->create([
+        'server_id' => $server->id,
+        'network' => 'commit-details-'.fake()->unique()->word(),
+    ]);
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'git_repository' => 'https://github.com/acme/shop.git',
+        'git_branch' => 'main',
+        'fqdn' => 'https://shop.example.com',
+    ]);
+});
+
+function createDeploymentRow(Application $application, array $attributes = []): ApplicationDeploymentQueue
+{
+    return ApplicationDeploymentQueue::create([
+        'application_id' => $application->id,
+        'deployment_uuid' => 'deploy-'.fake()->unique()->uuid(),
+        'commit' => DEPLOYMENT_EMAIL_COMMIT_SHA,
+        'commit_message' => "Add checkout page\n\nHandles card and wallet payments.",
+        'status' => 'finished',
+        ...$attributes,
+    ]);
+}
+
+function enableCommitDetails(Team $team, bool $enabled = true): void
+{
+    $team->emailNotificationSettings->update(['deployment_commit_details_email_notifications' => $enabled]);
+    $team->refresh();
+}
+
+function renderDeploymentMail(string $notificationClass, Application $application, ApplicationDeploymentQueue $deployment, Team $team, ?ApplicationPreview $preview = null): string
+{
+    return (string) (new $notificationClass($application, $deployment->deployment_uuid, $preview, $deployment))->toMail($team)->render();
+}
+
+it('defaults the commit details setting to off', function () {
+    expect($this->team->emailNotificationSettings->fresh()->deployment_commit_details_email_notifications)->toBeFalse();
+});
+
+it('includes commit details in deployment emails when enabled', function (string $notificationClass) {
+    enableCommitDetails($this->team);
+    $deployment = createDeploymentRow($this->application);
+
+    $html = renderDeploymentMail($notificationClass, $this->application, $deployment, $this->team);
+
+    expect($html)
+        ->toContain('3f9c2a7')
+        ->toContain('https://github.com/acme/shop/commit/'.DEPLOYMENT_EMAIL_COMMIT_SHA)
+        ->toContain('main')
+        ->toContain('Add checkout page')
+        ->toContain('Handles card and wallet payments.');
+})->with([DeploymentSuccess::class, DeploymentFailed::class]);
+
+it('leaves deployment emails unchanged when the setting is off', function (string $notificationClass) {
+    enableCommitDetails($this->team, false);
+    $deployment = createDeploymentRow($this->application);
+
+    $html = renderDeploymentMail($notificationClass, $this->application, $deployment, $this->team);
+
+    expect($html)
+        ->not->toContain('3f9c2a7')
+        ->not->toContain('Add checkout page')
+        ->toContain('View Deployment Logs');
+})->with([DeploymentSuccess::class, DeploymentFailed::class]);
+
+it('hides the commit block when the deployment has no commit information', function () {
+    enableCommitDetails($this->team);
+    $deployment = createDeploymentRow($this->application, ['commit' => 'HEAD', 'commit_message' => null]);
+
+    $html = renderDeploymentMail(DeploymentSuccess::class, $this->application, $deployment, $this->team);
+
+    expect($html)
+        ->not->toContain('Commit:')
+        ->not->toContain('Commit message:')
+        ->toContain('View Deployment Logs');
+});
+
+it('shows the commit for preview deployments without the base branch', function () {
+    enableCommitDetails($this->team);
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/acme/shop/pull/42',
+        'fqdn' => 'https://pr-42.shop.example.com',
+    ]);
+    $deployment = createDeploymentRow($this->application, ['pull_request_id' => 42]);
+
+    $html = renderDeploymentMail(DeploymentSuccess::class, $this->application, $deployment, $this->team, $preview);
+
+    expect($html)
+        ->toContain('Pull request #42')
+        ->toContain('3f9c2a7')
+        ->toContain('Add checkout page')
+        ->not->toContain(' on main');
+});
+
+it('escapes html and markdown in commit messages', function () {
+    enableCommitDetails($this->team);
+    $deployment = createDeploymentRow($this->application, [
+        'commit_message' => "Fix <script>alert(1)</script> bug\n[Verify your account](https://evil.example.com)\n# Big heading",
+    ]);
+
+    $html = renderDeploymentMail(DeploymentSuccess::class, $this->application, $deployment, $this->team);
+
+    expect($html)
+        ->not->toContain('<script>alert(1)</script>')
+        ->toContain('&lt;script&gt;')
+        ->not->toContain('href="https://evil.example.com"')
+        ->toContain('[Verify your account](https://evil.example.com)')
+        ->not->toContain('<h1>Big heading</h1>')
+        ->toContain('# Big heading');
+});
+
+it('lets team admins toggle commit details from email notification settings', function () {
+    $admin = User::factory()->create();
+    $this->team->members()->attach($admin->id, ['role' => 'admin']);
+    $this->actingAs($admin);
+    session(['currentTeam' => $this->team]);
+    Cache::flush();
+
+    Livewire::test(NotificationEmail::class)
+        ->assertSet('deploymentCommitDetailsEmailNotifications', false)
+        ->set('deploymentCommitDetailsEmailNotifications', true)
+        ->call('instantSaveDeploymentCommitDetails')
+        ->assertHasNoErrors();
+
+    expect($this->team->emailNotificationSettings->fresh()->deployment_commit_details_email_notifications)->toBeTrue();
+});
+
+it('does not let team members change the commit details setting', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+    Cache::flush();
+
+    Livewire::test(NotificationEmail::class)
+        ->set('deploymentCommitDetailsEmailNotifications', true)
+        ->call('instantSaveDeploymentCommitDetails')
+        ->assertSet('deploymentCommitDetailsEmailNotifications', false);
+
+    expect($this->team->emailNotificationSettings->fresh()->deployment_commit_details_email_notifications)->toBeFalse();
+});
+
+it('does not let admins of another team change the commit details setting', function () {
+    $otherTeam = Team::factory()->create();
+    $outsider = User::factory()->create();
+    $otherTeam->members()->attach($outsider->id, ['role' => 'admin']);
+    $this->actingAs($outsider);
+    session(['currentTeam' => $otherTeam]);
+    Cache::flush();
+
+    Livewire::test(NotificationEmail::class)
+        ->set('deploymentCommitDetailsEmailNotifications', true)
+        ->call('instantSaveDeploymentCommitDetails');
+
+    expect($this->team->emailNotificationSettings->fresh()->deployment_commit_details_email_notifications)->toBeFalse()
+        ->and($otherTeam->emailNotificationSettings->fresh()->deployment_commit_details_email_notifications)->toBeTrue();
+});
+
+function bigMarkdownCommitMessage(): string
+{
+    return implode("\n", [
+        'feat(checkout): rebuild payment flow',
+        '',
+        '# Heading one',
+        'Setext heading',
+        '==============',
+        '## Heading two',
+        '- bullet one',
+        '* bullet two',
+        '+ bullet three',
+        '1. first step',
+        '2. second step',
+        '> quoted text',
+        '    indented code line',
+        '```php',
+        'echo "hello";',
+        '```',
+        '| Column A | Column B |',
+        '| -------- | -------- |',
+        '| cell 1   | cell 2   |',
+        '**bold** _italic_ ~~strike~~ `inline code`',
+        '[Reset your password](https://evil.example.com/reset)',
+        '![tracking pixel](https://evil.example.com/pixel.png)',
+        '<https://evil.example.com/autolink>',
+        '<img src="https://evil.example.com/x.png" onerror="alert(1)">',
+        '<a href="https://evil.example.com">click me</a>',
+        '---',
+        'Co-authored-by: Jane Doe <jane@example.com>',
+        'Emoji check 🚀 ✅',
+        '',
+        str_repeat('Long body sentence for truncation. ', 60),
+        'THIS_TAIL_SHOULD_BE_TRUNCATED',
+    ]);
+}
+
+it('renders a big markdown commit message as plain safe text', function () {
+    enableCommitDetails($this->team);
+    $deployment = createDeploymentRow($this->application, ['commit_message' => bigMarkdownCommitMessage()]);
+
+    $html = renderDeploymentMail(DeploymentSuccess::class, $this->application, $deployment, $this->team);
+
+    expect($html)
+        ->toContain('feat(checkout): rebuild payment flow')
+        ->toContain('# Heading one')
+        ->toContain('==============')
+        ->toContain('- bullet one')
+        ->toContain('1. first step')
+        ->toContain('```php')
+        ->toContain('| Column A | Column B |')
+        ->toContain('**bold** _italic_ ~~strike~~ `inline code`')
+        ->toContain('Co-authored-by: Jane Doe &lt;jane@example.com&gt;')
+        ->toContain('Emoji check 🚀 ✅')
+        ->not->toContain("\u{FFFD}")
+        ->toContain('Long body sentence for truncation.')
+        ->not->toContain('THIS_TAIL_SHOULD_BE_TRUNCATED')
+        ->not->toContain('href="https://evil.example.com')
+        ->not->toContain('src="https://evil.example.com')
+        ->not->toContain('<img')
+        ->not->toContain('<a href="https://evil')
+        ->not->toContain('<h1>')
+        ->not->toContain('<h2>')
+        ->not->toContain('<ul>')
+        ->not->toContain('<ol>')
+        ->not->toContain('<blockquote>')
+        ->not->toContain('<pre>')
+        ->not->toContain('<table>')
+        ->not->toContain('<strong>bold</strong>')
+        ->toContain('---<br />');
+});
+
+it('keeps the email working when a commit message has invalid utf-8 bytes', function () {
+    enableCommitDetails($this->team);
+    $deployment = createDeploymentRow($this->application, ['commit_message' => "Fix caf\xE9 menu (latin-1 byte)"]);
+
+    $html = renderDeploymentMail(DeploymentSuccess::class, $this->application, $deployment, $this->team);
+
+    expect($html)
+        ->toContain('Fix caf')
+        ->toContain('menu (latin-1 byte)')
+        ->toContain('View Deployment Logs');
+});
+
+it('builds commit details without querying the deployment queue', function (string $notificationClass) {
+    enableCommitDetails($this->team);
+    $deployment = createDeploymentRow($this->application);
+
+    DB::flushQueryLog();
+    DB::enableQueryLog();
+    $notification = new $notificationClass($this->application, $deployment->deployment_uuid, null, $deployment);
+    $queries = collect(DB::getQueryLog())->pluck('query');
+    DB::disableQueryLog();
+
+    expect($queries->filter(fn (string $query): bool => str_contains($query, 'application_deployment_queues')))->toBeEmpty()
+        ->and($notification->commit_sha)->toBe(DEPLOYMENT_EMAIL_COMMIT_SHA);
+})->with([DeploymentSuccess::class, DeploymentFailed::class]);
+
+it('keeps the old constructor working without a deployment record', function () {
+    enableCommitDetails($this->team);
+
+    $html = (string) (new DeploymentSuccess($this->application, 'legacy-call'))->toMail($this->team)->render();
+
+    expect($html)
+        ->toContain('View Deployment Logs')
+        ->not->toContain('Commit message:');
+});
+
+it('passes the in-memory deployment record from the deployment job', function () {
+    Notification::fake();
+    $this->team->emailNotificationSettings->update(['smtp_enabled' => true, 'deployment_success_email_notifications' => true]);
+    $deployment = createDeploymentRow($this->application);
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+    foreach (['application' => $this->application, 'deployment_uuid' => $deployment->deployment_uuid, 'preview' => null, 'application_deployment_queue' => $deployment] as $name => $value) {
+        $reflection->getProperty($name)->setValue($job, $value);
+    }
+
+    $reflection->getMethod('sendDeploymentNotification')->invoke($job, DeploymentSuccess::class);
+
+    Notification::assertSentTo($this->team, DeploymentSuccess::class, fn (DeploymentSuccess $notification) => $notification->commit_sha === DEPLOYMENT_EMAIL_COMMIT_SHA
+        && str_starts_with($notification->commit_message, 'Add checkout page'));
+});
diff --git a/tests/Feature/DeploymentsIndicatorTest.php b/tests/Feature/DeploymentsIndicatorTest.php
index 5391826444..c89ce6c12d 100644
--- a/tests/Feature/DeploymentsIndicatorTest.php
+++ b/tests/Feature/DeploymentsIndicatorTest.php
@@ -74,3 +74,42 @@ it('does not show deployments of applications owned by another team', function (
         ->assertDontSee('Indicator App')
         ->assertDontSee('Active deployments');
 });
+
+it('hides the indicator on the page of the only application that is deploying', function () {
+    $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]))
+        ->assertSuccessful()
+        ->assertDontSee('aria-label="Active deployments"', false);
+});
+
+it('keeps the indicator on an application page when another application is deploying', function () {
+    $otherApplication = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'name' => 'Other App',
+    ]);
+
+    ApplicationDeploymentQueue::create([
+        'application_id' => $otherApplication->id,
+        'application_name' => $otherApplication->name,
+        'deployment_uuid' => 'deploy-indicator-'.fake()->uuid(),
+        'deployment_url' => '/deployments/other',
+        'server_id' => $this->server->id,
+        'server_name' => $this->server->name,
+        'status' => ApplicationDeploymentStatus::QUEUED->value,
+        'pull_request_id' => 0,
+    ]);
+
+    $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]))
+        ->assertSuccessful()
+        ->assertSee('2 deployments', false)
+        ->assertSee('aria-label="Active deployments"', false);
+});
diff --git a/tests/Feature/DevScriptTest.php b/tests/Feature/DevScriptTest.php
index 1864c012f9..232bde15de 100644
--- a/tests/Feature/DevScriptTest.php
+++ b/tests/Feature/DevScriptTest.php
@@ -245,6 +245,30 @@ BASH);
         ->not->toContain('--profile testing-host up');
 });
 
+it('runs the host qemu command with a clean local environment', function () {
+    if (! function_exists('posix_geteuid') || posix_geteuid() !== 0 || ! file_exists('/dev/kvm') || filetype('/dev/kvm') !== 'char' || ! is_readable('/dev/kvm') || ! is_writable('/dev/kvm')) {
+        $this->markTestSkipped('KVM and root access are required for this launcher branch.');
+    }
+
+    file_put_contents($this->devRoot.'/bin/php', <<<'BASH'
+#!/usr/bin/env bash
+[[ "$APP_ENV" == local && "$APP_CONFIG_CACHE" == */bootstrap/cache/dev-qemu-*.php ]] || {
+  echo 'This command may only run in development mode.' >&2
+  exit 1
+}
+printf 'php %s ENV=%s CACHE=%s\n' "$*" "$APP_ENV" "$APP_CONFIG_CACHE" >> "$DEV_TEST_LOG"
+BASH);
+
+    $process = runDevScript('wt', ['start', 'ubuntu-root'], [
+        'COOLIFY_DEV_SERVER_BACKEND' => 'auto',
+        'APP_ENV' => 'production',
+        'APP_CONFIG_CACHE' => '/tmp/stale-config.php',
+    ]);
+
+    expect($process->isSuccessful())->toBeTrue($process->getErrorOutput())
+        ->and(devScriptLog())->toContain('php artisan dev:qemu ubuntu-root --as-localhost ENV=local CACHE=');
+});
+
 it('starts a lima vm as localhost on macos and seeds its forwarded ssh port', function () {
     ($this->fakeLima)();
     runDevScript('main', ['start']);
diff --git a/tests/Feature/DevelopmentQemuVmTest.php b/tests/Feature/DevelopmentQemuVmTest.php
index ad6d1d76d0..60c273a36a 100644
--- a/tests/Feature/DevelopmentQemuVmTest.php
+++ b/tests/Feature/DevelopmentQemuVmTest.php
@@ -173,16 +173,41 @@ it('can change the localhost qemu profile without adding a server', function ()
 
 it('seeds localhost through the container command', function () {
     $this->seed(ServerSeeder::class);
+    Process::fake();
 
     expect(Artisan::call('dev:qemu:seed', [
         'profile' => 'ubuntu-root',
         '--as-localhost' => true,
     ]))->toBe(Command::SUCCESS)
         ->and(Server::query()->findOrFail(0)->ip)->toBe('192.168.122.10');
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'docker run -d --name coolify-db')
+        && str_contains($process->command, 'POSTGRES_DB='));
+});
+
+it('starts the instance database container with sudo on a non-root localhost vm', function () {
+    $this->seed(ServerSeeder::class);
+    Process::fake();
+
+    Artisan::call('dev:qemu:seed', ['profile' => 'ubuntu-non-root', '--as-localhost' => true]);
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'if ! sudo docker inspect coolify-db')
+        && str_contains($process->command, 'sudo docker run -d --name coolify-db')
+        && str_contains($process->command, 'sudo docker start coolify-db'));
+});
+
+it('still seeds localhost when the instance database container cannot start', function () {
+    $this->seed(ServerSeeder::class);
+    Process::fake(fn () => Process::result(errorOutput: 'Cannot connect to the Docker daemon', exitCode: 1));
+
+    expect(Artisan::call('dev:qemu:seed', ['profile' => 'ubuntu-root', '--as-localhost' => true]))->toBe(Command::SUCCESS)
+        ->and(Artisan::output())->toContain('Could not start the coolify-db container')
+        ->and(Server::query()->findOrFail(0)->ip)->toBe('192.168.122.10');
 });
 
 it('seeds localhost with the forwarded ssh address of a lima vm', function () {
     $this->seed(ServerSeeder::class);
+    Process::fake();
 
     expect(Artisan::call('dev:qemu:seed', [
         'profile' => 'debian-non-root',
@@ -210,22 +235,31 @@ it('replaces the seeded qemu server with the selected non-root equivalent', func
 
 it('reuses an existing vm without touching other managed vms', function () {
     $storagePath = sys_get_temp_dir().'/coolify-qemu-reuse-test-'.uniqid();
-    config(['development-qemu.storage_path' => $storagePath]);
+    config(['development-qemu.storage_path' => $storagePath, 'development-qemu.memory' => 1024]);
     File::ensureDirectoryExists($storagePath);
     File::put("{$storagePath}/coolify-dev-ubuntu-root.qcow2", 'other vm data');
     File::put("{$storagePath}/coolify-dev-ubuntu-non-root.qcow2", 'vm data');
 
-    Process::fake([
-        '* net-dumpxml *' => Process::result(output: '<network></network>'),
-        '* network inspect *' => Process::result(output: "172.18.0.0/16\n"),
-        '* dominfo *' => Process::result(output: 'exists'),
-        '* domstate *' => Process::result(output: "shut off\n"),
-        '*' => Process::result(),
-    ]);
+    $ran = [];
+    Process::fake(function ($process) use (&$ran) {
+        $ran[] = $process->command;
+
+        return match (true) {
+            str_contains($process->command, ' net-dumpxml ') => Process::result(output: '<network></network>'),
+            str_contains($process->command, ' network inspect ') => Process::result(output: "172.18.0.0/16\n"),
+            str_contains($process->command, ' dominfo ') => Process::result(output: 'exists'),
+            str_contains($process->command, ' domstate ') => Process::result(output: "shut off\n"),
+            default => Process::result(),
+        };
+    });
 
     StartDevelopmentQemuVm::run('ubuntu-non-root');
 
-    Process::assertRan(fn ($process) => $process->command === "virsh start 'coolify-dev-ubuntu-non-root'");
+    $commands = collect($ran);
+    $resize = $commands->search("virsh setmaxmem 'coolify-dev-ubuntu-non-root' 1024M --config");
+    expect($resize)->not->toBeFalse()
+        ->and($commands->search("virsh setmem 'coolify-dev-ubuntu-non-root' 1024M --config"))->toBeGreaterThan($resize)
+        ->and($commands->search("virsh start 'coolify-dev-ubuntu-non-root'"))->toBeGreaterThan($resize);
     Process::assertNotRan(fn ($process) => str_starts_with($process->command, 'virt-install '));
     Process::assertNotRan(fn ($process) => str_contains($process->command, 'virsh destroy'));
     Process::assertNotRan(fn ($process) => str_contains($process->command, 'virsh undefine'));
@@ -249,6 +283,7 @@ it('does not restart an already running vm', function () {
     StartDevelopmentQemuVm::run('ubuntu-root');
 
     Process::assertNotRan(fn ($process) => str_contains($process->command, 'virsh start'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'virsh setmem'));
     Process::assertNotRan(fn ($process) => str_starts_with($process->command, 'virt-install '));
     Process::assertRan(fn ($process) => str_contains($process->command, 'docker exec') && str_contains($process->command, 'fsockopen'));
 });
diff --git a/tests/Feature/DockerCleanupExecutionsAuthorizationTest.php b/tests/Feature/DockerCleanupExecutionsAuthorizationTest.php
new file mode 100644
index 0000000000..d45eb8760e
--- /dev/null
+++ b/tests/Feature/DockerCleanupExecutionsAuthorizationTest.php
@@ -0,0 +1,60 @@
+<?php
+
+use App\Livewire\Server\DockerCleanupExecutions;
+use App\Models\DockerCleanupExecution;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.driver' => 'file']);
+    InstanceSettings::forceCreate(['id' => 0]);
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'member']);
+    $this->otherTeam = Team::factory()->create();
+    $this->user->teams()->attach($this->otherTeam, ['role' => 'owner']);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->execution = DockerCleanupExecution::create([
+        'server_id' => $this->server->id,
+        'status' => 'running',
+        'message' => implode("\n", array_fill(0, 150, 'cleanup output')),
+    ]);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('denies log actions after server team access is removed', function (string $action) {
+    $component = Livewire::test(DockerCleanupExecutions::class, ['server' => $this->server])
+        ->call('selectExecution', $this->execution->id);
+
+    $this->team->members()->detach($this->user->id);
+    $this->user->refresh();
+    session(['currentTeam' => $this->otherTeam]);
+
+    $arguments = $action === 'selectExecution' ? [$this->execution->id] : [];
+    $component->call($action, ...$arguments)->assertForbidden();
+})->with(['refreshExecutions', 'selectExecution', 'polling', 'loadMoreLogs']);
+
+it('allows log actions for a server team member after switching session teams', function () {
+    $component = Livewire::test(DockerCleanupExecutions::class, ['server' => $this->server]);
+    session(['currentTeam' => $this->otherTeam]);
+
+    $component->call('refreshExecutions')
+        ->call('selectExecution', $this->execution->id)
+        ->assertSet('selectedExecution.id', $this->execution->id)
+        ->assertSet('isPollingActive', true)
+        ->call('loadMoreLogs')
+        ->assertSet('currentPage', 2);
+
+    $this->execution->update(['status' => 'success', 'message' => 'finished cleanup']);
+
+    $component->call('polling')
+        ->assertSet('isPollingActive', false)
+        ->assertSee('finished cleanup');
+});
diff --git a/tests/Feature/DockerCleanupJobTest.php b/tests/Feature/DockerCleanupJobTest.php
index 769a0dae13..a4ec2ac720 100644
--- a/tests/Feature/DockerCleanupJobTest.php
+++ b/tests/Feature/DockerCleanupJobTest.php
@@ -529,7 +529,7 @@ it('scans application images with a fixed number of remote commands and keeps th
     }
 });
 
-it('removes stopped Coolify containers but keeps the proxy, databases, applications and services', function () {
+it('removes stopped Coolify containers but keeps the proxy, databases, applications and services', function (bool $nonRoot) {
     $command = (new ReflectionMethod(CleanupDocker::class, 'buildContainerPruneCommand'))->invoke(new CleanupDocker);
     preg_match("/--format '([^']+)'/", $command, $format);
     $stoppedContainers = collect([
@@ -547,6 +547,14 @@ it('removes stopped Coolify containers but keeps the proxy, databases, applicati
     file_put_contents("$bin/docker", "#!/bin/sh\nif [ \"\$1\" = ps ]; then cat $bin/containers; else echo \"\$@\"; fi\n");
     chmod("$bin/docker", 0755);
 
+    if ($nonRoot) {
+        $server = new Server;
+        $server->user = 'coolify';
+        $command = parseCommandsByLineForSudo(collect([$command]), $server)[0];
+        file_put_contents("$bin/sudo", "#!/bin/sh\nexec \"\$@\"\n");
+        chmod("$bin/sudo", 0755);
+    }
+
     $output = shell_exec('PATH='.escapeshellarg("$bin:".getenv('PATH')).' /bin/sh -c '.escapeshellarg($command));
 
     array_map('unlink', glob("$bin/*"));
@@ -554,7 +562,7 @@ it('removes stopped Coolify containers but keeps the proxy, databases, applicati
 
     expect($command)->toContain('--filter label=coolify.managed=true')
         ->and(trim((string) $output))->toBe('rm helper');
-});
+})->with(['root' => false, 'non-root sudo parser' => true]);
 
 it('broadcasts DockerCleanupDone without the cleanup log so large logs fit the Reverb message size', function () {
     $server = dockerCleanupReachableServer();
diff --git a/tests/Feature/EnvironmentCanvasTest.php b/tests/Feature/EnvironmentCanvasTest.php
new file mode 100644
index 0000000000..d424ee22b6
--- /dev/null
+++ b/tests/Feature/EnvironmentCanvasTest.php
@@ -0,0 +1,451 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'name' => 'main-server', 'ip' => '203.0.113.10']);
+    $this->destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id, 'name' => 'canvas-env']);
+});
+
+function environmentCanvasActingAs(User $user, Team $team): mixed
+{
+    return test()->actingAs($user)->withSession(['currentTeam' => $team])
+        ->withHeader('X-Canvas-Team', (string) $team->id);
+}
+
+function environmentCanvasUrl(Project $project, Environment $environment, string $suffix = ''): string
+{
+    return "/canvas/api/projects/{$project->uuid}/environments/{$environment->uuid}/canvas{$suffix}";
+}
+
+function environmentCanvasApplication(Environment $environment, StandaloneDocker $destination, array $attributes = []): Application
+{
+    return Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        ...$attributes,
+    ]);
+}
+
+function environmentCanvasPostgres(Environment $environment, StandaloneDocker $destination): StandalonePostgresql
+{
+    return create_standalone_postgresql($environment->id, $destination, [
+        'name' => 'main-db',
+        'postgres_password' => 'canvas-secret-password',
+    ], 'postgres:17-alpine');
+}
+
+describe('GET canvas', function () {
+    test('returns zones, nodes, links and positions of the environment', function () {
+        $extraServer = Server::factory()->create(['team_id' => $this->team->id, 'name' => 'extra-server']);
+        $extraDestination = StandaloneDocker::query()->where('server_id', $extraServer->id)->firstOrFail();
+
+        $application = environmentCanvasApplication($this->environment, $this->destination, [
+            'name' => 'web',
+            'git_branch' => 'main',
+            'fqdn' => 'https://web.example.com, https://www.example.com,',
+            'status' => 'running:healthy',
+        ]);
+        $application->additional_servers()->attach($extraServer->id, ['standalone_docker_id' => $extraDestination->id, 'status' => 'running:healthy']);
+        LocalPersistentVolume::create(['name' => 'web-data', 'mount_path' => '/data', 'resource_type' => $application->getMorphClass(), 'resource_id' => $application->id]);
+
+        $service = Service::factory()->create([
+            'name' => 'stack',
+            'environment_id' => $this->environment->id,
+            'server_id' => $this->server->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+        ServiceApplication::forceCreate(['name' => 'ghost', 'service_id' => $service->id, 'fqdn' => 'https://ghost.example.com', 'status' => 'running:healthy']);
+        ServiceDatabase::forceCreate(['name' => 'mysql', 'service_id' => $service->id, 'status' => 'running:healthy']);
+
+        $database = environmentCanvasPostgres($this->environment, $this->destination);
+
+        $link = ResourceLink::create([
+            'environment_id' => $this->environment->id,
+            'source_type' => $application->getMorphClass(),
+            'source_id' => $application->id,
+            'target_type' => $database->getMorphClass(),
+            'target_id' => $database->id,
+            'label' => 'DATABASE_URL',
+        ]);
+        $this->environment->forceFill(['canvas_positions' => [$application->uuid => ['x' => 10, 'y' => -20], 'gone-resource' => ['x' => 1, 'y' => 1]]])->save();
+
+        environmentCanvasActingAs($this->admin, $this->team);
+        $response = $this
+            ->getJson(environmentCanvasUrl($this->project, $this->environment))
+            ->assertOk();
+
+        $response->assertJsonPath('project', ['uuid' => $this->project->uuid, 'name' => $this->project->name, 'link' => route('project.show', ['project_uuid' => $this->project->uuid])])
+            ->assertJsonPath('environment', ['uuid' => $this->environment->uuid, 'name' => 'canvas-env', 'link' => route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid])])
+            ->assertJsonPath('can_edit', true)
+            ->assertJsonPath('links', [['id' => $link->uuid, 'source' => $application->uuid, 'target' => $database->uuid, 'label' => 'DATABASE_URL']])
+            ->assertJsonPath('positions', [$application->uuid => ['x' => 10, 'y' => -20]]);
+
+        expect(collect($response->json('zones'))->keyBy('id')->all())->toEqual([
+            $this->server->uuid => ['id' => $this->server->uuid, 'name' => 'main-server', 'ip' => '203.0.113.10', 'is_reachable' => false, 'is_usable' => false, 'link' => route('server.show', ['server_uuid' => $this->server->uuid])],
+            $extraServer->uuid => ['id' => $extraServer->uuid, 'name' => 'extra-server', 'ip' => $extraServer->ip, 'is_reachable' => false, 'is_usable' => false, 'link' => route('server.show', ['server_uuid' => $extraServer->uuid])],
+        ]);
+
+        $nodes = collect($response->json('nodes'))->keyBy('id');
+        expect($nodes)->toHaveCount(3)
+            ->and($nodes[$application->uuid])->toEqual([
+                'id' => $application->uuid,
+                'type' => 'application',
+                'name' => 'web',
+                'status' => 'running:healthy',
+                'zone' => $this->server->uuid,
+                'extra_zones' => [$extraServer->uuid],
+                'urls' => ['https://web.example.com', 'https://www.example.com'],
+                'kind' => 'nixpacks',
+                'subtitle' => 'Nixpacks · main',
+                'children' => [],
+                'link' => $application->link(),
+                'logo' => ['src' => resource_logo_url('public-repo'), 'dark' => null, 'fallback' => null, 'padded' => false, 'favicon' => 'https://web.example.com/favicon.ico'],
+                'saved' => ['x' => 10, 'y' => -20],
+            ])
+            ->and($nodes[$service->uuid])->toEqual([
+                'id' => $service->uuid,
+                'type' => 'service',
+                'name' => 'stack',
+                'status' => 'running:healthy',
+                'zone' => $this->server->uuid,
+                'extra_zones' => [],
+                'urls' => ['https://ghost.example.com'],
+                'kind' => null,
+                'subtitle' => 'Service · 2 containers',
+                'children' => [
+                    ['name' => 'ghost', 'type' => 'application', 'status' => 'running:healthy'],
+                    ['name' => 'mysql', 'type' => 'database', 'status' => 'running:healthy'],
+                ],
+                'link' => $service->link(),
+                'logo' => null,
+                'saved' => null,
+            ])
+            ->and($nodes[$database->uuid])->toMatchArray([
+                'type' => 'database',
+                'name' => 'main-db',
+                'zone' => $this->server->uuid,
+                'urls' => [],
+                'kind' => 'postgresql',
+                'subtitle' => 'PostgreSQL · postgres:17-alpine',
+                'logo' => ['src' => resource_logo_url('postgres'), 'dark' => null, 'fallback' => null, 'padded' => false, 'favicon' => null],
+                'saved' => null,
+            ])
+            ->and($response->getContent())->not->toContain('canvas-secret-password');
+    });
+
+    test('drops links whose resource was deleted', function () {
+        $application = environmentCanvasApplication($this->environment, $this->destination);
+        $database = environmentCanvasPostgres($this->environment, $this->destination);
+        ResourceLink::create([
+            'environment_id' => $this->environment->id,
+            'source_type' => $application->getMorphClass(),
+            'source_id' => $application->id,
+            'target_type' => $database->getMorphClass(),
+            'target_id' => $database->id,
+        ]);
+        $database->forceDelete();
+
+        environmentCanvasActingAs($this->admin, $this->team)
+            ->getJson(environmentCanvasUrl($this->project, $this->environment))
+            ->assertOk()
+            ->assertJsonPath('links', []);
+    });
+
+    test('hides server ips and editing from a member', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        environmentCanvasApplication($this->environment, $this->destination);
+
+        environmentCanvasActingAs($member, $this->team)
+            ->getJson(environmentCanvasUrl($this->project, $this->environment))
+            ->assertOk()
+            ->assertJsonPath('zones.0.ip', null)
+            ->assertJsonPath('can_edit', false);
+    });
+
+    test('finds the environment by name', function () {
+        environmentCanvasActingAs($this->admin, $this->team)
+            ->getJson("/canvas/api/projects/{$this->project->uuid}/environments/canvas-env/canvas")
+            ->assertOk()
+            ->assertJsonPath('environment.uuid', $this->environment->uuid);
+    });
+
+    test('does not run more queries for more applications', function () {
+        environmentCanvasActingAs($this->admin, $this->team);
+        $countQueries = function (): int {
+            DB::flushQueryLog();
+            DB::enableQueryLog();
+            $this
+                ->getJson(environmentCanvasUrl($this->project, $this->environment))
+                ->assertOk();
+            DB::disableQueryLog();
+
+            return collect(DB::getQueryLog())->reject(fn (array $query) => str_contains($query['query'], 'audit_events'))->count();
+        };
+        environmentCanvasApplication($this->environment, $this->destination, ['fqdn' => 'https://a.example.com']);
+        $countQueries();
+        $queriesForOne = $countQueries();
+
+        foreach (range(1, 4) as $index) {
+            environmentCanvasApplication($this->environment, $this->destination, ['fqdn' => "https://a{$index}.example.com"]);
+        }
+        $queriesForFive = $countQueries();
+
+        expect($queriesForFive)->toBe($queriesForOne);
+    });
+});
+
+describe('PATCH canvas positions', function () {
+    test('merges positions, ignores unknown resources and prunes removed ones', function () {
+        $first = environmentCanvasApplication($this->environment, $this->destination);
+        $second = environmentCanvasApplication($this->environment, $this->destination);
+        $this->environment->forceFill(['canvas_positions' => [
+            $first->uuid => ['x' => 1, 'y' => 2],
+            'removed-resource' => ['x' => 5, 'y' => 5],
+        ]])->save();
+        $otherEnvironment = Environment::factory()->create(['project_id' => $this->project->id]);
+        $foreign = environmentCanvasApplication($otherEnvironment, $this->destination);
+
+        environmentCanvasActingAs($this->admin, $this->team)
+            ->patchJson(environmentCanvasUrl($this->project, $this->environment, '/positions'), ['positions' => [
+                $second->uuid => ['x' => -300, 'y' => 400],
+                $foreign->uuid => ['x' => 9, 'y' => 9],
+                'unknown' => ['x' => 'not-a-number'],
+            ]])
+            ->assertOk()
+            ->assertExactJson(['positions' => [
+                $first->uuid => ['x' => 1, 'y' => 2],
+                $second->uuid => ['x' => -300, 'y' => 400],
+            ]]);
+
+        expect($this->environment->refresh()->canvas_positions)->toBe([
+            $first->uuid => ['x' => 1, 'y' => 2],
+            $second->uuid => ['x' => -300, 'y' => 400],
+        ]);
+    });
+
+    test('rejects coordinates out of range', function () {
+        $application = environmentCanvasApplication($this->environment, $this->destination);
+
+        environmentCanvasActingAs($this->admin, $this->team)
+            ->patchJson(environmentCanvasUrl($this->project, $this->environment, '/positions'), ['positions' => [
+                $application->uuid => ['x' => 100001, 'y' => 0],
+            ]])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors(["positions.{$application->uuid}.x"]);
+    });
+});
+
+describe('canvas links', function () {
+    test('creates, relabels and deletes a link', function () {
+        $application = environmentCanvasApplication($this->environment, $this->destination);
+        $database = environmentCanvasPostgres($this->environment, $this->destination);
+        environmentCanvasActingAs($this->admin, $this->team);
+
+        $response = $this
+            ->postJson(environmentCanvasUrl($this->project, $this->environment, '/links'), [
+                'source' => $application->uuid,
+                'target' => $database->uuid,
+                'label' => 'uses',
+            ])
+            ->assertCreated()
+            ->assertJson(['source' => $application->uuid, 'target' => $database->uuid, 'label' => 'uses']);
+        $linkUuid = $response->json('id');
+        expect(ResourceLink::query()->whereUuid($linkUuid)->firstOrFail()->created_by)->toBe($this->admin->id);
+
+        $this
+            ->patchJson(environmentCanvasUrl($this->project, $this->environment, "/links/{$linkUuid}"), ['label' => 'reads'])
+            ->assertOk()
+            ->assertExactJson(['id' => $linkUuid, 'source' => $application->uuid, 'target' => $database->uuid, 'label' => 'reads']);
+
+        $this
+            ->deleteJson(environmentCanvasUrl($this->project, $this->environment, "/links/{$linkUuid}"))
+            ->assertOk()
+            ->assertJson(['message' => 'Link deleted.']);
+
+        expect(ResourceLink::query()->count())->toBe(0);
+    });
+
+    test('rejects a link to itself', function () {
+        $application = environmentCanvasApplication($this->environment, $this->destination);
+
+        environmentCanvasActingAs($this->admin, $this->team)
+            ->postJson(environmentCanvasUrl($this->project, $this->environment, '/links'), [
+                'source' => $application->uuid,
+                'target' => $application->uuid,
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors(['target']);
+    });
+
+    test('rejects a resource of another environment', function () {
+        $application = environmentCanvasApplication($this->environment, $this->destination);
+        $otherEnvironment = Environment::factory()->create(['project_id' => $this->project->id]);
+        $foreign = environmentCanvasApplication($otherEnvironment, $this->destination);
+
+        environmentCanvasActingAs($this->admin, $this->team)
+            ->postJson(environmentCanvasUrl($this->project, $this->environment, '/links'), [
+                'source' => $application->uuid,
+                'target' => $foreign->uuid,
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors(['target']);
+
+        expect(ResourceLink::query()->count())->toBe(0);
+    });
+
+    test('rejects a duplicate link but allows the opposite direction', function () {
+        $application = environmentCanvasApplication($this->environment, $this->destination);
+        $database = environmentCanvasPostgres($this->environment, $this->destination);
+        environmentCanvasActingAs($this->admin, $this->team);
+        $url = environmentCanvasUrl($this->project, $this->environment, '/links');
+
+        $this->postJson($url, ['source' => $application->uuid, 'target' => $database->uuid])->assertCreated();
+        $this->postJson($url, ['source' => $application->uuid, 'target' => $database->uuid])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors(['target']);
+        $this->postJson($url, ['source' => $database->uuid, 'target' => $application->uuid])->assertCreated();
+    });
+
+    test('returns 404 for a link of another environment', function () {
+        $otherEnvironment = Environment::factory()->create(['project_id' => $this->project->id]);
+        $first = environmentCanvasApplication($otherEnvironment, $this->destination);
+        $second = environmentCanvasApplication($otherEnvironment, $this->destination);
+        $link = ResourceLink::create([
+            'environment_id' => $otherEnvironment->id,
+            'source_type' => $first->getMorphClass(),
+            'source_id' => $first->id,
+            'target_type' => $second->getMorphClass(),
+            'target_id' => $second->id,
+        ]);
+        environmentCanvasActingAs($this->admin, $this->team);
+
+        $this
+            ->patchJson(environmentCanvasUrl($this->project, $this->environment, "/links/{$link->uuid}"), ['label' => 'x'])
+            ->assertNotFound();
+        $this
+            ->deleteJson(environmentCanvasUrl($this->project, $this->environment, "/links/{$link->uuid}"))
+            ->assertNotFound();
+
+        expect($link->fresh())->not->toBeNull();
+    });
+});
+
+describe('canvas authorization', function () {
+    test('a member can read the canvas but cannot change it', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        $application = environmentCanvasApplication($this->environment, $this->destination);
+        $database = environmentCanvasPostgres($this->environment, $this->destination);
+        environmentCanvasActingAs($member, $this->team);
+
+        $this->getJson(environmentCanvasUrl($this->project, $this->environment))->assertOk();
+        $this
+            ->patchJson(environmentCanvasUrl($this->project, $this->environment, '/positions'), ['positions' => [$application->uuid => ['x' => 1, 'y' => 1]]])
+            ->assertForbidden();
+        $this
+            ->postJson(environmentCanvasUrl($this->project, $this->environment, '/links'), ['source' => $application->uuid, 'target' => $database->uuid])
+            ->assertForbidden();
+
+        expect($this->environment->refresh()->canvas_positions)->toBeNull()
+            ->and(ResourceLink::query()->count())->toBe(0);
+    });
+
+    test('returns 404 for a project of another team', function () {
+        $otherTeam = Team::factory()->create();
+        $otherUser = User::factory()->create();
+        $otherTeam->members()->attach($otherUser->id, ['role' => 'owner']);
+        $application = environmentCanvasApplication($this->environment, $this->destination);
+        environmentCanvasActingAs($otherUser, $otherTeam);
+
+        $this->getJson(environmentCanvasUrl($this->project, $this->environment))->assertNotFound();
+        $this
+            ->patchJson(environmentCanvasUrl($this->project, $this->environment, '/positions'), ['positions' => [$application->uuid => ['x' => 1, 'y' => 1]]])
+            ->assertNotFound();
+    });
+    test('is not part of the public API', function () {
+        $plainTextToken = 'environment-canvas-test-token';
+        $token = $this->admin->tokens()->create([
+            'name' => 'environment-canvas-test',
+            'token' => hash('sha256', $plainTextToken),
+            'abilities' => ['root'],
+            'team_id' => $this->team->id,
+        ]);
+
+        $this->withHeaders(['Authorization' => "Bearer {$token->getKey()}|{$plainTextToken}"])
+            ->getJson("/api/v1/projects/{$this->project->uuid}/environments/{$this->environment->uuid}/canvas")
+            ->assertNotFound();
+    });
+});
+
+describe('canvas page', function () {
+    test('add resource opens the deploy canvas for this environment', function () {
+        $deployCanvasUrl = route('deploy-canvas', ['project' => $this->project->uuid, 'environment' => $this->environment->uuid]);
+
+        $this->actingAs($this->admin)->withSession(['currentTeam' => $this->team])
+            ->withoutVite()
+            ->get(route('project.environment.canvas', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]))
+            ->assertOk()
+            ->assertSee('data-new="'.e($deployCanvasUrl).'"', false)
+            ->assertSee('href="'.e($deployCanvasUrl).'"', false)
+            ->assertDontSee(route('project.resource.create', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]), false);
+    });
+
+    test('a team member can open the canvas page', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+
+        $this->actingAs($member)->withSession(['currentTeam' => $this->team])
+            ->withoutVite()
+            ->get(route('project.environment.canvas', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]))
+            ->assertOk()
+            ->assertSee('data-environment-canvas', false)
+            ->assertSee('data-environment="'.$this->environment->uuid.'"', false);
+    });
+
+    test('another team gets a 404', function () {
+        $otherTeam = Team::factory()->create(['show_boarding' => false]);
+        $otherUser = User::factory()->create();
+        $otherTeam->members()->attach($otherUser->id, ['role' => 'owner']);
+
+        $this->actingAs($otherUser)->withSession(['currentTeam' => $otherTeam])
+            ->withoutVite()
+            ->get(route('project.environment.canvas', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]))
+            ->assertNotFound();
+    });
+});
diff --git a/tests/Feature/FileDownloadStorageTest.php b/tests/Feature/FileDownloadStorageTest.php
new file mode 100644
index 0000000000..2cf526c1c0
--- /dev/null
+++ b/tests/Feature/FileDownloadStorageTest.php
@@ -0,0 +1,244 @@
+<?php
+
+use App\Jobs\DeleteFileDownloadJob;
+use App\Jobs\PrepareFileDownloadJob;
+use App\Livewire\Settings\Advanced;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\ContainerFilesystemService;
+use App\Services\FileDownloadStorageService;
+use Aws\CommandInterface;
+use Aws\MockHandler;
+use Aws\Result;
+use Aws\S3\Exception\S3Exception;
+use Aws\S3\S3Client;
+use Illuminate\Filesystem\AwsS3V3Adapter;
+use Illuminate\Filesystem\FilesystemAdapter;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+    $this->rootTeam = Team::factory()->create(['id' => 0]);
+    $this->storage = S3Storage::create([
+        'name' => 'Downloads',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'downloads',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => 0,
+    ]);
+});
+
+function lifecycleStorage(MockHandler $handler): S3Storage
+{
+    $storage = new class extends S3Storage
+    {
+        public S3Client $client;
+
+        public function filesystem(): FilesystemAdapter
+        {
+            $adapter = Mockery::mock(AwsS3V3Adapter::class);
+            $adapter->shouldReceive('getClient')->andReturn($this->client);
+
+            return $adapter;
+        }
+    };
+    $storage->bucket = 'downloads';
+    $storage->client = new S3Client([
+        'region' => 'us-east-1',
+        'version' => 'latest',
+        'credentials' => ['key' => 'k', 'secret' => 's'],
+        'handler' => $handler,
+    ]);
+
+    return $storage;
+}
+
+it('adds the lifecycle rule and keeps the other bucket rules', function () {
+    $put = null;
+    $handler = new MockHandler([
+        new Result(['Rules' => [
+            ['ID' => 'keep-me', 'Filter' => ['Prefix' => 'logs/'], 'Status' => 'Enabled', 'Expiration' => ['Days' => 30]],
+            ['ID' => FileDownloadStorageService::LIFECYCLE_RULE_ID, 'Filter' => ['Prefix' => 'old/'], 'Status' => 'Enabled', 'Expiration' => ['Days' => 9]],
+        ]]),
+        function (CommandInterface $command) use (&$put) {
+            $put = $command->toArray();
+
+            return new Result([]);
+        },
+    ]);
+
+    (new FileDownloadStorageService)->ensureLifecycleRule(lifecycleStorage($handler));
+
+    expect($put['LifecycleConfiguration']['Rules'])->toBe([
+        ['ID' => 'keep-me', 'Filter' => ['Prefix' => 'logs/'], 'Status' => 'Enabled', 'Expiration' => ['Days' => 30]],
+        ['ID' => FileDownloadStorageService::LIFECYCLE_RULE_ID, 'Filter' => ['Prefix' => FileDownloadStorageService::PREFIX], 'Status' => 'Enabled', 'Expiration' => ['Days' => 1]],
+    ]);
+});
+
+it('adds the lifecycle rule to a bucket without a lifecycle configuration', function () {
+    $put = null;
+    $handler = new MockHandler([
+        fn (CommandInterface $command) => new S3Exception('none', $command, ['code' => 'NoSuchLifecycleConfiguration']),
+        function (CommandInterface $command) use (&$put) {
+            $put = $command->toArray();
+
+            return new Result([]);
+        },
+    ]);
+
+    (new FileDownloadStorageService)->ensureLifecycleRule(lifecycleStorage($handler));
+
+    expect($put['LifecycleConfiguration']['Rules'])->toHaveCount(1);
+});
+
+it('fails when the provider rejects the lifecycle rule', function () {
+    $handler = new MockHandler([
+        new Result(['Rules' => []]),
+        fn (CommandInterface $command) => new S3Exception('not implemented', $command, ['code' => 'NotImplemented']),
+    ]);
+
+    (new FileDownloadStorageService)->ensureLifecycleRule(lifecycleStorage($handler));
+})->throws(RuntimeException::class, 'Could not add the auto-delete lifecycle rule');
+
+it('saves the download storage only after the lifecycle rule is added', function (bool $ruleAdded) {
+    $user = User::factory()->create();
+    $this->rootTeam->members()->attach($user->id, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $this->rootTeam]);
+    $downloads = Mockery::mock(FileDownloadStorageService::class);
+    $downloads->shouldReceive('ensureBucketIsPrivate')->once();
+    $expectation = $downloads->shouldReceive('ensureLifecycleRule')->once();
+    if (! $ruleAdded) {
+        $expectation->andThrow(new RuntimeException('Could not add the auto-delete lifecycle rule'));
+    }
+    app()->instance(FileDownloadStorageService::class, $downloads);
+
+    $component = Livewire::test(Advanced::class)
+        ->set('file_download_storage', 's3:'.$this->storage->id)
+        ->call('instantSave');
+
+    if ($ruleAdded) {
+        $component->assertSet('file_download_storage', 's3:'.$this->storage->id);
+        expect(InstanceSettings::find(0)->file_download_s3_storage_id)->toBe($this->storage->id);
+    } else {
+        $component->assertSet('file_download_storage', 'stream')->assertDispatched('error');
+        expect(InstanceSettings::find(0)->file_download_s3_storage_id)->toBeNull();
+    }
+})->with([true, false]);
+
+it('builds one S3 upload script that the non-root sudo parser keeps whole', function () {
+    $command = (new ContainerFilesystemService(Server::factory()->make(), 'app-123'))
+        ->buildS3UploadCommand("/app/it's.txt", false, 'https://s3.example.com/b/k?X-Amz-Signature=abc&x=1', ['Content-Disposition' => 'attachment; filename="a.txt"']);
+
+    expect($command)->toStartWith('sh -c ')
+        ->and($command)->toContain('mktemp', 'trap', 'curl -fsS', 'X-Amz-Signature=abc&x=1');
+    expect(parseCommandsByLineForSudo(collect([$command]), Server::factory()->make(['user' => 'deploy'])))
+        ->toBe(['sudo '.$command]);
+});
+
+it('uploads to S3, stores the link, and queues the delete', function () {
+    $this->freezeTime();
+    Storage::fake('ssh-keys');
+    config(['constants.ssh.mux_enabled' => false]);
+    Bus::fake([DeleteFileDownloadJob::class]);
+    Process::fake(['*' => Process::result(output: '')]);
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->rootTeam->id]);
+    $server = Server::factory()->create(['team_id' => $this->rootTeam->id, 'private_key_id' => $privateKey->id]);
+    $downloads = Mockery::mock(FileDownloadStorageService::class);
+    $downloads->shouldReceive('uploadUrl')->andReturn(['url' => 'https://s3.example.com/put', 'headers' => []]);
+    $downloads->shouldReceive('downloadUrl')->andReturn('https://s3.example.com/get');
+
+    (new PrepareFileDownloadJob('dl-1', 7, $server->id, 'app-123', '/data/a.txt', false, 'a.txt', $this->storage->id))->handle($downloads);
+
+    expect(Cache::get(PrepareFileDownloadJob::cacheKey('dl-1')))->toBe(['user_id' => 7, 'status' => 'ready', 'url' => 'https://s3.example.com/get']);
+    Process::assertRan(fn ($process) => str_contains($process->command, 'https://s3.example.com/put'));
+    Bus::assertDispatched(DeleteFileDownloadJob::class, fn (DeleteFileDownloadJob $job) => $job->s3StorageId === $this->storage->id
+        && str_starts_with($job->key, FileDownloadStorageService::PREFIX)
+        && $job->delay->equalTo(now()->addHours(6)));
+});
+
+it('makes download links that expire after 15 minutes', function () {
+    $this->storage->update(['endpoint' => 'https://1.1.1.1']);
+    $url = (new FileDownloadStorageService)->downloadUrl($this->storage, FileDownloadStorageService::PREFIX.'abc');
+
+    parse_str((string) parse_url($url, PHP_URL_QUERY), $query);
+    expect((int) $query['X-Amz-Expires'])->toBeBetween(890, 900);
+});
+
+it('stores a failure when the upload fails', function () {
+    Bus::fake([DeleteFileDownloadJob::class]);
+    $this->storage->update(['is_usable' => false]);
+
+    (new PrepareFileDownloadJob('dl-2', 7, 1, 'app-123', '/data/a.txt', false, 'a.txt', $this->storage->id))->handle(new FileDownloadStorageService);
+
+    $result = Cache::get(PrepareFileDownloadJob::cacheKey('dl-2'));
+    expect($result)->toMatchArray(['user_id' => 7, 'status' => 'failed'])
+        ->and($result['message'])->not->toContain('s3.example.com', 'X-Amz');
+});
+
+it('only deletes objects under the download prefix', function () {
+    $downloads = Mockery::mock(FileDownloadStorageService::class);
+    $downloads->shouldReceive('delete')->once()->with(Mockery::type(S3Storage::class), FileDownloadStorageService::PREFIX.'abc');
+
+    (new DeleteFileDownloadJob($this->storage->id, FileDownloadStorageService::PREFIX.'abc'))->handle($downloads);
+    (new DeleteFileDownloadJob($this->storage->id, 'backups/db.dump'))->handle($downloads);
+});
+
+function anonymousListingService(MockHandler $handler): FileDownloadStorageService
+{
+    return new class($handler) extends FileDownloadStorageService
+    {
+        public function __construct(private MockHandler $handler) {}
+
+        protected function anonymousClient(S3Storage $storage): S3Client
+        {
+            return new S3Client(['region' => 'us-east-1', 'version' => 'latest', 'credentials' => false, 'handler' => $this->handler]);
+        }
+    };
+}
+
+it('refuses a bucket that anonymous users can list', function () {
+    $downloads = anonymousListingService(new MockHandler([new Result(['Contents' => []])]));
+
+    $downloads->ensureBucketIsPrivate($this->storage);
+})->throws(RuntimeException::class, 'allows anonymous listing');
+
+it('accepts a bucket that denies anonymous listing', function () {
+    $downloads = anonymousListingService(new MockHandler([
+        fn (CommandInterface $command) => new S3Exception('denied', $command, ['code' => 'AccessDenied']),
+    ]));
+
+    $downloads->ensureBucketIsPrivate($this->storage);
+
+    expect(true)->toBeTrue();
+});
+
+it('refuses the bundled MinIO because servers and browsers cannot reach it', function () {
+    $this->storage->forceFill(['uuid' => 'minio', 'endpoint' => 'http://coolify-minio:9000'])->save();
+
+    (new FileDownloadStorageService)->ensureBucketIsPrivate($this->storage);
+})->throws(RuntimeException::class, 'uses an internal Docker host name');
+
+it('explains an unreachable endpoint instead of accepting it', function () {
+    $downloads = anonymousListingService(new MockHandler([
+        fn (CommandInterface $command) => new S3Exception('cURL error 6: Could not resolve host', $command),
+    ]));
+
+    $downloads->ensureBucketIsPrivate($this->storage);
+})->throws(RuntimeException::class, 'Could not connect to "Downloads"');
diff --git a/tests/Feature/GetLogsExportRedactionTest.php b/tests/Feature/GetLogsExportRedactionTest.php
new file mode 100644
index 0000000000..dfb016efab
--- /dev/null
+++ b/tests/Feature/GetLogsExportRedactionTest.php
@@ -0,0 +1,220 @@
+<?php
+
+use App\Livewire\Project\Shared\GetLogs;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+const GET_LOGS_EXPORT_CANARY = 'coolify-canary-exported-env-value';
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    $user = User::factory()->create();
+    $team = Team::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+    $this->server->settings->fill(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false])->save();
+    $this->server = Server::with('settings')->findOrFail($this->server->id);
+    $destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $team->id])->id]);
+    $destinationAttributes = ['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()];
+
+    $this->application = Application::factory()->create(['environment_id' => $environment->id, ...$destinationAttributes]);
+    $this->service = Service::factory()->create(['environment_id' => $environment->id, 'server_id' => $this->server->id, ...$destinationAttributes]);
+    $this->serviceApplication = ServiceApplication::create(['name' => 'web', 'service_id' => $this->service->id]);
+
+    foreach ([$this->application, $this->service] as $resource) {
+        EnvironmentVariable::query()->create([
+            'key' => 'EXPORT_CANARY',
+            'value' => GET_LOGS_EXPORT_CANARY,
+            'resourceable_type' => $resource->getMorphClass(),
+            'resourceable_id' => $resource->id,
+            'is_preview' => false,
+        ]);
+    }
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Process::fake(['*' => Process::result(output: '2026-09-28T10:00:01Z booted with '.GET_LOGS_EXPORT_CANARY)]);
+});
+
+it('redacts the resource environment values when copying or downloading logs', function (string $resource, string $action) {
+    $parameters = $resource === 'application'
+        ? ['resource' => $this->application]
+        : ['resource' => $this->service, 'servicesubtype' => $this->serviceApplication];
+
+    Livewire::test(GetLogs::class, ['server' => $this->server, 'container' => 'test-container', ...$parameters])
+        ->call($action)
+        ->assertReturned('2026-09-28T10:00:01Z booted with '.REDACTED);
+})->with(['application', 'service'])->with(['copyLogs', 'downloadAllLogs']);
+
+it('redacts stored and effective database passwords in exported logs', function (string $path, bool $remote) {
+    $database = StandalonePostgresql::query()->create([
+        'name' => 'log-redaction-database',
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+        'postgres_password' => 'xy',
+        'status' => 'running:healthy',
+    ]);
+    EnvironmentVariable::query()->create([
+        'key' => 'POSTGRES_PASSWORD',
+        'value' => $remote ? '{{vault.DB_PASSWORD}}' : 'effective-database-canary',
+        'resourceable_type' => $database->getMorphClass(),
+        'resourceable_id' => $database->id,
+        'is_preview' => false,
+    ]);
+    if ($remote) {
+        Http::preventStrayRequests();
+        Http::fake([
+            'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response(['DB_PASSWORD' => 'effective-database-canary']),
+        ]);
+        $token = IntegrationToken::factory()->create([
+            'team_id' => $database->team()->id,
+            'provider' => 'doppler',
+            'capabilities' => ['secrets'],
+        ]);
+        $database->secretManagerLink()->create(['integration_token_id' => $token->id]);
+    }
+    Process::fake(fn ($process) => match (true) {
+        str_contains($process->command, 'docker ps') => Process::result(output: json_encode(['ID' => 'abc123', 'Names' => $database->uuid, 'Labels' => '', 'State' => 'running'])),
+        str_contains($process->command, 'docker inspect') => Process::result(output: json_encode(['State' => ['Status' => 'running']])),
+        str_contains($process->command, 'docker logs') => Process::result(output: 'booted xy effective-database-canary'),
+        default => Process::result(output: ''),
+    });
+
+    if ($path === 'api') {
+        InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+        $user = auth()->user();
+        $accessToken = $user->createToken('database-logs', ['read', 'read:sensitive']);
+        $accessToken->accessToken->update(['team_id' => $database->team()->id]);
+        $token = $accessToken->plainTextToken;
+        auth()->forgetGuards();
+        $this->withToken($token)->getJson("/api/v1/databases/{$database->uuid}/logs")
+            ->assertOk()->assertJsonPath('logs', 'booted '.REDACTED.' '.REDACTED);
+    } else {
+        Livewire::test(GetLogs::class, ['server' => $this->server, 'container' => $database->uuid, 'resource' => $database])
+            ->call($path)->assertReturned('booted '.REDACTED.' '.REDACTED);
+    }
+})->with(['copyLogs', 'downloadAllLogs', 'api'])->with([false, true]);
+
+it('still exports database logs when its remote secret source fails', function (string $path) {
+    $database = StandalonePostgresql::query()->create([
+        'name' => 'log-redaction-failing-source',
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+        'postgres_password' => 'xy',
+        'status' => 'running:healthy',
+    ]);
+    EnvironmentVariable::query()->create([
+        'key' => 'POSTGRES_PASSWORD',
+        'value' => '{{vault.DB_PASSWORD}}',
+        'resourceable_type' => $database->getMorphClass(),
+        'resourceable_id' => $database->id,
+        'is_preview' => false,
+    ]);
+    Http::preventStrayRequests();
+    Http::fake(['https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response(['message' => 'down'], 500)]);
+    $token = IntegrationToken::factory()->create([
+        'team_id' => $database->team()->id,
+        'provider' => 'doppler',
+        'capabilities' => ['secrets'],
+    ]);
+    $database->secretManagerLink()->create(['integration_token_id' => $token->id]);
+    Process::fake(fn ($process) => match (true) {
+        str_contains($process->command, 'docker ps') => Process::result(output: json_encode(['ID' => 'abc123', 'Names' => $database->uuid, 'Labels' => '', 'State' => 'running'])),
+        str_contains($process->command, 'docker inspect') => Process::result(output: json_encode(['State' => ['Status' => 'running']])),
+        str_contains($process->command, 'docker logs') => Process::result(output: 'booted xy {{vault.DB_PASSWORD}}'),
+        default => Process::result(output: ''),
+    });
+
+    if ($path === 'api') {
+        InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+        $accessToken = auth()->user()->createToken('database-logs', ['read', 'read:sensitive']);
+        $accessToken->accessToken->update(['team_id' => $database->team()->id]);
+        auth()->forgetGuards();
+        $this->withToken($accessToken->plainTextToken)->getJson("/api/v1/databases/{$database->uuid}/logs")
+            ->assertOk()->assertJsonPath('logs', 'booted '.REDACTED.' '.REDACTED);
+    } else {
+        Livewire::test(GetLogs::class, ['server' => $this->server, 'container' => $database->uuid, 'resource' => $database])
+            ->call($path)->assertReturned('booted '.REDACTED.' '.REDACTED);
+    }
+})->with(['copyLogs', 'downloadAllLogs', 'api']);
+
+it('redacts database environment values with the same rules as other resources', function (bool $redactAll, string $expected) {
+    $database = StandalonePostgresql::query()->create([
+        'name' => 'log-redaction-rules-database',
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+        'postgres_password' => 'xy',
+    ]);
+    $database->update(['redact_all_env_values_in_logs' => $redactAll]);
+    foreach ([['TZ', 'UTC', false], ['APP_MODE', 'production-database-mode', false], ['LOCKED', 'q7', true]] as [$key, $value, $locked]) {
+        EnvironmentVariable::query()->create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => $database->getMorphClass(),
+            'resourceable_id' => $database->id,
+            'is_preview' => false,
+            'is_shown_once' => $locked,
+        ]);
+    }
+
+    $secrets = EnvironmentVariable::logRedactionSecretsFor($database->fresh());
+
+    expect(sanitizeLogsForExport('tz UTC mode production-database-mode locked q7 password xy', $secrets))->toBe($expected);
+})->with([
+    'hide all values' => [true, 'tz UTC mode '.REDACTED.' locked '.REDACTED.' password '.REDACTED],
+    'hide locked values only' => [false, 'tz UTC mode production-database-mode locked '.REDACTED.' password '.REDACTED],
+]);
+
+it('redacts stored database credentials even without environment variables', function (string $model, array $attributes) {
+    $database = new $model($attributes);
+    if ($database instanceof StandaloneMongodb) {
+        $database->mongo_initdb_root_password = encrypt($attributes['mongo_initdb_root_password']);
+    }
+    $database->setRelation('runtime_environment_variables', collect());
+
+    $secrets = EnvironmentVariable::logRedactionSecretsFor($database);
+
+    expect(sanitizeLogsForExport('booted '.implode(' ', array_values($attributes)), $secrets))
+        ->toBe('booted '.implode(' ', array_fill(0, count($attributes), REDACTED)));
+})->with([
+    'postgres' => [StandalonePostgresql::class, ['postgres_password' => 'xy']],
+    'mysql' => [StandaloneMysql::class, ['mysql_password' => 'xy', 'mysql_root_password' => 'zw']],
+    'mariadb' => [StandaloneMariadb::class, ['mariadb_password' => 'xy', 'mariadb_root_password' => 'zw']],
+    'mongodb' => [StandaloneMongodb::class, ['mongo_initdb_root_password' => 'xy']],
+    'clickhouse' => [StandaloneClickhouse::class, ['clickhouse_admin_password' => 'xy']],
+    'keydb' => [StandaloneKeydb::class, ['keydb_password' => 'xy']],
+    'dragonfly' => [StandaloneDragonfly::class, ['dragonfly_password' => 'xy']],
+]);
diff --git a/tests/Feature/GetRollbackImagesTest.php b/tests/Feature/GetRollbackImagesTest.php
new file mode 100644
index 0000000000..a9937a70ac
--- /dev/null
+++ b/tests/Feature/GetRollbackImagesTest.php
@@ -0,0 +1,82 @@
+<?php
+
+use App\Actions\Application\GetRollbackImages;
+use App\Enums\ApplicationDeploymentStatus;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $team = Team::factory()->create();
+    // The server is not reachable, so only registry images are listed and no SSH command runs.
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::factory()->create(['server_id' => $server->id, 'network' => 'rollback-test']);
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $team->id])->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+        'docker_registry_image_name' => 'ghcr.io/coollabs/app',
+    ]);
+});
+
+function rollbackDeployment(Application $application, string $commit, string $finishedAt, array $attributes = []): void
+{
+    ApplicationDeploymentQueue::create([
+        'application_id' => $application->id,
+        'deployment_uuid' => fake()->uuid(),
+        'commit' => $commit,
+        'status' => ApplicationDeploymentStatus::FINISHED->value,
+        'pull_request_id' => 0,
+        ...$attributes,
+    ])->forceFill(['updated_at' => $finishedAt])->saveQuietly();
+}
+
+it('lists the commits of successful deployments as registry images, newest first and once per commit', function () {
+    rollbackDeployment($this->application, 'aaaaaaa', '2026-10-01 10:00:00');
+    rollbackDeployment($this->application, 'bbbbbbb', '2026-10-02 10:00:00');
+    rollbackDeployment($this->application, 'aaaaaaa', '2026-10-03 10:00:00');
+    rollbackDeployment($this->application, 'ccccccc', '2026-10-04 10:00:00', ['status' => ApplicationDeploymentStatus::FAILED->value]);
+    rollbackDeployment($this->application, 'ddddddd', '2026-10-04 10:00:00', ['pull_request_id' => 5]);
+    rollbackDeployment($this->application, 'HEAD', '2026-10-04 10:00:00');
+
+    $result = GetRollbackImages::run($this->application);
+
+    expect($result['current'])->toBeNull()
+        ->and($result['images'])->toBe([
+            ['tag' => 'aaaaaaa', 'created_at' => '2026-10-03 10:00:00', 'is_current' => false, 'source' => 'registry'],
+            ['tag' => 'bbbbbbb', 'created_at' => '2026-10-02 10:00:00', 'is_current' => false, 'source' => 'registry'],
+        ]);
+});
+
+it('limits the registry images to the most recent deployments', function () {
+    foreach (range(1, GetRollbackImages::REGISTRY_DEPLOYMENTS_LIMIT + 2) as $day) {
+        rollbackDeployment($this->application, sprintf('%07d', $day), sprintf('2026-10-%02d 10:00:00', $day));
+    }
+
+    $images = GetRollbackImages::run($this->application)['images'];
+
+    expect($images)->toHaveCount(GetRollbackImages::REGISTRY_DEPLOYMENTS_LIMIT)
+        ->and($images[0]['tag'])->toBe(sprintf('%07d', GetRollbackImages::REGISTRY_DEPLOYMENTS_LIMIT + 2));
+});
+
+it('lists no registry images when the application does not push commit images', function (array $attributes) {
+    $this->application->update($attributes);
+    rollbackDeployment($this->application, 'aaaaaaa', '2026-10-01 10:00:00');
+
+    expect(GetRollbackImages::run($this->application->fresh())['images'])->toBe([]);
+})->with([
+    'no registry image name' => [['docker_registry_image_name' => null]],
+    'docker image build pack' => [['build_pack' => 'dockerimage']],
+    'docker compose build pack' => [['build_pack' => 'dockercompose']],
+    'dockerfile without git' => [['build_pack' => 'dockerfile', 'dockerfile' => 'FROM nginx']],
+]);
diff --git a/tests/Feature/GitSourceTypeIsolationTest.php b/tests/Feature/GitSourceTypeIsolationTest.php
new file mode 100644
index 0000000000..4cb185973f
--- /dev/null
+++ b/tests/Feature/GitSourceTypeIsolationTest.php
@@ -0,0 +1,96 @@
+<?php
+
+use App\Jobs\ProcessGithubPullRequestWebhook;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GiteaApp;
+use App\Models\GithubApp;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    $this->team = Team::factory()->create();
+    $this->githubApp = GithubApp::create([
+        'name' => 'github-app',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 1234567890,
+        'webhook_secret' => 'test-secret',
+        'is_public' => false,
+        'team_id' => $this->team->id,
+    ]);
+    $this->giteaApp = GiteaApp::create([
+        'name' => 'gitea-app',
+        'api_url' => 'https://gitea.example.com/api/v1',
+        'html_url' => 'https://gitea.example.com',
+        'team_id' => $this->team->id,
+    ]);
+    // Both sources share the same id, so only source_type tells them apart.
+    expect($this->giteaApp->id)->toBe($this->githubApp->id);
+});
+
+function createSourceTypeIsolationApplication(Team $team, GiteaApp $source): Application
+{
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    return Application::create([
+        'name' => 'gitea-sourced-app',
+        'git_repository' => 'test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'repository_project_id' => 987654321,
+        'source_id' => $source->id,
+        'source_type' => GiteaApp::class,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+it('does not route a GitHub App webhook to an application of another source type with the same id', function () {
+    Queue::fake();
+    createSourceTypeIsolationApplication($this->team, $this->giteaApp);
+
+    $body = json_encode([
+        'action' => 'closed',
+        'number' => 42,
+        'repository' => ['id' => 987654321, 'full_name' => 'test-org/test-repo'],
+        'pull_request' => [
+            'html_url' => 'https://github.com/test-org/test-repo/pull/42',
+            'title' => 'Change',
+            'author_association' => 'OWNER',
+            'head' => ['ref' => 'feature', 'sha' => 'e83c5163316f89bfbde7d9ab23ca2e25604af290'],
+            'base' => ['ref' => 'main'],
+        ],
+    ], JSON_THROW_ON_ERROR);
+
+    $response = $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'pull_request',
+        'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    $response->assertOk();
+    expect($response->getContent())->toContain('Nothing to do');
+    Queue::assertNotPushed(ProcessGithubPullRequestWebhook::class);
+});
+
+it('does not block GitHub App deletion because of an application of another source type with the same id', function () {
+    createSourceTypeIsolationApplication($this->team, $this->giteaApp);
+
+    $this->githubApp->delete();
+
+    expect(GithubApp::find($this->githubApp->id))->toBeNull();
+});
diff --git a/tests/Feature/GiteaOAuthCallbackStateTest.php b/tests/Feature/GiteaOAuthCallbackStateTest.php
new file mode 100644
index 0000000000..d694653ab1
--- /dev/null
+++ b/tests/Feature/GiteaOAuthCallbackStateTest.php
@@ -0,0 +1,153 @@
+<?php
+
+use App\Livewire\Source\Gitea\Change as GiteaSource;
+use App\Models\GiteaApp;
+use App\Models\Team;
+use App\Models\User;
+use App\Rules\SafeExternalUrl;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\Request as HttpRequest;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Http::macro('GitSource', fn (string $url) => Http::withOptions(SafeExternalUrl::httpClientOptions(
+        $url,
+        resolver: fn (string $host): array => ['93.184.216.34'],
+    )));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->giteaApp = GiteaApp::create([
+        'name' => 'Self-hosted Gitea',
+        'api_url' => 'https://gitea.example.com/api/v1',
+        'html_url' => 'https://gitea.example.com',
+        'client_id' => 'client-id',
+        'client_secret' => 'client-secret',
+        'redirect_uri' => 'https://coolify.example.com/webhooks/source/gitea/redirect',
+        'team_id' => $this->team->id,
+        'is_system_wide' => false,
+        'is_public' => false,
+    ]);
+});
+
+function putGiteaOAuthState(string $state, int $giteaAppId, int $teamId): string
+{
+    $key = GiteaSource::oauthStateCacheKey($state);
+    Cache::put($key, ['gitea_app_id' => $giteaAppId, 'team_id' => $teamId], now()->addMinutes(60));
+
+    return $key;
+}
+
+describe('Gitea OAuth callback state validation', function () {
+    test('rejects a callback without a state', function () {
+        Http::fake();
+
+        $this->get('/webhooks/source/gitea/redirect?code=any')->assertRedirect(route('source.all'));
+
+        Http::assertNothingSent();
+        expect($this->giteaApp->refresh()->access_token)->toBeNull();
+    });
+
+    test('rejects a callback whose state is the source UUID', function () {
+        Http::fake();
+
+        $this->get('/webhooks/source/gitea/redirect?code=any&state='.$this->giteaApp->uuid)
+            ->assertRedirect(route('source.all'));
+
+        Http::assertNothingSent();
+        expect($this->giteaApp->refresh()->access_token)->toBeNull();
+    });
+
+    test('rejects an unknown or expired state', function () {
+        Http::fake();
+
+        $this->get('/webhooks/source/gitea/redirect?code=any&state=not-a-real-state')
+            ->assertRedirect(route('source.all'));
+
+        Http::assertNothingSent();
+        expect($this->giteaApp->refresh()->access_token)->toBeNull();
+    });
+
+    test('rejects a state issued for a different team', function () {
+        Http::fake();
+        $otherTeam = Team::factory()->create();
+        putGiteaOAuthState('state-for-other-team', $this->giteaApp->id, $otherTeam->id);
+
+        $this->get('/webhooks/source/gitea/redirect?code=any&state=state-for-other-team')
+            ->assertRedirect(route('source.all'));
+
+        Http::assertNothingSent();
+        expect($this->giteaApp->refresh()->access_token)->toBeNull();
+    });
+
+    test('rejects a callback from a team member who cannot administer the source', function () {
+        Http::fake();
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        $this->actingAs($member);
+        session(['currentTeam' => $this->team]);
+        putGiteaOAuthState('member-state', $this->giteaApp->id, $this->team->id);
+
+        $this->get('/webhooks/source/gitea/redirect?code=any&state=member-state')
+            ->assertRedirect(route('source.all'));
+
+        Http::assertNothingSent();
+        expect($this->giteaApp->refresh()->access_token)->toBeNull();
+    });
+
+    test('requires authentication', function () {
+        auth()->logout();
+        session()->forget('currentTeam');
+
+        $this->get('/webhooks/source/gitea/redirect?code=any&state=any')->assertRedirect(route('login'));
+    });
+
+    test('exchanges the code at the Gitea token endpoint, stores the tokens, and consumes the state', function () {
+        Http::fake([
+            'gitea.example.com/login/oauth/access_token' => Http::response([
+                'access_token' => 'new-access-token',
+                'refresh_token' => 'new-refresh-token',
+                'token_type' => 'bearer',
+            ]),
+        ]);
+        $key = putGiteaOAuthState('a-valid-state', $this->giteaApp->id, $this->team->id);
+
+        $this->get('/webhooks/source/gitea/redirect?code=valid-code&state=a-valid-state')
+            ->assertRedirect(route('source.gitea.show', ['gitea_app_uuid' => $this->giteaApp->uuid]));
+
+        Http::assertSent(fn (HttpRequest $request): bool => $request->url() === 'https://gitea.example.com/login/oauth/access_token'
+            && $request['grant_type'] === 'authorization_code'
+            && $request['code'] === 'valid-code'
+            && $request['client_id'] === 'client-id'
+            && $request['client_secret'] === 'client-secret'
+            && $request['redirect_uri'] === 'https://coolify.example.com/webhooks/source/gitea/redirect');
+
+        $fresh = $this->giteaApp->refresh();
+        expect($fresh->access_token)->toBe('new-access-token')
+            ->and($fresh->refresh_token)->toBe('new-refresh-token')
+            ->and($fresh->expires_at)->toBeGreaterThanOrEqual(time() + 3590)
+            ->and($fresh->expires_at)->toBeLessThanOrEqual(time() + 3600)
+            ->and(Cache::get($key))->toBeNull();
+    });
+
+    test('does not store tokens when the token exchange fails', function () {
+        Http::fake([
+            'gitea.example.com/login/oauth/access_token' => Http::response(['error_description' => 'bad code'], 400),
+        ]);
+        putGiteaOAuthState('failing-state', $this->giteaApp->id, $this->team->id);
+
+        $this->get('/webhooks/source/gitea/redirect?code=bad&state=failing-state')
+            ->assertRedirect(route('source.gitea.show', ['gitea_app_uuid' => $this->giteaApp->uuid]))
+            ->assertSessionHas('error', 'Gitea OAuth failed: bad code');
+
+        expect($this->giteaApp->refresh()->access_token)->toBeNull();
+    });
+});
diff --git a/tests/Feature/GiteaPrivateRepositoryTest.php b/tests/Feature/GiteaPrivateRepositoryTest.php
new file mode 100644
index 0000000000..8eb893f5e0
--- /dev/null
+++ b/tests/Feature/GiteaPrivateRepositoryTest.php
@@ -0,0 +1,127 @@
+<?php
+
+use App\Livewire\Project\New\GiteaPrivateRepository;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GiteaApp;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+/**
+ * Http::GitSource() pins DNS before Http::fake() answers, so use a public IP
+ * literal that needs no DNS lookup. No request leaves the test.
+ */
+function giteaPickerBaseUrl(): string
+{
+    return 'https://1.1.1.1';
+}
+
+function giteaPickerSourceForTeam(Team $team, string $name): GiteaApp
+{
+    return GiteaApp::create([
+        'name' => $name,
+        'api_url' => giteaPickerBaseUrl().'/api/v1',
+        'html_url' => giteaPickerBaseUrl(),
+        'client_id' => 'client-id',
+        'client_secret' => 'client-secret',
+        'access_token' => 'gitea-access-token',
+        'refresh_token' => 'gitea-refresh-token',
+        'expires_at' => time() + 3600,
+        'team_id' => $team->id,
+        'is_system_wide' => false,
+        'is_public' => false,
+    ]);
+}
+
+beforeEach(function () {
+    Queue::fake();
+    Server::flushIdentityMap();
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->destination = StandaloneDocker::factory()->create([
+        'server_id' => $this->server->id,
+        'name' => 'dest-gitea',
+        'network' => 'coolify-gitea',
+    ]);
+
+    $this->giteaApp = giteaPickerSourceForTeam($this->team, 'Own Gitea');
+
+    $this->otherTeam = Team::factory()->create();
+    $this->otherGiteaApp = giteaPickerSourceForTeam($this->otherTeam, 'Foreign Gitea');
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('lists only the current team Gitea Apps', function () {
+    Livewire::test(GiteaPrivateRepository::class, ['type' => 'private-gitea-app'])
+        ->assertSee('Own Gitea')
+        ->assertDontSee('Foreign Gitea');
+});
+
+it('loads Gitea repositories and branches and creates an application from the selection', function () {
+    Http::fake([
+        '1.1.1.1/api/v1/user/repos*' => Http::response([
+            ['id' => 42, 'name' => 'web', 'full_name' => 'acme/web', 'default_branch' => 'develop', 'html_url' => giteaPickerBaseUrl().'/acme/web', 'owner' => ['login' => 'acme']],
+        ], 200),
+        '1.1.1.1/api/v1/repos/acme/web/branches*' => Http::response([
+            ['name' => 'main'],
+            ['name' => 'develop'],
+        ], 200),
+    ]);
+
+    Livewire::test(GiteaPrivateRepository::class, ['type' => 'private-gitea-app'])
+        ->set('parameters', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid])
+        ->set('query', ['destination' => $this->destination->uuid])
+        ->call('loadRepositories', $this->giteaApp->id)
+        ->assertSet('current_step', 'repository')
+        ->assertSet('selected_project_id', 42)
+        ->assertSet('selected_repository_path', 'acme/web')
+        ->call('loadBranches')
+        ->assertSet('selected_branch_name', 'develop')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $application = Application::query()->sole();
+    expect($application->repository_project_id)->toBe(42)
+        ->and($application->git_repository)->toBe('acme/web')
+        ->and($application->git_branch)->toBe('develop')
+        ->and($application->source_type)->toBe(GiteaApp::class)
+        ->and($application->source_id)->toBe($this->giteaApp->id);
+});
+
+it('rejects another team Gitea App without calling its API', function () {
+    Http::fake();
+
+    expect(fn () => Livewire::test(GiteaPrivateRepository::class, ['type' => 'private-gitea-app'])
+        ->call('loadRepositories', $this->otherGiteaApp->id))
+        ->toThrow(ModelNotFoundException::class);
+
+    Http::assertNothingSent();
+    expect(Application::count())->toBe(0);
+});
+
+it('locks the selected Gitea App so the client cannot switch it before submit', function () {
+    expect(fn () => Livewire::test(GiteaPrivateRepository::class, ['type' => 'private-gitea-app'])
+        ->set('gitea_app_id', $this->otherGiteaApp->id))
+        ->toThrow(CannotUpdateLockedPropertyException::class);
+});
diff --git a/tests/Feature/GiteaSourceChangeViewTest.php b/tests/Feature/GiteaSourceChangeViewTest.php
new file mode 100644
index 0000000000..0fc92ea783
--- /dev/null
+++ b/tests/Feature/GiteaSourceChangeViewTest.php
@@ -0,0 +1,214 @@
+<?php
+
+use App\Livewire\Source\Gitea\Change;
+use App\Models\GiteaApp;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function makeGiteaChangeViewApp(Team $team, array $attributes = []): GiteaApp
+{
+    return GiteaApp::create(array_merge([
+        'name' => 'My Gitea',
+        'api_url' => 'https://gitea.com/api/v1',
+        'html_url' => 'https://gitea.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'team_id' => $team->id,
+        'is_system_wide' => false,
+        'is_public' => false,
+    ], $attributes));
+}
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    InstanceSettings::forceCreate([
+        'id' => 0,
+        'fqdn' => null,
+        'public_ipv4' => null,
+        'public_ipv6' => null,
+    ]);
+
+    $this->giteaApp = makeGiteaChangeViewApp($this->team);
+});
+
+describe('Gitea source setup view', function () {
+    test('shows incomplete-setup guidance with the credential form', function () {
+        Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class)
+            ->assertSee('Finish connecting this Gitea App before using it as a source')
+            ->assertSee('https://gitea.com/user/settings/applications')
+            ->assertSee('Client ID')
+            ->assertSee('Client secret')
+            ->assertSee('Save')
+            ->assertDontSee('Test connection');
+    });
+
+    test('derives api url when gitea url changes', function () {
+        Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class)
+            ->set('htmlUrl', 'https://gitea.example.com')
+            ->assertSet('apiUrl', 'https://gitea.example.com/api/v1');
+    });
+
+    test('saves and reloads credentials and organization', function () {
+        Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class)
+            ->set('clientId', 'gitea-client-id')
+            ->set('clientSecretInput', 'super-secret-value')
+            ->set('organization', 'myorg')
+            ->call('submit')
+            ->assertDispatched('success');
+
+        $this->giteaApp->refresh();
+        expect($this->giteaApp->client_secret)->toBe('super-secret-value')
+            ->and($this->giteaApp->organization)->toBe('myorg');
+
+        Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class)
+            ->assertSet('clientId', 'gitea-client-id')
+            ->assertSet('clientSecretInput', 'super-secret-value')
+            ->assertSet('organization', 'myorg');
+    });
+
+    test('uses the gitea redirect path for a custom public endpoint', function () {
+        Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class)
+            ->set('use_custom_webhook_endpoint', true)
+            ->set('custom_webhook_endpoint', 'http://100.75.155.70:8000')
+            ->assertSet('redirectUri', 'http://100.75.155.70:8000/webhooks/source/gitea/redirect');
+
+        expect($this->giteaApp->refresh()->redirect_uri)
+            ->toBe('http://100.75.155.70:8000/webhooks/source/gitea/redirect');
+    });
+
+    test('builds the gitea oauth url and caches the state payload', function () {
+        $this->giteaApp->update(['client_id' => 'gitea-client-id']);
+
+        $component = Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class);
+
+        $state = $component->get('oauthState');
+        $url = $component->instance()->getOAuthUrl();
+
+        expect($url)->toStartWith('https://gitea.com/login/oauth/authorize?');
+        parse_str(parse_url($url, PHP_URL_QUERY), $query);
+        expect($query)->toMatchArray([
+            'client_id' => 'gitea-client-id',
+            'response_type' => 'code',
+            'scope' => 'read:user read:repository read:organization',
+            'state' => $state,
+        ])->and($query['redirect_uri'])->toEndWith('/webhooks/source/gitea/redirect');
+
+        expect(Change::oauthStateCacheKey($state))->toBe('gitea-app-oauth-state:'.hash('sha256', $state))
+            ->and(Cache::get(Change::oauthStateCacheKey($state)))->toBe([
+                'gitea_app_id' => $this->giteaApp->id,
+                'team_id' => $this->team->id,
+            ]);
+    });
+
+    test('shows the webhook url and secret for a connected app', function () {
+        $this->giteaApp->update([
+            'access_token' => 'access-token',
+            'refresh_token' => 'refresh-token',
+            'expires_at' => time() + 3600,
+            'webhook_secret' => 'gitea-webhook-secret',
+        ]);
+
+        Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class)
+            ->assertSee('/webhooks/source/gitea/events')
+            ->assertSet('webhookSecret', 'gitea-webhook-secret')
+            ->assertSee('Test connection');
+    });
+
+    test('test connection reports the authenticated gitea login', function () {
+        $this->giteaApp->update([
+            'access_token' => 'access-token',
+            'refresh_token' => 'refresh-token',
+            'expires_at' => time() + 3600,
+        ]);
+
+        Http::fake([
+            'gitea.com/api/v1/user' => Http::response(['login' => 'gitea-user'], 200),
+        ]);
+
+        Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class)
+            ->call('testConnection')
+            ->assertDispatched('success', 'Connection successful! Authenticated as: gitea-user');
+    });
+
+    test('redirects after the gitea app is deleted', function () {
+        Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class)
+            ->call('delete')
+            ->assertRedirect(route('source.all'));
+
+        $this->assertModelMissing($this->giteaApp);
+    });
+});
+
+describe('Gitea source authorization', function () {
+    test('user of another team cannot open a team gitea source', function () {
+        $otherTeam = Team::factory()->create();
+        $foreign = makeGiteaChangeViewApp($otherTeam, ['client_secret' => 'foreign-secret']);
+
+        Livewire::withQueryParams(['gitea_app_uuid' => $foreign->uuid])
+            ->test(Change::class)
+            ->assertStatus(404);
+    });
+
+    test('unrelated users cannot see system-wide source secrets', function () {
+        $otherTeam = Team::factory()->create();
+        $shared = makeGiteaChangeViewApp($otherTeam, [
+            'is_system_wide' => true,
+            'client_secret' => 'shared-client-secret',
+            'webhook_secret' => 'shared-webhook-secret',
+        ]);
+
+        $component = Livewire::withQueryParams(['gitea_app_uuid' => $shared->uuid])
+            ->test(Change::class)
+            ->assertSet('clientSecretInput', null)
+            ->assertSet('webhookSecret', null);
+
+        expect($component->html())
+            ->not->toContain('shared-client-secret')
+            ->not->toContain('shared-webhook-secret');
+    });
+
+    test('member of the source team cannot update it after switching to a team they own', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        $ownTeam = Team::factory()->create();
+        $ownTeam->members()->attach($member->id, ['role' => 'owner']);
+
+        $this->actingAs($member);
+        session(['currentTeam' => $this->team]);
+
+        $component = Livewire::withQueryParams(['gitea_app_uuid' => $this->giteaApp->uuid])
+            ->test(Change::class);
+
+        session(['currentTeam' => $ownTeam]);
+
+        $component->set('name', 'hijacked')
+            ->call('submit')
+            ->assertDispatched('error');
+        $component->call('delete');
+
+        $this->assertModelExists($this->giteaApp);
+        expect($this->giteaApp->refresh()->name)->toBe('My Gitea');
+    });
+});
diff --git a/tests/Feature/GiteaSourceCreateModalTest.php b/tests/Feature/GiteaSourceCreateModalTest.php
new file mode 100644
index 0000000000..7e411e7883
--- /dev/null
+++ b/tests/Feature/GiteaSourceCreateModalTest.php
@@ -0,0 +1,65 @@
+<?php
+
+use App\Livewire\Source\Gitea\Create;
+use App\Models\GiteaApp;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+describe('Gitea source create modal', function () {
+    test('renders the create form', function () {
+        Livewire::test(Create::class)
+            ->assertSee('Self-hosted Gitea')
+            ->assertSee('Organization')
+            ->assertSee('Continue');
+    });
+
+    test('creates a gitea app with defaults for gitea.com and redirects to it', function () {
+        $component = Livewire::test(Create::class)
+            ->set('name', 'my-gitea')
+            ->set('organization', 'myorg,myuser')
+            ->call('createGiteaApp');
+
+        $app = GiteaApp::where('name', 'my-gitea')->first();
+        expect($app)->not->toBeNull()
+            ->and($app->html_url)->toBe('https://gitea.com')
+            ->and($app->api_url)->toBe('https://gitea.com/api/v1')
+            ->and($app->custom_user)->toBe('git')
+            ->and($app->custom_port)->toBe(22)
+            ->and($app->organization)->toBe('myorg,myuser')
+            ->and($app->team_id)->toBe($this->team->id)
+            ->and(strlen((string) $app->webhook_secret))->toBe(32);
+
+        $component->assertRedirect(route('source.gitea.show', ['gitea_app_uuid' => $app->uuid]));
+    });
+
+    test('derives api url when html url changes', function () {
+        Livewire::test(Create::class)
+            ->set('html_url', 'https://gitea.example.com')
+            ->assertSet('api_url', 'https://gitea.example.com/api/v1');
+    });
+
+    test('team member cannot create a gitea app', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        $this->actingAs($member);
+
+        Livewire::test(Create::class)
+            ->set('name', 'member-gitea')
+            ->call('createGiteaApp');
+
+        expect(GiteaApp::where('name', 'member-gitea')->exists())->toBeFalse();
+    });
+});
diff --git a/tests/Feature/GiteaSourceListTest.php b/tests/Feature/GiteaSourceListTest.php
new file mode 100644
index 0000000000..879d928095
--- /dev/null
+++ b/tests/Feature/GiteaSourceListTest.php
@@ -0,0 +1,59 @@
+<?php
+
+use App\Models\GiteaApp;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->giteaApp = GiteaApp::create([
+        'name' => 'Team Gitea',
+        'organization' => 'acme',
+        'api_url' => 'https://gitea.com/api/v1',
+        'html_url' => 'https://gitea.com',
+        'team_id' => $this->team->id,
+        'is_system_wide' => false,
+        'is_public' => false,
+    ]);
+});
+
+test('team sources include gitea apps and count them as deletion blockers', function () {
+    expect($this->team->sources()->pluck('uuid'))->toContain($this->giteaApp->uuid)
+        ->and($this->team->deletionBlockers())->toMatchArray(['sources' => 1]);
+});
+
+test('sources page lists gitea apps with a link to their settings', function () {
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->get(route('source.all'))
+        ->assertOk()
+        ->assertSee('New Gitea App')
+        ->assertSee('Team Gitea')
+        ->assertSee('Gitea · acme')
+        ->assertSee(route('source.gitea.show', ['gitea_app_uuid' => $this->giteaApp->uuid]), false);
+});
+
+test('deleting a team transfers system-wide gitea apps and removes team gitea apps', function () {
+    $systemWide = GiteaApp::create([
+        'name' => 'Shared Gitea',
+        'api_url' => 'https://gitea.com/api/v1',
+        'html_url' => 'https://gitea.com',
+        'team_id' => $this->team->id,
+        'is_system_wide' => true,
+        'is_public' => false,
+    ]);
+
+    $this->team->delete();
+
+    expect($systemWide->refresh()->team_id)->toBe(0)
+        ->and(GiteaApp::find($this->giteaApp->id))->toBeNull();
+});
diff --git a/tests/Feature/GithubRunnerFlowTest.php b/tests/Feature/GithubRunnerFlowTest.php
index 8884763e08..2be3ec6d50 100644
--- a/tests/Feature/GithubRunnerFlowTest.php
+++ b/tests/Feature/GithubRunnerFlowTest.php
@@ -705,6 +705,42 @@ describe('provisioning', function () {
         Queue::assertPushed(CleanupGithubRunnerJob::class, fn ($job) => $job->executionId === $execution->id);
     });
 
+    it('stops provisioning without touching GitHub or the host when the server is transferred meanwhile', function (bool $cancelled) {
+        Queue::fake();
+        Process::fake(['*' => Process::result(output: '29.8.0')]);
+        $server = runnerTestServer($this->team);
+        runnerTestConfig($server, $this->githubApp);
+        $execution = runnerTestExecution($this->githubApp);
+        Http::fake([
+            'https://api.github.com/zen' => Http::response('ok', 200, ['Date' => now()->toRfc7231String()]),
+            'https://api.github.com/app/installations/*' => Http::response(['token' => 'installation-token'], 201),
+            'https://api.github.com/orgs/acme/actions/runners/42' => Http::response(null, 204),
+            'https://api.github.com/orgs/acme/actions/runners/generate-jitconfig' => function () use ($server, $execution, $cancelled) {
+                // The transfer commits while GitHub registers the runner. Without the cancel, it commits right
+                // after the job read the execution, so only the server shows the transfer.
+                $server->settings()->update(['force_disabled' => true]);
+                $server->forceFill(['server_metadata' => ['transfer' => ['status' => 'transferred']]])->saveQuietly();
+                if ($cancelled) {
+                    $execution->finish(GithubRunnerStatus::Cancelled);
+                }
+
+                return Http::response(['runner' => ['id' => 42], 'encoded_jit_config' => 'SECRET-JIT-CONFIG'], 201);
+            },
+        ]);
+
+        (new ProvisionGithubRunnerJob($execution->id))->handle();
+
+        expect($execution->fresh()->status)->toBe(GithubRunnerStatus::Cancelled)
+            ->and($execution->fresh()->ready_at)->toBeNull();
+        Process::assertDidntRun(fn (PendingProcess $process) => str_contains($process->command, '/home/runner/run.sh'));
+        Queue::assertPushed(CleanupGithubRunnerJob::class, fn ($job) => $job->executionId === $execution->id);
+
+        (new CleanupGithubRunnerJob($execution->id))->handle();
+
+        Process::assertDidntRun(fn (PendingProcess $process) => str_contains($process->command, 'docker rm'));
+        Http::assertNotSent(fn ($request) => $request->method() === 'DELETE');
+    })->with(['the transfer cancelled the execution' => true, 'the transfer commits after the last check' => false]);
+
     it('cleans up cancellation during remote provisioning without marking the runner ready', function (bool $duringStart) {
         Queue::fake();
         runnerTestConfig(runnerTestServer($this->team), $this->githubApp);
@@ -891,6 +927,19 @@ describe('server deletion', function () {
         expect(GithubApp::find($this->githubApp->id))->toBeNull();
     });
 
+    it('keeps the GitHub runners of a transferred server registered when it deletes the archive', function () {
+        Queue::fake();
+        $running = runnerTestExecution($this->githubApp, ['status' => GithubRunnerStatus::Running, 'server_id' => $this->server->id, 'github_runner_config_id' => $this->config->id, 'runner_id' => 42]);
+        $this->server->update(['server_metadata' => ['transfer' => ['status' => 'transferred']]]);
+
+        $this->server->delete();
+        DeleteServer::run($this->server->id);
+
+        expect(Server::withTrashed()->find($this->server->id))->toBeNull()
+            ->and(GithubRunnerExecution::whereKey($running->id)->exists())->toBeFalse();
+        Queue::assertNotPushed(DeregisterGithubRunnerJob::class);
+    });
+
     it('removes the runner from GitHub and ignores GitHub errors', function (int $status) {
         Http::fake([
             'https://api.github.com/zen' => Http::response('ok', 200, ['Date' => now()->toRfc7231String()]),
diff --git a/tests/Feature/GlobalSearchNavigationTest.php b/tests/Feature/GlobalSearchNavigationTest.php
index abe039fd80..99c2d5ab79 100644
--- a/tests/Feature/GlobalSearchNavigationTest.php
+++ b/tests/Feature/GlobalSearchNavigationTest.php
@@ -91,3 +91,20 @@ it('does not leak admin-only pages to a member through the team search cache', f
     expect(globalSearchNavigationLinks($team))->toContain(...adminOnlyNavigationLinks());
     expect(globalSearchNavigationLinks($team, 'member'))->not->toContain(...adminOnlyNavigationLinks());
 });
+
+it('opens the deploy canvas from the new canvas quick action', function () {
+    $user = User::factory()->create();
+    $team = Team::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    $component = Livewire::test(GlobalSearch::class)->call('openSearchModal');
+
+    expect(collect($component->get('creatableItems'))->firstWhere('type', 'canvas'))
+        ->toMatchArray(['name' => 'Canvas', 'category' => 'Quick Actions', 'route' => 'deploy-canvas']);
+
+    $component->call('navigateToResource', 'canvas')
+        ->assertDispatched('closeSearchModal')
+        ->assertRedirect(route('deploy-canvas'));
+});
diff --git a/tests/Feature/HelperVersionTest.php b/tests/Feature/HelperVersionTest.php
index 6c203887fb..908b3ba484 100644
--- a/tests/Feature/HelperVersionTest.php
+++ b/tests/Feature/HelperVersionTest.php
@@ -4,8 +4,11 @@ use App\Jobs\CheckHelperImageJob;
 use App\Models\InstanceSettings;
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Sleep;
 
 uses(RefreshDatabase::class);
 
@@ -19,13 +22,9 @@ beforeEach(function () {
     ]);
 });
 
-it('uses a newer helper version after fetching it from the CDN', function () {
+it('uses a newer helper version from the local versions file without asking the CDN', function () {
     Http::preventStrayRequests();
-    Http::fake([
-        'https://cdn.example.com/coolify/versions.json' => Http::response([
-            'coolify' => ['helper' => ['version' => '1.0.18']],
-        ]),
-    ]);
+    Cache::put('coolify:versions:all', ['coolify' => ['helper' => ['version' => '1.0.18']]], 3600);
 
     (new CheckHelperImageJob)->handle();
 
@@ -33,6 +32,21 @@ it('uses a newer helper version after fetching it from the CDN', function () {
         ->and(getHelperVersion())->toBe('1.0.18');
 });
 
+it('stores the helper version when the update check refreshes versions.json from the CDN', function () {
+    File::partialMock()->shouldReceive('put')->once()->with(base_path('versions.json'), Mockery::type('string'));
+    config(['constants.coolify.version' => '4.0.0']);
+    Http::preventStrayRequests();
+    Http::fake([
+        'https://cdn.example.com/coolify/versions.json' => Http::response([
+            'coolify' => ['v4' => ['version' => '4.0.0'], 'helper' => ['version' => '1.0.19']],
+        ]),
+    ]);
+
+    refresh_versions_file();
+
+    expect(InstanceSettings::findOrFail(0)->helper_version)->toBe('1.0.19');
+});
+
 it('does not use a stored helper version older than the bundled version', function () {
     InstanceSettings::findOrFail(0)->update(['helper_version' => '1.0.16']);
 
@@ -43,12 +57,14 @@ it('keeps the stored helper version and does not notify when the CDN is unavaila
     Team::factory()->create(['id' => 0])->discordNotificationSettings()->update(['discord_enabled' => true]);
     InstanceSettings::findOrFail(0)->update(['helper_version' => '1.0.17']);
     Notification::fake();
+    Sleep::fake();
+    File::partialMock()->shouldNotReceive('put');
     Http::preventStrayRequests();
     Http::fake([
-        'https://cdn.example.com/coolify/versions.json' => Http::response('error code: 1200', 503),
+        'https://cdn.example.com/coolify/versions.json' => Http::response('error code: 1200', 503, ['Retry-After' => '60']),
     ]);
 
-    (new CheckHelperImageJob)->handle();
+    expect(refresh_versions_file())->toBeNull();
 
     expect(InstanceSettings::findOrFail(0)->helper_version)->toBe('1.0.17');
     Notification::assertNothingSent();
diff --git a/tests/Feature/Helpers/DockerCustomCommandsTest.php b/tests/Feature/Helpers/DockerCustomCommandsTest.php
index 7a16d15446..b878d21c31 100644
--- a/tests/Feature/Helpers/DockerCustomCommandsTest.php
+++ b/tests/Feature/Helpers/DockerCustomCommandsTest.php
@@ -431,6 +431,62 @@ test('ConvertGpusCount', function () {
     ]);
 });
 
+test('ConvertInteractiveShortFlag', function () {
+    // -i keeps STDIN open so `docker attach` can send input (e.g. game server consoles).
+    expect(convertDockerRunToCompose('-i'))->toBe([
+        'stdin_open' => true,
+    ]);
+});
+
+test('ConvertTtyShortFlag', function () {
+    expect(convertDockerRunToCompose('-t'))->toBe([
+        'tty' => true,
+    ]);
+});
+
+test('ConvertInteractiveTtyCombinedShortFlag', function () {
+    expect(convertDockerRunToCompose('-it'))->toBe([
+        'stdin_open' => true,
+        'tty' => true,
+    ]);
+});
+
+test('ConvertTtyInteractiveCombinedShortFlag', function () {
+    expect(convertDockerRunToCompose('-ti'))->toBe([
+        'stdin_open' => true,
+        'tty' => true,
+    ]);
+});
+
+test('ConvertInteractiveTtyLongFlags', function () {
+    expect(convertDockerRunToCompose('--interactive --tty'))->toBe([
+        'stdin_open' => true,
+        'tty' => true,
+    ]);
+});
+
+test('ConvertInteractiveTtyWithOtherOptions', function () {
+    expect(convertDockerRunToCompose('-it --cap-add SYS_ADMIN'))->toBe([
+        'cap_add' => ['SYS_ADMIN'],
+        'stdin_open' => true,
+        'tty' => true,
+    ]);
+});
+
+test('DoesNotSetInteractiveTtyForUnrelatedShortFlags', function () {
+    // -d (detach) and other short flags without i/t must not enable stdin/tty.
+    expect(convertDockerRunToCompose('-d'))->toBe([]);
+});
+
+it('does not read interactive flags inside entrypoint arguments', function () {
+    expect(convertDockerRunToCompose('--entrypoint "python -i -t script.py"'))
+        ->toBe(['entrypoint' => 'python -i -t script.py']);
+});
+
+it('does not treat arbitrary short words as interactive flags', function () {
+    expect(convertDockerRunToCompose('-invalid'))->toBe([]);
+});
+
 test('ConvertRuntimeHardeningOptions', function () {
     $input = '--add-host host.docker.internal:host-gateway --add-host=db:10.0.0.5 --pids-limit 100 --runtime runc --read-only --tmpfs /run:rw,size=64m --tmpfs /tmp';
     $output = convertDockerRunToCompose($input);
@@ -462,6 +518,10 @@ test('UnsupportedDockerRunOptionsIsEmptyForSupportedOptions', function () {
         ->and(unsupportedDockerRunOptions(null))->toBe([]);
 });
 
+test('UnsupportedDockerRunOptionsSkipsInteractiveAndTtyFlags', function () {
+    expect(unsupportedDockerRunOptions('-it -t --interactive --tty --cap-add NET_ADMIN'))->toBe([]);
+});
+
 test('SeccompProfileMountFlags', function () {
     $input = '--security-opt seccomp=/etc/docker/seccomp.json --security-opt "seccomp:/srv/app profile.json" --security-opt seccomp=/etc/../root/x.json --security-opt seccomp=unconfined --security-opt apparmor=unconfined';
     expect(seccompProfileMountFlags($input))->toBe("--mount 'type=bind,source=/etc/docker/seccomp.json,target=/etc/docker/seccomp.json,readonly'")
diff --git a/tests/Feature/HostingerApiTest.php b/tests/Feature/HostingerApiTest.php
new file mode 100644
index 0000000000..3351b2dd10
--- /dev/null
+++ b/tests/Feature/HostingerApiTest.php
@@ -0,0 +1,324 @@
+<?php
+
+use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Http::preventStrayRequests();
+
+    InstanceSettings::query()->whereKey(0)->delete();
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create([
+        'id' => 0,
+        'is_api_enabled' => true,
+    ]));
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $this->bearerToken = $this->user->createToken('test-token', ['*'])->plainTextToken;
+    $this->hostingerToken = CloudProviderToken::factory()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+        'token' => 'hostinger-api-token',
+    ]);
+    $this->privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+});
+
+it('gets Hostinger data centers', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([
+            ['id' => 19, 'city' => 'Amsterdam', 'location' => 'nl'],
+        ]),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->getJson('/api/v1/hostinger/data-centers?cloud_provider_token_id='.$this->hostingerToken->uuid)
+        ->assertSuccessful()
+        ->assertJsonFragment(['id' => 19, 'city' => 'Amsterdam']);
+});
+
+it('gets Hostinger SSH keys and post-install scripts', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/public-keys' => Http::response([
+            'data' => [['id' => 42, 'name' => 'Operations']],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/post-install-scripts' => Http::response([
+            'data' => [['id' => 73, 'name' => 'Bootstrap Coolify']],
+        ]),
+    ]);
+
+    $query = '?cloud_provider_token_id='.$this->hostingerToken->uuid;
+
+    $this->withToken($this->bearerToken)
+        ->getJson('/api/v1/hostinger/ssh-keys'.$query)
+        ->assertSuccessful()
+        ->assertJsonFragment(['id' => 42, 'name' => 'Operations']);
+
+    $this->withToken($this->bearerToken)
+        ->getJson('/api/v1/hostinger/post-install-scripts'.$query)
+        ->assertSuccessful()
+        ->assertJsonFragment(['id' => 73, 'name' => 'Bootstrap Coolify']);
+});
+
+it('gets only Hostinger KVM plans through the API', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/billing/v1/catalog*' => Http::response([
+            ['id' => 'hostingercom-vps-kvm1', 'name' => 'KVM 1', 'prices' => []],
+            ['id' => 'hostingercom-vps-kvmminecraftalex', 'name' => 'Game Panel 1', 'prices' => []],
+        ]),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->getJson('/api/v1/hostinger/catalog?cloud_provider_token_id='.$this->hostingerToken->uuid)
+        ->assertSuccessful()
+        ->assertJsonCount(1)
+        ->assertJsonFragment(['id' => 'hostingercom-vps-kvm1'])
+        ->assertJsonMissing(['id' => 'hostingercom-vps-kvmminecraftalex']);
+});
+
+it('returns 403 with the Hostinger message when Hostinger denies a provider list', function (int $hostingerStatus) {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/post-install-scripts' => Http::response([
+            'message' => '[VPS:2000] Unauthorized',
+        ], $hostingerStatus),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->getJson('/api/v1/hostinger/post-install-scripts?cloud_provider_token_id='.$this->hostingerToken->uuid)
+        ->assertForbidden()
+        ->assertExactJson(['message' => 'Hostinger denied access to post-install scripts: [VPS:2000] Unauthorized']);
+})->with([401, 403]);
+
+it('returns 429 when Hostinger rate limits a provider list', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/templates' => Http::response([
+            'message' => 'Too many requests.',
+        ], 429, ['Retry-After' => '30']),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->getJson('/api/v1/hostinger/templates?cloud_provider_token_id='.$this->hostingerToken->uuid)
+        ->assertStatus(429)
+        ->assertHeader('Retry-After', '30')
+        ->assertExactJson(['message' => 'Rate limit exceeded. Please try again later.']);
+});
+
+it('returns a generic error when a Hostinger provider list fails', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([
+            'message' => 'Invalid request',
+        ], 422),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->getJson('/api/v1/hostinger/data-centers?cloud_provider_token_id='.$this->hostingerToken->uuid)
+        ->assertServerError()
+        ->assertExactJson(['message' => 'Failed to fetch Hostinger data centers.']);
+});
+
+it('creates a Hostinger VPS server through the API', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'order' => ['id' => 2957086, 'status' => 'completed'],
+            'virtual_machine' => [
+                'id' => 17923,
+                'state' => 'creating',
+                'ipv4' => [['address' => '203.0.113.10']],
+            ],
+        ]),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/servers/hostinger', [
+            'cloud_provider_token_id' => $this->hostingerToken->uuid,
+            'item_id' => 'hostingercom-vps-kvm2-usd-1m',
+            'data_center_id' => 19,
+            'template_id' => 1130,
+            'name' => 'api-hostinger.example.com',
+            'private_key_uuid' => $this->privateKey->uuid,
+            'enable_backups' => true,
+        ])
+        ->assertCreated()
+        ->assertJsonFragment([
+            'hostinger_virtual_machine_id' => 17923,
+            'ip' => '203.0.113.10',
+        ]);
+
+    $this->assertDatabaseHas('servers', [
+        'team_id' => $this->team->id,
+        'hostinger_virtual_machine_id' => 17923,
+        'ip' => '203.0.113.10',
+    ]);
+
+    Http::assertSent(fn ($request) => $request->method() === 'POST'
+        && $request->url() === 'https://developers.hostinger.com/api/vps/v1/virtual-machines'
+        && $request['setup']['enable_backups'] === true);
+});
+
+it('turns paid Hostinger backups off when the API request does not enable them', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'virtual_machine' => [
+                'id' => 17923,
+                'state' => 'creating',
+                'ipv4' => [['address' => '203.0.113.10']],
+            ],
+        ]),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/servers/hostinger', [
+            'cloud_provider_token_uuid' => $this->hostingerToken->uuid,
+            'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+            'data_center_id' => 19,
+            'template_id' => 1130,
+            'private_key_uuid' => $this->privateKey->uuid,
+        ])
+        ->assertCreated();
+
+    Http::assertSent(fn ($request) => $request->method() === 'POST'
+        && $request->url() === 'https://developers.hostinger.com/api/vps/v1/virtual-machines'
+        && $request['setup']['enable_backups'] === false);
+});
+
+it('requires the deploy ability to run a post-install script or add SSH keys on a Hostinger VPS', function (array $extra) {
+    Http::fake();
+    $writeToken = $this->user->createToken('write-token', ['read', 'write'])->plainTextToken;
+
+    $this->withToken($writeToken)
+        ->postJson('/api/v1/servers/hostinger', [
+            'cloud_provider_token_uuid' => $this->hostingerToken->uuid,
+            'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+            'data_center_id' => 19,
+            'template_id' => 1130,
+            'private_key_uuid' => $this->privateKey->uuid,
+            ...$extra,
+        ])
+        ->assertForbidden()
+        ->assertJsonPath('message', fn (string $message) => str_starts_with($message, 'Missing required permissions: deploy.'));
+
+    Http::assertNothingSent();
+    $this->assertDatabaseMissing('servers', ['team_id' => $this->team->id]);
+})->with([
+    'post-install script' => [['post_install_script_id' => 73]],
+    'extra SSH keys' => [['public_key_ids' => [42]]],
+]);
+
+it('lets a deploy token run a post-install script on a Hostinger VPS', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'virtual_machine' => [
+                'id' => 17923,
+                'state' => 'creating',
+                'ipv4' => [['address' => '203.0.113.10']],
+            ],
+        ]),
+    ]);
+    $deployToken = $this->user->createToken('deploy-token', ['read', 'write', 'deploy'])->plainTextToken;
+
+    $this->withToken($deployToken)
+        ->postJson('/api/v1/servers/hostinger', [
+            'cloud_provider_token_uuid' => $this->hostingerToken->uuid,
+            'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+            'data_center_id' => 19,
+            'template_id' => 1130,
+            'private_key_uuid' => $this->privateKey->uuid,
+            'post_install_script_id' => 73,
+        ])
+        ->assertCreated();
+
+    Http::assertSent(fn ($request) => $request->method() === 'POST'
+        && $request->url() === 'https://developers.hostinger.com/api/vps/v1/virtual-machines'
+        && $request['setup']['post_install_script_id'] === 73);
+});
+
+it('keeps a charged Hostinger VPS when the purchase returns an error through the API', function () {
+    $listRequests = 0;
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/2008976/setup' => Http::response([
+            'id' => 2008976,
+            'state' => 'creating',
+            'ipv4' => [['address' => '72.61.180.163']],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => function ($request) use (&$listRequests) {
+            if ($request->method() === 'POST') {
+                return Http::response(['message' => '[VPS:2004] Wrong hostname FQDN format'], 422);
+            }
+
+            return Http::response($listRequests++ === 0 ? [] : [['id' => 2008976, 'state' => 'initial']]);
+        },
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/servers/hostinger', [
+            'cloud_provider_token_id' => $this->hostingerToken->uuid,
+            'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+            'data_center_id' => 19,
+            'template_id' => 1077,
+            'private_key_uuid' => $this->privateKey->uuid,
+        ])
+        ->assertCreated()
+        ->assertJsonFragment([
+            'hostinger_virtual_machine_id' => 2008976,
+            'ip' => '72.61.180.163',
+        ]);
+
+    $this->assertDatabaseHas('servers', [
+        'team_id' => $this->team->id,
+        'hostinger_virtual_machine_id' => 2008976,
+        'ip' => '72.61.180.163',
+    ]);
+});
+
+it('reports a Hostinger order that is waiting for payment through the API', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'id' => 2957086,
+            'status' => 'payment_initiated',
+        ], 202),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/servers/hostinger', [
+            'cloud_provider_token_id' => $this->hostingerToken->uuid,
+            'item_id' => 'hostingercom-vps-kvm2-usd-1m',
+            'data_center_id' => 19,
+            'template_id' => 1130,
+            'private_key_uuid' => $this->privateKey->uuid,
+        ])
+        ->assertStatus(202)
+        ->assertJsonFragment(['message' => 'Hostinger order 2957086 is waiting for payment. Finish the VPS setup in hPanel.']);
+
+    $this->assertDatabaseMissing('servers', ['team_id' => $this->team->id]);
+});
+
+it('accepts Hostinger cloud provider tokens through the API', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([]),
+    ]);
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/cloud-tokens', [
+            'provider' => 'hostinger',
+            'token' => 'another-hostinger-token',
+            'name' => 'Another Hostinger Token',
+        ])
+        ->assertCreated();
+
+    $this->assertDatabaseHas('cloud_provider_tokens', [
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+        'name' => 'Another Hostinger Token',
+    ]);
+});
diff --git a/tests/Feature/HostingerServerCreationTest.php b/tests/Feature/HostingerServerCreationTest.php
new file mode 100644
index 0000000000..264fc523a4
--- /dev/null
+++ b/tests/Feature/HostingerServerCreationTest.php
@@ -0,0 +1,485 @@
+<?php
+
+use App\Actions\Server\DeleteServer;
+use App\Livewire\Server\Create;
+use App\Livewire\Server\CreatePage;
+use App\Livewire\Server\Delete;
+use App\Livewire\Server\New\ByHostinger;
+use App\Livewire\Server\Show;
+use App\Livewire\Server\ValidateAndInstall;
+use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+use Lorisleiva\Actions\Decorators\JobDecorator;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Http::preventStrayRequests();
+
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+    ]);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create([
+        'id' => 0,
+    ]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->token = CloudProviderToken::factory()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+        'token' => 'hostinger-token',
+        'name' => 'Production Hostinger',
+    ]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('offers Hostinger as a server provider', function () {
+    Livewire::test(Create::class)
+        ->assertSee('Hostinger')
+        ->assertSee(route('server.create.type', ['type' => 'hostinger']), false);
+
+    Livewire::test(CreatePage::class, ['type' => 'hostinger'])
+        ->assertSet('title', 'Hostinger')
+        ->assertSet('tokenProvider', 'hostinger');
+});
+
+it('uses the current cloud provider UI and Hostinger affiliate link', function () {
+    Livewire::test(ByHostinger::class)
+        ->assertSee('Hostinger account')
+        ->assertSee('https://www.hostinger.com/vps/coolify-hosting?ref=coolify.io', false)
+        ->assertSee("through Coolify's affiliate link.", false);
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->set('loading_data', false)
+        ->assertSee('Hostinger server')
+        ->assertSee('Advanced options')
+        ->assertSee('Buy and create');
+});
+
+it('leaves paid Hostinger backups off by default', function () {
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->assertSet('enable_backups', false)
+        ->set('loading_data', false)
+        ->assertSee('Enable weekly Hostinger backups (extra cost)')
+        ->assertSee('Hostinger charges extra for backups. Check the price in hPanel before you enable them.');
+});
+
+it('selects Hostinger account SSH keys with the same dropdown as Hetzner', function () {
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->set('loading_data', false)
+        ->set('hostinger_public_keys', [['id' => 42, 'name' => '<b>Operations</b>']])
+        ->assertSee('Extra SSH keys')
+        ->assertSee('Existing keys from the Hostinger account.')
+        ->assertSee('Search SSH keys')
+        ->assertSee('Operations')
+        ->assertSeeHtml('x-text="current">Select SSH keys</span>')
+        ->assertDontSeeHtml('<b>Operations</b>')
+        ->assertDontSeeHtml('id="hostinger-public-key-42-');
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->set('loading_data', false)
+        ->set('hostinger_public_keys', [])
+        ->assertSee('No account keys found');
+});
+
+it('purchases a Hostinger VPS and creates the linked Coolify server', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([
+            ['id' => 19, 'name' => 'nl-ams', 'city' => 'Amsterdam', 'location' => 'nl'],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/templates' => Http::response([
+            ['id' => 1130, 'name' => 'Ubuntu 24.04 LTS'],
+        ]),
+        'https://developers.hostinger.com/api/billing/v1/catalog*' => Http::response([
+            [
+                'id' => 'hostingercom-vps-kvm2',
+                'name' => 'KVM 2',
+                'category' => 'VPS',
+                'prices' => [
+                    [
+                        'id' => 'hostingercom-vps-kvm2-usd-1m',
+                        'currency' => 'USD',
+                        'price' => 1799,
+                        'first_period_price' => 899,
+                        'period' => 1,
+                        'period_unit' => 'month',
+                    ],
+                ],
+            ],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/public-keys' => Http::response(['data' => []]),
+        'https://developers.hostinger.com/api/vps/v1/post-install-scripts' => Http::response(['data' => []]),
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'order' => ['id' => 2957086, 'status' => 'completed'],
+            'virtual_machine' => [
+                'id' => 17923,
+                'hostname' => 'coolify-hostinger.example.com',
+                'state' => 'creating',
+                'ipv4' => [['address' => '203.0.113.10']],
+            ],
+        ]),
+    ]);
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData')
+        ->set('server_name', 'coolify-hostinger.example.com')
+        ->set('selected_data_center_id', 19)
+        ->set('selected_template_id', 1130)
+        ->set('selected_price_id', 'hostingercom-vps-kvm2-usd-1m')
+        ->set('private_key_id', $this->privateKey->id)
+        ->set('enable_backups', true)
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $server = Server::query()->where('hostinger_virtual_machine_id', 17923)->firstOrFail();
+
+    expect($server->name)->toBe('coolify-hostinger.example.com')
+        ->and($server->ip)->toBe('203.0.113.10')
+        ->and($server->hostinger_virtual_machine_status)->toBe('creating')
+        ->and($server->cloud_provider_token_id)->toBe($this->token->id);
+
+    Http::assertSent(fn ($request) => $request->method() === 'POST'
+        && $request->url() === 'https://developers.hostinger.com/api/vps/v1/virtual-machines'
+        && $request['item_id'] === 'hostingercom-vps-kvm2-usd-1m'
+        && $request['setup']['hostname'] === 'coolify-hostinger.example.com'
+        && $request['setup']['public_key']['key'] === $this->privateKey->getPublicKey());
+});
+
+it('keeps a purchased Hostinger VPS linked while its public IP is pending', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([['id' => 19, 'name' => 'nl-ams', 'city' => null]]),
+        'https://developers.hostinger.com/api/vps/v1/templates' => Http::response([['id' => 1130, 'name' => 'Ubuntu']]),
+        'https://developers.hostinger.com/api/billing/v1/catalog*' => Http::response([
+            ['id' => 'hostingercom-vps-kvm2', 'name' => 'KVM 2', 'prices' => [['id' => 'kvm2-monthly']]],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/public-keys' => Http::response(['data' => []]),
+        'https://developers.hostinger.com/api/vps/v1/post-install-scripts' => Http::response(['data' => []]),
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'virtual_machine' => ['id' => 17923, 'state' => 'creating', 'ipv4' => []],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'message' => 'Still provisioning',
+        ], 503),
+    ]);
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData')
+        ->set('server_name', 'pending-hostinger.example.com')
+        ->set('selected_data_center_id', 19)
+        ->set('selected_template_id', 1130)
+        ->set('selected_price_id', 'kvm2-monthly')
+        ->set('private_key_id', $this->privateKey->id)
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    expect(Server::query()->where('hostinger_virtual_machine_id', 17923)->firstOrFail()->ip)
+        ->toBe(Server::PLACEHOLDER_IP);
+});
+
+it('loads the Hostinger form when optional provider lists are not authorized', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([['id' => 19, 'name' => 'nl-ams', 'city' => 'Amsterdam']]),
+        'https://developers.hostinger.com/api/vps/v1/templates' => Http::response([['id' => 1130, 'name' => 'Ubuntu']]),
+        'https://developers.hostinger.com/api/billing/v1/catalog*' => Http::response([
+            ['id' => 'hostingercom-vps-kvm2', 'name' => 'KVM 2', 'prices' => [['id' => 'kvm2-monthly']]],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/public-keys' => Http::response(['message' => '[VPS:2000] Unauthorized'], 403),
+        'https://developers.hostinger.com/api/vps/v1/post-install-scripts' => Http::response(['message' => '[VPS:2000] Unauthorized'], 403),
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'virtual_machine' => ['id' => 17923, 'state' => 'creating', 'ipv4' => [['address' => '203.0.113.10']]],
+        ]),
+    ]);
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData')
+        ->assertSet('provider_data_error', null)
+        ->assertSet('hostinger_public_keys', [])
+        ->assertSet('post_install_scripts', [])
+        ->assertSee('Buy and create')
+        ->set('server_name', 'optional-lists.example.com')
+        ->set('selected_data_center_id', 19)
+        ->set('selected_template_id', 1130)
+        ->set('selected_price_id', 'kvm2-monthly')
+        ->set('private_key_id', $this->privateKey->id)
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    expect(Server::query()->where('hostinger_virtual_machine_id', 17923)->exists())->toBeTrue();
+});
+
+it('revalidates the selected Hostinger price before making a purchase', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([
+            ['id' => 19, 'name' => 'nl-ams', 'city' => 'Amsterdam'],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/templates' => Http::response([
+            ['id' => 1130, 'name' => 'Ubuntu 24.04 LTS'],
+        ]),
+        'https://developers.hostinger.com/api/billing/v1/catalog*' => Http::response([
+            [
+                'id' => 'hostingercom-vps-kvm2',
+                'name' => 'KVM 2',
+                'prices' => [['id' => 'hostingercom-vps-kvm2-usd-1m']],
+            ],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/public-keys' => Http::response(['data' => []]),
+        'https://developers.hostinger.com/api/vps/v1/post-install-scripts' => Http::response(['data' => []]),
+    ]);
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData')
+        ->set('server_name', 'coolify-hostinger.example.com')
+        ->set('selected_data_center_id', 19)
+        ->set('selected_template_id', 1130)
+        ->set('selected_price_id', 'tampered-price-id')
+        ->set('private_key_id', $this->privateKey->id)
+        ->call('submit')
+        ->assertHasErrors('selected_price_id');
+
+    Http::assertNotSent(fn ($request) => $request->method() === 'POST');
+});
+
+function fakeHostingerProvisioningOptions(array $overrides = []): void
+{
+    $price = fn (string $plan, int $period, string $unit, string $suffix) => [
+        'id' => "hostingercom-vps-{$plan}-usd-{$suffix}",
+        'currency' => 'USD',
+        'price' => 1000,
+        'first_period_price' => 500,
+        'period' => $period,
+        'period_unit' => $unit,
+    ];
+    $prices = fn (string $plan) => [
+        $price($plan, 2, 'year', '2y'),
+        $price($plan, 1, 'month', '1m'),
+        $price($plan, 1, 'year', '1y'),
+    ];
+
+    Http::fake(array_merge([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([
+            ['id' => 19, 'name' => 'nl-ams', 'city' => 'Amsterdam', 'location' => 'nl'],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/templates' => Http::response([
+            ['id' => 1121, 'name' => 'AlmaLinux 9 with CyberPanel'],
+            ['id' => 1130, 'name' => 'Ubuntu 24.04 LTS'],
+            ['id' => 1077, 'name' => 'Debian 13'],
+            ['id' => 1150, 'name' => 'Ubuntu 24.04 with Coolify'],
+        ]),
+        'https://developers.hostinger.com/api/billing/v1/catalog*' => Http::response([
+            ['id' => 'hostingercom-vps-kvm8', 'name' => 'KVM 8', 'metadata' => ['cpus' => 8], 'prices' => $prices('kvm8')],
+            ['id' => 'hostingercom-vps-kvmminecraftalex', 'name' => 'Game Panel 1', 'metadata' => ['cpus' => 1], 'prices' => $prices('kvmminecraftalex')],
+            ['id' => 'hostingercom-vps-kvm1', 'name' => 'KVM 1', 'metadata' => ['cpus' => 1], 'prices' => $prices('kvm1')],
+            ['id' => 'hostingercom-vps-kvm2', 'name' => 'KVM 2', 'metadata' => ['cpus' => 2], 'prices' => $prices('kvm2')],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/public-keys' => Http::response(['data' => []]),
+        'https://developers.hostinger.com/api/vps/v1/post-install-scripts' => Http::response(['data' => []]),
+    ], $overrides));
+}
+
+it('lists only Hostinger KVM plans sorted by size and billing period', function () {
+    fakeHostingerProvisioningOptions();
+
+    $component = Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData');
+
+    expect(collect($component->instance()->priceOptions)->pluck('id')->all())->toBe([
+        'hostingercom-vps-kvm1-usd-1m',
+        'hostingercom-vps-kvm1-usd-1y',
+        'hostingercom-vps-kvm1-usd-2y',
+        'hostingercom-vps-kvm2-usd-1m',
+        'hostingercom-vps-kvm2-usd-1y',
+        'hostingercom-vps-kvm2-usd-2y',
+        'hostingercom-vps-kvm8-usd-1m',
+        'hostingercom-vps-kvm8-usd-1y',
+        'hostingercom-vps-kvm8-usd-2y',
+    ]);
+
+    $component->assertDontSee('Game Panel');
+});
+
+it('splits Hostinger templates into plain operating systems and operating systems with applications', function () {
+    fakeHostingerProvisioningOptions();
+
+    $component = Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData')
+        ->assertSet('selected_os_template_id', 1130)
+        ->assertSet('selected_app_template_id', null)
+        ->assertSet('selected_template_id', 1130)
+        ->assertSee('Operating system with application')
+        ->assertSee('can conflict with the Coolify proxy on ports 80 and 443', false);
+
+    expect(collect($component->instance()->osTemplates)->pluck('name')->all())
+        ->toBe(['Debian 13', 'Ubuntu 24.04 LTS'])
+        ->and(collect($component->instance()->appTemplates)->pluck('name')->all())
+        ->toBe(['AlmaLinux 9 with CyberPanel', 'Ubuntu 24.04 with Coolify']);
+});
+
+it('keeps only one Hostinger operating system selection', function () {
+    fakeHostingerProvisioningOptions();
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData')
+        ->set('selected_app_template_id', 1150)
+        ->assertSet('selected_os_template_id', null)
+        ->assertSet('selected_template_id', 1150)
+        ->set('selected_os_template_id', 1077)
+        ->assertSet('selected_app_template_id', null)
+        ->assertSet('selected_template_id', 1077);
+});
+
+it('purchases a Hostinger VPS with an operating system that includes an application', function () {
+    fakeHostingerProvisioningOptions([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'virtual_machine' => ['id' => 17923, 'state' => 'creating', 'ipv4' => [['address' => '203.0.113.10']]],
+        ]),
+    ]);
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData')
+        ->set('server_name', 'app-template.example.com')
+        ->set('selected_data_center_id', 19)
+        ->set('selected_price_id', 'hostingercom-vps-kvm2-usd-1m')
+        ->set('selected_app_template_id', 1150)
+        ->set('private_key_id', $this->privateKey->id)
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    Http::assertSent(fn ($request) => $request->method() === 'POST'
+        && $request->url() === 'https://developers.hostinger.com/api/vps/v1/virtual-machines'
+        && $request['setup']['template_id'] === 1150);
+});
+
+it('rejects a Game Panel Hostinger plan before making a purchase', function () {
+    fakeHostingerProvisioningOptions();
+
+    Livewire::test(ByHostinger::class, ['selectedTokenUuid' => $this->token->uuid])
+        ->call('loadHostingerData')
+        ->set('server_name', 'game-panel.example.com')
+        ->set('selected_data_center_id', 19)
+        ->set('selected_price_id', 'hostingercom-vps-kvmminecraftalex-usd-1m')
+        ->set('private_key_id', $this->privateKey->id)
+        ->call('submit')
+        ->assertHasErrors('selected_price_id');
+
+    Http::assertNotSent(fn ($request) => $request->method() === 'POST');
+});
+
+it('starts a stopped Hostinger VPS from the server page', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+        'cloud_provider_token_id' => $this->token->id,
+        'hostinger_virtual_machine_id' => 17923,
+        'hostinger_virtual_machine_status' => 'stopped',
+    ]);
+
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923/start' => Http::response([
+            'id' => 456,
+            'state' => 'starting',
+        ]),
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $server->uuid])
+        ->call('startHostingerVirtualMachine')
+        ->assertSet('hostingerVirtualMachineStatus', 'starting')
+        ->assertDispatched('success');
+
+    expect($server->fresh()->hostinger_virtual_machine_status)->toBe('starting');
+});
+
+it('labels the Hostinger status refresh button on the server page', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+        'cloud_provider_token_id' => $this->token->id,
+        'hostinger_virtual_machine_id' => 17923,
+        'hostinger_virtual_machine_status' => 'running',
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $server->uuid])
+        ->assertSee('Hostinger · Running')
+        ->assertSee('Refresh provider status')
+        ->assertSeeHtml('wire:click.prevent="checkHostingerVirtualMachineStatus(true)"');
+});
+
+it('does not validate a stopped Hostinger VPS over SSH', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+        'cloud_provider_token_id' => $this->token->id,
+        'hostinger_virtual_machine_id' => 17923,
+        'hostinger_virtual_machine_status' => 'stopped',
+    ]);
+
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'id' => 17923,
+            'state' => 'stopped',
+            'ipv4' => [['address' => $server->ip]],
+        ]),
+    ]);
+
+    Livewire::test(ValidateAndInstall::class, ['server' => $server])
+        ->call('validateConnection')
+        ->assertSet('error', 'Hostinger VPS is stopped. Power it on before validating.');
+});
+
+it('warns that deleting from Coolify does not cancel the Hostinger VPS', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+        'cloud_provider_token_id' => $this->token->id,
+        'hostinger_virtual_machine_id' => 17923,
+    ]);
+
+    Livewire::test(Delete::class, ['server_uuid' => $server->uuid])
+        ->assertSee('Hostinger deletes the VPS only at the end of its paid period, and only if you select this in the confirmation dialog.')
+        ->assertSee('https://hpanel.hostinger.com/', false)
+        ->assertSeeHtml('<strong>Hostinger deletes a VPS only at the end of its paid period.</strong>')
+        ->assertSee('The VPS on Hostinger will NOT be deleted, and Hostinger will keep billing for it.');
+});
+
+it('passes the Hostinger deletion choice to the server deletion', function () {
+    Queue::fake();
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+        'cloud_provider_token_id' => $this->token->id,
+        'hostinger_virtual_machine_id' => 17923,
+    ]);
+
+    Livewire::test(Delete::class, ['server_uuid' => $server->uuid])
+        ->assertSee('Also delete VPS from Hostinger (at the end of the paid period)')
+        ->call('delete', 'password', ['delete_from_hostinger']);
+
+    Queue::assertPushed(JobDecorator::class, fn (JobDecorator $job) => $job->getAction() instanceof DeleteServer
+        && $job->getParameters()[9] === true
+        && $job->getParameters()[10] === 17923);
+});
+
+it('keeps the default deletion warning for servers without a Hostinger VPS', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+
+    Livewire::test(Delete::class, ['server_uuid' => $server->uuid])
+        ->assertSee('This operation is permanent and cannot be undone.')
+        ->assertDontSee('Hostinger deletes a VPS');
+});
diff --git a/tests/Feature/InstanceBackupMultipleS3DestinationsTest.php b/tests/Feature/InstanceBackupMultipleS3DestinationsTest.php
new file mode 100644
index 0000000000..551e0cef0f
--- /dev/null
+++ b/tests/Feature/InstanceBackupMultipleS3DestinationsTest.php
@@ -0,0 +1,137 @@
+<?php
+
+use App\Jobs\DatabaseBackupJob;
+use App\Livewire\Project\Database\BackupEdit;
+use App\Livewire\SettingsBackup;
+use App\Livewire\Storage\Resources as StorageResources;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function instanceBackupS3Storage(Team $team, string $name): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => str($name)->slug()->toString(),
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => $team->id,
+    ]);
+}
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    $this->rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    $server = Server::factory()->create([
+        'id' => 0,
+        'team_id' => 0,
+        'ip' => '127.0.0.1',
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => 0])->id,
+    ]);
+    $server->settings()->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail()->forceFill(['id' => 0])->save();
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $this->database = new StandalonePostgresql;
+    $this->database->forceFill([
+        'id' => 0,
+        'name' => 'coolify-db',
+        'postgres_user' => 'coolify',
+        'postgres_password' => 'password',
+        'postgres_db' => 'coolify',
+        'status' => 'running',
+        'destination_type' => StandaloneDocker::class,
+        'destination_id' => 0,
+    ])->save();
+    $this->backup = ScheduledDatabaseBackup::create([
+        'enabled' => true,
+        'save_s3' => false,
+        'frequency' => '0 0 * * *',
+        'database_id' => 0,
+        'database_type' => StandalonePostgresql::class,
+        'team_id' => 0,
+    ]);
+
+    $this->firstStorage = instanceBackupS3Storage($this->rootTeam, 'First S3');
+    $this->secondStorage = instanceBackupS3Storage($this->rootTeam, 'Second S3');
+    $this->otherTeam = Team::factory()->create();
+    $this->foreignStorage = instanceBackupS3Storage($this->otherTeam, 'Foreign S3');
+
+    $user = User::factory()->create();
+    $this->rootTeam->members()->attach($user->id, ['role' => 'admin']);
+    $user->teams()->attach($this->otherTeam->id, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => 0]]);
+});
+
+it('offers every root team S3 storage on the instance backup page', function () {
+    Livewire::test(SettingsBackup::class)
+        ->assertOk()
+        ->assertSee('First S3')
+        ->assertSee('Second S3')
+        ->assertDontSee('Foreign S3');
+});
+
+it('saves several S3 destinations for the instance backup and drops storages of other teams', function () {
+    // The session team can change in another tab after the page loads.
+    session(['currentTeam' => ['id' => $this->otherTeam->id]]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $this->backup->fresh(), 'availableS3Storages' => collect()])
+        ->set('saveS3', true)
+        ->set('s3StorageIds', [$this->firstStorage->id, $this->secondStorage->id, $this->foreignStorage->id])
+        ->call('submit')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    $backup = $this->backup->fresh();
+
+    expect($backup->save_s3)->toBeTruthy()
+        ->and($backup->s3_storage_id)->toBe($this->firstStorage->id)
+        ->and($backup->s3Storages()->pluck('s3_storages.id')->sort()->values()->all())
+        ->toBe([$this->firstStorage->id, $this->secondStorage->id]);
+});
+
+it('uploads the instance backup to every selected destination', function () {
+    $this->backup->forceFill(['save_s3' => true, 'databases_to_backup' => 'coolify'])->save();
+    $this->backup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
+    Process::fake(fn ($process) => Process::result(output: str_contains(implode(' ', (array) $process->command), 'du -b') ? '128' : ''));
+
+    $uploadedTo = collect();
+    $job = Mockery::mock(DatabaseBackupJob::class.'[upload_to_s3]', [$this->backup->fresh()])->shouldAllowMockingProtectedMethods();
+    $job->shouldReceive('upload_to_s3')->andReturnUsing(fn (S3Storage $storage) => $uploadedTo->push($storage->id));
+    $job->handle();
+
+    $execution = ScheduledDatabaseBackupExecution::query()->sole();
+
+    expect($uploadedTo->sort()->values()->all())->toBe([$this->firstStorage->id, $this->secondStorage->id])
+        ->and($execution->status)->toBe('success')
+        ->and($execution->s3_uploaded)->toBeTrue()
+        ->and($execution->s3Replicas()->where('s3_uploaded', true)->pluck('s3_storage_id')->sort()->values()->all())
+        ->toBe([$this->firstStorage->id, $this->secondStorage->id]);
+});
+
+it('links the instance backup from the storage resources page', function () {
+    $this->backup->forceFill(['save_s3' => true])->save();
+    $this->backup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
+
+    Livewire::test(StorageResources::class, ['storage' => $this->secondStorage])
+        ->assertSee('coolify-db')
+        ->assertSeeHtml(route('settings.backup'));
+});
diff --git a/tests/Feature/Jobs/DatabaseBackupJobTest.php b/tests/Feature/Jobs/DatabaseBackupJobTest.php
index a699a60eee..7bb4f6bca7 100644
--- a/tests/Feature/Jobs/DatabaseBackupJobTest.php
+++ b/tests/Feature/Jobs/DatabaseBackupJobTest.php
@@ -52,7 +52,7 @@ test('scheduled database backup casts full dump selection to boolean', function
         ->and((new ScheduledDatabaseBackup(['dump_all' => '1']))->dump_all)->toBeTrue();
 });
 
-test('upload_to_s3 throws exception and disables s3 when storage is null', function () {
+test('s3 upload throws exception and disables s3 when no destination exists', function () {
     $backup = ScheduledDatabaseBackup::create([
         'frequency' => '0 0 * * *',
         'save_s3' => true,
@@ -64,11 +64,7 @@ test('upload_to_s3 throws exception and disables s3 when storage is null', funct
 
     $job = new DatabaseBackupJob($backup);
 
-    $reflection = new ReflectionClass($job);
-    $s3Property = $reflection->getProperty('s3');
-    $s3Property->setValue($job, null);
-
-    $method = $reflection->getMethod('upload_to_s3');
+    $method = (new ReflectionClass($job))->getMethod('uploadToS3Destinations');
 
     expect(fn () => $method->invoke($job))
         ->toThrow(Exception::class, 'S3 storage configuration is missing or has been deleted');
@@ -78,7 +74,7 @@ test('upload_to_s3 throws exception and disables s3 when storage is null', funct
     expect($backup->s3_storage_id)->toBeNull();
 });
 
-test('upload_to_s3 exception message reports the previous s3 storage id', function () {
+test('s3 upload exception message reports the previous s3 storage id', function () {
     $backup = ScheduledDatabaseBackup::create([
         'frequency' => '0 0 * * *',
         'save_s3' => true,
@@ -90,10 +86,7 @@ test('upload_to_s3 exception message reports the previous s3 storage id', functi
 
     $job = new DatabaseBackupJob($backup);
 
-    $reflection = new ReflectionClass($job);
-    $reflection->getProperty('s3')->setValue($job, null);
-
-    expect(fn () => $reflection->getMethod('upload_to_s3')->invoke($job))
+    expect(fn () => (new ReflectionClass($job))->getMethod('uploadToS3Destinations')->invoke($job))
         ->toThrow(Exception::class, 'S3 storage ID: 12345');
 
     $backup->refresh();
@@ -101,7 +94,7 @@ test('upload_to_s3 exception message reports the previous s3 storage id', functi
     expect($backup->s3_storage_id)->toBeNull();
 });
 
-test('upload_to_s3 exception message reports null when no previous s3 storage id exists', function () {
+test('s3 upload exception message reports null when no previous s3 storage id exists', function () {
     $backup = ScheduledDatabaseBackup::create([
         'frequency' => '0 0 * * *',
         'save_s3' => true,
@@ -113,10 +106,7 @@ test('upload_to_s3 exception message reports null when no previous s3 storage id
 
     $job = new DatabaseBackupJob($backup);
 
-    $reflection = new ReflectionClass($job);
-    $reflection->getProperty('s3')->setValue($job, null);
-
-    expect(fn () => $reflection->getMethod('upload_to_s3')->invoke($job))
+    expect(fn () => (new ReflectionClass($job))->getMethod('uploadToS3Destinations')->invoke($job))
         ->toThrow(Exception::class, 'S3 storage ID: null');
 });
 
@@ -281,7 +271,7 @@ test('retention cleanup failure does not fail a successful database backup', fun
         'local_storage_deleted' => true,
         'created_at' => now()->subDay(),
     ]);
-    ScheduledDatabaseBackupExecution::create([
+    $newExecution = ScheduledDatabaseBackupExecution::create([
         'uuid' => 'new-backup',
         'database_name' => 'database',
         'filename' => '/backup/new.dmp',
@@ -290,6 +280,8 @@ test('retention cleanup failure does not fail a successful database backup', fun
         's3_uploaded' => true,
         'local_storage_deleted' => true,
     ]);
+    $oldExecution->s3Replicas()->create(['s3_storage_id' => $s3->id, 's3_uploaded' => true]);
+    $newExecution->s3Replicas()->create(['s3_storage_id' => $s3->id, 's3_uploaded' => true]);
     $disk = Mockery::mock();
     $disk->shouldReceive('delete')->once()->with(['/backup/old.dmp'])->andReturnFalse();
     Storage::shouldReceive('build')->once()->andReturn($disk);
diff --git a/tests/Feature/ListboxComponentTest.php b/tests/Feature/ListboxComponentTest.php
index 3e7f5dede3..9911562826 100644
--- a/tests/Feature/ListboxComponentTest.php
+++ b/tests/Feature/ListboxComponentTest.php
@@ -97,6 +97,24 @@ test('searchable listbox renders a search field with its placeholders', function
         ->toContain('No matching server');
 });
 
+test('searchable listbox with allowCustom offers the typed value as an option', function () {
+    $html = Blade::render(<<<'BLADE'
+        <x-forms.listbox id="path" :wire="false" searchable allowCustom :options="[['value' => 'Dockerfile', 'label' => 'Dockerfile']]" />
+    BLADE);
+
+    expect($html)
+        ->toContain('x-if="customOption"')
+        ->toContain('!customOption');
+});
+
+test('listbox without allowCustom offers no custom option', function () {
+    $html = Blade::render(<<<'BLADE'
+        <x-forms.listbox id="path" :wire="false" searchable :options="[['value' => 'Dockerfile', 'label' => 'Dockerfile']]" />
+    BLADE);
+
+    expect($html)->not->toContain('x-if="customOption"');
+});
+
 test('listbox without searchable renders no search field', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.listbox id="server" :wire="false" :options="[['value' => 1, 'label' => 'One']]" />
diff --git a/tests/Feature/Livewire/FileBrowserTest.php b/tests/Feature/Livewire/FileBrowserTest.php
new file mode 100644
index 0000000000..34698719d5
--- /dev/null
+++ b/tests/Feature/Livewire/FileBrowserTest.php
@@ -0,0 +1,770 @@
+<?php
+
+use App\Http\Controllers\FileBrowserDownloadController;
+use App\Jobs\PrepareFileDownloadJob;
+use App\Livewire\Project\Shared\FileBrowser;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\ContainerFilesystemService;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Process\Factory;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+use Illuminate\Support\Str;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    Storage::fake('ssh-keys');
+    InstanceSettings::forceCreate(['id' => 0]);
+    config(['constants.ssh.mux_enabled' => false]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+    $this->environment = $this->project->environments()->first();
+});
+
+it('blocks non-admin members from the file browser', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $application])
+        ->assertForbidden();
+});
+
+it('shows a stopped state when the container is not running', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'exited',
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $application])
+        ->assertSet('containerRunning', false)
+        ->assertSee('Start the container to browse its files');
+});
+
+it('loads the default directory in a deferred request for a running database', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/var/lib/postgresql'))   // defaultRoot inspect
+        ->push(Process::result(output: "dir\t0\t1\tdata\nfile\t10\t2\tpostgresql.conf"))]); // list
+
+    $database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->assertSet('containerRunning', true)
+        ->assertSet('currentPath', '/var/lib/postgresql')
+        ->assertSet('container', $database->uuid)
+        ->assertSee('data')
+        ->assertSee('postgresql.conf');
+});
+
+function fbRunningDatabase($environment, $destination): StandalonePostgresql
+{
+    return StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+it('creates a directory and re-lists', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                    // defaultRoot
+        ->push(Process::result(output: ''))                          // initial list (empty)
+        ->push(Process::result(output: ''))                          // mkdir
+        ->push(Process::result(output: "dir\t0\t1\tplugins"))]);     // re-list
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('createDirectory', 'plugins')
+        ->assertSee('plugins');
+});
+
+it('creates a file and re-lists', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                     // defaultRoot
+        ->push(Process::result(output: ''))                           // initial list (empty)
+        ->push(Process::result(output: ''))                           // createFile
+        ->push(Process::result(output: "file\t0\t1\t644\tconfig.yml"))]); // re-list
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('createFile', 'config.yml')
+        ->assertSee('config.yml');
+});
+
+it('changes permissions and re-lists', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                        // defaultRoot
+        ->push(Process::result(output: "file\t10\t1\t644\tapp.sh"))     // initial list
+        ->push(Process::result(output: ''))                             // chmod
+        ->push(Process::result(output: "file\t10\t1\t755\tapp.sh"))]);  // re-list
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->assertSee('644')
+        ->call('chmodEntry', 'app.sh', '755')
+        ->assertSee('755');
+});
+
+it('sets the editor language and content from the file when opening', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                       // defaultRoot
+        ->push(Process::result(output: "file\t12\t1\t644\tconfig.yml")) // initial list
+        ->push(Process::result(output: "OK\n".base64_encode("a: 1\n")))]); // single-round-trip read
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'config.yml')
+        ->assertSet('editorOpen', true)
+        ->assertSet('editorLanguage', 'yaml')
+        ->assertSet('editorContent', "a: 1\n")
+        ->assertDispatched('load-file-editor', content: "a: 1\n", language: 'yaml');
+});
+
+it('resolves a Monaco language for common extension-less files', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                      // defaultRoot
+        ->push(Process::result(output: "file\t12\t1\t644\tDockerfile")) // initial list
+        ->push(Process::result(output: "OK\n".base64_encode("FROM alpine\n")))]); // read
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'Dockerfile')
+        ->assertSet('editorLanguage', 'dockerfile');
+});
+
+it('refuses to open a binary or oversized file in the editor', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                     // defaultRoot
+        ->push(Process::result(output: "file\t99999999\t1\tbig.bin")) // initial list
+        ->push(Process::result(output: 'TOOBIG'))]);                 // single-round-trip read
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'big.bin')
+        ->assertSet('editingPath', null);
+});
+
+it('rejects client changes to container access state', function (string $property, mixed $value) {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))   // defaultRoot
+        ->push(Process::result(output: ''))]);      // initial list
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->set($property, $value);
+})->with([
+    ['container', 'someone-elses-container'],
+    ['type', 'service'],
+    ['containerRunning', false],
+    ['availableContainers', ['someone-elses-container']],
+])->throws(CannotUpdateLockedPropertyException::class);
+
+it('rechecks resource access before file operations', function (string $action, array $arguments) {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])->call('loadFiles');
+    $otherTeam = Team::factory()->create();
+    $this->project->update(['team_id' => $otherTeam->id]);
+    $component->call($action, ...$arguments)->assertForbidden();
+})->with([
+    ['open', ['folder']],
+    ['goTo', ['/data']],
+    ['refresh', []],
+    ['loadFiles', []],
+    ['selectContainer', ['unknown']],
+    ['saveEditor', []],
+    ['deleteEntry', ['config.yml']],
+    ['download', ['config.yml']],
+]);
+
+it('rejects a client attempt to replace the editor path', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->set('editingPath', '/etc/passwd');
+})->throws(CannotUpdateLockedPropertyException::class);
+
+it('rejects unsafe child names without deleting the current folder', function (string $name) {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('deleteEntry', $name)
+        ->assertDispatched('error');
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'rm -rf'));
+})->with(['', '.', '..', '../data', 'a/b', 'a\\b']);
+
+it('saves the opened file and clears editor state', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: "OK\n".base64_encode('before')))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: ''))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', "it's.txt")
+        ->set('editorContent', 'after')
+        ->call('saveEditor')
+        ->assertSet('editingPath', null)
+        ->assertSet('editorOpen', false)
+        ->assertSet('editorContent', '')
+        ->assertDispatched('success', 'Saved.');
+});
+
+it('clears the editor when selecting a container', function () {
+    Process::fake(['*' => Process::result(output: 'OK')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'config.yml')
+        ->assertSet('editorOpen', true)
+        ->call('selectContainer', $database->uuid)
+        ->assertSet('editingPath', null)
+        ->assertSet('editorOpen', false);
+});
+
+it('renames and deletes files with apostrophes', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('renameEntry', "it's.txt", "that's.txt")
+        ->assertDispatched('success', 'Renamed.')
+        ->call('deleteEntry', "that's.txt")
+        ->assertDispatched('success', 'Deleted.');
+});
+
+it('uploads a file and clears the upload state', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->set('upload', UploadedFile::fake()->create("it's.txt", 1, 'text/plain'))
+        ->call('uploadFile')
+        ->assertSet('upload', null)
+        ->assertDispatched('success', 'Uploaded.');
+});
+
+it('issues a one-time download token and redirects to the streaming route', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'dir 4'))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'folder')
+        ->assertRedirectContains('/files/download/');
+
+    $token = Str::afterLast($component->effects['redirect'], '/');
+    expect(Cache::get(FileBrowserDownloadController::cacheKey($token)))->toMatchArray([
+        'user_id' => $this->admin->id,
+        'container' => $database->uuid,
+        'path' => '/data/folder',
+        'name' => 'folder.tar.gz',
+        'is_dir' => true,
+    ]);
+});
+
+it('refuses downloads above the size cap', function () {
+    $overCapKb = intdiv(ContainerFilesystemService::MAX_DOWNLOAD_SIZE, 1024) + 1;
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: "dir {$overCapKb}"))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'folder')
+        ->assertNoRedirect()
+        ->assertDispatched('error');
+});
+
+it('only lets the token owner use a download token, and only once', function () {
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $download = [
+        'user_id' => $this->admin->id,
+        'resource_type' => $database::class,
+        'resource_id' => $database->id,
+        'server_id' => $this->server->id,
+        'container' => $database->uuid,
+        'path' => '/data/a.txt',
+        'name' => 'a.txt',
+        'is_dir' => false,
+    ];
+    $otherAdmin = User::factory()->create();
+    $otherAdmin->teams()->attach($this->team, ['role' => 'admin']);
+
+    Cache::put(FileBrowserDownloadController::cacheKey('token-a'), $download, 60);
+    $this->actingAs($otherAdmin)->withSession(['currentTeam' => $this->team])
+        ->get(route('project.files.download', 'token-a'))
+        ->assertNotFound();
+    expect(Cache::has(FileBrowserDownloadController::cacheKey('token-a')))->toBeFalse();
+
+    $this->actingAs($this->admin)->withSession(['currentTeam' => $this->team])
+        ->get(route('project.files.download', 'unknown'))
+        ->assertNotFound();
+});
+
+it('blocks members from the download route', function () {
+    $this->actingAs($this->member)->withSession(['currentTeam' => $this->team])
+        ->get(route('project.files.download', 'any'))
+        ->assertForbidden();
+});
+
+it('denies resources outside the current team even when the user belongs to both teams', function () {
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $otherTeam = Team::factory()->create();
+    $this->member->teams()->attach($otherTeam, ['role' => 'admin']);
+    $this->actingAs($this->member);
+    session(['currentTeam' => $otherTeam]);
+    Process::fake();
+    Livewire::test(FileBrowser::class, ['resource' => $database])->assertForbidden();
+    Process::assertNothingRan();
+});
+
+it('does not use a container that stopped after mounting', function (string $action, array $arguments) {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])->call('loadFiles');
+    $database->update(['status' => 'exited']);
+    $component->call($action, ...$arguments);
+})->with([
+    ['open', ['folder']],
+    ['goTo', ['/data']],
+    ['refresh', []],
+])->throws(RuntimeException::class, 'Container is not running.');
+
+it('lists files for a running application and excludes stopped and preview containers', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+    $containers = collect([
+        ['ID' => 'base', 'Names' => 'app-base', 'State' => 'running', 'Labels' => 'coolify.pullRequestId=0'],
+        ['ID' => 'stopped', 'Names' => 'app-stopped', 'State' => 'exited', 'Labels' => 'coolify.pullRequestId=0'],
+        ['ID' => 'preview', 'Names' => 'app-preview', 'State' => 'running', 'Labels' => 'coolify.pullRequestId=42'],
+    ])->map(fn ($container) => json_encode($container))->implode("\n");
+    Process::fake(function ($process) use ($containers) {
+        $output = match (true) {
+            str_contains($process->command, 'docker ps') => $containers,
+            str_contains($process->command, 'docker inspect') => '/app',
+            default => "file\t12\t1\t644\tconfig.yml",
+        };
+
+        return Process::result(output: $output);
+    });
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $application])
+        ->call('loadFiles')
+        ->assertSet('availableContainers', ['app-base'])
+        ->assertSet('container', 'app-base')
+        ->assertSet('currentPath', '/app')
+        ->assertSee('config.yml')
+        ->call('refresh')
+        ->assertSet('container', 'app-base')
+        ->assertSee('config.yml');
+});
+
+it('renders before SSH starts and loads files in a later request', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: "file\t0\t1\t644\tconfig.yml"))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database]);
+    Process::assertNothingRan();
+    $component->assertSet('filesLoaded', false)
+        ->assertSet('container', null)
+        ->call('loadFiles')
+        ->assertSet('filesLoaded', true)
+        ->assertSet('currentPath', '/data')
+        ->assertSee('config.yml');
+});
+
+it('does not start SSH if the resource stops before deferred loading', function () {
+    Process::fake();
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database]);
+    $database->update(['status' => 'exited']);
+
+    $component->call('loadFiles')
+        ->assertSet('filesLoaded', true)
+        ->assertSet('containerRunning', false);
+    Process::assertNothingRan();
+});
+
+it('allows retrying a failed initial container lookup', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+    $fail = true;
+    Process::fake(function ($process) use (&$fail) {
+        if (str_contains($process->command, 'docker ps')) {
+            if ($fail) {
+                $fail = false;
+
+                return Process::result(errorOutput: 'Permission denied', exitCode: 1);
+            }
+
+            return Process::result(output: json_encode([
+                'ID' => 'base', 'Names' => 'app-base', 'State' => 'running', 'Labels' => '',
+            ]));
+        }
+
+        return Process::result(output: str_contains($process->command, 'docker inspect') ? '/app' : '');
+    });
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $application])
+        ->call('loadFiles')
+        ->assertSet('filesLoaded', false)
+        ->assertSet('loadFailed', true)
+        ->assertSet('container', null)
+        ->call('loadFiles')
+        ->assertSet('filesLoaded', true)
+        ->assertSet('loadFailed', false)
+        ->assertSet('container', 'app-base');
+});
+
+function fbConfigureDownloadStorage(): S3Storage
+{
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::create([
+        'name' => 'Downloads',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'downloads',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => 0,
+    ]);
+    InstanceSettings::find(0)->update(['file_download_s3_storage_id' => $storage->id]);
+    Once::flush();
+
+    return $storage;
+}
+
+it('queues an S3 upload instead of streaming when download storage is set', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    $storage = fbConfigureDownloadStorage();
+    $overStreamCapKb = intdiv(ContainerFilesystemService::MAX_DOWNLOAD_SIZE, 1024) + 1;
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: "dir {$overStreamCapKb}"))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'folder')
+        ->assertNoRedirect()
+        ->assertDispatched('info');
+
+    expect($component->get('pendingDownloads'))->toHaveCount(1);
+    Bus::assertDispatched(PrepareFileDownloadJob::class, fn (PrepareFileDownloadJob $job) => $job->downloadId === $component->get('pendingDownloads')[0]
+        && $job->userId === $this->admin->id
+        && $job->path === '/data/folder'
+        && $job->isDir
+        && $job->downloadName === 'folder.tar.gz'
+        && $job->s3StorageId === $storage->id);
+});
+
+it('refuses S3 downloads above the S3 size cap', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    fbConfigureDownloadStorage();
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'file '.(FileDownloadStorageService::MAX_SIZE + 1)))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'big.bin')
+        ->assertDispatched('error');
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('opens a finished S3 download once and ignores entries of other users', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    fbConfigureDownloadStorage();
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'file 10'))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'a.txt');
+    $downloadId = $component->get('pendingDownloads')[0];
+    $cacheKey = PrepareFileDownloadJob::cacheKey($downloadId);
+
+    Cache::put($cacheKey, ['user_id' => $this->member->id, 'status' => 'ready', 'url' => 'https://s3.example.com/other'], 60);
+    $component->call('checkDownloads')
+        ->assertNotDispatched('open-file-download')
+        ->assertSet('pendingDownloads', [$downloadId]);
+
+    Cache::put($cacheKey, ['user_id' => $this->admin->id, 'status' => 'ready', 'url' => 'https://s3.example.com/get'], 60);
+    $component->call('checkDownloads')
+        ->assertDispatched('open-file-download', url: 'https://s3.example.com/get')
+        ->assertSet('pendingDownloads', []);
+    expect(Cache::has($cacheKey))->toBeFalse();
+});
+
+it('does not hand out S3 links after the user lost access to the resource', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    fbConfigureDownloadStorage();
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'file 10'))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'a.txt');
+    Cache::put(PrepareFileDownloadJob::cacheKey($component->get('pendingDownloads')[0]), ['user_id' => $this->admin->id, 'status' => 'ready', 'url' => 'https://s3.example.com/get'], 60);
+
+    $this->project->update(['team_id' => Team::factory()->create()->id]);
+
+    $component->call('checkDownloads')
+        ->assertForbidden()
+        ->assertNotDispatched('open-file-download');
+});
+
+it('limits how many S3 downloads a user can start', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    fbConfigureDownloadStorage();
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'file 10'))
+        ->push(Process::result(output: 'file 10'))
+        ->push(Process::result(output: 'file 10'))
+        ->push(Process::result(output: 'file 10'))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])->call('loadFiles');
+
+    foreach (range(1, 4) as $attempt) {
+        $component->call('download', 'a.txt');
+    }
+
+    expect($component->get('pendingDownloads'))->toHaveCount(3);
+    Bus::assertDispatchedTimes(PrepareFileDownloadJob::class, 3);
+    $component->assertDispatched('error', 'Too many downloads are in progress. Wait for them to finish, then try again.');
+});
+
+it('blocks navigation before a container is selected', function (string $action, array $arguments) {
+    Process::fake();
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database]);
+
+    expect(fn () => $component->call($action, ...$arguments))
+        ->toThrow(RuntimeException::class, 'Container is not running.');
+    expect($component->instance()->currentPath)->toBe('');
+    Process::assertNothingRan();
+})->with([
+    ['open', ['folder']],
+    ['goTo', ['/data']],
+    ['refresh', []],
+]);
+
+it('reduces upload names to one filename component', function (string $name, string $expected) {
+    $component = new FileBrowser;
+    $sanitize = new ReflectionMethod(FileBrowser::class, 'sanitizeUploadName');
+
+    expect($sanitize->invoke($component, $name))->toBe($expected);
+})->with([
+    ['../../etc/cron.d/payload', 'payload'],
+    ['..\\..\\etc\\cron.d\\payload', 'payload'],
+    ['../nested\\folder/payload', 'payload'],
+    ["it's.txt", "it's.txt"],
+    ['.env', '.env'],
+    ['my file.txt', 'my file.txt'],
+]);
+
+it('rejects empty and all-dot upload names', function (string $name) {
+    $component = new FileBrowser;
+    $sanitize = new ReflectionMethod(FileBrowser::class, 'sanitizeUploadName');
+
+    expect(fn () => $sanitize->invoke($component, $name))
+        ->toThrow(RuntimeException::class, 'Invalid file name.');
+})->with(['', '/', '\\', '.', '..', '...', '../..', '..\\..']);
+
+it('refuses to save an opened file after its container identity changes', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: "OK\n".base64_encode('before')))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'config.yml')
+        ->set('editorContent', 'after');
+
+    $database->update(['uuid' => (string) Str::uuid()]);
+    Process::swap(new Factory);
+    Process::fake();
+
+    expect(fn () => $component->call('saveEditor'))
+        ->toThrow(RuntimeException::class, 'Container is not running.');
+    expect($component->instance()->editingPath)->toBe('/data/config.yml');
+    Process::assertNothingRan();
+});
diff --git a/tests/Feature/Livewire/Fleet/MetricsChartPayloadTest.php b/tests/Feature/Livewire/Fleet/MetricsChartPayloadTest.php
new file mode 100644
index 0000000000..130b4c5ebe
--- /dev/null
+++ b/tests/Feature/Livewire/Fleet/MetricsChartPayloadTest.php
@@ -0,0 +1,133 @@
+<?php
+
+use App\Livewire\Fleet\Metrics;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\SentinelMetricsClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Concurrency;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+class ChartStubClient extends SentinelMetricsClient
+{
+    public function summary(): ?array
+    {
+        return ['online' => true, 'cpu' => 10.0, 'memUsed' => 1, 'memTotal' => 2,
+            'diskUsed' => 1, 'diskTotal' => 2, 'diskPercent' => 50.0, 'load1' => 0.1, 'netRx' => 0.0, 'netTx' => 0.0];
+    }
+
+    public function containersCurrent(): array
+    {
+        return [];
+    }
+
+    public function history(string $metric, string $range): array
+    {
+        return [[1000, 10.0], [2000, 20.0]];
+    }
+
+    public function networkHistory(string $range): array
+    {
+        return ['rx' => [[1000, 5.0]], 'tx' => [[1000, 1.0]]];
+    }
+}
+
+class ChartTestableMetrics extends Metrics
+{
+    protected function metricsClient(Server $server): SentinelMetricsClient
+    {
+        return new ChartStubClient($server);
+    }
+}
+
+class DenseChartStubClient extends ChartStubClient
+{
+    public function history(string $metric, string $range): array
+    {
+        // 300 points, like a downsampled 24h host series.
+        return array_map(fn ($i) => [$i * 1000, (float) $i], range(1, 300));
+    }
+}
+
+class DenseTestableMetrics extends Metrics
+{
+    protected function metricsClient(Server $server): SentinelMetricsClient
+    {
+        return new DenseChartStubClient($server);
+    }
+}
+
+beforeEach(function () {
+    // The settings hook starts Sentinel when metrics turn on. A sync queue would run it and make a real SSH call.
+    Queue::fake();
+    Concurrency::setDefaultInstance('sync');
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+    $user = User::factory()->create();
+    $team = Team::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+    $this->privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    $this->team = $team;
+});
+
+it('dispatches a chart payload with every trend series', function () {
+    $s = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
+    $s->settings->update(['is_metrics_enabled' => true]);
+
+    Livewire::test(ChartTestableMetrics::class)
+        ->call('loadData')
+        ->assertDispatched('refreshChartData-fleet-metrics', function ($event, $params) {
+            $payload = $params[0];
+
+            // Livewire JSON-serializes event params, so whole floats arrive as ints;
+            // compare loosely (10 == 10.0).
+            return $payload['cpu'] == [[1000, 10], [2000, 20]]
+                && $payload['networkRx'] == [[1000, 5]]
+                && array_key_exists('load', $payload);
+        });
+});
+
+it('includes KPI-tile spark series aligned to one shared time axis', function () {
+    $s = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
+    $s->settings->update(['is_metrics_enabled' => true]);
+
+    Livewire::test(ChartTestableMetrics::class)
+        ->call('loadData')
+        ->assertDispatched('refreshChartData-fleet-metrics', function ($event, $params) {
+            $payload = $params[0];
+
+            // Union of every series' buckets, sorted; each spark projects onto it,
+            // leaving gaps as null (network only has the 1000 bucket → tail is null).
+            return $payload['sparkCategories'] == [1000, 2000]
+                && $payload['cpuSpark'] == [10, 20]
+                && $payload['memSpark'] == [10, 20]
+                && $payload['diskSpark'] == [10, 20]
+                && $payload['netSpark'] === [6, null];
+        });
+});
+
+it('caps KPI-tile sparks to a readable point count on a shared axis', function () {
+    $s = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
+    $s->settings->update(['is_metrics_enabled' => true]);
+
+    Livewire::test(DenseTestableMetrics::class)
+        ->call('loadData')
+        ->assertDispatched('refreshChartData-fleet-metrics', function ($event, $params) {
+            $payload = $params[0];
+
+            // Dense trend charts keep their detail; sparks are thinned to <= 40 points,
+            // and every spark shares the same length as the axis (grouped-comparable).
+            return count($payload['cpu']) === 300
+                && count($payload['sparkCategories']) <= 40
+                && count($payload['cpuSpark']) === count($payload['sparkCategories'])
+                && count($payload['memSpark']) === count($payload['sparkCategories'])
+                && count($payload['netSpark']) === count($payload['sparkCategories']);
+        });
+});
diff --git a/tests/Feature/Livewire/Fleet/MetricsDataTest.php b/tests/Feature/Livewire/Fleet/MetricsDataTest.php
new file mode 100644
index 0000000000..90693900af
--- /dev/null
+++ b/tests/Feature/Livewire/Fleet/MetricsDataTest.php
@@ -0,0 +1,449 @@
+<?php
+
+use App\Actions\Server\StartSentinel;
+use App\Livewire\Fleet\Metrics;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\ServerSetting;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\SentinelMetricsClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Concurrency;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+use Tests\Support\ConcurrentMetricsClient;
+
+uses(RefreshDatabase::class);
+
+class StubMetricsClient extends SentinelMetricsClient
+{
+    /** @var array<string, ?array> serverUuid => summary */
+    public static array $summaries = [];
+
+    /** @var array<string, array> serverUuid => containers */
+    public static array $containers = [];
+
+    public static array $histories = [];
+
+    public static array $failingMetrics = [];
+
+    public function summary(): ?array
+    {
+        return self::$summaries[$this->server->uuid] ?? null;
+    }
+
+    public function containersCurrent(): array
+    {
+        return self::$containers[$this->server->uuid] ?? [];
+    }
+
+    public function history(string $metric, string $range): array
+    {
+        if (in_array($metric, self::$failingMetrics, true)) {
+            throw new RuntimeException('metric unavailable');
+        }
+
+        return self::$histories[$this->server->uuid][$metric] ?? [];
+    }
+
+    public function networkHistory(string $range): array
+    {
+        return ['rx' => [], 'tx' => []];
+    }
+}
+
+class TestableMetrics extends Metrics
+{
+    protected function metricsClient(Server $server): SentinelMetricsClient
+    {
+        return new StubMetricsClient($server);
+    }
+}
+
+class ProcessTestableMetrics extends Metrics
+{
+    protected function metricsClient(Server $server): SentinelMetricsClient
+    {
+        return new ConcurrentMetricsClient($server);
+    }
+}
+
+beforeEach(function () {
+    // The settings hook starts Sentinel when metrics turn on. A sync queue would run it and make a real SSH call.
+    Queue::fake();
+    Concurrency::setDefaultInstance('sync');
+    StubMetricsClient::$summaries = [];
+    StubMetricsClient::$containers = [];
+    StubMetricsClient::$histories = [];
+    StubMetricsClient::$failingMetrics = [];
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+    $user = User::factory()->create();
+    $team = Team::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+    $this->privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    $this->team = $team;
+});
+
+function metricsServer($team, $privateKey): Server
+{
+    $server = Server::factory()->create(['team_id' => $team->id, 'private_key_id' => $privateKey->id]);
+    $server->settings->update(['is_metrics_enabled' => true]);
+
+    return $server;
+}
+
+function onlineSummary(array $overrides = []): array
+{
+    return array_merge([
+        'online' => true, 'cpu' => 30.0, 'memUsed' => 100, 'memTotal' => 200,
+        'diskUsed' => 10, 'diskTotal' => 100, 'diskPercent' => 10.0,
+        'load1' => 0.4, 'netRx' => 5.0, 'netTx' => 1.0,
+    ], $overrides);
+}
+
+it('keeps an unreachable server in the table but excludes it from KPIs', function () {
+    $ok = metricsServer($this->team, $this->privateKey);
+    $dead = metricsServer($this->team, $this->privateKey);
+
+    StubMetricsClient::$summaries = [
+        $ok->uuid => onlineSummary(['cpu' => 30.0]),
+        $dead->uuid => null,
+    ];
+
+    $component = Livewire::test(TestableMetrics::class);
+
+    expect($component->get('serverRows'))->toHaveCount(2);
+
+    $deadRow = collect($component->get('serverRows'))->firstWhere('uuid', $dead->uuid);
+    expect($deadRow['online'])->toBeFalse();
+    expect($deadRow['cpu'])->toBeNull();
+
+    expect($component->get('kpis')['serversOnline'])->toBe(1);
+    expect($component->get('kpis')['cpuAvg'])->toBe(30.0);
+});
+
+it('ranks containers across servers by the selected metric', function () {
+    $s = metricsServer($this->team, $this->privateKey);
+
+    StubMetricsClient::$summaries = [$s->uuid => onlineSummary(['diskPercent' => 50.0])];
+    StubMetricsClient::$containers = [$s->uuid => [
+        ['id' => 'low', 'cpu' => 5.0, 'memUsed' => 10, 'memPercent' => 1.0, 'diskBytes' => 1, 'net' => 0.0],
+        ['id' => 'high', 'cpu' => 88.0, 'memUsed' => 20, 'memPercent' => 2.0, 'diskBytes' => 2, 'net' => 0.0],
+    ]];
+
+    $component = Livewire::test(TestableMetrics::class);
+
+    expect(array_column($component->get('topContainers'), 'id')[0])->toBe('high');
+});
+
+it('shows the KPI tiles, a stale badge for offline servers, and the container toggle', function () {
+    $ok = metricsServer($this->team, $this->privateKey);
+    $ok->update(['name' => 'web-1']);
+    $dead = metricsServer($this->team, $this->privateKey);
+    $dead->update(['name' => 'web-2']);
+
+    StubMetricsClient::$summaries = [
+        $ok->uuid => onlineSummary(['cpu' => 95.0, 'diskPercent' => 95.0]),
+        $dead->uuid => null,
+    ];
+
+    Livewire::test(TestableMetrics::class)
+        ->assertSee('web-1')
+        ->assertSee('web-2')
+        ->assertSee('Fleet CPU')
+        ->assertSee('healthy')
+        ->assertSee('attention')
+        ->assertSee('Offline');
+});
+
+it('re-ranks containers on metric switch without re-fetching', function () {
+    $s = metricsServer($this->team, $this->privateKey);
+
+    StubMetricsClient::$summaries = [$s->uuid => onlineSummary()];
+    StubMetricsClient::$containers = [$s->uuid => [
+        ['id' => 'a', 'cpu' => 5.0, 'memUsed' => 900, 'memPercent' => 9.0, 'diskBytes' => 1, 'net' => 0.0],
+        ['id' => 'b', 'cpu' => 90.0, 'memUsed' => 100, 'memPercent' => 1.0, 'diskBytes' => 9, 'net' => 0.0],
+    ]];
+
+    $component = Livewire::test(TestableMetrics::class);
+    expect(array_column($component->get('topContainers'), 'id')[0])->toBe('b'); // cpu
+
+    // Empty the stub so a re-fetch would change nothing/ break; the re-rank must use cached rows.
+    StubMetricsClient::$containers = [];
+    $component->set('containerMetric', 'memory');
+
+    expect(array_column($component->get('topContainers'), 'id')[0])->toBe('a'); // memory, still ranked
+});
+
+it('cannot see another team’s servers', function () {
+    $otherTeam = Team::factory()->create();
+    // Reuse the existing key id: the factory's private key is hardcoded, so a second
+    // PrivateKey::create collides on fingerprint. Only the server's team_id matters here.
+    $server = Server::factory()->create(['team_id' => $otherTeam->id, 'private_key_id' => $this->privateKey->id]);
+    $server->settings->update(['is_metrics_enabled' => true]);
+
+    $component = Livewire::test(TestableMetrics::class);
+
+    expect($component->get('serverRows'))->toHaveCount(0);
+});
+
+it('drops the "Fleet" tile prefix when scoped to a single server', function () {
+    $s = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$s->uuid => onlineSummary()];
+
+    Livewire::test(TestableMetrics::class)
+        ->assertSee('Fleet CPU')
+        ->set('serverUuid', $s->uuid)
+        ->assertDontSee('Fleet')
+        ->assertSee('for the selected server');
+});
+
+it('renders container metric values without leaking a blade directive', function () {
+    $s = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$s->uuid => onlineSummary()];
+    StubMetricsClient::$containers = [$s->uuid => [
+        ['id' => 'a', 'cpu' => 5.0, 'memUsed' => 900, 'memPercent' => 9.0, 'diskBytes' => 1, 'net' => 2048.0],
+    ]];
+
+    Livewire::test(TestableMetrics::class)
+        ->set('containerMetric', 'network')
+        ->assertDontSee('@break')
+        ->assertSee('/s');
+});
+
+it('falls back to cpu for an unknown container metric', function () {
+    $s = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$s->uuid => onlineSummary()];
+    StubMetricsClient::$containers = [$s->uuid => [
+        ['id' => 'a', 'cpu' => 5.0, 'memUsed' => 900, 'memPercent' => 9.0, 'diskBytes' => 1, 'net' => 0.0],
+    ]];
+
+    Livewire::withQueryParams(['cmetric' => 'foo'])
+        ->test(TestableMetrics::class)
+        ->assertOk()
+        ->assertSet('containerMetric', 'cpu')
+        ->set('containerMetric', 'bar')
+        ->assertSet('containerMetric', 'cpu');
+});
+
+it('keys container rows by server so shared container ids do not collide', function () {
+    $one = metricsServer($this->team, $this->privateKey);
+    $two = metricsServer($this->team, $this->privateKey);
+    $proxy = ['id' => 'coolify-proxy', 'cpu' => 1.0, 'memUsed' => 10, 'memPercent' => 1.0, 'diskBytes' => 1, 'net' => 0.0];
+
+    StubMetricsClient::$summaries = [$one->uuid => onlineSummary(), $two->uuid => onlineSummary()];
+    StubMetricsClient::$containers = [$one->uuid => [$proxy], $two->uuid => [$proxy]];
+
+    Livewire::test(TestableMetrics::class)
+        ->assertSeeHtml('wire:key="fleet-container-'.$one->uuid.'-coolify-proxy"')
+        ->assertSeeHtml('wire:key="fleet-container-'.$two->uuid.'-coolify-proxy"');
+});
+
+it('passes the spark time axis to the KPI sparklines on first paint', function () {
+    $s = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$s->uuid => onlineSummary()];
+
+    $component = Livewire::test(TestableMetrics::class);
+    $component->set('chartData', ['sparkCategories' => [1700000100000], 'cpuSpark' => [12.5]]);
+
+    $component->assertSeeHtml('1700000100000');
+});
+
+it('removes a transferred server on refresh', function () {
+    $server = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$server->uuid => onlineSummary()];
+    $component = Livewire::test(TestableMetrics::class);
+    expect($component->get('serverRows'))->toHaveCount(1);
+
+    $server->update(['team_id' => Team::factory()->create()->id]);
+    $component->call('loadData');
+
+    expect($component->get('serverRows'))->toBe([]);
+    expect($component->get('containersRaw'))->toBe([]);
+    expect($component->get('kpis')['serversTotal'])->toBe(0);
+});
+
+it('permits team members to read metrics', function () {
+    $server = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$server->uuid => onlineSummary()];
+    $member = User::factory()->create();
+    $member->teams()->attach($this->team, ['role' => 'member']);
+    $this->actingAs($member);
+
+    expect(Livewire::test(TestableMetrics::class)->get('kpis')['serversOnline'])->toBe(1);
+});
+
+it('keeps host trends when an older Sentinel has no summary endpoint', function () {
+    $server = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$histories = [$server->uuid => ['cpu' => [[1000, 25.0]], 'memory' => [[1000, 100.0]]]];
+
+    $component = Livewire::test(TestableMetrics::class);
+
+    expect($component->get('chartData')['cpu'])->toBe([[1000, 25.0]]);
+    expect($component->get('chartData')['memory'])->toBe([[1000, 100.0]]);
+    expect($component->get('topContainers'))->toBe([]);
+});
+
+it('keeps other metrics when one independent operation fails', function () {
+    $server = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$server->uuid => onlineSummary()];
+    StubMetricsClient::$histories = [$server->uuid => ['cpu' => [[1000, 25.0]]]];
+    StubMetricsClient::$failingMetrics = ['disk'];
+
+    $component = Livewire::test(TestableMetrics::class);
+
+    expect($component->get('chartData')['cpu'])->toBe([[1000, 25.0]]);
+    expect($component->get('chartData')['disk'])->toBe([]);
+    expect($component->get('kpis')['serversOnline'])->toBe(1);
+});
+
+it('resolves container names for the instance team with id zero', function () {
+    $rootTeam = Team::factory()->create(['id' => 0]);
+    auth()->user()->teams()->attach($rootTeam, ['role' => 'owner']);
+    auth()->user()->unsetRelation('teams');
+    session(['currentTeam' => $rootTeam]);
+    $project = Project::factory()->create(['team_id' => 0]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+
+    $meta = Livewire::test(TestableMetrics::class)->instance()->containerMeta($application->uuid);
+
+    expect($meta['name'])->toBe($application->name);
+    expect($meta['link'])->toContain($application->uuid);
+});
+
+it('denies metrics refresh after team membership is removed', function () {
+    $this->withoutVite();
+    $server = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$server->uuid => onlineSummary()];
+    $component = Livewire::test(TestableMetrics::class);
+
+    auth()->user()->teams()->detach($this->team);
+    auth()->user()->unsetRelation('teams');
+
+    $component->call('loadData')->assertForbidden();
+});
+
+it('clears stale container rankings after a server transfer', function () {
+    $server = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$server->uuid => onlineSummary()];
+    StubMetricsClient::$containers = [$server->uuid => [['id' => 'private-container', 'cpu' => 10]]];
+    $component = Livewire::test(TestableMetrics::class);
+
+    $server->update(['team_id' => Team::factory()->create()->id]);
+    $component->set('containerMetric', 'memory');
+
+    expect($component->get('topContainers'))->toBe([]);
+    expect($component->get('serverRows'))->toBe([]);
+});
+
+it('merges metrics from real concurrent workers and isolates endpoint failures', function () {
+    Concurrency::setDefaultInstance('process');
+    metricsServer($this->team, $this->privateKey);
+    metricsServer($this->team, $this->privateKey);
+
+    $component = Livewire::test(ProcessTestableMetrics::class);
+
+    expect($component->get('kpis')['serversOnline'])->toBe(2);
+    expect($component->get('topContainers'))->toHaveCount(2);
+    expect($component->get('chartData')['cpu'])->toBe([[1000, 25.0]]);
+    expect($component->get('chartData')['memory'])->toBe([[1000, 200.0]]);
+    expect($component->get('chartData')['disk'])->toBe([]);
+    expect($component->get('chartData')['networkRx'])->toBe([[1000, 10.0]]);
+});
+
+it('clears stale metrics after the last server is deleted', function () {
+    $server = metricsServer($this->team, $this->privateKey);
+    StubMetricsClient::$summaries = [$server->uuid => onlineSummary()];
+    StubMetricsClient::$containers = [$server->uuid => [['id' => 'deleted-container', 'cpu' => 10]]];
+    $component = Livewire::test(TestableMetrics::class);
+
+    $server->delete();
+    $component->set('containerMetric', 'memory');
+
+    expect($component->get('topContainers'))->toBe([]);
+    expect($component->get('serverRows'))->toBe([]);
+});
+
+it('repairs the Sentinel token before creating worker clients', function () {
+    $server = metricsServer($this->team, $this->privateKey);
+    $server->settings->updateQuietly(['sentinel_token' => 'invalid token']);
+    app()->bind(SentinelMetricsClient::class, fn ($app, $parameters) => new ConcurrentMetricsClient($parameters['server']));
+
+    loadLazy(Livewire::test(Metrics::class));
+
+    $token = $server->settings->fresh()->sentinel_token;
+    expect(ServerSetting::isValidSentinelToken($token))->toBeTrue();
+    expect($token)->not->toBe('invalid token');
+});
+
+/** A server that Coolify can reach, with metrics off. */
+function reachableServerWithoutMetrics(int $teamId, PrivateKey $privateKey): Server
+{
+    $server = Server::factory()->create(['team_id' => $teamId, 'private_key_id' => $privateKey->id]);
+    $server->settings->forceFill(['is_reachable' => true, 'is_usable' => true])->saveQuietly();
+
+    return $server;
+}
+
+it('enables metrics on each eligible server of the team from the empty state', function () {
+    $first = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $second = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $build = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $build->settings->update(['server_role' => 'build', 'is_build_server' => true]);
+    $unreachable = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
+    $foreign = reachableServerWithoutMetrics(Team::factory()->create()->id, $this->privateKey);
+
+    $component = Livewire::test(TestableMetrics::class)
+        ->assertSee('Enable metrics on 2 servers')
+        ->call('enableMetrics');
+
+    expect($first->settings->fresh()->is_metrics_enabled)->toBeTruthy();
+    expect($second->settings->fresh()->is_metrics_enabled)->toBeTruthy();
+    expect($build->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    expect($unreachable->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    expect($foreign->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    StartSentinel::assertPushed(2);
+
+    expect(array_column($component->get('serverRows'), 'uuid'))->toEqualCanonicalizing([$first->uuid, $second->uuid]);
+    $component->assertDontSee('No server metrics yet');
+});
+
+it('keeps enabling metrics on the other servers when one server fails', function () {
+    $broken = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $healthy = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    DB::statement("CREATE TRIGGER fail_settings_update BEFORE UPDATE ON server_settings WHEN NEW.server_id = {$broken->id} BEGIN SELECT RAISE(ABORT, 'write failed'); END");
+
+    Livewire::test(TestableMetrics::class)
+        ->call('enableMetrics')
+        ->assertDispatched('success', fn (string $event, array $params) => str_contains($params[0], 'Metrics enabled on 1 server.'))
+        ->assertDispatched('error', fn (string $event, array $params) => str_contains($params[0], $broken->name));
+
+    expect($broken->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    expect($healthy->settings->fresh()->is_metrics_enabled)->toBeTruthy();
+    StartSentinel::assertPushed(1);
+});
+
+it('does not let a team member enable metrics', function () {
+    $server = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $member = User::factory()->create();
+    $member->teams()->attach($this->team, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(TestableMetrics::class)
+        ->assertSee('No server metrics yet')
+        ->assertDontSee('Enable metrics on '.$server->name)
+        ->call('enableMetrics');
+
+    expect($server->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    StartSentinel::assertNotPushed();
+});
diff --git a/tests/Feature/Livewire/Fleet/MetricsPageTest.php b/tests/Feature/Livewire/Fleet/MetricsPageTest.php
new file mode 100644
index 0000000000..ad44bf6d72
--- /dev/null
+++ b/tests/Feature/Livewire/Fleet/MetricsPageTest.php
@@ -0,0 +1,33 @@
+<?php
+
+use App\Livewire\Fleet\Metrics;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+    $user = User::factory()->create();
+    $team = Team::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+    $this->team = $team;
+});
+
+it('renders the metrics page with an empty state when no server has metrics enabled', function () {
+    $component = loadLazy(Livewire::test(Metrics::class));
+
+    $component
+        ->assertOk()
+        ->assertSee('Metrics')
+        ->assertSee('Enable metrics on a server');
+});
+
+it('registers the metrics route', function () {
+    expect(route('metrics'))->toEndWith('/metrics');
+});
diff --git a/tests/Feature/Livewire/ServerTransferUiTest.php b/tests/Feature/Livewire/ServerTransferUiTest.php
index 31be7a217d..614e92de9f 100644
--- a/tests/Feature/Livewire/ServerTransferUiTest.php
+++ b/tests/Feature/Livewire/ServerTransferUiTest.php
@@ -1,26 +1,47 @@
 <?php
 
+use App\Actions\Server\DeleteServer;
+use App\Jobs\DeleteResourceJob;
+use App\Jobs\MigrateServerToInstanceJob;
+use App\Jobs\ReleaseManagedDnsRecordsJob;
+use App\Jobs\ValidateAndInstallServerJob;
+use App\Livewire\Server\Delete;
 use App\Livewire\Server\Transfer;
-use App\Livewire\Server\TransferImport;
+use App\Models\Application;
+use App\Models\DnsProviderZone;
 use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
 use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use App\Services\ServerTransfer\ServerTransferClaimer;
-use App\Services\ServerTransfer\ServerTransferExporter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    config(['app.env' => 'local']);
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
+    config(['app.env' => 'production']);
+    $this->withoutVite();
 
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
+    // The default password of UserFactory.
+    $this->userPassword = 'password'; // ggignore
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
     $this->actingAs($this->user);
     session(['currentTeam' => $this->team]);
@@ -34,47 +55,53 @@ beforeEach(function () {
     ]);
 });
 
-test('server transfer pages are unavailable outside development mode', function (string $uri) {
-    config(['app.env' => 'production']);
-
-    $this->get($uri)->assertNotFound();
-})->with([
-    '/servers/import',
-    fn () => '/server/'.$this->server->uuid.'/transfer',
-]);
-
-test('server transfer links are hidden outside development mode', function () {
-    config(['app.env' => 'production']);
-
-    $this->get('/servers')
-        ->assertOk()
-        ->assertDontSee('/servers/import');
-
-    $this->get('/server/'.$this->server->uuid)
-        ->assertOk()
-        ->assertDontSee('Transfer', escape: false);
+test('server transfer page is available in production', function () {
+    $this->get('/server/'.$this->server->uuid.'/transfer')->assertOk();
 });
 
-test('transfer state is hidden outside development mode', function (bool $managementDisabled) {
-    app(ServerTransferClaimer::class)->markTransferred($this->server, managementDisabled: $managementDisabled);
-    config(['app.env' => 'production']);
-
-    $this->get('/servers')
+test('server transfer link is shown to admins in production', function () {
+    $this->get('/server/'.$this->server->uuid)
         ->assertOk()
-        ->assertDontSee('Transferable')
-        ->assertDontSee('Transferred away');
+        ->assertSee('/server/'.$this->server->uuid.'/transfer', escape: false);
+});
+
+test('taking back a transferred server needs a typed confirmation', function () {
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://target.example.com');
 
     $this->get('/server/'.$this->server->uuid)
         ->assertOk()
-        ->assertDontSee('Transfer', escape: false)
-        ->assertDontSee('/transfer"', escape: false)
-        ->assertDontSee('another instance')
-        ->assertDontSee('Enable management')
-        ->assertDontSee('Disable management');
-})->with([
-    'management disabled' => [true],
-    'transferred away' => [false],
-]);
+        ->assertSee('Take back a transferred server?')
+        ->assertSee('Changes made on https://target.example.com after', escape: false);
+});
+
+test('team members cannot open the transfer page', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertRedirect(route('server.index'));
+
+    $this->get('/server/'.$this->server->uuid)
+        ->assertOk()
+        ->assertDontSee('/server/'.$this->server->uuid.'/transfer', escape: false);
+});
+
+test('a member who owns another team cannot use that role to transfer the server', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $otherTeam = Team::factory()->create();
+    $otherTeam->members()->attach($member->id, ['role' => 'owner']);
+    $this->actingAs($member);
+
+    session(['currentTeam' => $this->team]);
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertRedirect(route('server.index'));
+
+    session(['currentTeam' => $otherTeam]);
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertStatus(404);
+});
 
 test('transfer page renders for owned server', function () {
     Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
@@ -82,40 +109,14 @@ test('transfer page renders for owned server', function () {
         ->assertSee('Transfer server')
         ->assertSee('Target instance URL')
         ->assertSee('Target API token')
-        ->assertSee('Transfer server')
-        ->assertSee('Manual transfer');
-});
-
-test('transfer import page renders for admin', function () {
-    Livewire::test(TransferImport::class)
-        ->assertOk()
-        ->assertSee('Transfer file')
-        ->assertSee('Dry run')
-        ->assertSee('Import server');
-});
-
-test('export bundle streams download from livewire', function () {
-    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
-        ->call('exportBundle')
-        ->assertFileDownloaded('server-transfer-'.$this->server->uuid.'.json');
-});
-
-test('team members cannot export a transfer bundle', function () {
-    $member = User::factory()->create();
-    $this->team->members()->attach($member->id, ['role' => 'member']);
-    $this->actingAs($member);
-    session(['currentTeam' => $this->team]);
-
-    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
-        ->call('exportBundle')
-        ->assertNoFileDownloaded();
+        ->assertDontSee('Manual transfer')
+        ->assertDontSee('Passphrase');
 });
 
 test('transfer page badge shows the management state of the server', function (string $state, string $label, array $hidden) {
     $claimer = app(ServerTransferClaimer::class);
     match ($state) {
         'managed' => null,
-        'disabled' => $claimer->markTransferred($this->server, managementDisabled: true),
         'transferred' => $claimer->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test'),
     };
 
@@ -123,53 +124,194 @@ test('transfer page badge shows the management state of the server', function (s
         ->assertSee($label)
         ->assertDontSee($hidden);
 })->with([
-    'managed' => ['managed', 'Managed here', ['Transferable', 'Transferred away']],
-    'management disabled' => ['disabled', 'Transferable', ['Transferred away', 'Managed here']],
-    'transferred' => ['transferred', 'Transferred away', ['Transferable', 'Managed here']],
+    'managed' => ['managed', 'Managed here', ['Transferred away']],
+    'transferred' => ['transferred', 'Transferred away', ['Managed here']],
 ]);
 
-test('export bundle is encrypted only when a passphrase is set', function (?string $passphrase, string $fileName) {
+test('transfer to another instance runs in a queued job', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
+
     Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
-        ->set('passphrase', $passphrase)
-        ->call('exportBundle')
-        ->assertFileDownloaded('server-transfer-'.$this->server->uuid.$fileName);
+        ->set('targetUrl', 'https://8.8.8.8')
+        ->set('targetToken', 'target-token')
+        ->call('migrateServer')
+        ->assertHasNoErrors()
+        ->assertSet('targetToken', '')
+        ->assertSee('Transfer in progress');
+
+    Queue::assertPushed(MigrateServerToInstanceJob::class);
+    expect(data_get($this->server->fresh()->server_metadata, 'migration.status'))->toBe('running');
+});
+
+test('transfer page shows the error of a failed transfer', function () {
+    $this->server->forceFill(['server_metadata' => ['migration' => [
+        'status' => 'failed',
+        'target_url' => 'https://8.8.8.8',
+        'error' => 'Target import failed (HTTP 401): Unauthenticated.',
+    ]]])->save();
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Transfer failed')
+        ->assertSee('Target import failed (HTTP 401): Unauthenticated.');
+});
+
+test('a transferred server cannot delete its cloud provider machine', function () {
+    Queue::fake();
+    $this->server->forceFill(['hetzner_server_id' => 4242])->save();
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    $component = Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid]);
+    expect(collect($component->viewData('checkboxes'))->pluck('id'))->not->toContain('delete_from_hetzner');
+
+    $component->call('delete', $this->userPassword, ['delete_from_hetzner']);
+
+    DeleteServer::assertPushed(fn ($action, array $parameters) => $parameters[1] === false && $parameters[2] === 4242);
+});
+
+test('a transferred server does not show Hostinger VPS deletion guidance', function () {
+    $this->server->forceFill(['hostinger_virtual_machine_id' => 4242])->save();
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid])
+        ->assertDontSee('Hostinger deletes')
+        ->assertDontSee('hpanel.hostinger.com');
+});
+
+test('a managed server can still delete its cloud provider machine', function () {
+    $this->server->forceFill(['hetzner_server_id' => 4242])->save();
+
+    $component = Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid]);
+
+    expect(collect($component->viewData('checkboxes'))->pluck('id'))->toContain('delete_from_hetzner');
+});
+
+test('deleting a transferred server deletes its resources from this instance only', function () {
+    Queue::fake();
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create([
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    $component = Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid]);
+    expect(collect($component->viewData('checkboxes'))->pluck('id'))->not->toContain('force_delete_resources');
+
+    $component->call('delete', $this->userPassword);
+
+    Queue::assertPushed(DeleteResourceJob::class, fn (DeleteResourceJob $job) => $job->resource->is($application) && $job->deleteFromCoolifyOnly);
+    expect(Server::find($this->server->id))->toBeNull();
+});
+
+test('deleting a transferred server forgets the DNS records of its resources without releasing them at the provider', function () {
+    Queue::fake();
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create(['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()]);
+    // An archive that still tracks a record, for example from a transfer before records were forgotten at claim time.
+    $this->server->forceFill(['server_metadata' => ['transfer' => ['status' => 'transferred']]])->save();
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare']);
+    $zone = DnsProviderZone::factory()->create(['integration_token_id' => $token->id]);
+    $record = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id]);
+    $record->addReference($application);
+
+    Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid])->call('delete', $this->userPassword);
+    (new DeleteResourceJob($application->fresh(), deleteFromCoolifyOnly: true))->handle();
+
+    Queue::assertNotPushed(ReleaseManagedDnsRecordsJob::class);
+    expect(ManagedDnsRecord::find($record->id))->toBeNull()
+        ->and(Application::withTrashed()->find($application->id))->toBeNull();
+});
+
+test('deleting an application from Coolify only does not touch the server', function () {
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create([
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    Process::fake();
+
+    (new DeleteResourceJob($application, deleteFromCoolifyOnly: true))->handle();
+
+    Process::assertNothingRan();
+    expect(Application::withTrashed()->find($application->id))->toBeNull();
+});
+
+test('transfer with a token that the target does not accept shows an error and does not start', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'Unauthenticated.'], 401)]);
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->set('targetUrl', 'https://8.8.8.8')
+        ->set('targetToken', 'wrong-token')
+        ->call('migrateServer')
+        ->assertDispatched('error')
+        ->assertDontSee('Transfer in progress')
+        ->assertSee('A check failed. The transfer did not start.')
+        ->assertSee('OK: this instance can connect to the server over SSH.')
+        ->assertSee('FAILED: the target instance accepts the API token.')
+        ->assertSee('See the transfer log below for details.')
+        ->assertDontSee('checks failed:');
+
+    Queue::assertNotPushed(MigrateServerToInstanceJob::class);
+});
+
+test('transfer page links to the server on the target and lists the steps after a finished transfer', function () {
+    $this->server->forceFill(['server_metadata' => ['migration' => [
+        'status' => 'succeeded',
+        'target_url' => 'https://8.8.8.8',
+        'checklist' => ['Set the webhook URL of GitHub App <b>deploy-bot</b> to https://8.8.8.8/webhooks/source/github/events.'],
+        'target_server_url' => 'https://8.8.8.8/server/abc',
+    ]]])->save();
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Transfer finished')
+        ->assertSee('Finish the transfer on the target')
+        ->assertSee('href="https://8.8.8.8/server/abc"', escape: false)
+        ->assertSee('Set the webhook URL of GitHub App <b>deploy-bot</b> to https://8.8.8.8/webhooks/source/github/events.')
+        ->assertDontSee('<b>deploy-bot</b>', escape: false);
+});
+
+test('transfer page hides the post-transfer checklist', function (string $status, array $checklist) {
+    $this->server->forceFill(['server_metadata' => ['migration' => [
+        'status' => $status,
+        'target_url' => 'https://8.8.8.8',
+        'error' => 'Target import failed (HTTP 401): Unauthenticated.',
+        'checklist' => $checklist,
+    ]]])->save();
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertDontSee('Finish the transfer on the target')
+        ->assertDontSee('Set the webhook URL');
 })->with([
-    'null' => [null, '.json'],
-    'empty string' => ['', '.json'],
-    'only spaces' => ['   ', '.json'],
-    'set' => ['secret-pass', '.encrypted.json'],
+    'finished transfer without steps' => ['succeeded', []],
+    'failed transfer' => ['failed', ['Set the webhook URL of GitHub App deploy-bot.']],
 ]);
 
-test('import dry run from pasted json', function () {
-    $bundle = app(ServerTransferExporter::class)->export($this->server);
+test('the transfer page of an archive offers a transfer back instead of a transfer', function () {
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://8.8.8.8');
+    Http::fake(['https://8.8.8.8/api/v1/servers/*/migrate' => Http::response(['migration' => ['status' => 'running']], 202)]);
 
-    // Free IP for dry-run validation on same team would still report existing server
-    Livewire::test(TransferImport::class)
-        ->set('bundleJson', json_encode($bundle))
-        ->call('dryRun')
-        ->assertSet('lastResult.dry_run', true)
-        ->assertSet('lastResult.server_uuid', $this->server->uuid)
-        ->assertSee('Dry run result')
-        ->assertSee('Nothing written');
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertSet('managerUrl', 'https://8.8.8.8')
+        ->assertDontSee('Transfer to another instance')
+        ->set('managerToken', 'token-of-b')
+        ->call('transferBack')
+        ->assertDispatched('success')
+        ->assertSee('Transfer back started');
+
+    Http::assertSentCount(1);
 });
 
-test('import creates server after source removal', function () {
-    $bundle = app(ServerTransferExporter::class)->export($this->server);
-    $uuid = $this->server->uuid;
+test('team members cannot start a transfer back', function () {
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://8.8.8.8');
+    Http::fake();
+    $component = Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid]);
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
 
-    $this->server->forceDelete();
-    $this->privateKey->delete();
+    $component->set('managerToken', 'token-of-b')->call('transferBack');
 
-    Livewire::test(TransferImport::class)
-        ->set('bundleJson', json_encode($bundle))
-        ->set('preserveUuids', true)
-        ->set('adoptMode', true)
-        ->call('importBundle')
-        ->assertSet('importedServerUuid', $uuid)
-        ->assertSet('lastResult.dry_run', false)
-        ->assertSet('lastResult.claimed', true);
-
-    $server = Server::where('uuid', $uuid)->first();
-    expect($server)->not->toBeNull()
-        ->and(data_get($server->server_metadata, 'transfer.status'))->toBe('claimed');
+    Http::assertNothingSent();
 });
diff --git a/tests/Feature/LocalhostServerDetailsTest.php b/tests/Feature/LocalhostServerDetailsTest.php
index c106830184..af8c9cc8b1 100644
--- a/tests/Feature/LocalhostServerDetailsTest.php
+++ b/tests/Feature/LocalhostServerDetailsTest.php
@@ -95,7 +95,7 @@ it('renders stored localhost server details instead of the fetch action', functi
         ->assertSee('29.4.3')
         ->assertSee('Compose version')
         ->assertSee('2.32.4')
-        ->assertSee('Refresh server details')
+        ->assertSee('Refresh details')
         ->assertDontSee('Fetch server details');
 });
 
@@ -125,6 +125,22 @@ it('fetches localhost server details from the overview action', function () {
         ->and($server->composeVersion())->toBe('2.32.4');
 });
 
+it('does not fetch server details before the server is validated', function () {
+    $this->server->settings()->update([
+        'is_reachable' => false,
+        'is_usable' => false,
+    ]);
+
+    Process::fake();
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->call('refreshServerMetadata')
+        ->assertDispatched('error', 'Validate the server connection before fetching details.');
+
+    Process::assertNothingRan();
+    expect($this->server->fresh()->server_metadata)->toBeNull();
+});
+
 it('refetches localhost compose version from the overview refresh action', function () {
     $this->server->update([
         'server_metadata' => [
@@ -184,3 +200,23 @@ it('collects localhost server details after a successful connection check', func
         ->and($server->settings->is_reachable)->toBeTrue()
         ->and($server->settings->is_usable)->toBeTrue();
 });
+
+it('shows validation-only menus as disabled until the server is validated', function () {
+    $this->server->settings()->update([
+        'is_reachable' => false,
+        'is_usable' => false,
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Docker Cleanup')
+        ->assertSee('aria-disabled="true"', false)
+        ->assertDontSee(route('server.docker-cleanup', ['server_uuid' => $this->server->uuid]), false);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee(route('server.docker-cleanup', ['server_uuid' => $this->server->uuid]), false);
+});
diff --git a/tests/Feature/LogDrain/CloudwatchLogDrainTest.php b/tests/Feature/LogDrain/CloudwatchLogDrainTest.php
new file mode 100644
index 0000000000..26034973b9
--- /dev/null
+++ b/tests/Feature/LogDrain/CloudwatchLogDrainTest.php
@@ -0,0 +1,244 @@
+<?php
+
+use App\Actions\Server\StartLogDrain;
+use App\Actions\Server\StopLogDrain;
+use App\Livewire\Server\LogDrains;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = $this->user->teams()->first();
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('enables the CloudWatch drain and persists its options', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->once()->andReturn('ok');
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', '/coolify/prod')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->set('logDrainCloudwatchStreamPrefix', 'docker/')
+        ->call('toggleLogDrain', 'cloudwatch')
+        ->assertHasNoErrors()
+        ->assertSet('isLogDrainCloudwatchEnabled', true);
+
+    $settings = $this->server->settings->fresh();
+    expect($settings->is_logdrain_cloudwatch_enabled)->toBeTrue()
+        ->and($settings->logdrain_cloudwatch_group)->toBe('/coolify/prod')
+        ->and($settings->logdrain_cloudwatch_region)->toBe('us-east-1')
+        ->and($settings->logdrain_cloudwatch_stream_prefix)->toBe('docker/');
+});
+
+it('requires a log group before enabling CloudWatch', function () {
+    StartLogDrain::mock()->shouldNotReceive('handle');
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('isLogDrainCloudwatchEnabled', true)
+        ->call('instantSave')
+        ->assertDispatched('error')
+        ->assertSet('isLogDrainCloudwatchEnabled', false);
+
+    expect($this->server->settings->fresh()->is_logdrain_cloudwatch_enabled)->toBeFalse();
+});
+
+it('requires a region before enabling CloudWatch', function () {
+    StartLogDrain::mock()->shouldNotReceive('handle');
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->call('toggleLogDrain', 'cloudwatch')
+        ->assertDispatched('error')
+        ->assertSet('isLogDrainCloudwatchEnabled', false);
+
+    expect($this->server->settings->fresh()->is_logdrain_cloudwatch_enabled)->toBeFalse();
+});
+
+it('rejects stream prefixes that could break the compose file', function (string $prefix) {
+    StartLogDrain::mock()->shouldNotReceive('handle');
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->set('logDrainCloudwatchStreamPrefix', $prefix)
+        ->set('isLogDrainCloudwatchEnabled', true)
+        ->call('instantSave')
+        ->assertDispatched('error')
+        ->assertSet('isLogDrainCloudwatchEnabled', false);
+
+    expect($this->server->settings->fresh()->is_logdrain_cloudwatch_enabled)->toBeFalse();
+})->with(['docker/${HOME}', 'docker:', '{{.ID}}', 'with space']);
+
+it('enables the CloudWatch drain from the status dropdown', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->once()->andReturn('ok');
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->set('logDrainCloudwatchStreamPrefix', 'docker/')
+        ->set('isLogDrainCloudwatchEnabled', true)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $settings = $this->server->settings->fresh();
+    expect($settings->is_logdrain_cloudwatch_enabled)->toBeTrue()
+        ->and($settings->logdrain_cloudwatch_stream_prefix)->toBe('docker/');
+});
+
+it('disables other drains when CloudWatch is enabled', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->andReturn('ok');
+    $this->server->settings->update([
+        'is_logdrain_newrelic_enabled' => true,
+        'logdrain_newrelic_license_key' => 'abc123',
+        'logdrain_newrelic_base_uri' => 'https://log-api.newrelic.com',
+    ]);
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->call('toggleLogDrain', 'cloudwatch')
+        ->assertSet('isLogDrainNewRelicEnabled', false)
+        ->assertSet('isLogDrainCloudwatchEnabled', true);
+
+    $settings = $this->server->settings->fresh();
+    expect($settings->is_logdrain_newrelic_enabled)->toBeFalsy()
+        ->and($settings->is_logdrain_cloudwatch_enabled)->toBeTrue();
+});
+
+it('reverts the CloudWatch flag when starting the drain fails', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->andThrow(new RuntimeException('runtime boom'));
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->call('toggleLogDrain', 'cloudwatch')
+        ->assertSet('isLogDrainCloudwatchEnabled', false);
+
+    expect($this->server->settings->fresh()->is_logdrain_cloudwatch_enabled)->toBeFalse();
+});
+
+it('forbids team members from enabling CloudWatch', function () {
+    StartLogDrain::mock()->shouldNotReceive('handle');
+    $member = User::factory()->create();
+    $member->teams()->attach($this->team, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->call('toggleLogDrain', 'cloudwatch');
+
+    expect($this->server->settings->fresh()->is_logdrain_cloudwatch_enabled)->toBeFalse();
+});
+
+it('does not deploy the Fluent Bit container for CloudWatch', function () {
+    StopLogDrain::mock()->shouldReceive('handle')->once()->andReturn('removed');
+    $this->server->settings->update([
+        'is_logdrain_cloudwatch_enabled' => true,
+        'logdrain_cloudwatch_group' => 'coolify',
+        'logdrain_cloudwatch_region' => 'us-east-1',
+    ]);
+
+    $result = StartLogDrain::run($this->server->fresh());
+
+    expect($result)->toContain('awslogs');
+});
+
+it('turns off the legacy Highlight drain when CloudWatch is enabled', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->andReturn('ok');
+    $this->server->settings->update([
+        'is_logdrain_highlight_enabled' => true,
+        'logdrain_highlight_project_id' => 'legacy-project',
+    ]);
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->set('isLogDrainCloudwatchEnabled', true)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $settings = $this->server->settings->fresh();
+    expect($settings->is_logdrain_highlight_enabled)->toBeFalsy()
+        ->and($settings->is_logdrain_cloudwatch_enabled)->toBeTrue();
+});
+
+it('turns off the legacy Highlight drain when switching drains with toggleLogDrain', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->andReturn('ok');
+    $this->server->settings->update(['is_logdrain_highlight_enabled' => true]);
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->call('toggleLogDrain', 'cloudwatch');
+
+    $settings = $this->server->settings->fresh();
+    expect($settings->is_logdrain_highlight_enabled)->toBeFalsy()
+        ->and($settings->is_logdrain_cloudwatch_enabled)->toBeTrue();
+});
+
+it('keeps the legacy Highlight drain when saving without enabling another drain', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->andReturn('ok');
+    $this->server->settings->update(['is_logdrain_highlight_enabled' => true]);
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->call('submit')
+        ->assertDispatched('success');
+
+    expect($this->server->settings->fresh()->is_logdrain_highlight_enabled)->toBeTruthy();
+});
+
+it('rejects a save that would enable two log drains at once', function () {
+    StartLogDrain::mock()->shouldNotReceive('handle');
+    $this->server->settings->update([
+        'is_logdrain_newrelic_enabled' => true,
+        'logdrain_newrelic_license_key' => 'abc123',
+        'logdrain_newrelic_base_uri' => 'https://log-api.newrelic.com',
+    ]);
+
+    // The UI disables the CloudWatch dropdown here; this simulates a crafted request.
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainCloudwatchGroup', 'coolify')
+        ->set('logDrainCloudwatchRegion', 'us-east-1')
+        ->set('isLogDrainCloudwatchEnabled', true)
+        ->call('instantSave')
+        ->assertDispatched('error')
+        ->assertSet('isLogDrainCloudwatchEnabled', false)
+        ->assertSet('isLogDrainNewRelicEnabled', true);
+
+    $settings = $this->server->settings->fresh();
+    expect($settings->is_logdrain_cloudwatch_enabled)->toBeFalse()
+        ->and($settings->is_logdrain_newrelic_enabled)->toBeTruthy();
+});
+
+it('keeps the Fluent Bit drain running if CloudWatch is also enabled, matching the containers logging config', function () {
+    Process::fake();
+    StopLogDrain::mock()->shouldReceive('handle')->andReturn('removed');
+    $this->server->update(['private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id]);
+    $this->server->settings->update([
+        'is_logdrain_axiom_enabled' => true,
+        'logdrain_axiom_dataset_name' => 'ds',
+        'logdrain_axiom_api_key' => 'key',
+        'is_logdrain_cloudwatch_enabled' => true,
+        'logdrain_cloudwatch_group' => 'coolify',
+        'logdrain_cloudwatch_region' => 'us-east-1',
+    ]);
+    $server = $this->server->fresh();
+
+    expect(generate_log_drain_configuration($server)['driver'])->toBe('fluentd');
+
+    StartLogDrain::run($server);
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'log-drains/docker-compose.yml up -d'));
+});
diff --git a/tests/Feature/LogRedactionChannelTest.php b/tests/Feature/LogRedactionChannelTest.php
new file mode 100644
index 0000000000..29e2a9b6b1
--- /dev/null
+++ b/tests/Feature/LogRedactionChannelTest.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Log\LogManager;
+use Monolog\Handler\TestHandler;
+
+it('redacts secrets when Laravel creates a configured log channel', function (string $channel) {
+    config(['logging.redaction_enabled' => true, 'constants.coolify.self_hosted' => true]);
+    $configuration = config("logging.channels.{$channel}");
+    $configuration['driver'] = 'monolog';
+    $configuration['handler'] = TestHandler::class;
+    config([
+        "logging.channels.{$channel}" => $configuration,
+        'logging.channels.emergency.path' => '/dev/null',
+    ]);
+    $logger = (new LogManager(app()))->channel($channel);
+    $handler = $logger->getLogger()->getHandlers()[0];
+
+    expect($handler)->toBeInstanceOf(TestHandler::class);
+
+    $logger->error('password=coolify-canary-channel-secret', [
+        'token' => 'coolify-canary-context-secret',
+        'user_email' => 'admin@example.com',
+    ]);
+
+    $record = $handler->getRecords()[0];
+
+    expect($record->message)->toBe('password='.REDACTED);
+    expect($record->context['token'])->toBe(REDACTED);
+    expect($record->context['user_email'])->toBe($channel === 'audit' ? 'admin@example.com' : REDACTED);
+})->with(['single', 'audit']);
diff --git a/tests/Feature/LogRedactionRemoteSecretsTest.php b/tests/Feature/LogRedactionRemoteSecretsTest.php
new file mode 100644
index 0000000000..7bbdd24542
--- /dev/null
+++ b/tests/Feature/LogRedactionRemoteSecretsTest.php
@@ -0,0 +1,152 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\IntegrationToken;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+uses(RefreshDatabase::class);
+
+const DOPPLER_DOWNLOAD_URL = 'https://api.doppler.com/v3/configs/config/secrets/download*';
+
+beforeEach(function () {
+    Http::preventStrayRequests();
+    $this->team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $this->team->id])->id]);
+    $this->resourceAttributes = [
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ];
+    $this->serverId = $server->id;
+});
+
+function makeRemoteSecretResource(string $type): Application|Service|StandalonePostgresql
+{
+    $attributes = test()->resourceAttributes;
+
+    return match ($type) {
+        'application' => Application::factory()->create($attributes),
+        'service' => Service::factory()->create([...$attributes, 'server_id' => test()->serverId]),
+        'database' => StandalonePostgresql::query()->create([...$attributes, 'name' => 'remote-secret-db', 'postgres_password' => 'stored-db-password']),
+    };
+}
+
+function addRemoteSecretVariable(Application|Service|StandalonePostgresql $resource, string $key, string $value, bool $locked = false, bool $preview = false): void
+{
+    EnvironmentVariable::query()->create([
+        'key' => $key,
+        'value' => $value,
+        'resourceable_type' => $resource->getMorphClass(),
+        'resourceable_id' => $resource->id,
+        'is_preview' => $preview,
+        'is_shown_once' => $locked,
+    ]);
+}
+
+function linkDopplerSource(Application|Service|StandalonePostgresql $resource): void
+{
+    $token = IntegrationToken::factory()->create([
+        'team_id' => test()->team->id,
+        'provider' => 'doppler',
+        'capabilities' => ['secrets'],
+    ]);
+    $resource->secretManagerLink()->create(['integration_token_id' => $token->id]);
+}
+
+it('hides resolved remote secrets of applications and services as locked values', function (string $type, bool $locked) {
+    Http::fake([DOPPLER_DOWNLOAD_URL => Http::response(['API_TOKEN' => 'resolved-remote-api-token'])]);
+    $resource = makeRemoteSecretResource($type);
+    if ($type === 'application') {
+        $resource->settings->update(['redact_all_env_values_in_logs' => false]);
+    } else {
+        $resource->update(['redact_all_env_values_in_logs' => false]);
+    }
+    linkDopplerSource($resource);
+    addRemoteSecretVariable($resource, 'API_TOKEN', '{{vault.API_TOKEN}}', locked: $locked);
+
+    $secrets = EnvironmentVariable::logRedactionSecretsFor($resource->fresh());
+
+    expect($secrets['locked'])->toContain('resolved-remote-api-token')
+        ->and(sanitizeLogsForExport('token resolved-remote-api-token', $secrets))->toBe('token '.REDACTED);
+})->with(['application', 'service'])->with(['locked' => true, 'unlocked' => false]);
+
+it('hides resolved remote secrets of application preview variables', function () {
+    Http::fake([DOPPLER_DOWNLOAD_URL => Http::response(['PREVIEW_TOKEN' => 'resolved-preview-token'])]);
+    $application = makeRemoteSecretResource('application');
+    linkDopplerSource($application);
+    addRemoteSecretVariable($application, 'PREVIEW_TOKEN', '{{vault.PREVIEW_TOKEN}}', preview: true);
+
+    expect(EnvironmentVariable::logRedactionSecretsFor($application->fresh(), includePreview: true)['locked'])
+        ->toContain('resolved-preview-token');
+});
+
+it('fetches the secret source once per call', function () {
+    Http::fake([DOPPLER_DOWNLOAD_URL => Http::response(['FIRST' => 'first-remote-value', 'SECOND' => 'second-remote-value'])]);
+    $application = makeRemoteSecretResource('application');
+    linkDopplerSource($application);
+    addRemoteSecretVariable($application, 'FIRST', '{{vault.FIRST}}');
+    addRemoteSecretVariable($application, 'SECOND', '{{vault.SECOND}}', locked: true);
+
+    $secrets = EnvironmentVariable::logRedactionSecretsFor($application->fresh());
+
+    expect($secrets['locked'])->toContain('first-remote-value', 'second-remote-value');
+    Http::assertSentCount(1);
+});
+
+it('does not contact a secret source for resources without remote references', function (string $type) {
+    $resource = makeRemoteSecretResource($type);
+    linkDopplerSource($resource);
+    addRemoteSecretVariable($resource, 'PLAIN', 'plain-value', locked: true);
+
+    expect(EnvironmentVariable::logRedactionSecretsFor($resource->fresh())['locked'])->toContain('plain-value');
+    Http::assertNothingSent();
+})->with(['application', 'service', 'database']);
+
+it('keeps exporting logs when remote secrets cannot be resolved', function (string $type, string $failure) {
+    Log::spy();
+    $resource = makeRemoteSecretResource($type);
+    if ($failure === 'source fails') {
+        Http::fake([DOPPLER_DOWNLOAD_URL => Http::response(['message' => 'unavailable'], 500)]);
+        linkDopplerSource($resource);
+    } elseif ($failure === 'missing key') {
+        Http::fake([DOPPLER_DOWNLOAD_URL => Http::response(['PRESENT' => 'present-remote-value'])]);
+        linkDopplerSource($resource);
+    }
+    addRemoteSecretVariable($resource, 'LOCKED_PLAIN', 'locked-plain-value', locked: true);
+    addRemoteSecretVariable($resource, 'BROKEN', '{{vault.PRESENT}}-{{vault.MISSING}}');
+    addRemoteSecretVariable($resource, 'ALSO_BROKEN', '{{vault.MISSING}}');
+
+    $secrets = EnvironmentVariable::logRedactionSecretsFor($resource->fresh());
+
+    expect($secrets['locked'])->toContain('locked-plain-value', '{{vault.PRESENT}}-{{vault.MISSING}}', '{{vault.MISSING}}');
+    if ($failure === 'missing key') {
+        expect($secrets['locked'])->toContain('present-remote-value');
+    }
+    if ($type === 'database') {
+        expect($secrets['locked'])->toContain('stored-db-password');
+    }
+    Http::assertSentCount($failure === 'no source' ? 0 : 1);
+    Log::shouldHaveReceived('warning')->once()->withArgs(fn (string $message, array $context): bool => ! str_contains(json_encode($context), 'present-remote-value'));
+})->with(['application', 'service', 'database'])->with(['source fails', 'missing key', 'no source']);
+
+it('skips the secret source when the caller already holds the remote values', function () {
+    $application = makeRemoteSecretResource('application');
+    linkDopplerSource($application);
+    addRemoteSecretVariable($application, 'API_TOKEN', '{{vault.API_TOKEN}}', locked: true);
+
+    expect(EnvironmentVariable::logRedactionSecretsFor($application->fresh(), resolveRemoteSecrets: false)['locked'])
+        ->toContain('{{vault.API_TOKEN}}');
+    Http::assertNothingSent();
+});
diff --git a/tests/Feature/LogRedactionSecretsQueryCountTest.php b/tests/Feature/LogRedactionSecretsQueryCountTest.php
new file mode 100644
index 0000000000..88a126c9a2
--- /dev/null
+++ b/tests/Feature/LogRedactionSecretsQueryCountTest.php
@@ -0,0 +1,106 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+uses(RefreshDatabase::class);
+
+function makeLogRedactionQueryFixture(int $plainVariables, int $sharedVariables): Application
+{
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    for ($i = 0; $i < $plainVariables; $i++) {
+        EnvironmentVariable::query()->create([
+            'key' => "PLAIN_{$i}",
+            'value' => "plain-value-number-{$i}",
+            'resourceable_type' => $application->getMorphClass(),
+            'resourceable_id' => $application->id,
+            'is_preview' => false,
+        ]);
+    }
+    for ($i = 0; $i < $sharedVariables; $i++) {
+        SharedEnvironmentVariable::query()->create([
+            'key' => "SHARED_{$i}",
+            'value' => "shared-value-number-{$i}",
+            'type' => 'team',
+            'team_id' => $team->id,
+            'is_shown_once' => $i % 2 === 0,
+        ]);
+        EnvironmentVariable::query()->create([
+            'key' => "REF_{$i}",
+            'value' => "{{team.SHARED_{$i}}}",
+            'resourceable_type' => $application->getMorphClass(),
+            'resourceable_id' => $application->id,
+            'is_preview' => false,
+        ]);
+    }
+
+    return Application::query()->findOrFail($application->id);
+}
+
+function countLogRedactionQueries(Application $application): int
+{
+    DB::flushQueryLog();
+    DB::enableQueryLog();
+    EnvironmentVariable::logRedactionSecretsFor($application, includePreview: true);
+    $count = count(DB::getQueryLog());
+    DB::disableQueryLog();
+
+    return $count;
+}
+
+it('collects log redaction secrets with a query count that does not grow with plain variables', function () {
+    $small = countLogRedactionQueries(makeLogRedactionQueryFixture(plainVariables: 2, sharedVariables: 0));
+    $large = countLogRedactionQueries(makeLogRedactionQueryFixture(plainVariables: 40, sharedVariables: 0));
+
+    expect($large)->toBe($small);
+});
+
+it('collects log redaction secrets with a query count that does not grow with shared references', function () {
+    $small = countLogRedactionQueries(makeLogRedactionQueryFixture(plainVariables: 0, sharedVariables: 2));
+    $large = countLogRedactionQueries(makeLogRedactionQueryFixture(plainVariables: 0, sharedVariables: 20));
+
+    expect($large)->toBe($small);
+});
+
+it('still classifies plain, shared, and locked shared values correctly', function () {
+    $application = makeLogRedactionQueryFixture(plainVariables: 1, sharedVariables: 2);
+
+    $secrets = EnvironmentVariable::logRedactionSecretsFor($application);
+
+    expect($secrets['known'])->toContain('plain-value-number-0', 'shared-value-number-1')
+        ->and($secrets['locked'])->toContain('shared-value-number-0')
+        ->and($secrets['locked'])->not->toContain('shared-value-number-1');
+});
+
+it('does not create a circular relation on the resource', function () {
+    $application = makeLogRedactionQueryFixture(plainVariables: 2, sharedVariables: 1);
+
+    EnvironmentVariable::logRedactionSecretsFor($application);
+
+    expect($application->environment_variables->every(fn (EnvironmentVariable $variable): bool => ! $variable->relationLoaded('resourceable')))->toBeTrue()
+        ->and(json_encode($application->toArray()))->toBeString();
+});
+
+it('indexes application settings by application', function () {
+    expect(Schema::hasIndex('application_settings', ['application_id']))->toBeTrue();
+});
diff --git a/tests/Feature/LogRedactionSettingApiTest.php b/tests/Feature/LogRedactionSettingApiTest.php
new file mode 100644
index 0000000000..f0575f5ef2
--- /dev/null
+++ b/tests/Feature/LogRedactionSettingApiTest.php
@@ -0,0 +1,125 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $this->service = Service::factory()->create([
+        'environment_id' => $environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+    ]);
+    $this->database = StandalonePostgresql::query()->create([
+        'name' => 'log-redaction-database',
+        'postgres_password' => 'database-password',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+/**
+ * @param  list<string>  $abilities
+ */
+function logRedactionApiToken(Team $team, string $role, array $abilities = ['write']): string
+{
+    $user = User::factory()->create();
+    $team->members()->attach($user->id, ['role' => $role]);
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'test-token',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => $abilities,
+        'team_id' => $team->id,
+    ]);
+
+    return $token->getKey().'|'.$plainTextToken;
+}
+
+function logRedactionSettingOf(string $resource): bool
+{
+    return match ($resource) {
+        'application' => test()->application->settings->fresh()->redact_all_env_values_in_logs,
+        'service' => test()->service->fresh()->redact_all_env_values_in_logs,
+        'database' => test()->database->fresh()->redact_all_env_values_in_logs,
+    };
+}
+
+function logRedactionPath(string $resource): string
+{
+    return match ($resource) {
+        'application' => '/api/v1/applications/'.test()->application->uuid,
+        'service' => '/api/v1/services/'.test()->service->uuid,
+        'database' => '/api/v1/databases/'.test()->database->uuid,
+    };
+}
+
+it('lets a team admin limit log redaction to locked values', function (string $resource) {
+    $this->withToken(logRedactionApiToken($this->team, 'admin'))
+        ->patchJson(logRedactionPath($resource), ['redact_all_env_values_in_logs' => false])
+        ->assertOk();
+
+    expect(logRedactionSettingOf($resource))->toBeFalse();
+})->with(['application', 'service', 'database']);
+
+it('rejects a non-boolean log redaction value', function (string $resource) {
+    $this->withToken(logRedactionApiToken($this->team, 'admin'))
+        ->patchJson(logRedactionPath($resource), ['redact_all_env_values_in_logs' => 'nope'])
+        ->assertUnprocessable();
+
+    expect(logRedactionSettingOf($resource))->toBeTrue();
+})->with(['application', 'service', 'database']);
+
+it('forbids a team member from changing log redaction', function (string $resource) {
+    $this->withToken(logRedactionApiToken($this->team, 'member'))
+        ->patchJson(logRedactionPath($resource), ['redact_all_env_values_in_logs' => false])
+        ->assertForbidden();
+
+    expect(logRedactionSettingOf($resource))->toBeTrue();
+})->with(['application', 'service', 'database']);
+
+it('forbids a read-only token from changing log redaction', function (string $resource) {
+    $this->withToken(logRedactionApiToken($this->team, 'owner', ['read']))
+        ->patchJson(logRedactionPath($resource), ['redact_all_env_values_in_logs' => false])
+        ->assertForbidden();
+
+    expect(logRedactionSettingOf($resource))->toBeTrue();
+})->with(['application', 'service', 'database']);
+
+it('does not let an admin of another team change log redaction', function (string $resource) {
+    $this->withToken(logRedactionApiToken(Team::factory()->create(), 'owner'))
+        ->patchJson(logRedactionPath($resource), ['redact_all_env_values_in_logs' => false])
+        ->assertNotFound();
+
+    expect(logRedactionSettingOf($resource))->toBeTrue();
+})->with(['application', 'service', 'database']);
diff --git a/tests/Feature/LogRedactionSwitchTest.php b/tests/Feature/LogRedactionSwitchTest.php
new file mode 100644
index 0000000000..5135446857
--- /dev/null
+++ b/tests/Feature/LogRedactionSwitchTest.php
@@ -0,0 +1,29 @@
+<?php
+
+use App\Logging\RedactSensitiveData;
+use App\Services\Security\SensitiveDataRedactor;
+use Illuminate\Log\Logger;
+use Monolog\Handler\TestHandler;
+use Monolog\Logger as MonologLogger;
+
+it('writes raw framework logs when a self-hosted instance turns redaction off', function () {
+    config(['logging.redaction_enabled' => false, 'constants.coolify.self_hosted' => true]);
+    $handler = new TestHandler;
+    $logger = new Logger(new MonologLogger('test', [$handler]));
+
+    (new RedactSensitiveData(new SensitiveDataRedactor))($logger);
+    $logger->error('password=coolify-canary-raw-secret');
+
+    expect($handler->getRecords()[0]->message)->toBe('password=coolify-canary-raw-secret');
+});
+
+it('always redacts framework logs on cloud', function () {
+    config(['logging.redaction_enabled' => false, 'constants.coolify.self_hosted' => false]);
+    $handler = new TestHandler;
+    $logger = new Logger(new MonologLogger('test', [$handler]));
+
+    (new RedactSensitiveData(new SensitiveDataRedactor))($logger);
+    $logger->error('password=coolify-canary-cloud-secret');
+
+    expect($handler->getRecords()[0]->message)->toBe('password='.REDACTED);
+});
diff --git a/tests/Feature/LoginAndMcpAccessTest.php b/tests/Feature/LoginAndMcpAccessTest.php
index 1c63176fcc..b99dbd7627 100644
--- a/tests/Feature/LoginAndMcpAccessTest.php
+++ b/tests/Feature/LoginAndMcpAccessTest.php
@@ -1,7 +1,6 @@
 <?php
 
 use App\Http\Middleware\ApiAllowed;
-use App\Http\Middleware\ApiIpAllowed;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Route;
@@ -25,9 +24,9 @@ it('keeps MCP independent from the REST API switch but applies the IP allow-list
     $disable = Route::getRoutes()->match(Request::create('/api/v1/mcp/disable', 'POST'));
 
     expect($mcp->gatherMiddleware())->not->toContain(ApiAllowed::class)
-        ->and($mcp->gatherMiddleware())->toContain(ApiIpAllowed::class)
+        ->and($mcp->gatherMiddleware())->toContain('api.ip.allowed')
         ->and($enable->gatherMiddleware())->not->toContain(ApiAllowed::class)
         ->and($disable->gatherMiddleware())->not->toContain(ApiAllowed::class)
-        ->and($enable->gatherMiddleware())->toContain('auth:sanctum', 'api.token.team', ApiIpAllowed::class, 'api.ability:write')
-        ->and($disable->gatherMiddleware())->toContain('auth:sanctum', 'api.token.team', ApiIpAllowed::class, 'api.ability:write');
+        ->and($enable->gatherMiddleware())->toContain('auth:sanctum', 'api.token.team', 'api.ip.allowed', 'api.ability:write')
+        ->and($disable->gatherMiddleware())->toContain('auth:sanctum', 'api.token.team', 'api.ip.allowed', 'api.ability:write');
 });
diff --git a/tests/Feature/Mcp/CallsRestApiTest.php b/tests/Feature/Mcp/CallsRestApiTest.php
new file mode 100644
index 0000000000..618e63db6d
--- /dev/null
+++ b/tests/Feature/Mcp/CallsRestApiTest.php
@@ -0,0 +1,41 @@
+<?php
+
+use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Concerns\CallsRestApi;
+use Illuminate\Http\Request;
+use Illuminate\Routing\RouteCollection;
+use Illuminate\Support\Facades\Route;
+
+test('REST bridge removes nested database credentials even with sensitive read access', function (string $key) {
+    Route::setRoutes(new RouteCollection);
+    Route::post('/api/v1/mcp-credential-test', function (Request $request) use ($key) {
+        $request->attributes->set('can_read_sensitive', true);
+
+        return response()->json(['data' => [
+            ['uuid' => 'database-uuid', $key => 'credential'],
+            ['uuid' => 'another-uuid', $key => ['credential']],
+        ]]);
+    });
+
+    $bridge = new class
+    {
+        use BuildsResponse;
+        use CallsRestApi {
+            callRestApi as public call;
+        }
+    };
+
+    expect($bridge->call('POST', 'mcp-credential-test'))->toBe([
+        'status' => 200,
+        'body' => ['data' => [
+            ['uuid' => 'database-uuid'],
+            ['uuid' => 'another-uuid'],
+        ]],
+    ]);
+})->with([
+    'internal_db_url', 'external_db_url', 'password',
+    'postgres_password', 'dragonfly_password', 'keydb_password',
+    'redis_password', 'mongo_initdb_root_password',
+    'mariadb_password', 'mariadb_root_password',
+    'mysql_password', 'mysql_root_password', 'clickhouse_admin_password',
+]);
diff --git a/tests/Feature/Mcp/McpApplicationToolsTest.php b/tests/Feature/Mcp/McpApplicationToolsTest.php
new file mode 100644
index 0000000000..ffec7af91e
--- /dev/null
+++ b/tests/Feature/Mcp/McpApplicationToolsTest.php
@@ -0,0 +1,530 @@
+<?php
+
+use App\Jobs\DeleteResourceJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    Queue::fake();
+    Bus::fake();
+    Process::fake();
+    Server::flushIdentityMap();
+
+    InstanceSettings::query()->delete();
+    $settings = new InstanceSettings(['is_mcp_server_enabled' => true, 'is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->otherTeam = Team::factory()->create();
+    $this->otherUser = User::factory()->create();
+    $this->otherTeam->members()->attach($this->otherUser->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = $this->project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = mcpAppCreateApplication($this->environment, $this->destination, 'mine');
+
+    $this->otherServer = Server::factory()->create(['team_id' => $this->otherTeam->id]);
+    $this->otherDestination = StandaloneDocker::where('server_id', $this->otherServer->id)->firstOrFail();
+    $this->otherProject = Project::factory()->create(['team_id' => $this->otherTeam->id]);
+    $this->otherEnvironment = $this->otherProject->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $this->otherProject->id]);
+    $this->otherApplication = mcpAppCreateApplication($this->otherEnvironment, $this->otherDestination, 'theirs');
+});
+
+function mcpAppCreateApplication(Environment $environment, StandaloneDocker $destination, string $name): Application
+{
+    $application = Application::factory()->create([
+        'name' => $name,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $application->settings->fill(['is_container_label_readonly_enabled' => false])->save();
+
+    return $application;
+}
+
+function mcpAppToken(User $user, array $abilities = ['write']): string
+{
+    return $user->createToken('mcp-app', $abilities)->plainTextToken;
+}
+
+function mcpAppCall(string $token, string $tool, array $arguments = [])
+{
+    app('auth')->forgetGuards();
+
+    return test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+        'Accept' => 'application/json, text/event-stream',
+    ])->postJson('/mcp', [
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'tools/call',
+        'params' => ['name' => $tool, 'arguments' => (object) $arguments],
+    ]);
+}
+
+function mcpAppText($response): string
+{
+    return (string) ($response->json('result.content.0.text') ?? $response->json('error.message'));
+}
+
+function mcpAppIsError($response): bool
+{
+    return $response->json('result.isError') === true || $response->json('error') !== null;
+}
+
+/**
+ * @return array<string, mixed>
+ */
+function mcpAppPublicData(array $overrides = []): array
+{
+    return array_merge([
+        'project_uuid' => test()->project->uuid,
+        'environment_uuid' => test()->environment->uuid,
+        'server_uuid' => test()->server->uuid,
+        'git_repository' => 'https://gitlab.com/coolify/test-static-app',
+        'git_branch' => 'main',
+        'build_pack' => 'static',
+        'ports_exposes' => '80',
+        'autogenerate_domain' => false,
+        'name' => 'mcp-created',
+    ], $overrides);
+}
+
+function mcpAppCreatedCount(): int
+{
+    return Application::where('name', 'mcp-created')->count();
+}
+
+// create_application
+
+test('create_application creates a public app in the token team, not the session team', function () {
+    $token = mcpAppToken($this->user);
+    $sessionTeam = Team::factory()->create();
+    $sessionTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $sessionProject = Project::factory()->create(['team_id' => $sessionTeam->id]);
+    session(['currentTeam' => $sessionTeam]);
+
+    $response = mcpAppCall($token, 'create_application', ['action' => 'public', 'data' => mcpAppPublicData()]);
+
+    expect(mcpAppIsError($response))->toBeFalse(mcpAppText($response));
+    $application = Application::where('name', 'mcp-created')->sole();
+    expect($application->environment->project->team_id)->toBe($this->team->id)
+        ->and($application->destination_id)->toBe($this->destination->id);
+
+    $intoSessionTeam = mcpAppCall($token, 'create_application', ['action' => 'public', 'data' => mcpAppPublicData([
+        'project_uuid' => $sessionProject->uuid,
+        'environment_name' => 'production',
+        'name' => 'session-team-app',
+    ])]);
+    expect(mcpAppIsError($intoSessionTeam))->toBeTrue()
+        ->and(Application::where('name', 'session-team-app')->exists())->toBeFalse();
+});
+
+test('create_application creates a docker image app', function () {
+    $response = mcpAppCall(mcpAppToken($this->user), 'create_application', ['action' => 'docker_image', 'data' => [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'server_uuid' => $this->server->uuid,
+        'docker_registry_image_name' => 'nginx',
+        'docker_registry_image_tag' => 'latest',
+        'ports_exposes' => '80',
+        'autogenerate_domain' => false,
+        'name' => 'mcp-created',
+    ]]);
+
+    expect(mcpAppIsError($response))->toBeFalse(mcpAppText($response))
+        ->and(Application::where('name', 'mcp-created')->sole()->build_pack)->toBe('dockerimage');
+});
+
+test('create_application rejects a project or server of another team', function (string $field) {
+    $data = mcpAppPublicData([$field => $field === 'project_uuid' ? $this->otherProject->uuid : $this->otherServer->uuid]);
+
+    $response = mcpAppCall(mcpAppToken($this->user), 'create_application', ['action' => 'public', 'data' => $data]);
+
+    expect(mcpAppIsError($response))->toBeTrue()
+        ->and(mcpAppCreatedCount())->toBe(0);
+})->with(['project_uuid', 'server_uuid']);
+
+test('create_application rejects a destination of another team', function () {
+    $extra = StandaloneDocker::forceCreate([
+        'name' => 'second',
+        'network' => 'second-network',
+        'server_id' => $this->server->id,
+    ]);
+    expect($this->server->destinations()->count())->toBeGreaterThan(1);
+
+    $response = mcpAppCall(mcpAppToken($this->user), 'create_application', ['action' => 'public', 'data' => mcpAppPublicData([
+        'destination_uuid' => $this->otherDestination->uuid,
+    ])]);
+
+    expect(mcpAppIsError($response))->toBeTrue()
+        ->and(mcpAppText($response))->toContain('destination_uuid')
+        ->and(mcpAppCreatedCount())->toBe(0);
+
+    $ok = mcpAppCall(mcpAppToken($this->user), 'create_application', ['action' => 'public', 'data' => mcpAppPublicData([
+        'destination_uuid' => $extra->uuid,
+    ])]);
+    expect(mcpAppIsError($ok))->toBeFalse(mcpAppText($ok))
+        ->and(Application::where('name', 'mcp-created')->sole()->destination_id)->toBe($extra->id);
+});
+
+test('create_application rejects a private key of another team', function () {
+    $foreignKey = PrivateKey::factory()->create(['team_id' => $this->otherTeam->id]);
+
+    $response = mcpAppCall(mcpAppToken($this->user), 'create_application', ['action' => 'deploy_key', 'data' => mcpAppPublicData([
+        'git_repository' => 'git@gitlab.com:coolify/private-app.git',
+        'private_key_uuid' => $foreignKey->uuid,
+    ])]);
+
+    expect(mcpAppIsError($response))->toBeTrue()
+        ->and(mcpAppText($response))->toContain('Private Key not found')
+        ->and(mcpAppCreatedCount())->toBe(0)
+        ->and(mcpAppText($response))->not->toContain('PRIVATE KEY');
+});
+
+test('create_application rejects a GitHub App of another team', function () {
+    $foreignApp = GithubApp::forceCreate([
+        'name' => 'Their GitHub App',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'team_id' => $this->otherTeam->id,
+        'is_system_wide' => false,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->otherTeam->id])->id,
+    ]);
+
+    $response = mcpAppCall(mcpAppToken($this->user), 'create_application', ['action' => 'github_app', 'data' => mcpAppPublicData([
+        'git_repository' => 'their-org/their-repo',
+        'github_app_uuid' => $foreignApp->uuid,
+    ])]);
+
+    expect(mcpAppIsError($response))->toBeTrue()
+        ->and(mcpAppText($response))->toContain('Github App not found')
+        ->and(mcpAppCreatedCount())->toBe(0);
+});
+
+test('create_application rejects read-only and member tokens', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    foreach ([mcpAppToken($this->user, ['read']), mcpAppToken($member, ['read']), mcpAppToken($member, ['write'])] as $token) {
+        $response = mcpAppCall($token, 'create_application', ['action' => 'public', 'data' => mcpAppPublicData()]);
+        expect(mcpAppIsError($response))->toBeTrue();
+    }
+
+    expect(mcpAppCreatedCount())->toBe(0);
+});
+
+test('create_application instant_deploy needs the deploy ability', function () {
+    $response = mcpAppCall(mcpAppToken($this->user), 'create_application', ['action' => 'public', 'data' => mcpAppPublicData(['instant_deploy' => true])]);
+
+    expect(mcpAppIsError($response))->toBeTrue()
+        ->and(mcpAppText($response))->toContain('deploy')
+        ->and(mcpAppCreatedCount())->toBe(0)
+        ->and(ApplicationDeploymentQueue::count())->toBe(0);
+});
+
+// manage_application
+
+test('manage_application accepts scalar and null unused path parameters', function (mixed $destinationUuid) {
+    $response = mcpAppCall(mcpAppToken($this->user), 'manage_application', [
+        'action' => 'update',
+        'uuid' => $this->application->uuid,
+        'destination_uuid' => $destinationUuid,
+        'data' => ['name' => 'changed'],
+    ]);
+
+    $response->assertOk()->assertJsonMissingPath('error');
+    expect(mcpAppIsError($response))->toBeFalse()
+        ->and($this->application->fresh()->name)->toBe('changed');
+})->with([
+    'string' => ['unused'],
+    'integer' => [123],
+    'float' => [1.5],
+    'boolean' => [false],
+    'null' => [null],
+]);
+
+test('manage_application rejects non-scalar unused path parameters before updating', function (mixed $destinationUuid) {
+    $response = mcpAppCall(mcpAppToken($this->user), 'manage_application', [
+        'action' => 'update',
+        'uuid' => $this->application->uuid,
+        'destination_uuid' => $destinationUuid,
+        'data' => ['name' => 'changed'],
+    ]);
+
+    $response->assertOk()->assertJsonPath('result.isError', true)->assertJsonMissingPath('error');
+    expect(mcpAppText($response))->toContain('destination_uuid must be a string.')
+        ->and($this->application->fresh()->name)->toBe('mine');
+})->with([
+    'array' => [['invalid']],
+    'object' => [(object) ['uuid' => 'invalid']],
+]);
+
+test('manage_application updates, clones and moves an application of the token team', function () {
+    $token = mcpAppToken($this->user);
+
+    $updated = mcpAppCall($token, 'manage_application', ['action' => 'update', 'uuid' => $this->application->uuid, 'data' => ['name' => 'renamed']]);
+    expect(mcpAppIsError($updated))->toBeFalse(mcpAppText($updated))
+        ->and($this->application->fresh()->name)->toBe('renamed');
+
+    $cloned = mcpAppCall($token, 'manage_application', ['action' => 'clone', 'uuid' => $this->application->uuid, 'data' => ['destination_uuid' => $this->destination->uuid, 'name' => 'cloned']]);
+    expect(mcpAppIsError($cloned))->toBeFalse(mcpAppText($cloned))
+        ->and(Application::where('name', 'cloned')->sole()->environment_id)->toBe($this->environment->id);
+
+    $target = Environment::factory()->create(['project_id' => $this->project->id, 'name' => 'staging']);
+    $moved = mcpAppCall($token, 'manage_application', ['action' => 'move', 'uuid' => $this->application->uuid, 'confirm' => true, 'data' => ['environment_uuid' => $target->uuid]]);
+    expect(mcpAppIsError($moved))->toBeFalse(mcpAppText($moved))
+        ->and($this->application->fresh()->environment_id)->toBe($target->id);
+});
+
+test('manage_application deletes an application only with confirm=true and a deploy token', function () {
+    $writeOnly = mcpAppCall(mcpAppToken($this->user), 'manage_application', ['action' => 'delete', 'uuid' => $this->application->uuid, 'confirm' => true]);
+    expect(mcpAppIsError($writeOnly))->toBeTrue()
+        ->and(mcpAppText($writeOnly))->toContain('Missing required permissions: deploy')
+        ->and(Application::find($this->application->id))->not->toBeNull();
+
+    $token = mcpAppToken($this->user, ['write', 'deploy']);
+
+    $denied = mcpAppCall($token, 'manage_application', ['action' => 'delete', 'uuid' => $this->application->uuid]);
+    expect(mcpAppIsError($denied))->toBeTrue()
+        ->and(mcpAppText($denied))->toContain('confirm=true')
+        ->and(Application::find($this->application->id))->not->toBeNull();
+
+    $deleted = mcpAppCall($token, 'manage_application', ['action' => 'delete', 'uuid' => $this->application->uuid, 'confirm' => true]);
+    expect(mcpAppIsError($deleted))->toBeFalse(mcpAppText($deleted))
+        ->and(Application::find($this->application->id))->toBeNull();
+    Bus::assertDispatched(DeleteResourceJob::class);
+});
+
+test('manage_application needs confirm for move and remove_server', function (string $action) {
+    $response = mcpAppCall(mcpAppToken($this->user), 'manage_application', [
+        'action' => $action,
+        'uuid' => $this->application->uuid,
+        'destination_uuid' => $this->destination->uuid,
+        'data' => [],
+    ]);
+
+    expect(mcpAppIsError($response))->toBeTrue()
+        ->and(mcpAppText($response))->toContain('confirm=true')
+        ->and($this->application->fresh()->environment_id)->toBe($this->environment->id);
+})->with(['move', 'remove_server']);
+
+test('manage_application cannot touch an application of another team', function (string $action, array $data) {
+    $before = $this->otherApplication->fresh()->toArray();
+
+    $response = mcpAppCall(mcpAppToken($this->user, ['write', 'deploy']), 'manage_application', [
+        'action' => $action,
+        'uuid' => $this->otherApplication->uuid,
+        'destination_uuid' => $this->otherDestination->uuid,
+        'confirm' => true,
+        'data' => $data,
+    ]);
+
+    expect(mcpAppIsError($response))->toBeTrue()
+        ->and(Application::find($this->otherApplication->id))->not->toBeNull()
+        ->and($this->otherApplication->fresh()->name)->toBe($before['name'])
+        ->and($this->otherApplication->fresh()->environment_id)->toBe($before['environment_id'])
+        ->and(Application::where('name', 'hijacked')->exists())->toBeFalse();
+})->with([
+    'update' => ['update', ['name' => 'hijacked']],
+    'delete' => ['delete', []],
+    'clone' => ['clone', ['destination_uuid' => 'placeholder', 'name' => 'hijacked']],
+    'move' => ['move', ['environment_uuid' => 'placeholder']],
+    'add_server' => ['add_server', ['destination_uuid' => 'placeholder']],
+    'remove_server' => ['remove_server', []],
+]);
+
+test('manage_application rejects a destination or environment of another team', function () {
+    $token = mcpAppToken($this->user);
+
+    $clone = mcpAppCall($token, 'manage_application', ['action' => 'clone', 'uuid' => $this->application->uuid, 'data' => ['destination_uuid' => $this->otherDestination->uuid, 'name' => 'hijacked']]);
+    expect(mcpAppIsError($clone))->toBeTrue()
+        ->and(Application::where('name', 'hijacked')->exists())->toBeFalse();
+
+    $move = mcpAppCall($token, 'manage_application', ['action' => 'move', 'uuid' => $this->application->uuid, 'confirm' => true, 'data' => ['environment_uuid' => $this->otherEnvironment->uuid]]);
+    expect(mcpAppIsError($move))->toBeTrue()
+        ->and($this->application->fresh()->environment_id)->toBe($this->environment->id);
+
+    $addServer = mcpAppCall($token, 'manage_application', ['action' => 'add_server', 'uuid' => $this->application->uuid, 'data' => ['destination_uuid' => $this->otherDestination->uuid]]);
+    expect(mcpAppIsError($addServer))->toBeTrue()
+        ->and($this->application->fresh()->additional_networks)->toHaveCount(0);
+});
+
+test('manage_application adds and removes an additional server of the token team', function () {
+    $token = mcpAppToken($this->user);
+    $secondServer = Server::factory()->create(['team_id' => $this->team->id]);
+    $secondDestination = StandaloneDocker::where('server_id', $secondServer->id)->firstOrFail();
+
+    $added = mcpAppCall($token, 'manage_application', ['action' => 'add_server', 'uuid' => $this->application->uuid, 'data' => ['destination_uuid' => $secondDestination->uuid]]);
+    expect(mcpAppIsError($added))->toBeFalse(mcpAppText($added))
+        ->and($this->application->fresh()->additional_networks)->toHaveCount(1);
+
+    $removed = mcpAppCall($token, 'manage_application', ['action' => 'remove_server', 'uuid' => $this->application->uuid, 'destination_uuid' => $secondDestination->uuid, 'confirm' => true]);
+    expect(mcpAppIsError($removed))->toBeFalse(mcpAppText($removed))
+        ->and($this->application->fresh()->additional_networks)->toHaveCount(0);
+});
+
+test('manage_application rejects read-only and member tokens', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    foreach ([mcpAppToken($this->user, ['read']), mcpAppToken($member, ['read']), mcpAppToken($member, ['write'])] as $token) {
+        $update = mcpAppCall($token, 'manage_application', ['action' => 'update', 'uuid' => $this->application->uuid, 'data' => ['name' => 'nope']]);
+        $delete = mcpAppCall($token, 'manage_application', ['action' => 'delete', 'uuid' => $this->application->uuid, 'confirm' => true]);
+        expect(mcpAppIsError($update))->toBeTrue()
+            ->and(mcpAppIsError($delete))->toBeTrue();
+    }
+
+    expect($this->application->fresh()->name)->toBe('mine');
+});
+
+// manage_preview and get_application_preview
+
+test('manage_preview creates, updates and deletes a preview of the token team', function () {
+    $writeToken = mcpAppToken($this->user, ['write']);
+    $deployToken = mcpAppToken($this->user, ['deploy']);
+
+    $writeOnly = mcpAppCall($writeToken, 'manage_preview', ['action' => 'create', 'uuid' => $this->application->uuid, 'data' => ['pull_request_id' => 7, 'git_type' => 'github', 'instant_deploy' => false]]);
+    expect(mcpAppIsError($writeOnly))->toBeTrue()
+        ->and(mcpAppText($writeOnly))->toContain('deploy');
+
+    $created = mcpAppCall($deployToken, 'manage_preview', ['action' => 'create', 'uuid' => $this->application->uuid, 'data' => ['pull_request_id' => 7, 'git_type' => 'github', 'instant_deploy' => false]]);
+    expect(mcpAppIsError($created))->toBeFalse(mcpAppText($created))
+        ->and(ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', 7)->exists())->toBeTrue();
+
+    $updated = mcpAppCall($writeToken, 'manage_preview', ['action' => 'update', 'uuid' => $this->application->uuid, 'pull_request_id' => '7', 'data' => ['domains' => 'https://pr7.example.com']]);
+    expect(mcpAppIsError($updated))->toBeFalse(mcpAppText($updated))
+        ->and(ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', 7)->sole()->fqdn)->toBe('https://pr7.example.com');
+
+    $writeOnlyDelete = mcpAppCall($writeToken, 'manage_preview', ['action' => 'delete', 'uuid' => $this->application->uuid, 'pull_request_id' => '7', 'confirm' => true]);
+    expect(mcpAppIsError($writeOnlyDelete))->toBeTrue()
+        ->and(mcpAppText($writeOnlyDelete))->toContain('Missing required permissions: deploy');
+
+    $writeDeployToken = mcpAppToken($this->user, ['write', 'deploy']);
+    $denied = mcpAppCall($writeDeployToken, 'manage_preview', ['action' => 'delete', 'uuid' => $this->application->uuid, 'pull_request_id' => '7']);
+    expect(mcpAppIsError($denied))->toBeTrue()
+        ->and(mcpAppText($denied))->toContain('confirm=true');
+
+    $deleted = mcpAppCall($writeDeployToken, 'manage_preview', ['action' => 'delete', 'uuid' => $this->application->uuid, 'pull_request_id' => '7', 'confirm' => true]);
+    expect(mcpAppIsError($deleted))->toBeFalse(mcpAppText($deleted))
+        ->and(ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', 7)->exists())->toBeFalse();
+});
+
+test('manage_preview cannot touch previews of another team', function () {
+    $foreignPreview = ApplicationPreview::create(['application_id' => $this->otherApplication->id, 'pull_request_id' => 3, 'pull_request_html_url' => '', 'fqdn' => 'https://theirs.example.com']);
+    $token = mcpAppToken($this->user, ['write', 'deploy']);
+
+    $create = mcpAppCall($token, 'manage_preview', ['action' => 'create', 'uuid' => $this->otherApplication->uuid, 'data' => ['pull_request_id' => 9, 'git_type' => 'github', 'instant_deploy' => false]]);
+    $update = mcpAppCall($token, 'manage_preview', ['action' => 'update', 'uuid' => $this->otherApplication->uuid, 'pull_request_id' => '3', 'data' => ['domains' => 'https://hijacked.example.com']]);
+    $delete = mcpAppCall($token, 'manage_preview', ['action' => 'delete', 'uuid' => $this->otherApplication->uuid, 'pull_request_id' => '3', 'confirm' => true]);
+
+    expect(mcpAppIsError($create))->toBeTrue()
+        ->and(mcpAppIsError($update))->toBeTrue()
+        ->and(mcpAppIsError($delete))->toBeTrue()
+        ->and(ApplicationPreview::where('application_id', $this->otherApplication->id)->where('pull_request_id', 9)->exists())->toBeFalse()
+        ->and($foreignPreview->fresh())->not->toBeNull()
+        ->and($foreignPreview->fresh()->fqdn)->toBe('https://theirs.example.com');
+});
+
+test('manage_preview rejects read-only tokens', function () {
+    ApplicationPreview::create(['application_id' => $this->application->id, 'pull_request_id' => 4, 'pull_request_html_url' => '']);
+    $token = mcpAppToken($this->user, ['read']);
+
+    expect(mcpAppIsError(mcpAppCall($token, 'manage_preview', ['action' => 'create', 'uuid' => $this->application->uuid, 'data' => ['pull_request_id' => 5, 'git_type' => 'github']])))->toBeTrue()
+        ->and(mcpAppIsError(mcpAppCall($token, 'manage_preview', ['action' => 'delete', 'uuid' => $this->application->uuid, 'pull_request_id' => '4', 'confirm' => true])))->toBeTrue()
+        ->and(ApplicationPreview::where('application_id', $this->application->id)->count())->toBe(1);
+});
+
+test('get_application_preview returns a preview of the token team only', function () {
+    ApplicationPreview::create(['application_id' => $this->application->id, 'pull_request_id' => 12, 'pull_request_html_url' => '', 'fqdn' => 'https://pr12.example.com']);
+    ApplicationPreview::create(['application_id' => $this->otherApplication->id, 'pull_request_id' => 12, 'pull_request_html_url' => '', 'fqdn' => 'https://theirs.example.com']);
+    $token = mcpAppToken($this->user, ['read']);
+
+    $mine = mcpAppCall($token, 'get_application_preview', ['action' => 'get', 'uuid' => $this->application->uuid, 'pull_request_id' => '12']);
+    expect(mcpAppIsError($mine))->toBeFalse(mcpAppText($mine))
+        ->and(mcpAppText($mine))->toContain('pr12.example.com');
+
+    $theirs = mcpAppCall($token, 'get_application_preview', ['action' => 'get', 'uuid' => $this->otherApplication->uuid, 'pull_request_id' => '12']);
+    expect(mcpAppIsError($theirs))->toBeTrue()
+        ->and(mcpAppText($theirs))->not->toContain('theirs.example.com');
+});
+
+test('get_application_preview logs need read:sensitive and stay inside the token team', function () {
+    ApplicationPreview::create(['application_id' => $this->otherApplication->id, 'pull_request_id' => 12, 'pull_request_html_url' => '']);
+
+    $readOnly = mcpAppCall(mcpAppToken($this->user, ['read']), 'get_application_preview', ['action' => 'logs', 'uuid' => $this->application->uuid, 'pull_request_id' => '12']);
+    expect(mcpAppIsError($readOnly))->toBeTrue()
+        ->and(mcpAppText($readOnly))->toContain('read:sensitive');
+
+    $foreign = mcpAppCall(mcpAppToken($this->user, ['read', 'read:sensitive']), 'get_application_preview', ['action' => 'logs', 'uuid' => $this->otherApplication->uuid, 'pull_request_id' => '12']);
+    expect(mcpAppIsError($foreign))->toBeTrue()
+        ->and(mcpAppText($foreign))->toContain('not found');
+    Process::assertNothingRan();
+});
+
+// rollback_application and list_rollback_images
+
+test('rollback_application needs confirm and the deploy ability, then queues a rollback', function () {
+    $writeOnly = mcpAppCall(mcpAppToken($this->user, ['write']), 'rollback_application', ['action' => 'rollback', 'uuid' => $this->application->uuid, 'confirm' => true, 'data' => ['commit' => 'abc1234']]);
+    expect(mcpAppIsError($writeOnly))->toBeTrue()
+        ->and(mcpAppText($writeOnly))->toContain('Tool [rollback_application] not found');
+
+    $deployToken = mcpAppToken($this->user, ['deploy']);
+    $unconfirmed = mcpAppCall($deployToken, 'rollback_application', ['action' => 'rollback', 'uuid' => $this->application->uuid, 'data' => ['commit' => 'abc1234']]);
+    expect(mcpAppIsError($unconfirmed))->toBeTrue()
+        ->and(mcpAppText($unconfirmed))->toContain('confirm=true')
+        ->and(ApplicationDeploymentQueue::count())->toBe(0);
+
+    $queued = mcpAppCall($deployToken, 'rollback_application', ['action' => 'rollback', 'uuid' => $this->application->uuid, 'confirm' => true, 'data' => ['commit' => 'abc1234']]);
+    expect(mcpAppIsError($queued))->toBeFalse(mcpAppText($queued))
+        ->and(ApplicationDeploymentQueue::where('application_id', $this->application->id)->where('commit', 'abc1234')->where('rollback', true)->exists())->toBeTrue();
+});
+
+test('rollback_application cannot roll back an application of another team', function () {
+    $response = mcpAppCall(mcpAppToken($this->user, ['deploy']), 'rollback_application', ['action' => 'rollback', 'uuid' => $this->otherApplication->uuid, 'confirm' => true, 'data' => ['commit' => 'abc1234']]);
+
+    expect(mcpAppIsError($response))->toBeTrue()
+        ->and(ApplicationDeploymentQueue::count())->toBe(0);
+});
+
+test('list_rollback_images lists images for the token team only', function () {
+    $token = mcpAppToken($this->user, ['read']);
+
+    $mine = mcpAppCall($token, 'list_rollback_images', ['action' => 'list', 'uuid' => $this->application->uuid]);
+    expect(mcpAppIsError($mine))->toBeFalse(mcpAppText($mine))
+        ->and(mcpAppText($mine))->toContain('images');
+
+    $theirs = mcpAppCall($token, 'list_rollback_images', ['action' => 'list', 'uuid' => $this->otherApplication->uuid]);
+    expect(mcpAppIsError($theirs))->toBeTrue()
+        ->and(mcpAppText($theirs))->toContain('not found');
+});
diff --git a/tests/Feature/Mcp/McpDataToolsTest.php b/tests/Feature/Mcp/McpDataToolsTest.php
new file mode 100644
index 0000000000..dd96ca9cd9
--- /dev/null
+++ b/tests/Feature/Mcp/McpDataToolsTest.php
@@ -0,0 +1,799 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Once;
+use Illuminate\Support\Str;
+use Spatie\Activitylog\Models\Activity;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::query()->delete();
+    $settings = new InstanceSettings(['is_mcp_server_enabled' => true, 'is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
+    Server::flushIdentityMap();
+    Queue::fake();
+    Process::fake();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->otherTeam = Team::factory()->create();
+    $this->otherUser = User::factory()->create();
+    $this->otherTeam->members()->attach($this->otherUser->id, ['role' => 'owner']);
+
+    $this->mine = mcpDataSeedTeam($this->team);
+    $this->theirs = mcpDataSeedTeam($this->otherTeam);
+
+    session(['currentTeam' => $this->team]);
+});
+
+afterEach(function () {
+    Server::flushIdentityMap();
+});
+
+/**
+ * @return array{server: Server, destination: StandaloneDocker, project: Project, environment: Environment, database: StandalonePostgresql, service: Service, service_app: ServiceApplication, service_db: ServiceDatabase, application: Application}
+ */
+function mcpDataSeedTeam(Team $team): array
+{
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'db-'.$team->id,
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'pg-secret-'.$team->id,
+        'postgres_db' => 'app',
+        'image' => 'postgres:17',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $service = Service::factory()->create([
+        'name' => 'svc-'.$team->id,
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+    ]);
+    $serviceApp = ServiceApplication::create(['uuid' => (string) Str::uuid(), 'name' => 'web', 'service_id' => $service->id, 'image' => 'nginx:alpine']);
+    $serviceDb = ServiceDatabase::create(['uuid' => (string) Str::uuid(), 'name' => 'postgres', 'service_id' => $service->id, 'image' => 'postgres:17']);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    return [
+        'server' => $server,
+        'destination' => $destination,
+        'project' => $project,
+        'environment' => $environment,
+        'database' => $database,
+        'service' => $service,
+        'service_app' => $serviceApp,
+        'service_db' => $serviceDb,
+        'application' => $application,
+    ];
+}
+
+function mcpDataToken(User $user, array $abilities = ['write']): string
+{
+    return $user->createToken('mcp-data', $abilities)->plainTextToken;
+}
+
+function mcpDataCall(string $token, string $tool, array $arguments = [])
+{
+    // Each call authenticates its own token; the guard would otherwise keep the user of the previous call.
+    app('auth')->forgetGuards();
+
+    return test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+        'Accept' => 'application/json, text/event-stream',
+    ])->postJson('/mcp', [
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'tools/call',
+        'params' => ['name' => $tool, 'arguments' => (object) $arguments],
+    ]);
+}
+
+function mcpDataText($response): string
+{
+    return (string) ($response->json('result.content.0.text') ?? $response->json('error.message'));
+}
+
+/**
+ * A tool error (result.isError) or a JSON-RPC error, for example the MCP endpoint rejecting a member token with write abilities.
+ */
+function mcpDataIsError($response): bool
+{
+    return $response->json('result.isError') === true || $response->json('error') !== null;
+}
+
+function mcpDataJson($response): array
+{
+    return json_decode(mcpDataText($response), true) ?? [];
+}
+
+function mcpDataMember(Team $team): User
+{
+    $member = User::factory()->create();
+    $team->members()->attach($member->id, ['role' => 'member']);
+
+    return $member;
+}
+
+function mcpDataDbEnv(StandalonePostgresql $database, string $key, string $value, bool $shownOnce = false): EnvironmentVariable
+{
+    return EnvironmentVariable::create([
+        'key' => $key,
+        'value' => $value,
+        'is_shown_once' => $shownOnce,
+        'resourceable_type' => $database->getMorphClass(),
+        'resourceable_id' => $database->id,
+    ]);
+}
+
+function mcpDataS3(Team $team): S3Storage
+{
+    return S3Storage::create([
+        'name' => 'backups-'.$team->id,
+        'region' => 'us-east-1',
+        'key' => 'AKIADATATEST',
+        'secret' => 's3-secret-'.$team->id,
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+}
+
+// create_database
+
+test('create_database creates a database in the token team and never returns connection URLs', function (array $abilities) {
+    $response = mcpDataCall(mcpDataToken($this->user, $abilities), 'create_database', ['action' => 'postgresql', 'data' => [
+        'project_uuid' => $this->mine['project']->uuid,
+        'environment_uuid' => $this->mine['environment']->uuid,
+        'server_uuid' => $this->mine['server']->uuid,
+        'name' => 'from-mcp',
+        'postgres_password' => 'VeryS3cretPass',
+        'is_public' => true,
+        'public_port' => 15432,
+    ]]);
+
+    expect(mcpDataIsError($response))->toBeFalse();
+    $uuid = mcpDataJson($response)['data']['uuid'];
+    $database = StandalonePostgresql::whereUuid($uuid)->sole();
+    expect($database->name)->toBe('from-mcp')
+        ->and($database->environment_id)->toBe($this->mine['environment']->id)
+        ->and(mcpDataText($response))->not->toContain('VeryS3cretPass')
+        ->and(mcpDataText($response))->not->toContain('internal_db_url')
+        ->and(mcpDataText($response))->not->toContain('external_db_url')
+        ->and(mcpDataText($response))->not->toContain('postgres_password');
+})->with([
+    'write' => [['write']],
+    'root' => [['root']],
+    'write and read:sensitive' => [['write', 'read:sensitive']],
+]);
+
+test('create_database rejects a project, server, or destination of another team', function (string $field) {
+    $own = $this->mine;
+    StandaloneDocker::create(['name' => 'second', 'network' => 'second-net', 'server_id' => $own['server']->id]);
+    $data = [
+        'project_uuid' => $own['project']->uuid,
+        'environment_uuid' => $own['environment']->uuid,
+        'server_uuid' => $own['server']->uuid,
+        'destination_uuid' => $own['destination']->uuid,
+        'name' => 'cross-team',
+    ];
+    $data[$field] = match ($field) {
+        'project_uuid' => $this->theirs['project']->uuid,
+        'environment_uuid' => $this->theirs['environment']->uuid,
+        'server_uuid' => $this->theirs['server']->uuid,
+        'destination_uuid' => $this->theirs['destination']->uuid,
+    };
+
+    $response = mcpDataCall(mcpDataToken($this->user), 'create_database', ['action' => 'postgresql', 'data' => $data]);
+
+    expect(mcpDataIsError($response))->toBeTrue()
+        ->and(StandalonePostgresql::where('name', 'cross-team')->exists())->toBeFalse();
+})->with(['project_uuid', 'environment_uuid', 'server_uuid', 'destination_uuid']);
+
+test('create_database rejects read-only and member tokens, and instant_deploy without deploy', function () {
+    $data = [
+        'project_uuid' => $this->mine['project']->uuid,
+        'environment_uuid' => $this->mine['environment']->uuid,
+        'server_uuid' => $this->mine['server']->uuid,
+        'name' => 'denied',
+    ];
+    $member = mcpDataMember($this->team);
+
+    $read = mcpDataCall(mcpDataToken($this->user, ['read']), 'create_database', ['action' => 'redis', 'data' => $data]);
+    $memberResponse = mcpDataCall(mcpDataToken($member, ['write']), 'create_database', ['action' => 'redis', 'data' => $data]);
+    $instant = mcpDataCall(mcpDataToken($this->user), 'create_database', ['action' => 'redis', 'data' => $data + ['instant_deploy' => true]]);
+
+    expect(mcpDataIsError($read))->toBeTrue()
+        ->and(mcpDataText($read))->toContain('Tool [create_database] not found')
+        ->and(mcpDataIsError($memberResponse))->toBeTrue()
+        ->and(mcpDataIsError($instant))->toBeTrue()
+        ->and(mcpDataText($instant))->toContain('deploy');
+    expect(StandalonePostgresql::where('name', 'denied')->exists())->toBeFalse();
+});
+
+// manage_database
+
+test('manage_database updates a database of the token team', function () {
+    $response = mcpDataCall(mcpDataToken($this->user), 'manage_database', ['action' => 'update', 'uuid' => $this->mine['database']->uuid, 'data' => ['name' => 'renamed']]);
+
+    expect(mcpDataIsError($response))->toBeFalse()
+        ->and($this->mine['database']->fresh()->name)->toBe('renamed');
+});
+
+test('manage_database cannot touch a database of another team', function (string $action, array $data) {
+    $foreign = $this->theirs['database'];
+
+    $response = mcpDataCall(mcpDataToken($this->user, ['write', 'deploy']), 'manage_database', ['action' => $action, 'uuid' => $foreign->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpDataIsError($response))->toBeTrue();
+    $fresh = StandalonePostgresql::withTrashed()->find($foreign->id);
+    expect($fresh->trashed())->toBeFalse()
+        ->and($fresh->name)->toBe($foreign->name)
+        ->and($fresh->environment_id)->toBe($foreign->environment_id)
+        ->and(StandalonePostgresql::count())->toBe(2);
+})->with([
+    'update' => ['update', ['name' => 'hijacked']],
+    'delete' => ['delete', []],
+    'clone' => ['clone', ['destination_uuid' => 'placeholder']],
+    'move' => ['move', ['environment_uuid' => 'placeholder']],
+    'import' => ['import', ['source' => 's3', 's3_storage_uuid' => 'x', 'path' => '/a.sql']],
+]);
+
+test('manage_database rejects a destination, environment, or S3 storage of another team', function () {
+    $own = $this->mine['database'];
+    $token = mcpDataToken($this->user, ['write', 'deploy']);
+    $foreignS3 = mcpDataS3($this->otherTeam);
+
+    $clone = mcpDataCall($token, 'manage_database', ['action' => 'clone', 'uuid' => $own->uuid, 'confirm' => true, 'data' => ['destination_uuid' => $this->theirs['destination']->uuid]]);
+    $move = mcpDataCall($token, 'manage_database', ['action' => 'move', 'uuid' => $own->uuid, 'confirm' => true, 'data' => ['environment_uuid' => $this->theirs['environment']->uuid]]);
+    $import = mcpDataCall($token, 'manage_database', ['action' => 'import', 'uuid' => $own->uuid, 'confirm' => true, 'data' => ['source' => 's3', 's3_storage_uuid' => $foreignS3->uuid, 'path' => '/backup.sql']]);
+
+    expect(mcpDataIsError($clone))->toBeTrue()
+        ->and(mcpDataIsError($move))->toBeTrue()
+        ->and(mcpDataIsError($import))->toBeTrue()
+        ->and(StandalonePostgresql::count())->toBe(2)
+        ->and($own->fresh()->environment_id)->toBe($this->mine['environment']->id)
+        ->and(mcpDataText($import))->not->toContain('s3-secret');
+});
+
+test('manage_database clones to an own destination and moves to an own environment', function () {
+    $own = $this->mine['database'];
+    $token = mcpDataToken($this->user);
+    $target = Environment::factory()->create(['project_id' => $this->mine['project']->id]);
+
+    $clone = mcpDataCall($token, 'manage_database', ['action' => 'clone', 'uuid' => $own->uuid, 'confirm' => true, 'data' => ['destination_uuid' => $this->mine['destination']->uuid, 'name' => 'the-clone']]);
+    $move = mcpDataCall($token, 'manage_database', ['action' => 'move', 'uuid' => $own->uuid, 'confirm' => true, 'data' => ['environment_uuid' => $target->uuid]]);
+
+    expect(mcpDataIsError($clone))->toBeFalse()
+        ->and(StandalonePostgresql::where('name', 'the-clone')->sole()->environment_id)->toBe($this->mine['environment']->id)
+        ->and(mcpDataIsError($move))->toBeFalse()
+        ->and($own->fresh()->environment_id)->toBe($target->id);
+});
+
+test('manage_database destructive actions need confirm=true', function (string $action, array $data) {
+    $own = $this->mine['database'];
+
+    $denied = mcpDataCall(mcpDataToken($this->user, ['write', 'deploy']), 'manage_database', ['action' => $action, 'uuid' => $own->uuid, 'data' => $data]);
+
+    expect(mcpDataIsError($denied))->toBeTrue()
+        ->and(mcpDataText($denied))->toContain('confirm=true')
+        ->and(StandalonePostgresql::count())->toBe(2)
+        ->and($own->fresh())->not->toBeNull();
+})->with([
+    'delete' => ['delete', []],
+    'clone' => ['clone', ['destination_uuid' => 'x']],
+    'move' => ['move', ['environment_uuid' => 'x']],
+    'import' => ['import', ['source' => 'server', 'path' => '/tmp/a.sql']],
+]);
+
+test('manage_database delete with confirm=true deletes an own database', function () {
+    $own = $this->mine['database'];
+
+    $writeOnly = mcpDataCall(mcpDataToken($this->user), 'manage_database', ['action' => 'delete', 'uuid' => $own->uuid, 'confirm' => true]);
+    expect(mcpDataIsError($writeOnly))->toBeTrue()
+        ->and(mcpDataText($writeOnly))->toContain('Missing required permissions: deploy')
+        ->and(StandalonePostgresql::find($own->id))->not->toBeNull();
+
+    $response = mcpDataCall(mcpDataToken($this->user, ['write', 'deploy']), 'manage_database', ['action' => 'delete', 'uuid' => $own->uuid, 'confirm' => true]);
+
+    expect(mcpDataIsError($response))->toBeFalse()
+        ->and(StandalonePostgresql::find($own->id))->toBeNull();
+});
+
+test('manage_database import needs deploy and runs REST validation', function () {
+    $own = $this->mine['database'];
+    $writeOnly = mcpDataToken($this->user);
+
+    foreach ([['source' => 's3', 's3_storage_uuid' => 'x', 'path' => '/a.sql'], ['source' => 'server', 'path' => '/etc/passwd']] as $data) {
+        $denied = mcpDataCall($writeOnly, 'manage_database', ['action' => 'import', 'uuid' => $own->uuid, 'confirm' => true, 'data' => $data]);
+        expect(mcpDataIsError($denied))->toBeTrue()
+            ->and(mcpDataText($denied))->toContain('Missing required permissions: deploy');
+    }
+
+    $invalid = mcpDataCall(mcpDataToken($this->user, ['write', 'deploy']), 'manage_database', ['action' => 'import', 'uuid' => $own->uuid, 'confirm' => true, 'data' => ['source' => 's3']]);
+    expect(mcpDataIsError($invalid))->toBeTrue()
+        ->and(mcpDataText($invalid))->toContain('s3_storage_uuid');
+});
+
+test('manage_database rejects read-only and member tokens', function () {
+    $own = $this->mine['database'];
+    $member = mcpDataMember($this->team);
+
+    $read = mcpDataCall(mcpDataToken($this->user, ['read']), 'manage_database', ['action' => 'update', 'uuid' => $own->uuid, 'data' => ['name' => 'nope']]);
+    $memberResponse = mcpDataCall(mcpDataToken($member, ['read']), 'manage_database', ['action' => 'update', 'uuid' => $own->uuid, 'data' => ['name' => 'nope']]);
+
+    expect(mcpDataIsError($read))->toBeTrue()
+        ->and(mcpDataIsError($memberResponse))->toBeTrue()
+        ->and($own->fresh()->name)->not->toBe('nope');
+});
+
+// get_database_import
+
+test('get_database_import returns an own import and hides imports of other teams', function () {
+    $own = $this->mine['database'];
+    $foreign = $this->theirs['database'];
+    $makeActivity = fn (Team $team, StandalonePostgresql $database): Activity => Activity::create([
+        'log_name' => 'default',
+        'description' => 'import',
+        'properties' => ['team_id' => $team->id, 'type_uuid' => $database->uuid, 'operation' => 'database_import', 'status' => 'finished'],
+    ]);
+    $ownActivity = $makeActivity($this->team, $own);
+    $foreignActivity = $makeActivity($this->otherTeam, $foreign);
+    $token = mcpDataToken($this->user, ['read']);
+
+    $ok = mcpDataCall($token, 'get_database_import', ['action' => 'get', 'resource' => 'database', 'uuid' => $own->uuid, 'activity_id' => (string) $ownActivity->id]);
+    $foreignUuid = mcpDataCall($token, 'get_database_import', ['action' => 'get', 'resource' => 'database', 'uuid' => $foreign->uuid, 'activity_id' => (string) $foreignActivity->id]);
+    $foreignId = mcpDataCall($token, 'get_database_import', ['action' => 'get', 'resource' => 'database', 'uuid' => $own->uuid, 'activity_id' => (string) $foreignActivity->id]);
+
+    expect(mcpDataIsError($ok))->toBeFalse()
+        ->and(mcpDataJson($ok)['data']['status'])->toBe('finished')
+        ->and(mcpDataJson($ok)['data']['output'])->toBeNull()
+        ->and(mcpDataIsError($foreignUuid))->toBeTrue()
+        ->and(mcpDataIsError($foreignId))->toBeTrue();
+});
+
+test('get_database_import rejects a service database of another team', function () {
+    $response = mcpDataCall(mcpDataToken($this->user, ['read']), 'get_database_import', [
+        'action' => 'get',
+        'resource' => 'service_database',
+        'uuid' => $this->mine['service']->uuid,
+        'database_uuid' => $this->theirs['service_db']->uuid,
+        'activity_id' => '1',
+    ]);
+
+    expect(mcpDataIsError($response))->toBeTrue()
+        ->and(mcpDataText($response))->toContain('not found');
+});
+
+// list_service_templates
+
+test('list_service_templates lists template metadata without Compose content', function () {
+    $templates = get_service_templates();
+    $type = (string) $templates->keys()->first();
+
+    $response = mcpDataCall(mcpDataToken($this->user, ['read']), 'list_service_templates', ['search' => $type, 'per_page' => 100]);
+
+    expect(mcpDataIsError($response))->toBeFalse();
+    $items = collect(mcpDataJson($response)['data']);
+    expect($items->pluck('type'))->toContain($type)
+        ->and(array_keys($items->first()))->toEqualCanonicalizing(['type', 'slogan', 'category', 'tags', 'documentation', 'port'])
+        ->and(mcpDataText($response))->not->toContain((string) data_get($templates->get($type), 'compose'));
+});
+
+test('list_service_templates paginates and requires a valid token', function () {
+    $response = mcpDataCall(mcpDataToken($this->user, ['read']), 'list_service_templates', ['per_page' => 2]);
+    $payload = mcpDataJson($response);
+
+    expect($payload['data'])->toHaveCount(2)
+        ->and($payload['_pagination']['total'])->toBe(get_service_templates()->count())
+        ->and($payload['_pagination']['next']['args']['page'])->toBe(2);
+
+    $none = mcpDataCall(mcpDataToken($this->user, []), 'list_service_templates');
+    expect(mcpDataIsError($none))->toBeTrue();
+});
+
+// create_service
+
+test('create_service creates a Compose service in the token team', function () {
+    $response = mcpDataCall(mcpDataToken($this->user), 'create_service', ['action' => 'compose', 'data' => [
+        'project_uuid' => $this->mine['project']->uuid,
+        'environment_uuid' => $this->mine['environment']->uuid,
+        'server_uuid' => $this->mine['server']->uuid,
+        'name' => 'mcp-service',
+        'docker_compose_raw' => base64_encode("services:\n  app:\n    image: nginx:alpine\n"),
+    ]]);
+
+    expect(mcpDataIsError($response))->toBeFalse();
+    $service = Service::whereUuid(mcpDataJson($response)['data']['uuid'])->sole();
+    expect($service->name)->toBe('mcp-service')
+        ->and($service->environment_id)->toBe($this->mine['environment']->id)
+        ->and($service->server_id)->toBe($this->mine['server']->id);
+});
+
+test('create_service rejects a project, server, or destination of another team', function (string $field) {
+    $own = $this->mine;
+    StandaloneDocker::create(['name' => 'second', 'network' => 'second-net', 'server_id' => $own['server']->id]);
+    $data = [
+        'project_uuid' => $own['project']->uuid,
+        'environment_uuid' => $own['environment']->uuid,
+        'server_uuid' => $own['server']->uuid,
+        'destination_uuid' => $own['destination']->uuid,
+        'name' => 'cross-team-service',
+        'docker_compose_raw' => base64_encode("services:\n  app:\n    image: nginx:alpine\n"),
+    ];
+    $data[$field] = match ($field) {
+        'project_uuid' => $this->theirs['project']->uuid,
+        'environment_uuid' => $this->theirs['environment']->uuid,
+        'server_uuid' => $this->theirs['server']->uuid,
+        'destination_uuid' => $this->theirs['destination']->uuid,
+    };
+
+    $response = mcpDataCall(mcpDataToken($this->user), 'create_service', ['action' => 'compose', 'data' => $data]);
+
+    expect(mcpDataIsError($response))->toBeTrue()
+        ->and(Service::where('name', 'cross-team-service')->exists())->toBeFalse();
+})->with(['project_uuid', 'environment_uuid', 'server_uuid', 'destination_uuid']);
+
+test('create_service rejects read-only and member tokens', function () {
+    $data = [
+        'project_uuid' => $this->mine['project']->uuid,
+        'environment_uuid' => $this->mine['environment']->uuid,
+        'server_uuid' => $this->mine['server']->uuid,
+        'name' => 'denied-service',
+        'docker_compose_raw' => base64_encode("services:\n  app:\n    image: nginx:alpine\n"),
+    ];
+
+    $read = mcpDataCall(mcpDataToken($this->user, ['read']), 'create_service', ['action' => 'compose', 'data' => $data]);
+    $member = mcpDataCall(mcpDataToken(mcpDataMember($this->team), ['write']), 'create_service', ['action' => 'compose', 'data' => $data]);
+
+    expect(mcpDataIsError($read))->toBeTrue()
+        ->and(mcpDataIsError($member))->toBeTrue()
+        ->and(Service::where('name', 'denied-service')->exists())->toBeFalse();
+});
+
+// manage_service
+
+test('manage_service updates a service, its application, and its database', function () {
+    $own = $this->mine;
+    $token = mcpDataToken($this->user);
+
+    $service = mcpDataCall($token, 'manage_service', ['action' => 'update', 'uuid' => $own['service']->uuid, 'data' => ['name' => 'renamed-service']]);
+    $app = mcpDataCall($token, 'manage_service', ['action' => 'update_application', 'uuid' => $own['service']->uuid, 'app_uuid' => $own['service_app']->uuid, 'data' => ['human_name' => 'Web']]);
+    $db = mcpDataCall($token, 'manage_service', ['action' => 'update_database', 'uuid' => $own['service']->uuid, 'database_uuid' => $own['service_db']->uuid, 'data' => ['human_name' => 'DB']]);
+
+    expect(mcpDataIsError($service))->toBeFalse()
+        ->and($own['service']->fresh()->name)->toBe('renamed-service')
+        ->and(mcpDataIsError($app))->toBeFalse()
+        ->and($own['service_app']->fresh()->human_name)->toBe('Web')
+        ->and(mcpDataIsError($db))->toBeFalse()
+        ->and($own['service_db']->fresh()->human_name)->toBe('DB');
+});
+
+test('manage_service cannot touch a service of another team', function (string $action, array $data) {
+    $foreign = $this->theirs;
+
+    $response = mcpDataCall(mcpDataToken($this->user, ['write', 'deploy']), 'manage_service', [
+        'action' => $action,
+        'uuid' => $foreign['service']->uuid,
+        'app_uuid' => $foreign['service_app']->uuid,
+        'database_uuid' => $foreign['service_db']->uuid,
+        'confirm' => true,
+        'data' => $data,
+    ]);
+
+    expect(mcpDataIsError($response))->toBeTrue();
+    $fresh = Service::withTrashed()->find($foreign['service']->id);
+    expect($fresh->trashed())->toBeFalse()
+        ->and($fresh->name)->toBe($foreign['service']->name)
+        ->and($fresh->environment_id)->toBe($foreign['environment']->id)
+        ->and($foreign['service_app']->fresh()->human_name)->toBeNull()
+        ->and($foreign['service_db']->fresh()->human_name)->toBeNull()
+        ->and(Service::count())->toBe(2);
+})->with([
+    'update' => ['update', ['name' => 'hijacked']],
+    'delete' => ['delete', []],
+    'clone' => ['clone', ['destination_uuid' => 'placeholder']],
+    'move' => ['move', ['environment_uuid' => 'placeholder']],
+    'update_application' => ['update_application', ['human_name' => 'hijacked']],
+    'update_database' => ['update_database', ['human_name' => 'hijacked']],
+    'import_database' => ['import_database', ['source' => 's3', 's3_storage_uuid' => 'x', 'path' => '/a.sql']],
+]);
+
+test('manage_service cannot reach an application or database of another team through an own service', function () {
+    $token = mcpDataToken($this->user);
+
+    $app = mcpDataCall($token, 'manage_service', ['action' => 'update_application', 'uuid' => $this->mine['service']->uuid, 'app_uuid' => $this->theirs['service_app']->uuid, 'data' => ['human_name' => 'hijacked']]);
+    $db = mcpDataCall($token, 'manage_service', ['action' => 'update_database', 'uuid' => $this->mine['service']->uuid, 'database_uuid' => $this->theirs['service_db']->uuid, 'data' => ['human_name' => 'hijacked']]);
+
+    expect(mcpDataIsError($app))->toBeTrue()
+        ->and(mcpDataIsError($db))->toBeTrue()
+        ->and($this->theirs['service_app']->fresh()->human_name)->toBeNull()
+        ->and($this->theirs['service_db']->fresh()->human_name)->toBeNull();
+});
+
+test('manage_service rejects a destination, environment, or S3 storage of another team', function () {
+    $own = $this->mine;
+    $token = mcpDataToken($this->user, ['write', 'deploy']);
+    $foreignS3 = mcpDataS3($this->otherTeam);
+
+    $clone = mcpDataCall($token, 'manage_service', ['action' => 'clone', 'uuid' => $own['service']->uuid, 'confirm' => true, 'data' => ['destination_uuid' => $this->theirs['destination']->uuid]]);
+    $move = mcpDataCall($token, 'manage_service', ['action' => 'move', 'uuid' => $own['service']->uuid, 'confirm' => true, 'data' => ['environment_uuid' => $this->theirs['environment']->uuid]]);
+    $import = mcpDataCall($token, 'manage_service', ['action' => 'import_database', 'uuid' => $own['service']->uuid, 'database_uuid' => $own['service_db']->uuid, 'confirm' => true, 'data' => ['source' => 's3', 's3_storage_uuid' => $foreignS3->uuid, 'path' => '/a.sql']]);
+
+    expect(mcpDataIsError($clone))->toBeTrue()
+        ->and(mcpDataIsError($move))->toBeTrue()
+        ->and(mcpDataIsError($import))->toBeTrue()
+        ->and(Service::count())->toBe(2)
+        ->and($own['service']->fresh()->environment_id)->toBe($own['environment']->id);
+});
+
+test('manage_service destructive actions need confirm=true', function (string $action) {
+    $own = $this->mine;
+
+    $denied = mcpDataCall(mcpDataToken($this->user, ['write', 'deploy']), 'manage_service', ['action' => $action, 'uuid' => $own['service']->uuid, 'database_uuid' => $own['service_db']->uuid, 'data' => ['destination_uuid' => 'x']]);
+
+    expect(mcpDataIsError($denied))->toBeTrue()
+        ->and(mcpDataText($denied))->toContain('confirm=true')
+        ->and($own['service']->fresh())->not->toBeNull();
+})->with(['delete', 'clone', 'move', 'import_database']);
+
+test('manage_service delete with confirm=true deletes an own service', function () {
+    $writeOnly = mcpDataCall(mcpDataToken($this->user), 'manage_service', ['action' => 'delete', 'uuid' => $this->mine['service']->uuid, 'confirm' => true]);
+    expect(mcpDataIsError($writeOnly))->toBeTrue()
+        ->and(mcpDataText($writeOnly))->toContain('Missing required permissions: deploy')
+        ->and(Service::find($this->mine['service']->id))->not->toBeNull();
+
+    $response = mcpDataCall(mcpDataToken($this->user, ['write', 'deploy']), 'manage_service', ['action' => 'delete', 'uuid' => $this->mine['service']->uuid, 'confirm' => true]);
+
+    expect(mcpDataIsError($response))->toBeFalse()
+        ->and(Service::find($this->mine['service']->id))->toBeNull();
+});
+
+test('manage_service rejects read-only tokens', function () {
+    $response = mcpDataCall(mcpDataToken($this->user, ['read']), 'manage_service', ['action' => 'update', 'uuid' => $this->mine['service']->uuid, 'data' => ['name' => 'nope']]);
+
+    expect(mcpDataIsError($response))->toBeTrue()
+        ->and($this->mine['service']->fresh()->name)->not->toBe('nope');
+});
+
+// manage_env
+
+test('manage_env creates, updates, and deletes variables without returning values', function (string $resource) {
+    $target = match ($resource) {
+        'application' => $this->mine['application'],
+        'database' => $this->mine['database'],
+        'service' => $this->mine['service'],
+    };
+    $token = mcpDataToken($this->user);
+    $env = fn (string $key) => EnvironmentVariable::where('resourceable_type', $target->getMorphClass())->where('resourceable_id', $target->id)->where('key', $key)->where('is_preview', false)->first();
+
+    $create = mcpDataCall($token, 'manage_env', ['action' => 'create', 'resource' => $resource, 'uuid' => $target->uuid, 'data' => ['key' => 'MCP_KEY', 'value' => 'first-secret-value']]);
+    $update = mcpDataCall($token, 'manage_env', ['action' => 'update', 'resource' => $resource, 'uuid' => $target->uuid, 'data' => ['key' => 'MCP_KEY', 'value' => 'second-secret-value']]);
+
+    expect(mcpDataIsError($create))->toBeFalse()
+        ->and(mcpDataIsError($update))->toBeFalse()
+        ->and($env('MCP_KEY')->value)->toBe('second-secret-value');
+    foreach ([$create, $update] as $response) {
+        expect(mcpDataText($response))->not->toContain('secret-value');
+    }
+
+    $uuid = $env('MCP_KEY')->uuid;
+    $denied = mcpDataCall($token, 'manage_env', ['action' => 'delete', 'resource' => $resource, 'uuid' => $target->uuid, 'env_uuid' => $uuid]);
+    expect(mcpDataIsError($denied))->toBeTrue()
+        ->and(mcpDataText($denied))->toContain('confirm=true')
+        ->and($env('MCP_KEY'))->not->toBeNull();
+
+    $deleted = mcpDataCall($token, 'manage_env', ['action' => 'delete', 'resource' => $resource, 'uuid' => $target->uuid, 'env_uuid' => $uuid, 'confirm' => true]);
+    expect(mcpDataIsError($deleted))->toBeFalse()
+        ->and($env('MCP_KEY'))->toBeNull();
+})->with(['application', 'database', 'service']);
+
+test('manage_env bulk updates variables without returning values', function (string $resource) {
+    $target = match ($resource) {
+        'application' => $this->mine['application'],
+        'database' => $this->mine['database'],
+        'service' => $this->mine['service'],
+    };
+
+    $bulk = mcpDataCall(mcpDataToken($this->user), 'manage_env', ['action' => 'bulk_update', 'resource' => $resource, 'uuid' => $target->uuid, 'data' => ['data' => [['key' => 'MCP_BULK', 'value' => 'bulk-secret-value']]]]);
+
+    expect(mcpDataIsError($bulk))->toBeFalse()
+        ->and(mcpDataText($bulk))->not->toContain('bulk-secret-value')
+        ->and(EnvironmentVariable::where('resourceable_type', $target->getMorphClass())->where('resourceable_id', $target->id)->where('key', 'MCP_BULK')->where('is_preview', false)->sole()->value)->toBe('bulk-secret-value');
+})->with(['application', 'database', 'service']);
+
+test('manage_env cannot change variables of another team', function (string $action) {
+    $foreign = $this->theirs['database'];
+    $foreignEnv = mcpDataDbEnv($foreign, 'THEIR_KEY', 'their-value');
+    $token = mcpDataToken($this->user);
+
+    $viaForeignUuid = mcpDataCall($token, 'manage_env', ['action' => $action, 'resource' => 'database', 'uuid' => $foreign->uuid, 'env_uuid' => $foreignEnv->uuid, 'confirm' => true, 'data' => ['key' => 'THEIR_KEY', 'value' => 'hijacked', 'data' => [['key' => 'THEIR_KEY', 'value' => 'hijacked']]]]);
+    $viaOwnUuid = mcpDataCall($token, 'manage_env', ['action' => 'delete', 'resource' => 'database', 'uuid' => $this->mine['database']->uuid, 'env_uuid' => $foreignEnv->uuid, 'confirm' => true]);
+
+    expect(mcpDataIsError($viaForeignUuid))->toBeTrue()
+        ->and(mcpDataIsError($viaOwnUuid))->toBeTrue()
+        ->and($foreignEnv->fresh()->value)->toBe('their-value')
+        ->and(EnvironmentVariable::where('resourceable_id', $foreign->id)->where('resourceable_type', $foreign->getMorphClass())->count())->toBe(1);
+})->with(['create', 'update', 'bulk_update', 'delete']);
+
+test('manage_env rejects read-only and member tokens', function () {
+    $own = $this->mine['database'];
+    $data = ['action' => 'create', 'resource' => 'database', 'uuid' => $own->uuid, 'data' => ['key' => 'DENIED', 'value' => 'x']];
+
+    $read = mcpDataCall(mcpDataToken($this->user, ['read']), 'manage_env', $data);
+    $member = mcpDataCall(mcpDataToken(mcpDataMember($this->team), ['write']), 'manage_env', $data);
+
+    expect(mcpDataIsError($read))->toBeTrue()
+        ->and(mcpDataIsError($member))->toBeTrue()
+        ->and(EnvironmentVariable::where('key', 'DENIED')->exists())->toBeFalse();
+});
+
+// manage_shared_env
+
+test('manage_shared_env creates, updates, and deletes shared variables in the token team', function (string $resource) {
+    $args = match ($resource) {
+        'team' => [],
+        'project' => ['uuid' => $this->mine['project']->uuid],
+        'environment' => ['uuid' => $this->mine['project']->uuid, 'environment_name_or_uuid' => $this->mine['environment']->uuid],
+        'server' => ['uuid' => $this->mine['server']->uuid],
+    };
+    $token = mcpDataToken($this->user);
+
+    $create = mcpDataCall($token, 'manage_shared_env', ['action' => 'create', 'resource' => $resource, 'data' => ['key' => 'SHARED_MCP', 'value' => 'shared-value']] + $args);
+    expect(mcpDataIsError($create))->toBeFalse();
+    $envId = mcpDataJson($create)['data']['id'];
+    expect($envId)->not->toBeNull();
+    $env = SharedEnvironmentVariable::where('key', 'SHARED_MCP')->sole();
+    expect($env->team_id)->toBe($this->team->id)
+        ->and($env->type)->toBe($resource);
+
+    $update = mcpDataCall($token, 'manage_shared_env', ['action' => 'update', 'resource' => $resource, 'env_id' => (string) $envId, 'data' => ['value' => 'updated-value']] + $args);
+    expect(mcpDataIsError($update))->toBeFalse()
+        ->and($env->fresh()->value)->toBe('updated-value')
+        ->and(mcpDataText($update))->not->toContain('updated-value');
+
+    $denied = mcpDataCall($token, 'manage_shared_env', ['action' => 'delete', 'resource' => $resource, 'env_id' => (string) $envId] + $args);
+    expect(mcpDataIsError($denied))->toBeTrue()
+        ->and(mcpDataText($denied))->toContain('confirm=true')
+        ->and($env->fresh())->not->toBeNull();
+
+    $deleted = mcpDataCall($token, 'manage_shared_env', ['action' => 'delete', 'resource' => $resource, 'env_id' => (string) $envId, 'confirm' => true] + $args);
+    expect(mcpDataIsError($deleted))->toBeFalse()
+        ->and(SharedEnvironmentVariable::find($env->id))->toBeNull();
+})->with(['team', 'project', 'environment', 'server']);
+
+test('manage_shared_env cannot create in or change shared variables of another team', function (string $resource) {
+    $foreignArgs = match ($resource) {
+        'team' => [],
+        'project' => ['uuid' => $this->theirs['project']->uuid],
+        'environment' => ['uuid' => $this->theirs['project']->uuid, 'environment_name_or_uuid' => $this->theirs['environment']->uuid],
+        'server' => ['uuid' => $this->theirs['server']->uuid],
+    };
+    $foreignEnv = SharedEnvironmentVariable::create([
+        'key' => 'THEIR_SHARED',
+        'value' => 'their-shared-value',
+        'type' => $resource,
+        'team_id' => $this->otherTeam->id,
+        'project_id' => in_array($resource, ['project', 'environment'], true) ? $this->theirs['project']->id : null,
+        'environment_id' => $resource === 'environment' ? $this->theirs['environment']->id : null,
+        'server_id' => $resource === 'server' ? $this->theirs['server']->id : null,
+    ]);
+    $token = mcpDataToken($this->user);
+
+    $update = mcpDataCall($token, 'manage_shared_env', ['action' => 'update', 'resource' => $resource, 'env_id' => (string) $foreignEnv->id, 'data' => ['value' => 'hijacked']] + $foreignArgs);
+    $delete = mcpDataCall($token, 'manage_shared_env', ['action' => 'delete', 'resource' => $resource, 'env_id' => (string) $foreignEnv->id, 'confirm' => true] + $foreignArgs);
+
+    expect(mcpDataIsError($update))->toBeTrue()
+        ->and(mcpDataIsError($delete))->toBeTrue()
+        ->and($foreignEnv->fresh()->value)->toBe('their-shared-value');
+
+    if ($resource !== 'team') {
+        $create = mcpDataCall($token, 'manage_shared_env', ['action' => 'create', 'resource' => $resource, 'data' => ['key' => 'INJECTED', 'value' => 'x']] + $foreignArgs);
+        expect(mcpDataIsError($create))->toBeTrue()
+            ->and(SharedEnvironmentVariable::where('key', 'INJECTED')->exists())->toBeFalse();
+    }
+})->with(['team', 'project', 'environment', 'server']);
+
+test('manage_shared_env rejects read-only tokens', function () {
+    $response = mcpDataCall(mcpDataToken($this->user, ['read']), 'manage_shared_env', ['action' => 'create', 'resource' => 'team', 'data' => ['key' => 'DENIED_SHARED', 'value' => 'x']]);
+
+    expect(mcpDataIsError($response))->toBeTrue()
+        ->and(SharedEnvironmentVariable::where('key', 'DENIED_SHARED')->exists())->toBeFalse();
+});
+
+// get_env_values
+
+test('get_env_values returns values for an owner token with read:sensitive', function () {
+    $own = $this->mine['database'];
+    mcpDataDbEnv($own, 'DB_VISIBLE', 'visible-value');
+    mcpDataDbEnv($own, 'DB_ONCE', 'shown-once-value', shownOnce: true);
+    SharedEnvironmentVariable::create(['key' => 'TEAM_VISIBLE', 'value' => 'team-value', 'type' => 'team', 'team_id' => $this->team->id]);
+    $token = mcpDataToken($this->user, ['read', 'read:sensitive']);
+
+    $database = mcpDataCall($token, 'get_env_values', ['action' => 'list', 'resource' => 'database', 'uuid' => $own->uuid]);
+    $team = mcpDataCall($token, 'get_env_values', ['action' => 'list', 'resource' => 'team']);
+
+    expect(mcpDataIsError($database))->toBeFalse()
+        ->and(collect(mcpDataJson($database)['data'])->firstWhere('key', 'DB_VISIBLE')['value'])->toBe('visible-value')
+        ->and(mcpDataText($database))->not->toContain('shown-once-value')
+        ->and(mcpDataIsError($team))->toBeFalse()
+        ->and(collect(mcpDataJson($team)['data'])->firstWhere('key', 'TEAM_VISIBLE')['value'])->toBe('team-value');
+});
+
+test('get_env_values never returns values without read:sensitive or to members', function (array $abilities, bool $asMember) {
+    $own = $this->mine['database'];
+    mcpDataDbEnv($own, 'DB_HIDDEN', 'hidden-value');
+    $user = $asMember ? mcpDataMember($this->team) : $this->user;
+
+    $response = mcpDataCall(mcpDataToken($user, $abilities), 'get_env_values', ['action' => 'list', 'resource' => 'database', 'uuid' => $own->uuid]);
+
+    expect(mcpDataIsError($response))->toBeTrue()
+        ->and(mcpDataText($response))->not->toContain('hidden-value');
+})->with([
+    'read token' => [['read'], false],
+    'write token' => [['read', 'write'], false],
+    'member with read:sensitive' => [['read', 'read:sensitive'], true],
+]);
+
+test('get_env_values cannot read variables of another team', function (string $resource) {
+    $foreign = $this->theirs;
+    mcpDataDbEnv($foreign['database'], 'THEIR_DB', 'their-db-value');
+    SharedEnvironmentVariable::create(['key' => 'THEIR_PROJECT', 'value' => 'their-project-value', 'type' => 'project', 'team_id' => $this->otherTeam->id, 'project_id' => $foreign['project']->id]);
+    $args = match ($resource) {
+        'application' => ['uuid' => $foreign['application']->uuid],
+        'database' => ['uuid' => $foreign['database']->uuid],
+        'service' => ['uuid' => $foreign['service']->uuid],
+        'project' => ['uuid' => $foreign['project']->uuid],
+        'environment' => ['uuid' => $foreign['project']->uuid, 'environment_name_or_uuid' => $foreign['environment']->uuid],
+        'server' => ['uuid' => $foreign['server']->uuid],
+    };
+
+    $response = mcpDataCall(mcpDataToken($this->user, ['read', 'read:sensitive']), 'get_env_values', ['action' => 'list', 'resource' => $resource] + $args);
+
+    expect(mcpDataIsError($response))->toBeTrue()
+        ->and(mcpDataText($response))->not->toContain('their-');
+})->with(['application', 'database', 'service', 'project', 'environment', 'server']);
+
+test('get_env_values for the team returns only the token team variables', function () {
+    SharedEnvironmentVariable::create(['key' => 'THEIR_TEAM', 'value' => 'their-team-value', 'type' => 'team', 'team_id' => $this->otherTeam->id]);
+
+    $response = mcpDataCall(mcpDataToken($this->user, ['read', 'read:sensitive']), 'get_env_values', ['action' => 'list', 'resource' => 'team']);
+
+    expect(mcpDataIsError($response))->toBeFalse()
+        ->and(mcpDataText($response))->not->toContain('their-team-value');
+});
diff --git a/tests/Feature/Mcp/McpEndpointTest.php b/tests/Feature/Mcp/McpEndpointTest.php
index f514caea93..b1376df7cf 100644
--- a/tests/Feature/Mcp/McpEndpointTest.php
+++ b/tests/Feature/Mcp/McpEndpointTest.php
@@ -164,7 +164,6 @@ test('MCP endpoint lists tools for an authenticated token', function () {
         'get_service',
         'get_project',
         'list_deployments',
-        'get_logs',
         'list_env_keys',
     );
     expect($toolNames)->not->toContain(
@@ -172,7 +171,61 @@ test('MCP endpoint lists tools for an authenticated token', function () {
         'create_storage',
         'update_storage',
     );
-    expect($toolNames)->toContain('coolify_help', 'control', 'deploy');
+    expect($toolNames)->toContain('coolify_help')
+        ->and($toolNames)->not->toContain('control', 'deploy', 'get_logs', 'manage_project');
+});
+
+test('MCP tools/list shows write tools only to tokens with the ability', function () {
+    $names = fn (array $abilities): array => collect(mcpListTools($this->user->createToken('t', $abilities)->plainTextToken)->assertOk()->json('result.tools'))->pluck('name')->all();
+
+    app('auth')->forgetGuards();
+    $read = $names(['read']);
+    app('auth')->forgetGuards();
+    $deploy = $names(['read', 'deploy']);
+    app('auth')->forgetGuards();
+    $root = $names(['root']);
+
+    expect($read)->not->toContain('control', 'manage_project', 'create_application', 'get_logs', 'get_env_values')
+        ->and($deploy)->toContain('control', 'deploy', 'rollback_application')
+        ->and($deploy)->not->toContain('manage_project', 'get_logs')
+        ->and($root)->toContain('control', 'manage_project', 'get_logs', 'get_env_values')
+        ->and(count($read))->toBeLessThan(count($root));
+});
+
+test('MCP grouped tools only list the actions the token can use', function () {
+    $token = $this->user->createToken('read', ['read'])->plainTextToken;
+
+    $proxy = collect(mcpListTools($token)->json('result.tools'))->firstWhere('name', 'manage_proxy');
+
+    expect($proxy['inputSchema']['properties']['action']['enum'])->toBe(['get']);
+});
+
+test('MCP hidden tools cannot be called', function () {
+    $project = Project::create(['name' => 'Mine', 'team_id' => $this->team->id]);
+    $token = $this->user->createToken('read', ['read'])->plainTextToken;
+
+    $response = mcpCallTool($token, 'manage_project', ['action' => 'delete', 'uuid' => $project->uuid, 'confirm' => true]);
+
+    expect($response->json('error.message'))->toBe('Tool [manage_project] not found.')
+        ->and($project->fresh())->not->toBeNull();
+});
+
+test('MCP tools declare read-only and destructive annotations', function () {
+    $token = $this->user->createToken('mcp-root', ['root'])->plainTextToken;
+
+    $tools = collect(mcpListTools($token)->assertOk()->json('result.tools'))->keyBy('name');
+    $writePrefixes = ['manage_', 'create_', 'rollback_', 'docker_cleanup', 'cloud_provider', 'control', 'deploy', 'cancel_deployment'];
+
+    foreach ($tools as $name => $tool) {
+        $isWriteTool = collect($writePrefixes)->contains(fn (string $prefix): bool => str_starts_with($name, $prefix));
+
+        expect($tool['annotations'])->toHaveKey('readOnlyHint', ! $isWriteTool);
+        if ($isWriteTool) {
+            expect($tool['annotations'])->toHaveKey('destructiveHint', true);
+        }
+    }
+    expect($tools->has('list_projects'))->toBeTrue()
+        ->and($tools->has('manage_project'))->toBeTrue();
 });
 
 test('MCP endpoint accepts the legacy initialize handshake', function () {
@@ -193,6 +246,25 @@ test('MCP endpoint accepts the legacy initialize handshake', function () {
     expect($response->json('result.protocolVersion'))->toBe('2025-06-18');
 });
 
+test('MCP initialize negotiates when the client requests an unsupported protocol version', function () {
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    $response = mcpPost([
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'initialize',
+        'params' => [
+            'protocolVersion' => '2026-07-28',
+            'capabilities' => (object) [],
+            'clientInfo' => ['name' => 'test', 'version' => '1'],
+        ],
+    ], $token);
+
+    $response->assertOk();
+    expect($response->json('error'))->toBeNull();
+    expect($response->json('result.protocolVersion'))->toBe('2025-11-25');
+});
+
 test('MCP endpoint serves 2026-07-28 protocol requests with MCP headers', function () {
     Project::create(['name' => 'Mine', 'team_id' => $this->team->id]);
     $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
diff --git a/tests/Feature/Mcp/McpImproveTest.php b/tests/Feature/Mcp/McpImproveTest.php
index 2847b37e26..62caecfe3a 100644
--- a/tests/Feature/Mcp/McpImproveTest.php
+++ b/tests/Feature/Mcp/McpImproveTest.php
@@ -83,10 +83,12 @@ test('get_logs returns structured next_tools when not running', function () {
 });
 
 test('coolify_help returns essentials catalog', function () {
-    $response = mcpImproveCall('coolify_help', ['intent' => 'essentials']);
+    $response = mcpImproveCall('coolify_help');
     $response->assertOk();
     $body = mcpImproveJson($response);
-    expect($body['data']['catalog']['essentials']['tools'])->toContain('coolify_help', 'control', 'search_resources');
+    expect($body['data']['start_here'])->toContain('search_resources')
+        ->and($body['data']['read_tools'])->toHaveKey('list_applications')
+        ->and($body['data']['change_tools'])->not->toHaveKey('control');
 });
 
 test('list_unhealthy_resources sample_only returns summary', function () {
@@ -107,9 +109,9 @@ test('control requires deploy ability and stop requires confirm', function () {
         'action' => 'start',
         'uuid' => $this->application->uuid,
     ]);
-    expect($denied->json('result.isError'))->toBeTrue();
-    expect($denied->json('result.content.0.text'))->toContain('Missing required permissions');
+    expect($denied->json('error.message'))->toBe('Tool [control] not found.');
 
+    app('auth')->forgetGuards();
     $deployToken = $this->user->createToken('mcp-deploy-stop', ['read', 'deploy'])->plainTextToken;
     $stop = mcpImproveCall('control', [
         'resource' => 'application',
@@ -135,5 +137,6 @@ test('tools list includes coolify_help and control', function () {
     ]);
     $response->assertOk();
     $names = collect($response->json('result.tools'))->pluck('name')->all();
-    expect($names)->toContain('coolify_help', 'control', 'deploy', 'cancel_deployment');
+    expect($names)->toContain('coolify_help')
+        ->and($names)->not->toContain('control', 'deploy', 'cancel_deployment');
 });
diff --git a/tests/Feature/Mcp/McpLogRedactionTest.php b/tests/Feature/Mcp/McpLogRedactionTest.php
new file mode 100644
index 0000000000..2bf6d01c59
--- /dev/null
+++ b/tests/Feature/Mcp/McpLogRedactionTest.php
@@ -0,0 +1,157 @@
+<?php
+
+use App\Actions\Database\RestartDatabase;
+use App\Actions\Service\RestartService;
+use App\Models\Application;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+
+uses(RefreshDatabase::class);
+
+const MCP_LOG_CANARY = 'coolify-canary-mcp-env-value';
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.store' => 'array',
+        'constants.ssh.mux_enabled' => false,
+    ]);
+    $settings = new InstanceSettings(['is_mcp_server_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+    $this->server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    $destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $environment = Project::factory()->create(['team_id' => $this->team->id])->environments()->first();
+    $destinationAttributes = ['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()];
+
+    $this->application = Application::factory()->create(['environment_id' => $environment->id, 'status' => 'running:healthy', ...$destinationAttributes]);
+    $this->service = Service::factory()->create(['environment_id' => $environment->id, 'server_id' => $this->server->id, ...$destinationAttributes]);
+
+    foreach ([$this->application, $this->service] as $resource) {
+        EnvironmentVariable::query()->create([
+            'key' => 'MCP_CANARY',
+            'value' => MCP_LOG_CANARY,
+            'resourceable_type' => $resource->getMorphClass(),
+            'resourceable_id' => $resource->id,
+            'is_preview' => false,
+        ]);
+    }
+});
+
+/**
+ * @param  list<string>  $abilities
+ * @param  array<string, mixed>  $arguments
+ * @return array<string, mixed>
+ */
+function mcpLogRedactionCall(array $abilities, string $tool, array $arguments): array
+{
+    auth()->forgetGuards();
+    $token = test()->user->createToken('mcp-log-redaction', $abilities)->plainTextToken;
+
+    $response = test()->withToken($token)->withHeaders(['Accept' => 'application/json, text/event-stream'])->postJson('/mcp', [
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'tools/call',
+        'params' => ['name' => $tool, 'arguments' => (object) $arguments],
+    ])->assertOk();
+
+    return $response->json();
+}
+
+function fakeMcpApplicationContainer(Closure $logs): void
+{
+    Process::fake(fn ($process) => match (true) {
+        str_contains($process->command, 'docker ps') => Process::result(output: json_encode(['ID' => 'abc123', 'Names' => 'app', 'Labels' => '', 'State' => 'running'])),
+        str_contains($process->command, 'docker inspect') => Process::result(output: json_encode(['State' => ['Status' => 'running']])),
+        str_contains($process->command, 'docker logs') => $logs(),
+        default => Process::result(output: ''),
+    });
+}
+
+it('redacts the application environment values in get_logs output', function () {
+    fakeMcpApplicationContainer(fn () => Process::result(output: 'booted with '.MCP_LOG_CANARY));
+
+    $response = mcpLogRedactionCall(['read', 'read:sensitive'], 'get_logs', ['resource' => 'application', 'uuid' => $this->application->uuid]);
+    $data = json_decode($response['result']['content'][0]['text'], true)['data'];
+
+    expect($data['logs'])->toBe('booted with '.REDACTED)
+        ->and(json_encode($response))->not->toContain(MCP_LOG_CANARY);
+});
+
+it('redacts the application environment values in get_logs error messages', function () {
+    fakeMcpApplicationContainer(fn () => Process::result(errorOutput: 'logs failed near '.MCP_LOG_CANARY, exitCode: 1));
+
+    $response = mcpLogRedactionCall(['read', 'read:sensitive'], 'get_logs', ['resource' => 'application', 'uuid' => $this->application->uuid]);
+    $data = json_decode($response['result']['content'][0]['text'], true)['data'];
+
+    expect($data['reason'])->toBe('log_fetch_failed')
+        ->and($data['message'])->toBe('logs failed near '.REDACTED)
+        ->and(json_encode($response))->not->toContain(MCP_LOG_CANARY);
+});
+
+it('redacts the service environment values in control error messages', function () {
+    RestartService::partialMock()->shouldReceive('handle')->andThrow(new RuntimeException('restart failed near '.MCP_LOG_CANARY));
+
+    $response = mcpLogRedactionCall(['read', 'deploy'], 'control', ['resource' => 'service', 'action' => 'restart', 'uuid' => $this->service->uuid]);
+
+    expect(json_encode($response))->toContain('restart failed near')
+        ->not->toContain(MCP_LOG_CANARY);
+});
+
+it('redacts standalone database passwords in get_logs output and errors', function (bool $fails) {
+    $database = StandalonePostgresql::query()->create([
+        'name' => 'log-redaction-database',
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+        'postgres_password' => 'xy',
+        'status' => 'running:healthy',
+    ]);
+    fakeMcpApplicationContainer(fn () => $fails
+        ? Process::result(errorOutput: 'failed near xy', exitCode: 1)
+        : Process::result(output: 'booted xy'));
+
+    $response = mcpLogRedactionCall(['read', 'read:sensitive'], 'get_logs', ['resource' => 'database', 'uuid' => $database->uuid]);
+    $data = json_decode($response['result']['content'][0]['text'], true)['data'];
+
+    expect($data[$fails ? 'message' : 'logs'])->toBe(($fails ? 'failed near ' : 'booted ').REDACTED);
+})->with([false, true]);
+
+it('redacts standalone database passwords in control error messages', function () {
+    $database = StandalonePostgresql::query()->create([
+        'name' => 'control-redaction-database',
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+        'postgres_password' => 'control-db-password',
+    ]);
+    RestartDatabase::partialMock()->shouldReceive('handle')->andThrow(new RuntimeException('restart failed near control-db-password'));
+
+    $response = mcpLogRedactionCall(['read', 'deploy'], 'control', ['resource' => 'database', 'action' => 'restart', 'uuid' => $database->uuid]);
+
+    expect(json_encode($response))->toContain('restart failed near')
+        ->not->toContain('control-db-password');
+});
diff --git a/tests/Feature/Mcp/McpOperationsToolsTest.php b/tests/Feature/Mcp/McpOperationsToolsTest.php
new file mode 100644
index 0000000000..db2a0c60fb
--- /dev/null
+++ b/tests/Feature/Mcp/McpOperationsToolsTest.php
@@ -0,0 +1,618 @@
+<?php
+
+use App\Actions\Service\DeployServiceApplication;
+use App\Actions\Service\RestartServiceApplication;
+use App\Actions\Service\StopServiceApplication;
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\ScheduledTaskJob;
+use App\Jobs\VolumeBackupJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledTask;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Tag;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    config()->set('cache.default', 'array');
+    Server::flushIdentityMap();
+    Process::fake();
+    InstanceSettings::query()->delete();
+    $settings = new InstanceSettings(['is_mcp_server_enabled' => true, 'is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->own = mcpOpsSeedTeam($this->team);
+
+    $this->otherTeam = Team::factory()->create();
+    $this->otherUser = User::factory()->create();
+    $this->otherTeam->members()->attach($this->otherUser->id, ['role' => 'owner']);
+    $this->other = mcpOpsSeedTeam($this->otherTeam);
+
+    session(['currentTeam' => $this->team]);
+    Queue::fake();
+});
+
+/**
+ * @return array<string, mixed>
+ */
+function mcpOpsSeedTeam(Team $team): array
+{
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $destinationAttributes = [
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ];
+
+    $application = Application::factory()->create($destinationAttributes);
+    $database = StandalonePostgresql::create([
+        'name' => 'ops-postgres-'.$team->id,
+        'image' => 'postgres:17-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'db-password-'.$team->id,
+        'postgres_db' => 'postgres',
+        ...$destinationAttributes,
+    ]);
+    $service = Service::factory()->create($destinationAttributes);
+    $serviceApplication = ServiceApplication::create([
+        'uuid' => new_public_id(),
+        'name' => 'ops-service-app',
+        'image' => 'nginx:alpine',
+        'service_id' => $service->id,
+    ]);
+    $serviceDatabase = ServiceDatabase::create([
+        'uuid' => new_public_id(),
+        'name' => 'ops-service-db',
+        'image' => 'postgres:17-alpine',
+        'service_id' => $service->id,
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => $application->uuid.'-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $s3 = S3Storage::create([
+        'name' => 'ops-s3-'.$team->id,
+        'region' => 'us-east-1',
+        'key' => 'S3KEY'.$team->id,
+        'secret' => 'S3SECRET'.$team->id,
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+
+    return compact('server', 'destination', 'project', 'environment', 'application', 'database', 'service', 'serviceApplication', 'serviceDatabase', 'volume', 's3');
+}
+
+function mcpOpsToken(User $user, array $abilities = ['read', 'write']): string
+{
+    return $user->createToken('mcp-ops', $abilities)->plainTextToken;
+}
+
+function mcpOpsCall(string $token, string $tool, array $arguments = [])
+{
+    auth()->forgetGuards();
+
+    return test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+        'Accept' => 'application/json, text/event-stream',
+    ])->postJson('/mcp', [
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'tools/call',
+        'params' => ['name' => $tool, 'arguments' => (object) $arguments],
+    ]);
+}
+
+function mcpOpsText($response): string
+{
+    return (string) ($response->json('result.content.0.text') ?? $response->json('error.message'));
+}
+
+function mcpOpsIsError($response): bool
+{
+    return $response->json('result.isError') === true || $response->json('error') !== null;
+}
+
+function mcpOpsMember(Team $team): User
+{
+    $member = User::factory()->create();
+    $team->members()->attach($member->id, ['role' => 'member']);
+
+    return $member;
+}
+
+// ---------------------------------------------------------------- control
+
+test('control starts, restarts, and stops a service application and service database of the token team', function () {
+    $token = mcpOpsToken($this->user, ['read', 'deploy']);
+
+    $start = mcpOpsCall($token, 'control', ['resource' => 'service_application', 'action' => 'start', 'service_uuid' => $this->own['service']->uuid, 'uuid' => $this->own['serviceApplication']->uuid]);
+    expect(mcpOpsIsError($start))->toBeFalse()
+        ->and(mcpOpsText($start))->toContain('deploy request queued');
+    DeployServiceApplication::assertPushed();
+
+    $restart = mcpOpsCall($token, 'control', ['resource' => 'service_database', 'action' => 'restart', 'service_uuid' => $this->own['service']->uuid, 'uuid' => $this->own['serviceDatabase']->uuid]);
+    expect(mcpOpsIsError($restart))->toBeFalse()
+        ->and(mcpOpsText($restart))->toContain('restart request queued');
+    RestartServiceApplication::assertPushed();
+
+    $stop = mcpOpsCall($token, 'control', ['resource' => 'service_application', 'action' => 'stop', 'service_uuid' => $this->own['service']->uuid, 'uuid' => $this->own['serviceApplication']->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($stop))->toBeFalse();
+    StopServiceApplication::assertPushed();
+});
+
+test('control rejects service children of another team, also under an own service_uuid', function (string $resource, string $childKey, bool $ownParent) {
+    $token = mcpOpsToken($this->user, ['read', 'deploy']);
+    $parent = $ownParent ? $this->own['service'] : $this->other['service'];
+
+    $response = mcpOpsCall($token, 'control', ['resource' => $resource, 'action' => 'restart', 'service_uuid' => $parent->uuid, 'uuid' => $this->other[$childKey]->uuid]);
+
+    expect(mcpOpsIsError($response))->toBeTrue()
+        ->and(mcpOpsText($response))->toContain('not found');
+    Queue::assertNothingPushed();
+})->with([
+    'foreign app, own service' => ['service_application', 'serviceApplication', true],
+    'foreign app, foreign service' => ['service_application', 'serviceApplication', false],
+    'foreign db, own service' => ['service_database', 'serviceDatabase', true],
+    'foreign db, foreign service' => ['service_database', 'serviceDatabase', false],
+]);
+
+test('control service child stop needs confirm and service_uuid', function () {
+    $token = mcpOpsToken($this->user, ['read', 'deploy']);
+
+    $noConfirm = mcpOpsCall($token, 'control', ['resource' => 'service_application', 'action' => 'stop', 'service_uuid' => $this->own['service']->uuid, 'uuid' => $this->own['serviceApplication']->uuid]);
+    expect(mcpOpsIsError($noConfirm))->toBeTrue()
+        ->and(mcpOpsText($noConfirm))->toContain('confirm=true');
+
+    $noParent = mcpOpsCall($token, 'control', ['resource' => 'service_database', 'action' => 'start', 'uuid' => $this->own['serviceDatabase']->uuid]);
+    expect(mcpOpsIsError($noParent))->toBeTrue()
+        ->and(mcpOpsText($noParent))->toContain('service_uuid');
+
+    Queue::assertNothingPushed();
+});
+
+test('control service child rejects read-only and member tokens', function () {
+    $args = ['resource' => 'service_application', 'action' => 'restart', 'service_uuid' => $this->own['service']->uuid, 'uuid' => $this->own['serviceApplication']->uuid];
+
+    expect(mcpOpsIsError(mcpOpsCall(mcpOpsToken($this->user, ['read', 'write']), 'control', $args)))->toBeTrue();
+    expect(mcpOpsIsError(mcpOpsCall(mcpOpsToken(mcpOpsMember($this->team), ['read', 'deploy']), 'control', $args)))->toBeTrue();
+
+    Queue::assertNothingPushed();
+});
+
+// ---------------------------------------------------------------- deploy by tag
+
+test('deploy by tag deploys only the token team resources with that tag', function () {
+    $ownTag = Tag::create(['name' => 'prod', 'team_id' => $this->team->id]);
+    $this->own['application']->tags()->attach($ownTag->id);
+    $foreignTag = Tag::create(['name' => 'prod', 'team_id' => $this->otherTeam->id]);
+    $this->other['application']->tags()->attach($foreignTag->id);
+
+    $response = mcpOpsCall(mcpOpsToken($this->user, ['read', 'deploy']), 'deploy', ['tag' => 'prod', 'confirm' => true]);
+
+    expect(mcpOpsIsError($response))->toBeFalse()
+        ->and(mcpOpsText($response))->toContain($this->own['application']->uuid)
+        ->and(ApplicationDeploymentQueue::where('application_id', $this->own['application']->id)->count())->toBe(1)
+        ->and(ApplicationDeploymentQueue::where('application_id', $this->other['application']->id)->count())->toBe(0);
+});
+
+test('deploy by a tag that only another team has deploys nothing', function () {
+    $foreignTag = Tag::create(['name' => 'theirs', 'team_id' => $this->otherTeam->id]);
+    $this->other['application']->tags()->attach($foreignTag->id);
+
+    $response = mcpOpsCall(mcpOpsToken($this->user, ['read', 'deploy']), 'deploy', ['tag' => 'theirs', 'confirm' => true]);
+
+    expect(mcpOpsIsError($response))->toBeTrue()
+        ->and(ApplicationDeploymentQueue::count())->toBe(0);
+});
+
+test('deploy by tag needs confirm and exactly one of uuid or tag', function (array $args, string $message) {
+    $tag = Tag::create(['name' => 'prod', 'team_id' => $this->team->id]);
+    $this->own['application']->tags()->attach($tag->id);
+    $args = array_map(fn ($value) => $value === 'APP' ? $this->own['application']->uuid : $value, $args);
+
+    $response = mcpOpsCall(mcpOpsToken($this->user, ['read', 'deploy']), 'deploy', $args);
+
+    expect(mcpOpsIsError($response))->toBeTrue()
+        ->and(mcpOpsText($response))->toContain($message)
+        ->and(ApplicationDeploymentQueue::count())->toBe(0);
+})->with([
+    'no confirm' => [['tag' => 'prod'], 'confirm=true'],
+    'both' => [['tag' => 'prod', 'uuid' => 'APP', 'confirm' => true], 'exactly one'],
+    'neither' => [[], 'exactly one'],
+    'tag with pull request' => [['tag' => 'prod', 'pull_request_id' => 3, 'confirm' => true], 'pull_request_id'],
+]);
+
+test('deploy by tag rejects read-only and member tokens', function () {
+    $tag = Tag::create(['name' => 'prod', 'team_id' => $this->team->id]);
+    $this->own['application']->tags()->attach($tag->id);
+
+    expect(mcpOpsIsError(mcpOpsCall(mcpOpsToken($this->user, ['read', 'write']), 'deploy', ['tag' => 'prod', 'confirm' => true])))->toBeTrue();
+    expect(mcpOpsIsError(mcpOpsCall(mcpOpsToken(mcpOpsMember($this->team), ['read', 'deploy']), 'deploy', ['tag' => 'prod', 'confirm' => true])))->toBeTrue();
+    expect(ApplicationDeploymentQueue::count())->toBe(0);
+});
+
+// ---------------------------------------------------------------- manage_scheduled_task
+
+test('manage_scheduled_task creates, updates, executes, and deletes tasks of the token team', function (string $resource, string $key) {
+    $token = mcpOpsToken($this->user, ['read', 'write', 'deploy']);
+    $owner = $this->own[$key];
+
+    $created = mcpOpsCall($token, 'manage_scheduled_task', ['action' => 'create', 'resource' => $resource, 'uuid' => $owner->uuid, 'data' => ['name' => 'cleanup', 'command' => 'echo SECRETCMD', 'frequency' => 'daily']]);
+    expect(mcpOpsIsError($created))->toBeFalse()
+        ->and(mcpOpsText($created))->not->toContain('SECRETCMD');
+    $task = ScheduledTask::where('name', 'cleanup')->sole();
+    expect($task->team_id)->toBe($this->team->id)
+        ->and($task->{$resource.'_id'})->toBe($owner->id);
+
+    $updated = mcpOpsCall($token, 'manage_scheduled_task', ['action' => 'update', 'resource' => $resource, 'uuid' => $owner->uuid, 'task_uuid' => $task->uuid, 'data' => ['frequency' => 'hourly']]);
+    expect(mcpOpsIsError($updated))->toBeFalse()
+        ->and($task->fresh()->frequency)->toBe('hourly');
+
+    $executed = mcpOpsCall($token, 'manage_scheduled_task', ['action' => 'execute', 'resource' => $resource, 'uuid' => $owner->uuid, 'task_uuid' => $task->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($executed))->toBeFalse();
+    Queue::assertPushed(ScheduledTaskJob::class);
+
+    $deleted = mcpOpsCall($token, 'manage_scheduled_task', ['action' => 'delete', 'resource' => $resource, 'uuid' => $owner->uuid, 'task_uuid' => $task->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($deleted))->toBeFalse()
+        ->and($task->fresh())->toBeNull();
+})->with([
+    'application' => ['application', 'application'],
+    'service' => ['service', 'service'],
+]);
+
+test('manage_scheduled_task cannot reach tasks or resources of another team', function (string $action, bool $ownParent) {
+    $foreignTask = ScheduledTask::factory()->create(['team_id' => $this->otherTeam->id, 'application_id' => $this->other['application']->id, 'name' => 'theirs']);
+    $parent = $ownParent ? $this->own['application'] : $this->other['application'];
+
+    $response = mcpOpsCall(mcpOpsToken($this->user, ['read', 'write', 'deploy']), 'manage_scheduled_task', [
+        'action' => $action, 'resource' => 'application', 'uuid' => $parent->uuid, 'task_uuid' => $foreignTask->uuid,
+        'confirm' => true, 'data' => $action === 'create' ? ['name' => 'evil', 'command' => 'id', 'frequency' => 'daily'] : ($action === 'update' ? ['name' => 'hijacked'] : []),
+    ]);
+
+    expect(mcpOpsIsError($response))->toBeTrue()
+        ->and($foreignTask->fresh()?->name)->toBe('theirs')
+        ->and(ScheduledTask::where('name', 'evil')->exists())->toBeFalse();
+    Queue::assertNotPushed(ScheduledTaskJob::class);
+})->with([
+    'create on foreign app' => ['create', false],
+    'update via own app' => ['update', true],
+    'update via foreign app' => ['update', false],
+    'delete via own app' => ['delete', true],
+    'execute via own app' => ['execute', true],
+    'execute via foreign app' => ['execute', false],
+]);
+
+test('manage_scheduled_task needs confirm for delete and execute and rejects read-only tokens', function () {
+    $task = ScheduledTask::factory()->create(['team_id' => $this->team->id, 'application_id' => $this->own['application']->id]);
+    $token = mcpOpsToken($this->user, ['read', 'write', 'deploy']);
+
+    foreach (['delete', 'execute'] as $action) {
+        $response = mcpOpsCall($token, 'manage_scheduled_task', ['action' => $action, 'resource' => 'application', 'uuid' => $this->own['application']->uuid, 'task_uuid' => $task->uuid]);
+        expect(mcpOpsIsError($response))->toBeTrue()
+            ->and(mcpOpsText($response))->toContain('confirm=true');
+    }
+
+    $readOnly = mcpOpsCall(mcpOpsToken($this->user, ['read']), 'manage_scheduled_task', ['action' => 'execute', 'resource' => 'application', 'uuid' => $this->own['application']->uuid, 'task_uuid' => $task->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($readOnly))->toBeTrue();
+
+    $member = mcpOpsCall(mcpOpsToken(mcpOpsMember($this->team), ['read']), 'manage_scheduled_task', ['action' => 'delete', 'resource' => 'application', 'uuid' => $this->own['application']->uuid, 'task_uuid' => $task->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($member))->toBeTrue();
+
+    expect($task->fresh())->not->toBeNull();
+    Queue::assertNotPushed(ScheduledTaskJob::class);
+});
+
+// ---------------------------------------------------------------- manage_backup
+
+test('manage_backup creates, updates, runs, and deletes a backup schedule of the token team', function () {
+    $token = mcpOpsToken($this->user, ['read', 'write', 'deploy']);
+    $database = $this->own['database'];
+
+    $created = mcpOpsCall($token, 'manage_backup', ['action' => 'create', 'uuid' => $database->uuid, 'data' => ['frequency' => 'daily', 'save_s3' => true, 's3_storage_uuid' => $this->own['s3']->uuid]]);
+    expect(mcpOpsIsError($created))->toBeFalse()
+        ->and(mcpOpsText($created))->not->toContain('S3SECRET')
+        ->and(mcpOpsText($created))->not->toContain('S3KEY');
+    $backup = ScheduledDatabaseBackup::where('database_id', $database->id)->sole();
+    expect($backup->team_id)->toBe($this->team->id)
+        ->and($backup->s3_storage_id)->toBe($this->own['s3']->id);
+
+    $updated = mcpOpsCall($token, 'manage_backup', ['action' => 'update', 'uuid' => $database->uuid, 'scheduled_backup_uuid' => $backup->uuid, 'data' => ['frequency' => 'hourly', 'backup_now' => true]]);
+    expect(mcpOpsIsError($updated))->toBeFalse()
+        ->and($backup->fresh()->frequency)->toBe('hourly');
+    Queue::assertPushed(DatabaseBackupJob::class);
+
+    $execution = ScheduledDatabaseBackupExecution::create(['scheduled_database_backup_id' => $backup->id, 'database_name' => 'postgres', 'status' => 'success']);
+    $deletedExecution = mcpOpsCall($token, 'manage_backup', ['action' => 'delete_execution', 'uuid' => $database->uuid, 'scheduled_backup_uuid' => $backup->uuid, 'execution_uuid' => $execution->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($deletedExecution))->toBeFalse()
+        ->and($execution->fresh())->toBeNull();
+
+    $deleted = mcpOpsCall($token, 'manage_backup', ['action' => 'delete', 'uuid' => $database->uuid, 'scheduled_backup_uuid' => $backup->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($deleted))->toBeFalse()
+        ->and($backup->fresh())->toBeNull();
+});
+
+test('manage_backup rejects an S3 storage of another team', function () {
+    $token = mcpOpsToken($this->user);
+    $database = $this->own['database'];
+
+    $created = mcpOpsCall($token, 'manage_backup', ['action' => 'create', 'uuid' => $database->uuid, 'data' => ['frequency' => 'daily', 'save_s3' => true, 's3_storage_uuid' => $this->other['s3']->uuid]]);
+    expect(mcpOpsIsError($created))->toBeTrue()
+        ->and(ScheduledDatabaseBackup::where('database_id', $database->id)->exists())->toBeFalse();
+
+    $backup = ScheduledDatabaseBackup::create(['team_id' => $this->team->id, 'frequency' => 'daily', 'database_id' => $database->id, 'database_type' => $database->getMorphClass()]);
+    $updated = mcpOpsCall($token, 'manage_backup', ['action' => 'update', 'uuid' => $database->uuid, 'scheduled_backup_uuid' => $backup->uuid, 'data' => ['save_s3' => true, 's3_storage_uuids' => [$this->other['s3']->uuid], 'frequency' => 'hourly']]);
+    expect(mcpOpsIsError($updated))->toBeTrue()
+        ->and($backup->fresh()->s3_storage_id)->toBeNull()
+        ->and($backup->fresh()->frequency)->toBe('daily')
+        ->and($backup->fresh()->s3Storages()->exists())->toBeFalse();
+});
+
+test('manage_backup cannot reach backups of another team', function (string $action, bool $ownParent) {
+    $foreignDatabase = $this->other['database'];
+    $foreignBackup = ScheduledDatabaseBackup::create(['team_id' => $this->otherTeam->id, 'frequency' => 'daily', 'database_id' => $foreignDatabase->id, 'database_type' => $foreignDatabase->getMorphClass()]);
+    $foreignExecution = ScheduledDatabaseBackupExecution::create(['scheduled_database_backup_id' => $foreignBackup->id, 'database_name' => 'postgres', 'status' => 'success']);
+    $parent = $ownParent ? $this->own['database'] : $foreignDatabase;
+
+    $response = mcpOpsCall(mcpOpsToken($this->user), 'manage_backup', [
+        'action' => $action, 'uuid' => $parent->uuid, 'scheduled_backup_uuid' => $foreignBackup->uuid, 'execution_uuid' => $foreignExecution->uuid,
+        'confirm' => true, 'data' => $action === 'delete' || $action === 'delete_execution' ? [] : ['frequency' => 'hourly', 'backup_now' => true],
+    ]);
+
+    expect(mcpOpsIsError($response))->toBeTrue()
+        ->and($foreignBackup->fresh()?->frequency)->toBe('daily')
+        ->and($foreignExecution->fresh())->not->toBeNull()
+        ->and(ScheduledDatabaseBackup::where('team_id', $this->team->id)->exists())->toBeFalse();
+    Queue::assertNotPushed(DatabaseBackupJob::class);
+})->with([
+    'create on foreign db' => ['create', false],
+    'update via own db' => ['update', true],
+    'update via foreign db' => ['update', false],
+    'delete via own db' => ['delete', true],
+    'delete execution via own db' => ['delete_execution', true],
+    'delete execution via foreign db' => ['delete_execution', false],
+]);
+
+test('manage_backup needs confirm for deletes and rejects read-only tokens', function () {
+    $database = $this->own['database'];
+    $backup = ScheduledDatabaseBackup::create(['team_id' => $this->team->id, 'frequency' => 'daily', 'database_id' => $database->id, 'database_type' => $database->getMorphClass()]);
+    $execution = ScheduledDatabaseBackupExecution::create(['scheduled_database_backup_id' => $backup->id, 'database_name' => 'postgres', 'status' => 'success']);
+    $token = mcpOpsToken($this->user);
+
+    foreach (['delete', 'delete_execution'] as $action) {
+        $response = mcpOpsCall($token, 'manage_backup', ['action' => $action, 'uuid' => $database->uuid, 'scheduled_backup_uuid' => $backup->uuid, 'execution_uuid' => $execution->uuid]);
+        expect(mcpOpsIsError($response))->toBeTrue()
+            ->and(mcpOpsText($response))->toContain('confirm=true');
+    }
+
+    $readOnly = mcpOpsCall(mcpOpsToken($this->user, ['read']), 'manage_backup', ['action' => 'create', 'uuid' => $database->uuid, 'data' => ['frequency' => 'daily']]);
+    expect(mcpOpsIsError($readOnly))->toBeTrue()
+        ->and($backup->fresh())->not->toBeNull()
+        ->and($execution->fresh())->not->toBeNull()
+        ->and(ScheduledDatabaseBackup::count())->toBe(1);
+});
+
+// ---------------------------------------------------------------- manage_storage
+
+test('manage_storage creates, updates, and deletes storages of the token team', function () {
+    $token = mcpOpsToken($this->user);
+    $application = $this->own['application'];
+
+    $created = mcpOpsCall($token, 'manage_storage', ['action' => 'create', 'resource' => 'application', 'uuid' => $application->uuid, 'data' => ['type' => 'persistent', 'name' => 'cache', 'mount_path' => '/cache']]);
+    expect(mcpOpsIsError($created))->toBeFalse();
+    $volume = LocalPersistentVolume::where('name', $application->uuid.'-cache')->sole();
+
+    $updated = mcpOpsCall($token, 'manage_storage', ['action' => 'update', 'resource' => 'application', 'uuid' => $application->uuid, 'data' => ['type' => 'persistent', 'uuid' => $volume->uuid, 'mount_path' => '/cache2']]);
+    expect(mcpOpsIsError($updated))->toBeFalse()
+        ->and($volume->fresh()->mount_path)->toBe('/cache2');
+
+    $dbCreated = mcpOpsCall($token, 'manage_storage', ['action' => 'create', 'resource' => 'database', 'uuid' => $this->own['database']->uuid, 'data' => ['type' => 'persistent', 'name' => 'extra', 'mount_path' => '/extra']]);
+    expect(mcpOpsIsError($dbCreated))->toBeFalse();
+
+    $serviceCreated = mcpOpsCall($token, 'manage_storage', ['action' => 'create', 'resource' => 'service', 'uuid' => $this->own['service']->uuid, 'data' => ['type' => 'persistent', 'name' => 'svc', 'mount_path' => '/svc', 'resource_uuid' => $this->own['serviceApplication']->uuid]]);
+    expect(mcpOpsIsError($serviceCreated))->toBeFalse()
+        ->and(LocalPersistentVolume::where('resource_id', $this->own['serviceApplication']->id)->where('mount_path', '/svc')->exists())->toBeTrue();
+
+    $deleted = mcpOpsCall($token, 'manage_storage', ['action' => 'delete', 'resource' => 'application', 'uuid' => $application->uuid, 'storage_uuid' => $volume->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($deleted))->toBeFalse()
+        ->and($volume->fresh())->toBeNull();
+});
+
+test('manage_storage sets, runs, and removes a volume backup without returning S3 secrets', function () {
+    $token = mcpOpsToken($this->user, ['read', 'write', 'deploy']);
+    $args = ['resource' => 'application', 'uuid' => $this->own['application']->uuid, 'storage_uuid' => $this->own['volume']->uuid];
+
+    $set = mcpOpsCall($token, 'manage_storage', [...$args, 'action' => 'set_backup', 'data' => ['frequency' => 'daily', 'save_s3' => true, 's3_storage_uuid' => $this->own['s3']->uuid]]);
+    expect(mcpOpsIsError($set))->toBeFalse()
+        ->and(mcpOpsText($set))->not->toContain('S3SECRET')
+        ->and(mcpOpsText($set))->not->toContain('S3KEY');
+    $backup = ScheduledVolumeBackup::query()->sole();
+    expect($backup->s3_storage_id)->toBe($this->own['s3']->id);
+
+    $run = mcpOpsCall($token, 'manage_storage', [...$args, 'action' => 'run_backup', 'confirm' => true]);
+    expect(mcpOpsIsError($run))->toBeFalse();
+    Queue::assertPushed(VolumeBackupJob::class);
+
+    $removed = mcpOpsCall($token, 'manage_storage', [...$args, 'action' => 'remove_backup', 'confirm' => true]);
+    expect(mcpOpsIsError($removed))->toBeFalse()
+        ->and($backup->fresh())->toBeNull();
+});
+
+test('manage_storage rejects an S3 storage and a service child of another team', function () {
+    $token = mcpOpsToken($this->user);
+
+    $set = mcpOpsCall($token, 'manage_storage', ['action' => 'set_backup', 'resource' => 'application', 'uuid' => $this->own['application']->uuid, 'storage_uuid' => $this->own['volume']->uuid, 'data' => ['frequency' => 'daily', 'save_s3' => true, 's3_storage_uuid' => $this->other['s3']->uuid]]);
+    expect(mcpOpsIsError($set))->toBeTrue()
+        ->and(ScheduledVolumeBackup::query()->exists())->toBeFalse();
+
+    $create = mcpOpsCall($token, 'manage_storage', ['action' => 'create', 'resource' => 'service', 'uuid' => $this->own['service']->uuid, 'data' => ['type' => 'persistent', 'name' => 'evil', 'mount_path' => '/evil', 'resource_uuid' => $this->other['serviceApplication']->uuid]]);
+    expect(mcpOpsIsError($create))->toBeTrue()
+        ->and(LocalPersistentVolume::where('mount_path', '/evil')->exists())->toBeFalse();
+});
+
+test('manage_storage cannot reach storages of another team', function (string $action, bool $ownParent) {
+    $foreignVolume = $this->other['volume'];
+    $foreignVolume->scheduledBackups()->create(['team_id' => $this->otherTeam->id, 'frequency' => 'daily']);
+    $parent = $ownParent ? $this->own['application'] : $this->other['application'];
+
+    $response = mcpOpsCall(mcpOpsToken($this->user, ['read', 'write', 'deploy']), 'manage_storage', [
+        'action' => $action, 'resource' => 'application', 'uuid' => $parent->uuid, 'storage_uuid' => $foreignVolume->uuid, 'confirm' => true,
+        'data' => match ($action) {
+            'create' => ['type' => 'persistent', 'name' => 'evil', 'mount_path' => '/evil'],
+            'update' => ['type' => 'persistent', 'uuid' => $foreignVolume->uuid, 'mount_path' => '/hijacked'],
+            'set_backup' => ['frequency' => 'hourly'],
+            default => [],
+        },
+    ]);
+
+    expect(mcpOpsIsError($response))->toBeTrue()
+        ->and($foreignVolume->fresh()?->mount_path)->toBe('/data')
+        ->and($foreignVolume->scheduledBackups()->sole()->frequency)->toBe('daily')
+        ->and(LocalPersistentVolume::where('mount_path', '/evil')->exists())->toBeFalse();
+    Queue::assertNotPushed(VolumeBackupJob::class);
+})->with([
+    'create on foreign app' => ['create', false],
+    'update via own app' => ['update', true],
+    'update via foreign app' => ['update', false],
+    'delete via own app' => ['delete', true],
+    'set backup via own app' => ['set_backup', true],
+    'run backup via own app' => ['run_backup', true],
+    'run backup via foreign app' => ['run_backup', false],
+    'remove backup via own app' => ['remove_backup', true],
+]);
+
+test('manage_storage needs confirm for delete, remove_backup, and run_backup and rejects read-only tokens', function () {
+    $this->own['volume']->scheduledBackups()->create(['team_id' => $this->team->id, 'frequency' => 'daily']);
+    $args = ['resource' => 'application', 'uuid' => $this->own['application']->uuid, 'storage_uuid' => $this->own['volume']->uuid];
+    $token = mcpOpsToken($this->user, ['read', 'write', 'deploy']);
+
+    foreach (['delete', 'remove_backup', 'run_backup'] as $action) {
+        $response = mcpOpsCall($token, 'manage_storage', [...$args, 'action' => $action]);
+        expect(mcpOpsIsError($response))->toBeTrue()
+            ->and(mcpOpsText($response))->toContain('confirm=true');
+    }
+
+    $readOnly = mcpOpsCall(mcpOpsToken($this->user, ['read']), 'manage_storage', [...$args, 'action' => 'delete', 'confirm' => true]);
+    expect(mcpOpsIsError($readOnly))->toBeTrue()
+        ->and($this->own['volume']->fresh())->not->toBeNull()
+        ->and(ScheduledVolumeBackup::count())->toBe(1);
+    Queue::assertNotPushed(VolumeBackupJob::class);
+});
+
+// ---------------------------------------------------------------- manage_tags
+
+test('manage_tags creates, renames, attaches, detaches, and deletes tags of the token team', function () {
+    $token = mcpOpsToken($this->user);
+
+    $created = mcpOpsCall($token, 'manage_tags', ['action' => 'create', 'data' => ['name' => 'Web']]);
+    expect(mcpOpsIsError($created))->toBeFalse();
+    $tag = Tag::where('team_id', $this->team->id)->where('name', 'web')->sole();
+
+    $renamed = mcpOpsCall($token, 'manage_tags', ['action' => 'update', 'tag_uuid' => $tag->uuid, 'data' => ['name' => 'frontend']]);
+    expect(mcpOpsIsError($renamed))->toBeFalse()
+        ->and($tag->fresh()->name)->toBe('frontend');
+
+    foreach (['application', 'database', 'service'] as $resource) {
+        $attached = mcpOpsCall($token, 'manage_tags', ['action' => 'attach', 'resource' => $resource, 'uuid' => $this->own[$resource]->uuid, 'data' => ['tag_name' => 'frontend']]);
+        expect(mcpOpsIsError($attached))->toBeFalse()
+            ->and($this->own[$resource]->tags()->whereKey($tag->id)->exists())->toBeTrue();
+    }
+
+    $detached = mcpOpsCall($token, 'manage_tags', ['action' => 'detach', 'resource' => 'application', 'uuid' => $this->own['application']->uuid, 'tag_uuid' => $tag->uuid]);
+    expect(mcpOpsIsError($detached))->toBeFalse()
+        ->and($this->own['application']->tags()->whereKey($tag->id)->exists())->toBeFalse();
+
+    $deleted = mcpOpsCall($token, 'manage_tags', ['action' => 'delete', 'tag_uuid' => $tag->uuid, 'confirm' => true]);
+    expect(mcpOpsIsError($deleted))->toBeFalse()
+        ->and($tag->fresh())->toBeNull();
+});
+
+test('manage_tags attach never links a tag of another team', function () {
+    $foreignTag = Tag::create(['name' => 'shared', 'team_id' => $this->otherTeam->id]);
+
+    $response = mcpOpsCall(mcpOpsToken($this->user), 'manage_tags', ['action' => 'attach', 'resource' => 'application', 'uuid' => $this->own['application']->uuid, 'data' => ['tag_name' => 'shared']]);
+
+    expect(mcpOpsIsError($response))->toBeFalse()
+        ->and(mcpOpsText($response))->not->toContain($foreignTag->uuid)
+        ->and($this->own['application']->tags()->whereKey($foreignTag->id)->exists())->toBeFalse()
+        ->and($this->own['application']->tags()->sole()->team_id)->toBe($this->team->id);
+});
+
+test('manage_tags cannot change tags or resources of another team', function (string $action) {
+    $foreignTag = Tag::create(['name' => 'theirs', 'team_id' => $this->otherTeam->id]);
+    $this->other['application']->tags()->attach($foreignTag->id);
+    $ownTag = Tag::create(['name' => 'mine', 'team_id' => $this->team->id]);
+    $this->own['application']->tags()->attach($ownTag->id);
+
+    $args = match ($action) {
+        'update' => ['tag_uuid' => $foreignTag->uuid, 'data' => ['name' => 'hijacked']],
+        'delete' => ['tag_uuid' => $foreignTag->uuid],
+        'attach to foreign app' => ['resource' => 'application', 'uuid' => $this->other['application']->uuid, 'data' => ['tag_name' => 'evil']],
+        'detach foreign tag from own app' => ['resource' => 'application', 'uuid' => $this->own['application']->uuid, 'tag_uuid' => $foreignTag->uuid],
+        'detach from foreign app' => ['resource' => 'application', 'uuid' => $this->other['application']->uuid, 'tag_uuid' => $foreignTag->uuid],
+    };
+    $toolAction = str_starts_with($action, 'attach') ? 'attach' : (str_starts_with($action, 'detach') ? 'detach' : $action);
+
+    $response = mcpOpsCall(mcpOpsToken($this->user), 'manage_tags', ['action' => $toolAction, 'confirm' => true, ...$args]);
+
+    expect(mcpOpsIsError($response))->toBeTrue()
+        ->and($foreignTag->fresh()?->name)->toBe('theirs')
+        ->and($this->other['application']->tags()->whereKey($foreignTag->id)->exists())->toBeTrue()
+        ->and(Tag::where('name', 'evil')->exists())->toBeFalse();
+})->with([
+    'update',
+    'delete',
+    'attach to foreign app',
+    'detach foreign tag from own app',
+    'detach from foreign app',
+]);
+
+test('manage_tags delete needs confirm and write actions reject read-only and member tokens', function () {
+    $tag = Tag::create(['name' => 'mine', 'team_id' => $this->team->id]);
+
+    $noConfirm = mcpOpsCall(mcpOpsToken($this->user), 'manage_tags', ['action' => 'delete', 'tag_uuid' => $tag->uuid]);
+    expect(mcpOpsIsError($noConfirm))->toBeTrue()
+        ->and(mcpOpsText($noConfirm))->toContain('confirm=true');
+
+    $readOnly = mcpOpsCall(mcpOpsToken($this->user, ['read']), 'manage_tags', ['action' => 'create', 'data' => ['name' => 'nope']]);
+    expect(mcpOpsIsError($readOnly))->toBeTrue();
+
+    $member = mcpOpsCall(mcpOpsToken(mcpOpsMember($this->team), ['read', 'write']), 'manage_tags', ['action' => 'create', 'data' => ['name' => 'nope']]);
+    expect(mcpOpsIsError($member))->toBeTrue();
+
+    expect($tag->fresh())->not->toBeNull()
+        ->and(Tag::where('name', 'nope')->exists())->toBeFalse();
+});
diff --git a/tests/Feature/Mcp/McpReadToolsTest.php b/tests/Feature/Mcp/McpReadToolsTest.php
index 618a0b9cb6..155941ffd7 100644
--- a/tests/Feature/Mcp/McpReadToolsTest.php
+++ b/tests/Feature/Mcp/McpReadToolsTest.php
@@ -2,6 +2,8 @@
 
 use App\Jobs\ApplicationDeploymentJob;
 use App\Mcp\Concerns\BuildsResponse;
+use App\Mcp\Servers\CoolifyServer;
+use App\Mcp\Tools\CoolifyHelp;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\ApplicationPreview;
@@ -10,6 +12,7 @@ use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
 use App\Models\InstanceSettings;
 use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledDatabaseBackupExecution;
 use App\Models\ScheduledTask;
@@ -144,7 +147,6 @@ test('tools/list includes new read tools and lifecycle tools', function () {
         'list_resources',
         'list_deployments',
         'get_deployment',
-        'get_logs',
         'list_env_keys',
         'list_storages',
         'list_destinations',
@@ -163,10 +165,8 @@ test('tools/list includes new read tools and lifecycle tools', function () {
         'list_application_previews',
         'list_shared_env_keys',
         'coolify_help',
-        'control',
-        'deploy',
-        'cancel_deployment',
     );
+    expect($names)->not->toContain('control', 'deploy', 'cancel_deployment', 'get_logs');
 });
 
 test('database backup tools scope schedules by database type and id', function () {
@@ -217,6 +217,36 @@ test('database backup tools scope schedules by database type and id', function (
     expect($response->json('result.isError'))->toBeTrue();
 });
 
+test('list_database_backups returns every S3 destination primary first', function () {
+    $postgres = StandalonePostgresql::create([
+        'name' => 'multi-s3-db',
+        'postgres_password' => 'password',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    [$first, $second] = collect(['first', 'second'])->map(fn (string $name) => S3Storage::create([
+        'name' => $name, 'region' => 'us-east-1', 'key' => 'key', 'secret' => 'secret',
+        'bucket' => $name, 'endpoint' => 'https://s3.example.com', 'team_id' => $this->team->id,
+    ]))->all();
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->team->id,
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        's3_storage_id' => $second->id,
+        'database_id' => $postgres->id,
+        'database_type' => $postgres->getMorphClass(),
+    ]);
+    $backup->syncS3Storages([$first->id, $second->id]);
+
+    $response = mcpReadCall('list_database_backups', ['uuid' => $postgres->uuid]);
+    $response->assertOk();
+
+    $listed = mcpReadJson($response)['data']['backups'][0];
+    expect($listed['s3_storage_uuid'])->toBe($second->uuid)
+        ->and($listed['s3_storage_uuids'])->toBe([$second->uuid, $first->uuid]);
+});
+
 test('list_backup_executions omits messages without sensitive read and redacts when included', function () {
     $postgres = StandalonePostgresql::create([
         'name' => 'backup-msg-db',
@@ -1590,9 +1620,7 @@ test('get_logs requires sensitive read ability', function () {
         'uuid' => $this->application->uuid,
     ]);
 
-    $response->assertOk();
-    expect($response->json('result.isError'))->toBeTrue()
-        ->and($response->json('result.content.0.text'))->toContain('read:sensitive');
+    expect($response->json('error.message'))->toBe('Tool [get_logs] not found.');
 });
 
 test('team members cannot retrieve logs with sensitive read ability', function () {
@@ -1665,11 +1693,48 @@ test('get_logs returns structured choices when service has multiple containers',
         ->and(json_encode($body['data']['message'] ?? ''))->not->toContain('"uuid"');
 });
 
-test('coolify_help returns catalog intents', function () {
-    $response = mcpReadCall('coolify_help', ['intent' => 'essentials']);
+test('coolify_help lists only the tools this token can see', function () {
+    $response = mcpReadCall('coolify_help');
     $response->assertOk();
     $body = mcpReadJson($response);
-    expect($body['data']['catalog']['essentials']['tools'])->toContain('search_resources', 'control');
+
+    expect($body['data']['read_tools'])->toHaveKeys(['search_resources', 'list_applications'])
+        ->and($body['data']['read_tools'])->not->toHaveKey('get_logs')
+        ->and($body['data']['change_tools'])->not->toHaveKeys(['control', 'manage_project', 'create_application'])
+        ->and($body['data']['recipes'])->toHaveKey('deploy_app_from_git');
+});
+
+test('coolify_help topic returns recipe steps and marks tools the token cannot use', function () {
+    $body = mcpReadJson(mcpReadCall('coolify_help', ['topic' => 'deploy_app_from_git']));
+    $steps = collect($body['data']['steps'])->keyBy('tool');
+
+    expect($steps['list_projects']['available'])->toBeTrue()
+        ->and($steps['create_application']['available'])->toBeFalse()
+        ->and($steps['create_application']['action'])->toBe('public');
+});
+
+test('coolify_help search filters tools and rejects unknown topics', function () {
+    $body = mcpReadJson(mcpReadCall('coolify_help', ['search' => 'deployment']));
+    expect($body['data']['read_tools'])->toHaveKeys(['list_deployments', 'get_deployment'])
+        ->and($body['data']['read_tools'])->not->toHaveKey('list_servers');
+
+    app('auth')->forgetGuards();
+    $unknown = mcpReadCall('coolify_help', ['topic' => 'nope']);
+    expect($unknown->json('result.isError'))->toBeTrue();
+});
+
+test('coolify_help recipes only name registered tools and actions', function () {
+    $tools = collect(CoolifyServer::TOOLS)->mapWithKeys(fn (string $class) => [app($class)->name() => app($class)]);
+
+    foreach (CoolifyHelp::RECIPES as $recipe) {
+        foreach ($recipe['steps'] as $step) {
+            expect($tools)->toHaveKey($step['tool']);
+            if (isset($step['action'])) {
+                $actions = (new ReflectionMethod($tools[$step['tool']], 'actions'))->invoke($tools[$step['tool']]);
+                expect($actions)->toHaveKey($step['action']);
+            }
+        }
+    }
 });
 
 test('list_unhealthy_resources sample_only returns summary and samples', function () {
@@ -1689,12 +1754,11 @@ test('control and deploy require deploy ability', function () {
         'action' => 'start',
         'uuid' => $this->application->uuid,
     ]);
-    $denied->assertOk();
-    expect($denied->json('result.isError'))->toBeTrue();
-    expect($denied->json('result.content.0.text'))->toContain('Missing required permissions');
+    expect($denied->json('error.message'))->toBe('Tool [control] not found.');
 
+    app('auth')->forgetGuards();
     $deployDenied = mcpReadCall('deploy', ['uuid' => $this->application->uuid]);
-    expect($deployDenied->json('result.isError'))->toBeTrue();
+    expect($deployDenied->json('error.message'))->toBe('Tool [deploy] not found.');
 });
 
 test('control stop requires confirm', function () {
@@ -2485,8 +2549,8 @@ test('redactLogText redacts JSON secret fields in log lines', function () {
         ->and($redacted)->toContain('ok')
         ->and($redacted)->not->toContain('redactme01')
         ->and($redacted)->not->toContain('redactme02')
-        ->and($redacted)->toContain('token=')
-        ->and($redacted)->toContain('API_KEY=')
+        ->and($redacted)->toContain('token')
+        ->and($redacted)->toContain('API_KEY')
         ->and($redacted)->toContain(REDACTED);
 
     // Shell-style still works alongside JSON
diff --git a/tests/Feature/Mcp/McpServerToolsTest.php b/tests/Feature/Mcp/McpServerToolsTest.php
new file mode 100644
index 0000000000..36dafa8f07
--- /dev/null
+++ b/tests/Feature/Mcp/McpServerToolsTest.php
@@ -0,0 +1,883 @@
+<?php
+
+use App\Actions\Destination\RemoveStandaloneDockerNetwork;
+use App\Jobs\DockerCleanupJob;
+use App\Jobs\RestartProxyJob;
+use App\Models\AuditEvent;
+use App\Models\CloudProviderToken;
+use App\Models\DiscordNotificationSettings;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\TelegramNotificationSettings;
+use App\Models\User;
+use App\Services\SentinelMetricsClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+const MCP_SRV_NEW_PRIVATE_KEY = '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAuIzppW7xQGiSHBiMiQxJlsTq+XfUhnrUCHwYbbaLF/QAAAJDAOcCswDnA
+rAAAAAtzc2gtZWQyNTUxOQAAACAuIzppW7xQGiSHBiMiQxJlsTq+XfUhnrUCHwYbbaLF/Q
+AAAECKtKd242pj0qdKWaOpXAQFI2ZGLQOg9vCP2+o+LPLMtS4jOmlbvFAaJIcGIyJDEmWx
+Or5d9SGetQIfBhttosX9AAAACG1jcC10ZXN0AQIDBAU=
+-----END OPENSSH PRIVATE KEY-----';
+
+class McpSrvStubMetricsClient extends SentinelMetricsClient
+{
+    public static int $calls = 0;
+
+    public function summary(): ?array
+    {
+        self::$calls++;
+
+        return [
+            'online' => true, 'cpu' => 42.5, 'memUsed' => 1024, 'memTotal' => 4096,
+            'diskUsed' => 10, 'diskTotal' => 100, 'diskPercent' => 10.0,
+            'load1' => 0.5, 'netRx' => 5.0, 'netTx' => 1.0,
+        ];
+    }
+
+    public function history(string $metric, string $range): array
+    {
+        self::$calls++;
+        if ($metric === 'disk') {
+            throw new RuntimeException('Disk endpoint unavailable.');
+        }
+
+        return [
+            [now()->subHours(3)->getTimestampMs(), 1.0],
+            [now()->subMinutes(10)->getTimestampMs(), $metric === 'cpu' ? 42.5 : 1024.0],
+        ];
+    }
+
+    public function networkHistory(string $range): array
+    {
+        self::$calls++;
+
+        return ['rx' => [[now()->subMinutes(5)->getTimestampMs(), 5.0]], 'tx' => [[now()->subMinutes(5)->getTimestampMs(), 1.0]]];
+    }
+}
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Queue::fake();
+    Process::fake();
+    Storage::fake('ssh-keys');
+    Storage::fake('ssh-mux');
+    Http::preventStrayRequests();
+    config()->set('app.maintenance.store', 'array');
+    config()->set('cache.default', 'array');
+    config()->set('constants.ssh.mux_enabled', false);
+
+    InstanceSettings::query()->delete();
+    $settings = new InstanceSettings(['is_mcp_server_enabled' => true, 'is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->otherTeam = Team::factory()->create();
+    $this->otherUser = User::factory()->create();
+    $this->otherTeam->members()->attach($this->otherUser->id, ['role' => 'owner']);
+
+    $this->key = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->otherKey = PrivateKey::factory()->create(['team_id' => $this->otherTeam->id]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->key->id]);
+    $this->otherServer = Server::factory()->create(['team_id' => $this->otherTeam->id, 'private_key_id' => $this->otherKey->id, 'name' => 'Theirs']);
+
+    session(['currentTeam' => $this->team]);
+});
+
+afterEach(function () {
+    Server::flushIdentityMap();
+});
+
+function mcpSrvToken(User $user, array $abilities = ['read', 'write']): string
+{
+    return $user->createToken('mcp-srv', $abilities)->plainTextToken;
+}
+
+function mcpSrvCall(string $token, string $tool, array $arguments = [])
+{
+    return test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+        'Accept' => 'application/json, text/event-stream',
+    ])->postJson('/mcp', [
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'tools/call',
+        'params' => ['name' => $tool, 'arguments' => (object) $arguments],
+    ]);
+}
+
+function mcpSrvText($response): string
+{
+    return (string) ($response->json('result.content.0.text') ?? $response->json('error.message'));
+}
+
+function mcpSrvIsError($response): bool
+{
+    return $response->json('result.isError') === true || $response->json('error') !== null;
+}
+
+function mcpSrvData($response): mixed
+{
+    return json_decode(mcpSrvText($response), true)['data'] ?? null;
+}
+
+function mcpSrvMakeFunctional(Server $server): void
+{
+    $server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    Server::flushIdentityMap();
+}
+
+function mcpSrvGithubApp(Team $team, PrivateKey $key, array $overrides = []): GithubApp
+{
+    return GithubApp::create(array_merge([
+        'name' => 'gh-'.$team->id,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 1234,
+        'installation_id' => 5678,
+        'client_id' => 'client-id',
+        'client_secret' => 'GH_CLIENT_SECRET_VALUE',
+        'webhook_secret' => 'GH_WEBHOOK_SECRET_VALUE',
+        'private_key_id' => $key->id,
+        'team_id' => $team->id,
+        'is_system_wide' => false,
+    ], $overrides));
+}
+
+function mcpSrvS3(Team $team, array $overrides = []): S3Storage
+{
+    return S3Storage::create(array_merge([
+        'team_id' => $team->id,
+        'name' => 'S3 '.$team->id,
+        'region' => 'us-east-1',
+        'key' => 'S3_ACCESS_KEY_VALUE',
+        'secret' => 'S3_SECRET_KEY_VALUE',
+        'bucket' => 'test-bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'is_usable' => false,
+    ], $overrides));
+}
+
+// ---------------------------------------------------------------- shared checks
+
+test('server group write actions reject read-only tokens', function (string $tool, array $arguments) {
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read']), $tool, $arguments + ['confirm' => true]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->toMatch('/Missing required permissions: (write|deploy)|Tool \[\w+\] not found/');
+})->with([
+    'manage_server create' => ['manage_server', ['action' => 'create', 'data' => ['ip' => '203.0.113.50']]],
+    'manage_proxy restart' => ['manage_proxy', ['action' => 'restart', 'uuid' => 'x']],
+    'docker_cleanup run' => ['docker_cleanup', ['action' => 'run', 'uuid' => 'x']],
+    'manage_destination create' => ['manage_destination', ['action' => 'create', 'server_uuid' => 'x']],
+    'manage_registry create' => ['manage_registry', ['action' => 'create', 'uuid' => 'x']],
+    'manage_private_key create' => ['manage_private_key', ['action' => 'create']],
+    'manage_s3_storage create' => ['manage_s3_storage', ['action' => 'create']],
+    'manage_git_source create' => ['manage_git_source', ['action' => 'create', 'resource' => 'github']],
+    'cloud_provider provision_server' => ['cloud_provider', ['action' => 'provision_server', 'resource' => 'hetzner']],
+    'manage_notifications update' => ['manage_notifications', ['action' => 'update', 'resource' => 'discord']],
+]);
+
+test('server group write actions reject member tokens', function (string $tool, array $arguments) {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    $response = mcpSrvCall(mcpSrvToken($member, ['read', 'write']), $tool, $arguments + ['confirm' => true]);
+
+    expect($response->json('result'))->toBeNull()
+        ->and($response->json('error.message'))->toBe('Missing required team role.');
+})->with([
+    'manage_server update' => ['manage_server', ['action' => 'update', 'data' => ['name' => 'x']]],
+    'manage_private_key create' => ['manage_private_key', ['action' => 'create']],
+    'manage_registry list' => ['manage_registry', ['action' => 'list']],
+    'cloud_provider create_token' => ['cloud_provider', ['action' => 'create_token']],
+    'manage_notifications update' => ['manage_notifications', ['action' => 'update', 'resource' => 'email']],
+]);
+
+test('server group destructive actions need confirm=true', function (string $tool, array $arguments) {
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read', 'write', 'deploy']), $tool, $arguments);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->toContain('requires confirm=true');
+    Queue::assertNothingPushed();
+})->with([
+    'manage_server delete' => ['manage_server', ['action' => 'delete', 'uuid' => 'x']],
+    'manage_proxy update' => ['manage_proxy', ['action' => 'update', 'uuid' => 'x']],
+    'manage_proxy set_configuration' => ['manage_proxy', ['action' => 'set_configuration', 'uuid' => 'x']],
+    'manage_proxy restart' => ['manage_proxy', ['action' => 'restart', 'uuid' => 'x']],
+    'docker_cleanup run' => ['docker_cleanup', ['action' => 'run', 'uuid' => 'x']],
+    'manage_destination delete' => ['manage_destination', ['action' => 'delete', 'uuid' => 'x']],
+    'manage_registry delete' => ['manage_registry', ['action' => 'delete', 'uuid' => 'x', 'registry' => 'ghcr.io']],
+    'manage_private_key delete' => ['manage_private_key', ['action' => 'delete', 'uuid' => 'x']],
+    'manage_s3_storage delete' => ['manage_s3_storage', ['action' => 'delete', 'uuid' => 'x']],
+    'manage_git_source delete' => ['manage_git_source', ['action' => 'delete', 'resource' => 'github', 'source_id' => '1']],
+    'cloud_provider delete_token' => ['cloud_provider', ['action' => 'delete_token', 'uuid' => 'x']],
+    'cloud_provider provision_server' => ['cloud_provider', ['action' => 'provision_server', 'resource' => 'hetzner']],
+]);
+
+// ---------------------------------------------------------------- manage_server
+
+test('manage_server creates a server in the token team with a team private key', function () {
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_server', ['action' => 'create', 'data' => [
+        'name' => 'mcp-server', 'ip' => '203.0.113.50', 'private_key_uuid' => $this->key->uuid,
+    ]]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response));
+    $server = Server::where('name', 'mcp-server')->sole();
+    expect($server->team_id)->toBe($this->team->id)
+        ->and($server->private_key_id)->toBe($this->key->id);
+});
+
+test('manage_server rejects a private key of another team', function () {
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_server', ['action' => 'create', 'data' => [
+        'name' => 'stolen-key', 'ip' => '203.0.113.51', 'private_key_uuid' => $this->otherKey->uuid,
+    ]]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(Server::where('name', 'stolen-key')->exists())->toBeFalse();
+
+    $update = mcpSrvCall(mcpSrvToken($this->user), 'manage_server', ['action' => 'update', 'uuid' => $this->server->uuid, 'data' => ['private_key_uuid' => $this->otherKey->uuid]]);
+    expect(mcpSrvIsError($update))->toBeTrue()
+        ->and($this->server->fresh()->private_key_id)->toBe($this->key->id);
+});
+
+test('manage_server cannot change, validate, or delete a server of another team', function (string $action, array $data) {
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_server', ['action' => $action, 'uuid' => $this->otherServer->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpSrvIsError($response))->toBeTrue();
+    $fresh = Server::find($this->otherServer->id);
+    expect($fresh)->not->toBeNull()->and($fresh->name)->toBe('Theirs');
+    Queue::assertNothingPushed();
+})->with([
+    'update' => ['update', ['name' => 'Hijacked']],
+    'validate' => ['validate', []],
+    'delete' => ['delete', []],
+]);
+
+test('manage_server updates, validates, and deletes its own server', function () {
+    $token = mcpSrvToken($this->user);
+
+    $update = mcpSrvCall($token, 'manage_server', ['action' => 'update', 'uuid' => $this->server->uuid, 'data' => ['name' => 'renamed']]);
+    expect(mcpSrvIsError($update))->toBeFalse(mcpSrvText($update))
+        ->and($this->server->fresh()->name)->toBe('renamed');
+
+    $validate = mcpSrvCall($token, 'manage_server', ['action' => 'validate', 'uuid' => $this->server->uuid]);
+    expect(mcpSrvIsError($validate))->toBeFalse(mcpSrvText($validate));
+
+    $delete = mcpSrvCall($token, 'manage_server', ['action' => 'delete', 'uuid' => $this->server->uuid, 'confirm' => true]);
+    expect(mcpSrvIsError($delete))->toBeFalse(mcpSrvText($delete))
+        ->and(Server::find($this->server->id))->toBeNull();
+});
+
+// ---------------------------------------------------------------- manage_proxy
+
+test('manage_proxy reads and updates the proxy of its own server and queues a restart', function () {
+    $token = mcpSrvToken($this->user, ['read', 'write', 'deploy']);
+
+    $get = mcpSrvCall($token, 'manage_proxy', ['action' => 'get', 'uuid' => $this->server->uuid]);
+    expect(mcpSrvIsError($get))->toBeFalse(mcpSrvText($get))
+        ->and(mcpSrvData($get))->toHaveKey('proxy_type');
+
+    $update = mcpSrvCall($token, 'manage_proxy', ['action' => 'update', 'uuid' => $this->server->uuid, 'confirm' => true, 'data' => ['generate_exact_labels' => true]]);
+    expect(mcpSrvIsError($update))->toBeFalse(mcpSrvText($update))
+        ->and((bool) $this->server->settings()->first()->generate_exact_labels)->toBeTrue();
+
+    $restart = mcpSrvCall($token, 'manage_proxy', ['action' => 'restart', 'uuid' => $this->server->uuid, 'confirm' => true]);
+    expect(mcpSrvIsError($restart))->toBeFalse(mcpSrvText($restart));
+    Queue::assertPushed(RestartProxyJob::class);
+});
+
+test('manage_proxy cannot read or change the proxy of another team', function (string $action, array $data) {
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read', 'write', 'deploy']), 'manage_proxy', ['action' => $action, 'uuid' => $this->otherServer->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and((bool) $this->otherServer->settings()->first()->generate_exact_labels)->toBeFalse();
+    Queue::assertNothingPushed();
+})->with([
+    'get' => ['get', []],
+    'update' => ['update', ['generate_exact_labels' => true]],
+    'set_configuration' => ['set_configuration', ['configuration' => "services:\n  traefik:\n    image: evil\n"]],
+    'restart' => ['restart', []],
+]);
+
+// ---------------------------------------------------------------- docker_cleanup
+
+test('docker_cleanup reads, updates, lists, and runs cleanup on its own server', function () {
+    $token = mcpSrvToken($this->user, ['read', 'write', 'deploy']);
+
+    $get = mcpSrvCall($token, 'docker_cleanup', ['action' => 'get', 'uuid' => $this->server->uuid]);
+    expect(mcpSrvIsError($get))->toBeFalse(mcpSrvText($get))
+        ->and(mcpSrvData($get))->toHaveKey('docker_cleanup_threshold');
+
+    $update = mcpSrvCall($token, 'docker_cleanup', ['action' => 'update', 'uuid' => $this->server->uuid, 'data' => ['docker_cleanup_threshold' => 55]]);
+    expect(mcpSrvIsError($update))->toBeFalse(mcpSrvText($update))
+        ->and((int) $this->server->settings()->first()->docker_cleanup_threshold)->toBe(55);
+
+    $executions = mcpSrvCall($token, 'docker_cleanup', ['action' => 'executions', 'uuid' => $this->server->uuid]);
+    expect(mcpSrvIsError($executions))->toBeFalse(mcpSrvText($executions));
+
+    $run = mcpSrvCall($token, 'docker_cleanup', ['action' => 'run', 'uuid' => $this->server->uuid, 'confirm' => true]);
+    expect(mcpSrvIsError($run))->toBeFalse(mcpSrvText($run));
+    Queue::assertPushed(DockerCleanupJob::class);
+});
+
+test('docker_cleanup cannot touch a server of another team', function (string $action, array $data) {
+    $before = (int) $this->otherServer->settings()->first()->docker_cleanup_threshold;
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read', 'write', 'deploy']), 'docker_cleanup', ['action' => $action, 'uuid' => $this->otherServer->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and((int) $this->otherServer->settings()->first()->docker_cleanup_threshold)->toBe($before);
+    Queue::assertNothingPushed();
+})->with([
+    'get' => ['get', []],
+    'update' => ['update', ['docker_cleanup_threshold' => 12]],
+    'executions' => ['executions', []],
+    'run' => ['run', []],
+]);
+
+// ---------------------------------------------------------------- manage_destination
+
+test('manage_destination creates, renames, and deletes a destination on its own server', function () {
+    $cleanup = Mockery::mock(RemoveStandaloneDockerNetwork::class);
+    $cleanup->shouldReceive('handle')->once();
+    $this->app->instance(RemoveStandaloneDockerNetwork::class, $cleanup);
+    $token = mcpSrvToken($this->user);
+
+    $create = mcpSrvCall($token, 'manage_destination', ['action' => 'create', 'server_uuid' => $this->server->uuid, 'data' => ['network' => 'mcp-net', 'name' => 'mcp-dest']]);
+    expect(mcpSrvIsError($create))->toBeFalse(mcpSrvText($create));
+    $destination = StandaloneDocker::where('network', 'mcp-net')->sole();
+    expect($destination->server_id)->toBe($this->server->id);
+
+    $update = mcpSrvCall($token, 'manage_destination', ['action' => 'update', 'uuid' => $destination->uuid, 'data' => ['name' => 'renamed-dest']]);
+    expect(mcpSrvIsError($update))->toBeFalse(mcpSrvText($update))
+        ->and($destination->fresh()->name)->toBe('renamed-dest');
+
+    $delete = mcpSrvCall($token, 'manage_destination', ['action' => 'delete', 'uuid' => $destination->uuid, 'confirm' => true]);
+    expect(mcpSrvIsError($delete))->toBeFalse(mcpSrvText($delete))
+        ->and($destination->fresh())->toBeNull();
+});
+
+test('manage_destination cannot create a destination on a server of another team', function () {
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_destination', ['action' => 'create', 'server_uuid' => $this->otherServer->uuid, 'data' => ['network' => 'evil-net']]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(StandaloneDocker::where('network', 'evil-net')->exists())->toBeFalse();
+});
+
+test('manage_destination cannot rename or delete a destination of another team', function (string $action, array $data) {
+    $cleanup = Mockery::mock(RemoveStandaloneDockerNetwork::class);
+    $cleanup->shouldNotReceive('handle');
+    $this->app->instance(RemoveStandaloneDockerNetwork::class, $cleanup);
+    $foreign = StandaloneDocker::where('server_id', $this->otherServer->id)->firstOrFail();
+    $name = $foreign->name;
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_destination', ['action' => $action, 'uuid' => $foreign->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and($foreign->fresh())->not->toBeNull()
+        ->and($foreign->fresh()->name)->toBe($name);
+})->with([
+    'update' => ['update', ['name' => 'Hijacked']],
+    'delete' => ['delete', []],
+]);
+
+// ---------------------------------------------------------------- manage_registry
+
+test('manage_registry lists registry logins without passwords', function () {
+    mcpSrvMakeFunctional($this->server);
+    Process::fake(fn () => Process::result(output: json_encode([
+        'auths' => ['ghcr.io' => ['auth' => base64_encode('octocat:REGISTRY_PASSWORD_VALUE')]],
+    ])));
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['root']), 'manage_registry', ['action' => 'list', 'uuid' => $this->server->uuid]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response))
+        ->and(mcpSrvText($response))->toContain('ghcr.io')
+        ->and(mcpSrvText($response))->not->toContain('REGISTRY_PASSWORD_VALUE')
+        ->and(mcpSrvText($response))->not->toContain(base64_encode('octocat:REGISTRY_PASSWORD_VALUE'));
+});
+
+test('manage_registry list needs read:sensitive', function () {
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read', 'write']), 'manage_registry', ['action' => 'list', 'uuid' => $this->server->uuid]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->toContain('read:sensitive');
+});
+
+test('manage_registry logs in on its own server without echoing the password', function () {
+    mcpSrvMakeFunctional($this->server);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read', 'write', 'deploy']), 'manage_registry', ['action' => 'create', 'uuid' => $this->server->uuid, 'data' => [
+        'registry' => 'ghcr.io', 'username' => 'octocat', 'password' => 'REGISTRY_PASSWORD_VALUE',
+    ]]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response))
+        ->and(mcpSrvText($response))->not->toContain('REGISTRY_PASSWORD_VALUE');
+    Process::assertRan(fn ($process) => str_contains(is_array($process->command) ? implode(' ', $process->command) : $process->command, 'docker'));
+});
+
+test('manage_registry cannot touch registries on a server of another team', function (string $action, string $ability, array $extra) {
+    mcpSrvMakeFunctional($this->otherServer);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read', $ability]), 'manage_registry', ['action' => $action, 'uuid' => $this->otherServer->uuid, 'confirm' => true] + $extra);
+
+    expect(mcpSrvIsError($response))->toBeTrue();
+    Process::assertNothingRan();
+})->with([
+    'list' => ['list', 'read:sensitive', []],
+    'create' => ['create', 'write', ['data' => ['registry' => 'ghcr.io', 'username' => 'evil', 'password' => 'x']]],
+    'check' => ['check', 'write', ['registry' => 'ghcr.io']],
+    'delete' => ['delete', 'write', ['registry' => 'ghcr.io']],
+]);
+
+// ---------------------------------------------------------------- manage_private_key
+
+test('manage_private_key never returns key material, even to root and read:sensitive tokens', function (array $abilities) {
+    $token = mcpSrvToken($this->user, $abilities);
+    $keyBody = 'QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi';
+
+    $list = mcpSrvCall($token, 'manage_private_key', ['action' => 'list']);
+    expect(mcpSrvIsError($list))->toBeFalse(mcpSrvText($list))
+        ->and(mcpSrvText($list))->toContain($this->key->uuid)
+        ->and(mcpSrvText($list))->not->toContain('PRIVATE KEY')
+        ->and(mcpSrvText($list))->not->toContain($keyBody)
+        ->and(mcpSrvText($list))->not->toContain($this->otherKey->uuid);
+
+    $get = mcpSrvCall($token, 'manage_private_key', ['action' => 'get', 'uuid' => $this->key->uuid]);
+    expect(mcpSrvIsError($get))->toBeFalse(mcpSrvText($get))
+        ->and(mcpSrvText($get))->not->toContain('PRIVATE KEY')
+        ->and(mcpSrvText($get))->not->toContain($keyBody);
+})->with([
+    'root' => [['root']],
+    'read:sensitive' => [['read', 'read:sensitive']],
+]);
+
+test('manage_private_key create does not return or audit the key material', function () {
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['root']), 'manage_private_key', ['action' => 'create', 'data' => [
+        'name' => 'mcp-key', 'private_key' => MCP_SRV_NEW_PRIVATE_KEY,
+    ]]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response))
+        ->and(mcpSrvText($response))->not->toContain('PRIVATE KEY')
+        ->and(mcpSrvText($response))->not->toContain('AAAECKtKd242pj0qdKWaOpXAQFI2ZGLQOg9vCP2');
+    expect(PrivateKey::where('name', 'mcp-key')->sole()->team_id)->toBe($this->team->id);
+
+    $audit = AuditEvent::query()->get()->toJson();
+    expect($audit)->not->toContain('PRIVATE KEY')
+        ->and($audit)->not->toContain('AAAECKtKd242pj0qdKWaOpXAQFI2ZGLQOg9vCP2');
+});
+
+test('manage_private_key cannot read, change, or delete a key of another team', function (string $action, array $data) {
+    $original = $this->otherKey->fresh()->name;
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['root']), 'manage_private_key', ['action' => $action, 'uuid' => $this->otherKey->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(PrivateKey::find($this->otherKey->id))->not->toBeNull()
+        ->and(PrivateKey::find($this->otherKey->id)->name)->toBe($original);
+})->with([
+    'get' => ['get', []],
+    'update' => ['update', ['name' => 'Hijacked', 'private_key' => MCP_SRV_NEW_PRIVATE_KEY]],
+    'delete' => ['delete', []],
+]);
+
+test('manage_private_key deletes an unused key of its own team', function () {
+    $unused = PrivateKey::create(['team_id' => $this->team->id, 'name' => 'unused', 'private_key' => MCP_SRV_NEW_PRIVATE_KEY]);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_private_key', ['action' => 'delete', 'uuid' => $unused->uuid, 'confirm' => true]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response))
+        ->and(PrivateKey::find($unused->id))->toBeNull();
+});
+
+// ---------------------------------------------------------------- manage_s3_storage
+
+test('manage_s3_storage creates a storage and never returns the secret', function () {
+    $token = mcpSrvToken($this->user, ['root']);
+
+    $create = mcpSrvCall($token, 'manage_s3_storage', ['action' => 'create', 'data' => [
+        'name' => 'mcp-s3', 'endpoint' => 'https://s3.amazonaws.com', 'bucket' => 'mcp-bucket', 'region' => 'us-east-1',
+        'key' => 'S3_ACCESS_KEY_VALUE', 'secret' => 'S3_SECRET_KEY_VALUE',
+    ]]);
+    expect(mcpSrvIsError($create))->toBeFalse(mcpSrvText($create))
+        ->and(mcpSrvText($create))->not->toContain('S3_SECRET_KEY_VALUE');
+    $storage = S3Storage::where('name', 'mcp-s3')->sole();
+    expect($storage->team_id)->toBe($this->team->id);
+
+    foreach ([['action' => 'list'], ['action' => 'get', 'uuid' => $storage->uuid]] as $arguments) {
+        $read = mcpSrvCall($token, 'manage_s3_storage', $arguments);
+        expect(mcpSrvIsError($read))->toBeFalse(mcpSrvText($read))
+            ->and(mcpSrvText($read))->toContain($storage->uuid)
+            ->and(mcpSrvText($read))->not->toContain('S3_SECRET_KEY_VALUE');
+    }
+});
+
+test('manage_s3_storage cannot read, change, test, or delete a storage of another team', function (string $action, array $data) {
+    $foreign = mcpSrvS3($this->otherTeam, ['name' => 'Theirs']);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['root']), 'manage_s3_storage', ['action' => $action, 'uuid' => $foreign->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->not->toContain('S3_SECRET_KEY_VALUE')
+        ->and($foreign->fresh())->not->toBeNull()
+        ->and($foreign->fresh()->name)->toBe('Theirs');
+})->with([
+    'get' => ['get', []],
+    'update' => ['update', ['name' => 'Hijacked']],
+    'validate' => ['validate', []],
+    'delete' => ['delete', []],
+]);
+
+test('manage_s3_storage list does not include storages of another team', function () {
+    $foreign = mcpSrvS3($this->otherTeam);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_s3_storage', ['action' => 'list']);
+
+    expect(mcpSrvIsError($response))->toBeFalse()
+        ->and(mcpSrvText($response))->not->toContain($foreign->uuid);
+});
+
+// ---------------------------------------------------------------- manage_git_source
+
+test('manage_git_source lists apps without client or webhook secrets', function () {
+    $own = mcpSrvGithubApp($this->team, $this->key);
+    $shared = mcpSrvGithubApp($this->otherTeam, $this->otherKey, ['name' => 'shared', 'is_system_wide' => true]);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['root']), 'manage_git_source', ['action' => 'list', 'resource' => 'github']);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response))
+        ->and(mcpSrvText($response))->toContain($own->uuid)
+        ->and(mcpSrvText($response))->not->toContain('GH_CLIENT_SECRET_VALUE')
+        ->and(mcpSrvText($response))->not->toContain('GH_WEBHOOK_SECRET_VALUE')
+        ->and(mcpSrvText($response))->not->toContain('PRIVATE KEY');
+});
+
+test('manage_git_source rejects a GitHub app with a private key of another team', function () {
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_git_source', ['action' => 'create', 'resource' => 'github', 'data' => [
+        'name' => 'stolen', 'html_url' => 'https://github.com', 'app_id' => 1, 'installation_id' => 2,
+        'client_id' => 'id', 'client_secret' => 'secret', 'webhook_secret' => 'hook', 'private_key_uuid' => $this->otherKey->uuid,
+    ]]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(GithubApp::where('name', 'stolen')->exists())->toBeFalse();
+
+    $own = mcpSrvGithubApp($this->team, $this->key);
+    $update = mcpSrvCall(mcpSrvToken($this->user), 'manage_git_source', ['action' => 'update', 'resource' => 'github', 'source_id' => (string) $own->id, 'data' => ['private_key_uuid' => $this->otherKey->uuid]]);
+    expect(mcpSrvIsError($update))->toBeTrue()
+        ->and($own->fresh()->private_key_id)->toBe($this->key->id);
+});
+
+test('manage_git_source cannot change or delete GitHub apps of another team, including system-wide ones', function (bool $systemWide, string $action) {
+    $foreign = mcpSrvGithubApp($this->otherTeam, $this->otherKey, ['name' => 'Theirs', 'is_system_wide' => $systemWide]);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_git_source', ['action' => $action, 'resource' => 'github', 'source_id' => (string) $foreign->id, 'confirm' => true, 'data' => ['name' => 'Hijacked']]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and($foreign->fresh())->not->toBeNull()
+        ->and($foreign->fresh()->name)->toBe('Theirs');
+})->with([
+    'team app' => false,
+    'system-wide app' => true,
+])->with(['update', 'delete']);
+
+test('manage_git_source creates, updates, and deletes a GitLab app without returning secrets', function () {
+    $token = mcpSrvToken($this->user, ['read', 'write']);
+
+    $create = mcpSrvCall($token, 'manage_git_source', ['action' => 'create', 'resource' => 'gitlab', 'data' => [
+        'name' => 'mcp-gitlab', 'html_url' => 'https://gitlab.com', 'client_secret' => 'GL_CLIENT_SECRET_VALUE', 'webhook_token' => 'GL_WEBHOOK_TOKEN_VALUE',
+    ]]);
+    expect(mcpSrvIsError($create))->toBeFalse(mcpSrvText($create))
+        ->and(mcpSrvText($create))->not->toContain('GL_CLIENT_SECRET_VALUE')
+        ->and(mcpSrvText($create))->not->toContain('GL_WEBHOOK_TOKEN_VALUE');
+    $app = GitlabApp::where('name', 'mcp-gitlab')->sole();
+    expect($app->team_id)->toBe($this->team->id);
+
+    $list = mcpSrvCall($token, 'manage_git_source', ['action' => 'list', 'resource' => 'gitlab']);
+    expect(mcpSrvIsError($list))->toBeFalse()
+        ->and(mcpSrvText($list))->not->toContain('GL_CLIENT_SECRET_VALUE')
+        ->and(mcpSrvText($list))->not->toContain('GL_WEBHOOK_TOKEN_VALUE');
+    $sourceId = collect(mcpSrvData($list))->firstWhere('name', 'mcp-gitlab')['id'];
+    expect($sourceId)->not->toBeNull();
+
+    $update = mcpSrvCall($token, 'manage_git_source', ['action' => 'update', 'resource' => 'gitlab', 'source_id' => (string) $sourceId, 'data' => ['name' => 'renamed-gitlab']]);
+    expect(mcpSrvIsError($update))->toBeFalse(mcpSrvText($update))
+        ->and(mcpSrvText($update))->not->toContain('GL_CLIENT_SECRET_VALUE')
+        ->and(mcpSrvText($update))->not->toContain('GL_WEBHOOK_TOKEN_VALUE')
+        ->and($app->fresh()->name)->toBe('renamed-gitlab');
+
+    $delete = mcpSrvCall($token, 'manage_git_source', ['action' => 'delete', 'resource' => 'gitlab', 'source_id' => (string) $sourceId, 'confirm' => true]);
+    expect(mcpSrvIsError($delete))->toBeFalse(mcpSrvText($delete))
+        ->and(GitlabApp::find($app->id))->toBeNull();
+});
+
+test('manage_git_source cannot change or delete a GitLab app of another team', function (string $action) {
+    $foreign = GitlabApp::create(['name' => 'Theirs', 'html_url' => 'https://gitlab.com', 'api_url' => 'https://gitlab.com/api/v4', 'team_id' => $this->otherTeam->id]);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_git_source', ['action' => $action, 'resource' => 'gitlab', 'source_id' => (string) $foreign->id, 'confirm' => true, 'data' => ['name' => 'Hijacked']]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and($foreign->fresh())->not->toBeNull()
+        ->and($foreign->fresh()->name)->toBe('Theirs');
+})->with(['update', 'delete']);
+
+test('manage_git_source requires a known resource', function () {
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'manage_git_source', ['action' => 'list', 'resource' => 'bitbucket']);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->toContain('resource must be one of: github, gitlab');
+});
+
+// ---------------------------------------------------------------- cloud_provider
+
+test('cloud_provider adds and lists tokens without returning the token value', function () {
+    Http::fake(['https://api.hetzner.cloud/v1/servers' => Http::response([], 200)]);
+    $token = mcpSrvToken($this->user, ['root']);
+
+    $create = mcpSrvCall($token, 'cloud_provider', ['action' => 'create_token', 'data' => ['provider' => 'hetzner', 'token' => 'HETZNER_TOKEN_VALUE', 'name' => 'mcp-hetzner']]);
+    expect(mcpSrvIsError($create))->toBeFalse(mcpSrvText($create))
+        ->and(mcpSrvText($create))->not->toContain('HETZNER_TOKEN_VALUE');
+    $stored = CloudProviderToken::where('name', 'mcp-hetzner')->sole();
+    expect($stored->team_id)->toBe($this->team->id);
+
+    foreach ([['action' => 'list_tokens'], ['action' => 'get_token', 'uuid' => $stored->uuid]] as $arguments) {
+        $read = mcpSrvCall($token, 'cloud_provider', $arguments);
+        expect(mcpSrvIsError($read))->toBeFalse(mcpSrvText($read))
+            ->and(mcpSrvText($read))->toContain($stored->uuid)
+            ->and(mcpSrvText($read))->not->toContain('HETZNER_TOKEN_VALUE');
+    }
+});
+
+test('cloud_provider cannot read, change, validate, or delete a token of another team', function (string $action, array $data) {
+    Http::fake();
+    $foreign = CloudProviderToken::create(['team_id' => $this->otherTeam->id, 'provider' => 'hetzner', 'token' => 'FOREIGN_TOKEN_VALUE', 'name' => 'Theirs']);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['root']), 'cloud_provider', ['action' => $action, 'uuid' => $foreign->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->not->toContain('FOREIGN_TOKEN_VALUE')
+        ->and($foreign->fresh())->not->toBeNull()
+        ->and($foreign->fresh()->name)->toBe('Theirs');
+    Http::assertNothingSent();
+})->with([
+    'get_token' => ['get_token', []],
+    'update_token' => ['update_token', ['name' => 'Hijacked']],
+    'validate_token' => ['validate_token', []],
+    'delete_token' => ['delete_token', []],
+]);
+
+test('cloud_provider reads a catalog with a token of its own team', function () {
+    Http::fake(['https://api.hetzner.cloud/v1/locations*' => Http::response([
+        'locations' => [['id' => 1, 'name' => 'nbg1', 'description' => 'Nuremberg', 'country' => 'DE', 'city' => 'Nuremberg']],
+        'meta' => ['pagination' => ['next_page' => null]],
+    ], 200)]);
+    $cloudToken = CloudProviderToken::create(['team_id' => $this->team->id, 'provider' => 'hetzner', 'token' => 'OWN_TOKEN_VALUE', 'name' => 'Mine']);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'cloud_provider', ['action' => 'catalog', 'resource' => 'hetzner_locations', 'data' => ['cloud_provider_token_uuid' => $cloudToken->uuid]]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response))
+        ->and(mcpSrvText($response))->toContain('nbg1')
+        ->and(mcpSrvText($response))->not->toContain('OWN_TOKEN_VALUE');
+});
+
+test('cloud_provider cannot use a token of another team for catalogs or provisioning', function (string $action, string $resource, array $data) {
+    Http::fake();
+    $foreign = CloudProviderToken::create(['team_id' => $this->otherTeam->id, 'provider' => 'hetzner', 'token' => 'FOREIGN_TOKEN_VALUE', 'name' => 'Theirs']);
+    $serverCount = Server::count();
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'cloud_provider', ['action' => $action, 'resource' => $resource, 'confirm' => true, 'data' => ['cloud_provider_token_uuid' => $foreign->uuid] + $data]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(Server::count())->toBe($serverCount);
+    Http::assertNothingSent();
+})->with([
+    'catalog' => ['catalog', 'hetzner_server_types', []],
+    'provision' => ['provision_server', 'hetzner', ['location' => 'nbg1', 'server_type' => 'cx22', 'image' => 1, 'name' => 'evil']],
+]);
+
+test('cloud_provider provisioning rejects a private key of another team', function () {
+    Http::fake();
+    $cloudToken = CloudProviderToken::create(['team_id' => $this->team->id, 'provider' => 'hetzner', 'token' => 'OWN_TOKEN_VALUE', 'name' => 'Mine']);
+    $serverCount = Server::count();
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'cloud_provider', ['action' => 'provision_server', 'resource' => 'hetzner', 'confirm' => true, 'data' => [
+        'cloud_provider_token_uuid' => $cloudToken->uuid, 'private_key_uuid' => $this->otherKey->uuid,
+        'location' => 'nbg1', 'server_type' => 'cx22', 'image' => 1, 'name' => 'evil',
+    ]]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(Server::count())->toBe($serverCount);
+    Http::assertNothingSent();
+});
+
+test('cloud_provider provisioning a Hostinger VPS with a post-install script or extra SSH keys needs deploy', function (array $extra) {
+    Http::fake();
+    $cloudToken = CloudProviderToken::create(['team_id' => $this->team->id, 'provider' => 'hostinger', 'token' => 'OWN_TOKEN_VALUE', 'name' => 'Mine']);
+    $serverCount = Server::count();
+
+    $response = mcpSrvCall(mcpSrvToken($this->user), 'cloud_provider', ['action' => 'provision_server', 'resource' => 'hostinger', 'confirm' => true, 'data' => [
+        'cloud_provider_token_uuid' => $cloudToken->uuid, 'private_key_uuid' => $this->key->uuid,
+        'item_id' => 'hostingercom-vps-kvm1-usd-1m', 'data_center_id' => 19, 'template_id' => 1130,
+        ...$extra,
+    ]]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->toContain('Missing required permissions: deploy')
+        ->and(Server::count())->toBe($serverCount);
+    Http::assertNothingSent();
+})->with([
+    'post-install script' => [['post_install_script_id' => 73]],
+    'extra SSH keys' => [['public_key_ids' => [42]]],
+]);
+
+// ---------------------------------------------------------------- manage_notifications
+
+test('manage_notifications updates a channel of the token team and never returns webhook URLs or tokens', function () {
+    $token = mcpSrvToken($this->user, ['root']);
+    $otherSettings = DiscordNotificationSettings::query()->firstOrCreate(['team_id' => $this->otherTeam->id]);
+
+    $update = mcpSrvCall($token, 'manage_notifications', ['action' => 'update', 'resource' => 'discord', 'data' => [
+        'discord_enabled' => true, 'discord_webhook_url' => 'https://discord.com/api/webhooks/123/DISCORD_WEBHOOK_SECRET',
+    ]]);
+    expect(mcpSrvIsError($update))->toBeFalse(mcpSrvText($update))
+        ->and(mcpSrvText($update))->not->toContain('DISCORD_WEBHOOK_SECRET');
+
+    expect(DiscordNotificationSettings::where('team_id', $this->team->id)->sole()->discord_webhook_url)->toContain('DISCORD_WEBHOOK_SECRET')
+        ->and($otherSettings->fresh()->discord_webhook_url)->toBeNull();
+
+    $get = mcpSrvCall($token, 'manage_notifications', ['action' => 'get', 'resource' => 'discord']);
+    expect(mcpSrvIsError($get))->toBeFalse(mcpSrvText($get))
+        ->and(mcpSrvText($get))->toContain('discord_enabled')
+        ->and(mcpSrvText($get))->not->toContain('DISCORD_WEBHOOK_SECRET');
+});
+
+test('manage_notifications never returns channel secrets', function (string $channel, array $data, string $secret) {
+    $token = mcpSrvToken($this->user, ['root']);
+
+    $update = mcpSrvCall($token, 'manage_notifications', ['action' => 'update', 'resource' => $channel, 'data' => $data]);
+    expect(mcpSrvIsError($update))->toBeFalse(mcpSrvText($update))
+        ->and(mcpSrvText($update))->not->toContain($secret);
+
+    $get = mcpSrvCall($token, 'manage_notifications', ['action' => 'get', 'resource' => $channel]);
+    expect(mcpSrvIsError($get))->toBeFalse(mcpSrvText($get))
+        ->and(mcpSrvText($get))->not->toContain($secret);
+})->with([
+    'email smtp password' => ['email', ['smtp_password' => 'SMTP_PASSWORD_VALUE', 'resend_api_key' => 'RESEND_KEY_VALUE'], 'SMTP_PASSWORD_VALUE'],
+    'email resend key' => ['email', ['resend_api_key' => 'RESEND_KEY_VALUE'], 'RESEND_KEY_VALUE'],
+    'slack webhook' => ['slack', ['slack_webhook_url' => 'https://hooks.slack.com/services/SLACK_SECRET_PATH'], 'SLACK_SECRET_PATH'],
+    'telegram token' => ['telegram', ['telegram_token' => 'TELEGRAM_TOKEN_VALUE', 'telegram_chat_id' => '123'], 'TELEGRAM_TOKEN_VALUE'],
+    'pushover keys' => ['pushover', ['pushover_user_key' => 'PUSHOVER_USER_VALUE', 'pushover_api_token' => 'PUSHOVER_TOKEN_VALUE'], 'PUSHOVER_'],
+    'webhook url' => ['webhook', ['webhook_url' => 'https://example.com/hook/WEBHOOK_SECRET_PATH'], 'WEBHOOK_SECRET_PATH'],
+]);
+
+test('manage_notifications only changes the token team', function () {
+    TelegramNotificationSettings::query()->firstOrCreate(['team_id' => $this->otherTeam->id]);
+    $sessionSwitch = Team::factory()->create();
+    $sessionSwitch->members()->attach($this->user->id, ['role' => 'owner']);
+    $token = mcpSrvToken($this->user);
+    session(['currentTeam' => $sessionSwitch]);
+
+    $response = mcpSrvCall($token, 'manage_notifications', ['action' => 'update', 'resource' => 'telegram', 'data' => ['telegram_chat_id' => '999']]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response))
+        ->and(TelegramNotificationSettings::where('team_id', $this->team->id)->sole()->telegram_chat_id)->toBe('999')
+        ->and(TelegramNotificationSettings::where('team_id', $this->otherTeam->id)->sole()->telegram_chat_id)->toBeNull()
+        ->and(TelegramNotificationSettings::where('team_id', $sessionSwitch->id)->first()?->telegram_chat_id)->toBeNull();
+});
+
+// ---------------------------------------------------------------- list_audit_events
+
+test('list_audit_events returns only events of the token team', function () {
+    AuditEvent::factory()->create(['team_id' => $this->team->id, 'description' => 'own-team-event']);
+    AuditEvent::factory()->create(['team_id' => $this->otherTeam->id, 'description' => 'other-team-event']);
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read']), 'list_audit_events', ['action' => 'list', 'data' => ['per_page' => 50]]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response))
+        ->and(mcpSrvText($response))->toContain('own-team-event')
+        ->and(mcpSrvText($response))->not->toContain('other-team-event');
+});
+
+test('list_audit_events is denied for team members', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    AuditEvent::factory()->create(['team_id' => $this->team->id, 'description' => 'own-team-event']);
+
+    $response = mcpSrvCall(mcpSrvToken($member, ['read']), 'list_audit_events', ['action' => 'list']);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->not->toContain('own-team-event');
+});
+
+// ---------------------------------------------------------------- get_server_metrics
+
+test('get_server_metrics returns recent metrics for a server of the token team', function () {
+    McpSrvStubMetricsClient::$calls = 0;
+    $this->app->bind(SentinelMetricsClient::class, fn ($app, array $parameters) => new McpSrvStubMetricsClient($parameters['server']));
+    $this->server->settings->update(['is_metrics_enabled' => true]);
+    Server::flushIdentityMap();
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read']), 'get_server_metrics', ['server_uuid' => $this->server->uuid, 'minutes' => 60]);
+
+    expect(mcpSrvIsError($response))->toBeFalse(mcpSrvText($response));
+    $data = mcpSrvData($response);
+    expect($data['online'])->toBeTrue()
+        ->and($data['current']['cpu_percent'])->toBe(42.5)
+        ->and($data['series']['cpu_percent'])->toHaveCount(1)
+        ->and($data['series']['disk_used_percent'])->toBe([])
+        ->and($data['series']['network_rx_bytes_per_sec'])->toHaveCount(1)
+        ->and(mcpSrvText($response))->not->toContain('sentinel_token');
+});
+
+test('get_server_metrics caps minutes and rejects invalid values', function () {
+    $this->app->bind(SentinelMetricsClient::class, fn ($app, array $parameters) => new McpSrvStubMetricsClient($parameters['server']));
+    $this->server->settings->update(['is_metrics_enabled' => true]);
+    Server::flushIdentityMap();
+    $token = mcpSrvToken($this->user, ['read']);
+
+    $capped = mcpSrvCall($token, 'get_server_metrics', ['server_uuid' => $this->server->uuid, 'minutes' => 999999]);
+    expect(mcpSrvData($capped)['minutes'])->toBe(43200);
+
+    $invalid = mcpSrvCall($token, 'get_server_metrics', ['server_uuid' => $this->server->uuid, 'minutes' => 0]);
+    expect(mcpSrvIsError($invalid))->toBeTrue();
+});
+
+test('get_server_metrics does not read metrics of a server of another team', function () {
+    McpSrvStubMetricsClient::$calls = 0;
+    $this->app->bind(SentinelMetricsClient::class, fn ($app, array $parameters) => new McpSrvStubMetricsClient($parameters['server']));
+    $this->otherServer->settings->update(['is_metrics_enabled' => true]);
+    Server::flushIdentityMap();
+
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read']), 'get_server_metrics', ['server_uuid' => $this->otherServer->uuid]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->toContain('not found')
+        ->and(McpSrvStubMetricsClient::$calls)->toBe(0);
+});
+
+test('get_server_metrics explains when metrics are disabled', function () {
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read']), 'get_server_metrics', ['server_uuid' => $this->server->uuid]);
+
+    expect(mcpSrvIsError($response))->toBeTrue()
+        ->and(mcpSrvText($response))->toContain('Metrics are not enabled');
+});
diff --git a/tests/Feature/Mcp/McpToggleApiTest.php b/tests/Feature/Mcp/McpToggleApiTest.php
index 9759668262..109c5bbbd9 100644
--- a/tests/Feature/Mcp/McpToggleApiTest.php
+++ b/tests/Feature/Mcp/McpToggleApiTest.php
@@ -5,6 +5,7 @@ use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Once;
 
 uses(RefreshDatabase::class);
 
@@ -95,6 +96,7 @@ test('non-root token cannot disable MCP server', function () {
 
 test('root token can enable MCP server when the REST API is disabled', function () {
     InstanceSettings::query()->where('id', 0)->update(['is_api_enabled' => false]);
+    Once::flush();
     $token = makeRootMcpToken($this->user);
 
     test()->withHeaders(['Authorization' => 'Bearer '.$token])
@@ -104,16 +106,23 @@ test('root token can enable MCP server when the REST API is disabled', function
     expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeTrue();
 });
 
-test('root token cannot enable MCP server from an IP outside the allow-list', function () {
+test('MCP switch routes enforce the allowed API IPs', function (string $path) {
     InstanceSettings::query()->where('id', 0)->update(['is_api_enabled' => false, 'allowed_ips' => '192.0.2.10']);
+    Once::flush();
     $token = makeRootMcpToken($this->user);
 
     test()->withHeaders(['Authorization' => 'Bearer '.$token])
-        ->postJson('/api/v1/mcp/enable')
-        ->assertForbidden();
+        ->postJson($path)
+        ->assertForbidden()
+        ->assertJson(['message' => 'You are not allowed to access the API.']);
 
     expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeFalse();
-});
+
+    test()->withServerVariables(['REMOTE_ADDR' => '192.0.2.10'])
+        ->withHeaders(['Authorization' => 'Bearer '.$token])
+        ->postJson($path)
+        ->assertOk();
+})->with(['/api/v1/mcp/enable', '/api/v1/mcp/disable']);
 
 test('unauthenticated request to /api/v1/mcp/enable returns 401', function () {
     $response = test()->postJson('/api/v1/mcp/enable');
diff --git a/tests/Feature/Mcp/McpWriteToolsTest.php b/tests/Feature/Mcp/McpWriteToolsTest.php
new file mode 100644
index 0000000000..3db6c4ff08
--- /dev/null
+++ b/tests/Feature/Mcp/McpWriteToolsTest.php
@@ -0,0 +1,150 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::query()->delete();
+    $settings = new InstanceSettings(['is_mcp_server_enabled' => true, 'is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->otherTeam = Team::factory()->create();
+    $this->otherUser = User::factory()->create();
+    $this->otherTeam->members()->attach($this->otherUser->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+});
+
+function mcpWriteToken(User $user, array $abilities = ['write']): string
+{
+    return $user->createToken('mcp-write', $abilities)->plainTextToken;
+}
+
+function mcpWriteCall(string $token, string $tool, array $arguments = [])
+{
+    // Each MCP call is a new HTTP request; do not reuse the user and token of an earlier call.
+    app('auth')->forgetGuards();
+
+    return test()->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+        'Accept' => 'application/json, text/event-stream',
+    ])->postJson('/mcp', [
+        'jsonrpc' => '2.0',
+        'id' => 1,
+        'method' => 'tools/call',
+        'params' => ['name' => $tool, 'arguments' => (object) $arguments],
+    ]);
+}
+
+function mcpWriteText($response): string
+{
+    return (string) ($response->json('result.content.0.text') ?? $response->json('error.message'));
+}
+
+function mcpWriteIsError($response): bool
+{
+    return $response->json('result.isError') === true || $response->json('error') !== null;
+}
+
+test('manage_project creates a project in the token team, not the session team', function () {
+    $sessionTeam = Team::factory()->create();
+    $sessionTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $token = mcpWriteToken($this->user);
+    session(['currentTeam' => $sessionTeam]);
+
+    $response = mcpWriteCall($token, 'manage_project', ['action' => 'create', 'data' => ['name' => 'From MCP']]);
+
+    $response->assertOk();
+    expect(mcpWriteIsError($response))->toBeFalse();
+    expect(Project::where('name', 'From MCP')->sole()->team_id)->toBe($this->team->id);
+});
+
+test('manage_project cannot change or delete a project of another team', function (string $action, array $data) {
+    $foreign = Project::create(['name' => 'Theirs', 'team_id' => $this->otherTeam->id]);
+    $token = mcpWriteToken($this->user);
+
+    $response = mcpWriteCall($token, 'manage_project', ['action' => $action, 'uuid' => $foreign->uuid, 'confirm' => true, 'data' => $data]);
+
+    expect(mcpWriteIsError($response))->toBeTrue();
+    expect($foreign->fresh())->not->toBeNull()
+        ->and($foreign->fresh()->name)->toBe('Theirs');
+})->with([
+    'update' => ['update', ['name' => 'Hijacked']],
+    'delete' => ['delete', []],
+    'create environment' => ['create_environment', ['name' => 'evil']],
+]);
+
+test('manage_project rejects read-only tokens and member tokens', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    $readResponse = mcpWriteCall(mcpWriteToken($this->user, ['read']), 'manage_project', ['action' => 'create', 'data' => ['name' => 'Nope']]);
+    expect(mcpWriteIsError($readResponse))->toBeTrue()
+        ->and(mcpWriteText($readResponse))->toContain('Tool [manage_project] not found');
+
+    foreach ([['read'], ['write']] as $abilities) {
+        $memberToken = $member->createToken('member', $abilities)->plainTextToken;
+        $memberResponse = mcpWriteCall($memberToken, 'manage_project', ['action' => 'create', 'data' => ['name' => 'Nope']]);
+        expect(mcpWriteIsError($memberResponse))->toBeTrue();
+    }
+
+    expect(Project::where('name', 'Nope')->exists())->toBeFalse();
+});
+
+test('manage_project delete needs confirm=true', function () {
+    $project = Project::create(['name' => 'Mine', 'team_id' => $this->team->id]);
+    $token = mcpWriteToken($this->user);
+
+    $denied = mcpWriteCall($token, 'manage_project', ['action' => 'delete', 'uuid' => $project->uuid]);
+    expect(mcpWriteIsError($denied))->toBeTrue()
+        ->and(mcpWriteText($denied))->toContain('confirm=true')
+        ->and($project->fresh())->not->toBeNull();
+
+    $deleted = mcpWriteCall($token, 'manage_project', ['action' => 'delete', 'uuid' => $project->uuid, 'confirm' => true]);
+    expect(mcpWriteIsError($deleted))->toBeFalse()
+        ->and($project->fresh())->toBeNull();
+});
+
+test('manage_project returns REST validation errors', function () {
+    $response = mcpWriteCall(mcpWriteToken($this->user), 'manage_project', ['action' => 'create', 'data' => ['name' => '']]);
+
+    expect(mcpWriteIsError($response))->toBeTrue()
+        ->and(mcpWriteText($response))->toContain('name');
+});
+
+test('write tools reject path parameters that try to reach other routes', function (string $uuid) {
+    $response = mcpWriteCall(mcpWriteToken($this->user), 'manage_project', ['action' => 'update', 'uuid' => $uuid, 'data' => ['name' => 'x']]);
+
+    expect(mcpWriteIsError($response))->toBeTrue()
+        ->and(mcpWriteText($response))->toContain('invalid characters');
+})->with(['../enable', 'a/b', '..', '%2e%2e', 'x?y=1']);
+
+test('write tools reject an unknown action', function () {
+    $response = mcpWriteCall(mcpWriteToken($this->user), 'manage_project', ['action' => 'drop_everything']);
+
+    expect(mcpWriteIsError($response))->toBeTrue()
+        ->and(mcpWriteText($response))->toContain('action must be one of');
+});
+
+test('write tools work when the REST API is disabled', function () {
+    InstanceSettings::query()->whereKey(0)->update(['is_api_enabled' => false]);
+    Once::flush();
+
+    $response = mcpWriteCall(mcpWriteToken($this->user), 'manage_project', ['action' => 'create', 'data' => ['name' => 'Api Off']]);
+
+    expect(mcpWriteIsError($response))->toBeFalse()
+        ->and(Project::where('name', 'Api Off')->exists())->toBeTrue();
+});
diff --git a/tests/Feature/ModelFillableCreationTest.php b/tests/Feature/ModelFillableCreationTest.php
index 54870d3f8c..a71e1ea041 100644
--- a/tests/Feature/ModelFillableCreationTest.php
+++ b/tests/Feature/ModelFillableCreationTest.php
@@ -87,6 +87,8 @@ it('creates Server with all fillable attributes', function () {
         'hetzner_server_status' => 'running',
         'digitalocean_droplet_id' => 987654,
         'digitalocean_droplet_status' => 'active',
+        'hostinger_virtual_machine_id' => 17923,
+        'hostinger_virtual_machine_status' => 'running',
         'is_validating' => false,
         'detected_traefik_version' => 'v2.10.0',
         'traefik_outdated_info' => 'Up to date',
@@ -106,6 +108,8 @@ it('creates Server with all fillable attributes', function () {
     expect($server->hetzner_server_status)->toBe('running');
     expect($server->digitalocean_droplet_id)->toBe(987654);
     expect($server->digitalocean_droplet_status)->toBe('active');
+    expect($server->hostinger_virtual_machine_id)->toBe(17923);
+    expect($server->hostinger_virtual_machine_status)->toBe('running');
     expect($server->ip_previous)->toBe('10.0.0.1');
 });
 
diff --git a/tests/Feature/MultiServerApplicationTest.php b/tests/Feature/MultiServerApplicationTest.php
index 2f586e07b8..8f47010ac3 100644
--- a/tests/Feature/MultiServerApplicationTest.php
+++ b/tests/Feature/MultiServerApplicationTest.php
@@ -320,6 +320,25 @@ describe('combined deployment notification', function () {
         Notification::assertNothingSent();
     });
 
+    test('takes commit details for the summary from the main deployment', function () {
+        $parent = ApplicationDeploymentQueue::create([
+            'application_id' => $this->application->id,
+            'deployment_uuid' => new_public_id(),
+            'server_id' => $this->mainServer->id,
+            'status' => ApplicationDeploymentStatus::FINISHED->value,
+            'commit' => 'a1b2c3d4e5f60718293a4b5c6d7e8f9012345678',
+            'commit_message' => 'Add checkout page',
+        ]);
+        Cache::put("multi-server-deployment-queued:{$parent->deployment_uuid}", true);
+        $child = createMultiServerDeployment($this->application, $this->extraServer, ApplicationDeploymentStatus::FINISHED->value, $parent->deployment_uuid);
+        $job = makeMultiServerDeploymentJob(['application' => $this->application, 'application_deployment_queue' => $child]);
+
+        callMultiServerDeploymentJob($job, 'sendMultiServerDeploymentNotification', $parent->deployment_uuid);
+
+        Notification::assertSentTo($this->team, DeploymentSuccess::class, fn (DeploymentSuccess $notification) => $notification->commit_sha === $parent->commit
+            && $notification->commit_message === 'Add checkout page');
+    });
+
     test('sends a failed notification that links to the failed server deployment', function () {
         $parentUuid = new_public_id();
         Cache::put("multi-server-deployment-queued:{$parentUuid}", true);
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index 5563e87769..47b215d5f0 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -182,7 +182,7 @@ it('authorizes every volume backup form control', function (string $path, array
         [
             '/<x-forms\.button(?=[^>]*wire:click="toggleS3")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$resource")[^>]*>\s*Enable S3\s*<\/x-forms\.button>/s',
             '/<x-forms\.button(?=[^>]*wire:click="toggleS3")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$resource")[^>]*>\s*Disable S3\s*<\/x-forms\.button>/s',
-            '/<x-forms\.listbox canGate="update" :canResource="\$resource" id="s3StorageId"[\s\S]*?:disabled="! auth\(\)->user\(\)\?->can\(\'update\', \$resource\)"/',
+            '/<x-forms\.listbox canGate="update" :canResource="\$resource" id="s3StorageIds"/',
             '/<x-forms\.listbox canGate="update" :canResource="\$resource" id="disableLocalBackup"[\s\S]*?:disabled="! \$saveToS3 \|\| ! auth\(\)->user\(\)\?->can\(\'update\', \$resource\)"/',
         ],
     ],
diff --git a/tests/Feature/NavbarSubmenuTest.php b/tests/Feature/NavbarSubmenuTest.php
new file mode 100644
index 0000000000..de06618119
--- /dev/null
+++ b/tests/Feature/NavbarSubmenuTest.php
@@ -0,0 +1,142 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+});
+
+function renderNavbarAt(string $path, bool $mobile = false): string
+{
+    app()->instance('request', Request::create($path));
+
+    return (string) test()->blade($mobile ? '<x-navbar />' : '<x-navbar desktop />');
+}
+
+function loginNavbarUser(string $role): void
+{
+    test()->team->members()->attach(test()->user->id, ['role' => $role]);
+    test()->actingAs(test()->user);
+    session(['currentTeam' => test()->team]);
+}
+
+test('a submenu page opens its submenu with the current page active', function () {
+    loginNavbarUser('owner');
+
+    $html = renderNavbarAt('/metrics');
+
+    expect($html)
+        ->toContain('Back to the main menu')
+        ->toMatch('#aria-current="page"[^>]*>\s*<svg[^>]*>.*?</svg>\s*<span[^>]*>Metrics</span>#s');
+});
+
+test('a page outside every submenu starts on the main menu', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/servers'))->not->toContain('data-active-submenu="');
+});
+
+test('a submenu entry links to its first visible page', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/servers'))->toContain('href="'.route('analytics').'"');
+});
+
+test('the registries page is hidden from members in the integrations submenu', function () {
+    loginNavbarUser('member');
+
+    expect(renderNavbarAt('/sources'))
+        ->toContain('Destinations')
+        ->not->toContain('href="'.route('registries.index').'"');
+});
+
+test('the team submenu lists the team pages by role', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/team/members'))
+        ->toContain('href="'.route('team.member.index').'"')
+        ->toContain('href="'.route('team.audit-log').'"')
+        ->toContain('href="'.route('team.danger-zone').'"');
+});
+
+test('members do not see the audit log or danger zone in the team submenu', function () {
+    loginNavbarUser('member');
+
+    expect(renderNavbarAt('/team'))
+        ->toContain('href="'.route('team.member.index').'"')
+        ->not->toContain('href="'.route('team.audit-log').'"')
+        ->not->toContain('href="'.route('team.danger-zone').'"');
+});
+
+test('notifications and keys & tokens open their own submenus', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/notifications/discord'))
+        ->toContain('href="'.route('notifications.slack').'"')
+        ->toMatch('#aria-current="page"[^>]*>.*?discord\.svg#s');
+
+    expect(renderNavbarAt('/security/api-tokens'))
+        ->toContain('href="'.route('security.private-key.index').'"')
+        ->toContain('Back to the main menu');
+});
+
+test('the admin link belongs to the main menu, not to submenus', function () {
+    config()->set('app.env', 'local');
+    $root = User::factory()->create(['id' => 0]);
+    test()->team->members()->attach($root->id, ['role' => 'owner']);
+    test()->actingAs($root);
+    session(['currentTeam' => test()->team]);
+
+    expect(renderNavbarAt('/team'))
+        ->toMatch('#<li\s+x-show="!submenu"\s+x-cloak[^>]*>\s*<a title="Admin"#');
+});
+
+test('shared variables open their own submenu', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/shared-variables/servers'))
+        ->toContain('Back to the main menu')
+        ->toContain('href="'.route('shared-variables.team.index').'"')
+        ->toMatch('#aria-current="page"[^>]*>\s*<svg[^>]*>.*?</svg>\s*<span[^>]*>Servers</span>#s');
+});
+
+test('instance settings open their own submenu for instance admins', function () {
+    config()->set('app.env', 'local');
+    $root = User::factory()->create(['id' => 0]);
+    test()->team->members()->attach($root->id, ['role' => 'owner']);
+    test()->actingAs($root);
+    session(['currentTeam' => test()->team]);
+
+    expect(renderNavbarAt('/settings/email'))
+        ->toContain('Back to the main menu')
+        ->toContain('href="'.route('settings.oauth').'"')
+        ->toMatch('#aria-current="page"[^>]*>\s*<svg[^>]*>.*?</svg>\s*<span[^>]*>Email</span>#s');
+});
+
+test('a parent entry opens its submenu in place on mobile and desktop', function () {
+    loginNavbarUser('owner');
+
+    foreach ([renderNavbarAt('/servers', mobile: true), renderNavbarAt('/servers')] as $html) {
+        expect($html)
+            ->toContain('x-show="submenu === \'Monitoring\'"')
+            ->toMatch('#<button type="button" title="Monitoring" @click="submenu = \'Monitoring\'#')
+            ->not->toMatch('#<a title="Monitoring"#');
+    }
+});
+
+test('the projects entry links to the projects page and is active on project pages', function () {
+    loginNavbarUser('member');
+
+    expect(renderNavbarAt('/project/abc'))
+        ->toContain('href="'.route('project.index').'"')
+        ->toMatch('#title="Projects"[^>]*menu-item-active#s')
+        ->not->toMatch('#title="Dashboard"[^>]*menu-item-active#s');
+});
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index 822b78a4c9..f668a58372 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -173,3 +173,41 @@ it('falls back cleanly when the avatars S3 storage no longer exists', function (
         ->get(route('profile.avatar'))
         ->assertNotFound();
 });
+
+it('serves a team members profile picture to other members of the same team', function () {
+    Storage::fake('images');
+    $team = Team::factory()->create();
+    $viewer = User::factory()->create();
+    $member = User::factory()->create([
+        'avatar_path' => 'avatars/2/avatar.jpg',
+        'avatar_storage_type' => 'local',
+    ]);
+    $team->members()->attach($viewer->id, ['role' => 'member']);
+    $team->members()->attach($member->id, ['role' => 'member']);
+    Storage::disk('images')->put($member->avatar_path, 'avatar-content');
+
+    $this->actingAs($viewer);
+
+    expect(profile_avatar_url($member))->toBe(route('team.member.avatar', ['user_id' => $member->id, 'v' => $member->updated_at->timestamp]));
+
+    $this->withoutMiddleware()
+        ->get(route('team.member.avatar', ['user_id' => $member->id]))
+        ->assertSuccessful()
+        ->assertHeader('content-type', 'image/jpeg');
+});
+
+it('does not serve the profile picture of a user who shares no team', function () {
+    Storage::fake('images');
+    $viewer = User::factory()->create();
+    $viewer->teams()->attach(Team::factory()->create()->id, ['role' => 'owner']);
+    $stranger = User::factory()->create([
+        'avatar_path' => 'avatars/3/avatar.jpg',
+        'avatar_storage_type' => 'local',
+    ]);
+    $stranger->teams()->attach(Team::factory()->create()->id, ['role' => 'owner']);
+    Storage::disk('images')->put($stranger->avatar_path, 'avatar-content');
+
+    $this->withoutMiddleware()->actingAs($viewer)
+        ->get(route('team.member.avatar', ['user_id' => $stranger->id]))
+        ->assertNotFound();
+});
diff --git a/tests/Feature/ProfilePasskeysTest.php b/tests/Feature/ProfilePasskeysTest.php
new file mode 100644
index 0000000000..b4d44d65b2
--- /dev/null
+++ b/tests/Feature/ProfilePasskeysTest.php
@@ -0,0 +1,137 @@
+<?php
+
+use App\Livewire\Profile\Passkeys;
+use App\Models\InstanceSettings;
+use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Once;
+use Laravel\Passkeys\Passkey;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+    $this->withoutVite();
+
+    $this->user = User::factory()->create(['name' => 'Passkey User', 'password' => Hash::make('secret-password')]);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->user->teams()->sole()]);
+});
+
+function profilePasskey(User $user, string $name = 'Laptop'): Passkey
+{
+    return $user->passkeys()->create([
+        'name' => $name,
+        'credential_id' => 'credential-'.$user->id.'-'.$name,
+        'credential' => ['aaguid' => '00000000-0000-0000-0000-000000000000'],
+    ]);
+}
+
+it('lists only the passkeys of the current user', function () {
+    profilePasskey($this->user, 'My laptop');
+    profilePasskey(User::factory()->create(), 'Other phone');
+
+    Livewire::test(Passkeys::class)
+        ->assertSee('My laptop')
+        ->assertDontSee('Other phone');
+});
+
+it('opens the add form only after the confirm redirect', function () {
+    Livewire::test(Passkeys::class)->assertSet('show_form', false);
+
+    session()->flash('status', 'passkey-add');
+
+    Livewire::test(Passkeys::class)->assertSet('show_form', true);
+});
+
+it('renames a passkey of the current user', function () {
+    $passkey = profilePasskey($this->user);
+
+    Livewire::test(Passkeys::class)->call('rename', $passkey->id, '  Work laptop  ');
+
+    expect($passkey->fresh()->name)->toBe('Work laptop');
+});
+
+it('rejects an empty or too long passkey name', function (string $name) {
+    $passkey = profilePasskey($this->user);
+
+    Livewire::test(Passkeys::class)->call('rename', $passkey->id, $name)->assertHasErrors('name');
+
+    expect($passkey->fresh()->name)->toBe('Laptop');
+})->with(['empty' => ['   '], 'too long' => [str_repeat('a', 256)]]);
+
+it('does not rename the passkey of another user', function () {
+    $passkey = profilePasskey(User::factory()->create());
+
+    expect(fn () => Livewire::test(Passkeys::class)->call('rename', $passkey->id, 'Stolen'))
+        ->toThrow(ModelNotFoundException::class);
+
+    expect($passkey->fresh()->name)->toBe('Laptop');
+});
+
+it('deletes a passkey with the correct password', function () {
+    $passkey = profilePasskey($this->user);
+
+    Livewire::test(Passkeys::class)->call('delete', $passkey->id, 'secret-password');
+
+    expect(Passkey::find($passkey->id))->toBeNull();
+});
+
+it('does not delete a passkey with a wrong password', function () {
+    $passkey = profilePasskey($this->user);
+
+    Livewire::test(Passkeys::class)->call('delete', $passkey->id, 'wrong-password');
+
+    expect(Passkey::find($passkey->id))->not->toBeNull();
+});
+
+it('does not delete the passkey of another user', function () {
+    $passkey = profilePasskey(User::factory()->create());
+
+    expect(fn () => Livewire::test(Passkeys::class)->call('delete', $passkey->id, 'secret-password'))
+        ->toThrow(ModelNotFoundException::class);
+
+    expect(Passkey::find($passkey->id))->not->toBeNull();
+});
+
+it('renders nothing when passkeys are turned off', function () {
+    InstanceSettings::query()->where('id', 0)->update(['is_passkey_enabled' => false]);
+    Once::flush();
+    profilePasskey($this->user, 'My laptop');
+
+    Livewire::test(Passkeys::class)->assertDontSee('My laptop')->assertDontSee('Passkeys');
+});
+
+it('refuses passkey changes when passkeys are turned off', function (string $action, array $arguments) {
+    $passkey = profilePasskey($this->user);
+    InstanceSettings::query()->where('id', 0)->update(['is_passkey_enabled' => false]);
+    Once::flush();
+
+    Livewire::test(Passkeys::class)->call($action, $passkey->id, ...$arguments)->assertNotFound();
+
+    expect($passkey->fresh()?->name)->toBe('Laptop');
+})->with([
+    'rename' => ['rename', ['Renamed']],
+    'delete' => ['delete', ['secret-password']],
+]);
+
+it('explains why a passkey cannot be added on an address that does not support passkeys', function () {
+    profilePasskey($this->user, 'My laptop');
+
+    $this->get('http://203.0.113.10:8000/profile')
+        ->assertOk()
+        ->assertSee('My laptop')
+        ->assertSee('Passkeys need HTTPS')
+        ->assertDontSee('Add passkey');
+});
+
+it('reports if a rename was saved', function () {
+    $passkey = profilePasskey($this->user);
+
+    Livewire::test(Passkeys::class)->call('rename', $passkey->id, 'Work laptop')->assertReturned(true);
+    Livewire::test(Passkeys::class)->call('rename', $passkey->id, '   ')->assertReturned(null);
+});
diff --git a/tests/Feature/ProjectAndEnvironmentSettingsButtonTest.php b/tests/Feature/ProjectAndEnvironmentSettingsButtonTest.php
index 514ebac4c3..ec7f1423d0 100644
--- a/tests/Feature/ProjectAndEnvironmentSettingsButtonTest.php
+++ b/tests/Feature/ProjectAndEnvironmentSettingsButtonTest.php
@@ -35,7 +35,7 @@ test('project show page header links to project settings', function () {
     $editUrl = route('project.edit', ['project_uuid' => $this->project->uuid]);
 
     Livewire::test(ProjectShow::class, ['project_uuid' => $this->project->uuid])
-        ->assertSee('Settings')
+        ->assertSee('Open settings for Test Project', false)
         ->assertSee('Project settings', false)
         ->assertSeeHtml($editUrl);
 });
@@ -51,7 +51,22 @@ test('environment resources page header links to environment settings', function
         'environment_uuid' => $this->environment->uuid,
     ]))
         ->assertSuccessful()
-        ->assertSee('Settings')
+        ->assertSee('Open settings for '.$this->environment->name, false)
         ->assertSee('Environment settings', false)
         ->assertSee($editUrl, false);
 });
+
+test('empty environment resources page header links to the canvas', function () {
+    $canvasUrl = route('project.environment.canvas', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+    ]);
+
+    $this->get(route('project.resource.index', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+    ]))
+        ->assertSuccessful()
+        ->assertSee('No resources yet')
+        ->assertSee($canvasUrl, false);
+});
diff --git a/tests/Feature/ProjectCanvasTest.php b/tests/Feature/ProjectCanvasTest.php
new file mode 100644
index 0000000000..d198517f46
--- /dev/null
+++ b/tests/Feature/ProjectCanvasTest.php
@@ -0,0 +1,271 @@
+<?php
+
+use App\Livewire\Project\ProjectCanvas;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'name' => 'web-server']);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop']);
+    $this->staging = Environment::factory()->create(['project_id' => $this->project->id, 'name' => 'staging']);
+    $this->production = $this->project->environments()->where('name', 'production')->firstOrFail();
+});
+
+function projectCanvasApp(Environment $environment, Server $server, string $name): Application
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+
+    return Application::factory()->create([
+        'name' => $name,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+function projectCanvasSession(object $test, User $user, Team $team): object
+{
+    return $test->actingAs($user)->withSession(['currentTeam' => $team])
+        ->withHeader('X-Canvas-Team', (string) $team->id);
+}
+
+test('the project canvas shows the resources of every environment, grouped by environment', function () {
+    $app = projectCanvasApp($this->staging, $this->server, 'storefront');
+    $api = projectCanvasApp($this->staging, $this->server, 'orders-api');
+    $live = projectCanvasApp($this->production, $this->server, 'storefront-live');
+    $link = ResourceLink::create([
+        'environment_id' => $this->staging->id,
+        'source_type' => $app->getMorphClass(), 'source_id' => $app->id,
+        'target_type' => $api->getMorphClass(), 'target_id' => $api->id,
+    ]);
+    $this->production->forceFill(['canvas_positions' => [$live->uuid => ['x' => 40, 'y' => 80]]])->save();
+
+    // A resource of another project of the same team stays out.
+    $other = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $this->team->id])->id]);
+    projectCanvasApp($other, $this->server, 'elsewhere');
+
+    $response = projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertOk()
+        ->assertJsonPath('title', 'Shop')
+        ->assertJsonPath('can_edit', true)
+        ->assertJsonPath('can_move', false)
+        ->assertJsonPath('can_move_groups', true)
+        ->assertJsonPath('layout', 'server')
+        ->assertJsonPath('links.0.id', $link->uuid)
+        // Auto-placed: a position saved on one environment canvas does not fit next to the other environments.
+        ->assertJsonPath('positions', []);
+
+    expect(collect($response->json('zones'))->pluck('name')->all())->toBe(['web-server'])
+        ->and(collect($response->json('nodes'))->mapWithKeys(fn ($node) => [$node['name'] => $node['context']])->sortKeys()->all())->toBe([
+            'orders-api' => 'staging',
+            'storefront' => 'staging',
+            'storefront-live' => 'production',
+        ])
+        // The canvas saves moves and links on the environment canvas of each card.
+        ->and(collect($response->json('nodes'))->firstWhere('name', 'storefront-live')['environment'])->toBe(['uuid' => $this->production->uuid, 'name' => 'production']);
+});
+
+test('members see the project canvases but cannot edit them', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    projectCanvasSession($this, $member, $this->team)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertOk()
+        ->assertJsonPath('can_edit', false);
+    projectCanvasSession($this, $member, $this->team)
+        ->getJson('/canvas/api/projects/canvas')
+        ->assertOk()
+        ->assertJsonPath('can_edit', false)
+        ->assertJsonPath('can_move_groups', false);
+    projectCanvasSession($this, $member, $this->team)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertJsonPath('can_move_groups', false);
+    projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/projects/canvas')
+        ->assertJsonPath('can_move_groups', true);
+});
+
+test('the project canvas is out of reach from another team', function () {
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $outsider = User::factory()->create();
+    $otherTeam->members()->attach($outsider->id, ['role' => 'owner']);
+    $this->team->members()->attach($outsider->id, ['role' => 'member']);
+
+    // Session switched to the other team: this team's project is out of reach.
+    projectCanvasSession($this, $outsider, $otherTeam)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertNotFound();
+    projectCanvasSession($this, $outsider, $otherTeam)
+        ->get(route('project.canvas', ['project_uuid' => $this->project->uuid]))
+        ->assertNotFound();
+});
+
+test('the project page reopens the canvas when the user left it on the canvas view', function () {
+    $parameters = ['project_uuid' => $this->project->uuid];
+
+    projectCanvasSession($this, $this->admin, $this->team)
+        ->withoutVite()
+        ->get(route('project.canvas', $parameters))
+        ->assertOk()
+        ->assertSee('data-endpoint="/projects/'.$this->project->uuid.'/canvas"', false)
+        ->assertCookie("coolify_{$this->admin->id}_project_view", 'canvas');
+
+    projectCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_project_view", 'canvas')
+        ->get(route('project.show', $parameters))
+        ->assertRedirect(route('project.canvas', $parameters));
+
+    // The table / grid links on the canvas pick the list view again.
+    projectCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_project_view", 'canvas')
+        ->get(route('project.show', [...$parameters, 'view' => 'grid']))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_project_view", 'grid');
+});
+
+test('the projects canvas shows every project of the team as a zone, grouped by environment', function () {
+    $app = projectCanvasApp($this->staging, $this->server, 'storefront');
+    $blog = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Blog']);
+    $post = projectCanvasApp($blog->environments()->firstOrFail(), $this->server, 'wordpress');
+
+    // Another team's project stays out.
+    $otherTeam = Team::factory()->create();
+    $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);
+    $foreign = Project::factory()->create(['team_id' => $otherTeam->id, 'name' => 'Foreign']);
+    projectCanvasApp($foreign->environments()->firstOrFail(), $otherServer, 'secret-app');
+
+    $response = projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/projects/canvas')
+        ->assertOk()
+        ->assertJsonPath('title', 'Projects')
+        ->assertJsonPath('can_edit', true)
+        ->assertJsonPath('layout', 'server');
+
+    expect(collect($response->json('zones'))->pluck('name')->all())->toBe(['Blog', 'Shop'])
+        ->and(collect($response->json('nodes'))->mapWithKeys(fn ($node) => [$node['name'] => [$node['zone'], $node['context']]])->sortKeys()->all())->toBe([
+            'No resources yet' => [$this->project->uuid, 'production'],
+            'storefront' => [$this->project->uuid, 'staging'],
+            'wordpress' => [$blog->uuid, 'production'],
+        ]);
+});
+
+test('the project canvases show empty environments and projects as placeholder cards', function () {
+    projectCanvasApp($this->staging, $this->server, 'storefront');
+    $bare = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Bare']);
+    $bare->environments()->delete();
+
+    $project = projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertOk();
+    $placeholder = collect($project->json('nodes'))->firstWhere('type', 'empty');
+
+    // Next to the other environments: on the server of the project's resources.
+    expect(collect($project->json('zones'))->pluck('name')->all())->toBe(['web-server'])
+        ->and($placeholder)->toMatchArray([
+            'id' => "empty:{$this->production->uuid}",
+            'zone' => $this->server->uuid,
+            'context' => 'production',
+            // Admins add the first resource on the deploy canvas, with the environment chosen.
+            'link' => route('deploy-canvas', ['project' => $this->project->uuid, 'environment' => $this->production->uuid]),
+            'context_link' => route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->production->uuid]),
+            'environment' => ['uuid' => $this->production->uuid, 'name' => 'production'],
+        ]);
+
+    // Members cannot add resources: the card opens the environment page.
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $memberView = projectCanvasSession($this, $member, $this->team)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertOk();
+    expect(collect($memberView->json('nodes'))->firstWhere('type', 'empty')['link'])
+        ->toBe(route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->production->uuid]));
+
+    // A project without resources has no server: its environments get their own zone.
+    $alone = projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/projects/{$bare->uuid}/canvas")
+        ->assertOk();
+    expect(collect($alone->json('zones'))->pluck('name')->all())->toBe(['Empty environments'])
+        ->and($alone->json('nodes.0.name'))->toBe('No environments yet');
+
+    $team = projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/projects/canvas')
+        ->assertOk();
+
+    // A project without environments gets one placeholder in its zone.
+    expect(collect($team->json('nodes'))->firstWhere('zone', $bare->uuid))->toMatchArray([
+        'type' => 'empty',
+        'name' => 'No environments yet',
+        'link' => route('project.show', ['project_uuid' => $bare->uuid]),
+        'environment' => null,
+    ]);
+});
+
+test('the projects page reopens the canvas when the user left it on the canvas view', function () {
+    projectCanvasSession($this, $this->admin, $this->team)
+        ->get(route('project.canvas.index'))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_projects_view", 'canvas');
+
+    projectCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_projects_view", 'canvas')
+        ->get(route('project.index'))
+        ->assertRedirect(route('project.canvas.index'));
+
+    projectCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_projects_view", 'canvas')
+        ->get(route('project.index', ['view' => 'table']))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_projects_view", 'table');
+});
+
+test('an admin creates an environment from the project canvas', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ProjectCanvas::class, ['project_uuid' => $this->project->uuid])
+        ->set('name', 'testing')
+        ->call('submit')
+        ->assertRedirect();
+
+    expect($this->project->environments()->where('name', 'testing')->exists())->toBeTrue();
+});
+
+test('a member cannot create an environment from the project canvas', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ProjectCanvas::class, ['project_uuid' => $this->project->uuid])
+        ->set('name', 'testing')
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect($this->project->environments()->where('name', 'testing')->exists())->toBeFalse();
+});
diff --git a/tests/Feature/Proxy/CaddyBasicAuthLabelsTest.php b/tests/Feature/Proxy/CaddyBasicAuthLabelsTest.php
index 359abef073..4f3aa36510 100644
--- a/tests/Feature/Proxy/CaddyBasicAuthLabelsTest.php
+++ b/tests/Feature/Proxy/CaddyBasicAuthLabelsTest.php
@@ -106,3 +106,55 @@ it('emits the matching basic auth directive in application labels', function (st
     'caddy-docker-proxy 2.13, preview, all proxies' => ['lucaslorentz/caddy-docker-proxy:2.13-alpine', false, true, 'basic_auth'],
     'caddy-docker-proxy 2.13, preview, exact labels' => ['lucaslorentz/caddy-docker-proxy:2.13-alpine', true, true, 'basic_auth'],
 ]);
+
+it('hashes the password in application labels with the selected settings', function (array $proxy, bool $exactLabels, bool $preview, array $hashSettings, array $expectedLabels) {
+    $team = Team::factory()->create();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $team->id])->id]);
+    $server = Server::factory()->create(['team_id' => $team->id, 'proxy' => $proxy]);
+    $server->settings->update(['generate_exact_labels' => $exactLabels]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $application = Application::factory()->createOne([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'fqdn' => 'https://example.com',
+        'is_http_basic_auth_enabled' => true,
+        'http_basic_auth_username' => 'admin',
+        'http_basic_auth_password' => 'secret',
+        ...$hashSettings,
+    ]);
+    Server::flushIdentityMap();
+
+    $applicationPreview = $preview
+        ? (new ApplicationPreview)->forceFill(['pull_request_id' => 7, 'fqdn' => 'https://pr-7.example.com'])
+        : null;
+
+    $labels = collect(generateLabelsApplication($application->fresh(), $applicationPreview))->implode("\n");
+
+    expect($labels)->toContain(...$expectedLabels);
+})->with(function () {
+    $caddy = basicAuthCaddyProxy('lucaslorentz/caddy-docker-proxy:2.13-alpine');
+    $traefik = basicAuthCaddyProxy('traefik:v3.7', ['type' => ProxyTypes::TRAEFIK->value]);
+    $bcrypt = ['http_basic_auth_bcrypt_cost' => 4];
+    $argon2id = ['http_basic_auth_hash_algorithm' => 'argon2id', 'http_basic_auth_argon2id_memory_cost' => 8192, 'http_basic_auth_argon2id_time_cost' => 2];
+    $caddyBcrypt = 'caddy_0.basic_auth.admin="$2y$04$';
+    $traefikBcrypt = '.basicauth.users=admin:$2y$04$';
+
+    return [
+        'bcrypt, all proxies' => [$caddy, false, false, $bcrypt, [$caddyBcrypt, $traefikBcrypt]],
+        'bcrypt, all proxies, preview' => [$caddy, false, true, $bcrypt, [$caddyBcrypt, $traefikBcrypt]],
+        'bcrypt, exact Caddy labels' => [$caddy, true, false, $bcrypt, [$caddyBcrypt]],
+        'bcrypt, exact Caddy labels, preview' => [$caddy, true, true, $bcrypt, [$caddyBcrypt]],
+        'bcrypt, exact Traefik labels' => [$traefik, true, false, $bcrypt, [$traefikBcrypt]],
+        'bcrypt, exact Traefik labels, preview' => [$traefik, true, true, $bcrypt, [$traefikBcrypt]],
+        'Argon2id for Caddy, bcrypt for Traefik' => [$caddy, false, false, $argon2id, [
+            'caddy_0.basic_auth=argon2id',
+            'caddy_0.basic_auth.admin="$argon2id$v=19$m=8192,t=2,p=1$',
+            '.basicauth.users=admin:$2y$10$',
+        ]],
+        'bcrypt when Caddy is too old for the stored Argon2id' => [basicAuthCaddyProxy('lucaslorentz/caddy-docker-proxy:2.10-alpine'), false, false, $argon2id, [
+            'caddy_0.basic_auth.admin="$2y$10$',
+            '.basicauth.users=admin:$2y$10$',
+        ]],
+    ];
+});
diff --git a/tests/Feature/Proxy/MaintenanceModeTest.php b/tests/Feature/Proxy/MaintenanceModeTest.php
new file mode 100644
index 0000000000..44d8ba6d6e
--- /dev/null
+++ b/tests/Feature/Proxy/MaintenanceModeTest.php
@@ -0,0 +1,289 @@
+<?php
+
+use App\Enums\ProxyTypes;
+use App\Events\ProxyStatusChanged;
+use App\Events\ProxyStatusChangedUI;
+use App\Livewire\Project\Shared\Maintenance;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Process;
+use Livewire\Livewire;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+// Servers stay in a static identity map; do not leak them into later test files.
+afterEach(fn () => Server::flushIdentityMap());
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Event::fake([ProxyStatusChanged::class, ProxyStatusChangedUI::class]);
+    InstanceSettings::forceCreate(['id' => 0]);
+    config(['constants.ssh.mux_enabled' => false]);
+    fakeProxyFileUploads();
+
+    $this->team = Team::factory()->create();
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'user' => 'cooluser',
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+    $this->server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    $this->server->proxy->type = ProxyTypes::TRAEFIK->value;
+    $this->server->save();
+
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $this->server->id]);
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $project->id]);
+});
+
+function maintenanceApplication(array $attributes = []): Application
+{
+    $test = test();
+
+    return Application::factory()->create(array_merge([
+        'environment_id' => $test->environment->id,
+        'destination_id' => $test->destination->id,
+        'destination_type' => $test->destination->getMorphClass(),
+        'fqdn' => 'https://app.example.com',
+    ], $attributes));
+}
+
+function maintenanceService(array $domains): Service
+{
+    $test = test();
+    $service = Service::factory()->create([
+        'environment_id' => $test->environment->id,
+        'server_id' => $test->server->id,
+        'destination_id' => $test->destination->id,
+        'destination_type' => $test->destination->getMorphClass(),
+    ]);
+    foreach ($domains as $name => $fqdn) {
+        ServiceApplication::create(['name' => $name, 'service_id' => $service->id, 'image' => 'nginx', 'fqdn' => $fqdn]);
+    }
+
+    return $service;
+}
+
+function maintenanceServer(): Server
+{
+    return Server::find(test()->server->id);
+}
+
+/**
+ * @return array<int, string>
+ */
+function maintenanceScriptLines(): array
+{
+    $lines = [];
+    Process::assertRan(function ($process) use (&$lines) {
+        array_push($lines, ...explode("\n", $process->command));
+
+        return true;
+    });
+
+    return $lines;
+}
+
+it('routes the maintenance domains through Traefik with a priority just above the resource router', function () {
+    $application = maintenanceApplication(['fqdn' => 'https://app.example.com,http://app.example.com/api', 'is_maintenance_enabled' => true]);
+
+    $config = Yaml::parse(maintenanceServer()->maintenanceTraefikConfiguration(collect([$application])));
+    $routers = $config['http']['routers'];
+    $rootRule = 'Host(`app.example.com`) && PathPrefix(`/`)';
+    $apiRule = 'Host(`app.example.com`) && PathPrefix(`/api`)';
+
+    expect($routers["coolify-maintenance-{$application->uuid}-0-http"])->toMatchArray([
+        'entryPoints' => ['http'],
+        'rule' => $rootRule,
+        'service' => 'coolify-maintenance-noop',
+        'middlewares' => ['coolify-maintenance-headers', "coolify-maintenance-{$application->uuid}"],
+        'priority' => strlen($rootRule) + 1,
+    ])
+        ->and($routers["coolify-maintenance-{$application->uuid}-0-https"]['tls'])->toBe(['certResolver' => 'letsencrypt'])
+        // http:// domains get no TLS router.
+        ->and($routers)->not->toHaveKey("coolify-maintenance-{$application->uuid}-1-https")
+        ->and($routers["coolify-maintenance-{$application->uuid}-1-http"]['priority'])->toBe(strlen($apiRule) + 1)
+        // A resource router on a longer path of the same host keeps a higher priority.
+        ->and(strlen($apiRule))->toBeGreaterThan($routers["coolify-maintenance-{$application->uuid}-0-http"]['priority'])
+        ->and($config['http']['middlewares']["coolify-maintenance-{$application->uuid}"]['errors'])->toBe([
+            'status' => ['503'],
+            'service' => 'coolify-maintenance-pages',
+            'query' => "/maintenance-{$application->uuid}.html",
+        ])
+        ->and($config['http']['middlewares']['coolify-maintenance-headers']['headers']['customResponseHeaders'])->toBe(['Retry-After' => '300'])
+        ->and($config['http']['services']['coolify-maintenance-noop']['loadBalancer']['servers'])->toBe([])
+        ->and($config['http']['services']['coolify-maintenance-pages']['loadBalancer']['servers'])->toBe([['url' => 'http://coolify-proxy-error-pages:80']]);
+});
+
+it('writes Caddy maintenance blocks with the same site address as the resource labels', function (bool $forceHttps, string $domain) {
+    $application = maintenanceApplication(['fqdn' => $domain, 'is_maintenance_enabled' => true]);
+    $application->settings->update(['is_force_https_enabled' => $forceHttps]);
+    $application->refresh();
+    $labelAddress = str(fqdnLabelsForCaddy('coolify', $application->uuid, collect([$domain]), $forceHttps)->first(fn ($label) => str_starts_with($label, 'caddy_0=')))->after('caddy_0=')->value();
+    $matcher = "@coolify-maintenance-{$application->uuid}-0";
+    $path = parse_url($domain, PHP_URL_PATH) ?: '/';
+
+    $caddyfile = maintenanceServer()->caddyBaseCaddyfile(collect([$application]));
+
+    expect($caddyfile)
+        ->toStartWith("import /dynamic/*.caddy\n")
+        ->toContain("\n\n{$labelAddress} {\n\t{$matcher} path {$path}*\n\thandle {$matcher} {")
+        ->toContain("rewrite /maintenance-{$application->uuid}.html")
+        ->toContain('copy_response 503');
+})->with([
+    'https' => [false, 'https://app.example.com'],
+    'forced https' => [true, 'https://app.example.com'],
+    'http with path' => [false, 'http://app.example.com/api'],
+]);
+
+it('keeps the base Caddyfile to the import line without maintenance resources', function () {
+    expect(maintenanceServer()->caddyBaseCaddyfile(collect()))->toBe("import /dynamic/*.caddy\n");
+});
+
+it('skips domains that could inject proxy configuration', function () {
+    $application = maintenanceApplication(['fqdn' => 'https://ok.example.com,https://bad.example.com/a b,https://bad.example.com/{x},https://evil.example.com`)', 'is_maintenance_enabled' => true]);
+
+    expect($application->maintenanceRoutes()->pluck('host')->all())->toBe(['ok.example.com']);
+});
+
+it('collects the domains of Docker Compose applications and services', function () {
+    $compose = maintenanceApplication([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://web.example.com,https://www.example.com'], 'api' => ['domain' => 'https://web.example.com/api'], 'db' => ['domain' => '']]),
+    ]);
+    $service = maintenanceService(['ghost' => 'https://blog.example.com', 'admin' => 'https://admin.example.com/ghost']);
+
+    expect($compose->maintenanceRoutes()->map(fn ($route) => $route['host'].$route['path'])->all())->toBe(['web.example.com/', 'www.example.com/', 'web.example.com/api'])
+        ->and($service->maintenanceRoutes()->map(fn ($route) => $route['host'].$route['path'])->all())->toBe(['blog.example.com/', 'admin.example.com/ghost']);
+});
+
+it('writes the pages and the Traefik routes through sudo, and removes them when maintenance ends', function () {
+    $application = maintenanceApplication(['is_maintenance_enabled' => true]);
+    $service = maintenanceService(['ghost' => 'https://blog.example.com']);
+    $service->forceFill(['is_maintenance_enabled' => true])->save();
+    $pages = '/data/coolify/proxy/error-pages';
+
+    maintenanceServer()->setupMaintenancePages();
+    $lines = maintenanceScriptLines();
+
+    expect($lines)->toContain("sudo find $pages -maxdepth 1 -name 'maintenance-*.html' ! -name 'maintenance-{$application->uuid}.html' ! -name 'maintenance-{$service->uuid}.html' -delete")
+        ->and(collect($lines)->contains(fn ($line) => str_starts_with($line, 'sudo docker start coolify-proxy-error-pages')))->toBeTrue()
+        ->and(writtenProxyFile($lines, "$pages/maintenance-{$application->uuid}.html"))->toContain('We are doing some maintenance')
+        ->and(writtenProxyFile($lines, "$pages/maintenance-{$service->uuid}.html"))->toContain('We are doing some maintenance')
+        ->and(writtenProxyFile($lines, '/data/coolify/proxy//dynamic/coolify-maintenance.yaml'))
+        ->toContain('app.example.com')->toContain('blog.example.com');
+
+    $application->forceFill(['is_maintenance_enabled' => false])->save();
+    $service->forceFill(['is_maintenance_enabled' => false])->save();
+    maintenanceServer()->setupMaintenancePages();
+
+    expect(maintenanceScriptLines())->toContain('sudo rm -f /data/coolify/proxy//dynamic/coolify-maintenance.yaml')
+        ->toContain("sudo find $pages -maxdepth 1 -name 'maintenance-*.html' -delete");
+});
+
+it('writes the maintenance blocks into the base Caddyfile on Caddy servers', function () {
+    $this->server->proxy->type = ProxyTypes::CADDY->value;
+    $this->server->save();
+    $application = maintenanceApplication(['is_maintenance_enabled' => true]);
+
+    maintenanceServer()->setupMaintenancePages();
+
+    expect(writtenProxyFile(maintenanceScriptLines(), '/data/coolify/proxy/caddy/dynamic/Caddyfile'))
+        ->toContain("@coolify-maintenance-{$application->uuid}-0 path /*");
+});
+
+it('keeps the page container for maintenance when a redirect URL replaces the catch-all page', function () {
+    maintenanceApplication(['is_maintenance_enabled' => true]);
+    $server = maintenanceServer();
+    $server->proxy->redirect_url = 'https://example.com';
+    $server->save();
+
+    $server->setupProxyErrorPageContainer();
+
+    expect(collect(maintenanceScriptLines())->contains(fn ($line) => str_contains($line, 'docker run -d --name coolify-proxy-error-pages')))->toBeTrue();
+});
+
+it('does not touch Swarm servers', function () {
+    maintenanceApplication(['is_maintenance_enabled' => true]);
+    $this->server->settings->update(['is_swarm_manager' => true]);
+
+    $server = maintenanceServer();
+    $server->setupMaintenancePages();
+
+    expect($server->maintenanceResources())->toBeEmpty();
+    Process::assertNothingRan();
+});
+
+function maintenanceUser(Team $team, string $role): User
+{
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
+
+    return $user;
+}
+
+it('lets an admin enable maintenance and save a custom page', function () {
+    $application = maintenanceApplication();
+    $this->actingAs(maintenanceUser($this->team, 'admin'));
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Maintenance::class, ['resource' => $application])
+        ->set('maintenancePage', '<h1>Back soon</h1>')
+        ->call('submit')
+        ->assertDispatched('success')
+        ->set('isMaintenanceEnabled', true)
+        ->call('instantSaveMaintenance')
+        ->assertDispatched('success');
+
+    $application->refresh();
+    expect($application->is_maintenance_enabled)->toBeTrue()
+        ->and($application->maintenance_page)->toBe('<h1>Back soon</h1>')
+        ->and(writtenProxyFile(maintenanceScriptLines(), "/data/coolify/proxy/error-pages/maintenance-{$application->uuid}.html"))->toBe('<h1>Back soon</h1>');
+});
+
+it('rejects a maintenance page larger than the limit', function () {
+    $application = maintenanceApplication();
+    $this->actingAs(maintenanceUser($this->team, 'owner'));
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Maintenance::class, ['resource' => $application])
+        ->set('maintenancePage', str_repeat('a', Server::PROXY_ERROR_PAGE_MAX_BYTES + 1))
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect($application->fresh()->maintenance_page)->toBeNull();
+});
+
+it('does not let a member or another team change maintenance mode', function (string $who) {
+    $service = maintenanceService(['ghost' => 'https://blog.example.com']);
+    $team = $who === 'member' ? $this->team : Team::factory()->create();
+    $this->actingAs(maintenanceUser($team, $who === 'member' ? 'member' : 'owner'));
+    session(['currentTeam' => $team]);
+
+    Livewire::test(Maintenance::class, ['resource' => $service])
+        ->set('isMaintenanceEnabled', true)
+        ->call('instantSaveMaintenance')
+        ->assertDispatched('error')
+        ->set('maintenancePage', '<h1>Hacked</h1>')
+        ->call('submit')
+        ->assertDispatched('error');
+
+    $service->refresh();
+    expect($service->is_maintenance_enabled)->toBeFalse()
+        ->and($service->maintenance_page)->toBeNull();
+    Process::assertNothingRan();
+})->with(['member', 'other team']);
diff --git a/tests/Feature/Proxy/NonRootProxyCommandsTest.php b/tests/Feature/Proxy/NonRootProxyCommandsTest.php
index 04ac7980e6..3718b54d56 100644
--- a/tests/Feature/Proxy/NonRootProxyCommandsTest.php
+++ b/tests/Feature/Proxy/NonRootProxyCommandsTest.php
@@ -93,8 +93,10 @@ it('writes the Caddyfile through sudo', function () {
 
     StartProxy::run($this->server, async: false, force: true);
 
+    $base64 = base64_encode("import /dynamic/*.caddy\n");
+
     expect(nonRootProxyScriptLines())
-        ->toContain("echo 'import /dynamic/*.caddy' | sudo tee /data/coolify/proxy/caddy/dynamic/Caddyfile > /dev/null");
+        ->toContain("echo '{$base64}' | sudo base64 -d | sudo tee /data/coolify/proxy/caddy/dynamic/Caddyfile > /dev/null");
 });
 
 it('deploys the swarm proxy stack with an absolute compose file path', function () {
diff --git a/tests/Feature/Proxy/ProxyErrorPageTest.php b/tests/Feature/Proxy/ProxyErrorPageTest.php
new file mode 100644
index 0000000000..4d1f939459
--- /dev/null
+++ b/tests/Feature/Proxy/ProxyErrorPageTest.php
@@ -0,0 +1,286 @@
+<?php
+
+use App\Actions\Proxy\StopProxy;
+use App\Enums\ProxyTypes;
+use App\Events\ProxyStatusChanged;
+use App\Events\ProxyStatusChangedUI;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Process;
+use Livewire\Livewire;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+// Servers stay in a static identity map; do not leak them into later test files.
+afterEach(fn () => Server::flushIdentityMap());
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Event::fake([ProxyStatusChanged::class, ProxyStatusChangedUI::class]);
+    InstanceSettings::forceCreate(['id' => 0]);
+    config(['constants.ssh.mux_enabled' => false]);
+    fakeProxyFileUploads();
+
+    $this->team = Team::factory()->create();
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'user' => 'cooluser',
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+    $this->server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+});
+
+function useErrorPageProxy(Server $server, string $proxyType, array $proxy = []): Server
+{
+    $server->proxy->type = $proxyType;
+    foreach ($proxy as $key => $value) {
+        $server->proxy->{$key} = $value;
+    }
+    $server->save();
+
+    return $server->refresh();
+}
+
+/**
+ * @return array<int, string>
+ */
+function errorPageScriptLines(): array
+{
+    $lines = [];
+    Process::assertRan(function ($process) use (&$lines) {
+        array_push($lines, ...explode("\n", $process->command));
+
+        return true;
+    });
+
+    return $lines;
+}
+
+it('routes the Traefik catch-all through the errors middleware and keeps the 503', function () {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value);
+
+    $config = Yaml::parse($server->defaultRedirectConfiguration());
+
+    expect($config['http']['routers']['catchall']['service'])->toBe('noop')
+        ->and($config['http']['routers']['catchall']['middlewares'])->toBe(['error-pages'])
+        ->and($config['http']['services']['noop']['loadBalancer']['servers'])->toBe([])
+        ->and($config['http']['middlewares']['error-pages']['errors'])->toBe([
+            'status' => ['503'],
+            'service' => 'error-pages',
+            'query' => '/503.html',
+        ])
+        ->and($config['http']['services']['error-pages']['loadBalancer']['servers'])
+        ->toBe([['url' => 'http://coolify-proxy-error-pages:80']]);
+});
+
+it('catches plain HTTP with a router without TLS', function (array $proxy, array $middlewares) {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value, $proxy);
+
+    $routers = Yaml::parse($server->defaultRedirectConfiguration())['http']['routers'];
+
+    // A router with `tls` matches only HTTPS, so plain HTTP needs the catchall-http router.
+    expect($routers['catchall']['entryPoints'])->toBe(['https'])
+        ->and($routers['catchall']['tls'])->toBe(['certResolver' => 'letsencrypt'])
+        ->and($routers['catchall-http'])->toBe([
+            'entryPoints' => ['http'],
+            'service' => 'noop',
+            'rule' => 'PathPrefix(`/`)',
+            'priority' => -1000,
+            'middlewares' => $middlewares,
+        ]);
+})->with([
+    'error page' => [[], ['error-pages']],
+    'redirect URL' => [['redirect_url' => 'https://example.com'], ['redirect-regexp']],
+]);
+
+it('serves the error page through Caddy with a 503 status', function () {
+    $server = useErrorPageProxy($this->server, ProxyTypes::CADDY->value);
+
+    expect($server->defaultRedirectConfiguration())
+        ->toContain('reverse_proxy coolify-proxy-error-pages:80 {')
+        ->toContain('rewrite /503.html')
+        ->toContain('copy_response 503')
+        ->not->toContain('respond 503');
+});
+
+it('keeps the redirect URL ahead of the error page', function (string $proxyType) {
+    $server = useErrorPageProxy($this->server, $proxyType, ['redirect_url' => 'https://example.com']);
+    $server->proxy_error_page = '<h1>custom</h1>';
+    $server->save();
+
+    $configuration = $server->defaultRedirectConfiguration();
+    $server->setupDefaultRedirect();
+    $lines = errorPageScriptLines();
+
+    expect($configuration)->toContain('https://example.com')->not->toContain('error-pages')
+        ->and($lines)->toContain('sudo docker rm -f coolify-proxy-error-pages >/dev/null 2>&1 || sudo true')
+        ->and(implode("\n", $lines))->not->toContain('docker run');
+})->with([ProxyTypes::TRAEFIK->value, ProxyTypes::CADDY->value]);
+
+it('removes the catch-all and the page container when the default redirect is disabled', function () {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value, ['redirect_enabled' => false]);
+
+    $server->setupDefaultRedirect();
+    $lines = errorPageScriptLines();
+
+    expect($lines)
+        ->toContain('sudo rm -f /data/coolify/proxy//dynamic/default_redirect_503.yaml')
+        ->toContain('sudo docker rm -f coolify-proxy-error-pages >/dev/null 2>&1 || sudo true')
+        ->and(writtenProxyFile($lines, '/data/coolify/proxy//dynamic/default_redirect_503.yaml'))->toBeNull();
+});
+
+it('starts the page container through sudo before it writes the catch-all', function (string $proxyType, string $catchAll) {
+    $server = useErrorPageProxy($this->server, $proxyType);
+
+    $server->setupDefaultRedirect();
+    $lines = errorPageScriptLines();
+
+    $runLine = collect($lines)->search(fn (string $line) => str_contains($line, 'docker run -d --name coolify-proxy-error-pages'));
+    $catchAllLine = collect($lines)->search(fn (string $line) => str_contains($line, "tee $catchAll"));
+
+    expect($runLine)->toBeInt()
+        ->and($catchAllLine)->toBeInt()
+        ->and($runLine)->toBeLessThan($catchAllLine)
+        ->and($lines[$runLine])->toBe('sudo docker start coolify-proxy-error-pages >/dev/null 2>&1 || sudo docker run -d --name coolify-proxy-error-pages --network coolify --restart unless-stopped --label coolify.managed=true -v /data/coolify/proxy/error-pages:/www:ro busybox:musl httpd -f -p 80 -h /www')
+        ->and($lines)->toContain('sudo mkdir -p /data/coolify/proxy/error-pages && sudo find /data/coolify/proxy/error-pages -user root -exec chown -h cooluser:cooluser {} + && sudo chmod o-rwx /data/coolify/proxy/error-pages')
+        // The page goes through scp, then sudo moves it into place.
+        ->and(collect($lines)->contains(fn (string $line) => preg_match('#^sudo mv -f /tmp/coolify-upload-[0-9a-f]+ /data/coolify/proxy/error-pages/503.html$#', $line) === 1))->toBeTrue()
+        ->and($lines)->toContain('sudo chmod 644 /data/coolify/proxy/error-pages/503.html')
+        ->and(writtenProxyFile($lines, '/data/coolify/proxy/error-pages/503.html'))->toContain('This site is not available at the moment')
+        ->and(writtenProxyFile($lines, $catchAll))->toContain('coolify-proxy-error-pages');
+})->with([
+    'traefik' => [ProxyTypes::TRAEFIK->value, '/data/coolify/proxy//dynamic/default_redirect_503.yaml'],
+    'caddy' => [ProxyTypes::CADDY->value, '/data/coolify/proxy/caddy/dynamic/default_redirect_503.caddy'],
+]);
+
+it('pushes the custom page and falls back to the default page after a reset', function () {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value);
+    $server->proxy_error_page = '<h1>Maintenance</h1>';
+    $server->save();
+
+    $server->setupDefaultRedirect();
+    expect(writtenProxyFile(errorPageScriptLines(), '/data/coolify/proxy/error-pages/503.html'))->toBe('<h1>Maintenance</h1>');
+
+    $server->proxy_error_page = null;
+    $server->save();
+    $server->setupDefaultRedirect();
+
+    expect(writtenProxyFile(errorPageScriptLines(), '/data/coolify/proxy/error-pages/503.html'))
+        ->toContain('This site is not available at the moment')
+        ->toContain('https://coolify.io/docs/troubleshoot/applications/no-available-server')
+        ->not->toContain($server->name)
+        ->not->toContain($server->ip)
+        ->not->toContain($this->team->name);
+});
+
+it('keeps Swarm servers on the plain catch-all without a page container', function (string $swarmSetting) {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value);
+    $server->settings->update([$swarmSetting => true]);
+    $server->refresh();
+
+    $config = Yaml::parse($server->defaultRedirectConfiguration());
+    $server->setupDefaultRedirect();
+
+    expect($config['http']['routers'])->toBe(['catchall' => [
+        'entryPoints' => ['http', 'https'],
+        'service' => 'noop',
+        'rule' => 'PathPrefix(`/`)',
+        'tls' => ['certResolver' => 'letsencrypt'],
+        'priority' => -1000,
+    ]])
+        ->and($config['http'])->not->toHaveKey('middlewares')
+        ->and(array_keys($config['http']['services']))->toBe(['noop'])
+        ->and(implode("\n", errorPageScriptLines()))->not->toContain('coolify-proxy-error-pages');
+})->with(['is_swarm_manager', 'is_swarm_worker']);
+
+it('removes the page container when the proxy stops', function () {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value);
+
+    StopProxy::run($server);
+
+    expect(errorPageScriptLines())->toContain('sudo docker rm -f coolify-proxy-error-pages 2>/dev/null || sudo true');
+});
+
+function errorPageUser(Team $team, string $role): User
+{
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
+
+    return $user;
+}
+
+it('lets an admin save and reset the custom error page', function () {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value);
+    $this->actingAs(errorPageUser($this->team, 'admin'));
+    session(['currentTeam' => $this->team]);
+
+    // The page loads the proxy configuration before the global save bar submits it.
+    $component = Livewire::test('server.proxy', ['server' => $server])
+        ->set('proxySettings', "services:\n  traefik:\n    image: traefik:v3.6\n    ports:\n      - '80:80'\n")
+        ->set('customErrorPage', '<h1>Maintenance</h1>')
+        ->call('submit')
+        ->assertDispatched('success');
+
+    expect($server->fresh()->proxy_error_page)->toBe('<h1>Maintenance</h1>')
+        ->and(writtenProxyFile(errorPageScriptLines(), '/data/coolify/proxy/error-pages/503.html'))->toBe('<h1>Maintenance</h1>');
+
+    $component->call('resetCustomErrorPage')
+        ->assertDispatched('success')
+        ->assertSet('customErrorPage', null);
+
+    expect($server->fresh()->proxy_error_page)->toBeNull();
+});
+
+it('uploads a custom page larger than one shell argument', function () {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value);
+    $page = '<h1>Big</h1>'.str_repeat('a', 300 * 1024);
+    $server->proxy_error_page = $page;
+    $server->save();
+
+    $server->setupDefaultRedirect();
+    $lines = errorPageScriptLines();
+
+    // Linux limits one shell argument to 128 KiB, so the page must not be inside a command.
+    expect(writtenProxyFile($lines, '/data/coolify/proxy/error-pages/503.html'))->toBe($page)
+        ->and(collect($lines)->max(fn (string $line) => strlen($line)))->toBeLessThan(128 * 1024);
+});
+
+it('rejects a custom error page larger than the limit', function () {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value);
+    $this->actingAs(errorPageUser($this->team, 'owner'));
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test('server.proxy', ['server' => $server])
+        ->set('customErrorPage', str_repeat('a', Server::PROXY_ERROR_PAGE_MAX_BYTES + 1))
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect($server->fresh()->proxy_error_page)->toBeNull();
+    Process::assertNothingRan();
+});
+
+it('does not let a member or another team change the custom error page', function (string $who) {
+    $server = useErrorPageProxy($this->server, ProxyTypes::TRAEFIK->value);
+    $server->proxy_error_page = '<h1>Original</h1>';
+    $server->save();
+
+    $team = $who === 'member' ? $this->team : Team::factory()->create();
+    $this->actingAs(errorPageUser($team, $who === 'member' ? 'member' : 'owner'));
+    session(['currentTeam' => $team]);
+
+    Livewire::test('server.proxy', ['server' => $server])
+        ->set('customErrorPage', '<h1>Hacked</h1>')
+        ->call('submit')
+        ->assertDispatched('error')
+        ->call('resetCustomErrorPage')
+        ->assertDispatched('error');
+
+    expect($server->fresh()->proxy_error_page)->toBe('<h1>Original</h1>');
+    Process::assertNothingRan();
+})->with(['member', 'other team']);
diff --git a/tests/Feature/ReencryptWithAppKeyCommandTest.php b/tests/Feature/ReencryptWithAppKeyCommandTest.php
new file mode 100644
index 0000000000..02c6ab7713
--- /dev/null
+++ b/tests/Feature/ReencryptWithAppKeyCommandTest.php
@@ -0,0 +1,142 @@
+<?php
+
+use App\Actions\Server\StartSentinel;
+use App\Console\Commands\ReencryptWithAppKey;
+use App\Models\Application;
+use App\Models\EnvironmentVariable;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\ServerSetting;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Queue;
+use Symfony\Component\Finder\Finder;
+
+uses(RefreshDatabase::class);
+
+function useAppKeys(string $key, array $previousKeys = []): void
+{
+    config(['app.key' => $key, 'app.previous_keys' => $previousKeys]);
+    app()->forgetInstance('encrypter');
+    Crypt::clearResolvedInstance('encrypter');
+}
+
+function newAppKey(): string
+{
+    return 'base64:'.base64_encode(random_bytes(32));
+}
+
+beforeEach(function () {
+    Queue::fake();
+    $this->oldKey = newAppKey();
+    $this->newKey = newAppKey();
+    useAppKeys($this->oldKey);
+
+    InstanceSettings::forceCreate(['id' => 0, 'smtp_password' => 'instance-smtp-password']);
+    $this->team = Team::factory()->create();
+    $this->privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
+    $this->server->settings->forceFill(['is_sentinel_enabled' => true])->saveQuietly();
+    $this->environmentVariable = EnvironmentVariable::create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://user:secret@db:5432/app',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => Application::factory()->create()->id,
+    ]);
+    $this->gitlabApp = GitlabApp::create([
+        'name' => 'GitLab',
+        'api_url' => 'https://gitlab.example.com/api/v4',
+        'html_url' => 'https://gitlab.example.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'webhook_token' => 'secret-webhook-token',
+        'team_id' => $this->team->id,
+    ]);
+    $this->oldSentinelToken = $this->server->settings->sentinel_token;
+    $this->privateKeyValue = $this->privateKey->private_key;
+});
+
+it('re-encrypts stored secrets so they decrypt without the previous key', function () {
+    useAppKeys($this->newKey, [$this->oldKey]);
+
+    $this->artisan('app-key:reencrypt --force')
+        ->expectsOutputToContain('Regenerated 1 Sentinel tokens.')
+        ->assertSuccessful();
+    StartSentinel::assertPushed();
+
+    useAppKeys($this->newKey);
+
+    expect(InstanceSettings::query()->find(0)->smtp_password)->toBe('instance-smtp-password')
+        ->and($this->privateKey->fresh()->private_key)->toBe($this->privateKeyValue)
+        ->and($this->environmentVariable->fresh()->value)->toBe('postgres://user:secret@db:5432/app')
+        ->and($this->gitlabApp->fresh()->webhook_token)->toBe('secret-webhook-token');
+
+    $sentinelToken = $this->server->settings->fresh()->sentinel_token;
+    expect($sentinelToken)->not->toBe($this->oldSentinelToken)
+        ->and(json_decode(decrypt($sentinelToken), true))->toBe(['server_uuid' => $this->server->uuid]);
+});
+
+it('changes nothing when every secret already uses the current key', function () {
+    useAppKeys($this->newKey, [$this->oldKey]);
+    $this->artisan('app-key:reencrypt --force')->assertSuccessful();
+    $rawPrivateKey = DB::table('private_keys')->where('id', $this->privateKey->id)->value('private_key');
+
+    $this->artisan('app-key:reencrypt --force')
+        ->expectsOutputToContain('Re-encrypted 0 values.')
+        ->expectsOutputToContain('Regenerated 0 Sentinel tokens.')
+        ->assertSuccessful();
+
+    expect(DB::table('private_keys')->where('id', $this->privateKey->id)->value('private_key'))->toBe($rawPrivateKey);
+});
+
+it('reports old-key values in a dry run without changing them', function () {
+    $rawPrivateKey = DB::table('private_keys')->where('id', $this->privateKey->id)->value('private_key');
+    useAppKeys($this->newKey, [$this->oldKey]);
+
+    $this->artisan('app-key:reencrypt --dry-run')
+        ->expectsOutputToContain('values and 1 Sentinel tokens use an old key. Nothing was changed.')
+        ->assertSuccessful();
+
+    expect(DB::table('private_keys')->where('id', $this->privateKey->id)->value('private_key'))->toBe($rawPrivateKey)
+        ->and($this->server->settings->fresh()->sentinel_token)->toBe($this->oldSentinelToken);
+    StartSentinel::assertNotPushed();
+});
+
+it('keeps legacy plaintext values as they are', function () {
+    DB::table('gitlab_apps')->where('id', $this->gitlabApp->id)->update(['webhook_token' => 'legacy-plaintext-token']);
+    useAppKeys($this->newKey, [$this->oldKey]);
+
+    $this->artisan('app-key:reencrypt --force')->assertSuccessful();
+
+    expect(DB::table('gitlab_apps')->where('id', $this->gitlabApp->id)->value('webhook_token'))->toBe('legacy-plaintext-token');
+});
+
+it('fails and keeps values that no configured key can decrypt', function () {
+    $rawPrivateKey = DB::table('private_keys')->where('id', $this->privateKey->id)->value('private_key');
+    useAppKeys($this->newKey);
+
+    $this->artisan('app-key:reencrypt --force')
+        ->expectsOutputToContain('cannot be decrypted with APP_KEY or APP_PREVIOUS_KEYS')
+        ->assertFailed();
+
+    expect(DB::table('private_keys')->where('id', $this->privateKey->id)->value('private_key'))->toBe($rawPrivateKey);
+});
+
+it('knows every model that encrypts data without an encrypted cast', function () {
+    // Reviewed: EnvironmentVariable encrypts its "value" column, which also has an encrypted cast.
+    // ServerSetting encrypts the Sentinel token, which the command regenerates.
+    $reviewed = [EnvironmentVariable::class, ServerSetting::class];
+
+    $manualEncryption = collect(Finder::create()->files()->in(app_path('Models'))->name('*.php'))
+        ->filter(fn ($file) => preg_match('/\bCrypt::|(?<![\w>:$])(en|de)crypt\(/', $file->getContents()) === 1)
+        ->map(fn ($file) => 'App\\Models\\'.str_replace(['/', '.php'], ['\\', ''], $file->getRelativePathname()))
+        ->values()
+        ->all();
+
+    expect(array_diff($manualEncryption, [...array_keys(ReencryptWithAppKey::ACCESSOR_ENCRYPTED_COLUMNS), ...$reviewed]))
+        ->toBe([], 'Add the encrypted columns of these models to ReencryptWithAppKey::ACCESSOR_ENCRYPTED_COLUMNS.');
+});
diff --git a/tests/Feature/RemoteProcessRedactionTest.php b/tests/Feature/RemoteProcessRedactionTest.php
new file mode 100644
index 0000000000..525dda6614
--- /dev/null
+++ b/tests/Feature/RemoteProcessRedactionTest.php
@@ -0,0 +1,233 @@
+<?php
+
+use App\Actions\CoolifyTask\RunRemoteProcess;
+use App\Jobs\CoolifyTask;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\Team;
+use App\Services\DatabaseStartCommandExecutor;
+use App\Services\DockerRegistryLogins;
+use App\Support\ResourceStartActivity;
+use Illuminate\Contracts\Process\InvokedProcess;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Process\Exceptions\ProcessTimedOutException;
+use Illuminate\Process\FakeProcessResult;
+use Illuminate\Process\ProcessResult;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Spatie\Activitylog\Models\Activity;
+use Symfony\Component\Process\Exception\ProcessTimedOutException as SymfonyProcessTimedOutException;
+use Symfony\Component\Process\Process as SymfonyProcess;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('cache.default', 'array');
+    config()->set('constants.ssh.mux_enabled', false);
+    InstanceSettings::forceCreate(['id' => 0]);
+    Queue::fake();
+
+    $this->team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+        'user' => 'root',
+    ]);
+});
+
+function remoteProcessRedactionService(Team $team, bool $redactAll): Service
+{
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'environment_id' => $environment->id,
+        'redact_all_env_values_in_logs' => $redactAll,
+    ]);
+    foreach (['VISIBLE_VALUE' => ['visible-service-value', false], 'LOCKED_VALUE' => ['locked-service-value', true]] as $key => [$value, $locked]) {
+        EnvironmentVariable::query()->create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => $service->getMorphClass(),
+            'resourceable_id' => $service->id,
+            'is_preview' => false,
+            'is_shown_once' => $locked,
+        ]);
+    }
+
+    return $service;
+}
+
+function remoteProcessTimeout(): ProcessTimedOutException
+{
+    $process = new SymfonyProcess(['ssh', 'root@host', 'echo SECRET_COMMAND_VALUE']);
+    $process->setTimeout(5);
+
+    return new ProcessTimedOutException(new SymfonyProcessTimedOutException($process, SymfonyProcessTimedOutException::TYPE_GENERAL), new ProcessResult($process));
+}
+
+it('hides service environment values in remote process output', function (bool $redactAll, string $expected) {
+    $service = remoteProcessRedactionService($this->team, $redactAll);
+    Process::fake(fn () => Process::result(output: 'visible-service-value locked-service-value'));
+    $activity = remote_process(['docker compose up -d'], $this->server, type_uuid: $service->uuid);
+
+    (new RunRemoteProcess(Activity::query()->findOrFail($activity->id)))();
+
+    $stored = Activity::query()->findOrFail($activity->id);
+    expect(RunRemoteProcess::decodeOutput($stored))->toBe($expected)
+        ->and($stored->getExtraProperty('stdout'))->toBe($expected);
+})->with([
+    'redact all values' => [true, REDACTED.' '.REDACTED."\n"],
+    'redact locked values only' => [false, 'visible-service-value '.REDACTED."\n"],
+]);
+
+it('does not put the command of a timed out remote process in the error', function () {
+    Process::fake(fn () => throw remoteProcessTimeout());
+    $activity = remote_process(['echo SECRET_COMMAND_VALUE'], $this->server);
+
+    $run = new RunRemoteProcess(Activity::query()->findOrFail($activity->id));
+
+    expect(fn () => $run())->toThrow(fn (RuntimeException $exception) => expect($exception->getMessage())
+        ->not->toContain('SECRET_COMMAND_VALUE')
+        ->and($exception->getCode())->toBe(124)
+        ->and($exception->getPrevious())->toBeNull());
+});
+
+it('does not put the command of a timed out registry login in the error', function () {
+    Process::fake(fn () => throw remoteProcessTimeout());
+
+    expect(fn () => DockerRegistryLogins::login($this->server, 'ghcr.io', 'user', 'SECRET_COMMAND_VALUE'))
+        ->toThrow(fn (RuntimeException $exception) => expect($exception->getMessage())
+            ->not->toContain('SECRET_COMMAND_VALUE')
+            ->and($exception->getCode())->toBe(124));
+});
+
+it('stores a redacted error when a coolify task fails permanently', function () {
+    $activity = remote_process(['echo ok'], $this->server);
+    $task = new CoolifyTask(Activity::query()->findOrFail($activity->id), ignore_errors: false, call_event_on_finish: null, call_event_data: null);
+
+    $task->failed(new RuntimeException('failed: password=task-secret-value'));
+
+    expect(Activity::query()->findOrFail($activity->id)->getExtraProperty('error'))
+        ->not->toContain('task-secret-value')
+        ->toContain(REDACTED);
+});
+
+it('stores a redacted message when an activity is marked as failed', function () {
+    $activity = remote_process(['echo ok'], $this->server);
+
+    ResourceStartActivity::markFailed($activity, 'failed: password=mark-failed-secret');
+
+    $stored = Activity::query()->findOrFail($activity->id);
+    expect($stored->getExtraProperty('error'))->not->toContain('mark-failed-secret')->toContain(REDACTED)
+        ->and($stored->description)->not->toContain('mark-failed-secret');
+});
+
+it('redacts a database start secret that is split across output chunks', function () {
+    $database = new class extends Model
+    {
+        public function resolvedSecretManagerValuesForRedaction(): array
+        {
+            return ['split-secret-value'];
+        }
+    };
+    $database->setRelation('destination', (object) ['server' => $this->server]);
+    $activity = remote_process(['echo ok'], $this->server);
+    // The process fake ends every output chunk with a newline, so the chunks are sent by hand.
+    $invoked = Mockery::mock(InvokedProcess::class);
+    Process::shouldReceive('timeout->idleTimeout->start')->andReturnUsing(function (string $command, Closure $output) use ($invoked) {
+        $invoked->shouldReceive('wait')->andReturnUsing(function () use ($output) {
+            foreach (['value is split-sec', "ret-value\nnext ", 'line split-secret-value'] as $chunk) {
+                $output('out', $chunk);
+            }
+
+            return new FakeProcessResult;
+        });
+
+        return $invoked;
+    });
+
+    app(DatabaseStartCommandExecutor::class)->execute(['echo ok'], $database, $activity);
+
+    expect(RunRemoteProcess::decodeOutput(Activity::query()->findOrFail($activity->id)))
+        ->toBe('value is '.REDACTED."\nnext line ".REDACTED);
+});
+
+/**
+ * Runs a remote process whose output arrives in the given chunks, like a real SSH stream.
+ *
+ * @param  list<array{0: string, 1: string}>  $chunks
+ */
+function runRemoteProcessWithChunks(Activity $activity, array $chunks, ?Throwable $failure = null): void
+{
+    // The process fake ends every output chunk with a newline, so the chunks are sent by hand.
+    $invoked = Mockery::mock(InvokedProcess::class);
+    $invoked->shouldReceive('id')->andReturn(123);
+    Process::shouldReceive('timeout->start')->andReturnUsing(function (string $command, Closure $output) use ($invoked, $chunks, $failure) {
+        $invoked->shouldReceive('wait')->andReturnUsing(function () use ($output, $chunks, $failure) {
+            foreach ($chunks as [$type, $chunk]) {
+                $output($type, $chunk);
+            }
+            if ($failure !== null) {
+                throw $failure;
+            }
+
+            return new FakeProcessResult;
+        });
+
+        return $invoked;
+    });
+
+    (new RunRemoteProcess(Activity::query()->findOrFail($activity->id)))();
+}
+
+it('redacts a remote process secret that is split across output chunks', function () {
+    $service = remoteProcessRedactionService($this->team, redactAll: false);
+    $activity = remote_process(['docker compose up -d'], $this->server, type_uuid: $service->uuid);
+
+    runRemoteProcessWithChunks($activity, [
+        ['out', 'value is locked-ser'],
+        ['err', 'error locked-se'],
+        ['out', "vice-value\nnext "],
+        ['err', "rvice-value\n"],
+        ['out', 'line locked-service-value'],
+    ]);
+
+    $entries = collect(json_decode(Activity::query()->findOrFail($activity->id)->description, true));
+    expect($entries->where('type', 'out')->pluck('output')->implode(''))->toBe('value is '.REDACTED."\nnext line ".REDACTED)
+        ->and($entries->where('type', 'err')->pluck('output')->implode(''))->toBe('error '.REDACTED."\n")
+        ->and($entries->pluck('output')->implode(''))->not->toContain('locked-');
+});
+
+it('redacts a private key that is split across remote process output chunks', function () {
+    $activity = remote_process(['cat key'], $this->server);
+
+    runRemoteProcessWithChunks($activity, [
+        ['out', "before\n-----BEGIN OPENSSH PRIVATE KEY-----\nKEYBODYLINEONE\n"],
+        ['out', "KEYBODYLINETWO\n-----END OPENSSH PRIVATE KEY-----\nafter\n"],
+    ]);
+
+    expect(RunRemoteProcess::decodeOutput(Activity::query()->findOrFail($activity->id)))
+        ->toBe("before\n".REDACTED."\nafter\n");
+});
+
+it('hides an unfinished private key and keeps the last partial line of a timed out remote process', function () {
+    $service = remoteProcessRedactionService($this->team, redactAll: false);
+    $activity = remote_process(['cat key'], $this->server, type_uuid: $service->uuid);
+
+    expect(fn () => runRemoteProcessWithChunks($activity, [
+        ['out', "-----BEGIN PRIVATE KEY-----\nKEYBODYLINEONE\n"],
+        ['err', 'tail locked-service-value'],
+    ], remoteProcessTimeout()))->toThrow(RuntimeException::class);
+
+    $output = RunRemoteProcess::decodeOutput(Activity::query()->findOrFail($activity->id));
+    expect($output)->not->toContain('KEYBODYLINEONE')
+        ->not->toContain('locked-service-value')
+        ->toContain('tail '.REDACTED);
+});
diff --git a/tests/Feature/RepositoryScanSecurityTest.php b/tests/Feature/RepositoryScanSecurityTest.php
new file mode 100644
index 0000000000..4d1d441736
--- /dev/null
+++ b/tests/Feature/RepositoryScanSecurityTest.php
@@ -0,0 +1,98 @@
+<?php
+
+use App\Livewire\Project\New\GithubPrivateRepository;
+use App\Livewire\Project\New\GithubPrivateRepositoryDeployKey;
+use App\Livewire\Project\New\PublicGitRepository;
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\RepositoryDetector;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Validation\ValidationException;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->actingAs($this->user);
+    session(['currentTeam' => ['id' => $this->team->id]]);
+});
+
+test('members cannot start scans in any creation flow', function (string $componentClass) {
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+    $component = new $componentClass;
+    expect(fn () => $component->detectRepository())->toThrow(AuthorizationException::class);
+})->with([PublicGitRepository::class, GithubPrivateRepository::class, GithubPrivateRepositoryDeployKey::class]);
+
+test('owners cannot use scan base directory traversal', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $component = new PublicGitRepository;
+    $component->git_repository = 'https://github.com/test/repo';
+    $component->base_directory = '/../outside';
+    expect(fn () => $component->detectRepository())->toThrow(ValidationException::class);
+});
+
+test('scan does not run on a destination from another team', function () {
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $otherServer = Server::factory()->create(['team_id' => Team::factory()->create()->id]);
+    $otherDestination = $otherServer->standaloneDockers()->firstOrFail();
+
+    Livewire\Livewire::test(RepositoryScanStateTestComponent::class)
+        ->set('git_repository', 'https://github.com/test/repo')
+        ->set('query', ['destination' => $otherDestination->uuid])
+        ->call('detectRepository')
+        ->assertDispatched('error', 'Destination not found.')
+        ->assertSet('detectionRan', false);
+});
+
+test('environment import stores valid keys and skips malformed keys', function () {
+    $application = Application::factory()->create(['build_pack' => 'dockerfile']);
+    $component = new class extends PublicGitRepository
+    {
+        public function importInto(Application $application): void
+        {
+            $this->importDetectedEnvironmentVariables($application);
+        }
+    };
+    $component->envImported = true;
+    $component->envExampleVars = ['VALID_KEY' => 'value', 'invalid.key' => 'ignored', '1BAD' => 'ignored'];
+    $component->importInto($application);
+    expect($application->environment_variables()->pluck('value', 'key')->all())->toBe(['VALID_KEY' => 'value']);
+});
+
+class RepositoryScanStateTestComponent extends PublicGitRepository
+{
+    public function mount() {}
+
+    public function render()
+    {
+        return '<div></div>';
+    }
+}
+
+test('clients cannot change the detected Dockerfile allowlist', function () {
+    expect(fn () => Livewire\Livewire::test(RepositoryScanStateTestComponent::class)
+        ->set('detectedDockerfiles', ['../../outside/Dockerfile']))
+        ->toThrow(CannotUpdateLockedPropertyException::class);
+});
+
+test('deploy key scans clone with the key, like a deployment', function () {
+    $application = (new Application)->forceFill(['git_repository' => 'git@github.com:test/private.git', 'git_branch' => 'main', 'git_commit_sha' => 'HEAD', 'private_key_id' => 5]);
+    $application->setRelation('settings', (new ApplicationSetting)->forceFill(['is_git_shallow_clone_enabled' => true, 'is_git_submodules_enabled' => false]));
+    $application->setRelation('source', null);
+    $application->setRelation('private_key', (new PrivateKey)->forceFill(['private_key' => 'test-key']));
+    $detector = new RepositoryDetector($application, '/', new Server);
+
+    $clone = (new ReflectionMethod($detector, 'scanCommands'))->invoke($detector, 'scan-test')->get(3);
+
+    expect($clone)->toStartWith('sh -c ')
+        ->toContain(base64_encode('test-key'))
+        ->toContain('-i /root/.ssh/id_rsa_coolify_scan-test')
+        ->toContain('git@github.com:test/private.git');
+});
diff --git a/tests/Feature/ResourceLogoTest.php b/tests/Feature/ResourceLogoTest.php
new file mode 100644
index 0000000000..79c36ef585
--- /dev/null
+++ b/tests/Feature/ResourceLogoTest.php
@@ -0,0 +1,71 @@
+<?php
+
+use App\Models\Application;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\Service;
+use App\Models\StandaloneKeydb;
+use App\Models\StandalonePostgresql;
+
+beforeEach(function () {
+    config(['cache.default' => 'array']);
+});
+
+test('databases get the logo of their engine', function () {
+    expect(resource_logo(new StandalonePostgresql))
+        ->toBe(['src' => resource_logo_url('postgres'), 'dark' => null, 'fallback' => null, 'padded' => false, 'favicon' => null])
+        ->and(resource_logo(new StandaloneKeydb))
+        ->toBe(['src' => resource_logo_url('keydb'), 'dark' => resource_logo_url('keydb-dark'), 'fallback' => null, 'padded' => false, 'favicon' => null]);
+});
+
+test('applications get the logo of how they are built', function (string $buildPack, ?string $sourceType, string $logo) {
+    $application = (new Application)->forceFill(['build_pack' => $buildPack, 'source_type' => $sourceType]);
+
+    expect(resource_logo($application)['src'])->toBe(resource_logo_url($logo));
+})->with([
+    ['nixpacks', null, 'public-repo'],
+    ['railpack', GithubApp::class, 'github-app'],
+    ['static', GitlabApp::class, 'gitlab-app'],
+    ['dockerimage', null, 'docker-image'],
+    ['dockerfile', GithubApp::class, 'dockerfile'],
+    ['dockercompose', GitlabApp::class, 'docker-compose'],
+]);
+
+test('services get the logo of their template, with the CDN as fallback', function () {
+    $template = get_service_templates()->get('n8n');
+
+    expect(resource_logo(new Service(['name' => 'renamed', 'service_type' => 'n8n'])))->toBe([
+        'src' => asset($template->logo),
+        'dark' => null,
+        'fallback' => service_logo_urls($template->logo)['logo_cdn_url'],
+        'padded' => true,
+        'favicon' => null,
+    ]);
+});
+
+test('services created before the service type was stored use the template in their name', function () {
+    expect(resource_logo(new Service(['name' => 'n8n-abc123']))['src'])->toBe(asset(get_service_templates()->get('n8n')->logo));
+});
+
+test('services without a template logo have no logo', function () {
+    expect(resource_logo(new Service(['name' => 'custom-compose'])))->toBeNull();
+});
+
+test('applications with a domain get the favicon of their first domain', function (?string $fqdn, ?string $favicon) {
+    $application = (new Application)->forceFill(['build_pack' => 'nixpacks', 'fqdn' => $fqdn]);
+
+    expect(resource_logo($application)['favicon'])->toBe($favicon);
+})->with([
+    ['https://app.example.com/dashboard,https://www.example.com', 'https://app.example.com/favicon.ico'],
+    [' http://app.example.com:8080 ', 'http://app.example.com:8080/favicon.ico'],
+    [null, null],
+    ['app.example.com', null],
+    ['https://*.example.com', null],
+]);
+
+test('resource logo URLs carry the file modification time, so browsers load changed logos', function () {
+    $modifiedAt = filemtime(public_path('svgs/resources/docker-image.svg'));
+
+    expect(resource_logo_url('docker-image'))->toBe(asset('svgs/resources/docker-image.svg')."?v={$modifiedAt}")
+        ->and(resource_logo_url('missing-logo'))->toBe(asset('svgs/resources/missing-logo.svg'));
+});
diff --git a/tests/Feature/ResourceMenuInMainNavTest.php b/tests/Feature/ResourceMenuInMainNavTest.php
new file mode 100644
index 0000000000..7776e99551
--- /dev/null
+++ b/tests/Feature/ResourceMenuInMainNavTest.php
@@ -0,0 +1,148 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::query()->create([
+            'id' => 0,
+            'is_registration_enabled' => true,
+        ]);
+    });
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'name' => 'Navbar Menu App',
+        'status' => 'running',
+    ]);
+});
+
+test('an application page teleports its menu into the main sidebar ', function () {
+    $response = $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $html = $response->getContent();
+
+    expect($html)
+        ->toContain('id="main-nav-context-0"')
+        ->toContain('x-teleport="#main-nav-context-0"')
+        ->toContain('application-settings-navigation in-main-nav')
+        ->toMatch('#<button type="button" @click="navLevel = -1; navSwap = \'back\'"\s+title="Back to the main menu"#')
+        ->not->toContain('id="main-nav-context-1"')
+        ->and(substr_count($html, 'id="main-nav-context-0"'))->toBe(1);
+});
+
+test('pages without a resource menu keep the main menu on wide screens', function () {
+    $response = $this->get(route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]));
+
+    $response->assertSuccessful();
+    expect($response->getContent())->not->toContain('id="main-nav-context-');
+});
+
+test('a database page teleports its menu into the main sidebar', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'orders-db', 'postgres_user' => 'postgres', 'postgres_password' => 'password', 'postgres_db' => 'db',
+        'image' => 'postgres:17', 'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id, 'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $html = $this->get(route('project.database.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'database_uuid' => $database->uuid,
+    ]))->assertSuccessful()->getContent();
+
+    expect($html)
+        ->toContain('id="main-nav-context-0"')
+        ->toContain('x-teleport="#main-nav-context-0"')
+        ->toContain('application-settings-navigation in-main-nav');
+});
+
+test('a server page teleports its menu into the main sidebar with a back row to the main menu', function () {
+    $html = $this->get(route('server.show', ['server_uuid' => $this->server->uuid]))
+        ->assertSuccessful()
+        ->getContent();
+
+    expect($html)
+        ->toContain('x-teleport="#main-nav-context-0"')
+        ->toContain('application-settings-navigation in-main-nav')
+        ->toMatch('#@click="navLevel = -1; navSwap = \'back\'"\s+title="Back to the main menu"#')
+        ->and(substr_count($html, 'proxyConfigurationPending: '))->toBe(2);
+});
+
+test('integration detail pages teleport their menu with a back row to the integrations submenu', function () {
+    $storage = S3Storage::create([
+        'name' => 'backup-bucket', 'region' => 'us-east-1', 'key' => 'access-key', 'secret' => 'secret-key',
+        'bucket' => 'coolify-backups', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->team->id, 'is_usable' => true,
+    ]);
+
+    $pages = [
+        route('storage.show', ['storage_uuid' => $storage->uuid]),
+        route('destination.show', ['destination_uuid' => $this->destination->uuid]),
+    ];
+
+    foreach ($pages as $url) {
+        expect($this->get($url)->assertSuccessful()->getContent())
+            ->toContain('x-teleport="#main-nav-context-0"')
+            ->toContain('application-settings-navigation in-main-nav')
+            ->toMatch('#@click="navLevel = -1; navSwap = \'back\'"\s+title="Back to Integrations"#')
+            ->toContain('data-active-submenu="Integrations"');
+    }
+});
+
+test('a database backup page keeps the database menu one back away in the main sidebar', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'orders-db', 'postgres_user' => 'postgres', 'postgres_password' => 'password', 'postgres_db' => 'db',
+        'image' => 'postgres:17', 'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id, 'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *', 'save_s3' => false, 'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(), 'team_id' => $this->team->id,
+    ]);
+
+    $html = $this->get(route('project.database.backup.execution', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'database_uuid' => $database->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]))->assertSuccessful()->getContent();
+
+    expect($html)
+        ->toContain('x-teleport="#main-nav-context-0"')
+        ->toContain('x-teleport="#main-nav-context-1"')
+        ->toMatch('#@click="navLevel = -1; navSwap = \'back\'"\s+title="Back to the main menu"#')
+        ->toMatch('#@click="navLevel = 0; navSwap = \'back\'"\s+title="Back to the database menu"#')
+        ->and(substr_count($html, 'aria-label="Database settings"'))->toBe(1)
+        ->and(substr_count($html, 'aria-label="Backup settings"'))->toBe(2);
+});
diff --git a/tests/Feature/ResourceTeamAfterTeamSwitchTest.php b/tests/Feature/ResourceTeamAfterTeamSwitchTest.php
index 6a434a035a..dfa4f32181 100644
--- a/tests/Feature/ResourceTeamAfterTeamSwitchTest.php
+++ b/tests/Feature/ResourceTeamAfterTeamSwitchTest.php
@@ -175,7 +175,7 @@ test('backup edit keeps the S3 storage of the backup team when given a foreign l
     expect($backup->fresh()->s3_storage_id)->toBe($ownS3->id)
         ->and($backup->fresh()->save_s3)->toBeTruthy();
 
-    $component->set('s3StorageId', $foreignS3->id)->call('instantSave');
+    $component->set('s3StorageIds', [$foreignS3->id])->call('instantSave');
     expect($backup->fresh()->s3_storage_id)->toBe($ownS3->id);
 });
 
diff --git a/tests/Feature/ReverbAndTerminalPackagingTest.php b/tests/Feature/ReverbAndTerminalPackagingTest.php
index de27b46ee1..eb9e828a9d 100644
--- a/tests/Feature/ReverbAndTerminalPackagingTest.php
+++ b/tests/Feature/ReverbAndTerminalPackagingTest.php
@@ -113,8 +113,8 @@ it('runs Reverb and terminal websocket services inside the Coolify containers',
         ->toContain('exec node /terminal/terminal-server.js')
         ->and(file_exists(base_path(dirname($dockerfile)."/etc/s6-overlay/s6-rc.d/reverb/dependencies.d/{$dependencyService}")))->toBeTrue()
         ->and(file_exists(base_path(dirname($dockerfile)."/etc/s6-overlay/s6-rc.d/terminal-server/dependencies.d/{$dependencyService}")))->toBeTrue()
-        ->and(file_exists(base_path(dirname($dockerfile).'/etc/s6-overlay/s6-rc.d/user/contents.d/reverb')))->toBeTrue()
-        ->and(file_exists(base_path(dirname($dockerfile).'/etc/s6-overlay/s6-rc.d/user/contents.d/terminal-server')))->toBeTrue();
+        ->and(file_exists(base_path(dirname($dockerfile).'/etc/s6-overlay/user-bundles.d/user/contents.d/reverb')))->toBeTrue()
+        ->and(file_exists(base_path(dirname($dockerfile).'/etc/s6-overlay/user-bundles.d/user/contents.d/terminal-server')))->toBeTrue();
 })->with([
     'production image' => ['docker/production/Dockerfile', 'init-script'],
     'development image' => ['docker/development/Dockerfile', 'init-setup'],
diff --git a/tests/Feature/SafeDeploymentLogTest.php b/tests/Feature/SafeDeploymentLogTest.php
new file mode 100644
index 0000000000..1d4f5dcc69
--- /dev/null
+++ b/tests/Feature/SafeDeploymentLogTest.php
@@ -0,0 +1,421 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use App\Traits\ExecuteRemoteCommand;
+use Illuminate\Contracts\Process\InvokedProcess;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Process\FakeProcessResult;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+function makeSafeDeploymentLogFixture(): array
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    $deployment = ApplicationDeploymentQueue::query()->create([
+        'application_id' => $application->id,
+        'deployment_uuid' => fake()->uuid(),
+    ]);
+
+    return [$application, $deployment];
+}
+
+function createSafeDeploymentLogVariable(Application $application, string $key, string $value, bool $locked): void
+{
+    EnvironmentVariable::query()->create([
+        'key' => $key,
+        'value' => $value,
+        'resourceable_type' => $application->getMorphClass(),
+        'resourceable_id' => $application->id,
+        'is_preview' => false,
+        'is_shown_once' => $locked,
+    ]);
+}
+
+it('redacts every application environment value before storing deployment logs', function () {
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    $secret = 'coolify-canary-normal-environment-secret';
+
+    EnvironmentVariable::query()->create([
+        'key' => 'NORMAL_ENVIRONMENT_VALUE',
+        'value' => $secret,
+        'resourceable_type' => $application->getMorphClass(),
+        'resourceable_id' => $application->id,
+        'is_preview' => false,
+        'is_shown_once' => false,
+    ]);
+
+    $deployment = ApplicationDeploymentQueue::query()->create([
+        'application_id' => $application->id,
+        'deployment_uuid' => fake()->uuid(),
+    ]);
+
+    $deployment->addLogEntry(
+        message: "process returned {$secret}",
+        command: "deploy --credential={$secret}",
+    );
+
+    $storedLogs = $deployment->refresh()->getRawOriginal('logs');
+
+    expect($storedLogs)
+        ->not->toContain($secret)
+        ->toContain(REDACTED);
+});
+
+it('redacts only locked environment values when the application allows it', function () {
+    [$application, $deployment] = makeSafeDeploymentLogFixture();
+    $application->settings->update(['redact_all_env_values_in_logs' => false]);
+    createSafeDeploymentLogVariable($application, 'APP_ENV_NAME', 'visible-production-value', locked: false);
+    createSafeDeploymentLogVariable($application, 'LOCKED_VALUE', 'coolify-canary-locked-value', locked: true);
+
+    $deployment->addLogEntry('env visible-production-value coolify-canary-locked-value');
+
+    $output = json_decode($deployment->refresh()->logs, true)[0]['output'];
+
+    expect($output)->toBe('env visible-production-value '.REDACTED);
+});
+
+it('adds one hint to the deployment log when values that are not locked are hidden', function () {
+    [$application, $deployment] = makeSafeDeploymentLogFixture();
+    createSafeDeploymentLogVariable($application, 'APP_ENV_NAME', 'hidden-production-value', locked: false);
+
+    $deployment->addLogEntry('env hidden-production-value');
+    $deployment->addLogEntry('again hidden-production-value');
+    ApplicationDeploymentQueue::query()->findOrFail($deployment->id)->addLogEntry('other worker hidden-production-value');
+
+    $outputs = collect(json_decode($deployment->refresh()->logs, true))->pluck('output');
+
+    expect($outputs->all())->toBe([
+        'env '.REDACTED,
+        ApplicationDeploymentQueue::HIDDEN_ENV_VALUES_HINT,
+        'again '.REDACTED,
+        'other worker '.REDACTED,
+    ]);
+});
+
+it('adds no hidden values hint when only locked values are hidden', function (bool $redactAll) {
+    [$application, $deployment] = makeSafeDeploymentLogFixture();
+    $application->settings->update(['redact_all_env_values_in_logs' => $redactAll]);
+    createSafeDeploymentLogVariable($application, 'APP_ENV_NAME', 'plain-production-value', locked: false);
+    createSafeDeploymentLogVariable($application, 'LOCKED_VALUE', 'coolify-canary-locked-value', locked: true);
+
+    $deployment->addLogEntry('env coolify-canary-locked-value');
+    $deployment->addLogEntry($redactAll ? 'no env value here' : 'env plain-production-value');
+
+    expect(collect(json_decode($deployment->refresh()->logs, true))->pluck('output'))
+        ->not->toContain(ApplicationDeploymentQueue::HIDDEN_ENV_VALUES_HINT);
+})->with(['redact all on' => true, 'redact all off' => false]);
+
+it('keeps redacting all values for other applications in the same team', function () {
+    [$application, $deployment] = makeSafeDeploymentLogFixture();
+    createSafeDeploymentLogVariable($application, 'APP_ENV_NAME', 'hidden-production-value', locked: false);
+    $otherApplication = Application::factory()->create(['environment_id' => $application->environment_id]);
+    $otherApplication->settings->update(['redact_all_env_values_in_logs' => false]);
+
+    $deployment->addLogEntry('env hidden-production-value');
+
+    expect($application->settings->fresh()->redact_all_env_values_in_logs)->toBeTrue()
+        ->and(json_decode($deployment->refresh()->logs, true)[0]['output'])->toBe('env '.REDACTED);
+});
+
+it('redacts remote secrets registered on the deployment', function () {
+    [, $deployment] = makeSafeDeploymentLogFixture();
+    $deployment->redactRemoteSecrets(['API_TOKEN' => 'coolify-canary-remote-secret', 'PIN' => '4821']);
+
+    $deployment->addLogEntry(
+        message: 'output coolify-canary-remote-secret pin 4821',
+        command: 'echo coolify-canary-remote-secret',
+    );
+
+    expect($deployment->refresh()->getRawOriginal('logs'))
+        ->not->toContain('coolify-canary-remote-secret')
+        ->not->toContain('4821')
+        ->toContain(REDACTED);
+});
+
+it('always redacts short locked values and values of locked shared variables', function () {
+    [$application, $deployment] = makeSafeDeploymentLogFixture();
+    $application->settings->update(['redact_all_env_values_in_logs' => false]);
+    createSafeDeploymentLogVariable($application, 'PIN', '4821', locked: true);
+    SharedEnvironmentVariable::query()->create([
+        'key' => 'SHARED_DB_PASS',
+        'value' => 'coolify-canary-shared-locked',
+        'type' => 'team',
+        'team_id' => $application->team()->id,
+        'is_shown_once' => true,
+    ]);
+    createSafeDeploymentLogVariable($application, 'DB_PASS', '{{team.SHARED_DB_PASS}}', locked: false);
+
+    $deployment->addLogEntry('pin 4821 password coolify-canary-shared-locked');
+
+    expect(json_decode($deployment->refresh()->logs, true)[0]['output'])
+        ->toBe('pin '.REDACTED.' password '.REDACTED);
+});
+
+it('passes remote secrets from the deployment job into stored log entries', function () {
+    [$application, $deployment] = makeSafeDeploymentLogFixture();
+    $job = new class
+    {
+        use ExecuteRemoteCommand;
+
+        public $application;
+
+        public $application_deployment_queue;
+
+        public ?array $remote_secrets_cache = ['API_TOKEN' => 'coolify-canary-vault-secret'];
+    };
+    $job->application = $application;
+    $job->application_deployment_queue = $deployment;
+
+    (new ReflectionMethod($job, 'addRetryLogEntry'))->invoke($job, 1, 3, 1, 'failed near coolify-canary-vault-secret');
+
+    expect($deployment->refresh()->getRawOriginal('logs'))
+        ->not->toContain('coolify-canary-vault-secret')
+        ->toContain(REDACTED);
+});
+
+it('caches normalized remote secrets only after they are loaded', function () {
+    $job = new class
+    {
+        use ExecuteRemoteCommand;
+
+        public ?array $remote_secrets_cache = null;
+    };
+    $redact = new ReflectionMethod($job, 'redact_sensitive_info');
+
+    expect($redact->invoke($job, 'ordinary output'))->toBe('ordinary output');
+
+    $job->remote_secrets_cache = ['PIN' => '4821'];
+    expect($redact->invoke($job, 'pin 4821'))->toBe('pin '.REDACTED);
+
+    $cache = new ReflectionProperty($job, 'remoteSecretLogRedactionValues');
+    $normalized = $cache->getValue($job);
+    expect($normalized)->toContain('4821');
+
+    expect($redact->invoke($job, 'another pin 4821'))->toBe('another pin '.REDACTED)
+        ->and($cache->getValue($job))->toBe($normalized);
+
+    $otherJob = new ($job::class);
+    $otherJob->remote_secrets_cache = ['PIN' => '7392'];
+    expect($redact->invoke($otherJob, 'pin 7392'))->toBe('pin '.REDACTED);
+});
+
+it('keeps corrupted stored logs and warns once instead of overwriting them', function () {
+    [, $deployment] = makeSafeDeploymentLogFixture();
+    ApplicationDeploymentQueue::query()->whereKey($deployment->id)->update(['logs' => '{not json']);
+    Log::shouldReceive('warning')->once()->withArgs(fn (string $message, array $context) => $context === ['deployment_uuid' => $deployment->deployment_uuid]);
+
+    $deployment->addLogEntry('fresh entry');
+    $deployment->addLogEntry('second entry');
+
+    expect($deployment->refresh()->getRawOriginal('logs'))->toBe('{not json');
+});
+
+/**
+ * A deployment job whose remote command sends its output in the given chunks, like a real SSH stream.
+ *
+ * @param  list<array{0: string, 1: string}>  $chunks
+ */
+function runDeploymentCommandWithChunks(ApplicationDeploymentQueue $deployment, array $chunks, bool $hidden = false): void
+{
+    $team = $deployment->application->team();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+    $job = new class
+    {
+        use ExecuteRemoteCommand;
+
+        public $application;
+
+        public $application_deployment_queue;
+
+        public $server;
+
+        public $saved_outputs;
+    };
+    $job->application = $deployment->application;
+    $job->application_deployment_queue = $deployment;
+    $job->server = $server;
+    $job->saved_outputs = collect();
+    // The process fake ends every output chunk with a newline, so the chunks are sent by hand.
+    $invoked = Mockery::mock(InvokedProcess::class);
+    $invoked->shouldReceive('id')->andReturn(123);
+    Process::shouldReceive('timeout->idleTimeout->input->start')->andReturnUsing(function (string $command, Closure $output) use ($invoked, $chunks) {
+        $invoked->shouldReceive('wait')->andReturnUsing(function () use ($output, $chunks) {
+            foreach ($chunks as [$type, $chunk]) {
+                $output($type, $chunk);
+            }
+
+            return new FakeProcessResult;
+        });
+
+        return $invoked;
+    });
+
+    (new ReflectionMethod($job, 'executeCommandWithProcess'))->invoke($job, 'cat output', $hidden, null, true, false);
+}
+
+it('redacts a deployment output secret that is split across output chunks', function () {
+    [$application, $deployment] = makeSafeDeploymentLogFixture();
+    $application->settings->update(['redact_all_env_values_in_logs' => false]);
+    createSafeDeploymentLogVariable($application, 'LOCKED_VALUE', 'coolify-canary-locked-value', locked: true);
+
+    runDeploymentCommandWithChunks($deployment, [
+        ['out', 'value is coolify-canary-lo'],
+        ['err', 'error coolify-canary-'],
+        ['out', "cked-value\nnext "],
+        ['err', "locked-value\n"],
+        ['out', 'line coolify-canary-locked-value'],
+    ], hidden: true);
+
+    $logs = collect(json_decode($deployment->refresh()->logs, true));
+
+    expect($logs->map(fn (array $entry) => [$entry['type'], $entry['output']])->all())->toBe([
+        ['stdout', 'value is '.REDACTED],
+        ['stderr', 'error '.REDACTED],
+        ['stdout', 'next line '.REDACTED],
+    ])
+        ->and($logs->pluck('hidden')->unique()->all())->toBe([true])
+        ->and($logs->pluck('command')->unique()->all())->toBe(['cat output']);
+});
+
+it('redacts a private key that is split across deployment output chunks', function () {
+    [, $deployment] = makeSafeDeploymentLogFixture();
+
+    runDeploymentCommandWithChunks($deployment, [
+        ['out', "before\n-----BEGIN RSA PRIVATE KEY-----\nKEYBODYLINEONE\n"],
+        ['out', "KEYBODYLINETWO\n-----END RSA PRIVATE KEY-----\nafter\n"],
+    ]);
+
+    $outputs = collect(json_decode($deployment->refresh()->logs, true))->pluck('output');
+
+    expect($outputs->implode("\n"))->not->toContain('KEYBODYLINE')
+        ->and($outputs->all())->toBe(['before', REDACTED."\nafter"]);
+});
+
+/**
+ * A team with an API token, a functional server, and running containers whose logs print an environment value
+ * and a pattern secret. Returns the endpoint path for the requested resource.
+ */
+function makeRestLogRedactionEndpoint(string $resource, string $envSecret): array
+{
+    Server::flushIdentityMap();
+    config(['app.maintenance.store' => 'array', 'constants.ssh.mux_enabled' => false]);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $team->members()->attach($user->id, ['role' => 'owner']);
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'logs',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['root'],
+        'team_id' => $team->id,
+    ]);
+
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+    $server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $destinationAttributes = ['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()];
+
+    if ($resource === 'database') {
+        $owner = null;
+        $database = StandalonePostgresql::create([
+            'name' => 'logs-db',
+            'postgres_user' => 'postgres',
+            'postgres_password' => 'postgres',
+            'postgres_db' => 'app',
+            'image' => 'postgres:16-alpine',
+            'environment_id' => $environment->id,
+            ...$destinationAttributes,
+        ]);
+        $path = "/api/v1/databases/{$database->uuid}/logs";
+        $containerName = $database->uuid;
+    } elseif ($resource === 'application') {
+        $owner = Application::factory()->create(['environment_id' => $environment->id, ...$destinationAttributes]);
+        $path = "/api/v1/applications/{$owner->uuid}/logs";
+        $containerName = $owner->uuid;
+    } else {
+        $owner = Service::factory()->create(['environment_id' => $environment->id, 'server_id' => $server->id, ...$destinationAttributes]);
+        $child = $resource === 'service database'
+            ? ServiceDatabase::create(['uuid' => (string) Str::uuid(), 'name' => 'db', 'service_id' => $owner->id])
+            : ServiceApplication::create(['uuid' => (string) Str::uuid(), 'name' => 'web', 'service_id' => $owner->id]);
+        $containerName = "{$child->name}-{$owner->uuid}";
+        $path = match ($resource) {
+            'service' => "/api/v1/services/{$owner->uuid}/logs?sub_service_name=web",
+            'service application' => "/api/v1/services/{$owner->uuid}/applications/{$child->uuid}/logs",
+            'service database' => "/api/v1/services/{$owner->uuid}/databases/{$child->uuid}/logs",
+        };
+    }
+
+    if ($owner !== null) {
+        EnvironmentVariable::query()->create([
+            'key' => 'LOG_CANARY',
+            'value' => $envSecret,
+            'resourceable_type' => $owner->getMorphClass(),
+            'resourceable_id' => $owner->id,
+            'is_preview' => false,
+        ]);
+    }
+
+    Process::fake(function ($process) use ($containerName, $envSecret) {
+        return match (true) {
+            str_contains($process->command, 'docker ps') => Process::result(output: json_encode([
+                'ID' => 'abc123',
+                'Names' => $containerName,
+                'Labels' => "coolify.name={$containerName}",
+                'State' => 'running',
+            ])),
+            str_contains($process->command, 'docker inspect') => Process::result(output: json_encode(['State' => ['Status' => 'running']])),
+            str_contains($process->command, 'docker logs') => Process::result(output: "booted with {$envSecret}\npassword=coolify-canary-pattern-secret"),
+            default => Process::result(output: ''),
+        };
+    });
+
+    return [$path, $token->getKey().'|'.$plainTextToken];
+}
+
+it('redacts environment values and secrets in each REST container log endpoint', function (string $resource) {
+    $envSecret = 'coolify-canary-env-value-in-logs';
+    [$path, $bearerToken] = makeRestLogRedactionEndpoint($resource, $envSecret);
+
+    $logs = $this->withToken($bearerToken)->getJson($path)->assertOk()->json('logs');
+
+    expect($logs)
+        ->not->toContain('coolify-canary-pattern-secret')
+        ->toContain('password='.REDACTED);
+    if ($resource !== 'database') {
+        expect($logs)->toContain('booted with '.REDACTED)->not->toContain($envSecret);
+    }
+})->with(['application', 'database', 'service', 'service application', 'service database']);
diff --git a/tests/Feature/SafeOperationalLogSinksTest.php b/tests/Feature/SafeOperationalLogSinksTest.php
new file mode 100644
index 0000000000..256938d398
--- /dev/null
+++ b/tests/Feature/SafeOperationalLogSinksTest.php
@@ -0,0 +1,236 @@
+<?php
+
+use App\Actions\CoolifyTask\RunRemoteProcess;
+use App\Enums\ActivityTypes;
+use App\Events\ScheduledTaskDone;
+use App\Exceptions\NonReportableException;
+use App\Jobs\ScheduledTaskJob;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\ScheduledTaskExecution;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Notifications\ScheduledTask\TaskFailed;
+use App\Notifications\ScheduledTask\TaskSuccess;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Process;
+use Spatie\Activitylog\Models\Activity;
+
+uses(RefreshDatabase::class);
+
+it('redacts remote process output before encoding it for activity storage', function () {
+    $activity = new Activity;
+    $activity->description = '[]';
+    $activity->properties = collect([
+        'type' => ActivityTypes::COMMAND->value,
+    ]);
+
+    $process = new RunRemoteProcess($activity);
+    $encoded = $process->encodeOutput('stderr', 'password=coolify-canary-secret-remote');
+
+    expect($encoded)
+        ->not->toContain('coolify-canary-secret-remote')
+        ->toContain(REDACTED);
+});
+
+it('redacts scheduled task output before it reaches persistent sinks', function () {
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    EnvironmentVariable::query()->create([
+        'key' => 'TASK_VALUE',
+        'value' => 'coolify-canary-secret-scheduled',
+        'resourceable_type' => $application->getMorphClass(),
+        'resourceable_id' => $application->id,
+        'is_preview' => false,
+    ]);
+    $job = new ScheduledTaskJob(new ScheduledTask);
+    $job->resource = $application;
+    $method = new ReflectionMethod($job, 'redact');
+
+    $redacted = $method->invoke($job, 'unstructured coolify-canary-secret-scheduled output');
+
+    expect($redacted)
+        ->not->toContain('coolify-canary-secret-scheduled')
+        ->toContain(REDACTED);
+});
+
+it('redacts only locked values in scheduled task output when the service allows it', function () {
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'environment_id' => $environment->id,
+        'redact_all_env_values_in_logs' => false,
+    ]);
+    foreach (['VISIBLE_VALUE' => ['visible-service-value', false], 'LOCKED_VALUE' => ['coolify-canary-locked-service', true]] as $key => [$value, $locked]) {
+        EnvironmentVariable::query()->create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => $service->getMorphClass(),
+            'resourceable_id' => $service->id,
+            'is_preview' => false,
+            'is_shown_once' => $locked,
+        ]);
+    }
+    $job = new ScheduledTaskJob(new ScheduledTask);
+    $job->resource = $service;
+
+    $redacted = (new ReflectionMethod($job, 'redact'))->invoke($job, 'visible-service-value coolify-canary-locked-service');
+
+    expect($redacted)->toBe('visible-service-value '.REDACTED);
+});
+
+it('keeps scheduled task exceptions whose messages need no redaction', function () {
+    $job = new ScheduledTaskJob(new ScheduledTask);
+    $exception = new NonReportableException('No valid container was found.');
+
+    $result = (new ReflectionMethod($job, 'redactedException'))->invoke($job, $exception, $exception->getMessage());
+
+    expect($result)->toBe($exception);
+});
+
+it('rebuilds redacted scheduled task exceptions with the same reportability', function () {
+    $job = new ScheduledTaskJob(new ScheduledTask);
+    $method = new ReflectionMethod($job, 'redactedException');
+    $secret = 'password=coolify-canary-secret-exception';
+
+    $nonReportable = $method->invoke($job, new NonReportableException($secret, 3), 'password='.REDACTED);
+    $reportable = $method->invoke($job, new RuntimeException($secret, 4), 'password='.REDACTED);
+
+    expect($nonReportable)->toBeInstanceOf(NonReportableException::class)
+        ->and($nonReportable->getMessage())->toBe('password='.REDACTED)
+        ->and($nonReportable->getCode())->toBe(3)
+        ->and($nonReportable->getPrevious())->toBeNull()
+        ->and($reportable)->toBeInstanceOf(RuntimeException::class)
+        ->and($reportable->getPrevious())->toBeNull();
+});
+
+/**
+ * A running service container with an environment value that must not reach any scheduled task sink.
+ *
+ * @return array{0: ScheduledTask, 1: Team}
+ */
+function makeScheduledTaskRedactionFixture(string $secret): array
+{
+    Server::flushIdentityMap();
+    Notification::fake();
+    Event::fake([ScheduledTaskDone::class]);
+    InstanceSettings::forceCreate(['id' => 0]);
+    config(['app.maintenance.store' => 'array', 'constants.ssh.mux_enabled' => false]);
+
+    $team = Team::factory()->create();
+    $team->emailNotificationSettings->update([
+        'smtp_enabled' => true,
+        'scheduled_task_success_email_notifications' => true,
+        'scheduled_task_failure_email_notifications' => true,
+    ]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+    $server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    ServiceApplication::create(['name' => 'app', 'service_id' => $service->id, 'status' => 'running:healthy']);
+    EnvironmentVariable::query()->create([
+        'key' => 'TASK_SECRET',
+        'value' => $secret,
+        'resourceable_type' => $service->getMorphClass(),
+        'resourceable_id' => $service->id,
+        'is_preview' => false,
+    ]);
+
+    $task = ScheduledTask::factory()->create([
+        'team_id' => $team->id,
+        'service_id' => $service->id,
+        'command' => 'print-secret',
+    ]);
+
+    return [$task, $team];
+}
+
+it('redacts scheduled task output in the execution log and success notification', function () {
+    $secret = 'coolify-canary-task-success-output';
+    [$task, $team] = makeScheduledTaskRedactionFixture($secret);
+    Process::fake(fn () => Process::result(output: "value {$secret}"));
+
+    (new ScheduledTaskJob($task))->handle();
+
+    expect($task->executions()->sole())
+        ->status->toBe('success')
+        ->message->toBe('value '.REDACTED);
+    Notification::assertSentTo($team, TaskSuccess::class, fn (TaskSuccess $notification): bool => $notification->output === 'value '.REDACTED);
+});
+
+it('redacts scheduled task failures in the execution log, error log, and rethrown exception', function () {
+    $secret = 'coolify-canary-task-failure-output';
+    [$task] = makeScheduledTaskRedactionFixture($secret);
+    Process::fake(fn () => Process::result(errorOutput: "failed near {$secret}", exitCode: 1));
+    $errorChannel = Mockery::mock();
+    $errorChannel->shouldReceive('error')->once()->withArgs(fn (string $message, array $context): bool => ! str_contains(serialize($context), $secret));
+    Log::shouldReceive('channel')->with('scheduled-errors')->andReturn($errorChannel);
+
+    try {
+        (new ScheduledTaskJob($task))->handle();
+        $thrown = null;
+    } catch (Throwable $exception) {
+        $thrown = $exception;
+    }
+
+    expect($thrown)->not->toBeNull()
+        ->and($thrown->getMessage())->toBe('failed near '.REDACTED)
+        ->and($thrown->getPrevious())->toBeNull()
+        ->and($task->executions()->sole())
+        ->status->toBe('failed')
+        ->message->toBe('failed near '.REDACTED);
+});
+
+it('redacts permanent scheduled task failures in the execution, error log, and failure notification', function () {
+    $secret = 'coolify-canary-task-permanent-failure';
+    [$task, $team] = makeScheduledTaskRedactionFixture($secret);
+    $job = new ScheduledTaskJob($task);
+    ScheduledTaskExecution::forceCreate(['uuid' => $job->executionUuid, 'scheduled_task_id' => $task->id, 'started_at' => now()]);
+    $errorChannel = Mockery::mock();
+    $errorChannel->shouldReceive('error')->once()->withArgs(fn (string $message, array $context): bool => ! str_contains(serialize($context), $secret));
+    Log::shouldReceive('channel')->with('scheduled-errors')->andReturn($errorChannel);
+
+    $job->failed(new RuntimeException("password leaked {$secret}"));
+
+    $execution = ScheduledTaskExecution::query()->where('uuid', $job->executionUuid)->sole();
+    expect($execution->status)->toBe('failed')
+        ->and($execution->message)->toContain('password leaked '.REDACTED)
+        ->and($execution->message.$execution->error_details)->not->toContain($secret);
+    Notification::assertSentTo($team, TaskFailed::class, fn (TaskFailed $notification): bool => $notification->output === 'password leaked '.REDACTED);
+});
+
+it('records scheduled tasks that print literal null as successful with empty output', function () {
+    [$task, $team] = makeScheduledTaskRedactionFixture('coolify-canary-null-output');
+    Process::fake(fn () => Process::result(output: "null\n"));
+
+    (new ScheduledTaskJob($task))->handle();
+
+    expect($task->executions()->sole())
+        ->status->toBe('success')
+        ->message->toBe('');
+    Notification::assertSentTo($team, TaskSuccess::class, fn (TaskSuccess $notification): bool => $notification->output === '');
+});
diff --git a/tests/Feature/ScheduleAuditTest.php b/tests/Feature/ScheduleAuditTest.php
index 281fdd42b4..68a81a3325 100644
--- a/tests/Feature/ScheduleAuditTest.php
+++ b/tests/Feature/ScheduleAuditTest.php
@@ -300,12 +300,12 @@ test('disabling or moving S3 storage for backups records audit events', function
     $volumeEvent = scheduleAuditEvent('ui.volume_backup.schedule_set');
 
     expect($databaseEvent->resource_uuid)->toBe($database->uuid)
-        ->and($databaseEvent->metadata['changed_fields'])->toEqualCanonicalizing(['save_s3', 's3_storage_id'])
+        ->and($databaseEvent->metadata['changed_fields'])->toEqualCanonicalizing(['save_s3', 's3_storage_id', 's3_storages'])
         ->and($volumeEvent->metadata['resource_type'])->toBe('application')
         ->and($volumeEvent->metadata['resource_uuid'])->toBe($this->application->uuid)
         ->and($volumeEvent->metadata['storage_uuid'])->toBe($volume->uuid)
         ->and($volumeEvent->metadata['backup_uuid'])->toBe($volumeBackup->uuid)
-        ->and($volumeEvent->metadata['changed_fields'])->toBe(['s3_storage_id']);
+        ->and($volumeEvent->metadata['changed_fields'])->toEqualCanonicalizing(['s3_storage_id', 's3_storages']);
 });
 
 test('configuring the instance database backup records an audit event', function () {
@@ -422,3 +422,27 @@ test('updating, toggling, and deleting a storage backup schedule record audit ev
         ->and($deleteEvent->metadata['storage_uuid'])->toBe($volume->uuid)
         ->and($backup->fresh())->toBeNull();
 });
+
+test('a request that reaches the danger section after the backup schedule is deleted does not render it', function () {
+    $database = createScheduleAuditPostgres($this->environment, $this->destination);
+    $backup = createScheduleAuditDatabaseBackup($this->team, $database);
+
+    Event::listen(RouteMatched::class, function (RouteMatched $event) use ($database): void {
+        $event->route->setParameter('project_uuid', $this->project->uuid);
+        $event->route->setParameter('environment_uuid', $this->environment->uuid);
+        $event->route->setParameter('database_uuid', $database->uuid);
+    });
+
+    Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+        'section' => 'danger',
+    ])
+        ->call('delete', 'password', ['delete_associated_backups_locally'])
+        ->assertRedirect()
+        ->call('refreshStatus')
+        ->assertOk();
+
+    expect($backup->fresh())->toBeNull()
+        ->and(scheduleAuditEvent('ui.database.backup_schedule_deleted')->metadata['backup_uuid'])->toBe($backup->uuid);
+});
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index 19edd2af41..f437602c69 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Console\Kernel as ConsoleKernel;
 use App\Jobs\CheckForUpdatesJob;
 use App\Jobs\CheckHelperImageJob;
 use App\Jobs\PullChangelog;
@@ -41,6 +42,20 @@ it('schedules ssh mux cleanup locally on every scheduler host', function () {
     expect($event->getSummaryForDisplay())->toBe('cleanup:ssh-mux');
 });
 
+it('refreshes the local versions.json hourly on every cloud node', function (bool $cloud) {
+    config(['constants.coolify.self_hosted' => ! $cloud]);
+    $schedule = app(Schedule::class);
+
+    $event = collect($schedule->events())->first(
+        fn ($e) => (string) $e->description === 'versions:refresh-local'
+    );
+
+    expect($event)->not->toBeNull();
+    expect($event->onOneServer)->toBeFalse();
+    expect($event->expression)->toBe('0 * * * *');
+    expect($event->filtersPass(app()))->toBe($cloud);
+})->with(['cloud' => true, 'self-hosted' => false]);
+
 it('schedules every production job with onOneServer', function () {
     $schedule = app(Schedule::class);
 
@@ -57,20 +72,45 @@ it('schedules every production job with onOneServer', function () {
     });
 });
 
-it('dispatches CDN fetching jobs with a random delay so instances do not hit the CDN at the same second', function () {
+it('delays CDN fetching jobs by a stable offset per instance inside the hourly interval', function () {
     InstanceSettings::query()->whereKey(0)->update(['is_auto_update_enabled' => true]);
+    config(['app.id' => 'instance-a']);
     Queue::fake();
 
-    $jobs = [CheckHelperImageJob::class, CheckForUpdatesJob::class, PullTemplatesFromCDN::class, PullChangelog::class, UpdateCoolifyJob::class];
+    $jobs = [CheckForUpdatesJob::class, PullTemplatesFromCDN::class, PullChangelog::class, UpdateCoolifyJob::class];
     $schedule = app(Schedule::class);
+    $expectedDelay = ConsoleKernel::cdnDelaySeconds('0 * * * *');
 
     foreach ($jobs as $job) {
         $event = collect($schedule->events())->first(fn ($e) => $e->description === $job);
         expect($event)->not->toBeNull("[{$job}] is not scheduled");
         $event->run(app());
 
-        Queue::assertPushed($job, fn ($pushed) => is_int($pushed->delay) && $pushed->delay >= 0 && $pushed->delay <= 600);
+        Queue::assertPushed($job, fn ($pushed) => $pushed->delay === $expectedDelay);
     }
+
+    expect(collect($schedule->events())->first(fn ($e) => $e->description === CheckHelperImageJob::class))->toBeNull();
+});
+
+it('spreads the CDN delay of many instances over the full hour', function () {
+    $delays = collect(range(1, 2000))->map(function (int $i) {
+        config(['app.id' => bin2hex(random_bytes(16))]);
+
+        return ConsoleKernel::cdnDelaySeconds('0 * * * *');
+    });
+
+    expect($delays->min())->toBeGreaterThanOrEqual(0)
+        ->and($delays->max())->toBeLessThan(3600);
+    // Each 10-minute window of the hour gets about one sixth of the instances.
+    $delays->groupBy(fn (int $delay) => intdiv($delay, 600))
+        ->each(fn (Collection $window) => expect($window->count())->toBeGreaterThan(250)->toBeLessThan(420));
+});
+
+it('keeps the CDN delay inside a cron interval shorter than one hour', function () {
+    config(['app.id' => 'instance-b']);
+
+    expect(ConsoleKernel::cdnDelaySeconds('*/15 * * * *'))->toBeLessThan(900)
+        ->and(ConsoleKernel::cdnDelaySeconds('0 0 * * *'))->toBeLessThan(3600);
 });
 
 it('does not schedule Stripe subscription reconciliation automatically', function () {
diff --git a/tests/Feature/ScheduledTaskDeleteTest.php b/tests/Feature/ScheduledTaskDeleteTest.php
index b34a38428b..3834b7b0ef 100644
--- a/tests/Feature/ScheduledTaskDeleteTest.php
+++ b/tests/Feature/ScheduledTaskDeleteTest.php
@@ -14,8 +14,6 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Routing\Events\RouteMatched;
-use Illuminate\Support\Facades\Event;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -37,22 +35,6 @@ beforeEach(function () {
     $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
 });
 
-afterEach(function () {
-    Event::forget(RouteMatched::class);
-});
-
-/**
- * @param  array<string, string>  $parameters
- */
-function bindScheduledTaskDeleteRoute(array $parameters): void
-{
-    Event::listen(RouteMatched::class, function (RouteMatched $event) use ($parameters): void {
-        foreach ($parameters as $name => $value) {
-            $event->route->setParameter($name, $value);
-        }
-    });
-}
-
 test('deleting a service scheduled task returns true so the confirmation modal does not refresh the deleted task', function () {
     $service = Service::factory()->create([
         'environment_id' => $this->environment->id,
@@ -66,22 +48,17 @@ test('deleting a service scheduled task returns true so the confirmation modal d
         'command' => 'echo nightly',
         'frequency' => 'daily',
     ]);
-    $parameters = [
-        'project_uuid' => $this->project->uuid,
-        'environment_uuid' => $this->environment->uuid,
-        'service_uuid' => $service->uuid,
-    ];
-    bindScheduledTaskDeleteRoute([...$parameters, 'task_uuid' => $task->uuid]);
 
-    Livewire::test(Show::class)
+    Livewire::test(Show::class, ['resource' => $service, 'task' => $task])
         ->call('delete')
         ->assertReturned(true)
-        ->assertRedirect(route('project.service.scheduled-tasks.show', $parameters));
+        ->assertDispatched('scheduledTaskDeleted')
+        ->assertNoRedirect();
 
     expect($task->fresh())->toBeNull();
 });
 
-test('deleting an application scheduled task returns true and redirects to the task list', function () {
+test('deleting an application scheduled task returns true and closes the task modal', function () {
     $application = Application::factory()->create([
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
@@ -94,17 +71,12 @@ test('deleting an application scheduled task returns true and redirects to the t
         'command' => 'echo nightly',
         'frequency' => 'daily',
     ]);
-    $parameters = [
-        'project_uuid' => $this->project->uuid,
-        'environment_uuid' => $this->environment->uuid,
-        'application_uuid' => $application->uuid,
-    ];
-    bindScheduledTaskDeleteRoute([...$parameters, 'task_uuid' => $task->uuid]);
 
-    Livewire::test(Show::class)
+    Livewire::test(Show::class, ['resource' => $application, 'task' => $task])
         ->call('delete')
         ->assertReturned(true)
-        ->assertRedirect(route('project.application.scheduled-tasks.show', $parameters));
+        ->assertDispatched('scheduledTaskDeleted')
+        ->assertNoRedirect();
 
     expect($task->fresh())->toBeNull();
 });
diff --git a/tests/Feature/ScheduledTaskModalTest.php b/tests/Feature/ScheduledTaskModalTest.php
new file mode 100644
index 0000000000..5c73bdc053
--- /dev/null
+++ b/tests/Feature/ScheduledTaskModalTest.php
@@ -0,0 +1,102 @@
+<?php
+
+use App\Livewire\Project\Shared\ScheduledTask\All;
+use App\Livewire\Project\Shared\ScheduledTask\Show;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $this->task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+        'application_id' => $this->application->id,
+        'name' => 'modal-task',
+        'command' => 'echo hello',
+    ]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+test('opening a task shows the editor modal', function () {
+    Livewire::test(All::class, ['resource' => $this->application])
+        ->call('openTask', $this->task->uuid)
+        ->assertSet('taskModalOpen', true)
+        ->assertSet('taskUuid', $this->task->uuid)
+        ->assertSeeLivewire(Show::class);
+});
+
+test('task uuid in the url opens the modal on load', function () {
+    Livewire::withQueryParams(['task_uuid' => $this->task->uuid])
+        ->test(All::class, ['resource' => $this->application])
+        ->assertSet('taskModalOpen', true)
+        ->assertSeeLivewire(Show::class);
+});
+
+test('a task of another resource cannot be opened', function () {
+    $otherTask = ScheduledTask::factory()->create(['team_id' => Team::factory()->create()->id]);
+
+    expect(fn () => Livewire::test(All::class, ['resource' => $this->application])
+        ->call('openTask', $otherTask->uuid))
+        ->toThrow(ModelNotFoundException::class);
+});
+
+test('deleting a task from the modal closes it', function () {
+    $list = Livewire::test(All::class, ['resource' => $this->application])
+        ->call('openTask', $this->task->uuid);
+
+    Livewire::test(Show::class, ['resource' => $this->application, 'task' => $this->task])
+        ->call('delete')
+        ->assertDispatched('scheduledTaskDeleted');
+
+    expect(ScheduledTask::find($this->task->id))->toBeNull();
+
+    $list->dispatch('scheduledTaskDeleted')
+        ->assertSet('taskModalOpen', false)
+        ->assertSet('taskUuid', '')
+        ->assertDontSee('modal-task');
+});
+
+test('old task page url redirects to the list with the modal open', function () {
+    $application = $this->application->load('environment.project');
+
+    $this->get(route('project.application.scheduled-tasks', [
+        'project_uuid' => $application->environment->project->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+        'task_uuid' => $this->task->uuid,
+    ]))->assertRedirect(route('project.application.scheduled-tasks.show', [
+        'project_uuid' => $application->environment->project->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+        'task_uuid' => $this->task->uuid,
+    ]));
+});
diff --git a/tests/Feature/SecretManagers/RemoteSecretResourceLifecycleTest.php b/tests/Feature/SecretManagers/RemoteSecretResourceLifecycleTest.php
index 92038a1f55..aac3ad833a 100644
--- a/tests/Feature/SecretManagers/RemoteSecretResourceLifecycleTest.php
+++ b/tests/Feature/SecretManagers/RemoteSecretResourceLifecycleTest.php
@@ -234,7 +234,7 @@ test('a service start stops before the service when a non-literal variable refer
         ->toThrow(RemoteSecretException::class, 'no secret manager source is configured');
 });
 
-test('a service restart fetches remote secrets only once', function () {
+test('a service restart fetches remote secrets once to start and once to redact the start output', function () {
     Http::fake([REMOTE_SECRET_LIFECYCLE_DOPPLER_URL => Http::response(['API_KEY' => 'value'])]);
     Process::fake(['*' => Process::result(output: '')]);
     StopService::shouldRun();
@@ -243,7 +243,8 @@ test('a service restart fetches remote secrets only once', function () {
 
     StartService::run($service, stopBeforeStart: true);
 
-    Http::assertSentCount(1);
+    // The start output is redacted in the activity job, which loads the service again.
+    Http::assertSentCount(2);
 });
 
 test('a database restart keeps the database running and reports the secret manager error', function () {
diff --git a/tests/Feature/Security/AuditLogTest.php b/tests/Feature/Security/AuditLogTest.php
index dc2408ab25..b75b0801a8 100644
--- a/tests/Feature/Security/AuditLogTest.php
+++ b/tests/Feature/Security/AuditLogTest.php
@@ -376,27 +376,14 @@ describe('API mutation audit logging', function () {
         expect($response->status())->toBeIn([201, 422]);
     });
 
-    test('enable_api denial for non-root team emits warning audit event', function () {
+    test('POST /api/v1/enable no longer exists', function () {
         [$team, $user] = makeAuditTeamUser();
         $token = makeAuditApiToken($user, $team);
         auth()->forgetGuards();
 
-        $auditChannel = Mockery::mock();
-        $auditChannel->shouldReceive('warning')
-            ->atLeast()
-            ->once()
-            ->with('api.instance.enable_denied', Mockery::any());
-
-        Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
-        Log::shouldReceive('warning')->andReturnNull();
-        Log::shouldReceive('info')->andReturnNull();
-        Log::shouldReceive('error')->andReturnNull();
-
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$token,
-        ])->postJson('/api/v1/enable');
-
-        $response->assertStatus(403);
+        $this->withHeaders(['Authorization' => 'Bearer '.$token])
+            ->postJson('/api/v1/enable')
+            ->assertNotFound();
     });
 
     test('project creation records api.project.created audit event', function () {
diff --git a/tests/Feature/Security/CloudProviderTokenFormTest.php b/tests/Feature/Security/CloudProviderTokenFormTest.php
index a3d06fba11..f1e6af5cde 100644
--- a/tests/Feature/Security/CloudProviderTokenFormTest.php
+++ b/tests/Feature/Security/CloudProviderTokenFormTest.php
@@ -60,7 +60,35 @@ test('security cloud token form lets users choose every supported provider', fun
         ->assertSee('Provider')
         ->assertSee('Hetzner')
         ->assertSee('DigitalOcean')
-        ->assertSee('Vultr');
+        ->assertSee('Vultr')
+        ->assertSee('Hostinger');
+});
+
+test('adding a hostinger token from a modal validates and refreshes hostinger token selectors', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([], 200),
+    ]);
+
+    $component = Livewire::test(CloudProviderTokenForm::class, [
+        'modal_mode' => true,
+        'provider' => 'hostinger',
+    ])
+        ->set('name', 'Production Hostinger')
+        ->set('token', 'hostinger-token')
+        ->call('addToken')
+        ->assertHasNoErrors()
+        ->assertDispatched('close-modal');
+
+    $dispatches = collect(data_get($component->effects, 'dispatches', []));
+
+    expect($dispatches->contains(fn (array $dispatch) => $dispatch['name'] === 'tokenAdded.hostinger'
+        && data_get($dispatch, 'to') === 'server.new.by-hostinger'))->toBeTrue();
+
+    $this->assertDatabaseHas('cloud_provider_tokens', [
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+        'name' => 'Production Hostinger',
+    ]);
 });
 
 test('adding a cloud provider token stores an optional description', function () {
diff --git a/tests/Feature/Security/CloudProviderTokenShowTest.php b/tests/Feature/Security/CloudProviderTokenShowTest.php
index c3a1ce082e..822b242f64 100644
--- a/tests/Feature/Security/CloudProviderTokenShowTest.php
+++ b/tests/Feature/Security/CloudProviderTokenShowTest.php
@@ -94,6 +94,21 @@ test('cloud token detail page validates the token', function () {
         ->assertDispatched('success');
 });
 
+test('cloud token detail page validates Hostinger tokens', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([], 200),
+    ]);
+
+    $token = CloudProviderToken::factory()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+    ]);
+
+    Livewire::test(Show::class, ['cloud_token_uuid' => $token->uuid])
+        ->call('validateToken')
+        ->assertDispatched('success');
+});
+
 test('cloud token detail page deletes unused tokens', function () {
     $token = CloudProviderToken::factory()->create([
         'team_id' => $this->team->id,
diff --git a/tests/Feature/Security/IntegrationTokenFormTest.php b/tests/Feature/Security/IntegrationTokenFormTest.php
index 41d18784ee..2344563ca4 100644
--- a/tests/Feature/Security/IntegrationTokenFormTest.php
+++ b/tests/Feature/Security/IntegrationTokenFormTest.php
@@ -205,7 +205,7 @@ test('cloudflare dns scope guidance and token creation link are shown', function
         ->set('capabilities', ['dns'])
         ->assertSee('Zone - DNS - Edit')
         ->assertSee('Zone - Zone - Read')
-        ->assertSeeHtml('https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management');
+        ->assertSeeHtml(e(IntegrationToken::cloudflareTokenTemplateUrl(['dns'])));
 });
 
 test('saved integration token rows render modal editors with a gear button', function () {
@@ -469,3 +469,21 @@ test('saving a vault token with unchanged connection settings and a blank token
         ->and($savedToken->token)->toBe('hvs.stored-secret')
         ->and($savedToken->metadata)->toBe(['base_url' => 'https://example.com:8200', 'namespace' => 'team-a']);
 });
+
+test('the token list shows its empty state after the editor deletes the last token', function () {
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'secret',
+        'capabilities' => ['dns'],
+    ]);
+    $list = Livewire::test(IntegrationTokens::class)->assertDontSee('No integration tokens');
+
+    Livewire::test(IntegrationTokenEditor::class, ['integration_token_uuid' => $token->uuid])
+        ->call('delete')
+        ->assertDispatched('integration-token-deleted', uuid: $token->uuid);
+
+    $list->dispatch('integration-token-deleted', uuid: $token->uuid)
+        ->assertSee('No integration tokens');
+});
diff --git a/tests/Feature/Server/CheckAndStartSentinelJobTest.php b/tests/Feature/Server/CheckAndStartSentinelJobTest.php
index cb541b3519..ac2213e736 100644
--- a/tests/Feature/Server/CheckAndStartSentinelJobTest.php
+++ b/tests/Feature/Server/CheckAndStartSentinelJobTest.php
@@ -21,7 +21,8 @@ beforeEach(function () {
     Storage::fake('ssh-mux');
     config()->set('constants.ssh.max_retries', 1);
     config()->set('constants.ssh.mux_enabled', false);
-    Http::fake(['*' => Http::response(['coolify' => ['sentinel' => ['version' => '1.0.0']]])]);
+    Http::preventStrayRequests();
+    Cache::put('coolify:versions:all', ['coolify' => ['sentinel' => ['version' => '1.0.0']]], 3600);
 
     $user = User::factory()->create();
     $team = $user->teams()->first();
@@ -109,6 +110,7 @@ it('does not restart a Sentinel whose health check is still starting', function
 
 it('restarts a running Sentinel that stopped pushing, at most once per hour', function () {
     Cache::flush();
+    Cache::put('coolify:versions:all', ['coolify' => ['sentinel' => ['version' => '1.0.0']]], 3600);
     $this->server->forceFill(['sentinel_updated_at' => now()->subMinutes(15), 'sentinel_waiting_since' => null])->save();
     Process::fake([
         '*docker ps*' => Process::result(output: 'running Up 2 hours (healthy)'),
@@ -122,6 +124,7 @@ it('restarts a running Sentinel that stopped pushing, at most once per hour', fu
 
 it('does not restart a Sentinel that started recently and has not pushed yet', function () {
     Cache::flush();
+    Cache::put('coolify:versions:all', ['coolify' => ['sentinel' => ['version' => '1.0.0']]], 3600);
     $this->server->forceFill(['sentinel_updated_at' => now()->subDays(5), 'sentinel_waiting_since' => now()->subMinutes(3)])->save();
     Process::fake([
         '*docker ps*' => Process::result(output: 'running Up 3 minutes (healthy)'),
diff --git a/tests/Feature/Server/ServerListPatchStatusTest.php b/tests/Feature/Server/ServerListPatchStatusTest.php
new file mode 100644
index 0000000000..50f1758a5d
--- /dev/null
+++ b/tests/Feature/Server/ServerListPatchStatusTest.php
@@ -0,0 +1,147 @@
+<?php
+
+use App\Livewire\Server\Index;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Storage::fake('ssh-keys');
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+});
+
+function serverListPatchServer(object $test, string $name, array $settings = []): Server
+{
+    $server = Server::factory()->create([
+        'name' => $name,
+        'team_id' => $test->team->id,
+        'private_key_id' => $test->privateKey->id,
+    ]);
+    $server->settings->forceFill($settings)->saveQuietly();
+
+    return $server;
+}
+
+function serverListPatchResult(int $updates, int $security, ?bool $rebootRequired): array
+{
+    return [
+        'osId' => 'ubuntu',
+        'package_manager' => 'apt',
+        'total_updates' => $updates,
+        'security_updates' => $security,
+        'reboot_required' => $rebootRequired,
+        'updates' => [],
+    ];
+}
+
+function serverListPatchActingAs(object $test, string $role): void
+{
+    $user = User::factory()->create();
+    $test->team->members()->attach($user, ['role' => $role]);
+    $test->actingAs($user);
+    session(['currentTeam' => $test->team]);
+}
+
+describe('patchStatus()', function () {
+    it('returns null when the server was never checked', function () {
+        $server = serverListPatchServer($this, 'never');
+
+        expect($server->settings->fresh()->patchStatus())->toBeNull();
+    });
+
+    it('returns the error of a failed check', function () {
+        $server = serverListPatchServer($this, 'failed', [
+            'patch_check_result' => ['osId' => 'ubuntu', 'package_manager' => 'apt'],
+            'patch_check_error' => 'apt-get failed',
+            'patch_checked_at' => now(),
+        ]);
+
+        expect($server->settings->fresh()->patchStatus())
+            ->toMatchArray(['updates' => 0, 'security' => 0, 'reboot_required' => false, 'error' => 'apt-get failed']);
+    });
+
+    it('returns the update, security, and reboot counts', function () {
+        $server = serverListPatchServer($this, 'counts', [
+            'patch_check_result' => serverListPatchResult(3, 1, true),
+            'patch_checked_at' => now()->subHour(),
+        ]);
+
+        $status = $server->settings->fresh()->patchStatus();
+
+        expect($status)->toMatchArray(['updates' => 3, 'security' => 1, 'reboot_required' => true, 'error' => null])
+            ->and($status['checked_at']->isSameMinute(now()->subHour()))->toBeTrue();
+    });
+
+    it('treats an old result without security and reboot keys as none', function () {
+        $server = serverListPatchServer($this, 'old', [
+            'patch_check_result' => ['osId' => 'ubuntu', 'package_manager' => 'apt', 'total_updates' => 2, 'updates' => []],
+            'patch_checked_at' => now(),
+        ]);
+
+        expect($server->settings->fresh()->patchStatus())
+            ->toMatchArray(['updates' => 2, 'security' => 0, 'reboot_required' => false, 'error' => null]);
+    });
+});
+
+describe('server list', function () {
+    beforeEach(function () {
+        serverListPatchServer($this, 'secure-host', [
+            'patch_check_result' => serverListPatchResult(3, 1, true),
+            'patch_checked_at' => now(),
+        ]);
+        serverListPatchServer($this, 'plain-host', [
+            'patch_check_result' => serverListPatchResult(2, 0, false),
+            'patch_checked_at' => now(),
+        ]);
+        serverListPatchServer($this, 'broken-host', [
+            'patch_check_error' => 'apt-get failed',
+            'patch_checked_at' => now(),
+        ]);
+        serverListPatchServer($this, 'unchecked-host');
+    });
+
+    it('shows patch badges to an admin', function () {
+        serverListPatchActingAs($this, 'admin');
+
+        Livewire::test(Index::class)
+            ->assertSee('1 security update')
+            ->assertSee('2 updates')
+            ->assertSee('Reboot required')
+            ->assertSee('Patch check failed')
+            ->assertDontSee('Patches:');
+    });
+
+    it('hides patch badges from a member', function () {
+        serverListPatchActingAs($this, 'member');
+
+        Livewire::test(Index::class)
+            ->assertSee('secure-host')
+            ->assertDontSee('security update')
+            ->assertDontSee('Reboot required')
+            ->assertDontSee('Patch check failed');
+    });
+
+    it('shows up to date when every checked server has no updates', function () {
+        Server::query()->each(fn (Server $server) => $server->settings->forceFill([
+            'patch_check_result' => serverListPatchResult(0, 0, false),
+            'patch_check_error' => null,
+            'patch_checked_at' => now(),
+        ])->saveQuietly());
+        serverListPatchActingAs($this, 'admin');
+
+        Livewire::test(Index::class)
+            ->assertSee('Up to date');
+    });
+});
diff --git a/tests/Feature/Server/ServerPatchesTest.php b/tests/Feature/Server/ServerPatchesTest.php
new file mode 100644
index 0000000000..b65c74c4fc
--- /dev/null
+++ b/tests/Feature/Server/ServerPatchesTest.php
@@ -0,0 +1,519 @@
+<?php
+
+use App\Actions\Server\CheckUpdates;
+use App\Actions\Server\ConfigureAutomaticSecurityUpdates;
+use App\Actions\Server\RebootServer;
+use App\Actions\Server\UpdatePackage;
+use App\Events\ServerPackagesUpdateFinished;
+use App\Events\ServerPatchCheckFinished;
+use App\Jobs\ServerManagerJob;
+use App\Jobs\ServerPatchCheckJob;
+use App\Livewire\Server\Security\Patches;
+use App\Models\AuditEvent;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use App\Notifications\Server\ServerPatchCheck;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+use Spatie\Activitylog\Models\Activity;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Storage::fake('ssh-keys');
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin, ['role' => 'admin']);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+    $this->server->settings->forceFill(['is_reachable' => true, 'is_usable' => true])->saveQuietly();
+});
+
+function patchesTestResult(int $updates = 1): array
+{
+    return [
+        'osId' => 'ubuntu',
+        'package_manager' => 'apt',
+        'total_updates' => $updates,
+        'updates' => array_slice([
+            ['package' => 'openssl', 'current_version' => '3.0.13-0ubuntu3.1', 'new_version' => '3.0.13-0ubuntu3.4', 'architecture' => 'amd64', 'repository' => 'noble-updates,noble-security'],
+            ['package' => 'curl', 'current_version' => '8.5.0-2ubuntu10.1', 'new_version' => '8.5.0-2ubuntu10.6', 'architecture' => 'amd64', 'repository' => 'noble-updates'],
+        ], 0, $updates),
+    ];
+}
+
+function runPatchesTestJob(Server $server, bool $manual = false): void
+{
+    (new ServerPatchCheckJob($server->fresh(), $manual))->handle();
+}
+
+describe('patch check job', function () {
+    beforeEach(function () {
+        Notification::fake();
+        Event::fake([ServerPatchCheckFinished::class]);
+        $this->team->emailNotificationSettings()->update(['use_instance_email_settings' => true, 'server_patch_email_notifications' => true]);
+    });
+
+    it('saves the result, clears the running flag, and broadcasts to the server team', function () {
+        CheckUpdates::shouldRun()->andReturn(patchesTestResult(2));
+        Cache::put(ServerPatchCheckJob::runningCacheKey($this->server), true);
+
+        runPatchesTestJob($this->server, manual: true);
+
+        $settings = $this->server->settings->fresh();
+        expect($settings->patch_check_result['total_updates'])->toBe(2)
+            ->and($settings->patch_check_result['updates'][0]['package'])->toBe('openssl')
+            ->and($settings->patch_check_error)->toBeNull()
+            ->and($settings->patch_checked_at)->not->toBeNull()
+            ->and(Cache::has(ServerPatchCheckJob::runningCacheKey($this->server)))->toBeFalse();
+        Event::assertDispatched(ServerPatchCheckFinished::class, fn ($event) => $event->teamId === $this->team->id && $event->serverUuid === $this->server->uuid);
+        Notification::assertNothingSent();
+    });
+
+    it('notifies about available updates on a scheduled check', function () {
+        CheckUpdates::shouldRun()->andReturn(patchesTestResult());
+
+        runPatchesTestJob($this->server);
+
+        Notification::assertSentTo($this->team, ServerPatchCheck::class);
+    });
+
+    it('sends the failure notification only when the check changes from ok to error', function () {
+        CheckUpdates::shouldRun()->andReturn(
+            ['osId' => 'ubuntu', 'package_manager' => 'apt', 'error' => 'apt is locked'],
+            ['osId' => 'ubuntu', 'package_manager' => 'apt', 'error' => 'apt is locked'],
+            patchesTestResult(0),
+            ['osId' => 'ubuntu', 'package_manager' => 'apt', 'error' => 'apt is locked again'],
+        );
+
+        runPatchesTestJob($this->server);
+        runPatchesTestJob($this->server);
+        expect($this->server->settings->fresh()->patch_check_error)->toBe('apt is locked');
+        Notification::assertSentToTimes($this->team, ServerPatchCheck::class, 1);
+
+        runPatchesTestJob($this->server);
+        expect($this->server->settings->fresh()->patch_check_error)->toBeNull();
+
+        runPatchesTestJob($this->server);
+        Notification::assertSentToTimes($this->team, ServerPatchCheck::class, 2);
+    });
+
+    it('saves an error for a manual check of a server that is not functional', function () {
+        $this->server->settings->forceFill(['is_reachable' => false])->saveQuietly();
+        CheckUpdates::shouldRun()->never();
+
+        runPatchesTestJob($this->server, manual: true);
+
+        expect($this->server->settings->fresh()->patch_check_error)->toBe('Server is not reachable or not ready.');
+        Event::assertDispatched(ServerPatchCheckFinished::class);
+    });
+});
+
+describe('check frequency', function () {
+    it('uses the server frequency instead of the weekly default', function () {
+        $default = ServerManagerJob::patchCheckCron($this->server);
+        expect($default)->toEndWith('* * 0');
+
+        $this->server->settings->forceFill(['patch_check_frequency' => 'daily'])->saveQuietly();
+        expect(ServerManagerJob::patchCheckCron($this->server->fresh()))->toBe('0 0 * * *');
+
+        $this->server->settings->forceFill(['patch_check_frequency' => '30 3 * * 1'])->saveQuietly();
+        expect(ServerManagerJob::patchCheckCron($this->server->fresh()))->toBe('30 3 * * 1');
+    });
+
+    it('accepts presets and cron expressions that run at most once per hour', function (string $frequency, bool $valid) {
+        expect(Patches::isValidPatchCheckFrequency($frequency))->toBe($valid);
+    })->with([
+        ['daily', true],
+        ['hourly', true],
+        ['0 3 * * *', true],
+        ['every_minute', false],
+        ['*/30 * * * *', false],
+        ['not a cron', false],
+    ]);
+
+    it('saves a valid frequency and rejects an invalid one', function () {
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->set('patchCheckFrequency', 'daily')
+            ->call('submit')
+            ->assertDispatched('success')
+            ->set('patchCheckFrequency', '* * * * *')
+            ->call('submit')
+            ->assertDispatched('error');
+
+        expect($this->server->settings->fresh()->patch_check_frequency)->toBe('daily');
+    });
+});
+
+describe('patches page', function () {
+    beforeEach(function () {
+        Queue::fake();
+    });
+
+    it('shows the saved result of the last check', function () {
+        $this->server->settings->forceFill(['patch_check_result' => patchesTestResult(2), 'patch_checked_at' => now()->subHour()])->saveQuietly();
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->assertSee('1 hour ago')
+            ->assertSee('openssl')
+            ->assertSee('8.5.0-2ubuntu10.6');
+    });
+
+    it('queues the check for an admin and shows the progress', function () {
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->call('checkForUpdates')
+            ->assertSet('checking', true)
+            ->assertSee('Inspecting installed packages');
+
+        Queue::assertPushed(ServerPatchCheckJob::class, fn ($job) => $job->manual && $job->server->is($this->server));
+    });
+
+    it('refreshes from the saved result when the check finishes', function () {
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $this->team]);
+        $component = Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])->call('checkForUpdates');
+
+        $this->server->settings->forceFill(['patch_check_result' => patchesTestResult(), 'patch_checked_at' => now()])->saveQuietly();
+        Cache::forget(ServerPatchCheckJob::runningCacheKey($this->server));
+
+        $component->call('patchCheckFinished', ['serverUuid' => $this->server->uuid])
+            ->assertSet('checking', false)
+            ->assertSee('openssl');
+    });
+
+    it('updates only a package from the saved result', function () {
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $this->team]);
+        $this->server->settings->forceFill(['patch_check_result' => patchesTestResult(), 'patch_checked_at' => now()])->saveQuietly();
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->call('updatePackage', 'curl; reboot')
+            ->assertDispatched('error', message: 'This package has no update in the last check.');
+    });
+});
+
+describe('patches authorization', function () {
+    beforeEach(function () {
+        Queue::fake();
+        $this->member = User::factory()->create();
+        $this->team->members()->attach($this->member, ['role' => 'member']);
+    });
+
+    it('does not let a member open the page', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])->assertForbidden();
+    });
+
+    it('does not show a server of another team', function () {
+        $otherTeam = Team::factory()->create();
+        $this->admin->teams()->attach($otherTeam, ['role' => 'owner']);
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $otherTeam]);
+
+        expect(fn () => Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid]))->toThrow(ModelNotFoundException::class);
+    });
+
+    it('uses the role in the server team after the session switches to a team the user owns', function () {
+        $otherTeam = Team::factory()->create();
+        $this->member->teams()->attach($otherTeam, ['role' => 'owner']);
+        $this->member->teams()->updateExistingPivot($this->team->id, ['role' => 'admin']);
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        $component = Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid]);
+
+        // The user is now only a member of the server team, but owns the session team.
+        $this->member->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+        $this->member->unsetRelation('teams');
+        session(['currentTeam' => $otherTeam]);
+
+        $component->call('checkForUpdates')->assertDispatched('error');
+        $component->set('patchCheckFrequency', 'daily')->call('submit')->assertDispatched('error');
+
+        Queue::assertNothingPushed();
+        expect($this->server->settings->fresh()->patch_check_frequency)->toBeNull();
+    });
+});
+
+it('runs a new check when a package update finishes', function () {
+    Queue::fake();
+
+    ServerPackagesUpdateFinished::dispatch(['server_uuid' => $this->server->uuid, 'packages' => ['curl']]);
+
+    Queue::assertPushed(ServerPatchCheckJob::class, fn ($job) => $job->manual && $job->server->is($this->server));
+    expect(Cache::has(ServerPatchCheckJob::runningCacheKey($this->server)))->toBeTrue();
+});
+
+describe('security, reboot, and risk', function () {
+    beforeEach(function () {
+        Queue::fake();
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $this->team]);
+    });
+
+    it('shows security updates, risky packages, and the reboot action', function () {
+        $result = (new CheckUpdates)->addUpdateDetails([
+            'osId' => 'ubuntu', 'package_manager' => 'apt', 'total_updates' => 2,
+            'updates' => [
+                ['package' => 'curl', 'new_version' => '8.5.0-2ubuntu10.6', 'repository' => 'noble-updates'],
+                ['package' => 'docker-ce', 'new_version' => '5:28.0.0-1', 'repository' => 'noble-security'],
+            ],
+        ], 'apt');
+        $result['reboot_required'] = true;
+        $this->server->settings->forceFill(['patch_check_result' => $result, 'patch_checked_at' => now()])->saveQuietly();
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->assertSee('1 security update')
+            ->assertSee('Reboot required')
+            ->assertSee('Reboot server')
+            ->assertSee(CheckUpdates::RISK_LABELS['docker'])
+            ->assertSeeInOrder(['docker-ce', 'curl']);
+    });
+
+    it('reboots the server for an admin and checks it again later', function () {
+        RebootServer::shouldRun()->once()->with(Mockery::on(fn ($server) => $server->is($this->server)));
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->call('rebootServer')
+            ->assertDispatched('success');
+    });
+
+    it('does not let a member of the server team reboot after the session switches to a team the user owns', function () {
+        $user = User::factory()->create();
+        $this->team->members()->attach($user, ['role' => 'admin']);
+        $otherTeam = Team::factory()->create();
+        $user->teams()->attach($otherTeam, ['role' => 'owner']);
+        $this->actingAs($user);
+        $component = Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid]);
+
+        $user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+        $user->unsetRelation('teams');
+        session(['currentTeam' => $otherTeam]);
+        RebootServer::shouldRun()->never();
+
+        $component->call('rebootServer')->assertDispatched('error');
+    });
+
+    it('does not reboot a server that another instance manages', function () {
+        $this->server->forceFill(['server_metadata' => ['transfer' => ['status' => 'transferred']]])->saveQuietly();
+
+        expect(fn () => RebootServer::run($this->server->fresh()))->toThrow(RuntimeException::class, 'managed by another Coolify instance');
+    });
+
+    it('marks the risky packages in the notification', function () {
+        $result = (new CheckUpdates)->addUpdateDetails(['updates' => [
+            ['package' => 'linux-image-6.8.0-45-generic', 'repository' => 'noble-security', 'current_version' => '1', 'new_version' => '2', 'architecture' => 'amd64'],
+            ['package' => 'curl', 'repository' => 'noble-updates', 'current_version' => '1', 'new_version' => '2', 'architecture' => 'amd64'],
+        ]], 'apt');
+
+        $payload = (new ServerPatchCheck($this->server, [...$result, 'total_updates' => 2, 'reboot_required' => true]))->toWebhook();
+
+        expect($payload['critical_packages_count'])->toBe(1)
+            ->and($payload['security_updates'])->toBe(1)
+            ->and($payload['reboot_required'])->toBeTrue();
+    });
+});
+
+describe('automatic security updates', function () {
+    beforeEach(function () {
+        Queue::fake();
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $this->team]);
+        $this->server->settings->forceFill(['patch_check_result' => patchesTestResult(0), 'patch_checked_at' => now()])->saveQuietly();
+    });
+
+    it('turns automatic security updates on and off with the saved time', function () {
+        $this->server->settings->forceFill(['auto_security_updates_time' => '04:30'])->saveQuietly();
+        ConfigureAutomaticSecurityUpdates::shouldRun()->once()
+            ->with(Mockery::on(fn ($server) => $server->is($this->server)), 'apt', true, '04:30');
+        ConfigureAutomaticSecurityUpdates::shouldRun()->once()
+            ->with(Mockery::on(fn ($server) => $server->is($this->server)), 'apt', false, '04:30');
+
+        $component = Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->assertSee('Turn on automatic security updates?')
+            ->assertSee('all containers on this server stop and start again')
+            ->call('toggleAutomaticSecurityUpdates')
+            ->assertDispatched('success')
+            ->assertSet('autoSecurityUpdates', true);
+        expect($this->server->settings->fresh()->is_auto_security_updates_enabled)->toBeTrue();
+
+        $component->call('toggleAutomaticSecurityUpdates')->assertSet('autoSecurityUpdates', false);
+        expect($this->server->settings->fresh()->is_auto_security_updates_enabled)->toBeFalse();
+    });
+
+    it('does not let the client turn on automatic updates without the confirmed action', function () {
+        ConfigureAutomaticSecurityUpdates::shouldRun()->never();
+
+        expect(fn () => Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])->set('autoSecurityUpdates', true))
+            ->toThrow(CannotUpdateLockedPropertyException::class);
+    });
+
+    it('applies a new maintenance window only when automatic updates are on', function () {
+        ConfigureAutomaticSecurityUpdates::shouldRun()->once()
+            ->with(Mockery::on(fn ($server) => $server->is($this->server)), 'apt', true, '05:00');
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->set('autoSecurityUpdatesTime', '04:00')
+            ->call('submit')
+            ->assertDispatched('success');
+        expect($this->server->settings->fresh()->auto_security_updates_time)->toBe('04:00');
+
+        $this->server->settings->forceFill(['is_auto_security_updates_enabled' => true])->saveQuietly();
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->set('autoSecurityUpdatesTime', '05:00')
+            ->call('submit')
+            ->assertDispatched('success');
+        expect($this->server->settings->fresh()->auto_security_updates_time)->toBe('05:00');
+    });
+
+    it('turns on automatic updates with the time in the field, also when it is not saved yet', function () {
+        ConfigureAutomaticSecurityUpdates::shouldRun()->once()
+            ->with(Mockery::on(fn ($server) => $server->is($this->server)), 'apt', true, '05:45');
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->set('autoSecurityUpdatesTime', '05:45')
+            ->call('toggleAutomaticSecurityUpdates')
+            ->assertDispatched('success');
+
+        expect($this->server->settings->fresh())
+            ->is_auto_security_updates_enabled->toBeTrue()
+            ->auto_security_updates_time->toBe('05:45');
+    });
+
+    it('keeps the setting off when the server commands fail', function () {
+        ConfigureAutomaticSecurityUpdates::shouldRun()->once()->andThrow(new RuntimeException('apt-get failed'));
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->call('toggleAutomaticSecurityUpdates')
+            ->assertDispatched('error')
+            ->assertSet('autoSecurityUpdates', false);
+
+        expect($this->server->settings->fresh()->is_auto_security_updates_enabled)->toBeFalse();
+    });
+
+    it('shows that other package managers are not supported', function () {
+        $this->server->settings->forceFill(['patch_check_result' => [...patchesTestResult(0), 'package_manager' => 'pacman']])->saveQuietly();
+        ConfigureAutomaticSecurityUpdates::shouldRun()->never();
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->assertSee('this server uses pacman')
+            ->assertDontSee('Turn on automatic security updates?')
+            ->call('toggleAutomaticSecurityUpdates')
+            ->assertDispatched('error');
+    });
+
+    it('rejects an invalid maintenance window', function () {
+        ConfigureAutomaticSecurityUpdates::shouldRun()->never();
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->set('autoSecurityUpdatesTime', '25:00')
+            ->call('submit')
+            ->assertDispatched('error');
+    });
+
+    it('does not let a member turn on automatic updates', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member, ['role' => 'admin']);
+        $this->actingAs($member);
+        $component = Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid]);
+        $member->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+        $member->unsetRelation('teams');
+        ConfigureAutomaticSecurityUpdates::shouldRun()->never();
+
+        $component->call('toggleAutomaticSecurityUpdates')->assertDispatched('error');
+        expect($this->server->settings->fresh()->is_auto_security_updates_enabled)->toBeFalse();
+    });
+});
+
+describe('audit trail', function () {
+    beforeEach(function () {
+        Queue::fake();
+        $this->withoutDefer();
+        $this->actingAs($this->admin);
+        session(['currentTeam' => $this->team]);
+        $this->server->settings->forceFill(['patch_check_result' => patchesTestResult(), 'patch_checked_at' => now()])->saveQuietly();
+    });
+
+    it('records who requested a package update', function () {
+        $activity = Activity::query()->create(['log_name' => 'default', 'description' => '', 'properties' => []]);
+        UpdatePackage::shouldRun()->once()->andReturn($activity);
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])->call('updatePackage', 'openssl');
+
+        $event = AuditEvent::query()->where('event', 'ui.server.packages_update_requested')->sole();
+        expect($event->actor_email)->toBe($this->admin->email)
+            ->and($event->team_id)->toBe($this->team->id)
+            ->and($event->resource_uuid)->toBe($this->server->uuid)
+            ->and($event->metadata['packages'])->toBe(['openssl'])
+            ->and($event->metadata['activity_id'])->toBe($activity->id);
+    });
+
+    it('records the result of a finished package update and checks the server again', function (string $status, string $result) {
+        $activity = Activity::query()->create(['log_name' => 'default', 'description' => '', 'properties' => [
+            'type_uuid' => 'update-1', 'status' => $status, 'exitCode' => $status === 'finished' ? 0 : 100,
+        ]]);
+        auth()->logout();
+
+        ServerPackagesUpdateFinished::dispatch([
+            'update_id' => 'update-1', 'server_uuid' => $this->server->uuid, 'packages' => [], 'package_manager' => 'apt',
+            'actor_id' => $this->admin->id, 'actor_name' => $this->admin->name, 'actor_email' => $this->admin->email,
+        ]);
+
+        $event = AuditEvent::query()->where('event', 'ui.server.packages_update_finished')->sole();
+        expect($event->actor_email)->toBe($this->admin->email)
+            ->and($event->team_id)->toBe($this->team->id)
+            ->and($event->metadata)->toMatchArray(['packages' => 'all', 'result' => $result, 'activity_id' => $activity->id]);
+        Queue::assertPushed(ServerPatchCheckJob::class);
+    })->with([
+        ['finished', 'success'],
+        ['error', 'failed'],
+    ]);
+
+    it('records a reboot and a failed reboot', function () {
+        RebootServer::shouldRun()->once();
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])->call('rebootServer');
+
+        RebootServer::shouldRun()->once()->andThrow(new RuntimeException('Server is not reachable or not ready.'));
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])->call('rebootServer');
+
+        expect(AuditEvent::query()->where('event', 'ui.server.reboot_requested')->orderBy('id')->get()->map(fn ($event) => $event->metadata['result'])->all())
+            ->toBe(['started', 'failed']);
+    });
+
+    it('records a change of the automatic security updates', function () {
+        ConfigureAutomaticSecurityUpdates::shouldRun()->once();
+
+        Livewire::test(Patches::class, ['server_uuid' => $this->server->uuid])
+            ->call('toggleAutomaticSecurityUpdates');
+
+        $event = AuditEvent::query()->where('event', 'ui.server.auto_security_updates_updated')->sole();
+        expect($event->actor_email)->toBe($this->admin->email)
+            ->and($event->metadata)->toMatchArray(['enabled' => true, 'time' => '03:00', 'package_manager' => 'apt', 'result' => 'success']);
+    });
+});
diff --git a/tests/Feature/ServerCanvasTest.php b/tests/Feature/ServerCanvasTest.php
new file mode 100644
index 0000000000..58de97837d
--- /dev/null
+++ b/tests/Feature/ServerCanvasTest.php
@@ -0,0 +1,413 @@
+<?php
+
+use App\Livewire\Server\Index as ServerIndex;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\ServerCanvas;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cookie;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    $this->web = Server::factory()->create(['team_id' => $this->team->id, 'name' => 'web-server', 'ip' => '203.0.113.20']);
+    $this->db = Server::factory()->create(['team_id' => $this->team->id, 'name' => 'db-server']);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop']);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id, 'name' => 'staging']);
+});
+
+function serverCanvasApp(Environment $environment, Server $server, string $name): Application
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+
+    return Application::factory()->create([
+        'name' => $name,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+function serverCanvasSession(object $test, User $user, Team $team): object
+{
+    return $test->actingAs($user)->withSession(['currentTeam' => $team])
+        ->withHeader('X-Canvas-Team', (string) $team->id);
+}
+
+test('the servers canvas shows every server of the team with its resources and links', function () {
+    $app = serverCanvasApp($this->environment, $this->web, 'storefront');
+    $api = serverCanvasApp($this->environment, $this->db, 'orders-api');
+    $link = ResourceLink::create([
+        'environment_id' => $this->environment->id,
+        'source_type' => $app->getMorphClass(), 'source_id' => $app->id,
+        'target_type' => $api->getMorphClass(), 'target_id' => $api->id,
+    ]);
+
+    $response = serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk()
+        ->assertJsonPath('title', 'Servers')
+        ->assertJsonPath('title_link', null)
+        ->assertJsonPath('can_edit', true)
+        ->assertJsonPath('layout', 'server')
+        ->assertJsonPath('positions', [])
+        ->assertJsonPath('links.0.id', $link->uuid);
+
+    $resources = collect($response->json('nodes'))->where('type', '!=', 'empty');
+
+    // The project's empty production environment shows as a placeholder card on the server of its other environments.
+    expect(collect($response->json('zones'))->pluck('name')->all())->toBe(['db-server', 'web-server'])
+        ->and(collect($response->json('nodes'))->mapWithKeys(fn ($node) => [$node['name'] => [$node['zone'], $node['context']]])->all())->toBe([
+            'storefront' => [$this->web->uuid, 'Shop / staging'],
+            'orders-api' => [$this->db->uuid, 'Shop / staging'],
+            'No resources yet' => [$this->web->uuid, 'Shop / production'],
+        ])
+        ->and($response->json('nodes.0.project'))->toBe(['uuid' => $this->project->uuid, 'name' => 'Shop'])
+        ->and($response->json('nodes.0.environment'))->toBe(['uuid' => $this->environment->uuid, 'name' => 'staging'])
+        ->and($resources->pluck('context_link')->unique()->all())->toBe([
+            route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]),
+        ])
+        ->and(collect($response->json('zones'))->pluck('link')->all())->toBe([
+            route('server.show', ['server_uuid' => $this->db->uuid]),
+            route('server.show', ['server_uuid' => $this->web->uuid]),
+        ]);
+});
+
+test('the servers canvas puts empty environments of a project without resources on the first server', function () {
+    $bare = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Bare']);
+
+    $response = serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk();
+
+    expect(collect($response->json('zones'))->pluck('name')->all())->toBe(['db-server', 'web-server'])
+        ->and(collect($response->json('nodes'))->where('project.uuid', $bare->uuid)->pluck('zone')->all())->toBe([$this->db->uuid]);
+});
+
+test('the servers canvas shows a server without resources as a placeholder card in its zone', function () {
+    serverCanvasApp($this->environment, $this->web, 'storefront');
+    Environment::query()->where('project_id', $this->project->id)->where('name', '!=', 'staging')->delete();
+
+    $response = serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk();
+
+    $placeholder = collect($response->json('nodes'))->firstWhere('zone', $this->db->uuid);
+
+    expect($placeholder)->toMatchArray([
+        'id' => 'empty-server:'.$this->db->uuid,
+        'type' => 'empty',
+        'name' => 'No resources yet',
+        'link' => route('server.show', ['server_uuid' => $this->db->uuid]),
+    ])->and(collect($response->json('nodes'))->where('zone', $this->web->uuid)->pluck('name')->all())->toBe(['storefront']);
+});
+
+test('one server canvas shows only that server, and links that leave it are hidden', function () {
+    $app = serverCanvasApp($this->environment, $this->web, 'storefront');
+    $api = serverCanvasApp($this->environment, $this->db, 'orders-api');
+    ResourceLink::create([
+        'environment_id' => $this->environment->id,
+        'source_type' => $app->getMorphClass(), 'source_id' => $app->id,
+        'target_type' => $api->getMorphClass(), 'target_id' => $api->id,
+    ]);
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/servers/{$this->web->uuid}/canvas")
+        ->assertOk()
+        ->assertJsonPath('title', 'web-server')
+        ->assertJsonPath('title_link', route('server.show', ['server_uuid' => $this->web->uuid]))
+        ->assertJsonCount(1, 'zones')
+        ->assertJsonPath('nodes.0.name', 'storefront')
+        ->assertJsonCount(1, 'nodes')
+        ->assertJsonPath('links', []);
+});
+
+test('the server canvas sends the card positions saved on the environment canvas with each card', function () {
+    $app = serverCanvasApp($this->environment, $this->web, 'storefront');
+    $other = serverCanvasApp($this->environment, $this->web, 'checkout');
+    $this->environment->forceFill(['canvas_positions' => [$app->uuid => ['x' => 120, 'y' => 40]]])->save();
+
+    $nodes = collect(serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk()
+        ->assertJsonPath('can_edit', true)
+        ->assertJsonPath('can_move', false)
+        ->assertJsonPath('positions', [])
+        ->json('nodes'))->keyBy('id');
+
+    expect($nodes[$app->uuid]['saved'])->toBe(['x' => 120, 'y' => 40])
+        ->and($nodes[$other->uuid]['saved'])->toBeNull();
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/servers/{$this->web->uuid}/canvas")
+        ->assertOk()
+        ->assertJsonPath('can_move', false)
+        ->assertJsonPath('positions', []);
+});
+
+test('members see the server canvas without server IPs and cannot edit it', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    serverCanvasApp($this->environment, $this->web, 'storefront');
+
+    serverCanvasSession($this, $member, $this->team)
+        ->getJson("/canvas/api/servers/{$this->web->uuid}/canvas")
+        ->assertOk()
+        ->assertJsonPath('can_edit', false)
+        ->assertJsonPath('zones.0.ip', null);
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/servers/{$this->web->uuid}/canvas")
+        ->assertJsonPath('zones.0.ip', '203.0.113.20');
+});
+
+test('the server canvas never shows another team servers or resources', function () {
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $outsider = User::factory()->create();
+    $otherTeam->members()->attach($outsider->id, ['role' => 'owner']);
+    $this->team->members()->attach($outsider->id, ['role' => 'member']);
+    serverCanvasApp($this->environment, $this->web, 'storefront');
+
+    // Session switched to the other team: this team's server is out of reach.
+    serverCanvasSession($this, $outsider, $otherTeam)
+        ->getJson("/canvas/api/servers/{$this->web->uuid}/canvas")
+        ->assertNotFound();
+    $all = serverCanvasSession($this, $outsider, $otherTeam)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk();
+    expect($all->json('zones'))->toBe([])->and($all->json('nodes'))->toBe([]);
+
+    serverCanvasSession($this, $outsider, $otherTeam)
+        ->get(route('server.canvas', ['server_uuid' => $this->web->uuid]))
+        ->assertNotFound();
+});
+
+test('the canvas pages open for team members', function () {
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withoutVite()
+        ->get(route('server.canvas.index'))
+        ->assertOk()
+        ->assertSee('data-endpoint="/servers/canvas"', false);
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withoutVite()
+        ->get(route('server.canvas', ['server_uuid' => $this->web->uuid]))
+        ->assertOk()
+        ->assertSee('data-endpoint="/servers/'.$this->web->uuid.'/canvas"', false);
+});
+
+test('the servers page reopens the canvas when the user left it on the canvas view', function () {
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->get(route('server.canvas.index'))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_servers_view", 'canvas');
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_servers_view", 'canvas')
+        ->get(route('server.index'))
+        ->assertRedirect(route('server.canvas.index'));
+
+    // The table / grid links on the canvas pick the list view again.
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_servers_view", 'canvas')
+        ->get(route('server.index', ['view' => 'grid']))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_servers_view", 'grid');
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_servers_view", 'grid')
+        ->get(route('server.index'))
+        ->assertOk();
+});
+
+test('the environment page reopens the canvas when the user left it on the canvas view', function () {
+    $parameters = ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid];
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->get(route('project.environment.canvas', $parameters))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_environment_view", 'canvas');
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_environment_view", 'canvas')
+        ->get(route('project.resource.index', $parameters))
+        ->assertRedirect(route('project.environment.canvas', $parameters));
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_environment_view", 'canvas')
+        ->get(route('project.resource.index', [...$parameters, 'view' => 'table']))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_environment_view", 'table');
+});
+
+test('the server resources page reopens the one server canvas when the user left it on the canvas view', function () {
+    $parameters = ['server_uuid' => $this->web->uuid];
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->get(route('server.canvas', $parameters))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_server_resources_view", 'canvas');
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_server_resources_view", 'canvas')
+        ->get(route('server.resources', $parameters))
+        ->assertRedirect(route('server.canvas', $parameters));
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_server_resources_view", 'canvas')
+        ->get(route('server.resources', [...$parameters, 'view' => 'list']))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_server_resources_view", 'list');
+});
+
+test('the canvas API works with the browser session when the instance API is disabled', function () {
+    InstanceSettings::query()->whereKey(0)->update(['is_api_enabled' => false]);
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk()
+        ->assertJsonPath('title', 'Servers');
+});
+
+test('the remembered view belongs to the user, not to the browser', function () {
+    $other = User::factory()->create();
+    $this->team->members()->attach($other->id, ['role' => 'admin']);
+
+    serverCanvasSession($this, $other, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_servers_view", 'canvas')
+        ->get(route('server.index'))
+        ->assertOk();
+});
+
+test('the list page remembers the table or grid choice and opens it again', function () {
+    $this->actingAs($this->admin)->withSession(['currentTeam' => $this->team]);
+    $cookie = "coolify_{$this->admin->id}_servers_view";
+
+    Livewire::test(ServerIndex::class)->call('saveListView', 'servers', 'grid');
+    expect(Cookie::queued($cookie)?->getValue())->toBe('grid');
+
+    // Unknown pages and views are ignored.
+    Cookie::flushQueuedCookies();
+    Livewire::test(ServerIndex::class)
+        ->call('saveListView', 'servers', 'canvas')
+        ->call('saveListView', 'billing', 'grid');
+    expect(Cookie::getQueuedCookies())->toBeEmpty();
+
+    serverCanvasSession($this, $this->admin, $this->team)
+        ->withCookie($cookie, 'grid')
+        ->get(route('server.index'))
+        ->assertOk()
+        ->assertSee("viewMode: 'grid'", false);
+});
+
+test('one server canvas loads the unmanaged containers of that server', function () {
+    $server = Mockery::mock($this->web)->makePartial();
+    $server->shouldReceive('loadUnmanagedContainers')->andReturn(collect([
+        ['ID' => 'abc123', 'Names' => 'portainer', 'Image' => 'portainer/portainer-ce', 'State' => 'running', 'Status' => 'Up 2 hours (healthy)'],
+        ['ID' => 'def456', 'Names' => 'old-job', 'Image' => 'busybox', 'State' => 'exited', 'Status' => 'Exited (0) 3 days ago'],
+    ]));
+
+    $nodes = app(ServerCanvas::class)->unmanagedContainerNodes($server);
+
+    expect($nodes->map(fn ($node) => [$node['id'], $node['type'], $node['name'], $node['status'], $node['subtitle'], $node['zone'], $node['context']])->all())->toBe([
+        ['container:def456', 'container', 'old-job', 'exited', 'busybox', $this->web->uuid, 'Unmanaged containers'],
+        ['container:abc123', 'container', 'portainer', 'running:healthy', 'portainer/portainer-ce', $this->web->uuid, 'Unmanaged containers'],
+    ]);
+});
+
+test('the server canvas still loads when the unmanaged containers cannot be read', function () {
+    $server = Mockery::mock($this->web)->makePartial();
+    $server->shouldReceive('loadUnmanagedContainers')->andThrow(new RuntimeException('SSH failed'));
+
+    expect(app(ServerCanvas::class)->unmanagedContainerNodes($server)->all())->toBe([]);
+});
+
+test('only the one server canvas points to the unmanaged containers of its server', function () {
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $foreign = Server::factory()->create(['team_id' => $otherTeam->id]);
+
+    serverCanvasSession($this, $this->admin, $this->team)->getJson("/canvas/api/servers/{$this->web->uuid}/canvas")
+        ->assertJsonPath('containers_endpoint', "/servers/{$this->web->uuid}/canvas/containers");
+    serverCanvasSession($this, $this->admin, $this->team)->getJson('/canvas/api/servers/canvas')
+        ->assertJsonPath('containers_endpoint', null);
+    serverCanvasSession($this, $this->admin, $this->team)->getJson("/canvas/api/servers/{$this->web->uuid}/canvas/containers")
+        ->assertOk()->assertExactJson(['nodes' => []]);
+    serverCanvasSession($this, $this->admin, $this->team)->getJson("/canvas/api/servers/{$foreign->uuid}/canvas/containers")
+        ->assertNotFound();
+});
+
+test('server zones show host facts, the proxy and a usage endpoint only when metrics can be read', function () {
+    $this->web->forceFill([
+        'server_metadata' => ['os' => 'Ubuntu 24.04', 'arch' => 'x86_64', 'cpus' => 4, 'memory_bytes' => 8589934592, 'uptime_since' => '2026-10-01 10:00:00'],
+        'proxy' => ['type' => 'TRAEFIK', 'status' => 'running'],
+    ])->save();
+    $this->web->settings->forceFill(['is_reachable' => true, 'is_metrics_enabled' => true])->saveQuietly();
+    $this->db->settings->forceFill(['is_reachable' => true, 'is_metrics_enabled' => false])->saveQuietly();
+    $this->db->forceFill(['proxy' => ['type' => 'NONE']])->save();
+
+    $zones = collect(serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk()
+        ->json('zones'))->keyBy('name');
+
+    expect($zones['web-server']['details'])->toBe([
+        'os' => 'Ubuntu 24.04',
+        'arch' => 'x86_64',
+        'cpus' => 4,
+        'memory_bytes' => 8589934592,
+        'uptime_since' => '2026-10-01 10:00:00',
+        'proxy' => ['type' => 'TRAEFIK', 'status' => 'running'],
+        'usage_endpoint' => "/servers/{$this->web->uuid}/canvas/usage",
+    ])
+        ->and($zones['db-server']['details']['proxy'])->toBeNull()
+        ->and($zones['db-server']['details']['usage_endpoint'])->toBeNull();
+});
+
+test('the usage endpoint returns the latest Sentinel values and never another team server', function () {
+    $server = Mockery::mock($this->web)->makePartial();
+    $server->shouldReceive('getCpuMetrics')->andReturn([[1, 10.0], [2, 12.34]]);
+    $server->shouldReceive('getMemoryMetrics')->andReturn([[2, 40.0]]);
+    $server->shouldReceive('getDiskMetrics')->andThrow(new RuntimeException('no disk data'));
+
+    expect(app(ServerCanvas::class)->usage($server))->toBe(['cpu' => 12.3, 'memory' => 40.0, 'disk' => null]);
+
+    $this->web->settings->forceFill(['is_metrics_enabled' => false])->saveQuietly();
+    serverCanvasSession($this, $this->admin, $this->team)->getJson("/canvas/api/servers/{$this->web->uuid}/canvas/usage")
+        ->assertOk()->assertExactJson(['cpu' => null, 'memory' => null, 'disk' => null]);
+
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $foreign = Server::factory()->create(['team_id' => $otherTeam->id]);
+    serverCanvasSession($this, $this->admin, $this->team)->getJson("/canvas/api/servers/{$foreign->uuid}/canvas/usage")
+        ->assertNotFound();
+});
+
+test('only admins may move the environment groups on the server canvas', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    serverCanvasSession($this, $this->admin, $this->team)->getJson('/canvas/api/servers/canvas')
+        ->assertJsonPath('can_move_groups', true);
+    serverCanvasSession($this, $member, $this->team)->getJson('/canvas/api/servers/canvas')
+        ->assertJsonPath('can_move_groups', false);
+});
diff --git a/tests/Feature/ServerCloudProviderStatusCheckJobTest.php b/tests/Feature/ServerCloudProviderStatusCheckJobTest.php
index 10e1a8c9d8..ba0ceee459 100644
--- a/tests/Feature/ServerCloudProviderStatusCheckJobTest.php
+++ b/tests/Feature/ServerCloudProviderStatusCheckJobTest.php
@@ -60,6 +60,36 @@ it('syncs provider state for a placeholder server without scheduling SSH', funct
     Queue::assertNotPushed(ServerConnectionCheckJob::class);
 });
 
+it('schedules Hostinger provider state checks', function () {
+    $server = createCloudServerForStatusCheckJobTest('hostinger', [
+        'hostinger_virtual_machine_id' => 17923,
+        'hostinger_virtual_machine_status' => 'creating',
+    ]);
+
+    Queue::fake();
+    (new ServerManagerJob)->handle();
+    Queue::assertPushed(ServerCloudProviderStatusCheckJob::class, fn (ServerCloudProviderStatusCheckJob $job) => $job->server->is($server));
+});
+
+it('runs Hostinger provider state checks', function () {
+    $server = createCloudServerForStatusCheckJobTest('hostinger', [
+        'hostinger_virtual_machine_id' => 17923,
+        'hostinger_virtual_machine_status' => 'creating',
+    ]);
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'id' => 17923,
+            'state' => 'running',
+            'ipv4' => [['address' => '203.0.113.23']],
+        ]),
+    ]);
+
+    (new ServerCloudProviderStatusCheckJob($server))->handle();
+
+    expect($server->fresh()->ip)->toBe('203.0.113.23')
+        ->and($server->fresh()->hostinger_virtual_machine_status)->toBe('running');
+});
+
 it('backfills a DigitalOcean placeholder without changing reachability', function () {
     $server = createCloudServerForStatusCheckJobTest('digitalocean', [
         'digitalocean_droplet_id' => 987,
diff --git a/tests/Feature/ServerConnectionCheckIsolationTest.php b/tests/Feature/ServerConnectionCheckIsolationTest.php
index 771c4a832a..9d5b0b572b 100644
--- a/tests/Feature/ServerConnectionCheckIsolationTest.php
+++ b/tests/Feature/ServerConnectionCheckIsolationTest.php
@@ -5,6 +5,7 @@ use App\Models\CloudProviderToken;
 use App\Models\PrivateKey;
 use App\Models\Server;
 use App\Models\Team;
+use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
@@ -243,3 +244,57 @@ it('gives the job enough time for every connection check step', function () {
     expect($job->timeout)->toBeGreaterThanOrEqual(ServerConnectionCheckJob::maximumCheckSeconds())
         ->and($lock->expiresAfter)->toBeGreaterThan($job->timeout);
 });
+
+it('stops managing a server when its owner marker names another instance', function () {
+    $server = createServerForConnectionIsolationTest([
+        'ip' => '203.0.113.10',
+        'server_metadata' => ['transfer' => ['status' => 'claimed', 'claim' => ['claim_id' => 'claim-of-this-instance']]],
+    ]);
+    $server->settings->update(['is_reachable' => true, 'is_usable' => true]);
+    Process::fake([
+        '*ls -la /*' => Process::result(output: '{"claim_id":"claim-of-instance-b","instance_url":"https://coolify-b.test"}', exitCode: 0),
+        '*' => Process::result(output: '{"Server":{"Version":"29.4.3"}}', exitCode: 0),
+    ]);
+
+    (new ServerConnectionCheckJob($server->fresh(), disableMux: false))->handle();
+
+    $server->refresh();
+    expect($server->isTransferredAway())->toBeTrue()
+        ->and(data_get($server->server_metadata, 'transfer.target_instance_url'))->toBe('https://coolify-b.test')
+        ->and((bool) $server->settings->force_disabled)->toBeTrue();
+    Process::assertDidntRun(fn ($process) => str_contains($process->command, 'docker version'));
+});
+
+it('keeps managing a server when its owner marker is its own claim', function () {
+    $server = createServerForConnectionIsolationTest([
+        'ip' => '203.0.113.10',
+        'server_metadata' => ['transfer' => ['status' => 'claimed', 'claim' => ['claim_id' => 'claim-of-this-instance']]],
+    ]);
+    Process::fake([
+        '*ls -la /*' => Process::result(output: '{"claim_id":"claim-of-this-instance"}', exitCode: 0),
+        '*compose*' => Process::result(output: 'v2.32.4', exitCode: 0),
+        '*' => Process::result(output: '{"Server":{"Version":"29.4.3"}}', exitCode: 0),
+    ]);
+
+    (new ServerConnectionCheckJob($server->fresh(), disableMux: false))->handle();
+
+    $server->refresh();
+    expect($server->isTransferredAway())->toBeFalse()
+        ->and((bool) $server->settings->is_usable)->toBeTrue();
+});
+
+it('passes the SSH probe on a server without an owner marker', function () {
+    // The remote shell runs the probe with `set -e`, like this.
+    $result = Process::input(ServerConnectionCheckJob::probeCommand())->run(['sh', '-se']);
+
+    expect(file_exists(ServerTransferClaimer::OWNER_MARKER_PATH))->toBeFalse()
+        ->and($result->exitCode())->toBe(0);
+});
+
+it('keeps the owner marker read elevated in the SSH probe on a non-root server', function () {
+    $server = createServerForConnectionIsolationTest(['user' => 'ubuntu']);
+
+    expect(parseCommandsByLineForSudo(collect([ServerConnectionCheckJob::probeCommand()]), $server))->toBe([
+        'sudo cat '.ServerTransferClaimer::OWNER_MARKER_PATH.' 2>/dev/null || sudo true; ls -la / > /dev/null',
+    ]);
+});
diff --git a/tests/Feature/ServerDangerMenuVisibilityTest.php b/tests/Feature/ServerDangerMenuVisibilityTest.php
index fde1e65b7d..2f6b687c15 100644
--- a/tests/Feature/ServerDangerMenuVisibilityTest.php
+++ b/tests/Feature/ServerDangerMenuVisibilityTest.php
@@ -39,7 +39,7 @@ test('danger menu is visible for non-coolify-host servers that use host.docker.i
 
     $this->get(route('server.show', ['server_uuid' => $server->uuid]))
         ->assertSuccessful()
-        ->assertSee('>Danger</', false)
+        ->assertSee('>Danger Zone</', false)
         ->assertSee(route('server.delete', ['server_uuid' => $server->uuid]), false);
 });
 
@@ -58,7 +58,6 @@ test('danger menu is hidden for the coolify host server', function () {
 
     $this->get(route('server.show', ['server_uuid' => $server->uuid]))
         ->assertSuccessful()
-        ->assertDontSee('>Danger</', false)
         ->assertDontSee(route('server.delete', ['server_uuid' => $server->uuid]), false);
 });
 
diff --git a/tests/Feature/ServerManagementOwnershipTest.php b/tests/Feature/ServerManagementOwnershipTest.php
index 66e34538f3..1081738c69 100644
--- a/tests/Feature/ServerManagementOwnershipTest.php
+++ b/tests/Feature/ServerManagementOwnershipTest.php
@@ -1,19 +1,28 @@
 <?php
 
 use App\Livewire\Server\Show;
+use App\Livewire\Server\TransferFinish;
+use App\Models\Application;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    config(['app.env' => 'local']);
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    config(['app.env' => 'production']);
+    $this->withoutVite();
     InstanceSettings::forceCreate([
         'id' => 0,
         'fqdn' => 'https://coolify-a.test',
@@ -32,40 +41,13 @@ beforeEach(function () {
     session(['currentTeam' => $this->team]);
 });
 
-test('owner can stop managing a server from this instance', function () {
-    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
-        ->assertDispatched('success');
-
-    $this->server->refresh();
-
-    expect($this->server->isTransferredAway())->toBeTrue()
-        ->and($this->server->isManagementDisabled())->toBeTrue()
-        ->and((bool) $this->server->settings->force_disabled)->toBeTrue()
-        ->and((bool) $this->server->settings->is_sentinel_enabled)->toBeFalse();
-});
-
-test('server with disabled management shows it is transferable, not transferred away', function () {
-    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
-        ->assertSee('Transferable to another instance')
-        ->assertSee(route('server.transfer', ['server_uuid' => $this->server->uuid]))
-        ->assertDontSee('Transferred to another instance')
-        ->assertDontSee('Transferred away')
-        ->assertDontSeeHtml('>Transferable<');
-});
-
-test('server transferred to another instance is not reported as management disabled', function () {
+test('server transferred to another instance shows where it was transferred', function () {
     app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
 
-    $this->server->refresh();
-
-    expect($this->server->isTransferredAway())->toBeTrue()
-        ->and($this->server->isManagementDisabled())->toBeFalse();
-
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
         ->assertSee('Transferred to another instance')
-        ->assertDontSee('Transferable to another instance');
+        ->assertSee('https://coolify-b.test')
+        ->assertSee('Enable management');
 });
 
 test('owner can take management of a transferred server', function () {
@@ -79,7 +61,7 @@ test('owner can take management of a transferred server', function () {
     ])->save();
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
+        ->call('enableManagement')
         ->assertDispatched('success');
 
     $this->server->refresh();
@@ -112,7 +94,7 @@ test('cloud team over its server limit cannot take management of a transferred s
     markServerTransferredAway($this->server);
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
+        ->call('enableManagement')
         ->assertDispatched('error')
         ->assertNotDispatched('success');
 
@@ -128,7 +110,7 @@ test('cloud team within its server limit can take management of a transferred se
     markServerTransferredAway($this->server);
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
+        ->call('enableManagement')
         ->assertDispatched('success');
 
     $this->server->refresh();
@@ -137,7 +119,7 @@ test('cloud team within its server limit can take management of a transferred se
         ->and((bool) $this->server->settings->force_disabled)->toBeFalse();
 });
 
-test('claiming a server keeps it force disabled when the cloud team is over its server limit', function () {
+test('claiming a server fails without changes when the cloud team is over its server limit', function () {
     config()->set('constants.coolify.self_hosted', false);
     $this->team->forceFill(['custom_server_limit' => 1])->save();
     Server::factory()->create([
@@ -146,15 +128,18 @@ test('claiming a server keeps it force disabled when the cloud team is over its
     ]);
     markServerTransferredAway($this->server);
 
-    app(ServerTransferClaimer::class)->claim($this->server);
+    expect(fn () => app(ServerTransferClaimer::class)->claim($this->server))
+        ->toThrow(RuntimeException::class, 'over its server limit');
 
     $this->server->refresh();
 
-    expect(data_get($this->server->server_metadata, 'transfer.status'))->toBe('claimed')
+    expect($this->server->isTransferredAway())->toBeTrue()
         ->and((bool) $this->server->settings->force_disabled)->toBeTrue();
+    Process::assertNothingRan();
 });
 
-test('team members cannot change server management ownership', function () {
+test('team members cannot take management of a transferred server', function () {
+    markServerTransferredAway($this->server);
     $member = User::factory()->create();
     $this->team->members()->attach($member, ['role' => 'member']);
 
@@ -162,27 +147,25 @@ test('team members cannot change server management ownership', function () {
     session(['currentTeam' => $this->team]);
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
+        ->call('enableManagement')
         ->assertForbidden();
 
-    expect($this->server->fresh()->isTransferredAway())->toBeFalse();
+    expect($this->server->fresh()->isTransferredAway())->toBeTrue();
 });
 
-test('server overview shows a management button that matches the ownership state', function () {
+test('a managed server has no management button and cannot be disabled from the server page', function () {
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->assertSee('Disable management')
         ->assertDontSee('Enable management')
-        ->assertDontSeeHtml('wire:confirm')
-        ->call('toggleManagement', '')
-        ->assertSee('Enable management')
-        ->assertDontSee('Disable management');
+        ->assertDontSee('Disable management')
+        ->call('enableManagement')
+        ->assertNotDispatched('success');
+
+    expect(data_get($this->server->fresh()->server_metadata, 'transfer.status'))->toBeNull();
 });
 
-test('server validation button is hidden while management is disabled or transferred away', function () {
+test('server validation button is hidden while the server is transferred away', function () {
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->assertSeeHtml('wire:click.prevent="validateServer"')
-        ->call('toggleManagement')
-        ->assertDontSeeHtml('wire:click.prevent="validateServer"');
+        ->assertSeeHtml('wire:click.prevent="validateServer"');
 
     app(ServerTransferClaimer::class)->markTransferred($this->server->fresh(), targetInstanceUrl: 'https://coolify-b.test');
 
@@ -190,13 +173,37 @@ test('server validation button is hidden while management is disabled or transfe
         ->assertDontSeeHtml('wire:click.prevent="validateServer"');
 });
 
-test('management ownership is not available outside development', function () {
-    config(['app.env' => 'production']);
+test('taking back a transferred server fails without changes when the host cannot be reached', function () {
+    markServerTransferredAway($this->server);
+    Process::fake(['*' => Process::result(errorOutput: 'Connection refused', exitCode: 1)]);
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->assertDontSee('Disable management')
-        ->call('toggleManagement')
-        ->assertNotFound();
+        ->call('enableManagement')
+        ->assertNotDispatched('success');
 
-    expect($this->server->fresh()->isTransferredAway())->toBeFalse();
+    $this->server->refresh();
+
+    expect($this->server->isTransferredAway())->toBeTrue()
+        ->and((bool) $this->server->settings->force_disabled)->toBeTrue();
+});
+
+test('after a take back the server page shows the finish list until the user finishes the transfer', function () {
+    markServerTransferredAway($this->server);
+    Application::factory()->create([
+        'name' => 'shop',
+        'destination_id' => $this->server->standaloneDockers()->first()->id,
+        'destination_type' => StandaloneDocker::class,
+        'git_repository' => 'https://github.com/coollabsio/coolify',
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->call('enableManagement')
+        ->assertDispatched('transferFinishStarted');
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server->fresh()])
+        ->assertSee('Finish the transfer')
+        ->assertSee('Manual webhook of shop')
+        ->call('finishTransfer')
+        ->assertDontSee('Finish the transfer');
+    expect(data_get($this->server->fresh()->server_metadata, 'transfer.finish.finished_at'))->not->toBeNull();
 });
diff --git a/tests/Feature/ServerMetadataTest.php b/tests/Feature/ServerMetadataTest.php
index e4cbb5ed6e..5d521a71e6 100644
--- a/tests/Feature/ServerMetadataTest.php
+++ b/tests/Feature/ServerMetadataTest.php
@@ -128,6 +128,35 @@ it('stores a parsed docker version when gathering server metadata', function ()
         ->and($this->server->fresh()->composeVersion())->toBe('2.32.4');
 });
 
+it('keeps transfer and migration state when gathering server metadata', function () {
+    $this->server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+    // Loaded before the transfer state is written, like a validation that runs during a transfer.
+    $staleServer = Server::find($this->server->id);
+
+    $this->server->update(['server_metadata' => [
+        'os' => 'Old OS',
+        'transfer' => ['status' => 'claimed', 'export_id' => 'export-1'],
+        'migration' => ['status' => 'succeeded', 'export_id' => 'export-1'],
+    ]]);
+
+    Process::fake([
+        '*' => Process::result(output: "---PRETTY_NAME---\nDebian GNU/Linux 12 (bookworm)\n---CPUS---\n2", exitCode: 0),
+    ]);
+
+    $staleServer->gatherServerMetadata();
+
+    expect($this->server->fresh()->server_metadata)
+        ->toMatchArray([
+            'os' => 'Debian GNU/Linux 12 (bookworm)',
+            'cpus' => 2,
+            'transfer' => ['status' => 'claimed', 'export_id' => 'export-1'],
+            'migration' => ['status' => 'succeeded', 'export_id' => 'export-1'],
+        ]);
+});
+
 it('shows the stored docker version in remote server details', function () {
     $this->server->update([
         'server_metadata' => [
@@ -191,3 +220,57 @@ it('does not call gatherServerMetadata when docker version validation fails', fu
         ->instance()
         ->validateDockerVersion();
 });
+
+it('stores detected NVIDIA GPUs and the container toolkit when gathering server metadata', function (array $gpuLines, array $toolkitLines, array $expectedGpus, bool $expectedToolkit) {
+    $this->server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    Process::fake([
+        '*' => Process::result(output: implode("\n", [
+            '---PRETTY_NAME---',
+            'Ubuntu 24.04 LTS',
+            '---CPUS---',
+            '8',
+            '---DOCKER---',
+            '29.4.3-ce',
+            '---COMPOSE---',
+            'v2.32.4',
+            '---GPUS---',
+            ...$gpuLines,
+            '---NVIDIA_TOOLKIT---',
+            ...$toolkitLines,
+        ]), exitCode: 0),
+    ]);
+
+    $this->server->gatherServerMetadata();
+    $server = $this->server->fresh();
+
+    expect($server->detectedGpus())->toBe($expectedGpus)
+        ->and($server->server_metadata['nvidia_container_toolkit'])->toBe($expectedToolkit)
+        ->and($server->server_metadata['cpus'])->toBe(8);
+})->with([
+    'two gpus' => [
+        ['0, GPU-1a2b, 81559, NVIDIA H100 80GB HBM3', '1, GPU-3c4d, 24564, NVIDIA GeForce RTX 4090, Founders'],
+        ['/usr/bin/nvidia-container-runtime-hook', '/usr/bin/nvidia-ctk'],
+        [
+            ['index' => '0', 'uuid' => 'GPU-1a2b', 'memory_mb' => 81559, 'name' => 'NVIDIA H100 80GB HBM3'],
+            ['index' => '1', 'uuid' => 'GPU-3c4d', 'memory_mb' => 24564, 'name' => 'NVIDIA GeForce RTX 4090, Founders'],
+        ],
+        true,
+    ],
+    'driver installed without a working gpu' => [
+        ['NVIDIA-SMI has failed because it could not communicate with the NVIDIA driver.'],
+        [],
+        [],
+        false,
+    ],
+    'no nvidia-smi' => [[], [], [], false],
+]);
+
+it('returns null detected GPUs when GPUs were never checked', function () {
+    $this->server->update(['server_metadata' => ['os' => 'Ubuntu 24.04 LTS']]);
+
+    expect($this->server->fresh()->detectedGpus())->toBeNull();
+});
diff --git a/tests/Feature/ServerNavbarStatusVisibilityTest.php b/tests/Feature/ServerNavbarStatusVisibilityTest.php
index b524064fea..fddef90107 100644
--- a/tests/Feature/ServerNavbarStatusVisibilityTest.php
+++ b/tests/Feature/ServerNavbarStatusVisibilityTest.php
@@ -1,17 +1,20 @@
 <?php
 
+use App\Enums\ProxyTypes;
 use App\Livewire\Server\Navbar;
 use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
+use App\Services\ProxyDashboardCacheService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::create(['id' => 0]);
+    InstanceSettings::forceCreate(['id' => 0]);
 });
 
 function makeNavbarServer(bool $isFunctional): array
@@ -98,3 +101,35 @@ it('refreshes sentinel status when sentinel restarts for the server', function (
         ->assertDontSee('Out of sync')
         ->assertDispatched('sentinel-status-changed');
 });
+
+it('does not render the floating action panel when the server has no proxy actions', function () {
+    [$server] = makeNavbarServer(isFunctional: false);
+
+    Livewire::test('server.navbar', ['server' => $server])
+        ->assertDontSeeHtml('x-teleport="#resource-action-hud-slot"');
+});
+
+it('renders the floating action panel with proxy actions for a functional server', function () {
+    [$server] = makeNavbarServer(isFunctional: true);
+    $server->forceFill(['proxy' => ['type' => ProxyTypes::TRAEFIK->value]])->save();
+    $server = $server->fresh();
+
+    expect($server->proxySet())->toBeTrue();
+
+    Livewire::test('server.navbar', ['server' => $server])
+        ->assertSeeHtml('x-teleport="#resource-action-hud-slot"')
+        ->assertSee('Refresh Proxy Status');
+});
+
+it('shows the Traefik dashboard link without proxy actions to members who cannot manage the proxy', function () {
+    [$server, $user, $team] = makeNavbarServer(isFunctional: true);
+    $user->teams()->updateExistingPivot($team->id, ['role' => 'member']);
+    $server->forceFill(['proxy' => ['type' => ProxyTypes::TRAEFIK->value, 'status' => 'running']])->save();
+    $server = $server->fresh();
+    Cache::put(ProxyDashboardCacheService::getCacheKey($server), true);
+
+    Livewire::test('server.navbar', ['server' => $server])
+        ->assertSeeHtml('x-teleport="#resource-action-hud-slot"')
+        ->assertSee('Traefik Dashboard')
+        ->assertDontSee('Refresh Proxy Status');
+});
diff --git a/tests/Feature/ServerTransferPreviewOwnershipTest.php b/tests/Feature/ServerTransferPreviewOwnershipTest.php
index a5560fd74e..b098f8050e 100644
--- a/tests/Feature/ServerTransferPreviewOwnershipTest.php
+++ b/tests/Feature/ServerTransferPreviewOwnershipTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\InstanceSettings;
@@ -15,12 +16,15 @@ use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferImporter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Validation\ValidationException;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
     config()->set('app.env', 'local');
     config()->set('app.maintenance.driver', 'file');
     Server::flushIdentityMap();
@@ -80,7 +84,7 @@ test('preview imports reject another team UUID and roll back all imported record
     $token->accessToken->forceFill(['team_id' => $team->id])->save();
     $counts = [Server::count(), Application::withTrashed()->count(), PrivateKey::count(), Project::count()];
 
-    $this->withToken($token->plainTextToken)->postJson('/api/v1/servers/import', ['bundle' => $bundle])
+    $this->withToken($token->plainTextToken)->postJson('/api/v1/servers/import', ['bundle' => $bundle, 'adopt_mode' => false])
         ->assertUnprocessable()
         ->assertJsonValidationErrors('previews');
 
@@ -103,7 +107,7 @@ test('preview imports reject another team domain without clearing it', function
     $serverCount = Server::count();
 
     try {
-        app(ServerTransferImporter::class)->import($bundle, $team->id, preserveUuids: $preserveUuids);
+        app(ServerTransferImporter::class)->import($bundle, $team->id, preserveUuids: $preserveUuids, adoptMode: false);
         $this->fail('A foreign preview domain must be rejected.');
     } catch (ValidationException $exception) {
         expect($exception->errors())->toHaveKey('previews');
@@ -130,7 +134,7 @@ test('preview imports preserve same-team UUID handoffs and preview volumes', fun
         'mount_path' => '/data',
     ]);
 
-    $result = app(ServerTransferImporter::class)->import($fixture['bundle'], $team->id);
+    $result = app(ServerTransferImporter::class)->import($fixture['bundle'], $team->id, adoptMode: false);
 
     $imported = Server::whereUuid($result['server_uuid'])->firstOrFail()->applications()->firstOrFail();
     expect($preview->fresh()->application_id)->toBe($imported->id)
@@ -146,7 +150,7 @@ test('preview imports can release a same-team domain collision', function () {
     $bundle = $fixture['bundle'];
     $bundle['projects'][0]['environments'][0]['applications'][0]['previews'][0]['uuid'] = new_public_id();
 
-    $result = app(ServerTransferImporter::class)->import($bundle, $team->id);
+    $result = app(ServerTransferImporter::class)->import($bundle, $team->id, adoptMode: false);
 
     $imported = Server::whereUuid($result['server_uuid'])->firstOrFail()->applications()->firstOrFail();
     expect($fixture['preview']->fresh()->fqdn)->toBeNull();
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index e1893de8bc..b660d4d174 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -160,7 +160,6 @@ it('groups configured domains and shows redirect settings in the table', functio
         ->toContain('<span>DNS status</span>')
         ->not->toContain('<span>Last checked</span>')
         ->not->toContain("service-domain-group-{$this->webApp->id}")
-        ->and(substr_count($html, '2 domains'))->toBe(1)
         ->and(substr_count($html, '<span>Domain</span>'))->toBe(1)
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
diff --git a/tests/Feature/ServiceHeadingStatusTest.php b/tests/Feature/ServiceHeadingStatusTest.php
index 9cd0488e2d..fb4678ad2f 100644
--- a/tests/Feature/ServiceHeadingStatusTest.php
+++ b/tests/Feature/ServiceHeadingStatusTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Livewire\Project\Service\Heading as ServiceHeading;
+use App\Livewire\Project\Service\ResourceCard;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
@@ -81,3 +82,17 @@ test('the heading shows the service status when no resource is selected', functi
         ->assertSeeInOrder(['Service status', 'Containers', 'Healthcheck'])
         ->assertSee('Degraded');
 });
+
+test('a compose resource row shows the new status when the service status changes', function () {
+    $component = Livewire::test(ResourceCard::class, [
+        'service' => $this->service->fresh(),
+        'resource' => $this->exitedApp->fresh(),
+        'parameters' => $this->parameters,
+    ])->assertSee('Exited');
+
+    $this->exitedApp->forceFill(['status' => 'running:healthy'])->save();
+
+    $component->dispatch("echo-private:team.{$this->team->id},ServiceStatusChanged")
+        ->assertSee('Running')
+        ->assertDontSee('Exited');
+});
diff --git a/tests/Feature/ServiceResourceRoutingTest.php b/tests/Feature/ServiceResourceRoutingTest.php
index 3c1aa95d59..9d910aebf0 100644
--- a/tests/Feature/ServiceResourceRoutingTest.php
+++ b/tests/Feature/ServiceResourceRoutingTest.php
@@ -195,8 +195,8 @@ test('legacy service database backup detail urls redirect to unified backup view
     ];
 
     $this->get($generalUrl)->assertRedirect(route('project.service.volume-backups.index', $parameters));
-    $this->get($generalUrl.'/s3')->assertRedirect(route('project.service.volume-backups.index', $parameters));
-    $this->get($generalUrl.'/retention')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/s3')->assertRedirect($generalUrl);
+    $this->get($generalUrl.'/retention')->assertRedirect($generalUrl);
     $this->get($generalUrl.'/danger')->assertRedirect(route('project.service.volume-backups.index', $parameters));
     $this->get($generalUrl.'/executions')->assertRedirect(route('project.service.volume-backups.index', $parameters));
 });
diff --git a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
index 105ab6db68..d6519cbb39 100644
--- a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
+++ b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
@@ -48,7 +48,7 @@ it('uses resource tile icons for databases', function () {
     $databases = collect((new Select)->loadServices()['databases'])->keyBy('id');
 
     foreach (['keydb', 'dragonfly', 'clickhouse'] as $database) {
-        expect($databases[$database]['logo'])->toBe(asset("svgs/resources/{$database}.svg"));
+        expect($databases[$database]['logo'])->toBe(resource_logo_url($database));
     }
 });
 
diff --git a/tests/Feature/SettingsBackupBeforeUpdateTest.php b/tests/Feature/SettingsBackupBeforeUpdateTest.php
new file mode 100644
index 0000000000..211e37ffd5
--- /dev/null
+++ b/tests/Feature/SettingsBackupBeforeUpdateTest.php
@@ -0,0 +1,47 @@
+<?php
+
+use App\Livewire\SettingsBackup;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    $rootTeam = Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => 0, 'ip' => '127.0.0.1']);
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $this->user = User::factory()->create();
+    $rootTeam->members()->attach($this->user->id, ['role' => 'admin']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => ['id' => 0]]);
+});
+
+test('instance admin can turn the backup before update off', function () {
+    Livewire::test(SettingsBackup::class)
+        ->assertSet('is_backup_before_update_enabled', true)
+        ->set('is_backup_before_update_enabled', false)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    expect(InstanceSettings::find(0)->is_backup_before_update_enabled)->toBeFalse();
+});
+
+test('team member cannot change the backup before update', function () {
+    $component = Livewire::test(SettingsBackup::class);
+    Team::find(0)->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->user->refresh();
+
+    $component->set('is_backup_before_update_enabled', false)
+        ->call('instantSave')
+        ->assertDispatched('error', 'This action is unauthorized.');
+
+    expect(InstanceSettings::find(0)->is_backup_before_update_enabled)->toBeTrue();
+});
diff --git a/tests/Feature/SettingsSearchItemsTest.php b/tests/Feature/SettingsSearchItemsTest.php
index d04cf26bfa..0dce34ae89 100644
--- a/tests/Feature/SettingsSearchItemsTest.php
+++ b/tests/Feature/SettingsSearchItemsTest.php
@@ -21,11 +21,12 @@ function serverSettingsSearchGroups(): array
         ],
         'General' => [
             ['label' => 'Proxy', 'route' => 'server.proxy'],
+            ['label' => 'Metrics', 'route' => 'server.metrics', 'disabled' => true],
         ],
     ];
 }
 
-it('lists pages, visible child pages and in-page sections with their breadcrumbs', function () {
+it('lists enabled pages, visible child pages and in-page sections with their breadcrumbs', function () {
     InstanceSettings::forceCreate(['id' => 0]);
 
     $items = settingsSearchItems(
diff --git a/tests/Feature/SharedVariableCanvasTest.php b/tests/Feature/SharedVariableCanvasTest.php
new file mode 100644
index 0000000000..92b3db0f6c
--- /dev/null
+++ b/tests/Feature/SharedVariableCanvasTest.php
@@ -0,0 +1,356 @@
+<?php
+
+use App\Livewire\SharedVariables\Canvas as SharedVariablesCanvas;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Arr;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'name' => 'web-server']);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop']);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id, 'name' => 'staging']);
+    $this->storefront = sharedVariableCanvasApp($this->environment, $this->server, 'storefront');
+    $this->token = SharedEnvironmentVariable::create([
+        'key' => 'API_TOKEN', 'value' => 'secret-value', 'type' => 'team', 'team_id' => $this->team->id,
+    ]);
+});
+
+function sharedVariableCanvasApp(Environment $environment, Server $server, string $name): Application
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+
+    return Application::factory()->create([
+        'name' => $name,
+        'build_pack' => 'dockerimage',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+function sharedVariableCanvasEnv(Application $application, string $key, string $value): EnvironmentVariable
+{
+    return EnvironmentVariable::create([
+        'key' => $key, 'value' => $value,
+        'resourceable_type' => $application->getMorphClass(), 'resourceable_id' => $application->id,
+    ]);
+}
+
+function sharedVariableCanvasEnvs(Application $application)
+{
+    return EnvironmentVariable::query()->where('resourceable_type', $application->getMorphClass())->where('resourceable_id', $application->id);
+}
+
+function sharedVariableCanvasAs(object $test, User $user, Team $team): object
+{
+    return $test->actingAs($user)->withSession(['currentTeam' => $team])
+        ->withHeader('X-Canvas-Team', (string) $team->id);
+}
+
+test('the team canvas shows the variables, the resources and which resources use them, without values', function () {
+    sharedVariableCanvasEnv($this->storefront, 'API_TOKEN', '{{team.API_TOKEN}}');
+    $worker = sharedVariableCanvasApp($this->environment, $this->server, 'worker');
+    sharedVariableCanvasEnv($worker, 'DATABASE_URL', 'postgres://{{ team.API_TOKEN }}@db');
+    sharedVariableCanvasEnv($worker, 'OLD', '{{team.REMOVED_KEY}}');
+    sharedVariableCanvasEnv($worker, 'PROJECT_ONLY', '{{project.API_TOKEN}}');
+
+    $response = sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/shared-variables/team/canvas')
+        ->assertOk()
+        ->assertJsonPath('layout', 'connect')
+        ->assertJsonPath('can_edit', true)
+        ->assertJsonPath('title_link', route('shared-variables.team.index'));
+
+    $variableId = 'variable:'.$this->token->id;
+    expect($response->getContent())->not->toContain('secret-value')
+        ->and(collect($response->json('nodes'))->mapWithKeys(fn ($node) => [$node['id'] => [$node['name'], $node['zone']]])->all())->toBe([
+            $variableId => ['API_TOKEN', 'sources'],
+            'missing:REMOVED_KEY' => ['REMOVED_KEY', 'sources'],
+            $this->storefront->uuid => ['storefront', 'resources'],
+            $worker->uuid => ['worker', 'resources'],
+        ])
+        ->and(collect($response->json('links'))->mapWithKeys(fn ($link) => [$link['id'] => Arr::only($link, ['label', 'removable', 'missing'])])->all())->toBe([
+            "{$variableId}|{$this->storefront->uuid}" => ['label' => null, 'removable' => true, 'missing' => false],
+            "{$variableId}|{$worker->uuid}" => ['label' => 'DATABASE_URL', 'removable' => false, 'missing' => false],
+            "missing:REMOVED_KEY|{$worker->uuid}" => ['label' => 'OLD', 'removable' => true, 'missing' => true],
+        ]);
+
+    // Resources carry their project and environment for the canvas filter.
+    $storefront = collect($response->json('nodes'))->firstWhere('id', $this->storefront->uuid);
+    expect($storefront['project'])->toBe(['uuid' => $this->project->uuid, 'name' => 'Shop'])
+        ->and($storefront['environment'])->toBe(['uuid' => $this->environment->uuid, 'name' => 'staging']);
+});
+
+test('an admin adds a shared variable to a resource from the canvas', function () {
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->postJson('/canvas/api/shared-variables/team/canvas/links', [
+            'source' => 'variable:'.$this->token->id,
+            'target' => $this->storefront->uuid,
+        ])
+        ->assertCreated()
+        ->assertJsonPath('id', 'variable:'.$this->token->id.'|'.$this->storefront->uuid)
+        ->assertJsonPath('keys', ['API_TOKEN']);
+
+    $variables = sharedVariableCanvasEnvs($this->storefront)->get();
+    expect($variables)->toHaveCount(2)
+        ->and($variables->pluck('value')->unique()->all())->toBe(['{{team.API_TOKEN}}'])
+        ->and($variables->pluck('is_preview')->sort()->values()->all())->toBe([false, true])
+        ->and($variables->firstWhere('is_preview', false)->real_value)->toBe('secret-value');
+
+    // Adding it again, or over a variable with the same name, is refused.
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->postJson('/canvas/api/shared-variables/team/canvas/links', ['source' => 'variable:'.$this->token->id, 'target' => $this->storefront->uuid])
+        ->assertStatus(422)
+        ->assertJsonPath('message', 'storefront already uses API_TOKEN.');
+    $other = sharedVariableCanvasApp($this->environment, $this->server, 'other');
+    sharedVariableCanvasEnv($other, 'API_TOKEN', 'local-value');
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->postJson('/canvas/api/shared-variables/team/canvas/links', ['source' => 'variable:'.$this->token->id, 'target' => $other->uuid])
+        ->assertStatus(422)
+        ->assertJsonPath('message', 'other already has a variable named API_TOKEN. Rename or remove it first.');
+});
+
+test('removing a link deletes the reference and its preview copy, but not a longer value', function () {
+    sharedVariableCanvasEnv($this->storefront, 'API_TOKEN', '{{team.API_TOKEN}}');
+    $linkId = 'variable:'.$this->token->id.'|'.$this->storefront->uuid;
+    expect(sharedVariableCanvasEnvs($this->storefront)->count())->toBe(2);
+
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->deleteJson('/canvas/api/shared-variables/team/canvas/links/'.rawurlencode($linkId))
+        ->assertOk();
+    expect(sharedVariableCanvasEnvs($this->storefront)->count())->toBe(0);
+
+    sharedVariableCanvasEnv($this->storefront, 'DATABASE_URL', 'postgres://{{team.API_TOKEN}}@db');
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->deleteJson('/canvas/api/shared-variables/team/canvas/links/'.rawurlencode($linkId))
+        ->assertStatus(422);
+    expect(sharedVariableCanvasEnvs($this->storefront)->where('is_preview', false)->pluck('key')->all())->toBe(['DATABASE_URL']);
+});
+
+test('a reference to a deleted shared variable can be removed', function () {
+    sharedVariableCanvasEnv($this->storefront, 'OLD', '{{team.REMOVED_KEY}}');
+
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->deleteJson('/canvas/api/shared-variables/team/canvas/links/'.rawurlencode('missing:REMOVED_KEY|'.$this->storefront->uuid))
+        ->assertOk();
+
+    expect(sharedVariableCanvasEnvs($this->storefront)->exists())->toBeFalse();
+});
+
+test('a member sees the canvas but cannot add or remove shared variables', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    sharedVariableCanvasEnv($this->storefront, 'API_TOKEN', '{{team.API_TOKEN}}');
+
+    sharedVariableCanvasAs($this, $member, $this->team)
+        ->getJson('/canvas/api/shared-variables/team/canvas')
+        ->assertOk()
+        ->assertJsonPath('can_edit', false);
+    sharedVariableCanvasAs($this, $member, $this->team)
+        ->postJson('/canvas/api/shared-variables/team/canvas/links', ['source' => 'variable:'.$this->token->id, 'target' => $this->storefront->uuid])
+        ->assertForbidden();
+    sharedVariableCanvasAs($this, $member, $this->team)
+        ->deleteJson('/canvas/api/shared-variables/team/canvas/links/'.rawurlencode('variable:'.$this->token->id.'|'.$this->storefront->uuid))
+        ->assertForbidden();
+
+    expect(sharedVariableCanvasEnvs($this->storefront)->count())->toBe(2);
+});
+
+test('a project canvas only links project variables to resources of that project', function () {
+    $projectVariable = SharedEnvironmentVariable::create([
+        'key' => 'SHOP_NAME', 'value' => 'shop', 'type' => 'project', 'team_id' => $this->team->id, 'project_id' => $this->project->id,
+    ]);
+    $otherProject = Project::factory()->create(['team_id' => $this->team->id]);
+    $outside = sharedVariableCanvasApp(Environment::factory()->create(['project_id' => $otherProject->id]), $this->server, 'outside');
+    $base = "/canvas/api/shared-variables/project/{$this->project->uuid}/canvas";
+
+    $response = sharedVariableCanvasAs($this, $this->admin, $this->team)->getJson($base)->assertOk();
+    expect(collect($response->json('nodes'))->pluck('name')->all())->toBe(['SHOP_NAME', 'storefront']);
+
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->postJson("{$base}/links", ['source' => 'variable:'.$projectVariable->id, 'target' => $outside->uuid])
+        ->assertStatus(422)
+        ->assertJsonValidationErrors('target');
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->postJson("{$base}/links", ['source' => 'variable:'.$this->token->id, 'target' => $this->storefront->uuid])
+        ->assertStatus(422)
+        ->assertJsonValidationErrors('source');
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->postJson("{$base}/links", ['source' => 'variable:'.$projectVariable->id, 'target' => $this->storefront->uuid])
+        ->assertCreated();
+
+    expect(sharedVariableCanvasEnvs($this->storefront)->where('is_preview', false)->first()->value)->toBe('{{project.SHOP_NAME}}');
+});
+
+test('a server canvas only shows resources on that server', function () {
+    $other = Server::factory()->create(['team_id' => $this->team->id]);
+    sharedVariableCanvasApp($this->environment, $other, 'elsewhere');
+
+    $response = sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/shared-variables/server/{$this->server->uuid}/canvas")
+        ->assertOk();
+
+    expect(collect($response->json('nodes'))->where('type', '!=', 'variable')->pluck('name')->all())->toBe(['storefront']);
+});
+
+test('the server canvas hides the built-in server variables and the references to them', function () {
+    $this->server->environment_variables()->create(['key' => 'REGION', 'value' => 'eu', 'team_id' => $this->team->id]);
+    sharedVariableCanvasEnv($this->storefront, 'HOST', '{{server.COOLIFY_SERVER_NAME}}');
+    sharedVariableCanvasEnv($this->storefront, 'REGION', '{{server.REGION}}');
+
+    $response = sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/shared-variables/server/{$this->server->uuid}/canvas")
+        ->assertOk();
+
+    // Coolify creates COOLIFY_SERVER_UUID / COOLIFY_SERVER_NAME on every server; they are not shown, not even as deleted.
+    expect(collect($response->json('nodes'))->where('type', 'variable')->pluck('name')->all())->toBe(['REGION'])
+        ->and(collect($response->json('links'))->pluck('key')->all())->toBe(['REGION']);
+});
+
+test('another team cannot open or change the canvas of a scope it does not own', function () {
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $otherTeam->members()->attach($this->admin->id, ['role' => 'owner']);
+
+    // The session is switched to the other team after the canvas was opened.
+    sharedVariableCanvasAs($this, $this->admin, $otherTeam)
+        ->getJson("/canvas/api/shared-variables/project/{$this->project->uuid}/canvas")
+        ->assertNotFound();
+    sharedVariableCanvasAs($this, $this->admin, $otherTeam)
+        ->postJson('/canvas/api/shared-variables/team/canvas/links', ['source' => 'variable:'.$this->token->id, 'target' => $this->storefront->uuid])
+        ->assertStatus(422);
+    sharedVariableCanvasAs($this, $this->admin, $otherTeam)
+        ->get(route('shared-variables.project.canvas', ['project_uuid' => $this->project->uuid]))
+        ->assertNotFound();
+
+    expect(sharedVariableCanvasEnvs($this->storefront)->exists())->toBeFalse();
+});
+
+test('the canvas page opens for every scope', function () {
+    $routes = [
+        route('shared-variables.team.canvas'),
+        route('shared-variables.project.canvas', ['project_uuid' => $this->project->uuid]),
+        route('shared-variables.environment.canvas', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]),
+        route('shared-variables.server.canvas', ['server_uuid' => $this->server->uuid]),
+    ];
+    $endpoints = [
+        '/shared-variables/team/canvas',
+        "/shared-variables/project/{$this->project->uuid}/canvas",
+        "/shared-variables/environment/{$this->environment->uuid}/canvas",
+        "/shared-variables/server/{$this->server->uuid}/canvas",
+    ];
+
+    foreach ($routes as $i => $url) {
+        sharedVariableCanvasAs($this, $this->admin, $this->team)->get($url)
+            ->assertOk()
+            ->assertSee('data-endpoint="'.$endpoints[$i].'"', false);
+    }
+});
+
+test('every shared variable row links to the connect envs canvas with the variable selected', function () {
+    $projectVariable = SharedEnvironmentVariable::create([
+        'key' => 'SHOP_NAME', 'value' => 'shop', 'type' => 'project', 'team_id' => $this->team->id, 'project_id' => $this->project->id,
+    ]);
+
+    sharedVariableCanvasAs($this, $this->admin, $this->team)->get(route('shared-variables.team.index'))
+        ->assertOk()
+        ->assertSee(route('shared-variables.team.canvas').'?select=variable%3A'.$this->token->id, false);
+    sharedVariableCanvasAs($this, $this->admin, $this->team)->get(route('shared-variables.project.show', ['project_uuid' => $this->project->uuid]))
+        ->assertOk()
+        ->assertSee(route('shared-variables.project.canvas', ['project_uuid' => $this->project->uuid]).'?select=variable%3A'.$projectVariable->id, false);
+});
+
+test('each shared variables page reopens its canvas when the user left it on the canvas view', function (string $scope) {
+    $parameters = match ($scope) {
+        'team' => [],
+        'project' => ['project_uuid' => $this->project->uuid],
+        'environment' => ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid],
+        'server' => ['server_uuid' => $this->server->uuid],
+    };
+    $listRoute = $scope === 'team' ? 'shared-variables.team.index' : "shared-variables.{$scope}.show";
+    $cookie = "coolify_{$this->admin->id}_{$scope}_variables_view";
+
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->get(route("shared-variables.{$scope}.canvas", $parameters))
+        ->assertOk()
+        ->assertCookie($cookie, 'canvas');
+
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->withCookie($cookie, 'canvas')
+        ->get(route($listRoute, $parameters))
+        ->assertRedirect(route("shared-variables.{$scope}.canvas", $parameters));
+
+    sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->withCookie($cookie, 'canvas')
+        ->get(route($listRoute, [...$parameters, 'view' => 'list']))
+        ->assertOk()
+        ->assertCookie($cookie, 'list');
+})->with(['team', 'project', 'environment', 'server']);
+
+test('an admin adds a shared variable from the canvas modal and the canvas reloads', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(SharedVariablesCanvas::class, ['project_uuid' => $this->project->uuid])
+        ->dispatch('saveKey', ['key' => 'SHOP_URL', 'value' => 'https://shop.test', 'is_multiline' => false, 'is_literal' => false])
+        ->assertRedirect(route('shared-variables.project.canvas', ['project_uuid' => $this->project->uuid]));
+
+    $variable = SharedEnvironmentVariable::query()->where('key', 'SHOP_URL')->firstOrFail();
+    expect($variable->type)->toBe('project')
+        ->and($variable->project_id)->toBe($this->project->id)
+        ->and($variable->team_id)->toBe($this->team->id);
+});
+
+test('a member cannot add a shared variable from the canvas, also after switching to an owned team', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $ownTeam = Team::factory()->create();
+    $member->teams()->attach($ownTeam, ['role' => 'owner']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(SharedVariablesCanvas::class);
+    $member->load('teams');
+    session(['currentTeam' => $ownTeam]);
+
+    $component
+        ->dispatch('saveKey', ['key' => 'SHOP_URL', 'value' => 'x', 'is_multiline' => false, 'is_literal' => false])
+        ->assertDispatched('error');
+
+    expect(SharedEnvironmentVariable::query()->where('key', 'SHOP_URL')->exists())->toBeFalse();
+});
+
+test('the server canvas rejects the predefined server variables', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(SharedVariablesCanvas::class, ['server_uuid' => $this->server->uuid])
+        ->dispatch('saveKey', ['key' => 'COOLIFY_SERVER_NAME', 'value' => 'x', 'is_multiline' => false, 'is_literal' => false])
+        ->assertDispatched('error');
+
+    expect($this->server->environment_variables()->where('key', 'COOLIFY_SERVER_NAME')->where('value', 'x')->exists())->toBeFalse();
+});
diff --git a/tests/Feature/SharedVariablesOverviewTest.php b/tests/Feature/SharedVariablesOverviewTest.php
new file mode 100644
index 0000000000..d9d6df9019
--- /dev/null
+++ b/tests/Feature/SharedVariablesOverviewTest.php
@@ -0,0 +1,90 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\SharedVariableCanvas;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop']);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+function overviewShared(array $attributes): SharedEnvironmentVariable
+{
+    return SharedEnvironmentVariable::create(['value' => 'secret-value', ...$attributes]);
+}
+
+function overviewEnv(Application $application, string $key, string $value): void
+{
+    EnvironmentVariable::create([
+        'key' => $key, 'value' => $value,
+        'resourceable_type' => $application->getMorphClass(), 'resourceable_id' => $application->id,
+    ]);
+}
+
+test('the overview counts variables per scope and the resources that use each one', function () {
+    overviewShared(['key' => 'API_TOKEN', 'type' => 'team', 'team_id' => $this->team->id]);
+    overviewShared(['key' => 'DB_URL', 'type' => 'project', 'team_id' => $this->team->id, 'project_id' => $this->project->id]);
+    overviewShared(['key' => 'REGION', 'type' => 'server', 'team_id' => $this->team->id, 'server_id' => $this->server->id]);
+    overviewEnv($this->application, 'TOKEN', '{{team.API_TOKEN}}');
+    overviewEnv($this->application, 'DATABASE', 'postgres://{{ project.DB_URL }}');
+    overviewEnv($this->application, 'OLD', '{{team.REMOVED}}');
+
+    $overview = app(SharedVariableCanvas::class)->overview($this->team);
+
+    expect($overview['scopes']['team'])->toBe(['variables' => 1, 'owners' => 1])
+        ->and($overview['scopes']['project'])->toBe(['variables' => 1, 'owners' => 1])
+        ->and($overview['scopes']['environment'])->toBe(['variables' => 0, 'owners' => 0])
+        ->and($overview['used']->pluck('resources', 'key')->all())->toBe(['API_TOKEN' => 1, 'DB_URL' => 1])
+        ->and($overview['unused']->pluck('key')->all())->toBe(['REGION'])
+        ->and($overview['missing'])->toBe(1);
+});
+
+test('a reference resolves against the resource own project, not another project with the same key', function () {
+    $otherProject = Project::factory()->create(['team_id' => $this->team->id]);
+    overviewShared(['key' => 'DB_URL', 'type' => 'project', 'team_id' => $this->team->id, 'project_id' => $otherProject->id]);
+    overviewEnv($this->application, 'DATABASE', '{{project.DB_URL}}');
+
+    $overview = app(SharedVariableCanvas::class)->overview($this->team);
+
+    expect($overview['used'])->toBeEmpty()
+        ->and($overview['missing'])->toBe(1);
+});
+
+test('the overview page shows only the current team and never the values', function () {
+    overviewShared(['key' => 'API_TOKEN', 'type' => 'team', 'team_id' => $this->team->id]);
+    $otherTeam = Team::factory()->create();
+    overviewShared(['key' => 'OTHER_TEAM_KEY', 'type' => 'team', 'team_id' => $otherTeam->id]);
+
+    $this->actingAs($this->user)->withSession(['currentTeam' => $this->team])
+        ->get(route('shared-variables.index'))
+        ->assertSuccessful()
+        ->assertSee('API_TOKEN')
+        ->assertDontSee('OTHER_TEAM_KEY')
+        ->assertDontSee('secret-value');
+});
diff --git a/tests/Feature/StableNestedLivewireKeysTest.php b/tests/Feature/StableNestedLivewireKeysTest.php
index 96ad9a8959..4c3a63a0d4 100644
--- a/tests/Feature/StableNestedLivewireKeysTest.php
+++ b/tests/Feature/StableNestedLivewireKeysTest.php
@@ -30,7 +30,7 @@ it('keys nested Livewire status components rendered inside navigation loops', fu
     $sidebar = file_get_contents(resource_path('views/components/application/configuration-sidebar.blade.php'));
 
     expect($sidebar)
-        ->toContain(':key="\'application-server-status-\'.$application->uuid"');
+        ->toContain(':key="$placement.\'-application-server-status-\'.$application->uuid"');
 });
 
 it('keys virtual log rows by stable line identity instead of list position', function () {
diff --git a/tests/Feature/StandaloneSqliteTest.php b/tests/Feature/StandaloneSqliteTest.php
index b63b9917e5..845d88e5da 100644
--- a/tests/Feature/StandaloneSqliteTest.php
+++ b/tests/Feature/StandaloneSqliteTest.php
@@ -77,6 +77,32 @@ it('generates a compose file that passes the database files to the image', funct
         ->and($service['volumes'])->toBe(['sqlite-data-'.$this->database->uuid.':/var/lib/sqlite']);
 });
 
+it('uses the server log drain driver when log draining is enabled', function () {
+    $commands = [];
+    $executor = Mockery::mock(DatabaseStartCommandExecutor::class);
+    $executor->shouldReceive('execute')->once()->withArgs(function (array $captured) use (&$commands) {
+        $commands = $captured;
+
+        return true;
+    })->andReturn(new Activity);
+    app()->instance(DatabaseStartCommandExecutor::class, $executor);
+    $this->server->settings->update([
+        'is_logdrain_cloudwatch_enabled' => true,
+        'logdrain_cloudwatch_region' => 'us-east-1',
+        'logdrain_cloudwatch_group' => 'coolify',
+    ]);
+    $this->database->update(['is_log_drain_enabled' => true]);
+    Server::flushIdentityMap();
+
+    (new StartSqlite)->handle($this->database->fresh(), new Activity);
+
+    preg_match("/^echo '([^']+)' \| base64 -d/", collect($commands)->first(fn (string $command) => str_contains($command, 'docker-compose.yml')), $matches);
+    $service = Yaml::parse(base64_decode($matches[1]))['services'][$this->database->uuid];
+
+    expect($service['logging']['driver'])->toBe('awslogs')
+        ->and($service['logging']['options']['awslogs-group'])->toBe('coolify');
+});
+
 it('restores a gzipped backup with .restore into the first database file', function () {
     $command = app(DatabaseImportCommandBuilder::class)->buildRestoreCommand($this->database, '/tmp/restore_1', false);
 
diff --git a/tests/Feature/SyncCdnTest.php b/tests/Feature/SyncCdnTest.php
index 00bed238c7..52e0ea8945 100644
--- a/tests/Feature/SyncCdnTest.php
+++ b/tests/Feature/SyncCdnTest.php
@@ -97,6 +97,7 @@ SH);
         'install.sh',
         'upgrade.sh',
         'upgrade-postgres.sh',
+        ...($environment === 'production' ? ['patch.sh'] : []),
         'service-templates-latest.json',
     ];
     $allTargets = array_map(fn (string $file) => "$targetDirectory/$file", $allBasenames);
@@ -179,6 +180,7 @@ it('purges the CDN files from the Cloudflare cache', function (string $environme
             'install.sh',
             'upgrade.sh',
             'upgrade-postgres.sh',
+            ...($environment === 'production' ? ['patch.sh'] : []),
             'service-templates-latest.json',
         ]))->all());
 })->with([
diff --git a/tests/Feature/TagApiTest.php b/tests/Feature/TagApiTest.php
index ad46995a3f..ac8154163e 100644
--- a/tests/Feature/TagApiTest.php
+++ b/tests/Feature/TagApiTest.php
@@ -350,14 +350,15 @@ describe('DELETE /api/v1/applications/{uuid}/tags/{tag_uuid}', function () {
         expect($this->application->tags()->count())->toBe(0);
     });
 
-    test('garbage-collects orphaned tag', function () {
+    test('keeps the tag after its last resource is removed', function () {
         $tag = Tag::create(['name' => 'production', 'team_id' => $this->team->id]);
         $this->application->tags()->attach($tag->id);
 
         $this->withHeaders(tagApiAuthHeaders($this->bearerToken))
             ->deleteJson("/api/v1/applications/{$this->application->uuid}/tags/{$tag->uuid}");
 
-        expect(Tag::find($tag->id))->toBeNull();
+        // Tags can exist without resources; delete them with DELETE /api/v1/tags/{uuid}.
+        expect(Tag::find($tag->id))->not->toBeNull();
     });
 
     test('returns 404 when deleting a tag that is not attached to the application', function () {
diff --git a/tests/Feature/TagCanvasTest.php b/tests/Feature/TagCanvasTest.php
new file mode 100644
index 0000000000..e54af1fcea
--- /dev/null
+++ b/tests/Feature/TagCanvasTest.php
@@ -0,0 +1,226 @@
+<?php
+
+use App\Livewire\Project\Shared\Tags as ResourceTags;
+use App\Livewire\Tags\Canvas as TagsCanvas;
+use App\Livewire\Tags\Show;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Tag;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop']);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id, 'name' => 'staging']);
+    $this->storefront = Application::factory()->create([
+        'name' => 'storefront', 'build_pack' => 'dockerimage', 'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id, 'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $this->tag = Tag::create(['name' => 'production', 'team_id' => $this->team->id]);
+});
+
+function tagCanvasAs(object $test, User $user, Team $team): object
+{
+    return $test->actingAs($user)->withSession(['currentTeam' => $team])
+        ->withHeader('X-Canvas-Team', (string) $team->id);
+}
+
+test('the tags canvas shows every tag, also without resources, and which resources have them', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'orders-db', 'postgres_user' => 'postgres', 'postgres_password' => 'password', 'postgres_db' => 'db',
+        'image' => 'postgres:17', 'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id, 'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $this->storefront->tags()->attach($this->tag->id);
+    $database->tags()->attach($this->tag->id);
+    $empty = Tag::create(['name' => 'unused', 'team_id' => $this->team->id]);
+
+    $response = tagCanvasAs($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/tags/canvas')
+        ->assertOk()
+        ->assertJsonPath('layout', 'connect')
+        ->assertJsonPath('can_edit', true);
+
+    expect(collect($response->json('nodes'))->mapWithKeys(fn ($node) => [$node['id'] => $node['type']])->all())->toBe([
+        'tag:'.$this->tag->uuid => 'tag',
+        'tag:'.$empty->uuid => 'tag',
+        $database->uuid => 'database',
+        $this->storefront->uuid => 'application',
+    ])->and(collect($response->json('links'))->pluck('id')->sort()->values()->all())->toBe(collect([
+        'tag:'.$this->tag->uuid.'|'.$database->uuid,
+        'tag:'.$this->tag->uuid.'|'.$this->storefront->uuid,
+    ])->sort()->values()->all());
+});
+
+test('an admin tags and untags a resource from the canvas, and the tag stays', function () {
+    $source = 'tag:'.$this->tag->uuid;
+
+    tagCanvasAs($this, $this->admin, $this->team)
+        ->postJson('/canvas/api/tags/canvas/links', ['source' => $source, 'target' => $this->storefront->uuid])
+        ->assertCreated()
+        ->assertJsonPath('id', $source.'|'.$this->storefront->uuid);
+    expect($this->storefront->tags()->pluck('name')->all())->toBe(['production']);
+
+    tagCanvasAs($this, $this->admin, $this->team)
+        ->postJson('/canvas/api/tags/canvas/links', ['source' => $source, 'target' => $this->storefront->uuid])
+        ->assertStatus(422)
+        ->assertJsonPath('message', 'storefront already has the production tag.');
+
+    tagCanvasAs($this, $this->admin, $this->team)
+        ->deleteJson('/canvas/api/tags/canvas/links/'.rawurlencode($source.'|'.$this->storefront->uuid))
+        ->assertOk();
+    expect($this->storefront->tags()->count())->toBe(0)
+        ->and(Tag::find($this->tag->id))->not->toBeNull();
+});
+
+test('a member sees the tags canvas but cannot tag resources', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    tagCanvasAs($this, $member, $this->team)->getJson('/canvas/api/tags/canvas')
+        ->assertOk()
+        ->assertJsonPath('can_edit', false);
+    tagCanvasAs($this, $member, $this->team)
+        ->postJson('/canvas/api/tags/canvas/links', ['source' => 'tag:'.$this->tag->uuid, 'target' => $this->storefront->uuid])
+        ->assertForbidden();
+
+    expect($this->storefront->tags()->count())->toBe(0);
+});
+
+test('tags and resources of another team cannot be connected', function () {
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $otherTeam->members()->attach($this->admin->id, ['role' => 'owner']);
+    $otherTag = Tag::create(['name' => 'foreign', 'team_id' => $otherTeam->id]);
+
+    // The session is switched to the other team after the canvas was opened.
+    tagCanvasAs($this, $this->admin, $otherTeam)
+        ->postJson('/canvas/api/tags/canvas/links', ['source' => 'tag:'.$otherTag->uuid, 'target' => $this->storefront->uuid])
+        ->assertStatus(422)
+        ->assertJsonValidationErrors('target');
+    tagCanvasAs($this, $this->admin, $this->team)
+        ->postJson('/canvas/api/tags/canvas/links', ['source' => 'tag:'.$otherTag->uuid, 'target' => $this->storefront->uuid])
+        ->assertStatus(422)
+        ->assertJsonValidationErrors('source');
+
+    expect($this->storefront->tags()->count())->toBe(0);
+});
+
+test('the tags page creates a tag without resources and deletes a tag', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Show::class)
+        ->set('newTagName', 'Staging')
+        ->call('createTag')
+        ->assertHasNoErrors()
+        ->assertRedirect(route('tags.show', ['tagName' => 'staging']));
+    expect(Tag::query()->where('team_id', $this->team->id)->where('name', 'staging')->exists())->toBeTrue();
+
+    Livewire::test(Show::class)->set('newTagName', 'production')->call('createTag')->assertHasErrors('newTagName');
+    Livewire::test(Show::class)->set('newTagName', 'two words')->call('createTag')->assertHasErrors('newTagName');
+
+    $this->storefront->tags()->attach($this->tag->id);
+    Livewire::test(Show::class, ['tagName' => 'production'])
+        ->call('deleteTag')
+        ->assertRedirect(route('tags.show'));
+    expect(Tag::find($this->tag->id))->toBeNull()
+        ->and($this->storefront->tags()->count())->toBe(0);
+});
+
+test('the tags canvas creates a tag, and a member cannot', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TagsCanvas::class)
+        ->assertSee('New tag')
+        ->set('newTagName', 'Staging')
+        ->call('createTag')
+        ->assertHasNoErrors()
+        ->assertRedirect(route('tags.show', ['tagName' => 'staging']));
+
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(TagsCanvas::class)
+        ->assertDontSee('New tag')
+        ->set('newTagName', 'qa')
+        ->call('createTag');
+
+    expect(Tag::query()->where('team_id', $this->team->id)->orderBy('name')->pluck('name')->all())->toBe(['production', 'staging']);
+});
+
+test('a member cannot create or delete tags on the tags page', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Show::class)->set('newTagName', 'staging')->call('createTag');
+    Livewire::test(Show::class, ['tagName' => 'production'])->call('deleteTag');
+
+    expect(Tag::query()->where('team_id', $this->team->id)->pluck('name')->all())->toBe(['production']);
+});
+
+test('removing the last resource from a tag on the resource page keeps the tag', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $this->storefront->tags()->attach($this->tag->id);
+
+    Livewire::test(ResourceTags::class, ['resource' => $this->storefront])
+        ->call('deleteTag', (string) $this->tag->id);
+
+    expect($this->storefront->tags()->count())->toBe(0)
+        ->and(Tag::find($this->tag->id))->not->toBeNull();
+});
+
+test('the tags canvas page opens a tag from its connect link', function () {
+    tagCanvasAs($this, $this->admin, $this->team)->get(route('tags.canvas'))
+        ->assertOk()
+        ->assertSee('data-mode="tags"', false);
+    tagCanvasAs($this, $this->admin, $this->team)->get(route('tags.show', ['tagName' => 'production']))
+        ->assertOk()
+        ->assertSee(route('tags.canvas').'?select=tag%3A'.$this->tag->uuid, false);
+});
+
+test('the tags page reopens the canvas when the user left it on the canvas view', function () {
+    tagCanvasAs($this, $this->admin, $this->team)
+        ->get(route('tags.canvas'))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_tags_view", 'canvas');
+
+    tagCanvasAs($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_tags_view", 'canvas')
+        ->get(route('tags.show'))
+        ->assertRedirect(route('tags.canvas'));
+
+    tagCanvasAs($this, $this->admin, $this->team)
+        ->withCookie("coolify_{$this->admin->id}_tags_view", 'canvas')
+        ->get(route('tags.show', ['view' => 'grid']))
+        ->assertOk()
+        ->assertCookie("coolify_{$this->admin->id}_tags_view", 'grid');
+});
diff --git a/tests/Feature/TagsShowPageTest.php b/tests/Feature/TagsShowPageTest.php
index cb1fe725ee..e3ff87911b 100644
--- a/tests/Feature/TagsShowPageTest.php
+++ b/tests/Feature/TagsShowPageTest.php
@@ -33,7 +33,7 @@ it('shows an empty state when there are no tags', function () {
     Livewire::test(Show::class)
         ->assertSee('Tags')
         ->assertSee('No tags yet')
-        ->assertSee('Open a resource and add a tag to start grouping related deployments.');
+        ->assertSee('Create a tag, then connect it to resources to group related deployments.');
 });
 
 it('shows a card grid overview when tags exist and none is selected', function () {
@@ -98,3 +98,72 @@ it('redirects to the overview when the requested tag does not exist', function (
     Livewire::test(Show::class, ['tagName' => 'missing-tag'])
         ->assertRedirect(route('tags.show'));
 });
+
+it('lists the team resources in the connect modal and toggles the tag on a resource', function () {
+    $tag = Tag::create(['name' => 'hello', 'team_id' => $this->team->id]);
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'shop']);
+    $environment = Environment::factory()->create(['project_id' => $project->id, 'name' => 'prod']);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'name' => 'untagged-app',
+    ]);
+
+    $component = Livewire::test(Show::class, ['tagName' => 'hello'])
+        ->assertDontSee('shop / prod')
+        ->call('openConnectResources')
+        ->assertSee('shop / prod')
+        ->assertSee('untagged-app')
+        ->call('toggleResource', $application->uuid);
+
+    expect($application->tags()->whereKey($tag->id)->exists())->toBeTrue();
+    expect($component->get('applications')->pluck('uuid')->all())->toBe([$application->uuid]);
+
+    $component->call('toggleResource', $application->uuid);
+
+    expect($application->tags()->whereKey($tag->id)->exists())->toBeFalse();
+});
+
+it('does not tag a resource of another team from the connect modal', function () {
+    $tag = Tag::create(['name' => 'hello', 'team_id' => $this->team->id]);
+    $otherTeam = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $otherTeam->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $otherTeam->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    Livewire::test(Show::class, ['tagName' => 'hello'])
+        ->call('toggleResource', $application->uuid)
+        ->assertDispatched('error');
+
+    expect($application->tags()->exists())->toBeFalse();
+});
+
+it('does not let a member change tags from the connect modal', function () {
+    $tag = Tag::create(['name' => 'hello', 'team_id' => $this->team->id]);
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $member = User::factory()->create();
+    $member->teams()->attach($this->team, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(Show::class, ['tagName' => 'hello'])
+        ->call('toggleResource', $application->uuid);
+
+    expect($application->tags()->exists())->toBeFalse();
+});
diff --git a/tests/Feature/TeamAvatarTest.php b/tests/Feature/TeamAvatarTest.php
new file mode 100644
index 0000000000..f2c91172ae
--- /dev/null
+++ b/tests/Feature/TeamAvatarTest.php
@@ -0,0 +1,168 @@
+<?php
+
+use App\Livewire\SwitchTeam;
+use App\Livewire\Team\Index;
+use App\Models\InstanceSettings;
+use App\Models\S3Storage;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create([
+        'id' => 0,
+        'avatar_storage_type' => 'local',
+    ]));
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+function giveTeamStoredAvatar(Team $team): string
+{
+    $path = "team-avatars/{$team->id}/avatar.jpg";
+    $team->forceFill(['avatar_path' => $path, 'avatar_storage_type' => 'local'])->save();
+    Storage::disk('images')->put($path, 'avatar-content');
+
+    return $path;
+}
+
+it('stores a team avatar using the instance image storage setting', function () {
+    Storage::fake('images');
+    $upload = UploadedFile::fake()->createWithContent('team.jpg', file_get_contents(base_path('tests/Fixtures/project-icon.jpg')));
+
+    Livewire::test(Index::class)
+        ->set('avatar', $upload)
+        ->call('uploadAvatar')
+        ->assertHasNoErrors()
+        ->assertDispatched('team-avatar-updated');
+
+    $this->team->refresh();
+
+    expect($this->team->avatar_path)->toBe("team-avatars/{$this->team->id}/avatar.jpg")
+        ->and($this->team->avatar_storage_type)->toBe('local')
+        ->and($this->team->avatar_s3_storage_id)->toBeNull();
+    Storage::disk('images')->assertExists($this->team->avatar_path);
+});
+
+it('does not let a team member change the team avatar', function () {
+    Storage::fake('images');
+    $path = giveTeamStoredAvatar($this->team);
+    $member = User::factory()->create();
+    $member->teams()->attach($this->team, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Index::class)
+        ->set('avatar', UploadedFile::fake()->createWithContent('team.jpg', file_get_contents(base_path('tests/Fixtures/project-icon.jpg'))))
+        ->call('uploadAvatar')
+        ->call('removeAvatar');
+
+    expect($this->team->refresh()->avatar_path)->toBe($path);
+    Storage::disk('images')->assertExists($path);
+    expect(Storage::disk('images')->get($path))->toBe('avatar-content');
+});
+
+it('removes a team avatar', function () {
+    Storage::fake('images');
+    $path = giveTeamStoredAvatar($this->team);
+
+    Livewire::test(Index::class)
+        ->call('removeAvatar')
+        ->assertHasNoErrors();
+
+    expect($this->team->refresh()->avatar_path)->toBeNull();
+    Storage::disk('images')->assertMissing($path);
+});
+
+it('serves a team avatar only to members of the team', function () {
+    Storage::fake('images');
+    giveTeamStoredAvatar($this->team);
+
+    $this->get(route('team.avatar', ['team_id' => $this->team->id]))
+        ->assertSuccessful()
+        ->assertHeader('content-type', 'image/jpeg');
+
+    $otherUser = User::factory()->create();
+    $otherTeam = Team::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'owner']);
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    $this->get(route('team.avatar', ['team_id' => $this->team->id]))
+        ->assertNotFound();
+});
+
+it('serves the avatar of another team the user belongs to', function () {
+    Storage::fake('images');
+    $otherTeam = Team::factory()->create();
+    $this->user->teams()->attach($otherTeam, ['role' => 'member']);
+    giveTeamStoredAvatar($otherTeam);
+
+    $this->get(route('team.avatar', ['team_id' => $otherTeam->id]))
+        ->assertSuccessful();
+});
+
+it('deletes the avatar file when the team is deleted', function () {
+    Storage::fake('images');
+    $path = giveTeamStoredAvatar($this->team);
+
+    $this->team->delete();
+
+    Storage::disk('images')->assertMissing($path);
+});
+
+it('shows team avatars in the team switcher', function () {
+    $otherTeam = Team::factory()->create(['name' => 'Zeta']);
+    $this->user->teams()->attach($otherTeam, ['role' => 'member']);
+    $otherTeam->forceFill(['avatar_path' => "team-avatars/{$otherTeam->id}/avatar.jpg", 'avatar_storage_type' => 'local'])->save();
+    $this->user->load('teams');
+
+    Livewire::test(SwitchTeam::class)
+        ->assertSeeHtml('src="'.team_avatar_url($otherTeam).'"');
+});
+
+it('stores a team avatar on the instance S3 storage and serves it from the CDN', function () {
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://1.1.1.1',
+        'is_usable' => true,
+    ]);
+    InstanceSettings::findOrFail(0)->update([
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+        'image_cdn_url' => 'https://avatars.example.com/media',
+    ]);
+    $s3Disk = Storage::fake('team-avatar-s3');
+    Storage::extend('s3', fn () => $s3Disk);
+    Storage::fake('images');
+
+    $upload = UploadedFile::fake()->createWithContent('team.jpg', file_get_contents(base_path('tests/Fixtures/project-icon.jpg')));
+
+    Livewire::test(Index::class)
+        ->set('avatar', $upload)
+        ->call('uploadAvatar')
+        ->assertHasNoErrors()
+        ->assertNotDispatched('error');
+
+    $this->team->refresh();
+    expect($this->team->avatar_storage_type)->toBe('s3')
+        ->and($this->team->avatar_s3_storage_id)->toBe($storage->id)
+        ->and(team_avatar_url($this->team))->toBe("https://avatars.example.com/media/team-avatars/{$this->team->id}/avatar.jpg?v={$this->team->updated_at->timestamp}");
+    $s3Disk->assertExists($this->team->avatar_path);
+    Storage::disk('images')->assertMissing($this->team->avatar_path);
+});
diff --git a/tests/Feature/TeamBroadcastEventsTest.php b/tests/Feature/TeamBroadcastEventsTest.php
index c41abb7c99..f07a521501 100644
--- a/tests/Feature/TeamBroadcastEventsTest.php
+++ b/tests/Feature/TeamBroadcastEventsTest.php
@@ -11,7 +11,6 @@ use App\Events\ProxyStatusChangedUI;
 use App\Events\ScheduledTaskDone;
 use App\Events\SentinelRestarted;
 use App\Events\SentinelSynchronized;
-use App\Events\ServerPackageUpdated;
 use App\Events\ServerValidated;
 use App\Events\ServiceChecked;
 use App\Events\ServiceStatusChanged;
@@ -54,7 +53,6 @@ dataset('team broadcast events', [
     FileStorageChanged::class,
     ProxyStatusChangedUI::class,
     ScheduledTaskDone::class,
-    ServerPackageUpdated::class,
     ServerValidated::class,
     ServiceChecked::class,
     ServiceStatusChanged::class,
diff --git a/tests/Feature/TerminalCapabilitiesTest.php b/tests/Feature/TerminalCapabilitiesTest.php
new file mode 100644
index 0000000000..7bb648d9b1
--- /dev/null
+++ b/tests/Feature/TerminalCapabilitiesTest.php
@@ -0,0 +1,58 @@
+<?php
+
+use App\Livewire\Project\Shared\Terminal;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use phpseclib3\Crypt\RSA;
+
+uses(RefreshDatabase::class);
+
+it('probes container capabilities with exactly one elevation layer', function (string $user, string $sudo) {
+    config()->set('app.key', 'base64:'.base64_encode(random_bytes(32)));
+    config()->set('constants.ssh.mux_enabled', false);
+    Storage::fake('ssh-keys');
+    $team = Team::factory()->create();
+    $key = PrivateKey::create([
+        'name' => 'Terminal test key',
+        'private_key' => RSA::createKey(1024)->toString('OpenSSH'),
+        'team_id' => $team->id,
+    ]);
+    $server = Server::factory()->create([
+        'user' => $user,
+        'team_id' => $team->id,
+        'private_key_id' => $key->id,
+    ]);
+    Process::fake(fn () => Process::result(output: 'true'));
+
+    $terminal = new Terminal;
+    expect((new ReflectionMethod(Terminal::class, 'containerKeepsStdinOpen'))->invoke($terminal, $server, 'game-1'))->toBeTrue();
+    expect((new ReflectionMethod(Terminal::class, 'checkShellAvailability'))->invoke($terminal, $server, 'game-1'))->toBeTrue();
+
+    Process::assertRan(function ($process) use ($sudo) {
+        if (! str_contains($process->command, 'docker inspect')) {
+            return false;
+        }
+        expect($process->command)
+            ->toContain("\n{$sudo}docker inspect --format '{{.Config.OpenStdin}}' 'game-1' 2>/dev/null\n")
+            ->not->toContain('sudo sudo');
+
+        return str_contains($process->command, 'docker inspect');
+    });
+    Process::assertRan(function ($process) use ($sudo) {
+        if (! str_contains($process->command, 'docker exec')) {
+            return false;
+        }
+        expect($process->command)
+            ->toContain("{$sudo}docker exec 'game-1' bash -c 'exit 0' 2>/dev/null || {$sudo}docker exec 'game-1' sh -c 'exit 0' 2>/dev/null")
+            ->not->toContain('sudo sudo');
+
+        return true;
+    });
+})->with([
+    'root' => ['root', ''],
+    'non-root' => ['ubuntu', 'sudo '],
+]);
diff --git a/tests/Feature/TerminalConsoleModeTest.php b/tests/Feature/TerminalConsoleModeTest.php
new file mode 100644
index 0000000000..85ec73ea77
--- /dev/null
+++ b/tests/Feature/TerminalConsoleModeTest.php
@@ -0,0 +1,156 @@
+<?php
+
+use App\Livewire\Project\Shared\Terminal;
+use App\Models\Server;
+use App\Services\TerminalSessionService;
+use Mockery\LegacyMockInterface;
+
+function consoleModeServer(bool $nonRoot): Server
+{
+    /** @var Server&LegacyMockInterface $server */
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->shouldReceive('isNonRoot')->andReturn($nonRoot);
+
+    return $server;
+}
+
+it('builds an interactive attach command with safe detach keys for console mode', function () {
+    $command = app(TerminalSessionService::class)->containerCommand(consoleModeServer(false), 'minecraft-abc123', 'attach');
+
+    expect($command)
+        // Primes the console with recent logs, then attaches for live output.
+        ->toContain("docker logs --tail 200 'minecraft-abc123' 2>&1; ")
+        ->toContain('exec docker attach --detach-keys="ctrl-p,ctrl-q" --sig-proxy=false \'minecraft-abc123\'');
+});
+
+it('prefixes sudo for non-root servers in console mode', function () {
+    $command = app(TerminalSessionService::class)->containerCommand(consoleModeServer(true), 'minecraft-abc123', 'attach');
+
+    expect($command)
+        ->toStartWith('sudo docker logs --tail 200 ')
+        ->toContain('exec sudo docker attach --detach-keys="ctrl-p,ctrl-q" --sig-proxy=false ');
+});
+
+it('keeps the interactive shell command for shell mode', function () {
+    $command = app(TerminalSessionService::class)->containerCommand(consoleModeServer(false), 'web-1', 'shell');
+
+    expect($command)
+        ->toContain("docker exec -it 'web-1' sh -c")
+        ->not->toContain('docker attach');
+});
+
+it('defaults to console mode when the container keeps stdin open', function () {
+    $terminal = new Terminal;
+    $terminal->attachAvailable = true;
+
+    expect($terminal->resolveMode(null))->toBe('attach');
+});
+
+it('defaults to shell mode when the container has no open stdin', function () {
+    $terminal = new Terminal;
+    $terminal->attachAvailable = false;
+
+    expect($terminal->resolveMode(null))->toBe('shell');
+});
+
+it('never selects console mode when attach is unavailable even if requested', function () {
+    $terminal = new Terminal;
+    $terminal->attachAvailable = false;
+
+    expect($terminal->resolveMode('attach'))->toBe('shell');
+});
+
+it('renders a line-oriented command box for console mode instead of a raw terminal', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/terminal.blade.php'));
+
+    expect($view)
+        ->toContain('terminal-console-input')
+        ->toContain('submitConsoleCommand()')
+        ->toContain('x-ref="consoleInput"')
+        // The mobile control toolbar (which can send Ctrl-C) is hidden in console mode.
+        ->toContain("terminalActive && \$wire.terminalMode !== 'attach'")
+        // The earlier guardrail UI is gone in favour of the command box.
+        ->not->toContain('detachTerminal()')
+        ->not->toContain('Ctrl-C can stop the app');
+});
+
+it('keeps the console terminal read-only and sends whole command lines', function () {
+    $client = file_get_contents(resource_path('js/terminal.js'));
+
+    expect($client)
+        ->toContain('isConsoleMode()')
+        // Keystrokes are not forwarded while attached; commands carry a trailing newline.
+        ->toContain('message: `${command}\n`')
+        ->toContain('this.term.options.disableStdin = consoleMode');
+});
+
+it('places the shell/console selector beside the theme selector using shared styling', function () {
+    $selector = file_get_contents(resource_path('views/components/terminal/mode-selector.blade.php'));
+
+    expect($selector)
+        // Reuses the shared trigger + menu styling from the theme/renderer selectors.
+        ->toContain('terminal-theme-trigger')
+        ->toContain('console-theme-selector')
+        // Only shown when the container is interactive; drives the parent Alpine state.
+        ->toContain('x-show="attachAvailable"')
+        ->toContain('setTerminalMode(')
+        ->toContain("'key' => 'shell'")
+        ->toContain("'key' => 'attach'");
+
+    foreach (['project/shared/execute-container-command', 'terminal/index'] as $view) {
+        $blade = file_get_contents(resource_path("views/livewire/{$view}.blade.php"));
+
+        expect($blade)
+            // Grouped with the theme selector so extra header options do not break the layout.
+            ->toContain('<div class="ml-auto flex items-center gap-2">')
+            ->toContain('<x-terminal.mode-selector />')
+            ->toContain('terminal-mode-updated.window')
+            ->toContain("Livewire.dispatch('set-terminal-mode', { mode });");
+    }
+});
+
+it('lets the header selector switch modes through a livewire listener', function () {
+    $component = file_get_contents(app_path('Livewire/Project/Shared/Terminal.php'));
+
+    expect($component)->toContain("#[On('set-terminal-mode')]");
+});
+
+it('prefixes sudo for non-root servers when probing container capabilities', function () {
+    $component = file_get_contents(app_path('Livewire/Project/Shared/Terminal.php'));
+
+    expect($component)
+        // Both the shell probe and the OpenStdin inspection must reach the Docker socket.
+        ->toContain('{$sudo}docker exec {$escapedContainer} bash')
+        ->toContain("{\$sudo}docker inspect --format '{{.Config.OpenStdin}}'");
+});
+
+it('hides the shell option and shell-unavailable notice when no shell exists', function () {
+    $selector = file_get_contents(resource_path('views/components/terminal/mode-selector.blade.php'));
+    $terminal = file_get_contents(resource_path('views/livewire/project/shared/terminal.blade.php'));
+
+    expect($selector)
+        // Shell (docker exec) needs a shell in the image, so hide it when there is none.
+        ->toContain('x-show="hasShell"');
+
+    expect($terminal)
+        // Attach mode does not need a shell, so only warn while shell mode is active.
+        ->toContain("!\$hasShell && \$terminalMode === 'shell'");
+
+    foreach (['project/shared/execute-container-command', 'terminal/index'] as $view) {
+        $blade = file_get_contents(resource_path("views/livewire/{$view}.blade.php"));
+
+        expect($blade)
+            // The parent Alpine state tracks shell availability for the selector.
+            ->toContain('hasShell = $event.detail.hasShell')
+            ->toContain("mode === 'shell' && !this.hasShell");
+    }
+});
+
+it('keeps console history connection-local', function () {
+    $client = file_get_contents(resource_path('js/terminal.js'));
+
+    expect($client)
+        ->not->toContain('localStorage.setItem(key, JSON.stringify(this.consoleHistory))')
+        // The mode-updated event carries shell availability to the header selector.
+        ->toContain('hasShell: this.$wire?.hasShell ?? true');
+});
diff --git a/tests/Feature/TerminalSessionSecurityTest.php b/tests/Feature/TerminalSessionSecurityTest.php
index dca3d59cbd..55650df4ca 100644
--- a/tests/Feature/TerminalSessionSecurityTest.php
+++ b/tests/Feature/TerminalSessionSecurityTest.php
@@ -7,6 +7,7 @@ use App\Models\User;
 use App\Services\TerminalSessionService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 uses(RefreshDatabase::class);
@@ -102,6 +103,29 @@ it('constructs fixed ssh arguments from the authorized server record', function
     $this->postJson('/terminal/session', ['token' => $token])->assertForbidden();
 });
 
+it('carries the console mode in the token and attaches instead of exec on redeem', function () {
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
+    $service = app(TerminalSessionService::class);
+    Process::fake([
+        '*docker inspect*' => Process::result(output: json_encode(['State' => ['Status' => 'running']])),
+        '*' => Process::result(),
+    ]);
+
+    $attachCommand = $service->redeem($this->user, $service->issue($this->user, $server, 'minecraft-abc123', 'attach'));
+    $shellCommand = $service->redeem($this->user, $service->issue($this->user, $server, 'minecraft-abc123'));
+
+    expect($attachCommand)
+        ->toContain('docker attach --detach-keys="ctrl-p,ctrl-q" --sig-proxy=false')
+        ->not->toContain('docker exec')
+        ->and($shellCommand)
+        ->toContain('docker exec -it')
+        ->not->toContain('docker attach');
+});
+
 it('rejects option-like and traversal container identifiers before command construction', function (string $container) {
     $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
     $server = Server::factory()->create([
diff --git a/tests/Feature/TrafficAnalytics/GeoVisualizationTest.php b/tests/Feature/TrafficAnalytics/GeoVisualizationTest.php
index 13e230d6a1..3c3fc9a06b 100644
--- a/tests/Feature/TrafficAnalytics/GeoVisualizationTest.php
+++ b/tests/Feature/TrafficAnalytics/GeoVisualizationTest.php
@@ -27,7 +27,7 @@ class FakeGeoTrafficClient extends SentinelTrafficClient
     }
 }
 
-function fakeGeoResponses(array $countryRows): array
+function fakeGeoResponses(array $countryRows, array $cityRows = []): array
 {
     return [
         '/traffic/apps' => json_encode([]),
@@ -41,6 +41,7 @@ function fakeGeoResponses(array $countryRows): array
         ]),
         '/traffic/paths' => json_encode([]),
         '/traffic/breakdown/country' => json_encode($countryRows),
+        '/traffic/breakdown/city' => json_encode($cityRows),
         '/traffic/attribution' => json_encode(['attribution' => 'GeoIP data by MaxMind']),
     ];
 }
@@ -111,7 +112,7 @@ it('shows a plain no-data state when no country data has been recorded', functio
 
     loadLazy(Livewire::test(Analytics::class))
         ->assertOk()
-        ->assertSee('Countries')
+        ->assertSee('Locations')
         ->assertSee('No country data for the selected range');
 });
 
@@ -135,3 +136,94 @@ it('mounts the globe from the element itself when country data arrives after the
         ->assertSeeHtml('id="global-analytics-globe" x-ref="canvas"')
         ->assertSeeHtml('window.mountTrafficGlobe(canvas');
 });
+
+it('renders the city list, the switch, and both marker sets when Sentinel returns city data', function () {
+    $server = bootGeoServer();
+
+    $fake = new FakeGeoTrafficClient($server);
+    $fake->responses = fakeGeoResponses(
+        [['value' => 'DE', 'requests' => 600, 'bytes_out' => 15000]],
+        [
+            ['value' => 'DE|BE|Berlin', 'requests' => 400, 'bytes_out' => 9000, 'lat' => 52.52, 'lon' => 13.405],
+            ['value' => 'DE||', 'requests' => 150, 'bytes_out' => 4000],
+            ['value' => '__other__', 'requests' => 50, 'bytes_out' => 2000],
+        ],
+    );
+    app()->bind(SentinelTrafficClient::class, fn () => $fake);
+
+    loadLazy(Livewire::test(Analytics::class))
+        ->assertOk()
+        ->assertSeeHtml('aria-label="Location detail"')
+        ->assertSee('Germany')
+        ->assertSee('Berlin')
+        ->assertSee('BE, Germany')
+        // Only the row with coordinates turns the globe on hover.
+        ->assertSeeHtml('focus([52.52, 13.405])');
+});
+
+it('sends the globe one marker set for each view, without markers for unknown cities', function () {
+    $server = bootGeoServer();
+
+    $fake = new FakeGeoTrafficClient($server);
+    $fake->responses = fakeGeoResponses(
+        [['value' => 'DE', 'requests' => 600, 'bytes_out' => 15000]],
+        [
+            ['value' => 'DE|BE|Berlin', 'requests' => 400, 'bytes_out' => 9000, 'lat' => 52.52, 'lon' => 13.405],
+            // An unknown city never gets a marker, also when Sentinel sends coordinates.
+            ['value' => 'DE||', 'requests' => 150, 'bytes_out' => 4000, 'lat' => 51.0, 'lon' => 9.0],
+        ],
+    );
+    app()->bind(SentinelTrafficClient::class, fn () => $fake);
+
+    loadLazy(Livewire::test(Analytics::class))
+        ->call('loadData')
+        ->assertDispatched('refreshChartData-global-analytics-status', function (string $event, array $params): bool {
+            return data_get($params, '0.geo') === [
+                'countries' => [['code' => 'DE', 'requests' => 600]],
+                'cities' => [['lat' => 52.52, 'lon' => 13.405, 'requests' => 400]],
+            ];
+        });
+});
+
+it('shows an empty city list and no city markers when Sentinel returns no city data', function (array $cityRows) {
+    $server = bootGeoServer();
+
+    $fake = new FakeGeoTrafficClient($server);
+    $fake->responses = fakeGeoResponses([
+        ['value' => 'DE', 'requests' => 600, 'bytes_out' => 15000],
+    ], $cityRows);
+    app()->bind(SentinelTrafficClient::class, fn () => $fake);
+
+    loadLazy(Livewire::test(Analytics::class))
+        ->assertOk()
+        ->assertSee('Germany')
+        ->assertSee('No city data for the selected range.')
+        ->assertDontSeeHtml('focus([')
+        ->call('loadData')
+        ->assertDispatched('refreshChartData-global-analytics-status', function (string $event, array $params): bool {
+            return data_get($params, '0.geo') === [
+                'countries' => [['code' => 'DE', 'requests' => 600]],
+                'cities' => [],
+            ];
+        });
+})->with([
+    'old sentinel' => [[]],
+    'country-only database' => [[['value' => 'DE||', 'requests' => 600, 'bytes_out' => 15000]]],
+]);
+
+it('escapes a city name that contains quotes or HTML', function () {
+    $server = bootGeoServer();
+
+    $fake = new FakeGeoTrafficClient($server);
+    $fake->responses = fakeGeoResponses(
+        [['value' => 'US', 'requests' => 600, 'bytes_out' => 15000]],
+        [['value' => "US|MO|O'Fallon <b>x</b>", 'requests' => 400, 'bytes_out' => 9000, 'lat' => 38.81, 'lon' => -90.7]],
+    );
+    app()->bind(SentinelTrafficClient::class, fn () => $fake);
+
+    loadLazy(Livewire::test(Analytics::class))
+        ->assertOk()
+        ->assertSee("O'Fallon <b>x</b>")
+        ->assertDontSeeHtml('<b>x</b></span>')
+        ->assertSeeHtml('focus([38.81, -90.7])');
+});
diff --git a/tests/Feature/TrafficAnalytics/GlobalAnalyticsTest.php b/tests/Feature/TrafficAnalytics/GlobalAnalyticsTest.php
index 58add72c10..870befc0f5 100644
--- a/tests/Feature/TrafficAnalytics/GlobalAnalyticsTest.php
+++ b/tests/Feature/TrafficAnalytics/GlobalAnalyticsTest.php
@@ -149,8 +149,6 @@ it('renders a team-wide analytics summary across enabled servers', function () {
         ->assertSee('Global Leaderboard App')
         ->assertSee('Top hosts')
         ->assertSee('Top paths')
-        ->assertSee('3 4xx')
-        ->assertSee('1 5xx')
         ->assertSee('Status codes')
         ->assertSee('Countries')
         ->assertSee('United States')
@@ -490,7 +488,9 @@ it('labels the IP breakdown by the client IP mode of the queried servers', funct
         $component->assertDontSee('Top IPs')
             ->assertDontSee('Top networks')
             ->assertDontSee('203.0.113.7');
-        expect($component->instance()->breakdowns)->not->toHaveKey('ip');
+        // Sentinel finds the city from the client IP, so it stores no cities either.
+        expect($component->instance()->breakdowns)->not->toHaveKey('ip')
+            ->and($component->instance()->breakdowns)->not->toHaveKey('city');
 
         return;
     }
diff --git a/tests/Feature/TrafficAnalytics/SentinelTrafficClientTest.php b/tests/Feature/TrafficAnalytics/SentinelTrafficClientTest.php
index b3946c00ba..81c1cb5c6c 100644
--- a/tests/Feature/TrafficAnalytics/SentinelTrafficClientTest.php
+++ b/tests/Feature/TrafficAnalytics/SentinelTrafficClientTest.php
@@ -95,10 +95,10 @@ it('accepts every known dimension and rejects unknown ones', function () {
     $client = new FakeTrafficClient($server);
     $client->response = json_encode([]);
 
-    foreach (['status', 'method', 'country', 'referer', 'browser', 'os', 'device', 'protocol', 'scheme', 'tls', 'cache', 'bot'] as $dimension) {
+    foreach (['status', 'method', 'country', 'city', 'referer', 'browser', 'os', 'device', 'protocol', 'scheme', 'tls', 'cache', 'bot'] as $dimension) {
         $client->breakdown(null, $dimension, 'a', 'b');
     }
-    expect($client->captured)->toHaveCount(12);
+    expect($client->captured)->toHaveCount(13);
 
     expect(fn () => $client->breakdown(null, 'not-a-real-dimension', 'a', 'b'))
         ->toThrow(InvalidArgumentException::class);
diff --git a/tests/Feature/TrafficAnalytics/TrafficAnalyticsAggregatorTest.php b/tests/Feature/TrafficAnalytics/TrafficAnalyticsAggregatorTest.php
index ef9f7325f6..fbcaaf2307 100644
--- a/tests/Feature/TrafficAnalytics/TrafficAnalyticsAggregatorTest.php
+++ b/tests/Feature/TrafficAnalytics/TrafficAnalyticsAggregatorTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Data\Traffic\TrafficBreakdownData;
 use App\Data\Traffic\TrafficOverviewData;
 use App\Services\TrafficAnalyticsAggregator;
 
@@ -24,3 +25,25 @@ it('returns a zeroed, non-approximate result for a single server', function () {
     expect($result['latencyApproximate'])->toBeFalse();
     expect($result['uniquesApproximate'])->toBeFalse();
 });
+
+it('sums one city from two servers and keeps the first coordinates', function () {
+    $aggregator = new TrafficAnalyticsAggregator(['city']);
+    $aggregator->addBreakdown('city', [new TrafficBreakdownData('DE|BE|Berlin', 5, 500)]);
+    $aggregator->addBreakdown('city', [new TrafficBreakdownData('DE|BE|Berlin', 4, 400, 52.52, 13.405)]);
+    $aggregator->addBreakdown('city', [new TrafficBreakdownData('DE|BE|Berlin', 1, 100, 1.0, 2.0)]);
+
+    expect($aggregator->breakdowns()['city'])->toBe([
+        ['value' => 'DE|BE|Berlin', 'requests' => 10, 'bytesOut' => 1000, 'lat' => 52.52, 'lon' => 13.405],
+    ]);
+});
+
+it('adds no coordinate keys to rows that have none', function () {
+    $aggregator = new TrafficAnalyticsAggregator(['country', 'city']);
+    $aggregator->addBreakdown('country', [new TrafficBreakdownData('DE', 5, 500)]);
+    $aggregator->addBreakdown('city', [new TrafficBreakdownData('DE||', 5, 500)]);
+
+    expect($aggregator->breakdowns())->toBe([
+        'country' => [['value' => 'DE', 'requests' => 5, 'bytesOut' => 500]],
+        'city' => [['value' => 'DE||', 'requests' => 5, 'bytesOut' => 500]],
+    ]);
+});
diff --git a/tests/Feature/TrafficAnalytics/TrafficDataTest.php b/tests/Feature/TrafficAnalytics/TrafficDataTest.php
index b75fd0b550..7169b5b42c 100644
--- a/tests/Feature/TrafficAnalytics/TrafficDataTest.php
+++ b/tests/Feature/TrafficAnalytics/TrafficDataTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Data\Traffic\TrafficBreakdownData;
 use App\Data\Traffic\TrafficOverviewData;
 use App\Data\Traffic\TrafficPathData;
 
@@ -36,3 +37,26 @@ it('maps per-path error counters from sentinel', function () {
     expect($dto->s4xx)->toBe(3)
         ->and($dto->s5xx)->toBe(2);
 });
+
+it('maps city coordinates from sentinel', function () {
+    $dto = TrafficBreakdownData::fromSentinel([
+        'value' => 'DE|BE|Berlin', 'requests' => 9, 'bytes_out' => 900, 'lat' => 52.52, 'lon' => 13.405,
+    ]);
+
+    expect($dto->value)->toBe('DE|BE|Berlin')
+        ->and($dto->lat)->toBe(52.52)
+        ->and($dto->lon)->toBe(13.405);
+});
+
+it('leaves coordinates null when sentinel sends none or sends only one', function (array $row) {
+    $dto = TrafficBreakdownData::fromSentinel(['value' => 'DE||', 'requests' => 2, 'bytes_out' => 20] + $row);
+
+    expect($dto->lat)->toBeNull()->and($dto->lon)->toBeNull();
+})->with([
+    'none' => [[]],
+    'only lat' => [['lat' => 52.52]],
+    'not numeric' => [['lat' => 'x', 'lon' => 'y']],
+    'not finite' => [['lat' => INF, 'lon' => 13.4]],
+    'latitude out of range' => [['lat' => 91, 'lon' => 13.4]],
+    'longitude out of range' => [['lat' => 52.5, 'lon' => -181]],
+]);
diff --git a/tests/Feature/VolumeBackupMultipleS3DestinationsTest.php b/tests/Feature/VolumeBackupMultipleS3DestinationsTest.php
new file mode 100644
index 0000000000..3eadab443a
--- /dev/null
+++ b/tests/Feature/VolumeBackupMultipleS3DestinationsTest.php
@@ -0,0 +1,386 @@
+<?php
+
+use App\Actions\Shared\DeleteScheduledVolumeBackup;
+use App\Jobs\VolumeBackupJob;
+use App\Jobs\VolumeBackupRecoveryJob;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Filesystem\FilesystemAdapter;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Notification::fake();
+    config(['broadcasting.default' => 'null']);
+    defined('CURLOPT_RESOLVE') || define('CURLOPT_RESOLVE', 10203);
+});
+
+/**
+ * @return array{0: ScheduledVolumeBackup, 1: S3Storage, 2: S3Storage, 3: Server}
+ */
+function createMultiDestinationVolumeBackup(array $backupAttributes = []): array
+{
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+    $team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $privateKey->id,
+        'ip' => '203.0.113.10',
+    ]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $storages = collect(['first', 'second'])->map(fn (string $name): S3Storage => S3Storage::create([
+        'name' => "{$name} storage",
+        'region' => 'us-east-1',
+        'key' => "{$name}-key",
+        'secret' => 'secret',
+        'bucket' => "{$name}-bucket",
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]));
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        ...$backupAttributes,
+    ]);
+    $backup->syncS3Storages($storages->pluck('id')->all());
+
+    return [$backup->fresh(), $storages[0], $storages[1], $server];
+}
+
+function fakeMultiDestinationS3Disks(): void
+{
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->zeroOrMoreTimes()->andReturn([]);
+    $disk->shouldReceive('delete')->zeroOrMoreTimes()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->zeroOrMoreTimes()->andReturn($disk);
+}
+
+it('archives locally and uploads to every destination instead of streaming', function () {
+    [$backup, $first, $second] = createMultiDestinationVolumeBackup(['disable_local_backup' => true]);
+    fakeMultiDestinationS3Disks();
+    Process::fake([
+        '*du -b*' => '128',
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup))->handle();
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'mc pipe'));
+    Process::assertRan(fn ($process) => str_contains($process->command, 'tar -I') && str_contains($process->command, ' > '));
+    Process::assertRan(fn ($process) => str_contains($process->command, 'mc cp') && str_contains($process->command, 'temporary/first-bucket/'));
+    Process::assertRan(fn ($process) => str_contains($process->command, 'mc cp') && str_contains($process->command, 'temporary/second-bucket/'));
+    Process::assertRan(fn ($process) => preg_match("/rm -f '[^']+\\.tar\\.gz'/", $process->command) === 1);
+    expect($execution->status)->toBe('success')
+        ->and($execution->s3_storage_id)->toBe($first->id)
+        ->and($execution->s3_uploaded)->toBeTrue()
+        ->and($execution->local_storage_deleted)->toBeTrue()
+        ->and($execution->s3Replicas()->orderBy('s3_storage_id')->get()->map->only(['s3_storage_id', 's3_uploaded'])->all())->toBe([
+            ['s3_storage_id' => $first->id, 's3_uploaded' => true],
+            ['s3_storage_id' => $second->id, 's3_uploaded' => true],
+        ]);
+});
+
+it('keeps the local archive and cleans the partial upload when one destination fails', function () {
+    [$backup, $first, $second] = createMultiDestinationVolumeBackup(['disable_local_backup' => true]);
+    fakeMultiDestinationS3Disks();
+    Process::fake([
+        '*du -b*' => '128',
+        '*temporary/second-bucket/*' => Process::result(errorOutput: 'access denied', exitCode: 1),
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup))->handle();
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    $firstReplica = $execution->s3Replicas()->where('s3_storage_id', $first->id)->sole();
+    $secondReplica = $execution->s3Replicas()->where('s3_storage_id', $second->id)->sole();
+    Process::assertNotRan(fn ($process) => preg_match("/rm -f '[^']+\\.tar\\.gz'/", $process->command) === 1);
+    expect($execution->status)->toBe('success')
+        ->and($execution->message)->toContain('S3 upload failed: second storage:')
+        ->and($execution->s3_uploaded)->toBeFalse()
+        ->and($execution->s3_cleanup_pending)->toBeFalse()
+        ->and($execution->local_storage_deleted)->toBeFalse()
+        ->and($firstReplica->s3_uploaded)->toBeTrue()
+        ->and($firstReplica->s3_storage_deleted)->toBeFalse()
+        ->and($secondReplica->s3_uploaded)->toBeFalse()
+        ->and($secondReplica->s3_storage_deleted)->toBeTrue()
+        ->and($secondReplica->message)->not->toBeEmpty();
+});
+
+it('applies S3 retention to each destination separately', function () {
+    [$backup, $first, $second, $server] = createMultiDestinationVolumeBackup([
+        'retention_amount_locally' => 0,
+        'retention_days_locally' => 0,
+        'retention_max_storage_locally' => 0,
+        'retention_amount_s3' => 1,
+        'retention_days_s3' => 0,
+        'retention_max_storage_s3' => 0,
+    ]);
+    $createExecution = function (string $name, int $daysAgo, array $uploadedTo) use ($backup, $first, $second): ScheduledVolumeBackupExecution {
+        $execution = ScheduledVolumeBackupExecution::create([
+            'scheduled_volume_backup_id' => $backup->id,
+            's3_storage_id' => $first->id,
+            'status' => 'success',
+            'filename' => "/data/coolify/backups/volumes/test/{$name}.tar.gz",
+            'local_storage_deleted' => true,
+            'created_at' => now()->subDays($daysAgo),
+        ]);
+        foreach ([$first, $second] as $storage) {
+            $execution->s3Replicas()->create([
+                's3_storage_id' => $storage->id,
+                's3_uploaded' => in_array($storage->id, $uploadedTo, true),
+            ]);
+        }
+        $execution->refreshS3Summary();
+
+        return $execution;
+    };
+    $oldest = $createExecution('oldest', 3, [$first->id]);
+    $older = $createExecution('older', 2, [$first->id, $second->id]);
+    $latest = $createExecution('latest', 1, [$first->id]);
+    $disk = Mockery::mock();
+    $disk->shouldReceive('delete')
+        ->once()
+        ->with(['/data/coolify/backups/volumes/test/older.tar.gz', '/data/coolify/backups/volumes/test/oldest.tar.gz'])
+        ->andReturnTrue();
+    Storage::shouldReceive('build')
+        ->once()
+        ->with(Mockery::on(fn (array $config): bool => $config['key'] === 'first-key'))
+        ->andReturn($disk);
+    $job = new VolumeBackupJob($backup);
+
+    (new ReflectionClass($job))->getMethod('removeExpiredBackups')->invoke($job, $server);
+
+    expect($oldest->fresh())->toBeNull()
+        ->and($older->fresh())->not->toBeNull()
+        ->and($older->s3Replicas()->where('s3_storage_id', $first->id)->sole()->s3_storage_deleted)->toBeTrue()
+        ->and($older->s3Replicas()->where('s3_storage_id', $second->id)->sole()->s3_storage_deleted)->toBeFalse()
+        ->and($older->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($latest->s3Replicas()->where('s3_storage_id', $first->id)->sole()->s3_storage_deleted)->toBeFalse();
+});
+
+it('continues retention and execution cleanup when a replica storage is missing', function () {
+    $this->freezeTime();
+    [$backup, , $second, $server] = createMultiDestinationVolumeBackup([
+        'retention_amount_locally' => 0,
+        'retention_days_locally' => 0,
+        'retention_max_storage_locally' => 0,
+        'retention_amount_s3' => 0,
+        'retention_days_s3' => 7,
+        'retention_max_storage_s3' => 0,
+    ]);
+    $executions = collect([false, true])->map(function (bool $localDeleted) use ($backup, $second): ScheduledVolumeBackupExecution {
+        $execution = $backup->executions()->create([
+            'status' => 'success',
+            'filename' => '/data/coolify/backups/volumes/test/'.($localDeleted ? 'deleted' : 'local').'.tar.gz',
+            'local_storage_deleted' => $localDeleted,
+        ]);
+        $execution->forceFill(['created_at' => now()->subDays(10)])->save();
+        $execution->s3Replicas()->create(['s3_storage_id' => null, 's3_uploaded' => true]);
+        $execution->s3Replicas()->create(['s3_storage_id' => $second->id, 's3_uploaded' => true]);
+        $execution->refreshS3Summary();
+
+        return $execution;
+    });
+    $disk = Mockery::mock();
+    $disk->shouldReceive('delete')->once()->with(Mockery::on(
+        fn (array $filenames): bool => count($filenames) === 2
+            && in_array($executions[0]->filename, $filenames, true)
+            && in_array($executions[1]->filename, $filenames, true),
+    ))->andReturnTrue();
+    Storage::shouldReceive('build')->once()
+        ->with(Mockery::on(fn (array $config): bool => $config['key'] === 'second-key'))
+        ->andReturn($disk);
+    $job = new VolumeBackupJob($backup);
+
+    (new ReflectionClass($job))->getMethod('removeExpiredBackups')->invoke($job, $server);
+
+    expect($executions[0]->fresh()->s3_storage_deleted)->toBeTrue()
+        ->and($executions[0]->s3Replicas()->where('s3_storage_deleted', false)->count())->toBe(0);
+    $this->assertModelMissing($executions[1]);
+});
+
+it('cleans an interrupted upload from every destination whose copy did not finish', function () {
+    [$backup, $first, $second] = createMultiDestinationVolumeBackup();
+    $execution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $backup->id,
+        's3_storage_id' => $first->id,
+        'status' => 'failed',
+        'filename' => '/data/coolify/backups/volumes/test/interrupted.tar.gz',
+        's3_cleanup_pending' => true,
+    ]);
+    $uploaded = $execution->s3Replicas()->create(['s3_storage_id' => $first->id, 's3_uploaded' => true]);
+    $interrupted = $execution->s3Replicas()->create(['s3_storage_id' => $second->id]);
+    $withoutStorage = $execution->s3Replicas()->create(['s3_storage_id' => null, 's3_uploaded' => false]);
+    $disk = Mockery::mock();
+    $disk->shouldReceive('delete')->once()->with(['/data/coolify/backups/volumes/test/interrupted.tar.gz'])->andReturnTrue();
+    Storage::shouldReceive('build')
+        ->once()
+        ->with(Mockery::on(fn (array $config): bool => $config['key'] === 'second-key'))
+        ->andReturn($disk);
+
+    VolumeBackupRecoveryJob::cleanupS3Upload($execution);
+
+    expect($execution->fresh()->s3_cleanup_pending)->toBeFalse()
+        ->and($uploaded->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($interrupted->fresh()->s3_storage_deleted)->toBeTrue()
+        ->and($withoutStorage->fresh()->s3_storage_deleted)->toBeTrue();
+});
+
+it('keeps the cleanup pending when one destination cannot delete the partial upload', function () {
+    [$backup, $first, $second] = createMultiDestinationVolumeBackup();
+    $execution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $backup->id,
+        's3_storage_id' => $first->id,
+        'status' => 'failed',
+        'filename' => '/data/coolify/backups/volumes/test/interrupted.tar.gz',
+        's3_cleanup_pending' => true,
+    ]);
+    $failing = $execution->s3Replicas()->create(['s3_storage_id' => $first->id, 's3_uploaded' => false]);
+    $cleaned = $execution->s3Replicas()->create(['s3_storage_id' => $second->id, 's3_uploaded' => false]);
+    $failingDisk = Mockery::mock();
+    $failingDisk->shouldReceive('delete')->once()->andReturnFalse();
+    $cleanedDisk = Mockery::mock();
+    $cleanedDisk->shouldReceive('delete')->once()->andReturnTrue();
+    Storage::shouldReceive('build')->with(Mockery::on(fn (array $config): bool => $config['key'] === 'first-key'))->andReturn($failingDisk);
+    Storage::shouldReceive('build')->with(Mockery::on(fn (array $config): bool => $config['key'] === 'second-key'))->andReturn($cleanedDisk);
+
+    expect(fn () => VolumeBackupRecoveryJob::cleanupS3Upload($execution))->toThrow(RuntimeException::class);
+
+    expect($execution->fresh()->s3_cleanup_pending)->toBeTrue()
+        ->and($failing->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($cleaned->fresh()->s3_storage_deleted)->toBeTrue();
+});
+
+it('moves the primary destination to a remaining storage when the primary storage is deleted', function () {
+    [$backup, $first, $second] = createMultiDestinationVolumeBackup();
+    $execution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $backup->id,
+        's3_storage_id' => $first->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/volumes/test/archive.tar.gz',
+    ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $first->id, 's3_uploaded' => true]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $second->id, 's3_uploaded' => true]);
+    $execution->refreshS3Summary();
+
+    expect($backup->s3_storage_id)->toBe($first->id);
+
+    $first->delete();
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeTrue()
+        ->and($backup->s3_storage_id)->toBe($second->id)
+        ->and($backup->s3Storages()->pluck('s3_storages.id')->all())->toBe([$second->id])
+        ->and($execution->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($execution->hasLiveS3Copies())->toBeTrue();
+});
+
+it('preserves the schedule and uploaded replica when its S3 storage is unavailable', function () {
+    [$backup] = createMultiDestinationVolumeBackup();
+    $execution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $backup->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/volumes/test/archive.tar.gz',
+        'local_storage_deleted' => true,
+    ]);
+    $replica = $execution->s3Replicas()->create([
+        's3_storage_id' => null,
+        's3_uploaded' => true,
+        's3_storage_deleted' => false,
+    ]);
+    $execution->refreshS3Summary();
+
+    expect(fn () => (new DeleteScheduledVolumeBackup)->handle($backup, deleteLocalArchives: false))
+        ->toThrow(RuntimeException::class, 'The S3 storage used by an existing backup is unavailable.');
+
+    expect($backup->fresh())->not->toBeNull();
+    expect($replica->fresh()->s3_storage_deleted)->toBeFalse();
+    expect($execution->fresh()->s3_storage_deleted)->toBeFalse();
+    expect($execution->hasLiveS3Copies())->toBeTrue();
+});
+
+it('rolls back all backup detachment changes when an execution update fails', function () {
+    [$backup, $storage] = createMultiDestinationVolumeBackup();
+    $backup->syncS3Storages([$storage->id]);
+    $databaseBackup = ScheduledDatabaseBackup::create([
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'database_type' => 'App\\Models\\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $storage->team_id,
+    ]);
+    $databaseBackup->syncS3Storages([$storage->id]);
+    $databaseExecution = $databaseBackup->executions()->create([
+        'uuid' => 'rollback-database',
+        'database_name' => 'app',
+        'status' => 'success',
+        's3_uploaded' => true,
+    ]);
+    $databaseReplica = $databaseExecution->s3Replicas()->create([
+        's3_storage_id' => $storage->id,
+        's3_uploaded' => true,
+    ]);
+    $execution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $backup->id,
+        's3_storage_id' => $storage->id,
+        'status' => 'failed',
+        's3_cleanup_pending' => true,
+    ]);
+    $replica = $execution->s3Replicas()->create([
+        's3_storage_id' => $storage->id,
+        's3_uploaded' => false,
+    ]);
+    Event::listen('eloquent.updating: '.ScheduledVolumeBackupExecution::class, function (): void {
+        throw new RuntimeException('Execution update failed');
+    });
+
+    expect(fn () => $storage->delete())->toThrow(RuntimeException::class, 'Execution update failed');
+
+    $this->assertModelExists($storage);
+    foreach ([$databaseBackup, $backup] as $schedule) {
+        expect($schedule->fresh()->s3_storage_id)->toBe($storage->id)
+            ->and((bool) $schedule->fresh()->save_s3)->toBeTrue()
+            ->and($schedule->s3Storages()->pluck('s3_storages.id')->all())->toBe([$storage->id]);
+    }
+    expect($databaseReplica->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($databaseExecution->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($replica->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($execution->fresh()->s3_cleanup_pending)->toBeTrue();
+});
diff --git a/tests/Feature/VolumeBackupRecoveryBoundsTest.php b/tests/Feature/VolumeBackupRecoveryBoundsTest.php
index ff3ed2d031..08d90ab774 100644
--- a/tests/Feature/VolumeBackupRecoveryBoundsTest.php
+++ b/tests/Feature/VolumeBackupRecoveryBoundsTest.php
@@ -93,7 +93,7 @@ function createRecoveryBoundsBackup(Team $team, array $backupAttributes = []): a
 
 function createRecoveryBoundsExecution(ScheduledVolumeBackup $backup, array $attributes = []): ScheduledVolumeBackupExecution
 {
-    return ScheduledVolumeBackupExecution::create([
+    $execution = ScheduledVolumeBackupExecution::create([
         'scheduled_volume_backup_id' => $backup->id,
         's3_storage_id' => $backup->s3_storage_id,
         'status' => 'failed',
@@ -101,6 +101,9 @@ function createRecoveryBoundsExecution(ScheduledVolumeBackup $backup, array $att
         's3_cleanup_pending' => true,
         ...$attributes,
     ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $backup->s3_storage_id]);
+
+    return $execution;
 }
 
 function failRecoveryBoundsS3Delete(string $awsCode): void
@@ -164,7 +167,7 @@ it('records a categorized S3 cleanup failure without throwing or leaking the S3
 
     $execution->refresh();
     expect($execution->s3_cleanup_pending)->toBeTrue()
-        ->and($execution->s3_storage_deleted)->toBeFalse()
+        ->and($execution->s3Replicas()->sole()->s3_storage_deleted)->toBeFalse()
         ->and($execution->recovery_error)->toBe('s3_auth')
         ->and($execution->recovery_last_attempt_at->equalTo(now()))->toBeTrue()
         ->and($execution->recovery_needs_attention)->toBeTrue()
@@ -261,7 +264,7 @@ it('cleans the S3 upload even when container recovery fails', function () {
     $execution->refresh();
     expect($execution->stop_recovery_pending)->toBeTrue()
         ->and($execution->s3_cleanup_pending)->toBeFalse()
-        ->and($execution->s3_storage_deleted)->toBeTrue()
+        ->and($execution->s3Replicas()->sole()->s3_storage_deleted)->toBeTrue()
         ->and($execution->recovery_error)->toBe('server_unreachable')
         ->and($execution->recovery_needs_attention)->toBeFalse();
     Notification::assertNothingSent();
@@ -281,7 +284,7 @@ it('resets the recovery state after a successful attempt', function () {
 
     $execution->refresh();
     expect($execution->s3_cleanup_pending)->toBeFalse()
-        ->and($execution->s3_storage_deleted)->toBeTrue()
+        ->and($execution->s3Replicas()->sole()->s3_storage_deleted)->toBeTrue()
         ->and($execution->recovery_error)->toBeNull()
         ->and($execution->recovery_last_attempt_at)->toBeNull()
         ->and($execution->recovery_needs_attention)->toBeFalse();
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index 97fd82614f..14b0676aa3 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -466,34 +466,19 @@ it('splits scheduled backup settings and executions across dedicated urls', func
     $this->get($generalUrl)
         ->assertOk()
         ->assertSee('General')
-        ->assertSee('S3 storage')
-        ->assertSee('Retention')
         ->assertSee('Executions')
         ->assertSee('Danger Zone')
         ->assertSee('Backup schedule')
         ->assertSee('File-level consistency')
-        ->assertDontSee('Enable S3')
-        ->assertDontSee('Backups to keep')
-        ->assertDontSee('Review generated archives')
-        ->assertDontSee('Delete backup schedule');
-
-    $this->get($generalUrl.'/s3')
-        ->assertOk()
         ->assertSeeText('No validated S3 storage')
-        ->assertDontSee('Local copy')
-        ->assertDontSee('Enable S3')
-        ->assertDontSee('Disable S3')
-        ->assertDontSee('Backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Review generated archives');
-
-    $this->get($generalUrl.'/retention')
-        ->assertOk()
         ->assertSee('Local backups')
         ->assertSee('S3 backups')
         ->assertSee('Backups to keep')
-        ->assertDontSee('File-level consistency')
-        ->assertDontSee('Review generated archives');
+        ->assertDontSee('Review generated archives')
+        ->assertDontSee('Delete backup schedule');
+
+    $this->get($generalUrl.'/s3')->assertRedirect($generalUrl);
+    $this->get($generalUrl.'/retention')->assertRedirect($generalUrl);
 
     $this->get($generalUrl.'/executions')
         ->assertOk()
@@ -874,6 +859,7 @@ it('deletes an individual S3 archive from the storage recorded on its execution'
         'local_storage_deleted' => true,
         's3_uploaded' => true,
     ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $originalStorage->id, 's3_uploaded' => true]);
     $disk = Mockery::mock();
     $disk->shouldReceive('delete')
         ->once()
@@ -953,7 +939,6 @@ it('enables and disables volume S3 backups from the S3 title action', function (
     $component = Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->assertSee('Enable S3')
         ->assertDontSee('You do not have permission to perform this action.')
@@ -986,9 +971,8 @@ it('persists S3 settings the first time when a volume backup schedule does not e
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
-        ->assertSet('s3StorageId', $s3Storage->id)
+        ->assertSet('s3StorageIds', [$s3Storage->id])
         ->call('toggleS3')
         ->assertSet('saveToS3', true)
         ->assertDispatched('success');
@@ -1018,9 +1002,8 @@ it('persists the selected S3 storage when a volume backup schedule does not exis
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
-        ->set('s3StorageId', $s3Storage->id)
+        ->set('s3StorageIds', [$s3Storage->id])
         ->assertDispatched('success');
 
     $backup = ScheduledVolumeBackup::query()->sole();
@@ -1042,7 +1025,6 @@ it('shows and saves volume S3 retention while S3 backups are disabled', function
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 'retention',
     ])
         ->assertSee('S3 backups')
         ->set('retentionAmountS3', 12)
@@ -1069,7 +1051,6 @@ it('allows team owners to edit volume backup retention settings', function () {
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 'retention',
     ])->assertDontSee('You do not have permission to perform this action.');
 });
 
@@ -1096,7 +1077,6 @@ it('does not enable S3 backups when another volume backup setting is invalid', f
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->set('frequency', 'not a valid schedule')
         ->call('toggleS3')
@@ -1140,10 +1120,9 @@ it('does not change S3 storage when another volume backup setting is invalid', f
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->set('frequency', 'not a valid schedule')
-        ->set('s3StorageId', $secondS3Storage->id)
+        ->set('s3StorageIds', [$secondS3Storage->id])
         ->assertHasErrors('frequency')
         ->assertNotDispatched('success');
 
@@ -1261,18 +1240,18 @@ it('lists and accepts only S3 storages of the resource team when the session tea
     $component = Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application]);
 
     expect($component->get('availableS3Storages')->pluck('id')->all())->toBe([$resourceTeamStorage->id])
-        ->and($component->get('s3StorageId'))->toBe($resourceTeamStorage->id);
+        ->and($component->get('s3StorageIds'))->toBe([$resourceTeamStorage->id]);
 
     $component->set('frequency', 'daily')
         ->set('saveToS3', true)
-        ->set('s3StorageId', $otherTeamStorage->id)
-        ->assertHasErrors('s3StorageId')
+        ->set('s3StorageIds', [$otherTeamStorage->id])
+        ->assertHasErrors('s3StorageIds')
         ->call('save')
-        ->assertHasErrors('s3StorageId');
+        ->assertHasErrors('s3StorageIds');
 
     expect(ScheduledVolumeBackup::query()->count())->toBe(0);
 
-    $component->set('s3StorageId', $resourceTeamStorage->id)
+    $component->set('s3StorageIds', [$resourceTeamStorage->id])
         ->call('save')
         ->assertHasNoErrors();
 
@@ -1302,9 +1281,9 @@ it('only accepts a usable S3 storage owned by the current team', function () {
     Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application])
         ->set('frequency', 'daily')
         ->set('saveToS3', true)
-        ->set('s3StorageId', $foreignStorage->id)
+        ->set('s3StorageIds', [$foreignStorage->id])
         ->call('save')
-        ->assertHasErrors('s3StorageId');
+        ->assertHasErrors('s3StorageIds');
 
     expect(ScheduledVolumeBackup::query()->count())->toBe(0);
 });
@@ -1329,7 +1308,7 @@ it('saves the database-style S3 backup controls immediately', function () {
     ]);
 
     $component = Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application])
-        ->assertSet('s3StorageId', $s3Storage->id)
+        ->assertSet('s3StorageIds', [$s3Storage->id])
         ->set('saveToS3', true)
         ->call('instantSave')
         ->set('disableLocalBackup', true)
@@ -1384,8 +1363,8 @@ it('saves the selected volume backup S3 storage immediately while S3 is disabled
         's3_storage_id' => $firstS3Storage->id,
     ]);
 
-    Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application, 'section' => 's3'])
-        ->set('s3StorageId', $secondS3Storage->id)
+    Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application])
+        ->set('s3StorageIds', [$secondS3Storage->id])
         ->assertDispatched('success');
 
     $backup = ScheduledVolumeBackup::query()->sole();
@@ -1419,7 +1398,6 @@ it('saves the archive behavior immediately and the local copy with the S3 form',
     $s3Component = Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ]);
     // The local copy choice belongs to the S3 form and is persisted by its explicit save.
     $s3Component->set('disableLocalBackup', true)->call('save')->assertDispatched('success');
@@ -1446,14 +1424,12 @@ it('allows volume S3 backups to be disabled when no usable storage remains', fun
     $component = Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->assertSet('saveToS3', true)
         ->assertSeeText('S3 storage')
         ->assertSeeText('No validated S3 storage')
         ->assertSeeHtml('href="'.route('storage.index').'"')
         ->assertSeeText('Open S3 storage')
-        ->assertDontSee('Save')
         ->assertDontSee('Disable S3')
         ->assertDontSee('Local copy')
         ->call('toggleS3')
@@ -1493,6 +1469,7 @@ it('disables S3 volume backups when the storage is deleted', function () {
         's3_uploaded' => true,
         's3_cleanup_pending' => true,
     ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $s3Storage->id, 's3_uploaded' => true]);
 
     $s3Storage->delete();
 
@@ -1537,6 +1514,7 @@ it('marks historical executions deleted when their recorded S3 storage is remove
         's3_uploaded' => true,
         's3_cleanup_pending' => true,
     ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $originalStorage->id, 's3_uploaded' => true]);
 
     $originalStorage->delete();
 
@@ -1711,7 +1689,7 @@ it('deletes S3 archives from the storage recorded on each execution', function (
         'frequency' => 'daily',
         'save_s3' => true,
     ]);
-    ScheduledVolumeBackupExecution::create([
+    $execution = ScheduledVolumeBackupExecution::create([
         'scheduled_volume_backup_id' => $backup->id,
         's3_storage_id' => $originalStorage->id,
         'status' => 'success',
@@ -1719,6 +1697,7 @@ it('deletes S3 archives from the storage recorded on each execution', function (
         'local_storage_deleted' => true,
         's3_uploaded' => true,
     ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $originalStorage->id, 's3_uploaded' => true]);
     $disk = Mockery::mock();
     $disk->shouldReceive('delete')
         ->once()
@@ -1984,7 +1963,8 @@ it('keeps the upload destination on the volume backup execution', function () {
     $execution = ScheduledVolumeBackupExecution::query()->sole();
 
     expect($execution->s3_storage_id)->toBe($s3Storage->id)
-        ->and($execution->s3->is($s3Storage))->toBeTrue();
+        ->and($execution->s3->is($s3Storage))->toBeTrue()
+        ->and($execution->s3Replicas()->sole()->s3_storage_id)->toBe($s3Storage->id);
 });
 
 it('streams S3-only volume backups with Content-MD5 on Object Lock buckets and without a local archive', function () {
@@ -2043,6 +2023,7 @@ it('streams S3-only volume backups with Content-MD5 on Object Lock buckets and w
     expect($execution->status)->toBe('success')
         ->and($execution->size)->toBe(128)
         ->and($execution->s3_uploaded)->toBeTrue()
+        ->and($execution->s3Replicas()->sole()->s3_uploaded)->toBeTrue()
         ->and($execution->local_storage_deleted)->toBeTrue();
 });
 
@@ -2251,15 +2232,26 @@ it('removes retained S3 archives from the storage recorded on each execution', f
         'status' => 'success',
         'filename' => '/data/coolify/backups/volumes/test/old.tar.gz',
         's3_uploaded' => true,
+        'created_at' => now()->subDays(2),
+    ]);
+    $oldExecution->s3Replicas()->create(['s3_storage_id' => $originalStorage->id, 's3_uploaded' => true]);
+    $retainedOriginalExecution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $backup->id,
+        's3_storage_id' => $originalStorage->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/volumes/test/retained-original.tar.gz',
+        's3_uploaded' => true,
         'created_at' => now()->subDay(),
     ]);
-    ScheduledVolumeBackupExecution::create([
+    $retainedOriginalExecution->s3Replicas()->create(['s3_storage_id' => $originalStorage->id, 's3_uploaded' => true]);
+    $newExecution = ScheduledVolumeBackupExecution::create([
         'scheduled_volume_backup_id' => $backup->id,
         's3_storage_id' => $newStorage->id,
         'status' => 'success',
         'filename' => '/data/coolify/backups/volumes/test/new.tar.gz',
         's3_uploaded' => true,
     ]);
+    $newExecution->s3Replicas()->create(['s3_storage_id' => $newStorage->id, 's3_uploaded' => true]);
     $disk = Mockery::mock();
     $disk->shouldReceive('delete')->once()->with(['/data/coolify/backups/volumes/test/old.tar.gz'])->andReturnTrue();
     Storage::shouldReceive('build')
@@ -2271,7 +2263,10 @@ it('removes retained S3 archives from the storage recorded on each execution', f
 
     $method->invoke($job, $server);
 
-    expect($oldExecution->fresh()->s3_storage_deleted)->toBeTrue();
+    expect($oldExecution->fresh()->s3_storage_deleted)->toBeTrue()
+        ->and($oldExecution->s3Replicas()->sole()->s3_storage_deleted)->toBeTrue()
+        ->and($retainedOriginalExecution->fresh()->s3_storage_deleted)->toBeFalse()
+        ->and($newExecution->fresh()->s3_storage_deleted)->toBeFalse();
 });
 
 it('does not query execution history when local retention is unlimited', function () {
@@ -2584,6 +2579,7 @@ it('cleans an interrupted S3 upload and coordinates recovery with the backup loc
         'filename' => '/data/coolify/backups/volumes/test/interrupted.tar.gz',
         's3_cleanup_pending' => true,
     ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $s3Storage->id]);
     $disk = Mockery::mock();
     $disk->shouldReceive('delete')->once()->andReturnTrue();
     Storage::shouldReceive('build')->once()->andReturn($disk);
@@ -2593,7 +2589,7 @@ it('cleans an interrupted S3 upload and coordinates recovery with the backup loc
     $job->handle();
 
     expect($execution->fresh()->s3_cleanup_pending)->toBeFalse()
-        ->and($execution->fresh()->s3_storage_deleted)->toBeTrue();
+        ->and($execution->s3Replicas()->sole()->s3_storage_deleted)->toBeTrue();
 });
 
 it('cleans an interrupted upload from the execution S3 storage after a schedule switch', function () {
@@ -2632,6 +2628,7 @@ it('cleans an interrupted upload from the execution S3 storage after a schedule
         'filename' => '/data/coolify/backups/volumes/test/interrupted.tar.gz',
         's3_cleanup_pending' => true,
     ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $originalStorage->id]);
     $disk = Mockery::mock();
     $disk->shouldReceive('delete')->once()->andReturnTrue();
     Storage::shouldReceive('build')
@@ -2642,7 +2639,7 @@ it('cleans an interrupted upload from the execution S3 storage after a schedule
     VolumeBackupRecoveryJob::cleanupS3Upload($execution);
 
     expect($execution->fresh()->s3_cleanup_pending)->toBeFalse()
-        ->and($execution->fresh()->s3_storage_deleted)->toBeTrue();
+        ->and($execution->s3Replicas()->sole()->s3_storage_deleted)->toBeTrue();
 });
 
 it('keeps the S3 key tracked when interrupted upload cleanup must be retried', function () {
@@ -2673,6 +2670,7 @@ it('keeps the S3 key tracked when interrupted upload cleanup must be retried', f
         'filename' => '/data/coolify/backups/volumes/test/interrupted.tar.gz',
         's3_cleanup_pending' => true,
     ]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $s3Storage->id]);
     $disk = Mockery::mock();
     $disk->shouldReceive('delete')->once()->andReturnFalse();
     Storage::shouldReceive('build')->once()->andReturn($disk);
@@ -2990,3 +2988,26 @@ it('fails the volume archive only on fatal tar errors', function (int $tarExitCo
     'file changed as we read it' => [1, 0],
     'fatal error' => [2, 2],
 ]);
+
+it('shows the backup actions in the header bar on every application backup page', function () {
+    config(['cache.default' => 'array', 'app.maintenance.driver' => 'file']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+    ]);
+    $showUrl = route('project.application.backup.show', [
+        'project_uuid' => $application->project()->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]);
+
+    foreach (['', '/executions', '/danger'] as $suffix) {
+        expect($this->get($showUrl.$suffix)->assertOk()->getContent())
+            ->toMatch('/x-teleport="#resource-action-hud-slot".*?wire:click="toggleEnabled".*?Disable backup.*?wire:click="backupNow"/s');
+    }
+});
diff --git a/tests/Feature/Webhook/GiteaAppWebhookTest.php b/tests/Feature/Webhook/GiteaAppWebhookTest.php
new file mode 100644
index 0000000000..2e6f5e942c
--- /dev/null
+++ b/tests/Feature/Webhook/GiteaAppWebhookTest.php
@@ -0,0 +1,236 @@
+<?php
+
+use App\Actions\Application\CleanupPreviewDeployment;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\GiteaApp;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Testing\TestResponse;
+use Tests\TestCase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Queue::fake();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->giteaApp = giteaAppWebhookSource($this->team, 'gitea-app-secret');
+});
+
+function giteaAppWebhookSource(Team $team, string $secret): GiteaApp
+{
+    return GiteaApp::create([
+        'name' => 'gitea-app-'.str()->random(6),
+        'api_url' => 'https://gitea.example.com/api/v1',
+        'html_url' => 'https://gitea.example.com',
+        'webhook_secret' => $secret,
+        'team_id' => $team->id,
+        'is_system_wide' => false,
+        'is_public' => false,
+    ]);
+}
+
+function giteaAppWebhookApplication(Team $team, int $sourceId, string $sourceType = GiteaApp::class): Application
+{
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['is_reachable' => true, 'is_usable' => true, 'force_disabled' => false]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    $application = Application::create([
+        'name' => 'gitea-app-webhook-app',
+        'git_repository' => 'test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'source_id' => $sourceId,
+        'source_type' => $sourceType,
+        'repository_project_id' => 555,
+    ]);
+    $application->settings->update(['is_auto_deploy_enabled' => true, 'is_preview_deployments_enabled' => true]);
+
+    return $application->refresh();
+}
+
+/**
+ * @return array<string, mixed>
+ */
+function giteaAppWebhookPayload(string $event, string $action = 'opened'): array
+{
+    $sha = 'e83c5163316f89bfbde7d9ab23ca2e25604af290';
+
+    if ($event === 'push') {
+        return [
+            'ref' => 'refs/heads/main',
+            'before' => 'a83c5163316f89bfbde7d9ab23ca2e25604af290',
+            'after' => $sha,
+            'repository' => ['id' => 555, 'full_name' => 'test-org/test-repo'],
+            'commits' => [['message' => 'Update', 'added' => [], 'modified' => ['README.md'], 'removed' => []]],
+        ];
+    }
+
+    return [
+        'action' => $action,
+        'number' => 7,
+        'repository' => ['id' => 555, 'full_name' => 'test-org/test-repo'],
+        'pull_request' => [
+            'html_url' => 'https://gitea.example.com/test-org/test-repo/pulls/7',
+            'title' => 'Add feature',
+            'head' => ['ref' => 'feature', 'sha' => $sha, 'repo' => ['id' => 555]],
+            'base' => ['ref' => 'main', 'repo' => ['id' => 555]],
+        ],
+    ];
+}
+
+/**
+ * @param  array<string, string>  $headers
+ */
+function sendGiteaAppWebhook(TestCase $test, string $event, array $payload, ?string $secret = 'gitea-app-secret', array $headers = []): TestResponse
+{
+    $body = json_encode($payload);
+    $server = ['CONTENT_TYPE' => 'application/json', 'HTTP_X-Gitea-Event' => $event];
+    if ($secret !== null) {
+        $server['HTTP_X-Gitea-Signature'] = hash_hmac('sha256', $body, $secret);
+    }
+
+    return $test->call('POST', '/webhooks/source/gitea/events', [], [], [], array_merge($server, $headers), $body);
+}
+
+describe('Gitea App webhook authentication', function () {
+    test('rejects a delivery without a signature', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+
+        sendGiteaAppWebhook($this, 'push', giteaAppWebhookPayload('push'), secret: null)->assertStatus(401);
+
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeFalse();
+    });
+
+    test('rejects a delivery with an invalid signature', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+
+        sendGiteaAppWebhook($this, 'push', giteaAppWebhookPayload('push'), secret: 'wrong-secret')->assertStatus(401);
+
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeFalse();
+    });
+
+    test('accepts a GitHub-style X-Hub-Signature-256 header', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+        $payload = giteaAppWebhookPayload('push');
+        $body = json_encode($payload);
+
+        $this->call('POST', '/webhooks/source/gitea/events', [], [], [], [
+            'CONTENT_TYPE' => 'application/json',
+            'HTTP_X-Gitea-Event' => 'push',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'gitea-app-secret'),
+        ], $body)->assertOk();
+
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeTrue();
+    });
+
+    test('answers ping deliveries', function () {
+        sendGiteaAppWebhook($this, 'ping', ['hook_id' => 1])->assertOk()->assertSee('pong');
+    });
+});
+
+describe('Gitea App webhook push', function () {
+    test('queues a deployment only for applications of the signing Gitea App', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+
+        $otherGiteaApp = giteaAppWebhookSource(Team::factory()->create(), 'other-secret');
+        $otherGiteaApplication = giteaAppWebhookApplication($otherGiteaApp->team, $otherGiteaApp->id);
+
+        // A GitLab App with the same id must not have its applications deployed.
+        $gitlabApp = GitlabApp::forceCreate([
+            'id' => $this->giteaApp->id,
+            'uuid' => (string) str()->uuid(),
+            'name' => 'colliding-gitlab-app',
+            'api_url' => 'https://gitlab.com/api/v4',
+            'html_url' => 'https://gitlab.com',
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+            'is_public' => false,
+        ]);
+        $gitlabApplication = giteaAppWebhookApplication($this->team, $gitlabApp->id, GitlabApp::class);
+
+        sendGiteaAppWebhook($this, 'push', giteaAppWebhookPayload('push'))
+            ->assertOk()
+            ->assertSee('gitea-app-webhook-app');
+
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->where('commit', 'e83c5163316f89bfbde7d9ab23ca2e25604af290')->exists())->toBeTrue()
+            ->and(ApplicationDeploymentQueue::query()->where('application_id', $otherGiteaApplication->id)->exists())->toBeFalse()
+            ->and(ApplicationDeploymentQueue::query()->where('application_id', $gitlabApplication->id)->exists())->toBeFalse();
+    });
+
+    test('does not deploy a push to another branch', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+        $payload = giteaAppWebhookPayload('push');
+        $payload['ref'] = 'refs/heads/develop';
+
+        sendGiteaAppWebhook($this, 'push', $payload)->assertOk();
+
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeFalse();
+    });
+
+    test('skips commits marked with [skip ci]', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+        $payload = giteaAppWebhookPayload('push');
+        $payload['commits'][0]['message'] = 'Docs [skip ci]';
+
+        sendGiteaAppWebhook($this, 'push', $payload)->assertOk()->assertSee('skipped');
+
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeFalse();
+    });
+});
+
+describe('Gitea App webhook pull requests', function () {
+    test('an opened pull request creates a preview and queues a preview deployment', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+
+        sendGiteaAppWebhook($this, 'pull_request', giteaAppWebhookPayload('pull_request', 'opened'))->assertOk();
+
+        $preview = ApplicationPreview::query()->where('application_id', $application->id)->where('pull_request_id', 7)->first();
+        expect($preview)->not->toBeNull()
+            ->and($preview->git_type)->toBe('gitea')
+            ->and(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->where('pull_request_id', 7)->exists())->toBeTrue();
+    });
+
+    test('a pull request from a fork is not deployed without public previews', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+        $payload = giteaAppWebhookPayload('pull_request', 'opened');
+        $payload['pull_request']['head']['repo']['id'] = 999;
+
+        sendGiteaAppWebhook($this, 'pull_request', $payload)->assertOk();
+
+        expect(ApplicationPreview::query()->where('application_id', $application->id)->exists())->toBeFalse()
+            ->and(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeFalse();
+    });
+
+    test('a closed pull request cleans up the preview deployment', function () {
+        $application = giteaAppWebhookApplication($this->team, $this->giteaApp->id);
+        ApplicationPreview::create([
+            'git_type' => 'gitea',
+            'application_id' => $application->id,
+            'pull_request_id' => 7,
+            'pull_request_html_url' => 'https://gitea.example.com/test-org/test-repo/pulls/7',
+        ]);
+        CleanupPreviewDeployment::shouldRun()->once();
+
+        sendGiteaAppWebhook($this, 'pull_request', giteaAppWebhookPayload('pull_request', 'closed'))
+            ->assertOk()
+            ->assertSee('Preview deployment closed');
+    });
+});
diff --git a/tests/Feature/Webhook/GitlabSystemHookTest.php b/tests/Feature/Webhook/GitlabSystemHookTest.php
new file mode 100644
index 0000000000..8856846918
--- /dev/null
+++ b/tests/Feature/Webhook/GitlabSystemHookTest.php
@@ -0,0 +1,278 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Testing\TestResponse;
+use Tests\TestCase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Queue::fake();
+    InstanceSettings::forceCreate(['id' => 0]);
+});
+
+function gitlabSystemHookSha(): string
+{
+    return 'da1560886d4f094c3e6c9ef40349f7d38b5d27d7';
+}
+
+function gitlabSystemHookSource(string $token): GitlabApp
+{
+    return GitlabApp::create([
+        'name' => "gitlab-system-hook-{$token}",
+        'api_url' => 'https://gitlab.example.com/api/v4',
+        'html_url' => 'https://gitlab.example.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'webhook_token' => $token,
+        'team_id' => Team::factory()->create()->id,
+        'is_system_wide' => false,
+        'is_public' => false,
+    ]);
+}
+
+function gitlabSystemHookApplication(GitlabApp $source, int $projectId = 15, string $branch = 'main'): Application
+{
+    $project = Project::factory()->create(['team_id' => $source->team_id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $source->team_id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    $application = Application::create([
+        'name' => "gitlab-system-hook-app-{$source->id}",
+        'git_repository' => 'mike/diaspora',
+        'git_branch' => $branch,
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'source_id' => $source->id,
+        'source_type' => GitlabApp::class,
+        'repository_project_id' => $projectId,
+    ]);
+    $application->settings->update([
+        'is_auto_deploy_enabled' => true,
+        'is_preview_deployments_enabled' => true,
+    ]);
+
+    return $application->refresh();
+}
+
+/**
+ * A push payload in the shape of the GitLab system hook docs example: it has
+ * `event_name` and a top-level `project_id`, but no `object_kind` and no `project.id`.
+ *
+ * @see https://docs.gitlab.com/administration/system_hooks/#push-events
+ *
+ * @return array<string, mixed>
+ */
+function gitlabSystemHookDocumentedPush(int $projectId = 15, string $ref = 'refs/heads/main'): array
+{
+    return [
+        'event_name' => 'push',
+        'before' => '95790bf891e76fee5e1747ab589903a6a1f80f22',
+        'after' => gitlabSystemHookSha(),
+        'ref' => $ref,
+        'checkout_sha' => gitlabSystemHookSha(),
+        'user_id' => 4,
+        'project_id' => $projectId,
+        'project' => ['name' => 'Diaspora', 'path_with_namespace' => 'mike/diaspora', 'default_branch' => 'main'],
+        'commits' => [[
+            'id' => gitlabSystemHookSha(),
+            'message' => 'Add simple search to projects in public area',
+            'added' => ['app.php'],
+            'modified' => [],
+            'removed' => [],
+        ]],
+        'total_commits_count' => 1,
+    ];
+}
+
+/**
+ * A push payload as current GitLab sends it to system hooks
+ * (Gitlab::DataBuilder::Push, the same data as for project hooks).
+ *
+ * @return array<string, mixed>
+ */
+function gitlabSystemHookRuntimePush(int $projectId = 15): array
+{
+    $payload = gitlabSystemHookDocumentedPush($projectId);
+    $payload['object_kind'] = 'push';
+    $payload['project']['id'] = $projectId;
+
+    return $payload;
+}
+
+/**
+ * @return array<string, mixed>
+ */
+function gitlabSystemHookMergeRequest(int $projectId = 15, string $action = 'open'): array
+{
+    return [
+        'object_kind' => 'merge_request',
+        'event_type' => 'merge_request',
+        'project' => ['id' => $projectId, 'path_with_namespace' => 'mike/diaspora'],
+        'object_attributes' => [
+            'action' => $action,
+            'iid' => 1,
+            'url' => 'https://gitlab.example.com/mike/diaspora/-/merge_requests/1',
+            'title' => 'MS-Viewport',
+            'source_branch' => 'ms-viewport',
+            'target_branch' => 'main',
+            'source_project_id' => $projectId,
+            'target_project_id' => $projectId,
+            'last_commit' => ['id' => gitlabSystemHookSha(), 'message' => 'Fix viewport'],
+        ],
+    ];
+}
+
+/**
+ * @param  array<string, mixed>  $payload
+ */
+function gitlabSystemHookSend(TestCase $test, array $payload, ?string $token, string $event = 'System Hook'): TestResponse
+{
+    $headers = ['HTTP_X-Gitlab-Event' => $event];
+    if ($token !== null) {
+        $headers['HTTP_X-Gitlab-Token'] = $token;
+    }
+
+    return $test->call('POST', '/webhooks/source/gitlab/events', [], [], [], $headers + [
+        'REMOTE_ADDR' => '203.0.113.20',
+        'CONTENT_TYPE' => 'application/json',
+    ], json_encode($payload, JSON_THROW_ON_ERROR));
+}
+
+function gitlabSystemHookDeployments(Application $application): array
+{
+    return ApplicationDeploymentQueue::query()->where('application_id', $application->id)->pluck('commit')->all();
+}
+
+describe('GitLab system hook push', function () {
+    test('a push to the tracked branch queues a deployment', function (array $payload) {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+
+        gitlabSystemHookSend($this, $payload, 'system-hook-token')
+            ->assertOk()
+            ->assertJsonPath('0.application', $application->name);
+
+        expect(gitlabSystemHookDeployments($application))->toBe([gitlabSystemHookSha()]);
+    })->with([
+        'documented payload' => [fn () => gitlabSystemHookDocumentedPush()],
+        'runtime payload' => [fn () => gitlabSystemHookRuntimePush()],
+    ]);
+
+    test('a push to another branch queues no deployment', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(ref: 'refs/heads/develop'), 'system-hook-token')->assertOk();
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    });
+
+    test('a push for a project that no application tracks queues no deployment', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source, projectId: 15);
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(projectId: 99), 'system-hook-token')
+            ->assertOk()
+            ->assertExactJson([]);
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    });
+
+    test('a token only deploys applications of its own source', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $otherSource = gitlabSystemHookSource('other-source-token');
+        $application = gitlabSystemHookApplication($source);
+        $otherApplication = gitlabSystemHookApplication($otherSource);
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(), 'system-hook-token')->assertOk();
+
+        expect(gitlabSystemHookDeployments($application))->toBe([gitlabSystemHookSha()])
+            ->and(gitlabSystemHookDeployments($otherApplication))->toBe([]);
+    });
+
+    test('a missing or invalid token is rejected', function (?string $token) {
+        $application = gitlabSystemHookApplication(gitlabSystemHookSource('system-hook-token'));
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(), $token)->assertUnauthorized();
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    })->with([
+        'missing' => [null],
+        'invalid' => ['wrong-token'],
+    ]);
+});
+
+describe('GitLab system hook merge request', function () {
+    test('an opened merge request queues a preview deployment', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+
+        gitlabSystemHookSend($this, gitlabSystemHookMergeRequest(), 'system-hook-token')->assertOk();
+
+        expect(ApplicationPreview::query()->where('application_id', $application->id)->pluck('pull_request_id')->all())->toBe([1])
+            ->and(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->sole()->pull_request_id)->toBe(1);
+    });
+});
+
+describe('GitLab system hook events without a deployment', function () {
+    test('the event is ignored without an error', function (array $payload) {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+
+        gitlabSystemHookSend($this, $payload, 'system-hook-token')
+            ->assertOk()
+            ->assertJsonPath('status', 'failed')
+            ->assertJsonPath('message', 'Event not allowed. Only push and merge_request events are allowed.');
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    })->with([
+        'project_create' => [['event_name' => 'project_create', 'project_id' => 15, 'name' => 'Diaspora', 'path_with_namespace' => 'mike/diaspora']],
+        'user_create' => [['event_name' => 'user_create', 'user_id' => 41, 'username' => 'js', 'email' => 'js@gitlabhq.com']],
+        'repository_update' => [['event_name' => 'repository_update', 'project_id' => 15, 'changes' => [['ref' => 'refs/heads/main', 'after' => gitlabSystemHookSha()]], 'refs' => ['refs/heads/main']]],
+        'tag_push' => [['event_name' => 'tag_push', 'ref' => 'refs/tags/v1.0.0', 'after' => gitlabSystemHookSha(), 'project_id' => 15, 'commits' => []]],
+    ]);
+});
+
+describe('GitLab project webhook', function () {
+    test('a push to the tracked branch still queues a deployment', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+        $payload = gitlabSystemHookRuntimePush();
+        unset($payload['event_name'], $payload['project_id']);
+
+        gitlabSystemHookSend($this, $payload, 'system-hook-token', event: 'Push Hook')->assertOk();
+
+        expect(gitlabSystemHookDeployments($application))->toBe([gitlabSystemHookSha()]);
+    });
+
+    test('a payload without object_kind is still rejected', function () {
+        $application = gitlabSystemHookApplication(gitlabSystemHookSource('system-hook-token'));
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(), 'system-hook-token', event: 'Push Hook')
+            ->assertOk()
+            ->assertJsonPath('message', 'Event not allowed. Only push and merge_request events are allowed.');
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    });
+});
diff --git a/tests/Fixtures/parser/expected/application-with-exact-caddy-labels.yaml b/tests/Fixtures/parser/expected/application-with-exact-caddy-labels.yaml
index a3472cf1d2..1d5f6c0885 100644
--- a/tests/Fixtures/parser/expected/application-with-exact-caddy-labels.yaml
+++ b/tests/Fixtures/parser/expected/application-with-exact-caddy-labels.yaml
@@ -10,7 +10,7 @@
       domain: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io:8080'
     blog:
       domain: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
-  previews: {  }
+  previews: {}
   volumes:
     - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
     - 'referenceapplication0001_web-data:/app/data'
@@ -653,7 +653,7 @@
       domain: 'https://blog.example.com/blog:2368'
     api.v2:
       domain: 'https://api-v2.example.com'
-  previews: {  }
+  previews: {}
   volumes:
     - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
     - 'referenceapplication0001_web-data:/app/data'
@@ -2021,7 +2021,7 @@
     api.v2:
       domain: 'https://api-v2.example.com'
   previews:
-    8: {  }
+    8: {}
     7:
       fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
       docker_compose_domains:
diff --git a/tests/Fixtures/parser/expected/application-with-exact-traefik-labels.yaml b/tests/Fixtures/parser/expected/application-with-exact-traefik-labels.yaml
index 6bc43c91ba..21ed208946 100644
--- a/tests/Fixtures/parser/expected/application-with-exact-traefik-labels.yaml
+++ b/tests/Fixtures/parser/expected/application-with-exact-traefik-labels.yaml
@@ -10,7 +10,7 @@
       domain: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io:8080'
     blog:
       domain: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
-  previews: {  }
+  previews: {}
   volumes:
     - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
     - 'referenceapplication0001_web-data:/app/data'
@@ -666,7 +666,7 @@
       domain: 'https://blog.example.com/blog:2368'
     api.v2:
       domain: 'https://api-v2.example.com'
-  previews: {  }
+  previews: {}
   volumes:
     - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
     - 'referenceapplication0001_web-data:/app/data'
@@ -2138,7 +2138,7 @@
     api.v2:
       domain: 'https://api-v2.example.com'
   previews:
-    8: {  }
+    8: {}
     7:
       fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
       docker_compose_domains:
diff --git a/tests/Fixtures/parser/expected/application-with-settings.yaml b/tests/Fixtures/parser/expected/application-with-settings.yaml
index 70fb7de7b9..4958098cb2 100644
--- a/tests/Fixtures/parser/expected/application-with-settings.yaml
+++ b/tests/Fixtures/parser/expected/application-with-settings.yaml
@@ -10,7 +10,7 @@
       domain: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io:8080'
     blog:
       domain: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
-  previews: {  }
+  previews: {}
   volumes:
     - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
     - 'referenceapplication0001_web-data:/app/data'
@@ -761,7 +761,7 @@
       domain: 'https://blog.example.com/blog:2368'
     api.v2:
       domain: 'https://api-v2.example.com'
-  previews: {  }
+  previews: {}
   volumes:
     - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
     - 'referenceapplication0001_web-data:/app/data'
@@ -2444,7 +2444,7 @@
     api.v2:
       domain: 'https://api-v2.example.com'
   previews:
-    8: {  }
+    8: {}
     7:
       fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
       docker_compose_domains:
diff --git a/tests/Fixtures/parser/expected/application.yaml b/tests/Fixtures/parser/expected/application.yaml
index 5e1d8200cf..eb5c2be0b0 100644
--- a/tests/Fixtures/parser/expected/application.yaml
+++ b/tests/Fixtures/parser/expected/application.yaml
@@ -10,7 +10,7 @@
       domain: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io:8080'
     blog:
       domain: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
-  previews: {  }
+  previews: {}
   volumes:
     - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
     - 'referenceapplication0001_web-data:/app/data'
@@ -701,7 +701,7 @@
       domain: 'https://blog.example.com/blog:2368'
     api.v2:
       domain: 'https://api-v2.example.com'
-  previews: {  }
+  previews: {}
   volumes:
     - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
     - 'referenceapplication0001_web-data:/app/data'
@@ -2264,7 +2264,7 @@
     api.v2:
       domain: 'https://api-v2.example.com'
   previews:
-    8: {  }
+    8: {}
     7:
       fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
       docker_compose_domains:
diff --git a/tests/Fixtures/parser/expected/invalid-yaml.yaml b/tests/Fixtures/parser/expected/invalid-yaml.yaml
index dfb9e4721e..34484411b7 100644
--- a/tests/Fixtures/parser/expected/invalid-yaml.yaml
+++ b/tests/Fixtures/parser/expected/invalid-yaml.yaml
@@ -1,15 +1,15 @@
 1_deploy:
-  applications: {  }
-  databases: {  }
-  environment_variables: {  }
-  compose: {  }
+  applications: {}
+  databases: {}
+  environment_variables: {}
+  compose: {}
 2_custom_domains:
-  applications: {  }
-  databases: {  }
-  environment_variables: {  }
-  compose: {  }
+  applications: {}
+  databases: {}
+  environment_variables: {}
+  compose: {}
 3_domain_on_applications_without_one:
-  applications: {  }
-  databases: {  }
-  environment_variables: {  }
-  compose: {  }
+  applications: {}
+  databases: {}
+  environment_variables: {}
+  compose: {}
diff --git a/tests/Fixtures/terminal-websocket-rejection-server.mjs b/tests/Fixtures/terminal-websocket-rejection-server.mjs
index f7fd59ab17..ed2de47f3e 100644
--- a/tests/Fixtures/terminal-websocket-rejection-server.mjs
+++ b/tests/Fixtures/terminal-websocket-rejection-server.mjs
@@ -5,6 +5,7 @@
 // Usage: node terminal-websocket-rejection-server.mjs <mode>
 //   close-on-upgrade: complete the handshake, then close with 4401 (session rejected)
 //   reject-token:     on the first client frame, send the legacy text message and close with 4403
+//   ready:            on the first client frame, signal that the PTY is ready
 //
 // Prints the listening port on stdout. GET /stats returns {"upgrades": n}.
 import { createHash } from 'node:crypto';
@@ -57,6 +58,11 @@ server.on('upgrade', (req, socket) => {
     }
 
     socket.once('data', () => {
+        if (mode === 'ready') {
+            socket.write(frame(0x1, Buffer.from('pty-ready')));
+            return;
+        }
+
         const message = 'Unauthorized: Terminal token was rejected';
         socket.write(frame(0x1, Buffer.from(message)));
         socket.end(closeFrame(4403, message));
diff --git a/tests/Pest.php b/tests/Pest.php
index fa1810d7d0..b0a054c607 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -1,6 +1,8 @@
 <?php
 
 use App\Models\Server;
+use Illuminate\Process\PendingProcess;
+use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Once;
 use Livewire\Features\SupportTesting\Testable;
 use Tests\TestCase;
@@ -142,3 +144,39 @@ function loginAndSkipBoarding(string $email = 'test@example.com', string $passwo
 // {
 //     // ..
 // }
+
+/**
+ * Fakes all processes and keeps the content of every file that Server::uploadProxyFile()
+ * copies with scp, keyed by the remote upload path.
+ */
+function fakeProxyFileUploads(): void
+{
+    $GLOBALS['proxyFileUploads'] = [];
+    Process::fake(function (PendingProcess $process) {
+        if (preg_match("#'(/[^']*coolify-proxy-file-[^']+)'.*'(/tmp/coolify-upload-[0-9a-f]+)'#", (string) $process->command, $matches)) {
+            $GLOBALS['proxyFileUploads'][$matches[2]] = file_get_contents($matches[1]);
+        }
+
+        return Process::result();
+    });
+}
+
+/**
+ * The last content written to $file on the server, with Server::uploadProxyFile() or with
+ * `echo '<base64>' | base64 -d | tee $file`.
+ *
+ * @param  array<int, string>  $lines  remote script lines (see Process::assertRan)
+ */
+function writtenProxyFile(array $lines, string $file): ?string
+{
+    $content = null;
+    foreach ($lines as $line) {
+        if (preg_match('#mv -f (/tmp/coolify-upload-[0-9a-f]+) '.preg_quote($file, '#').'$#', $line, $matches)) {
+            $content = $GLOBALS['proxyFileUploads'][$matches[1]] ?? null;
+        } elseif (str_contains($line, "tee $file") && preg_match("/echo '([A-Za-z0-9+\/=]+)'/", $line, $matches)) {
+            $content = base64_decode($matches[1]);
+        }
+    }
+
+    return $content;
+}
diff --git a/tests/Support/ConcurrentMetricsClient.php b/tests/Support/ConcurrentMetricsClient.php
new file mode 100644
index 0000000000..278d92b95d
--- /dev/null
+++ b/tests/Support/ConcurrentMetricsClient.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace Tests\Support;
+
+use App\Services\SentinelMetricsClient;
+
+class ConcurrentMetricsClient extends SentinelMetricsClient
+{
+    public function summary(): ?array
+    {
+        return [
+            'online' => true, 'cpu' => 25.0, 'memUsed' => 100, 'memTotal' => 200,
+            'diskUsed' => 10, 'diskTotal' => 100, 'diskPercent' => 10.0,
+            'load1' => 0.4, 'netRx' => 5.0, 'netTx' => 1.0,
+        ];
+    }
+
+    public function containersCurrent(): array
+    {
+        return [['id' => 'container-'.$this->server->uuid, 'cpu' => 25.0]];
+    }
+
+    public function history(string $metric, string $range): array
+    {
+        if ($metric === 'disk') {
+            throw new \RuntimeException('Disk endpoint unavailable.');
+        }
+
+        return [[1000, $metric === 'cpu' ? 25.0 : 100.0]];
+    }
+
+    public function networkHistory(string $range): array
+    {
+        return ['rx' => [[1000, 5.0]], 'tx' => [[1000, 1.0]]];
+    }
+}
diff --git a/tests/Unit/Actions/Server/ConfigureAutomaticSecurityUpdatesTest.php b/tests/Unit/Actions/Server/ConfigureAutomaticSecurityUpdatesTest.php
new file mode 100644
index 0000000000..2e3afb22dc
--- /dev/null
+++ b/tests/Unit/Actions/Server/ConfigureAutomaticSecurityUpdatesTest.php
@@ -0,0 +1,124 @@
+<?php
+
+use App\Actions\Server\ConfigureAutomaticSecurityUpdates;
+use App\Models\Server;
+
+/**
+ * @param  list<string>  $commands
+ * @return list<string>
+ */
+function autoSecurityUpdatesDecodedPayloads(array $commands): array
+{
+    preg_match_all("/echo '?([A-Za-z0-9+\/=]{8,})'? \| base64 -d/", implode("\n", $commands), $matches);
+
+    return array_map(fn (string $payload) => base64_decode($payload, true), $matches[1]);
+}
+
+function autoSecurityUpdatesNonRootServer(): Server
+{
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+    $server->shouldReceive('setAttribute')->andReturnSelf();
+    $server->user = 'ubuntu';
+
+    return $server;
+}
+
+afterEach(function () {
+    Mockery::close();
+});
+
+test('only apt and dnf support automatic security updates', function (?string $packageManager, bool $supported) {
+    expect(ConfigureAutomaticSecurityUpdates::supportFor($packageManager))->toBe($supported);
+})->with([
+    ['apt', true],
+    ['dnf', true],
+    ['zypper', false],
+    ['apk', false],
+    ['pacman', false],
+    [null, false],
+]);
+
+test('apt installs unattended-upgrades and allows only the security origins at the chosen time', function () {
+    $commands = ConfigureAutomaticSecurityUpdates::commands('apt', true, '04:30');
+    [$config, $dropIn] = autoSecurityUpdatesDecodedPayloads($commands);
+
+    expect($commands[0])->toContain('command -v unattended-upgrade')
+        ->toContain('DEBIAN_FRONTEND=noninteractive apt-get install -y unattended-upgrades')
+        ->and(implode("\n", $commands))
+        ->toContain('tee /etc/apt/apt.conf.d/52coolify-unattended-upgrades > /dev/null')
+        ->toContain('tee /etc/systemd/system/apt-daily-upgrade.timer.d/coolify.conf > /dev/null')
+        ->toContain('chmod 644 /etc/apt/apt.conf.d/52coolify-unattended-upgrades /etc/systemd/system/apt-daily-upgrade.timer.d/coolify.conf')
+        ->and($commands)->toContain('systemctl daemon-reload')
+        ->toContain('systemctl enable --now apt-daily.timer apt-daily-upgrade.timer')
+        ->and($config)
+        ->toContain('APT::Periodic::Unattended-Upgrade "1";')
+        ->toContain('#clear Unattended-Upgrade::Allowed-Origins;')
+        ->toContain('#clear Unattended-Upgrade::Origins-Pattern;')
+        ->toContain('"origin=Debian,codename=${distro_codename}-security,label=Debian-Security";')
+        ->toContain('"origin=Ubuntu,archive=${distro_codename}-security";')
+        ->not->toContain('archive=${distro_codename}-updates')
+        ->and($dropIn)->toBe("[Timer]\nOnCalendar=\nOnCalendar=*-*-* 04:30\nRandomizedDelaySec=0\n");
+});
+
+test('apt disable removes only the Coolify files', function () {
+    expect(ConfigureAutomaticSecurityUpdates::commands('apt', false, '03:00'))->toBe([
+        'rm -f /etc/apt/apt.conf.d/52coolify-unattended-upgrades /etc/systemd/system/apt-daily-upgrade.timer.d/coolify.conf',
+        'systemctl daemon-reload',
+    ]);
+});
+
+test('dnf installs dnf-automatic, applies only security updates and sets the timer of dnf4 or dnf5', function () {
+    $commands = ConfigureAutomaticSecurityUpdates::commands('dnf', true, '22:15');
+    [$dropIn] = autoSecurityUpdatesDecodedPayloads($commands);
+
+    expect($commands[0])->toBe('dnf install -y dnf-automatic')
+        ->and($commands[1])
+        ->toContain('f=/etc/dnf/automatic.conf')
+        ->toContain('(upgrade_type|apply_updates)[[:space:]]*=/d')
+        ->toContain('a upgrade_type = security')
+        ->toContain('a apply_updates = yes')
+        ->and($commands[2])
+        ->toContain('t=dnf-automatic.timer; if [ -e /usr/lib/systemd/system/dnf5-automatic.timer ]; then t=dnf5-automatic.timer; fi;')
+        ->toContain('/etc/systemd/system/$t.d/coolify.conf')
+        ->toContain('systemctl enable --now $t')
+        ->and($dropIn)->toBe("[Timer]\nOnCalendar=\nOnCalendar=*-*-* 22:15\nRandomizedDelaySec=0\n");
+});
+
+test('dnf disable stops the timer and removes the Coolify drop-in', function () {
+    $commands = ConfigureAutomaticSecurityUpdates::commands('dnf', false, '03:00');
+
+    expect($commands)->toHaveCount(1)
+        ->and($commands[0])
+        ->toContain('systemctl disable --now $t')
+        ->toContain('rm -f /etc/systemd/system/$t.d/coolify.conf')
+        ->toContain('systemctl daemon-reload')
+        ->not->toContain('automatic.conf');
+});
+
+test('every command runs as root for a non-root SSH user', function (string $packageManager, bool $enabled) {
+    $commands = ConfigureAutomaticSecurityUpdates::commands($packageManager, $enabled, '03:00');
+
+    $parsed = parseCommandsByLineForSudo(collect($commands), autoSecurityUpdatesNonRootServer());
+
+    foreach ($parsed as $line) {
+        $isSudoLine = str_starts_with($line, 'sudo ') && ! str_contains($line, ' | ');
+        $isSudoShellScript = isSingleSudoShellScript($line) && substr_count($line, 'sudo') === 1;
+        $isSudoTeePipe = preg_match("/^echo '[A-Za-z0-9+\/=]+' \| sudo base64 -d \| sudo tee \/etc\/\S+ > \/dev\/null$/", $line) === 1;
+
+        expect($isSudoLine || $isSudoShellScript || $isSudoTeePipe)->toBeTrue("Line does not run as root: {$line}");
+    }
+})->with([
+    'apt enabled' => ['apt', true],
+    'apt disabled' => ['apt', false],
+    'dnf enabled' => ['dnf', true],
+    'dnf disabled' => ['dnf', false],
+]);
+
+test('handle rejects a time that is not HH:MM', function (string $time) {
+    ConfigureAutomaticSecurityUpdates::run(new Server, 'apt', true, $time);
+})->throws(InvalidArgumentException::class)->with(['24:00', '3:00', '03:60', '03:00; reboot', '']);
+
+test('handle rejects an unsupported package manager', function () {
+    ConfigureAutomaticSecurityUpdates::run(new Server, 'zypper', true, '03:00');
+})->throws(RuntimeException::class);
diff --git a/tests/Unit/Actions/Server/ServerPatchCommandsTest.php b/tests/Unit/Actions/Server/ServerPatchCommandsTest.php
new file mode 100644
index 0000000000..1d9c777eeb
--- /dev/null
+++ b/tests/Unit/Actions/Server/ServerPatchCommandsTest.php
@@ -0,0 +1,212 @@
+<?php
+
+use App\Actions\Server\CheckUpdates;
+use App\Actions\Server\UpdatePackage;
+use App\Models\Server;
+
+function patchCommandsNonRootServer(): Server
+{
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+    $server->shouldReceive('setAttribute')->andReturnSelf();
+    $server->user = 'ubuntu';
+
+    return $server;
+}
+
+afterEach(function () {
+    Mockery::close();
+});
+
+it('updates apt packages without prompts and keeps changed configuration files', function () {
+    expect(UpdatePackage::commands('apt'))->toBe([
+        'env DEBIAN_FRONTEND=noninteractive apt-get update -qq',
+        'env DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold upgrade',
+    ])->and(UpdatePackage::commands('apt', "'openssl'"))->toBe([
+        'env DEBIAN_FRONTEND=noninteractive apt-get update -qq',
+        "env DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold install --only-upgrade 'openssl'",
+    ]);
+});
+
+it('runs the apt update commands with sudo for a non-root user', function () {
+    $parsed = parseCommandsByLineForSudo(collect(UpdatePackage::commands('apt', "'openssl'")), patchCommandsNonRootServer());
+
+    expect($parsed)->toBe([
+        'sudo env DEBIAN_FRONTEND=noninteractive apt-get update -qq',
+        "sudo env DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold install --only-upgrade 'openssl'",
+    ]);
+});
+
+it('allows only a full system upgrade on Arch Linux', function () {
+    expect(UpdatePackage::commands('pacman'))->toBe(['pacman -Syu --noconfirm'])
+        ->and(UpdatePackage::commands('pacman', "'curl'"))->toBeNull();
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->shouldReceive('serverStatus')->andReturn(true);
+
+    expect(UpdatePackage::run($server, 'arch', 'curl', 'pacman'))
+        ->toHaveKey('error', 'This operating system supports only a full system upgrade. Use "Update all packages".');
+});
+
+it('runs the pacman check as one sudo shell script for a non-root user', function () {
+    $parsed = parseCommandsByLineForSudo(collect([CheckUpdates::PACMAN_CHECK_COMMAND]), patchCommandsNonRootServer());
+
+    expect($parsed)->toBe(['sudo '.CheckUpdates::PACMAN_CHECK_COMMAND])
+        ->and(CheckUpdates::PACMAN_CHECK_COMMAND)->not->toContain('pacman -Sy --noconfirm')
+        ->and(CheckUpdates::PACMAN_CHECK_COMMAND)->toContain('--dbpath');
+});
+
+it('parses checkupdates output', function () {
+    $output = <<<'OUTPUT'
+libarchive 3.8.9-1 -> 3.8.10-1
+zlib 1:1.3.2-3 -> 1:1.3.2-4
+OUTPUT;
+
+    expect((new CheckUpdates)->parsePacmanOutput($output)['updates'])->toBe([
+        ['package' => 'libarchive', 'current_version' => '3.8.9-1', 'new_version' => '3.8.10-1', 'architecture' => 'unknown', 'repository' => 'unknown'],
+        ['package' => 'zlib', 'current_version' => '1:1.3.2-3', 'new_version' => '1:1.3.2-4', 'architecture' => 'unknown', 'repository' => 'unknown'],
+    ]);
+});
+
+it('parses dnf4 repoquery output with the installed versions and without the arch suffix', function () {
+    // Rocky Linux 9 (dnf 4.14): dnf4 adds its own newline after --qf, so every second line is empty.
+    $upgrades = "acl x86_64 2.4.0-1.el9_8 baseos\n\nopenssl x86_64 1:3.5.8-2.el9_8 baseos\n\npython3.11 x86_64 3.11.13-1.el9 appstream\n\n";
+    $installed = "acl x86_64 2.3.1-3.el9\nopenssl x86_64 3.0.1-41.el9_0\nbash x86_64 5.1.8-4.el9\n";
+
+    expect((new CheckUpdates)->parseDnfOutput($upgrades, $installed))->toBe([
+        'total_updates' => 3,
+        'updates' => [
+            ['package' => 'acl', 'new_version' => '2.4.0-1.el9_8', 'repository' => 'baseos', 'architecture' => 'x86_64', 'current_version' => '2.3.1-3.el9'],
+            ['package' => 'openssl', 'new_version' => '1:3.5.8-2.el9_8', 'repository' => 'baseos', 'architecture' => 'x86_64', 'current_version' => '3.0.1-41.el9_0'],
+            ['package' => 'python3.11', 'new_version' => '3.11.13-1.el9', 'repository' => 'appstream', 'architecture' => 'x86_64', 'current_version' => 'unknown'],
+        ],
+    ]);
+});
+
+it('parses dnf5 repoquery output', function () {
+    // Fedora 44 (dnf 5.4).
+    $upgrades = "ca-certificates noarch 2026.2.90_v9.0.317-1.fc44 updates\ncurl x86_64 8.18.0-14.fc44 updates\n";
+    $installed = "curl x86_64 8.18.0-12.fc44\n";
+
+    $updates = (new CheckUpdates)->parseDnfOutput($upgrades, $installed)['updates'];
+
+    expect($updates)->toHaveCount(2)
+        ->and($updates[0])->toMatchArray(['package' => 'ca-certificates', 'architecture' => 'noarch', 'current_version' => 'unknown'])
+        ->and($updates[1])->toMatchArray(['package' => 'curl', 'new_version' => '8.18.0-14.fc44', 'current_version' => '8.18.0-12.fc44']);
+});
+
+it('updates a dnf package by its name', function () {
+    expect(UpdatePackage::commands('dnf', "'python3.11'"))->toBe(["dnf upgrade -y 'python3.11'"]);
+});
+
+it('marks apt updates from a security suite', function () {
+    // Ubuntu 24.04 and Debian 12 (now oldstable-security) `apt list --upgradable` lines.
+    $output = <<<'OUTPUT'
+Listing... Done
+libsystemd0/noble-security 255.4-1ubuntu8.18 amd64 [upgradable from: 255.4-1ubuntu8.17]
+openssl/noble-updates,noble-security 3.0.13-0ubuntu3.4 amd64 [upgradable from: 3.0.13-0ubuntu3.1]
+perl-base/oldstable-security 5.36.0-7+deb12u4 amd64 [upgradable from: 5.36.0-7+deb12u3]
+curl/noble-updates 8.5.0-2ubuntu10.6 amd64 [upgradable from: 8.5.0-2ubuntu10.1]
+OUTPUT;
+    $action = new CheckUpdates;
+
+    $result = $action->addUpdateDetails($action->parseAptOutput($output), 'apt');
+
+    expect(collect($result['updates'])->pluck('security', 'package')->all())->toBe([
+        'libsystemd0' => true,
+        'openssl' => true,
+        'perl-base' => true,
+        'curl' => false,
+    ])->and($result['security_updates'])->toBe(3)
+        ->and($result['updates'][0]['risk'])->toBe('system');
+});
+
+it('reads the security packages of dnf4 and dnf5 advisories', function () {
+    // Rocky Linux 9 (dnf4) and Fedora 42 (dnf5) `dnf updateinfo list --security`.
+    $dnf4 = <<<'OUTPUT'
+RLSA-2026:42736 Important/Sec. acl-2.4.0-1.el9_8.x86_64
+RLSA-2023:0340  Moderate/Sec.  bash-5.1.8-6.el9_1.x86_64
+RLSA-2025:23343 Moderate/Sec.  binutils-gold-2.35.2-67.el9_7.1.x86_64
+OUTPUT;
+    $dnf5 = <<<'OUTPUT'
+Name                   Type     Severity                              Package              Issued
+FEDORA-2026-11d7d4d8f3 security Moderate     vim-data-2:9.2.390-1.fc42.noarch 2026-05-07 01:26:58
+FEDORA-2026-7af660d639 security Moderate   openssl-libs-1:3.2.6-4.fc42.x86_64 2026-05-08 01:24:13
+OUTPUT;
+    $action = new CheckUpdates;
+
+    expect($action->parseDnfSecurityPackages($dnf4))->toBe(['acl', 'bash', 'binutils-gold'])
+        ->and($action->parseDnfSecurityPackages($dnf5))->toBe(['vim-data', 'openssl-libs']);
+
+    $result = $action->addUpdateDetails(['updates' => [
+        ['package' => 'openssl-libs', 'repository' => 'updates'],
+        ['package' => 'kernel-core', 'repository' => 'updates'],
+    ]], 'dnf', $action->parseDnfSecurityPackages($dnf5));
+
+    expect($result['security_updates'])->toBe(1)
+        ->and($result['updates'][0]['security'])->toBeTrue()
+        ->and($result['updates'][1])->toMatchArray(['security' => false, 'risk' => 'kernel']);
+});
+
+it('reads the packages that zypper security patches upgrade', function () {
+    $output = <<<'XML'
+<?xml version='1.0'?>
+<stream>
+<message type="info">Loading repository data...</message>
+<install-summary download-size="1024" space-usage-diff="0" packages-to-change="3">
+<to-install>
+<solvable type="patch" kind="patch" name="openSUSE-SLE-15.6-2024-1234" edition="1" arch="noarch"/>
+</to-install>
+<to-upgrade>
+<solvable type="package" kind="package" name="openssh" edition="9.6p1-150600.6.3.1" arch="x86_64" edition-old="9.6p1-150600.6.1"/>
+<solvable kind="package" name="libopenssl3" edition="3.1.4-150600.5.7.1" arch="x86_64"/>
+</to-upgrade>
+</install-summary>
+</stream>
+XML;
+
+    expect((new CheckUpdates)->parseZypperSecurityPackages($output))->toBe(['openssh', 'libopenssl3'])
+        ->and((new CheckUpdates)->parseZypperSecurityPackages('<stream><message>Nothing to do.</message></stream>'))->toBe([]);
+});
+
+it('does not report a security count when the package manager cannot tell', function () {
+    $result = (new CheckUpdates)->addUpdateDetails(['updates' => [['package' => 'linux', 'repository' => 'unknown']]], 'pacman');
+
+    expect($result['security_updates'])->toBeNull()
+        ->and($result['updates'][0])->toMatchArray(['security' => false, 'risk' => 'kernel']);
+});
+
+it('classifies risky packages per package manager', function (string $packageManager, string $package, ?string $risk) {
+    expect(CheckUpdates::riskFor($packageManager, $package))->toBe($risk);
+})->with([
+    ['apt', 'docker-ce', 'docker'],
+    ['apt', 'containerd.io', 'docker'],
+    ['apt', 'linux-image-6.8.0-45-generic', 'kernel'],
+    ['apt', 'libc6', 'system'],
+    ['apt', 'openssh-server', 'system'],
+    ['apt', 'docker-compose', null],
+    ['apt', 'linux-firmware', null],
+    ['apt', 'curl', null],
+    ['dnf', 'kernel-core', 'kernel'],
+    ['dnf', 'glibc', 'system'],
+    ['dnf', 'moby-engine', 'docker'],
+    ['zypper', 'kernel-default', 'kernel'],
+    ['pacman', 'linux-lts', 'kernel'],
+    ['pacman', 'linux-firmware', null],
+    ['apk', 'docker-engine', 'docker'],
+    ['apk', 'musl', 'system'],
+]);
+
+it('reads the reboot status and runs its check as one sudo shell script', function () {
+    $action = new CheckUpdates;
+
+    expect($action->parseRebootStatus("REBOOT=yes\n"))->toBeTrue()
+        ->and($action->parseRebootStatus("REBOOT=no\n"))->toBeFalse()
+        ->and($action->parseRebootStatus("REBOOT=unknown\n"))->toBeNull()
+        ->and($action->parseRebootStatus(''))->toBeNull();
+
+    $server = patchCommandsNonRootServer();
+    foreach ([CheckUpdates::REBOOT_CHECK_COMMAND, CheckUpdates::DNF_SECURITY_COMMAND, CheckUpdates::ZYPPER_SECURITY_COMMAND] as $command) {
+        expect(parseCommandsByLineForSudo(collect([$command]), $server))->toBe(['sudo '.$command]);
+    }
+});
diff --git a/tests/Unit/ApplicationDeploymentErrorLoggingTest.php b/tests/Unit/ApplicationDeploymentErrorLoggingTest.php
index adc194ca0b..39ee65b4d3 100644
--- a/tests/Unit/ApplicationDeploymentErrorLoggingTest.php
+++ b/tests/Unit/ApplicationDeploymentErrorLoggingTest.php
@@ -17,7 +17,8 @@ use Illuminate\Queue\TimeoutExceededException;
  * - The exception code (if present)
  * - The file and line where the error occurred
  * - Previous exception details (if chained)
- * - Stack trace (first 5 lines)
+ *
+ * Stack traces are not written, because their truncated arguments can hold secrets.
  */
 it('logs comprehensive error details when failed() is called', function () {
     // Create a mock exception with all properties
@@ -111,7 +112,7 @@ it('logs comprehensive error details when failed() is called', function () {
     expect($errorMessageString)->toContain('Location:');
     expect($errorMessageString)->toContain('Caused by:');
     expect($errorMessageString)->toContain('RuntimeException: Connection refused');
-    expect($errorMessageString)->toContain('Stack trace');
+    expect($errorMessageString)->not->toContain('Stack trace');
 
     // Verify stderr type is used for error logging
     $stderrEntries = array_filter($logEntries, fn ($entry) => $entry['type'] === 'stderr');
@@ -131,9 +132,6 @@ it('logs comprehensive error details when failed() is called', function () {
     $locationEntry = collect($logEntries)->first(fn ($entry) => str_contains($entry['message'], 'Location:'));
     expect($locationEntry['hidden'])->toBeTrue();
 
-    $stackTraceEntry = collect($logEntries)->first(fn ($entry) => str_contains($entry['message'], 'Stack trace'));
-    expect($stackTraceEntry['hidden'])->toBeTrue();
-
     $causedByEntry = collect($logEntries)->first(fn ($entry) => str_contains($entry['message'], 'Caused by:'));
     expect($causedByEntry['hidden'])->toBeTrue();
 });
diff --git a/tests/Unit/ApplicationDeploymentRailpackConfigTest.php b/tests/Unit/ApplicationDeploymentRailpackConfigTest.php
index 1a6297153a..61deef08f2 100644
--- a/tests/Unit/ApplicationDeploymentRailpackConfigTest.php
+++ b/tests/Unit/ApplicationDeploymentRailpackConfigTest.php
@@ -260,6 +260,23 @@ it('pins docker config while running railpack buildx commands', function () {
         ->toContain('DOCKER_CONFIG=/root/.docker docker buildx build --builder coolify-railpack');
 });
 
+it('stops the railpack builder after the build when no other build uses it', function () {
+    [$job, $reflection] = makeRailpackDeploymentJob([
+        'uuid' => 'application-uuid',
+    ]);
+
+    $command = invokeRailpackMethod($job, $reflection, 'railpack_build_command', ['coollabsio/coolify:test', collect([])]);
+
+    $sharedLock = strpos($command, 'flock -s 9');
+    $build = strpos($command, 'docker buildx build --builder coolify-railpack');
+    $stop = strpos($command, 'if flock -n -x 9; then DOCKER_CONFIG=/root/.docker docker buildx stop coolify-railpack');
+
+    expect($sharedLock)->not->toBeFalse()
+        ->and($build)->toBeGreaterThan($sharedLock)
+        ->and($stop)->toBeGreaterThan($build)
+        ->and($command)->toEndWith('exit $status');
+});
+
 it('filters reserved docker client variables from railpack build secrets', function () {
     [$job, $reflection] = makeRailpackDeploymentJob([
         'uuid' => 'application-uuid',
@@ -439,7 +456,7 @@ it('creates an empty build-time env file for railpack when there are no generate
     foreach ([
         'application_deployment_queue' => new class extends ApplicationDeploymentQueue
         {
-            public function addLogEntry(string $message, string $type = 'stdout', bool $hidden = false): void {}
+            public function addLogEntry(string $message, string $type = 'stdout', bool $hidden = false, ?string $command = null, int $batch = 1): void {}
         },
         'build_pack' => 'railpack',
         'pull_request_id' => 0,
diff --git a/tests/Unit/ApplicationDeploymentRailpackEnvParityTest.php b/tests/Unit/ApplicationDeploymentRailpackEnvParityTest.php
index 1dda8b8c3e..0b7d5406c9 100644
--- a/tests/Unit/ApplicationDeploymentRailpackEnvParityTest.php
+++ b/tests/Unit/ApplicationDeploymentRailpackEnvParityTest.php
@@ -81,13 +81,13 @@ it('generates escaped railpack env args from resolved values and includes instal
         'RAILPACK_CUSTOM_FLAG' => 'hello world',
         'RAILPACK_JSON' => '{"token":"abc"}',
         'RAILPACK_INSTALL_CMD' => 'npm ci && npm run postinstall',
-        'RAILPACK_DEPLOY_APT_PACKAGES' => 'curl wget',
+        'RAILPACK_DEPLOY_APT_PACKAGES' => '... curl wget',
     ]);
     expect($envArgs)->toContain("--env 'RAILPACK_NODE_VERSION=22'");
     expect($envArgs)->toContain("--env 'RAILPACK_CUSTOM_FLAG=hello world'");
     expect($envArgs)->toContain("--env 'RAILPACK_JSON={\"token\":\"abc\"}'");
     expect($envArgs)->toContain("--env 'RAILPACK_INSTALL_CMD=npm ci && npm run postinstall'");
-    expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=curl wget'");
+    expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=... curl wget'");
     expect($envArgs)->not->toContain('RAILPACK_NULL');
 });
 
@@ -136,7 +136,7 @@ it('uses preview railpack environment variables for preview deployments', functi
 
     expect($variables->all())->toBe([
         'RAILPACK_PREVIEW_ONLY' => 'preview-value',
-        'RAILPACK_DEPLOY_APT_PACKAGES' => 'curl wget',
+        'RAILPACK_DEPLOY_APT_PACKAGES' => '... curl wget',
     ]);
 });
 
@@ -195,7 +195,7 @@ it('merges coolify env variables into railpack build variables', function () {
 
     expect($variables->all())->toBe([
         'MY_BUILD_VAR' => 'hello',
-        'RAILPACK_DEPLOY_APT_PACKAGES' => 'curl wget',
+        'RAILPACK_DEPLOY_APT_PACKAGES' => '... curl wget',
         'COOLIFY_URL' => 'https://app.example.com',
         'COOLIFY_FQDN' => 'app.example.com',
         'COOLIFY_BRANCH' => 'main',
@@ -209,7 +209,7 @@ it('merges coolify env variables into railpack build variables', function () {
 
     expect($envArgs)->toContain("--env 'COOLIFY_URL=https://app.example.com'");
     expect($envArgs)->toContain("--env 'SOURCE_COMMIT=abc123'");
-    expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=curl wget'");
+    expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=... curl wget'");
     expect($envArgs)->not->toContain('EMPTY_VAR');
     expect($envArgs)->not->toContain('NULL_VAR');
 });
@@ -257,11 +257,11 @@ it('preserves user railpack deploy apt packages while adding healthcheck tools o
     $method->setAccessible(true);
     $variables = $method->invoke($job);
 
-    expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('ffmpeg curl wget');
+    expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('... ffmpeg curl wget');
 
     $envArgsProperty = $reflection->getProperty('env_railpack_args');
     $envArgsProperty->setAccessible(true);
     $envArgs = $envArgsProperty->getValue($job);
 
-    expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=ffmpeg curl wget'");
+    expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=... ffmpeg curl wget'");
 });
diff --git a/tests/Unit/CdnHttpRetryTest.php b/tests/Unit/CdnHttpRetryTest.php
new file mode 100644
index 0000000000..740461d28c
--- /dev/null
+++ b/tests/Unit/CdnHttpRetryTest.php
@@ -0,0 +1,52 @@
+<?php
+
+use Carbon\CarbonInterval;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Sleep;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+beforeEach(function () {
+    Sleep::fake();
+    $this->sleptSeconds = [];
+    Sleep::whenFakingSleep(fn (CarbonInterval $duration) => $this->sleptSeconds[] = $duration->totalSeconds);
+});
+
+it('waits for the Retry-After of a Cloudflare 1200 response before it retries', function () {
+    Http::fakeSequence()
+        ->push('error code: 1200', 503, ['Retry-After' => '60'])
+        ->push(['coolify' => ['helper' => ['version' => '1.0.0']]], 200);
+
+    $response = cdn_http()->get('https://cdn.example.com/coolify/versions.json');
+
+    expect($response->successful())->toBeTrue();
+    Http::assertSentCount(2);
+    expect($this->sleptSeconds)->toHaveCount(1)
+        ->and($this->sleptSeconds[0])->toBeGreaterThanOrEqual(60)->toBeLessThanOrEqual(120);
+});
+
+it('backs off exponentially when the response has no Retry-After', function () {
+    Http::fakeSequence()
+        ->push('', 502)
+        ->push('', 502)
+        ->push('', 502);
+
+    $response = cdn_http()->get('https://cdn.example.com/coolify/versions.json');
+
+    expect($response->status())->toBe(502);
+    Http::assertSentCount(3);
+    expect($this->sleptSeconds)->toHaveCount(2)
+        ->and($this->sleptSeconds[0])->toBeGreaterThanOrEqual(2)->toBeLessThanOrEqual(4)
+        ->and($this->sleptSeconds[1])->toBeGreaterThanOrEqual(4)->toBeLessThanOrEqual(8);
+});
+
+it('does not retry a client error', function () {
+    Http::fakeSequence()->push('', 404);
+
+    $response = cdn_http()->get('https://cdn.example.com/coolify/versions.json');
+
+    expect($response->status())->toBe(404);
+    Http::assertSentCount(1);
+    Sleep::assertNeverSlept();
+});
diff --git a/tests/Unit/CheckForUpdatesJobTest.php b/tests/Unit/CheckForUpdatesJobTest.php
index 0b04224c5e..45d1f61942 100644
--- a/tests/Unit/CheckForUpdatesJobTest.php
+++ b/tests/Unit/CheckForUpdatesJobTest.php
@@ -8,6 +8,7 @@ use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Sleep;
 use Tests\TestCase;
 
 uses(TestCase::class, RefreshDatabase::class);
@@ -163,3 +164,21 @@ it('preserves other component versions when preventing Coolify downgrade', funct
     $job = new CheckForUpdatesJob;
     $job->handle();
 });
+
+it('keeps the local versions.json when the CDN fetch fails', function () {
+    Http::fake(['*' => Http::response('', 500)]);
+    File::shouldReceive('put')->never();
+    Cache::shouldReceive('forget')->never();
+
+    expect(refresh_versions_file())->toBeNull();
+});
+
+it('makes only one CDN request for a manual check, so the web request does not wait for retries', function () {
+    Sleep::fake();
+    Http::fake(['*' => Http::response('error code: 1200', 503, ['Retry-After' => '60'])]);
+
+    (new CheckForUpdatesJob(cdnTries: 1))->handle();
+
+    Http::assertSentCount(1);
+    Sleep::assertNeverSlept();
+});
diff --git a/tests/Unit/CloudProviderTokenFormViewTest.php b/tests/Unit/CloudProviderTokenFormViewTest.php
index 58e0e60777..f5666a0b39 100644
--- a/tests/Unit/CloudProviderTokenFormViewTest.php
+++ b/tests/Unit/CloudProviderTokenFormViewTest.php
@@ -1,5 +1,47 @@
 <?php
 
+it('allows selecting Vultr in cloud provider token forms', function () {
+    $view = file_get_contents(__DIR__.'/../../resources/views/livewire/security/cloud-provider-token-form.blade.php');
+    $component = file_get_contents(__DIR__.'/../../app/Livewire/Security/CloudProviderTokenForm.php');
+
+    expect($view)->toContain('<x-forms.listbox required id="provider" label="Provider"')
+        ->and($view)->toContain("['value' => 'vultr', 'label' => 'Vultr']")
+        ->and($view)->toContain("['value' => 'digitalocean', 'label' => 'DigitalOcean']")
+        ->and($view)->toContain("['value' => 'hostinger', 'label' => 'Hostinger']")
+        ->and(substr_count($view, 'https://console.vultr.com/user/apiaccess/'))->toBe(1)
+        ->and($view)->not->toContain('cloudProviderTokens->where(\'provider\', $provider)->isEmpty()')
+        ->and($view)->not->toContain('<x-forms.select required id="provider" label="Provider" disabled>')
+        ->and($component)->toContain("'provider' => 'required|string|in:hetzner,digitalocean,vultr,hostinger'");
+});
+
+it('keeps provider affiliate links on server provider views', function () {
+    $tokenFormView = file_get_contents(__DIR__.'/../../resources/views/livewire/security/cloud-provider-token-form.blade.php');
+    $hetznerView = file_get_contents(__DIR__.'/../../resources/views/livewire/server/new/by-hetzner.blade.php');
+    $vultrView = file_get_contents(__DIR__.'/../../resources/views/livewire/server/new/by-vultr.blade.php');
+    $digitalOceanView = file_get_contents(__DIR__.'/../../resources/views/livewire/server/new/by-digital-ocean.blade.php');
+
+    expect($tokenFormView)
+        ->not->toContain('https://coolify.io/hetzner')
+        ->not->toContain('https://coolify.io/vultr')
+        ->and($hetznerView)->toContain('https://coolify.io/hetzner')
+        ->and($vultrView)->toContain('https://coolify.io/vultr')
+        ->and($digitalOceanView)->toContain('https://coolify.io/digitalocean');
+});
+
+it('uses the shared modal form on the cloud provider tokens page', function () {
+    $view = file_get_contents(__DIR__.'/../../resources/views/livewire/security/cloud-provider-tokens.blade.php');
+
+    expect($view)->toContain('New token')
+        ->and($view)->toContain('<x-application.settings-section title="Cloud tokens"')
+        ->and($view)->toContain('<livewire:security.cloud-provider-token-form :modal_mode="true"')
+        ->and($view)->toContain("\$savedToken->provider === 'digitalocean' ? 'DigitalOcean' : ucfirst(\$savedToken->provider)")
+        ->and($view)->not->toContain('<h3>New Token</h3>')
+        ->and($view)->not->toContain(':modal_mode="false"')
+        ->and($view)->not->toContain('wire:click="validateToken')
+        ->and($view)->not->toContain('submitAction="deleteToken')
+        ->and($view)->not->toContain('Created {{ $savedToken->created_at->diffForHumans() }}');
+});
+
 it('gates new cloud tokens and keys saved token rows by id', function () {
     $view = file_get_contents(__DIR__.'/../../resources/views/livewire/security/cloud-provider-tokens.blade.php');
 
diff --git a/tests/Unit/CoolifyUpgradeStatusTest.php b/tests/Unit/CoolifyUpgradeStatusTest.php
index 1302e97370..dcc074da7d 100644
--- a/tests/Unit/CoolifyUpgradeStatusTest.php
+++ b/tests/Unit/CoolifyUpgradeStatusTest.php
@@ -147,5 +147,7 @@ it('does not detect a running upgrade for empty or malformed status', function (
 })->with([
     'empty' => '',
     'missing fields' => '3|Pulling Docker images',
+    'blank timestamp' => '3|Pulling Docker images|',
+    'whitespace timestamp' => "3|Pulling Docker images| \t",
     'invalid timestamp' => '3|Pulling Docker images|not-a-date',
 ]);
diff --git a/tests/Unit/DatabaseImport/DatabaseImportCommandBuilderTest.php b/tests/Unit/DatabaseImport/DatabaseImportCommandBuilderTest.php
index 9307689c47..c6966c1706 100644
--- a/tests/Unit/DatabaseImport/DatabaseImportCommandBuilderTest.php
+++ b/tests/Unit/DatabaseImport/DatabaseImportCommandBuilderTest.php
@@ -83,8 +83,8 @@ test('restores dump-all PostgreSQL custom archives with pg_restore from the deco
 
     // pg_restore cannot read gzip files, so it must receive the decompressed archive on stdin.
     expect($command)
-        ->toContain('stream | pg_restore -U ${POSTGRES_USER} -d "$db"')
-        ->toContain('stream | psql -U ${POSTGRES_USER} -d "$db"')
+        ->toContain('stream | pg_restore -U "$pg_user" -d "$db"')
+        ->toContain('stream | psql -U "$pg_user" -d "$db"')
         ->not->toContain("-d \"\$db\" '/tmp/backup.dump.gz'");
 });
 
diff --git a/tests/Unit/DatabaseImport/DatabaseImportRestoreScriptTest.php b/tests/Unit/DatabaseImport/DatabaseImportRestoreScriptTest.php
index d5cb871d95..f7007689d6 100644
--- a/tests/Unit/DatabaseImport/DatabaseImportRestoreScriptTest.php
+++ b/tests/Unit/DatabaseImport/DatabaseImportRestoreScriptTest.php
@@ -235,7 +235,7 @@ function restoreScriptResource(string $engine): object
 /**
  * @return array{exit: int, stdout: string, stderr: string, calls: list<array{name: string, args: string, header: string, stdin: string}>, dir: string, backup: string, leftovers: list<string>}
  */
-function restoreScriptRun(string $engine, string $contents, bool $dumpAll = false, bool $replaceExisting = false, bool $keepOwners = false, bool $restoreMysqlUsers = false): array
+function restoreScriptRun(string $engine, string $contents, bool $dumpAll = false, bool $replaceExisting = false, bool $keepOwners = false, bool $restoreMysqlUsers = false, array $env = []): array
 {
     $dir = restoreScriptTempDir();
 
@@ -257,6 +257,11 @@ if [ ! -t 0 ]; then
     header=\$(head -c 5 {$escapedStdin}/\$call)
 fi
 printf '%s|%s|%s\\n' '{$client}' "\$*" "\$header" >> {$escapedLog}
+if [ -n "\${STUB_FAIL_MATCH:-}" ]; then
+    case "\$*" in *"\$STUB_FAIL_MATCH"*) exit 1 ;; esac
+fi
+case "\$*" in *"SELECT datname FROM pg_database"*) printf '%s\\n' "\${STUB_DATABASES:-}" ;; esac
+case "\$*" in *rolsuper*) printf '%s\\n' "\${STUB_ROLSUPER-t}" ;; esac
 exit 0
 SH);
             chmod($dir.'/bin/'.$client, 0755);
@@ -267,7 +272,7 @@ SH);
 
         $script = (new DatabaseImportCommandBuilder)->buildRestoreCommand(restoreScriptResource($engine), $backup, $dumpAll, $replaceExisting, $keepOwners, restoreMysqlUsers: $restoreMysqlUsers);
 
-        $result = restoreScriptProcess(['sh', '-c', $script], $dir, [
+        $environment = array_merge([
             'PATH' => $dir.'/bin'.PATH_SEPARATOR.(getenv('PATH') ?: '/usr/bin:/bin'),
             'TMPDIR' => $dir,
             'POSTGRES_USER' => 'postgres',
@@ -282,7 +287,8 @@ SH);
             'MARIADB_ROOT_PASSWORD' => 'root_pass',
             'MONGO_INITDB_ROOT_USERNAME' => 'root',
             'MONGO_INITDB_ROOT_PASSWORD' => 'mongo_pass',
-        ]);
+        ], $env);
+        $result = restoreScriptProcess(['sh', '-c', $script], $dir, array_filter($environment, fn (?string $value): bool => $value !== null));
 
         $lines = array_values(array_filter(explode("\n", (string) file_get_contents($log)), fn (string $line): bool => $line !== ''));
         $calls = array_map(function (string $line, int $index) use ($dir): array {
@@ -385,6 +391,10 @@ if ($name === 'dropdb') {
     $database = end($args);
     if (isset($databases[$database])) { exit(1); }
     $databases[$database] = 'empty';
+} elseif (in_array('-Atc', $args, true)) {
+    // Connection and superuser checks run their query as an argument and change nothing.
+    echo str_contains(end($args), 'rolsuper') ? "t\n" : "1\n";
+    exit(0);
 } else {
     $variables = [];
     foreach ($args as $index => $arg) {
@@ -496,17 +506,18 @@ test('restores single PostgreSQL archives with pg_restore and SQL with psql', fu
     expect($run['exit'])->toBe(0, $run['stderr']);
     restoreScriptExpectCalls($run['calls'], $expectedCalls);
 })->with([
-    'custom archive' => ['pg-custom', false, [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --no-owner --no-acl -U postgres -d app']]]],
-    'custom archive replacing existing objects' => ['pg-custom', true, [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --no-owner --no-acl --clean --if-exists -U postgres -d app']]]],
-    'gzip custom archive' => ['pg-custom-gz', false, [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --no-owner --no-acl -U postgres -d app']]]],
-    'gzip custom archive replacing existing objects' => ['pg-custom-gz', true, [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --no-owner --no-acl --clean --if-exists -U postgres -d app']]]],
-    'tar archive' => ['pg-tar', false, [['pg_restore', 'toc.d', ['--exit-on-error --single-transaction --no-owner --no-acl -U postgres -d app']]]],
-    'gzip tar archive' => ['pg-tar-gz', false, [['pg_restore', 'toc.d', ['--exit-on-error --single-transaction --no-owner --no-acl -U postgres -d app']]]],
-    'plain SQL' => ['pg-sql', false, [['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d app']]]],
-    'gzip SQL' => ['pg-sql-gz', false, [['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d app']]]],
+    'custom archive' => ['pg-custom', false, [['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']], ['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --no-owner --no-acl -U postgres -d app']]]],
+    'custom archive replacing existing objects' => ['pg-custom', true, [['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']], ['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --no-owner --no-acl --clean --if-exists -U postgres -d app']]]],
+    'gzip custom archive' => ['pg-custom-gz', false, [['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']], ['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --no-owner --no-acl -U postgres -d app']]]],
+    'gzip custom archive replacing existing objects' => ['pg-custom-gz', true, [['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']], ['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction --no-owner --no-acl --clean --if-exists -U postgres -d app']]]],
+    'tar archive' => ['pg-tar', false, [['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']], ['pg_restore', 'toc.d', ['--exit-on-error --single-transaction --no-owner --no-acl -U postgres -d app']]]],
+    'gzip tar archive' => ['pg-tar-gz', false, [['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']], ['pg_restore', 'toc.d', ['--exit-on-error --single-transaction --no-owner --no-acl -U postgres -d app']]]],
+    'plain SQL' => ['pg-sql', false, [['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']], ['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d app']]]],
+    'gzip SQL' => ['pg-sql-gz', false, [['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']], ['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d app']]]],
     // SQL cannot replace single objects: it restores into a new database, and only a
     // successful restore replaces the current one, so a failure changes nothing.
     'plain SQL replacing existing objects' => ['pg-sql', true, [
+        ['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']],
         ['psql', 'SELEC', ['-v ON_ERROR_STOP=1 -At', '-v new=coolify_restore_new_', '-v old=coolify_restore_old_']],
         ['createdb', '', ['-U postgres coolify_restore_new_']],
         ['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d coolify_restore_new_']],
@@ -514,6 +525,7 @@ test('restores single PostgreSQL archives with pg_restore and SQL with psql', fu
         ['dropdb', '', ['--maintenance-db=template1 -U postgres --if-exists coolify_restore_old_']],
     ]],
     'gzip SQL replacing existing objects' => ['pg-sql-gz', true, [
+        ['psql', '', ['-U postgres -d template1 -Atc', 'SELECT 1']],
         ['psql', 'SELEC', ['-v ON_ERROR_STOP=1 -At', '-v new=coolify_restore_new_', '-v old=coolify_restore_old_']],
         ['createdb', '', ['-U postgres coolify_restore_new_']],
         ['psql', '-- Po', ['-v ON_ERROR_STOP=1 --single-transaction -U postgres -d coolify_restore_new_']],
@@ -526,8 +538,8 @@ test('keeps PostgreSQL owners and privileges only when requested', function (str
     $run = restoreScriptRun('postgresql', restoreScriptFixture($fixture), keepOwners: true);
 
     expect($run['exit'])->toBe(0, $run['stderr']);
-    restoreScriptExpectCalls($run['calls'], [['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction -U postgres -d app']]]);
-    expect($run['calls'][0]['args'])->not->toContain('--no-owner')->not->toContain('--no-acl');
+    restoreScriptExpectCalls($run['calls'], [['psql', '', ['SELECT 1']], ['pg_restore', 'PGDMP', ['--exit-on-error --single-transaction -U postgres -d app']]]);
+    expect($run['calls'][1]['args'])->not->toContain('--no-owner')->not->toContain('--no-acl');
 })->with(['custom archive' => ['pg-custom'], 'gzip custom archive' => ['pg-custom-gz']]);
 
 test('rejects unsupported single PostgreSQL backups before calling any client', function (string $fixture, string $message) {
@@ -541,23 +553,30 @@ test('rejects unsupported single PostgreSQL backups before calling any client',
     'binary garbage' => ['garbage', 'Unsupported PostgreSQL backup format'],
 ]);
 
-test('restores PostgreSQL backups containing all databases after checking the format', function (string $fixture, array $restoreCall) {
-    $run = restoreScriptRun('postgresql', restoreScriptFixture($fixture), dumpAll: true);
+test('restores PostgreSQL backups containing all databases after checking the format', function (string $fixture, array $restoreCall, array $environment, string $user) {
+    $run = restoreScriptRun('postgresql', restoreScriptFixture($fixture), dumpAll: true, env: $environment + ['STUB_DATABASES' => 'app']);
 
     $recreate = [
-        ['psql', '', ['-U postgres -c', 'pg_terminate_backend']],
-        ['psql', '', ['-U postgres -t -c', 'SELECT datname FROM pg_database']],
-        ['createdb', '', ['-U postgres app']],
+        ['psql', '', ["-U {$user} -d template1 -Atc", 'rolsuper']],
+        ['psql', '', ["-U {$user} -d template1 -c", 'pg_terminate_backend']],
+        ['psql', '', ["-U {$user} -d template1 -t -c", 'SELECT datname FROM pg_database']],
+        ['dropdb', '', ["-U {$user} --maintenance-db=template1 --if-exists app"]],
+        ['createdb', '', ["-U {$user} app"]],
     ];
     $inspect = $restoreCall[0] === 'pg_restore' ? [['pg_restore', 'PGDMP', ['-l']]] : [];
 
     expect($run['exit'])->toBe(0, $run['stderr']);
+    $restoreCall[2] = ["-U {$user} -d app"];
     restoreScriptExpectCalls($run['calls'], [...$inspect, ...$recreate, $restoreCall]);
 })->with([
     'custom archive' => ['pg-custom', ['pg_restore', 'PGDMP', ['-U postgres -d app']]],
     'gzip custom archive' => ['pg-custom-gz', ['pg_restore', 'PGDMP', ['-U postgres -d app']]],
     'plain SQL' => ['pg-sql', ['psql', '-- Po', ['-U postgres -d app']]],
     'gzip SQL' => ['pg-sql-gz', ['psql', '-- Po', ['-U postgres -d app']]],
+])->with([
+    'POSTGRES_USER' => [[], 'postgres'],
+    'PGUSER' => [['POSTGRES_USER' => null, 'PGUSER' => 'custom_user'], 'custom_user'],
+    'POSTGRESQL_USERNAME' => [['POSTGRES_USER' => null, 'POSTGRESQL_USERNAME' => 'bitnami'], 'bitnami'],
 ]);
 
 test('rejects unsupported PostgreSQL backups containing all databases before dropping anything', function () {
@@ -568,6 +587,46 @@ test('rejects unsupported PostgreSQL backups containing all databases before dro
         ->and($run['calls'])->toBe([]);
 });
 
+test('finds the PostgreSQL user from POSTGRES_USER, PGUSER, or POSTGRESQL_USERNAME', function (array $env, string $user) {
+    $run = restoreScriptRun('postgresql', restoreScriptFixture('pg-custom'), env: ['POSTGRES_USER' => null, 'POSTGRES_DB' => null, ...$env]);
+
+    expect($run['exit'])->toBe(0, $run['stderr']);
+    restoreScriptExpectCalls($run['calls'], [
+        ['psql', '', ["-U {$user} -d template1 -Atc"]],
+        ['pg_restore', 'PGDMP', ["-U {$user} -d {$user}"]],
+    ]);
+})->with([
+    'POSTGRES_USER' => [['POSTGRES_USER' => 'app'], 'app'],
+    'PGUSER' => [['PGUSER' => 'pguser'], 'pguser'],
+    'Bitnami POSTGRESQL_USERNAME' => [['POSTGRESQL_USERNAME' => 'bitnami'], 'bitnami'],
+    'POSTGRES_USER wins over the others' => [['POSTGRES_USER' => 'app', 'PGUSER' => 'pguser', 'POSTGRESQL_USERNAME' => 'bitnami'], 'app'],
+    'nothing set' => [[], 'postgres'],
+]);
+
+test('stops a PostgreSQL restore before any change when it cannot connect as the user', function (string $fixture, bool $dumpAll, bool $replaceExisting, string $message) {
+    $run = restoreScriptRun('postgresql', restoreScriptFixture($fixture), $dumpAll, $replaceExisting, env: ['POSTGRES_USER' => null, 'STUB_FAIL_MATCH' => '-d template1 -Atc']);
+
+    $changing = array_filter($run['calls'], fn (array $call): bool => ! str_contains($call['args'], '-d template1 -Atc') && ! ($call['name'] === 'pg_restore' && $call['args'] === '-l'));
+
+    expect($run['exit'])->toBe(1)
+        ->and($run['stderr'])->toContain($message)->toContain('postgres')->toContain('Nothing was changed.')
+        ->and($changing)->toBe([]);
+})->with([
+    'custom archive' => ['pg-custom', false, false, 'Cannot connect to PostgreSQL as user'],
+    'SQL' => ['pg-sql', false, false, 'Cannot connect to PostgreSQL as user'],
+    'SQL replacing existing objects' => ['pg-sql', false, true, 'Cannot connect to PostgreSQL as user'],
+    'all databases' => ['pg-custom', true, false, 'needs a PostgreSQL superuser'],
+]);
+
+test('refuses to restore all PostgreSQL databases as a user that is not a superuser', function () {
+    $run = restoreScriptRun('postgresql', restoreScriptFixture('pg-sql'), dumpAll: true, env: ['POSTGRES_USER' => null, 'POSTGRESQL_USERNAME' => 'bitnami', 'STUB_ROLSUPER' => 'f']);
+
+    expect($run['exit'])->toBe(1)
+        ->and($run['stderr'])->toContain('needs a PostgreSQL superuser')->toContain('bitnami')->toContain('Nothing was changed.')
+        ->and(array_column($run['calls'], 'name'))->toBe(['psql'])
+        ->and($run['calls'][0]['args'])->toContain('rolsuper');
+});
+
 test('restores single MySQL and MariaDB SQL backups', function (string $engine, string $fixture) {
     $run = restoreScriptRun($engine, restoreScriptFixture($fixture));
 
diff --git a/tests/Unit/DeployKeyDedicatedPathTest.php b/tests/Unit/DeployKeyDedicatedPathTest.php
index 70e772471c..40f6cecb4c 100644
--- a/tests/Unit/DeployKeyDedicatedPathTest.php
+++ b/tests/Unit/DeployKeyDedicatedPathTest.php
@@ -1,10 +1,20 @@
 <?php
 
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\ApplicationSetting;
 use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Traits\ExecuteRemoteCommand;
+use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Tests\TestCase;
+
+uses(TestCase::class, LazilyRefreshDatabase::class);
 
 afterEach(function () {
     Mockery::close();
@@ -66,6 +76,48 @@ it('skips logging the docker deploy key materialization command before ls-remote
         ->and(substr($source, $commandPosition, 200))->toContain("'skip_command_log' => true");
 });
 
+it('supports skipping command log entries without adding a hidden command entry', function () {
+    Storage::fake('ssh-keys');
+    Storage::fake('ssh-mux');
+    config(['constants.ssh.mux_enabled' => false]);
+    InstanceSettings::forceCreate(['id' => 0]);
+    $privateKey = PrivateKey::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $privateKey->team_id,
+        'private_key_id' => $privateKey->id,
+    ]);
+    $application = Application::factory()->create();
+    $deployment = ApplicationDeploymentQueue::query()->create([
+        'application_id' => $application->id,
+        'deployment_uuid' => fake()->uuid(),
+    ]);
+    $payload = base64_encode('private-deploy-key-material');
+    $command = "echo '{$payload}' | base64 -d | tee /root/.ssh/id_rsa_coolify_test";
+    Process::fake(['*' => Process::result(output: "materialized {$payload}")]);
+    $job = new class($server, $application, $deployment)
+    {
+        use ExecuteRemoteCommand;
+
+        public function __construct(
+            public Server $server,
+            public Application $application,
+            public ApplicationDeploymentQueue $application_deployment_queue,
+        ) {}
+    };
+
+    (new ReflectionMethod($job, 'executeCommandWithProcess'))->invoke(
+        $job, $command, false, null, true, false, true, true,
+    );
+
+    $storedLogs = $deployment->refresh()->getRawOriginal('logs');
+    $logs = json_decode($storedLogs, true, flags: JSON_THROW_ON_ERROR);
+    expect($logs)->toHaveCount(1)
+        ->and($logs[0]['command'])->toBeNull()
+        ->and($logs[0]['output'])->toBe('materialized '.REDACTED);
+    expect($storedLogs)->not->toContain($payload)->not->toContain($command);
+    Process::assertRan(fn ($process) => str_contains($process->command, $command));
+});
+
 it('writes a deploy key to a per-deployment path and cleans it up for ls-remote on the host', function () use ($keyPath) {
     $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
     $privateKey->shouldReceive('getAttribute')->with('private_key')->andReturn('fake-private-key');
diff --git a/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php b/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php
index 1e2e0d796c..f4b4586832 100644
--- a/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php
+++ b/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php
@@ -148,6 +148,22 @@ it('detects deployment hook changes as redeploy-only changes', function (string
     'post-deployment container' => ['post_deployment_command_container', 'Post-deployment command container', 'worker'],
 ]);
 
+it('detects HTTP basic auth hash setting changes as redeploy-only changes', function (string $field, string $label, string|int $newValue) {
+    $application = snapshotTestApplication();
+    markSnapshotTestApplicationDeployed($application);
+
+    $application->update([$field => $newValue]);
+    $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+
+    expect($diff->requiresBuild())->toBeFalse()
+        ->and(collect($diff->changes())->pluck('label'))->toContain($label);
+})->with([
+    'hash algorithm' => ['http_basic_auth_hash_algorithm', 'HTTP basic auth hash algorithm', 'argon2id'],
+    'bcrypt cost factor' => ['http_basic_auth_bcrypt_cost', 'HTTP basic auth bcrypt cost factor', 4],
+    'Argon2id memory' => ['http_basic_auth_argon2id_memory_cost', 'HTTP basic auth Argon2id memory (KiB)', 8192],
+    'Argon2id iterations' => ['http_basic_auth_argon2id_time_cost', 'HTTP basic auth Argon2id iterations', 2],
+]);
+
 it('detects source integration changes as build changes', function (string $field, string $label, mixed $newValue) {
     $application = snapshotTestApplication([
         'source_id' => 1,
diff --git a/tests/Unit/GenerateLogDrainConfigurationTest.php b/tests/Unit/GenerateLogDrainConfigurationTest.php
new file mode 100644
index 0000000000..0ac5eb05b2
--- /dev/null
+++ b/tests/Unit/GenerateLogDrainConfigurationTest.php
@@ -0,0 +1,77 @@
+<?php
+
+use App\Models\Server;
+use App\Models\ServerSetting;
+
+function serverWithLogDrainSettings(array $attributes): Server
+{
+    $server = new Server;
+    $server->setRelation('settings', new ServerSetting($attributes));
+
+    return $server;
+}
+
+it('uses the fluentd driver when CloudWatch is not the active drain', function () {
+    $server = serverWithLogDrainSettings(['is_logdrain_axiom_enabled' => true]);
+
+    expect(generate_log_drain_configuration($server))->toBe(generate_fluentd_configuration());
+});
+
+it('uses the awslogs driver with every configured option', function () {
+    $server = serverWithLogDrainSettings([
+        'is_logdrain_cloudwatch_enabled' => true,
+        'logdrain_cloudwatch_region' => 'eu-west-1',
+        'logdrain_cloudwatch_group' => '/coolify/prod',
+        'logdrain_cloudwatch_stream_prefix' => 'docker/',
+    ]);
+
+    expect(generate_log_drain_configuration($server))->toBe([
+        'driver' => 'awslogs',
+        'options' => [
+            'awslogs-region' => 'eu-west-1',
+            'awslogs-group' => '/coolify/prod',
+            'awslogs-create-group' => 'true',
+            'mode' => 'non-blocking',
+            'tag' => 'docker/{{.Name}}',
+        ],
+    ]);
+});
+
+it('names streams after the container when no prefix is set', function () {
+    $server = serverWithLogDrainSettings([
+        'is_logdrain_cloudwatch_enabled' => true,
+        'logdrain_cloudwatch_region' => 'us-east-1',
+        'logdrain_cloudwatch_group' => 'coolify',
+    ]);
+
+    expect(generate_log_drain_configuration($server)['options']['tag'])->toBe('{{.Name}}');
+});
+
+it('does not fall back to a default region', function () {
+    $server = serverWithLogDrainSettings([
+        'is_logdrain_cloudwatch_enabled' => true,
+        'logdrain_cloudwatch_group' => 'coolify',
+    ]);
+
+    expect(generate_log_drain_configuration($server)['options'])->not->toHaveKey('awslogs-region');
+});
+
+it('never sets awslogs-stream because it would override the container-name tag', function () {
+    $server = serverWithLogDrainSettings([
+        'is_logdrain_cloudwatch_enabled' => true,
+        'logdrain_cloudwatch_group' => 'coolify',
+        'logdrain_cloudwatch_stream_prefix' => 'apps/',
+    ]);
+
+    expect(generate_log_drain_configuration($server)['options'])->not->toHaveKey('awslogs-stream');
+});
+
+it('reports CloudWatch as an enabled drain that does not use Fluent Bit', function () {
+    $cloudwatch = serverWithLogDrainSettings(['is_logdrain_cloudwatch_enabled' => true]);
+    $axiom = serverWithLogDrainSettings(['is_logdrain_axiom_enabled' => true]);
+
+    expect($cloudwatch->isLogDrainEnabled())->toBeTrue()
+        ->and($cloudwatch->isFluentBitLogDrainEnabled())->toBeFalse()
+        ->and($axiom->isLogDrainEnabled())->toBeTrue()
+        ->and($axiom->isFluentBitLogDrainEnabled())->toBeTrue();
+});
diff --git a/tests/Unit/GiteaSourceCommandsTest.php b/tests/Unit/GiteaSourceCommandsTest.php
new file mode 100644
index 0000000000..ef741bb92d
--- /dev/null
+++ b/tests/Unit/GiteaSourceCommandsTest.php
@@ -0,0 +1,170 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\GiteaApp;
+use App\Models\PrivateKey;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Encryption\Encrypter;
+use Illuminate\Support\Collection;
+
+beforeEach(function () {
+    Model::encryptUsing(new Encrypter(str_repeat('a', 32), 'AES-256-CBC'));
+});
+
+afterEach(function () {
+    Model::encryptUsing(null);
+});
+
+function giteaCommandsAsString(array|Collection|string $commands): string
+{
+    if (is_string($commands)) {
+        return $commands;
+    }
+
+    return collect($commands)->map(fn ($command) => data_get($command, 'command') ?? $command[0] ?? $command)->implode(' && ');
+}
+
+/**
+ * A non-expired token short-circuits refreshGiteaToken(), so no HTTP call is made.
+ */
+function giteaConnectedSource(string $htmlUrl = 'https://gitea.example.test'): GiteaApp
+{
+    $source = new GiteaApp;
+    $source->forceFill([
+        'html_url' => $htmlUrl,
+        'api_url' => $htmlUrl.'/api/v1',
+        'is_public' => false,
+        'custom_port' => 22,
+        'custom_user' => 'git',
+        'team_id' => 1,
+    ]);
+    $source->access_token = 'gt-token/with+sym';
+    $source->refresh_token = 'gt-refresh-token';
+    $source->expires_at = time() + 3600;
+
+    return $source;
+}
+
+function giteaApplicationFor(GiteaApp $source, string $repository = 'owner/private-app', bool $submodules = false): Application
+{
+    $application = new Application;
+    $application->forceFill([
+        'uuid' => 'test-app-uuid',
+        'git_repository' => $repository,
+        'git_branch' => 'main',
+        'git_commit_sha' => 'HEAD',
+    ]);
+
+    $settings = new ApplicationSetting;
+    $settings->is_git_shallow_clone_enabled = false;
+    $settings->is_git_submodules_enabled = $submodules;
+    $settings->is_git_lfs_enabled = false;
+    $application->setRelation('settings', $settings);
+    $application->setRelation('source', $source);
+
+    return $application;
+}
+
+it('clones a connected Gitea source over HTTPS with the OAuth token and per-command submodule credentials', function () {
+    $application = giteaApplicationFor(giteaConnectedSource(), submodules: true);
+
+    $result = $application->generateGitImportCommands(deployment_uuid: 'test-deployment', exec_in_docker: false);
+
+    $expectedConfig = "git -c 'url.https://oauth2:gt-token%2Fwith%2Bsym@gitea.example.test/.insteadOf=https://gitea.example.test/'";
+
+    expect($result['fullRepoUrl'])->toBe('https://oauth2:gt-token%2Fwith%2Bsym@gitea.example.test/owner/private-app.git');
+    expect($result['commands'])
+        ->not->toContain('git config --global')
+        ->toContain("{$expectedConfig} clone --recurse-submodules -b 'main' 'https://oauth2:gt-token%2Fwith%2Bsym@gitea.example.test/owner/private-app.git'")
+        ->toContain("{$expectedConfig} submodule update --init --recursive");
+});
+
+it('fetches the Gitea pull request ref through the OAuth git config', function () {
+    $application = giteaApplicationFor(giteaConnectedSource(), submodules: true);
+
+    $result = $application->generateGitImportCommands(
+        deployment_uuid: 'test-deployment',
+        pull_request_id: 7,
+        exec_in_docker: false,
+        only_checkout: true,
+        custom_base_dir: '/artifacts/test',
+    );
+
+    expect($result['branch'])->toBe('pull/7/head:pr-7-coolify');
+    expect($result['commands'])
+        ->toContain(".insteadOf=https://gitea.example.test/' fetch origin 'pull/7/head:pr-7-coolify'")
+        ->not->toContain('merge-requests');
+});
+
+it('runs ls-remote for a connected Gitea source with the OAuth token and custom port', function () {
+    $application = giteaApplicationFor(giteaConnectedSource('http://gitea.example.test:3000'));
+
+    $result = $application->generateGitLsRemoteCommands('test-deployment', false);
+
+    expect($result['fullRepoUrl'])->toBe('http://oauth2:gt-token%2Fwith%2Bsym@gitea.example.test:3000/owner/private-app.git');
+    expect($result['commands'])->toContain("git ls-remote 'http://oauth2:gt-token%2Fwith%2Bsym@gitea.example.test:3000/owner/private-app.git'");
+});
+
+it('falls back to the Gitea source private key only when it belongs to the source team', function (int $keyTeamId, bool $expectKey) {
+    $privateKey = new PrivateKey;
+    $privateKey->forceFill(['team_id' => $keyTeamId, 'private_key' => 'fake-private-key']);
+
+    $source = new GiteaApp;
+    $source->forceFill(['html_url' => 'https://gitea.example.test', 'custom_port' => 2222, 'team_id' => 1]);
+    $source->setRelation('privateKey', $privateKey);
+
+    $application = giteaApplicationFor($source, 'git@gitea.example.test:owner/private-app.git');
+
+    $lsRemote = giteaCommandsAsString($application->generateGitLsRemoteCommands('test-deployment', false)['commands']);
+    $import = $application->generateGitImportCommands(deployment_uuid: 'test-deployment', pull_request_id: 3, exec_in_docker: false);
+    $importCommands = giteaCommandsAsString($import['commands']);
+
+    foreach ([$lsRemote, $importCommands] as $commands) {
+        expect($commands)->not->toContain('oauth2:');
+        $expectKey
+            ? expect($commands)->toContain('id_rsa_coolify_')->toContain('-p 2222')
+            : expect($commands)->not->toContain('id_rsa_coolify_');
+    }
+    if ($expectKey) {
+        expect($import['branch'])->toBe('pull/3/head:pr-3-coolify');
+    }
+})->with([
+    'same team' => [1, true],
+    'other team' => [2, false],
+]);
+
+it('clones a disconnected Gitea source without a key as a public repository', function () {
+    $source = new GiteaApp;
+    $source->forceFill(['html_url' => 'https://gitea.example.test', 'team_id' => 1]);
+    $source->setRelation('privateKey', null);
+
+    $application = giteaApplicationFor($source, 'https://gitea.example.test/owner/public-app.git');
+
+    $result = $application->generateGitImportCommands(deployment_uuid: 'test-deployment', exec_in_docker: false);
+
+    expect($result['fullRepoUrl'])->toBe('https://gitea.example.test/owner/public-app.git');
+    expect(giteaCommandsAsString($result['commands']))
+        ->toContain("'https://gitea.example.test/owner/public-app.git'")
+        ->not->toContain('oauth2:')
+        ->not->toContain('id_rsa_coolify_');
+});
+
+it('links Gitea branches and commits with Gitea URL paths', function () {
+    $application = giteaApplicationFor(giteaConnectedSource());
+    $application->base_directory = '/app';
+
+    expect($application->git_branch_location)->toBe('https://gitea.example.test/owner/private-app/src/branch/main/app');
+    expect($application->git_commits)->toBe('https://gitea.example.test/owner/private-app/commits/branch/main');
+    expect($application->gitCommitLink('abc123'))->toBe('https://gitea.example.test/owner/private-app/commit/abc123');
+});
+
+it('converts a Gitea HTTP repository to SSH for deploy keys', function () {
+    $source = new GiteaApp;
+    $source->forceFill(['html_url' => 'https://gitea.example.test', 'custom_port' => 2222, 'custom_user' => 'git']);
+
+    expect(convertGitUrl('owner/repo', 'deploy_key', $source))->toBe([
+        'repository' => 'ssh://git@gitea.example.test:2222/owner/repo',
+        'port' => '2222',
+    ]);
+});
diff --git a/tests/Unit/HasRepositoryDetectionTest.php b/tests/Unit/HasRepositoryDetectionTest.php
new file mode 100644
index 0000000000..a06c778c97
--- /dev/null
+++ b/tests/Unit/HasRepositoryDetectionTest.php
@@ -0,0 +1,152 @@
+<?php
+
+use App\Data\RepositoryDetectionResult;
+use App\Models\Application;
+use App\Traits\HasRepositoryDetection;
+use Illuminate\Validation\ValidationException;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+/**
+ * Minimal host that mimics the Livewire components using the trait.
+ */
+class RepositoryDetectionHost
+{
+    use HasRepositoryDetection;
+
+    public string $build_pack = 'railpack';
+
+    public int $port = 3000;
+
+    public ?string $docker_compose_location = '/docker-compose.yaml';
+
+    protected function applicationForDetection(): Application
+    {
+        return $this->unsavedApplicationForDetection('test/repo', 'main');
+    }
+
+    public function updatedBuildPack(): void {}
+
+    public function resetErrorBag($field = null): void {}
+
+    public function dockerfileLocation(): ?string
+    {
+        return $this->selectedDockerfileLocation();
+    }
+
+    public function apply(RepositoryDetectionResult $result): void
+    {
+        $this->applyDetectionResult($result);
+    }
+}
+
+test('env vars are flattened to plain key value strings for the import form', function () {
+    $host = new RepositoryDetectionHost;
+
+    $host->apply(new RepositoryDetectionResult(
+        envFiles: [
+            '.env.example' => "APP_NAME=MyApp\nAPP_DEBUG=true\nAPP_URL=\"https://example.com\"",
+        ],
+    ));
+
+    expect($host->envExampleVars)->toBe([
+        'APP_NAME' => 'MyApp',
+        'APP_DEBUG' => 'true',
+        'APP_URL' => 'https://example.com',
+    ]);
+
+    // No value should be an array (which would render as "[object Object]" in the UI).
+    foreach ($host->envExampleVars as $value) {
+        expect($value)->toBeString();
+    }
+});
+
+test('switching the selected env file keeps values flat', function () {
+    $host = new RepositoryDetectionHost;
+
+    $host->apply(new RepositoryDetectionResult(
+        envFiles: [
+            '.env.example' => 'FOO=bar',
+            '.env.sample' => 'BAZ=qux',
+        ],
+    ));
+
+    $host->selectedEnvFile = '.env.sample';
+    $host->updatedSelectedEnvFile();
+
+    expect($host->envExampleVars)->toBe(['BAZ' => 'qux']);
+});
+
+test('empty scan preserves the chosen build pack and clears previous results', function () {
+    $host = new RepositoryDetectionHost;
+    $host->apply(new RepositoryDetectionResult(envFiles: ['.env.example' => 'FOO=bar']));
+    $host->envImported = true;
+    $host->apply(RepositoryDetectionResult::none());
+
+    expect($host->build_pack)->toBe('railpack')
+        ->and($host->envExampleVars)->toBe([])
+        ->and($host->detectedEnvFiles)->toBe([])
+        ->and($host->selectedEnvFile)->toBeNull()
+        ->and($host->envImported)->toBeFalse();
+});
+
+test('switching to a Dockerfile without EXPOSE resets the detected port', function () {
+    $host = new RepositoryDetectionHost;
+    $host->apply(new RepositoryDetectionResult(
+        dockerfiles: ['Dockerfile', 'Dockerfile.worker'],
+        dockerfilePorts: ['Dockerfile' => 8080, 'Dockerfile.worker' => null],
+    ));
+    $host->selectedDockerfile = 'Dockerfile.worker';
+    $host->updatedSelectedDockerfile();
+
+    expect($host->port)->toBe(3000)->and($host->detectedPort)->toBeNull();
+});
+
+test('a typed Dockerfile path that was not detected is kept', function () {
+    $host = new RepositoryDetectionHost;
+    $host->apply(new RepositoryDetectionResult(dockerfiles: ['Dockerfile'], dockerfilePorts: ['Dockerfile' => 8080]));
+    $host->selectedDockerfile = ' /docker/prod.Dockerfile ';
+    $host->updatedSelectedDockerfile();
+
+    expect($host->selectedDockerfile)->toBe('docker/prod.Dockerfile')
+        ->and($host->dockerfileLocation())->toBe('/docker/prod.Dockerfile')
+        ->and($host->port)->toBe(3000);
+});
+
+test('a typed Dockerfile path with unsafe characters is rejected', function () {
+    $host = new RepositoryDetectionHost;
+    $host->selectedDockerfile = 'Dockerfile; rm -rf /';
+
+    expect(fn () => $host->updatedSelectedDockerfile())->toThrow(ValidationException::class);
+});
+
+test('an empty Dockerfile selection keeps the default location', function () {
+    $host = new RepositoryDetectionHost;
+    $host->selectedDockerfile = '  ';
+    $host->updatedSelectedDockerfile();
+
+    expect($host->selectedDockerfile)->toBeNull()->and($host->dockerfileLocation())->toBeNull();
+});
+
+test('a typed Docker Compose path sets the compose location', function () {
+    $host = new RepositoryDetectionHost;
+    $host->apply(new RepositoryDetectionResult(dockerComposeFiles: ['docker-compose.yml']));
+    $host->selectedDockerComposeFile = '/deploy/compose.prod.yaml';
+    $host->updatedSelectedDockerComposeFile();
+
+    expect($host->selectedDockerComposeFile)->toBe('deploy/compose.prod.yaml')
+        ->and($host->docker_compose_location)->toBe('/deploy/compose.prod.yaml');
+});
+
+test('nested build files do not change the build pack', function () {
+    $host = new RepositoryDetectionHost;
+    $host->apply(new RepositoryDetectionResult(
+        dockerfiles: ['apps/api/Dockerfile'],
+        dockerComposeFiles: ['examples/demo/docker-compose.yml'],
+    ));
+
+    expect($host->build_pack)->toBe('railpack')
+        ->and($host->suggestedBuildPack)->toBeNull()
+        ->and($host->detectedDockerComposeFiles)->toBe(['examples/demo/docker-compose.yml']);
+});
diff --git a/tests/Unit/HostingerDeleteServerTest.php b/tests/Unit/HostingerDeleteServerTest.php
new file mode 100644
index 0000000000..ee74c1fefd
--- /dev/null
+++ b/tests/Unit/HostingerDeleteServerTest.php
@@ -0,0 +1,90 @@
+<?php
+
+use App\Actions\Server\DeleteServer;
+use App\Models\CloudProviderToken;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    Http::preventStrayRequests();
+
+    $this->team = Team::factory()->create();
+    $this->token = CloudProviderToken::factory()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hostinger',
+        'token' => 'test-hostinger-token',
+    ]);
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+        'cloud_provider_token_id' => $this->token->id,
+        'hostinger_virtual_machine_id' => 17923,
+    ]);
+    $this->server->delete();
+});
+
+it('deletes the Hostinger VPS by disabling auto-renewal when requested', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'id' => 17923,
+            'subscription_id' => 'Azz2Y9VWEjUO69lF',
+        ]),
+        'https://developers.hostinger.com/api/billing/v1/subscriptions/Azz2Y9VWEjUO69lF/auto-renewal/disable' => Http::response([
+            'id' => 'Azz2Y9VWEjUO69lF',
+            'is_auto_renewed' => false,
+        ]),
+    ]);
+
+    DeleteServer::run(
+        serverId: $this->server->id,
+        cloudProviderTokenId: $this->token->id,
+        teamId: $this->team->id,
+        deleteFromHostinger: true,
+        hostingerVirtualMachineId: 17923,
+    );
+
+    Http::assertSent(fn ($request) => $request->method() === 'DELETE'
+        && $request->url() === 'https://developers.hostinger.com/api/billing/v1/subscriptions/Azz2Y9VWEjUO69lF/auto-renewal/disable');
+    expect(Server::withTrashed()->find($this->server->id))->toBeNull();
+});
+
+it('retains the server when the Hostinger VPS cannot be deleted', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'id' => 17923,
+            'subscription_id' => 'Azz2Y9VWEjUO69lF',
+        ]),
+        'https://developers.hostinger.com/api/billing/v1/subscriptions/Azz2Y9VWEjUO69lF/auto-renewal/disable' => Http::response([
+            'message' => 'Unauthorized',
+        ], 403),
+    ]);
+
+    expect(fn () => DeleteServer::run(
+        serverId: $this->server->id,
+        cloudProviderTokenId: $this->token->id,
+        teamId: $this->team->id,
+        deleteFromHostinger: true,
+        hostingerVirtualMachineId: 17923,
+    ))->toThrow(Exception::class, 'Hostinger API error: Unauthorized');
+
+    expect(Server::withTrashed()->find($this->server->id))->not->toBeNull();
+});
+
+it('does not call Hostinger when the VPS should be kept', function () {
+    DeleteServer::run(
+        serverId: $this->server->id,
+        cloudProviderTokenId: $this->token->id,
+        teamId: $this->team->id,
+        hostingerVirtualMachineId: 17923,
+    );
+
+    Http::assertNothingSent();
+    expect(Server::withTrashed()->find($this->server->id))->toBeNull();
+});
diff --git a/tests/Unit/HostingerIconTest.php b/tests/Unit/HostingerIconTest.php
new file mode 100644
index 0000000000..bbb84c6fb9
--- /dev/null
+++ b/tests/Unit/HostingerIconTest.php
@@ -0,0 +1,10 @@
+<?php
+
+it('renders the official Hostinger mark', function () {
+    $contents = file_get_contents(__DIR__.'/../../resources/views/components/hostinger-icon.blade.php');
+
+    expect($contents)
+        ->toContain('viewBox="0 0 26 30"')
+        ->toContain('M0.000249566 14.046V0.000497794')
+        ->toContain('Hostinger');
+});
diff --git a/tests/Unit/HostingerServerStateTest.php b/tests/Unit/HostingerServerStateTest.php
new file mode 100644
index 0000000000..c4073e2dbb
--- /dev/null
+++ b/tests/Unit/HostingerServerStateTest.php
@@ -0,0 +1,45 @@
+<?php
+
+use App\Models\CloudProviderToken;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    Http::preventStrayRequests();
+});
+
+it('refreshes Hostinger virtual machine status and public IP', function () {
+    $team = Team::factory()->create();
+    $token = CloudProviderToken::factory()->create([
+        'team_id' => $team->id,
+        'provider' => 'hostinger',
+        'token' => 'hostinger-token',
+    ]);
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $privateKey->id,
+        'cloud_provider_token_id' => $token->id,
+        'hostinger_virtual_machine_id' => 17923,
+        'hostinger_virtual_machine_status' => 'creating',
+        'ip' => '0.0.0.0',
+    ]);
+
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'id' => 17923,
+            'state' => 'running',
+            'ipv4' => [['address' => '203.0.113.10']],
+        ]),
+    ]);
+
+    expect($server->refreshHostingerState())->toBe('running')
+        ->and($server->fresh()->hostinger_virtual_machine_status)->toBe('running')
+        ->and($server->fresh()->ip)->toBe('203.0.113.10');
+});
diff --git a/tests/Unit/HostingerServiceTest.php b/tests/Unit/HostingerServiceTest.php
new file mode 100644
index 0000000000..15cb16a422
--- /dev/null
+++ b/tests/Unit/HostingerServiceTest.php
@@ -0,0 +1,339 @@
+<?php
+
+use App\Exceptions\RateLimitException;
+use App\Services\HostingerService;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+beforeEach(function () {
+    Http::preventStrayRequests();
+});
+
+it('fetches Hostinger provisioning options', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([
+            ['id' => 19, 'name' => 'nl-ams', 'city' => 'Amsterdam', 'location' => 'nl'],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/templates' => Http::response([
+            ['id' => 1130, 'name' => 'Ubuntu 24.04 LTS'],
+        ]),
+        'https://developers.hostinger.com/api/billing/v1/catalog?category=VPS' => Http::response([
+            [
+                'id' => 'hostingercom-vps-kvm2',
+                'name' => 'KVM 2',
+                'category' => 'VPS',
+                'prices' => [
+                    [
+                        'id' => 'hostingercom-vps-kvm2-usd-1m',
+                        'currency' => 'USD',
+                        'price' => 1799,
+                        'first_period_price' => 899,
+                        'period' => 1,
+                        'period_unit' => 'month',
+                    ],
+                ],
+            ],
+        ]),
+    ]);
+
+    $service = new HostingerService('test-token');
+
+    expect($service->getDataCenters()[0]['city'])->toBe('Amsterdam')
+        ->and($service->getTemplates()[0]['name'])->toBe('Ubuntu 24.04 LTS')
+        ->and($service->getCatalogItems()[0]['prices'][0]['price'])->toBe(1799);
+});
+
+it('returns only KVM plans from the Hostinger VPS catalog', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/billing/v1/catalog?category=VPS' => Http::response([
+            ['id' => 'hostingercom-vps-kvm1', 'name' => 'KVM 1', 'prices' => []],
+            ['id' => 'hostingercom-vps-kvmminecraftalex', 'name' => 'Game Panel 1', 'prices' => []],
+            ['id' => 'hostingercom-vps-kvm8', 'name' => 'KVM 8', 'prices' => []],
+            ['id' => 'hostingercom-vps-kvmminecraftwolf', 'name' => 'Game Panel 8', 'prices' => []],
+            ['name' => 'Missing id', 'prices' => []],
+        ]),
+    ]);
+
+    expect(collect((new HostingerService('test-token'))->getCatalogItems())->pluck('id')->all())
+        ->toBe(['hostingercom-vps-kvm1', 'hostingercom-vps-kvm8']);
+});
+
+it('fetches and attaches Hostinger account SSH keys', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/public-keys' => Http::response([
+            'data' => [['id' => 42, 'name' => 'Operations', 'key' => 'ssh-ed25519 AAAA']],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/public-keys/attach/17923' => Http::response([
+            'id' => 456,
+            'state' => 'running',
+        ]),
+    ]);
+
+    $service = new HostingerService('test-token');
+
+    expect($service->getPublicKeys()[0]['id'])->toBe(42)
+        ->and($service->attachPublicKeys(17923, ['42'])['id'])->toBe(456);
+
+    Http::assertSent(fn ($request) => $request->url() === 'https://developers.hostinger.com/api/vps/v1/public-keys/attach/17923'
+        && $request['ids'] === [42]);
+});
+
+it('fetches Hostinger post-install scripts', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/post-install-scripts' => Http::response([
+            'data' => [['id' => 73, 'name' => 'Bootstrap Coolify']],
+        ]),
+    ]);
+
+    expect((new HostingerService('test-token'))->getPostInstallScripts()[0]['id'])->toBe(73);
+});
+
+it('purchases a Hostinger virtual machine with its setup options', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'order' => ['id' => 2957086, 'status' => 'completed'],
+            'virtual_machine' => [
+                'id' => 17923,
+                'hostname' => 'coolify-test.example.com',
+                'state' => 'creating',
+                'ipv4' => [['address' => '203.0.113.10']],
+            ],
+        ]),
+    ]);
+
+    $virtualMachine = (new HostingerService('test-token'))->purchaseVirtualMachine([
+        'item_id' => 'hostingercom-vps-kvm2-usd-1m',
+        'setup' => [
+            'data_center_id' => 19,
+            'template_id' => 1130,
+            'hostname' => 'coolify-test.example.com',
+            'enable_backups' => true,
+            'public_key' => [
+                'name' => 'Coolify',
+                'key' => 'ssh-ed25519 AAAA test@example.com',
+            ],
+        ],
+    ]);
+
+    expect($virtualMachine['id'])->toBe(17923);
+
+    Http::assertSent(fn ($request) => $request->method() === 'POST'
+        && $request->url() === 'https://developers.hostinger.com/api/vps/v1/virtual-machines'
+        && $request->hasHeader('Authorization', 'Bearer test-token')
+        && $request['item_id'] === 'hostingercom-vps-kvm2-usd-1m'
+        && $request['setup']['data_center_id'] === 19
+        && $request['setup']['template_id'] === 1130
+        && $request['setup']['enable_backups'] === true
+        && $request['setup']['public_key']['key'] === 'ssh-ed25519 AAAA test@example.com');
+});
+
+it('only sends a fully qualified hostname to Hostinger', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'virtual_machine' => ['id' => 17923, 'state' => 'creating'],
+        ]),
+    ]);
+
+    $service = new HostingerService('test-token');
+    $service->purchaseVirtualMachine([
+        'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+        'setup' => ['data_center_id' => 19, 'template_id' => 1130, 'hostname' => 'coolify-server'],
+    ]);
+    $service->purchaseVirtualMachine([
+        'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+        'setup' => ['data_center_id' => 19, 'template_id' => 1130, 'hostname' => 'coolify.example.com'],
+    ]);
+
+    $sentHostnames = Http::recorded()->filter(fn ($record) => $record[0]->method() === 'POST')->values()->map(fn ($record) => $record[0]['setup']['hostname'] ?? null)->all();
+
+    expect($sentHostnames)->toBe([null, 'coolify.example.com']);
+});
+
+it('does not retry a failed Hostinger purchase', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => fn ($request) => $request->method() === 'GET'
+            ? Http::response([])
+            : Http::response(['message' => 'Server error'], 500),
+    ]);
+
+    expect(fn () => (new HostingerService('test-token'))->purchaseVirtualMachine([
+        'item_id' => 'hostingercom-vps-kvm2-usd-1m',
+        'setup' => ['data_center_id' => 19, 'template_id' => 1130],
+    ]))->toThrow(Exception::class, 'Hostinger API error: Server error');
+
+    Http::assertSentCount(3);
+    expect(Http::recorded()->filter(fn ($record) => $record[0]->method() === 'POST'))->toHaveCount(1);
+});
+
+it('sets up a charged Hostinger VPS when the purchase returns an error', function () {
+    $listRequests = 0;
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/2008976/setup' => Http::response([
+            'id' => 2008976,
+            'state' => 'creating',
+            'ipv4' => [['address' => '72.61.180.163']],
+        ]),
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => function ($request) use (&$listRequests) {
+            if ($request->method() === 'POST') {
+                return Http::response(['message' => '[VPS:2004] Wrong hostname FQDN format'], 422);
+            }
+
+            return Http::response($listRequests++ === 0
+                ? [['id' => 100, 'state' => 'running']]
+                : [['id' => 100, 'state' => 'running'], ['id' => 2008976, 'state' => 'initial']]);
+        },
+    ]);
+
+    $virtualMachine = (new HostingerService('test-token'))->purchaseVirtualMachine([
+        'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+        'setup' => ['data_center_id' => 19, 'template_id' => 1077, 'enable_backups' => false],
+    ]);
+
+    expect($virtualMachine['id'])->toBe(2008976)
+        ->and($virtualMachine['state'])->toBe('creating');
+
+    Http::assertSent(fn ($request) => $request->url() === 'https://developers.hostinger.com/api/vps/v1/virtual-machines/2008976/setup'
+        && $request['data_center_id'] === 19
+        && $request['template_id'] === 1077
+        && $request['enable_backups'] === false);
+});
+
+it('returns a charged Hostinger VPS that still needs setup when the setup retry fails', function () {
+    $listRequests = 0;
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/2008976/setup' => Http::response(['message' => 'Setup failed'], 422),
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => function ($request) use (&$listRequests) {
+            if ($request->method() === 'POST') {
+                return Http::response(['message' => 'Setup failed'], 422);
+            }
+
+            return Http::response($listRequests++ === 0 ? [] : [['id' => 2008976, 'state' => 'initial']]);
+        },
+    ]);
+
+    $virtualMachine = (new HostingerService('test-token'))->purchaseVirtualMachine([
+        'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+        'setup' => ['data_center_id' => 19, 'template_id' => 1077],
+    ]);
+
+    expect($virtualMachine)->toBe(['id' => 2008976, 'state' => 'initial']);
+});
+
+it('reports a Hostinger purchase whose payment is still processing', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'id' => 2957086,
+            'subscription_id' => 'Azz353Uhl1xC54pR0',
+            'status' => 'payment_initiated',
+            'message' => 'Payment is being processed.',
+        ], 202),
+    ]);
+    Log::shouldReceive('warning')->once()->with('Hostinger VPS order did not return a virtual machine', [
+        'id' => 2957086,
+        'subscription_id' => 'Azz353Uhl1xC54pR0',
+        'status' => 'payment_initiated',
+        'message' => 'Payment is being processed.',
+    ]);
+
+    expect(fn () => (new HostingerService('test-token'))->purchaseVirtualMachine([
+        'item_id' => 'hostingercom-vps-kvm2-usd-1m',
+        'setup' => ['data_center_id' => 19, 'template_id' => 1130],
+    ]))->toThrow(Exception::class, 'Hostinger order 2957086 is waiting for payment. Finish the VPS setup in hPanel.');
+});
+
+it('extracts a Hostinger public IPv4 address before falling back to IPv6', function () {
+    $virtualMachine = [
+        'ipv4' => [['address' => '203.0.113.10']],
+        'ipv6' => [['address' => '2001:db8::10']],
+    ];
+
+    $service = new HostingerService('test-token');
+
+    expect($service->getPublicIpAddress($virtualMachine))->toBe('203.0.113.10')
+        ->and($service->getPublicIpAddress(['ipv4' => [], 'ipv6' => $virtualMachine['ipv6']]))->toBe('2001:db8::10');
+});
+
+it('waits for Hostinger to assign a public IP', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'id' => 17923,
+            'state' => 'running',
+            'ipv4' => [['address' => '203.0.113.10']],
+        ]),
+    ]);
+
+    $service = new HostingerService('test-token');
+    $virtualMachine = $service->waitForPublicIp([
+        'id' => 17923,
+        'state' => 'creating',
+        'ipv4' => [],
+    ], sleepMilliseconds: 0);
+
+    expect($service->getPublicIpAddress($virtualMachine))->toBe('203.0.113.10');
+});
+
+it('stops waiting for a Hostinger public IP after 10 attempts by default', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923' => Http::response([
+            'id' => 17923,
+            'state' => 'initial',
+            'ipv4' => [],
+        ]),
+    ]);
+
+    $service = new HostingerService('test-token');
+    $virtualMachine = $service->waitForPublicIp([
+        'id' => 17923,
+        'state' => 'initial',
+        'ipv4' => [],
+    ], sleepMilliseconds: 0);
+
+    expect($service->getPublicIpAddress($virtualMachine))->toBeNull();
+    Http::assertSentCount(10);
+});
+
+it('finds a Hostinger virtual machine by public IP', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            [
+                'id' => 17923,
+                'ipv4' => [['address' => '203.0.113.10']],
+                'ipv6' => [['address' => '2001:db8::10']],
+            ],
+        ]),
+    ]);
+
+    $service = new HostingerService('test-token');
+
+    expect($service->findVirtualMachineByIp('203.0.113.10')['id'])->toBe(17923)
+        ->and($service->findVirtualMachineByIp('2001:db8::10')['id'])->toBe(17923)
+        ->and($service->findVirtualMachineByIp('198.51.100.1'))->toBeNull();
+});
+
+it('starts a Hostinger virtual machine', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines/17923/start' => Http::response([
+            'id' => 456,
+            'name' => 'start',
+            'state' => 'running',
+        ]),
+    ]);
+
+    $action = (new HostingerService('test-token'))->startVirtualMachine(17923);
+
+    expect($action['state'])->toBe('running');
+});
+
+it('raises the shared rate limit exception for Hostinger throttling', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/data-centers' => Http::response([
+            'message' => 'Too many requests.',
+        ], 429, ['Retry-After' => '30']),
+    ]);
+
+    expect(fn () => (new HostingerService('test-token'))->getDataCenters())
+        ->toThrow(RateLimitException::class, 'Rate limit exceeded. Please try again later.');
+});
diff --git a/tests/Unit/Livewire/Database/S3RestoreTest.php b/tests/Unit/Livewire/Database/S3RestoreTest.php
index 8716fe5831..d620c737e8 100644
--- a/tests/Unit/Livewire/Database/S3RestoreTest.php
+++ b/tests/Unit/Livewire/Database/S3RestoreTest.php
@@ -40,6 +40,7 @@ if [ ! -t 0 ]; then
     cat >/dev/null
 fi
 printf '%s:%s\\n' '{$tool}' "\$header" >> '{$logFile}'
+case "\$*" in *rolsuper*) echo t ;; esac
 exit 0
 SH;
             $path = $binDir.'/'.$tool;
@@ -107,7 +108,7 @@ test('buildRestoreCommand handles PostgreSQL with dumpAll', function () {
     $result = $component->buildRestoreCommand('/tmp/test.dump');
 
     expect($result)->toStartWith("backup='/tmp/test.dump'");
-    expect($result)->toContain('stream | psql -U ${POSTGRES_USER} -d "$db"');
+    expect($result)->toContain('stream | psql -U "$pg_user" -d "$db"');
 });
 
 test('buildRestoreCommand dump-all PostgreSQL restore is pg_restore for PGDMP otherwise psql', function () {
@@ -118,8 +119,8 @@ test('buildRestoreCommand dump-all PostgreSQL restore is pg_restore for PGDMP ot
 
     expect($command)
         ->toContain('if [ "$(stream | head -c 5)" = PGDMP ] || is_tar; then')
-        ->toContain('stream | pg_restore -U ${POSTGRES_USER} -d "$db"')
-        ->toContain('stream | psql -U ${POSTGRES_USER} -d "$db"')
+        ->toContain('stream | pg_restore -U "$pg_user" -d "$db"')
+        ->toContain('stream | psql -U "$pg_user" -d "$db"')
         ->and(strpos($command, 'kind=archive'))->toBeLessThan(strpos($command, 'dropdb'));
 });
 
@@ -132,7 +133,7 @@ test('dump-all PostgreSQL import text shows the client chosen by the dump format
 
 test('dump-all PostgreSQL restore selects the client for the dump format', function (string $contents, bool $gzip, string $restore, array $preflight) {
     // Check the archive, terminate sessions, list databases, recreate the target database, then restore.
-    expect(invokedPostgresRestoreClients($contents, $gzip))->toBe([...$preflight, 'psql:', 'psql:', 'createdb:', $restore]);
+    expect(invokedPostgresRestoreClients($contents, $gzip))->toBe([...$preflight, 'psql:', 'psql:', 'psql:', 'createdb:', $restore]);
 })->with([
     'custom archive' => ['PGDMP'.str_repeat("\0", 16), false, 'pg_restore:PGDMP', ['pg_restore:PGDMP']],
     'gzip custom archive' => ['PGDMP'.str_repeat("\0", 16), true, 'pg_restore:PGDMP', ['pg_restore:PGDMP']],
diff --git a/tests/Unit/Metrics/HasMetricsMappingTest.php b/tests/Unit/Metrics/HasMetricsMappingTest.php
new file mode 100644
index 0000000000..d8b4b805bd
--- /dev/null
+++ b/tests/Unit/Metrics/HasMetricsMappingTest.php
@@ -0,0 +1,75 @@
+<?php
+
+use App\Traits\HasMetrics;
+
+/**
+ * Test double exposing the new metric mappers without SSH: overrides the fetch step
+ * to return canned Sentinel rows.
+ */
+class MetricsMappingDouble
+{
+    use HasMetrics;
+
+    /** @var array<string, ?array> type => rows */
+    public array $rowsByType = [];
+
+    protected function fetchMetricRows(string $type, int $mins): ?array
+    {
+        return $this->rowsByType[$type] ?? null;
+    }
+}
+
+it('keeps only the root mount for disk metrics', function () {
+    $d = new MetricsMappingDouble;
+    $d->rowsByType['disk'] = [
+        ['time' => 1000, 'mount' => '/boot', 'usedPercent' => 90.0],
+        ['time' => 1000, 'mount' => '/', 'usedPercent' => 40.0],
+        ['time' => 2000, 'mount' => '/', 'usedPercent' => 42.0],
+    ];
+
+    expect($d->getDiskMetrics(5))->toBe([[1000, 40.0], [2000, 42.0]]);
+});
+
+it('splits network metrics into rx and tx series', function () {
+    $d = new MetricsMappingDouble;
+    $d->rowsByType['network'] = [
+        ['time' => 1000, 'rxBytesPerSec' => 100.0, 'txBytesPerSec' => 10.0],
+        ['time' => 2000, 'rxBytesPerSec' => 200.0, 'txBytesPerSec' => 20.0],
+    ];
+
+    expect($d->getNetworkMetrics(5))->toBe([
+        'rx' => [[1000, 100.0], [2000, 200.0]],
+        'tx' => [[1000, 10.0], [2000, 20.0]],
+    ]);
+});
+
+it('maps the one minute load average', function () {
+    $d = new MetricsMappingDouble;
+    $d->rowsByType['load'] = [
+        ['time' => 1000, 'load1' => 0.5, 'load5' => 1.0, 'load15' => 1.5],
+    ];
+
+    expect($d->getLoadMetrics(5))->toBe([[1000, 0.5]]);
+});
+
+it('returns null for a metric when metrics are unavailable', function () {
+    $d = new MetricsMappingDouble; // rowsByType empty -> fetch returns null
+
+    expect($d->getDiskMetrics(5))->toBeNull();
+    expect($d->getNetworkMetrics(5))->toBeNull();
+    expect($d->getLoadMetrics(5))->toBeNull();
+});
+
+it('does not use non-root mounts when root disk samples are missing', function () {
+    $double = new MetricsMappingDouble;
+    $double->rowsByType['disk'] = [['time' => 1000, 'mount' => '/boot', 'usedPercent' => 90]];
+
+    expect($double->getDiskMetrics(5))->toBe([]);
+});
+
+it('supports older disk rows without a mount field', function () {
+    $double = new MetricsMappingDouble;
+    $double->rowsByType['disk'] = [['time' => 1000, 'usedPercent' => 40]];
+
+    expect($double->getDiskMetrics(5))->toBe([[1000, 40.0]]);
+});
diff --git a/tests/Unit/Metrics/PressureLevelTest.php b/tests/Unit/Metrics/PressureLevelTest.php
new file mode 100644
index 0000000000..e2c922a216
--- /dev/null
+++ b/tests/Unit/Metrics/PressureLevelTest.php
@@ -0,0 +1,22 @@
+<?php
+
+use App\Support\Metrics\PressureLevel;
+
+it('classifies cpu/memory pressure at 70/90 cutoffs', function () {
+    expect(PressureLevel::for(10, 'cpu'))->toBe('ok');
+    expect(PressureLevel::for(70, 'cpu'))->toBe('warning');
+    expect(PressureLevel::for(89.9, 'memory'))->toBe('warning');
+    expect(PressureLevel::for(90, 'memory'))->toBe('error');
+});
+
+it('classifies disk pressure at 80/90 cutoffs', function () {
+    expect(PressureLevel::for(75, 'disk'))->toBe('ok');
+    expect(PressureLevel::for(80, 'disk'))->toBe('warning');
+    expect(PressureLevel::for(95, 'disk'))->toBe('error');
+});
+
+it('treats a null percent as ok and maps levels to classes', function () {
+    expect(PressureLevel::for(null, 'cpu'))->toBe('ok');
+    expect(PressureLevel::textClass('error'))->toContain('text-red-500');
+    expect(PressureLevel::barClass('warning'))->toContain('bg-orange-500');
+});
diff --git a/tests/Unit/ParseCommandsByLineForSudoTest.php b/tests/Unit/ParseCommandsByLineForSudoTest.php
index 594ecbd046..a0ef50d1ad 100644
--- a/tests/Unit/ParseCommandsByLineForSudoTest.php
+++ b/tests/Unit/ParseCommandsByLineForSudoTest.php
@@ -863,3 +863,17 @@ test('parseCommandsByLineForSudo keeps pipes inside quoted strings unchanged', f
 
     expect($result[0])->toBe("sudo docker ps --format '{{.Names}} | {{.Image}}' | sudo grep app");
 });
+
+test('railpack builder helper command gets sudo only outside the helper script', function () {
+    $command = railpackBuilderHelperCommand('$HOME/.docker/buildx', 'coolify-helper:1.0.0', 'docker buildx prune --builder coolify-railpack -af');
+
+    $parsed = parseCommandsByLineForSudo(collect([$command]), $this->server)[0];
+
+    // The SSH user's shell must expand $HOME, so the line must not be wrapped in `sudo bash -c`.
+    expect($parsed)->toBe(
+        'sudo docker run --rm -v $HOME/.docker/buildx:/root/.docker/buildx -v /var/run/docker.sock:/var/run/docker.sock coolify-helper:1.0.0'
+        ." bash -c 'exec 9>/root/.docker/buildx/coolify-railpack.lock; if flock -s 9; then :; else exit $?; fi; docker buildx prune --builder coolify-railpack -af; status=$?;"
+        .' if flock -n -x 9; then DOCKER_CONFIG=/root/.docker docker buildx stop coolify-railpack >/dev/null 2>&1; fi;'
+        ." exit \$status' 2>/dev/null || sudo true"
+    );
+});
diff --git a/tests/Unit/Policies/GiteaAppPolicyTest.php b/tests/Unit/Policies/GiteaAppPolicyTest.php
new file mode 100644
index 0000000000..c1b847fbf7
--- /dev/null
+++ b/tests/Unit/Policies/GiteaAppPolicyTest.php
@@ -0,0 +1,192 @@
+<?php
+
+use App\Models\GiteaApp;
+use App\Models\User;
+use App\Policies\GiteaAppPolicy;
+
+it('allows any user to view any gitea apps', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows any user to view system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->view($user, $model))->toBeTrue();
+});
+
+it('allows team member to view non-system-wide gitea app', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->view($user, $model))->toBeTrue();
+});
+
+it('denies non-team member to view non-system-wide gitea app', function () {
+    $teams = collect([
+        (object) ['id' => 2, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->view($user, $model))->toBeFalse();
+});
+
+it('allows admin to create gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies non-admin to create gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows user with system access to update system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('canAccessSystemResources')->andReturn(true);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->update($user, $model))->toBeTrue();
+});
+
+it('denies user without system access to update system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('canAccessSystemResources')->andReturn(false);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->update($user, $model))->toBeFalse();
+});
+
+it('allows team admin to update non-system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->update($user, $model))->toBeTrue();
+});
+
+it('denies team member to update non-system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->update($user, $model))->toBeFalse();
+});
+
+it('allows user with system access to delete system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('canAccessSystemResources')->andReturn(true);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->delete($user, $model))->toBeTrue();
+});
+
+it('denies user without system access to delete system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('canAccessSystemResources')->andReturn(false);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->delete($user, $model))->toBeFalse();
+});
+
+it('allows team admin to delete non-system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->delete($user, $model))->toBeTrue();
+});
+
+it('denies team member to delete non-system-wide gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->delete($user, $model))->toBeFalse();
+});
+
+it('denies update when team_id is null without type error', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldNotReceive('isAdminOfTeam');
+
+    $model = mockGiteaApp(teamId: null, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->update($user, $model))->toBeFalse();
+});
+
+it('denies delete when team_id is null without type error', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldNotReceive('isAdminOfTeam');
+
+    $model = mockGiteaApp(teamId: null, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->delete($user, $model))->toBeFalse();
+});
+
+it('denies restore of gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->restore($user, $model))->toBeFalse();
+});
+
+it('denies force delete of gitea app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $model = mockGiteaApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GiteaAppPolicy;
+    expect($policy->forceDelete($user, $model))->toBeFalse();
+});
+
+function mockGiteaApp(?int $teamId, bool $isSystemWide): GiteaApp
+{
+    $giteaApp = Mockery::mock(GiteaApp::class)->makePartial();
+    $giteaApp->team_id = $teamId;
+    $giteaApp->is_system_wide = $isSystemWide;
+
+    return $giteaApp;
+}
diff --git a/tests/Unit/RailpackBuilderLockTest.php b/tests/Unit/RailpackBuilderLockTest.php
new file mode 100644
index 0000000000..273104d6c4
--- /dev/null
+++ b/tests/Unit/RailpackBuilderLockTest.php
@@ -0,0 +1,43 @@
+<?php
+
+use Symfony\Component\Process\Process;
+
+require_once __DIR__.'/../../bootstrap/helpers/docker.php';
+
+function runRailpackLockScript(string $command, string $setup = ''): Process
+{
+    $directory = sys_get_temp_dir().'/railpack-lock-'.bin2hex(random_bytes(8));
+    mkdir($directory);
+
+    try {
+        $script = str_replace('/root/.docker/buildx/coolify-railpack.lock', $directory.'/builder.lock', $setup.railpackBuilderLockedScript($command));
+        $process = new Process(['bash', '-c', $script]);
+        $process->run();
+
+        return $process;
+    } finally {
+        @unlink($directory.'/builder.lock');
+        rmdir($directory);
+    }
+}
+
+test('a failed shared lock prevents the builder command from running', function () {
+    $process = runRailpackLockScript('printf build-ran', 'flock() { return 73; }; ');
+
+    expect($process->getExitCode())->toBe(73);
+    expect($process->getOutput())->toBe('');
+});
+
+test('the builder stops after a failed command without hiding its exit status', function () {
+    $process = runRailpackLockScript('(exit 42)', 'exec 3>&1; docker() { printf stopped >&3; return 0; }; ');
+
+    expect($process->getExitCode())->toBe(42);
+    expect($process->getOutput())->toBe('stopped');
+});
+
+test('a held shared lock prevents stopping the builder', function () {
+    $process = runRailpackLockScript('printf built', 'exec 8>/root/.docker/buildx/coolify-railpack.lock; flock -s 8; docker() { exit 99; }; ');
+
+    expect($process->getExitCode())->toBe(0);
+    expect($process->getOutput())->toBe('built');
+});
diff --git a/tests/Unit/RedactSensitiveDataLoggingTest.php b/tests/Unit/RedactSensitiveDataLoggingTest.php
new file mode 100644
index 0000000000..226a49ed1c
--- /dev/null
+++ b/tests/Unit/RedactSensitiveDataLoggingTest.php
@@ -0,0 +1,85 @@
+<?php
+
+use App\Logging\RedactSensitiveAuditData;
+use App\Logging\RedactSensitiveData;
+use App\Services\Security\SensitiveDataRedactor;
+use Illuminate\Log\Logger;
+use Monolog\Handler\TestHandler;
+use Monolog\Logger as MonologLogger;
+
+it('redacts messages, nested context, and exceptions before a handler receives the record', function () {
+    $secret = 'coolify-canary-secret-a91f0c';
+    $handler = new TestHandler;
+    $logger = new Logger(new MonologLogger('test', [$handler]));
+
+    (new RedactSensitiveData(new SensitiveDataRedactor))($logger);
+
+    $logger->error(
+        "Deployment failed with password={$secret}",
+        [
+            'headers' => ['Authorization' => "Bearer {$secret}"],
+            'exception' => new RuntimeException("token={$secret}"),
+        ],
+    );
+
+    $record = $handler->getRecords()[0];
+    $serializedRecord = serialize([$record->message, $record->context, $record->extra]);
+
+    expect($serializedRecord)
+        ->not->toContain($secret)
+        ->toContain(REDACTED)
+        ->and($record->context['exception']['trace'])->toBeString()->not->toBeEmpty();
+});
+
+it('keeps redacted traces and previous exceptions', function () {
+    $secret = 'coolify-canary-secret-previous';
+    $handler = new TestHandler;
+    $logger = new Logger(new MonologLogger('test', [$handler]));
+
+    (new RedactSensitiveData(new SensitiveDataRedactor))($logger);
+
+    $logger->error('Failed', [
+        'exception' => new RuntimeException('outer', 0, new RuntimeException("password={$secret}")),
+    ]);
+
+    $exception = $handler->getRecords()[0]->context['exception'];
+
+    expect($exception['trace'])->toContain('#0')
+        ->and($exception['previous']['message'])->toBe('password='.REDACTED)
+        ->and(serialize($exception))->not->toContain($secret);
+});
+
+it('wires redaction into all persistent and remote log channels', function () {
+    $configuration = file_get_contents(__DIR__.'/../../config/logging.php');
+
+    expect($configuration)
+        ->toContain("'channels' => ['single']")
+        ->toContain("env('LOG_LEVEL', 'debug')")
+        ->not->toContain("env('LOG_LEVEL', 'info')")
+        ->and(substr_count($configuration, 'RedactSensitiveData::class'))->toBe(9)
+        ->and($configuration)->toMatch("/'audit' => \\[[^\\]]*'tap' => \\[RedactSensitiveAuditData::class\\]/s");
+});
+
+it('keeps email addresses in the audit log while still redacting secrets', function () {
+    $secret = 'coolify-canary-secret-audit';
+    $handler = new TestHandler;
+    $logger = new Logger(new MonologLogger('audit', [$handler]));
+
+    (new RedactSensitiveAuditData(new SensitiveDataRedactor))($logger);
+
+    $logger->info("User changed password={$secret}", ['user_email' => 'admin@example.com', 'token' => $secret]);
+
+    $record = $handler->getRecords()[0];
+
+    expect($record->context['user_email'])->toBe('admin@example.com')
+        ->and($record->context['token'])->toBe(REDACTED)
+        ->and($record->message)->toBe('User changed password='.REDACTED);
+});
+
+it('redacts email addresses in the default channels', function () {
+    $redactor = new SensitiveDataRedactor;
+
+    expect($redactor->redactText('mail admin@example.com'))->toBe('mail '.REDACTED)
+        ->and($redactor->withoutEmailRedaction()->redactText('mail admin@example.com'))->toBe('mail admin@example.com')
+        ->and($redactor->redactText('mail admin@example.com'))->toBe('mail '.REDACTED);
+});
diff --git a/tests/Unit/RepositoryDetectionResultTest.php b/tests/Unit/RepositoryDetectionResultTest.php
new file mode 100644
index 0000000000..34bc2d189d
--- /dev/null
+++ b/tests/Unit/RepositoryDetectionResultTest.php
@@ -0,0 +1,120 @@
+<?php
+
+use App\Data\RepositoryDetectionResult;
+use App\Enums\BuildPackTypes;
+
+test('empty result returns correct defaults', function () {
+    $result = RepositoryDetectionResult::none();
+
+    expect($result->dockerfiles)->toBe([])
+        ->and($result->dockerComposeFiles)->toBe([])
+        ->and($result->envFiles)->toBe([])
+        ->and($result->dockerfilePorts)->toBe([]);
+});
+
+test('getSuggestedBuildPack returns dockercompose when compose files found', function () {
+    $result = new RepositoryDetectionResult(
+        dockerfiles: ['Dockerfile'],
+        dockerComposeFiles: ['docker-compose.yml'],
+    );
+
+    expect($result->getSuggestedBuildPack())->toBe(BuildPackTypes::DOCKERCOMPOSE);
+});
+
+test('getSuggestedBuildPack returns dockerfile when only dockerfiles found', function () {
+    $result = new RepositoryDetectionResult(
+        dockerfiles: ['Dockerfile'],
+    );
+
+    expect($result->getSuggestedBuildPack())->toBe(BuildPackTypes::DOCKERFILE);
+});
+
+test('getSuggestedBuildPack returns null when nothing found', function () {
+    $result = RepositoryDetectionResult::none();
+
+    expect($result->getSuggestedBuildPack())->toBeNull();
+});
+
+test('getSuggestedBuildPack ignores files in subdirectories', function () {
+    $result = new RepositoryDetectionResult(
+        dockerfiles: ['Dockerfile', 'apps/api/Dockerfile'],
+        dockerComposeFiles: ['examples/demo/docker-compose.yml'],
+    );
+
+    expect($result->getSuggestedBuildPack())->toBe(BuildPackTypes::DOCKERFILE);
+
+    $nestedOnly = new RepositoryDetectionResult(
+        dockerfiles: ['apps/api/Dockerfile'],
+        dockerComposeFiles: ['examples/demo/docker-compose.yml'],
+    );
+
+    expect($nestedOnly->getSuggestedBuildPack())->toBeNull();
+});
+
+test('hasDockerfile returns true when dockerfiles present', function () {
+    $result = new RepositoryDetectionResult(
+        dockerfiles: ['Dockerfile', 'apps/api/Dockerfile'],
+    );
+
+    expect($result->hasDockerfile())->toBeTrue();
+});
+
+test('hasDockerfile returns false when no dockerfiles', function () {
+    $result = RepositoryDetectionResult::none();
+
+    expect($result->hasDockerfile())->toBeFalse();
+});
+
+test('hasDockerCompose returns true when compose files present', function () {
+    $result = new RepositoryDetectionResult(
+        dockerComposeFiles: ['docker-compose.yml'],
+    );
+
+    expect($result->hasDockerCompose())->toBeTrue();
+});
+
+test('hasDockerCompose returns false when no compose files', function () {
+    $result = RepositoryDetectionResult::none();
+
+    expect($result->hasDockerCompose())->toBeFalse();
+});
+
+test('dockerfilePorts stores port mapping correctly', function () {
+    $result = new RepositoryDetectionResult(
+        dockerfiles: ['Dockerfile', 'apps/api/Dockerfile'],
+        dockerfilePorts: ['Dockerfile' => 3000, 'apps/api/Dockerfile' => 8080],
+    );
+
+    expect($result->dockerfilePorts)->toBe(['Dockerfile' => 3000, 'apps/api/Dockerfile' => 8080])
+        ->and($result->dockerfilePorts['Dockerfile'])->toBe(3000)
+        ->and($result->dockerfilePorts['apps/api/Dockerfile'])->toBe(8080);
+});
+
+test('hasEnvFiles returns true when env files present', function () {
+    $result = new RepositoryDetectionResult(
+        envFiles: ['.env.example' => 'APP_KEY=secret'],
+    );
+
+    expect($result->hasEnvFiles())->toBeTrue();
+});
+
+test('hasEnvFiles returns false when no env files', function () {
+    $result = RepositoryDetectionResult::none();
+
+    expect($result->hasEnvFiles())->toBeFalse();
+});
+
+test('envFiles stores multiple files with content', function () {
+    $result = new RepositoryDetectionResult(
+        envFiles: [
+            '.env.example' => 'APP_KEY=secret',
+            '.env.sample' => 'DB_HOST=localhost',
+            '.env.dist' => null,
+        ],
+    );
+
+    expect($result->envFiles)->toHaveCount(3)
+        ->and($result->envFiles['.env.example'])->toBe('APP_KEY=secret')
+        ->and($result->envFiles['.env.sample'])->toBe('DB_HOST=localhost')
+        ->and($result->envFiles['.env.dist'])->toBeNull();
+});
diff --git a/tests/Unit/RepositoryDetectorTest.php b/tests/Unit/RepositoryDetectorTest.php
new file mode 100644
index 0000000000..0281ed5391
--- /dev/null
+++ b/tests/Unit/RepositoryDetectorTest.php
@@ -0,0 +1,231 @@
+<?php
+
+use App\Enums\BuildPackTypes;
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\Server;
+use App\Services\RepositoryDetector;
+use Symfony\Component\Process\Process;
+
+function repositoryDetector(string $repository = 'https://github.com/test/repo', string $baseDirectory = '/'): RepositoryDetector
+{
+    $application = (new Application)->forceFill(['git_repository' => $repository, 'git_branch' => 'main', 'git_commit_sha' => 'HEAD']);
+    $application->setRelation('settings', (new ApplicationSetting)->forceFill(['is_git_shallow_clone_enabled' => true, 'is_git_submodules_enabled' => false]));
+    $application->setRelation('source', null);
+    $application->setRelation('private_key', null);
+
+    return new RepositoryDetector($application, $baseDirectory, new Server);
+}
+
+/**
+ * Runs the scan commands on this machine against a local Git repository, optionally after the
+ * non-root sudo parser (with `sudo` removed, so the test does not need root).
+ */
+function runRepositoryScan(RepositoryDetector $detector, string $uuid, bool $throughSudoParser = false): Process
+{
+    $commands = (new ReflectionMethod($detector, 'scanCommands'))->invoke($detector, $uuid);
+    if ($throughSudoParser) {
+        $server = Mockery::mock(Server::class)->makePartial();
+        $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+        $commands = collect(parseCommandsByLineForSudo($commands, $server))
+            ->map(fn (string $line) => preg_replace('/(^|\s)sudo /', '$1', $line))
+            ->map(fn (string $line) => preg_replace('/ && chown .*$/', '', $line));
+    }
+    $process = Process::fromShellCommandline("set -e\n".$commands->implode("\n"));
+    $process->run();
+
+    return $process;
+}
+
+beforeEach(function () {
+    $this->detector = repositoryDetector();
+    $this->parseOutputMethod = new ReflectionMethod($this->detector, 'parseOutput');
+});
+
+test('parseOutput handles complete detection output', function () {
+    $output = json_encode([
+        'dockerfiles' => ['Dockerfile', 'apps/api/Dockerfile'],
+        'dockerComposeFiles' => ['docker-compose.yml'],
+        'envFiles' => ['.env.example' => "APP_NAME=MyApp\nAPP_ENV=production\nDB_HOST=localhost\nDB_PORT=5432"],
+        'dockerfilePorts' => ['Dockerfile' => 3000, 'apps/api/Dockerfile' => 8080],
+    ]);
+
+    $result = $this->parseOutputMethod->invoke($this->detector, $output);
+
+    expect($result->dockerfiles)->toBe(['Dockerfile', 'apps/api/Dockerfile'])
+        ->and($result->dockerComposeFiles)->toBe(['docker-compose.yml'])
+        ->and($result->envFiles)->toHaveKey('.env.example')
+        ->and($result->envFiles['.env.example'])->toContain('APP_NAME=MyApp')
+        ->and($result->dockerfilePorts)->toBe(['Dockerfile' => 3000, 'apps/api/Dockerfile' => 8080])
+        ->and($result->getSuggestedBuildPack())->toBe(BuildPackTypes::DOCKERCOMPOSE);
+});
+
+test('parseOutput handles empty repository', function () {
+    $output = json_encode([
+        'dockerfiles' => [],
+        'dockerComposeFiles' => [],
+        'envFiles' => (object) [],
+        'dockerfilePorts' => (object) [],
+    ]);
+
+    $result = $this->parseOutputMethod->invoke($this->detector, $output);
+
+    expect($result->dockerfiles)->toBe([])
+        ->and($result->dockerComposeFiles)->toBe([])
+        ->and($result->envFiles)->toBe([])
+        ->and($result->dockerfilePorts)->toBe([])
+        ->and($result->getSuggestedBuildPack())->toBeNull();
+});
+
+test('parseOutput handles dockerfile without EXPOSE', function () {
+    $output = json_encode([
+        'dockerfiles' => ['Dockerfile'],
+        'dockerComposeFiles' => [],
+        'envFiles' => (object) [],
+        'dockerfilePorts' => ['Dockerfile' => null],
+    ]);
+
+    $result = $this->parseOutputMethod->invoke($this->detector, $output);
+
+    expect($result->dockerfiles)->toBe(['Dockerfile'])
+        ->and($result->dockerfilePorts)->toBe(['Dockerfile' => null])
+        ->and($result->getSuggestedBuildPack())->toBe(BuildPackTypes::DOCKERFILE);
+});
+
+test('parseOutput handles only env files without dockerfiles', function () {
+    $output = json_encode([
+        'dockerfiles' => [],
+        'dockerComposeFiles' => [],
+        'envFiles' => ['.env.example' => "SECRET_KEY=changeme\nDATABASE_URL=postgres://localhost/db"],
+        'dockerfilePorts' => (object) [],
+    ]);
+
+    $result = $this->parseOutputMethod->invoke($this->detector, $output);
+
+    expect($result->dockerfiles)->toBe([])
+        ->and($result->envFiles)->toHaveKey('.env.example')
+        ->and($result->envFiles['.env.example'])->toContain('SECRET_KEY=changeme')
+        ->and($result->envFiles['.env.example'])->toContain('DATABASE_URL=postgres://localhost/db')
+        ->and($result->getSuggestedBuildPack())->toBeNull();
+});
+
+test('parseOutput handles multiple compose files', function () {
+    $output = json_encode([
+        'dockerfiles' => [],
+        'dockerComposeFiles' => ['docker-compose.yml', 'compose.yaml'],
+        'envFiles' => (object) [],
+        'dockerfilePorts' => (object) [],
+    ]);
+
+    $result = $this->parseOutputMethod->invoke($this->detector, $output);
+
+    expect($result->dockerComposeFiles)->toBe(['docker-compose.yml', 'compose.yaml'])
+        ->and($result->getSuggestedBuildPack())->toBe(BuildPackTypes::DOCKERCOMPOSE);
+});
+
+test('parseOutput puts the file nearest to the base directory first', function () {
+    $output = json_encode([
+        'dockerfiles' => ['apps/api/Dockerfile', 'Dockerfile.dev', 'apps/web/Dockerfile', 'Dockerfile'],
+        'dockerComposeFiles' => ['examples/demo/compose.yaml', 'deploy/docker-compose.yml', 'compose.yaml'],
+        'envFiles' => (object) [],
+        'dockerfilePorts' => (object) [],
+    ]);
+
+    $result = $this->parseOutputMethod->invoke($this->detector, $output);
+
+    expect($result->dockerfiles)->toBe(['Dockerfile', 'Dockerfile.dev', 'apps/api/Dockerfile', 'apps/web/Dockerfile'])
+        ->and($result->dockerComposeFiles)->toBe(['compose.yaml', 'deploy/docker-compose.yml', 'examples/demo/compose.yaml']);
+});
+
+test('parseOutput handles multiple env files', function () {
+    $output = json_encode([
+        'dockerfiles' => [],
+        'dockerComposeFiles' => [],
+        'envFiles' => [
+            '.env.example' => "APP_KEY=base64:abc\nAPP_ENV=local",
+            '.env.sample' => "DB_HOST=127.0.0.1\nDB_PORT=5432",
+            '.env.dist' => 'REDIS_HOST=localhost',
+        ],
+        'dockerfilePorts' => (object) [],
+    ]);
+
+    $result = $this->parseOutputMethod->invoke($this->detector, $output);
+
+    expect($result->envFiles)->toHaveCount(3)
+        ->and($result->envFiles['.env.example'])->toContain('APP_KEY=base64:abc')
+        ->and($result->envFiles['.env.sample'])->toContain('DB_HOST=127.0.0.1')
+        ->and($result->envFiles['.env.dist'])->toContain('REDIS_HOST=localhost')
+        ->and($result->hasEnvFiles())->toBeTrue();
+});
+
+test('parseOutput handles string port values from JSON', function () {
+    $output = json_encode([
+        'dockerfiles' => ['Dockerfile'],
+        'dockerComposeFiles' => [],
+        'envFiles' => (object) [],
+        'dockerfilePorts' => ['Dockerfile' => '3000'],
+    ]);
+
+    $result = $this->parseOutputMethod->invoke($this->detector, $output);
+
+    expect($result->dockerfilePorts)->toBe(['Dockerfile' => 3000])
+        ->and($result->dockerfilePorts['Dockerfile'])->toBeInt();
+});
+
+test('parseOutput returns none for invalid JSON', function () {
+    $result = $this->parseOutputMethod->invoke($this->detector, 'not valid json');
+
+    expect($result->dockerfiles)->toBe([])
+        ->and($result->dockerComposeFiles)->toBe([])
+        ->and($result->envFiles)->toBe([])
+        ->and($result->dockerfilePorts)->toBe([]);
+});
+
+test('scanner rejects traversal before remote execution', function (string $baseDirectory) {
+    $detector = repositoryDetector(baseDirectory: $baseDirectory);
+    expect(fn () => (new ReflectionMethod($detector, 'scanCommands'))->invoke($detector, 'scan-test'))->toThrow(RuntimeException::class);
+})->with(['/../outside', '/app/../..', '/./app', '/app;id']);
+
+test('scanner reads only regular Git blobs and honors build directory', function (bool $throughSudoParser) {
+    $repo = sys_get_temp_dir().'/scan-fixture-'.bin2hex(random_bytes(8));
+    $uuid = 'scan-test-'.bin2hex(random_bytes(8));
+    mkdir($repo);
+    mkdir($repo.'/app');
+    mkdir($repo.'/app/services');
+    file_put_contents($repo.'/Dockerfile', "FROM scratch\nEXPOSE 9000\n");
+    file_put_contents($repo.'/app/Dockerfile', "FROM scratch\r\n  expose 8080/tcp\r\n");
+    file_put_contents($repo.'/app/services/Dockerfile.worker', "FROM scratch\nEXPOSE \${PORT}\n");
+    file_put_contents($repo.'/app/compose.yaml', 'services: {}');
+    file_put_contents($repo.'/app/.env.sample', "SAFE=value\nQUOTE='it''s'");
+    file_put_contents($repo.'/app/services/.env.example', 'NESTED=ignored');
+    file_put_contents($repo.'/app/my dockerfile notes.txt', 'not a Dockerfile');
+    file_put_contents($repo.'/secret', 'HOST_SECRET=do-not-read');
+    symlink($repo.'/secret', $repo.'/app/.env.example');
+    $git = 'git -C '.escapeshellarg($repo);
+    Process::fromShellCommandline("{$git} init -q -b main && {$git} add . && {$git} -c user.name=Test -c user.email=test@example.com commit -qm fixture")->mustRun();
+    try {
+        $detector = repositoryDetector($repo, '/app');
+        $process = runRepositoryScan($detector, $uuid, $throughSudoParser);
+        expect($process->isSuccessful())->toBeTrue($process->getErrorOutput());
+        $result = (new ReflectionMethod($detector, 'parseOutput'))->invoke($detector, $process->getOutput());
+        expect($result->dockerfiles)->toBe(['Dockerfile', 'services/Dockerfile.worker'])
+            ->and($result->dockerComposeFiles)->toBe(['compose.yaml'])
+            ->and($result->envFiles)->toBe(['.env.sample' => "SAFE=value\nQUOTE='it''s'"])
+            ->and($result->dockerfilePorts)->toBe(['Dockerfile' => 8080, 'services/Dockerfile.worker' => null]);
+
+        $failure = runRepositoryScan(repositoryDetector($repo.'-missing'), $uuid.'-missing', $throughSudoParser);
+        expect($failure->isSuccessful())->toBeFalse();
+    } finally {
+        Process::fromShellCommandline('rm -rf -- '.escapeshellarg($repo).' /tmp/'.$uuid.' /tmp/'.$uuid.'-missing')->mustRun();
+    }
+})->with(['root server' => false, 'non-root server' => true]);
+
+test('invalid port values are not suggested', function (mixed $port) {
+    $result = $this->parseOutputMethod->invoke($this->detector, json_encode(['dockerfilePorts' => ['Dockerfile' => $port]]));
+    expect($result->dockerfilePorts['Dockerfile'])->toBeNull();
+})->with([0, -1, 65536, '3.5', '3e3', true]);
+
+test('malformed scan collections fall back safely', function () {
+    $result = $this->parseOutputMethod->invoke($this->detector, '{"dockerfiles":"Dockerfile"}');
+    expect($result->dockerfiles)->toBe([]);
+});
diff --git a/tests/Unit/SanitizeLogsForExportTest.php b/tests/Unit/SanitizeLogsForExportTest.php
index 0ba2f4ef77..fb6d83c82b 100644
--- a/tests/Unit/SanitizeLogsForExportTest.php
+++ b/tests/Unit/SanitizeLogsForExportTest.php
@@ -15,7 +15,7 @@ it('removes JWT/Bearer tokens', function () {
     $result = sanitizeLogsForExport($input);
 
     expect($result)->not->toContain('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9');
-    expect($result)->toContain('Bearer '.REDACTED);
+    expect($result)->toBe('Authorization: '.REDACTED);
 });
 
 it('removes API keys with common patterns', function () {
diff --git a/tests/Unit/SensitiveDataRedactorTest.php b/tests/Unit/SensitiveDataRedactorTest.php
new file mode 100644
index 0000000000..fa43dfac03
--- /dev/null
+++ b/tests/Unit/SensitiveDataRedactorTest.php
@@ -0,0 +1,228 @@
+<?php
+
+use App\Enums\ApplicationDeploymentStatus;
+use App\Services\Security\SensitiveDataRedactor;
+
+it('redacts known secret values and encoded variants longest first', function () {
+    $redactor = new SensitiveDataRedactor;
+    $knownSecrets = ['coolify-secret', 'coolify-secret-longer', 'secret with spaces', 'quote"secret'];
+
+    $result = $redactor->redactText('coolify-secret-longer coolify-secret secret%20with%20spaces quote\"secret', $knownSecrets);
+
+    expect($result)->not->toContain('coolify-secret')
+        ->not->toContain('secret%20with%20spaces')
+        ->not->toContain('quote\"secret')
+        ->toBe(REDACTED.' '.REDACTED.' '.REDACTED.' '.REDACTED);
+});
+
+it('does not replace short known values in unstructured text', function () {
+    $result = (new SensitiveDataRedactor)->redactText('mode=dev enabled=yes count=1', ['dev', 'yes', 1]);
+
+    expect($result)->toBe('mode=dev enabled=yes count=1');
+});
+
+it('redacts sensitive keys recursively including short values', function () {
+    $result = (new SensitiveDataRedactor)->redactValue([
+        'name' => 'demo',
+        'PASSWORD' => 'x',
+        'request' => ['Authorization' => 'Bearer short', 'set-cookie' => 'session=secret', 'status' => 200],
+    ]);
+
+    expect($result)->toBe([
+        'name' => 'demo',
+        'PASSWORD' => REDACTED,
+        'request' => ['Authorization' => REDACTED, 'set-cookie' => REDACTED, 'status' => 200],
+    ]);
+});
+
+it('redacts complete authorization headers with opaque bearer tokens', function () {
+    $secret = 'coolify-canary-secret-scheduled';
+    $result = (new SensitiveDataRedactor)->redactText("Authorization: Bearer {$secret}\nstatus=ok");
+
+    expect($result)
+        ->not->toContain($secret)
+        ->toBe('Authorization: '.REDACTED."\nstatus=ok");
+});
+
+it('preserves current generic redaction behavior', function () {
+    $privateKey = "-----BEGIN PRIVATE KEY-----\nsecret-key-data\n-----END PRIVATE KEY-----";
+    $result = (new SensitiveDataRedactor)->redactText("\e[31mhttps://user:password@example.com\e[0m Bearer aaa.bbb.ccc {$privateKey}");
+
+    expect($result)->not->toContain("\e[31m")
+        ->not->toContain('password')
+        ->not->toContain('aaa.bbb.ccc')
+        ->not->toContain('secret-key-data')
+        ->toContain('https://user:'.REDACTED.'@example.com')
+        ->toContain('Bearer '.REDACTED);
+});
+
+it('normalizes invalid utf8 and removes unsafe control characters', function () {
+    $result = (new SensitiveDataRedactor)->redactText("valid\xC3\x28\x00\x07\nnext");
+
+    expect(mb_check_encoding($result, 'UTF-8'))->toBeTrue()
+        ->and($result)->not->toContain("\x00")
+        ->and($result)->not->toContain("\x07")
+        ->and($result)->toContain("\nnext");
+});
+
+it('suppresses logs when ANSI normalization exceeds the PCRE backtrack limit', function () {
+    $backtrackLimit = ini_get('pcre.backtrack_limit');
+    ini_set('pcre.backtrack_limit', '0');
+    set_error_handler(static fn (): bool => true, E_DEPRECATED);
+
+    try {
+        $result = (new SensitiveDataRedactor)->redactText("\e[31msecret");
+    } finally {
+        restore_error_handler();
+        ini_set('pcre.backtrack_limit', $backtrackLimit);
+    }
+
+    expect($result)->toBe(SensitiveDataRedactor::FAILURE_MESSAGE);
+});
+
+it('redacts large text completely without truncating it', function () {
+    $line = str_repeat('a', 1000)."\n";
+    $text = str_repeat($line, 600).'password=coolify-canary-tail-secret'."\n".'last line';
+
+    $result = (new SensitiveDataRedactor)->redactText($text);
+
+    expect(strlen($result))->toBeGreaterThan(600000)
+        ->and($result)->not->toContain('coolify-canary-tail-secret')
+        ->and($result)->toEndWith('password='.REDACTED."\nlast line");
+});
+
+it('keeps a private key that crosses a chunk boundary redacted', function () {
+    $privateKey = "-----BEGIN PRIVATE KEY-----\n".str_repeat("secret-key-line\n", 20000).'-----END PRIVATE KEY-----';
+    $text = str_repeat(str_repeat('a', 1000)."\n", 250).$privateKey."\nafter";
+
+    $result = (new SensitiveDataRedactor)->redactText($text);
+
+    expect($result)->not->toContain('secret-key-line')
+        ->and($result)->toEndWith(REDACTED."\nafter");
+});
+
+it('always redacts short locked secrets but not short unlocked values', function () {
+    $result = (new SensitiveDataRedactor)->redactText('pin 4821 mode dev', ['dev'], ['4821']);
+
+    expect($result)->toBe('pin '.REDACTED.' mode dev');
+});
+
+it('redacts complete quoted assignment values that contain spaces', function () {
+    $result = (new SensitiveDataRedactor)->redactText("password=\"first second\" PASSWORD='third fourth' next=1");
+
+    expect($result)
+        ->not->toContain('first')
+        ->not->toContain('second')
+        ->not->toContain('third')
+        ->not->toContain('fourth')
+        ->toBe('password="'.REDACTED.'" PASSWORD=\''.REDACTED.'\' next=1');
+});
+
+it('redacts arrayable objects and hides unknown objects', function () {
+    $secret = 'coolify-canary-object-secret';
+    $unknown = new class
+    {
+        public string $value = 'coolify-canary-object-secret';
+    };
+
+    $result = (new SensitiveDataRedactor)->redactValue([
+        'collection' => collect(['password' => $secret, 'name' => 'demo']),
+        'unknown' => $unknown,
+        'status' => ApplicationDeploymentStatus::FINISHED,
+    ]);
+
+    expect(serialize($result))->not->toContain($secret)
+        ->and($result['collection'])->toBe(['password' => REDACTED, 'name' => 'demo'])
+        ->and($result['unknown'])->toStartWith('[object ')
+        ->and($result['status'])->toBe(ApplicationDeploymentStatus::FINISHED);
+});
+
+it('redacts keys that end with a sensitive name', function () {
+    $redactor = new SensitiveDataRedactor;
+
+    expect($redactor->redactValue(['smtp_password' => 'hunter2', 'githubToken' => 'abc', 'X-Webhook-Secret' => 'def', 'token_count' => 5, 'password_reset_at' => 'today']))
+        ->toBe(['smtp_password' => REDACTED, 'githubToken' => REDACTED, 'X-Webhook-Secret' => REDACTED, 'token_count' => 5, 'password_reset_at' => 'today'])
+        ->and($redactor->redactText('smtp_password=hunter2 "db-password": "p w" max_tokens=100'))
+        ->toBe('smtp_password='.REDACTED.' "db-password": "'.REDACTED.'" max_tokens=100');
+});
+
+it('keeps quotes around redacted assignment values so JSON stays valid', function () {
+    $redactor = new SensitiveDataRedactor;
+
+    $json = $redactor->redactText('{"token": "abc", "password": "a\\"b", "name": "demo"}');
+
+    expect($json)->toBe('{"token": "'.REDACTED.'", "password": "'.REDACTED.'", "name": "demo"}')
+        ->and(json_decode($json, true))->toBe(['token' => REDACTED, 'password' => REDACTED, 'name' => 'demo'])
+        ->and($redactor->redactText("{'secret': 'abc'}"))->toBe("{'secret': '".REDACTED."'}");
+});
+
+it('does not treat prose or working directories as secret assignments', function () {
+    $redactor = new SensitiveDataRedactor;
+
+    expect($redactor->redactText('Failed to refresh token: Connection refused'))->toBe('Failed to refresh token: Connection refused')
+        ->and($redactor->redactText('PWD=/artifacts/abc'))->toBe('PWD=/artifacts/abc');
+});
+
+it('still redacts real secret assignments', function (string $text, string $expected) {
+    expect((new SensitiveDataRedactor)->redactText($text))->toBe($expected);
+})->with([
+    'equals' => ['password=abc', 'password='.REDACTED],
+    'quoted key and value' => ['"password": "abc"', '"password": "'.REDACTED.'"'],
+    'quoted key with bare value' => ['"token": abc123,', '"token": '.REDACTED.','],
+    'env style' => ['API_TOKEN=abc', 'API_TOKEN='.REDACTED],
+    'env style with colon' => ['POSTGRES_PASSWORD: abc next', 'POSTGRES_PASSWORD: '.REDACTED.' next'],
+    'compound key with colon' => ['smtp_password: abc next', 'smtp_password: '.REDACTED.' next'],
+    'yaml value at line end' => ["password: correcthorse\nnext", 'password: '.REDACTED."\nnext"],
+    'value that looks like a secret' => ['Password: hunter2 was set', 'Password: '.REDACTED.' was set'],
+    'authorization header' => ['Authorization: Bearer x', 'Authorization: '.REDACTED],
+]);
+
+it('replaces short locked values only as whole tokens', function () {
+    $redactor = new SensitiveDataRedactor;
+
+    expect($redactor->redactText('database ab_c cab 9ab', lockedSecrets: ['ab']))->toBe('database ab_c cab 9ab')
+        ->and($redactor->redactText('password xy user=xy "xy" postgres://u:xy@host', lockedSecrets: ['xy']))
+        ->toBe('password '.REDACTED.' user='.REDACTED.' "'.REDACTED.'" postgres://u:'.REDACTED.'@host')
+        ->and($redactor->redactText('éxyé xy', lockedSecrets: ['xy']))->toBe('éxyé '.REDACTED);
+});
+
+it('replaces encoded short locked values and long locked values longest first', function () {
+    $result = (new SensitiveDataRedactor)->redactText('p%40s p\\"s\\"q long-locked-value long-locked-value-2 inside-long-locked-valueX', lockedSecrets: ['p@s', 'p"s"q', 'long-locked-value', 'long-locked-value-2']);
+
+    expect($result)->toBe(REDACTED.' '.REDACTED.' '.REDACTED.' '.REDACTED.' inside-'.REDACTED.'X');
+});
+
+it('falls back to line by line redaction when a chunk exceeds PCRE limits', function () {
+    $text = "password=first-secret\n".str_repeat('a-', 40000)."\nToken=locked-value-123 next=1\nlast line";
+
+    $result = (new SensitiveDataRedactor)->redactText($text, lockedSecrets: ['locked-value-123']);
+
+    expect($result)->toBe('password='.REDACTED."\n".SensitiveDataRedactor::FAILURE_MESSAGE."\nToken=".REDACTED." next=1\nlast line");
+});
+
+it('redacts an unterminated private key followed by a lot of output without suppressing other lines', function () {
+    $text = "before password=abc\n-----BEGIN PRIVATE KEY-----\n".str_repeat("secret-key-line\n", 70000).'tail';
+
+    $result = (new SensitiveDataRedactor)->redactText($text);
+
+    expect($result)->not->toContain('secret-key-line')
+        ->not->toContain(SensitiveDataRedactor::FAILURE_MESSAGE)
+        ->toStartWith('before password='.REDACTED."\n");
+});
+
+it('keeps the quotes around a quoted shell assignment and hides its whole value', function (string $text, string $expected) {
+    expect((new SensitiveDataRedactor)->redactText($text))->toBe($expected);
+})->with([
+    'single quoted build arg' => [
+        "docker build --build-arg 'COOLIFY_BUILD_SECRETS_HASH=abc123def' --build-arg 'COOLIFY_URL'",
+        "docker build --build-arg 'COOLIFY_BUILD_SECRETS_HASH=".REDACTED."' --build-arg 'COOLIFY_URL'",
+    ],
+    'double quoted value with a space' => [
+        'export "DB_PASSWORD=first second" && next',
+        'export "DB_PASSWORD='.REDACTED.'" && next',
+    ],
+    'single quoted value with a space' => [
+        "--env 'api_token=abc def' --rm",
+        "--env 'api_token=".REDACTED."' --rm",
+    ],
+]);
diff --git a/tests/Unit/ServerTransfer/ServerTransferBundleTest.php b/tests/Unit/ServerTransfer/ServerTransferBundleTest.php
index 5a476cf345..cd4d74019b 100644
--- a/tests/Unit/ServerTransfer/ServerTransferBundleTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferBundleTest.php
@@ -46,49 +46,32 @@ test('assertValid throws validation exception', function () {
     ServerTransferBundle::assertValid(['schema_version' => 99]);
 })->throws(ValidationException::class);
 
-test('passphrase encrypt decrypt round trip', function () {
-    $original = ServerTransferBundle::wrap([
-        'private_key' => ['private_key' => 'secret-key-material'],
-        'server' => [
-            'uuid' => 'srv-1',
-            'name' => 'web',
-            'ip' => '10.0.0.1',
-            'port' => 22,
-            'user' => 'root',
-        ],
-        'destinations' => [['uuid' => 'd1', 'name' => 'coolify', 'network' => 'coolify', 'type' => 'standalone']],
-        'projects' => [],
-    ]);
-
-    $encrypted = ServerTransferBundle::encryptWithPassphrase($original, 'correct horse battery staple');
-
-    expect($encrypted['encrypted'])->toBeTrue()
-        ->and($encrypted['payload'])->toBeString();
-
-    $restored = ServerTransferBundle::decryptWithPassphrase($encrypted, 'correct horse battery staple');
-
-    expect($restored['export_id'])->toBe($original['export_id'])
-        ->and($restored['server']['uuid'])->toBe('srv-1')
-        ->and($restored['private_key']['private_key'])->toBe('secret-key-material');
-});
-
-test('wrong passphrase fails decrypt', function () {
-    $original = ServerTransferBundle::wrap([
+function bundleTestMinimalBundle(): array
+{
+    return ServerTransferBundle::wrap([
         'private_key' => ['private_key' => 'x'],
         'server' => ['uuid' => 's', 'name' => 'n', 'ip' => '1.1.1.1', 'port' => 22, 'user' => 'root'],
         'destinations' => [],
         'projects' => [],
     ]);
+}
 
-    $encrypted = ServerTransferBundle::encryptWithPassphrase($original, 'good-pass');
+test('validate rejects a bundle from a newer or unknown Coolify version', function (?string $version, string $error) {
+    $bundle = bundleTestMinimalBundle();
+    $bundle['coolify_version'] = $version;
 
-    ServerTransferBundle::decryptWithPassphrase($encrypted, 'bad-pass');
-})->throws(RuntimeException::class);
+    $result = ServerTransferBundle::validate($bundle);
 
-test('app key seal unseal round trip', function () {
-    $original = ['hello' => 'world', 'n' => 1];
-    $sealed = ServerTransferBundle::sealWithAppKey($original);
-    $restored = ServerTransferBundle::unsealWithAppKey($sealed);
+    expect($result['valid'])->toBeFalse()
+        ->and(implode(' ', $result['errors']))->toContain($error);
+})->with([
+    'newer' => ['99.0.0', 'Upgrade this instance'],
+    'missing' => [null, 'Missing coolify_version'],
+]);
 
-    expect($restored)->toBe($original);
+test('validate accepts a bundle from an older Coolify version', function () {
+    $bundle = bundleTestMinimalBundle();
+    $bundle['coolify_version'] = '4.0.0';
+
+    expect(ServerTransferBundle::validate($bundle)['valid'])->toBeTrue();
 });
diff --git a/tests/Unit/ServerTransfer/ServerTransferClaimerTest.php b/tests/Unit/ServerTransfer/ServerTransferClaimerTest.php
index 11ef8e4369..c5c07e6195 100644
--- a/tests/Unit/ServerTransfer/ServerTransferClaimerTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferClaimerTest.php
@@ -1,16 +1,35 @@
 <?php
 
+use App\Enums\GithubRunnerStatus;
+use App\Jobs\CleanupGithubRunnerJob;
+use App\Jobs\DeregisterGithubRunnerJob;
+use App\Jobs\ProvisionGithubRunnerJob;
+use App\Models\Application;
+use App\Models\DnsProviderZone;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
 use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
 use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
 use Tests\TestCase;
 
 uses(TestCase::class, RefreshDatabase::class);
 
 beforeEach(function () {
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
     $this->team = Team::factory()->create();
@@ -59,3 +78,213 @@ test('claim persists ownership metadata and always rebinds Sentinel', function (
         ->and((bool) $this->server->settings->is_sentinel_enabled)->toBeTrue()
         ->and((string) $this->server->settings->sentinel_custom_url)->toBe('https://coolify-a.test');
 });
+
+test('claim writes the owner marker with its claim id on the host', function () {
+    $result = app(ServerTransferClaimer::class)->claim($this->server);
+
+    $claimId = data_get($result, 'claim.claim_id');
+    expect($claimId)->toBeString()->not->toBeEmpty()
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.claim.claim_id'))->toBe($claimId);
+
+    Process::assertRan(function ($process) use ($claimId) {
+        $marker = json_decode((string) $process->input, true);
+
+        return str_contains($process->command, ServerTransferClaimer::OWNER_MARKER_PATH)
+            && data_get($marker, 'claim_id') === $claimId
+            && data_get($marker, 'instance_url') === 'https://coolify-a.test';
+    });
+});
+
+test('claim changes nothing when the owner marker cannot be written', function () {
+    Process::fake(['*' => Process::result(errorOutput: 'Permission denied', exitCode: 1)]);
+    $sentinelUrlBefore = $this->server->settings->sentinel_custom_url;
+
+    expect(fn () => app(ServerTransferClaimer::class)->claim($this->server))->toThrow(RuntimeException::class);
+
+    $this->server->refresh();
+    expect(data_get($this->server->server_metadata, 'transfer.status'))->toBe('imported')
+        ->and(data_get($this->server->server_metadata, 'transfer.claim'))->toBeNull()
+        ->and($this->server->settings->sentinel_custom_url)->toBe($sentinelUrlBefore);
+});
+
+test('a server is released when its owner marker names the claim of another instance', function () {
+    app(ServerTransferClaimer::class)->claim($this->server);
+
+    $released = app(ServerTransferClaimer::class)->releaseIfClaimedElsewhere($this->server->fresh(), json_encode([
+        'claim_id' => 'claim-of-instance-b',
+        'instance_url' => 'https://coolify-b.test',
+    ]));
+
+    $this->server->refresh();
+    expect($released)->toBeTrue()
+        ->and($this->server->isTransferredAway())->toBeTrue()
+        ->and(data_get($this->server->server_metadata, 'transfer.target_instance_url'))->toBe('https://coolify-b.test')
+        ->and((bool) $this->server->settings->force_disabled)->toBeTrue()
+        ->and((bool) $this->server->settings->is_sentinel_enabled)->toBeFalse();
+});
+
+test('a server is not released when the owner marker is its own claim or missing', function (?string $marker) {
+    $claimId = data_get(app(ServerTransferClaimer::class)->claim($this->server), 'claim.claim_id');
+    $marker = $marker === 'own' ? json_encode(['claim_id' => $claimId, 'instance_url' => 'https://coolify-a.test']) : $marker;
+
+    $released = app(ServerTransferClaimer::class)->releaseIfClaimedElsewhere($this->server->fresh(), $marker);
+
+    expect($released)->toBeFalse()
+        ->and($this->server->fresh()->isTransferredAway())->toBeFalse()
+        ->and((bool) $this->server->fresh()->settings->force_disabled)->toBeFalse();
+})->with([
+    'own claim' => 'own',
+    'no marker' => '',
+    'unreadable marker' => 'not json',
+    'marker without claim id' => '{"instance_url":"https://coolify-b.test"}',
+]);
+
+test('a server that this instance never claimed ignores the owner marker', function () {
+    $released = app(ServerTransferClaimer::class)->releaseIfClaimedElsewhere($this->server, json_encode([
+        'claim_id' => 'left-over-claim-of-a-deleted-instance',
+        'instance_url' => 'https://coolify-b.test',
+    ]));
+
+    expect($released)->toBeFalse()
+        ->and($this->server->fresh()->isTransferredAway())->toBeFalse();
+});
+
+test('markTransferred keeps the DNS records of the server resources as not owned, without provider calls', function () {
+    Http::fake();
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create(['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()]);
+    $otherApplication = Application::factory()->create();
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare']);
+    $zone = DnsProviderZone::factory()->create(['integration_token_id' => $token->id]);
+    $onlyThisServer = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id]);
+    $onlyThisServer->addReference($application);
+    $shared = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id]);
+    $shared->addReference($application);
+    $shared->addReference($otherApplication);
+
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    Http::assertNothingSent();
+    expect($onlyThisServer->fresh()->owned)->toBeFalse()
+        ->and($onlyThisServer->fresh()->references()->pluck('resource_id')->all())->toBe([$application->id])
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.parked_dns_record_ids'))->toBe([$onlyThisServer->id])
+        ->and($shared->fresh()->owned)->toBeTrue()
+        ->and($shared->fresh()->references()->pluck('resource_id')->all())->toBe([$otherApplication->id]);
+});
+
+test('take back owns the parked DNS records again and starts the finish list', function (string $remoteComment, bool $reclaimed) {
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create(['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()]);
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare']);
+    $zone = DnsProviderZone::factory()->create(['integration_token_id' => $token->id]);
+    $record = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id, 'name' => 'app.example.test', 'type' => 'A', 'content' => '10.0.0.1']);
+    $record->addReference($application);
+    $claimer = app(ServerTransferClaimer::class);
+    $claimer->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+    $claimer->claim($this->server->fresh());
+    $remote = ['type' => 'A', 'name' => 'app.example.test', 'content' => '10.0.0.1', 'comment' => str_replace('{uuid}', $record->uuid, $remoteComment)];
+    Http::fake([
+        'api.cloudflare.com/*' => fn ($request) => $request->method() === 'GET'
+            ? Http::response(['success' => true, 'result' => $remote])
+            : Http::response(['success' => true, 'result' => [...$remote, 'comment' => $record->ownershipComment()]]),
+    ]);
+
+    $items = $claimer->restoreAfterTakeBack($this->server->fresh());
+
+    expect($record->fresh()->owned)->toBe($reclaimed)
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.parked_dns_record_ids'))->toBeNull()
+        ->and(array_column($items, 'key'))->toContain("dns_record:{$record->uuid}", "manual_webhook:{$application->uuid}")
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.finish.items'))->toBe($items);
+    if ($reclaimed) {
+        Http::assertSent(fn ($request) => $request->method() === 'PATCH' && $request['comment'] === $record->ownershipComment());
+    } else {
+        Http::assertNotSent(fn ($request) => $request->method() === 'PATCH');
+    }
+})->with([
+    'the other instance adopted the record' => ['managed-by: coolify other-instance/{uuid}', true],
+    'someone changed the record at the provider' => ['set by hand', false],
+]);
+
+function transferRunnerSetup(Server $server): array
+{
+    $githubApp = GithubApp::create([
+        'name' => 'runner-app',
+        'organization' => 'acme',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 5151,
+        'installation_id' => 5252,
+        'webhook_secret' => 'runner-secret',
+        'team_id' => $server->team_id,
+        'is_system_wide' => false,
+    ]);
+    $config = GithubRunnerConfig::create(['server_id' => $server->id, 'github_app_id' => $githubApp->id, 'labels' => ['coolify'], 'is_enabled' => true]);
+
+    return [$githubApp, $config];
+}
+
+test('markTransferred disables the runner config and stops tracking the runners without removing them at GitHub', function () {
+    Queue::fake();
+    [$githubApp, $config] = transferRunnerSetup($this->server);
+    $execution = fn (GithubRunnerStatus $status, array $attributes = []) => GithubRunnerExecution::create([
+        'github_app_id' => $githubApp->id,
+        'github_runner_config_id' => $config->id,
+        'server_id' => $this->server->id,
+        'trigger_workflow_job_id' => fake()->unique()->numberBetween(1000, 9999),
+        'status' => $status,
+        'runner_id' => fake()->unique()->numberBetween(1, 999),
+        ...$attributes,
+    ]);
+    $active = collect([
+        $execution(GithubRunnerStatus::Queued, ['runner_id' => null]),
+        $execution(GithubRunnerStatus::Provisioning),
+        $execution(GithubRunnerStatus::Idle),
+        $execution(GithubRunnerStatus::Running),
+    ]);
+    $completed = $execution(GithubRunnerStatus::Completed, ['completed_at' => now()->subDay(), 'error_message' => null]);
+
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    expect($config->fresh()->is_enabled)->toBeFalse()
+        ->and($completed->fresh()->only(['status', 'error_message']))->toBe(['status' => GithubRunnerStatus::Completed, 'error_message' => null]);
+    foreach ($active as $row) {
+        $row->refresh();
+        expect($row->status)->toBe(GithubRunnerStatus::Cancelled)
+            ->and($row->completed_at)->not->toBeNull()
+            ->and($row->error_message)->toBe('The server was transferred to another Coolify instance. This instance stopped managing its runners.');
+    }
+
+    // Deleting the archive later must not pull the runners that now belong to the target.
+    $this->server->fresh()->forceDelete();
+
+    Queue::assertNotPushed(DeregisterGithubRunnerJob::class);
+    Queue::assertNotPushed(CleanupGithubRunnerJob::class);
+});
+
+test('a GitHub webhook does not queue a runner for a transferred server', function () {
+    Queue::fake();
+    [$githubApp] = transferRunnerSetup($this->server);
+    $send = function () use ($githubApp) {
+        $body = json_encode([
+            'action' => 'queued',
+            'workflow_job' => ['id' => fake()->unique()->numberBetween(1000, 9999), 'labels' => ['self-hosted', 'coolify'], 'name' => 'test'],
+            'repository' => ['id' => 99, 'full_name' => 'acme/api'],
+            'installation' => ['id' => $githubApp->installation_id],
+        ], JSON_THROW_ON_ERROR);
+
+        return $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'workflow_job',
+            'HTTP_X-GitHub-Hook-Installation-Target-Id' => (string) $githubApp->app_id,
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'runner-secret'),
+            'CONTENT_TYPE' => 'application/json',
+        ], $body);
+    };
+    $send()->assertSee('Runner queued.');
+    GithubRunnerExecution::query()->delete();
+
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    $send()->assertSee('No runner configuration matches the job labels.');
+    expect(GithubRunnerExecution::count())->toBe(0);
+    Queue::assertPushed(ProvisionGithubRunnerJob::class, 1);
+});
diff --git a/tests/Unit/ServerTransfer/ServerTransferCoverageTest.php b/tests/Unit/ServerTransfer/ServerTransferCoverageTest.php
new file mode 100644
index 0000000000..82448a4b6b
--- /dev/null
+++ b/tests/Unit/ServerTransfer/ServerTransferCoverageTest.php
@@ -0,0 +1,211 @@
+<?php
+
+use App\Jobs\ValidateAndInstallServerJob;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\CloudProviderToken;
+use App\Models\DnsProviderZone;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledTask;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\SslCertificate;
+use App\Models\StandaloneDocker;
+use App\Models\SwarmDocker;
+use App\Models\Tag;
+use App\Models\Team;
+use App\Services\ServerTransfer\ServerTransferCoverage;
+use App\Services\ServerTransfer\ServerTransferExporter;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Storage;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+/**
+ * Saves a record without model events. Required columns that $attributes leaves out get a dummy value.
+ *
+ * @param  class-string<Model>  $modelClass
+ * @param  array<string, mixed>  $attributes
+ */
+function transferCoverageRecord(string $modelClass, array $attributes = []): Model
+{
+    $model = new $modelClass;
+    foreach (Schema::getColumns($model->getTable()) as $column) {
+        $name = $column['name'];
+        if (array_key_exists($name, $attributes) || $column['nullable'] || $column['default'] !== null || $name === 'id' || $column['auto_increment']) {
+            continue;
+        }
+        // The SQLite test schema reports dates as text, so the model casts decide first.
+        $type = strtolower($column['type_name']);
+        $attributes[$name] = match (true) {
+            $name === 'uuid' => new_public_id(),
+            $model->hasCast($name, ['date', 'datetime', 'immutable_date', 'immutable_datetime', 'timestamp']) => now(),
+            $model->hasCast($name, ['bool', 'boolean']) || str_contains($type, 'bool') => false,
+            $model->hasCast($name, ['array', 'json', 'collection', 'object']) || str_contains($type, 'json') => [],
+            str_contains($type, 'int') => 1,
+            default => 'coverage_'.$name,
+        };
+    }
+
+    return $modelClass::withoutEvents(function () use ($model, $attributes) {
+        $model->forceFill($attributes)->save();
+
+        return $model;
+    });
+}
+
+/**
+ * Every key that the records at these bundle paths contain, also the keys of their `attributes` object.
+ * A record with a `model` key counts only for that model.
+ *
+ * @param  array<string, mixed>  $bundle
+ * @param  list<string>  $paths
+ * @return array{keys: list<string>, records: int}
+ */
+function transferCoverageBundleKeys(array $bundle, array $paths, string $modelClass): array
+{
+    $records = collect($paths)
+        ->flatMap(function (string $path) use ($bundle) {
+            $found = data_get($bundle, $path);
+
+            // A path to one record returns the record itself; a path with `*` returns a list of records.
+            return is_array($found) && ! array_is_list($found) ? [$found] : Arr::wrap($found);
+        })
+        ->filter(fn ($record) => is_array($record) && ! array_is_list($record))
+        ->filter(fn (array $record) => ! isset($record['model']) || $record['model'] === $modelClass);
+
+    $keys = $records->flatMap(fn (array $record) => [...array_keys($record), ...array_keys((array) ($record['attributes'] ?? []))]);
+
+    return ['keys' => $keys->unique()->values()->all(), 'records' => $records->count()];
+}
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Process::fake();
+    Storage::fake('ssh-keys');
+    Storage::fake('images');
+    Queue::fake([ValidateAndInstallServerJob::class]);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
+
+    $team = Team::factory()->create();
+    $teamId = ['team_id' => $team->id];
+    $privateKey = PrivateKey::factory()->create($teamId);
+    $deployKey = PrivateKey::factory()->create([...$teamId, 'private_key' => generateSSHKey('ed25519')['private']]);
+    $token = CloudProviderToken::factory()->create($teamId);
+    $this->server = Server::factory()->create([...$teamId, 'private_key_id' => $privateKey->id, 'cloud_provider_token_id' => $token->id, 'ip' => '10.88.0.10']);
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    transferCoverageRecord(SwarmDocker::class, ['server_id' => $this->server->id]);
+    transferCoverageRecord(SslCertificate::class, ['server_id' => $this->server->id]);
+
+    $project = Project::factory()->create($teamId);
+    Storage::disk('images')->put("project-icons/{$project->uuid}/icon.jpg", "\xFF\xD8\xFF\xE0\x00\x10JFIF\x00coverage");
+    $project->forceFill(['icon_path' => "project-icons/{$project->uuid}/icon.jpg", 'icon_storage_type' => 'local'])->saveQuietly();
+    $environment = $project->environments()->first() ?? Environment::factory()->create(['project_id' => $project->id]);
+    $onDestination = ['environment_id' => $environment->id, 'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()];
+
+    $githubApp = transferCoverageRecord(GithubApp::class, [...$teamId, 'is_system_wide' => false, 'private_key_id' => $deployKey->id]);
+    $gitlabApp = transferCoverageRecord(GitlabApp::class, [...$teamId, 'is_system_wide' => false]);
+    $application = Application::factory()->create([...$onDestination, 'source_type' => GithubApp::class, 'source_id' => $githubApp->id, 'private_key_id' => $deployKey->id]);
+    Application::factory()->create([...$onDestination, 'source_type' => GitlabApp::class, 'source_id' => $gitlabApp->id]);
+    $giteaApp = transferCoverageRecord(GiteaApp::class, [...$teamId, 'is_system_wide' => false]);
+    Application::factory()->create([...$onDestination, 'source_type' => GiteaApp::class, 'source_id' => $giteaApp->id]);
+    $preview = transferCoverageRecord(ApplicationPreview::class, ['application_id' => $application->id]);
+
+    $s3 = transferCoverageRecord(S3Storage::class, $teamId);
+    $service = Service::factory()->create([...$onDestination, 'server_id' => $this->server->id]);
+    transferCoverageRecord(ResourceLink::class, [
+        'environment_id' => $environment->id,
+        'source_type' => $application->getMorphClass(), 'source_id' => $application->id,
+        'target_type' => $service->getMorphClass(), 'target_id' => $service->id,
+    ]);
+    transferCoverageRecord(GithubRunnerConfig::class, ['server_id' => $this->server->id, 'github_app_id' => $githubApp->id, 'labels' => ['coverage']]);
+    transferCoverageRecord(ServiceApplication::class, ['service_id' => $service->id]);
+    transferCoverageRecord(ServiceDatabase::class, ['service_id' => $service->id]);
+
+    $databases = collect(ServerTransferCoverage::TRANSFERRED)->keys()
+        ->filter(fn (string $class) => str_starts_with(class_basename($class), 'Standalone') && ! in_array($class, [StandaloneDocker::class], true))
+        ->map(fn (string $class) => transferCoverageRecord($class, $onDestination));
+
+    $volume = transferCoverageRecord(LocalPersistentVolume::class, ['resource_type' => $application->getMorphClass(), 'resource_id' => $application->id]);
+    transferCoverageRecord(LocalFileVolume::class, ['resource_type' => $application->getMorphClass(), 'resource_id' => $application->id]);
+    transferCoverageRecord(ScheduledVolumeBackup::class, [...$teamId, 'backupable_type' => $volume->getMorphClass(), 'backupable_id' => $volume->id, 's3_storage_id' => $s3->id]);
+    transferCoverageRecord(ScheduledTask::class, [...$teamId, 'application_id' => $application->id]);
+    transferCoverageRecord(ScheduledTask::class, [...$teamId, 'service_id' => $service->id]);
+    transferCoverageRecord(ScheduledDatabaseBackup::class, [...$teamId, 'database_type' => $databases->first()->getMorphClass(), 'database_id' => $databases->first()->id, 's3_storage_id' => $s3->id]);
+
+    $tag = transferCoverageRecord(Tag::class, $teamId);
+    foreach ([$application, $databases->first(), $service] as $tagged) {
+        $tagged->tags()->attach($tag->id);
+    }
+
+    foreach ([$application, $preview->application, $databases->first(), $service] as $resource) {
+        transferCoverageRecord(EnvironmentVariable::class, ['resourceable_type' => $resource->getMorphClass(), 'resourceable_id' => $resource->id, 'key' => 'COVERAGE_'.fake()->unique()->numberBetween(), 'value' => '{{team.COVERAGE_TEAM}}']);
+    }
+    transferCoverageRecord(EnvironmentVariable::class, ['resourceable_type' => $application->getMorphClass(), 'resourceable_id' => $application->id, 'key' => 'COVERAGE_PREVIEW', 'value' => 'x', 'is_preview' => true]);
+    transferCoverageRecord(SharedEnvironmentVariable::class, [...$teamId, 'type' => 'team', 'key' => 'COVERAGE_TEAM']);
+    transferCoverageRecord(SharedEnvironmentVariable::class, [...$teamId, 'type' => 'server', 'server_id' => $this->server->id]);
+    transferCoverageRecord(SharedEnvironmentVariable::class, [...$teamId, 'type' => 'project', 'project_id' => $project->id]);
+    transferCoverageRecord(SharedEnvironmentVariable::class, [...$teamId, 'type' => 'environment', 'environment_id' => $environment->id]);
+
+    $cloudflareToken = IntegrationToken::factory()->create([...$teamId, 'provider' => 'cloudflare', 'capabilities' => ['dns', 'tunnel'], 'metadata' => ['automatic_dns' => true]]);
+    $secretsToken = IntegrationToken::factory()->create([...$teamId, 'provider' => 'infisical', 'capabilities' => ['secrets'], 'metadata' => ['client_id' => 'coverage']]);
+    $zone = DnsProviderZone::factory()->create(['integration_token_id' => $cloudflareToken->id]);
+    ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id])->addReference($application);
+    $application->secretManagerLink()->create(['integration_token_id' => $secretsToken->id, 'settings' => ['project_id' => 'coverage', 'environment' => 'prod']]);
+    $this->server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $cloudflareToken->id])->saveQuietly();
+
+    $this->bundle = app(ServerTransferExporter::class)->export($this->server->fresh());
+});
+
+test('every model has a server transfer decision', function () {
+    $models = collect(glob(app_path('Models/*.php')))
+        ->map(fn (string $file) => 'App\\Models\\'.basename($file, '.php'))
+        ->filter(fn (string $class) => is_subclass_of($class, Model::class) && ! (new ReflectionClass($class))->isAbstract());
+
+    $undecided = $models
+        ->reject(fn (string $class) => array_key_exists($class, ServerTransferCoverage::TRANSFERRED)
+            || array_key_exists($class, ServerTransferCoverage::NOT_TRANSFERRED))
+        ->values()->all();
+
+    expect($undecided)->toBe([], 'Add these models to the server transfer (ServerTransferExporter/Importer and ServerTransferCoverage::TRANSFERRED), or to ServerTransferCoverage::NOT_TRANSFERRED with a reason.');
+});
+
+test('every column of a transferred model is in the bundle or has a reason why not', function (string $modelClass) {
+    ['keys' => $exported, 'records' => $records] = transferCoverageBundleKeys($this->bundle, ServerTransferCoverage::TRANSFERRED[$modelClass], $modelClass);
+    expect($records)->toBeGreaterThan(0, "The coverage fixture exports no {$modelClass}. Add a record of it to the beforeEach of this test.");
+
+    $notExported = [...ServerTransferCoverage::ALWAYS_NOT_EXPORTED, ...array_keys(ServerTransferCoverage::NOT_EXPORTED_COLUMNS[$modelClass] ?? [])];
+    $columns = Schema::getColumnListing((new $modelClass)->getTable());
+
+    expect(array_values(array_diff($columns, $exported, $notExported)))
+        ->toBe([], "These {$modelClass} columns are not in the transfer bundle. Export and import them (with a round-trip test), or add them to ServerTransferCoverage::NOT_EXPORTED_COLUMNS with a reason.")
+        ->and(array_values(array_intersect(array_keys(ServerTransferCoverage::NOT_EXPORTED_COLUMNS[$modelClass] ?? []), $exported)))
+        ->toBe([], "These {$modelClass} columns are exported, so remove them from ServerTransferCoverage::NOT_EXPORTED_COLUMNS.")
+        ->and(array_values(array_diff(array_keys(ServerTransferCoverage::NOT_EXPORTED_COLUMNS[$modelClass] ?? []), $columns)))
+        ->toBe([], "These {$modelClass} columns no longer exist, so remove them from ServerTransferCoverage::NOT_EXPORTED_COLUMNS.");
+})->with(array_keys(ServerTransferCoverage::TRANSFERRED));
diff --git a/tests/Unit/ServerTransfer/ServerTransferDnsTest.php b/tests/Unit/ServerTransfer/ServerTransferDnsTest.php
new file mode 100644
index 0000000000..3dc6aedef1
--- /dev/null
+++ b/tests/Unit/ServerTransfer/ServerTransferDnsTest.php
@@ -0,0 +1,250 @@
+<?php
+
+use App\Jobs\ReleaseManagedDnsRecordsJob;
+use App\Jobs\ValidateAndInstallServerJob;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\DnsProviderZone;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Services\ServerTransfer\ServerTransferExporter;
+use App\Services\ServerTransfer\ServerTransferImporter;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\Request;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // Deleting the source resources must not release their DNS records at the provider.
+    Queue::fake([ValidateAndInstallServerJob::class, ReleaseManagedDnsRecordsJob::class]);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
+    config(['app.id' => 'source-instance']);
+
+    $this->team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $privateKey->id, 'ip' => '10.66.0.10']);
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = $project->environments()->first() ?? Environment::factory()->create(['project_id' => $project->id]);
+    $onDestination = ['environment_id' => $this->environment->id, 'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()];
+
+    $this->application = Application::factory()->create([...$onDestination, 'name' => 'web', 'fqdn' => 'https://app.example.com']);
+    $this->preview = new ApplicationPreview;
+    $this->preview->forceFill(['application_id' => $this->application->id, 'pull_request_id' => 3, 'pull_request_html_url' => '', 'fqdn' => 'https://pr-3.example.com']);
+    $this->preview->uuid = 'dns-transfer-preview';
+    $this->preview->saveQuietly();
+    $this->service = Service::factory()->create([...$onDestination, 'server_id' => $this->server->id]);
+    $this->serviceApplication = new ServiceApplication;
+    $this->serviceApplication->forceFill(['service_id' => $this->service->id, 'name' => 'whoami', 'fqdn' => 'https://svc.example.com']);
+    $this->serviceApplication->uuid = 'dns-transfer-service-app';
+    $this->serviceApplication->save();
+
+    $this->cloudflareToken = IntegrationToken::factory()->create([
+        'team_id' => $this->team->id, 'provider' => 'cloudflare', 'token' => 'cf-api-token', 'capabilities' => ['dns', 'tunnel'],
+    ]);
+    $this->zone = DnsProviderZone::factory()->create(['integration_token_id' => $this->cloudflareToken->id, 'name' => 'example.com', 'provider_zone_id' => 'zone-1']);
+
+    $this->exporter = app(ServerTransferExporter::class);
+    $this->importer = app(ServerTransferImporter::class);
+});
+
+/**
+ * @param  list<Model>  $resources
+ */
+function dnsTransferRecord(object $test, string $name, array $resources, bool $owned = true): ManagedDnsRecord
+{
+    $record = ManagedDnsRecord::factory()->create([
+        'dns_provider_zone_id' => $test->zone->id, 'provider_record_id' => 'cf-'.$name,
+        'type' => 'A', 'name' => $name, 'content' => '10.66.0.10', 'owned' => $owned,
+    ]);
+    foreach ($resources as $resource) {
+        $record->addReference($resource);
+    }
+
+    return $record;
+}
+
+/**
+ * The source rows are removed so the import can use the same UUIDs. The source forgets the DNS records at transfer.
+ */
+function removeDnsTransferSource(object $test): void
+{
+    ManagedDnsRecord::query()->delete();
+    ApplicationPreview::withoutEvents(fn () => ApplicationPreview::withTrashed()->get()->each->forceDelete());
+    ServiceApplication::withTrashed()->get()->each->forceDelete();
+    $test->service->forceDelete();
+    $test->application->forceDelete();
+    $test->server->forceDelete();
+}
+
+test('integration tokens move with the transfer and a token with the same uuid in the team is reused', function () {
+    $secretsToken = IntegrationToken::factory()->create([
+        'team_id' => $this->team->id, 'provider' => 'infisical', 'token' => 'infisical-secret', 'capabilities' => ['secrets'], 'metadata' => ['client_id' => 'client'],
+    ]);
+    $this->application->secretManagerLink()->create(['integration_token_id' => $secretsToken->id, 'settings' => ['project_id' => 'p1', 'environment' => 'prod']]);
+    $this->service->secretManagerLink()->create(['integration_token_id' => $secretsToken->id, 'settings' => ['project_id' => 'p2', 'environment' => 'dev']]);
+    $this->server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $this->cloudflareToken->id])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    expect(collect($bundle['integration_tokens'])->pluck('token', 'uuid')->all())
+        ->toEqualCanonicalizing([$secretsToken->uuid => 'infisical-secret', $this->cloudflareToken->uuid => 'cf-api-token'])
+        ->and($bundle['server']['settings']['cloudflare_tunnel_integration_token_uuid'])->toBe($this->cloudflareToken->uuid)
+        ->and($bundle['server']['settings'])->not->toHaveKey('cloudflare_tunnel_integration_token_id')
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('secret manager')
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('Cloudflare API token');
+
+    removeDnsTransferSource($this);
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $application = Application::where('uuid', $this->application->uuid)->firstOrFail();
+    $service = Service::where('uuid', $this->service->uuid)->firstOrFail();
+    expect(IntegrationToken::count())->toBe(2)
+        ->and($result['created']['integration_tokens'])->toBe(2)
+        ->and($application->secretManagerLink->integration_token_id)->toBe($secretsToken->id)
+        ->and($application->secretManagerLink->settings)->toBe(['project_id' => 'p1', 'environment' => 'prod'])
+        ->and($service->secretManagerLink->integration_token_id)->toBe($secretsToken->id)
+        ->and($service->secretManagerLink->settings)->toBe(['project_id' => 'p2', 'environment' => 'dev'])
+        ->and(Server::where('uuid', $result['server_uuid'])->firstOrFail()->settings->cloudflare_tunnel_integration_token_id)->toBe($this->cloudflareToken->id);
+});
+
+test('integration tokens get a new uuid in the target team when another team has the uuid', function () {
+    $secretsToken = IntegrationToken::factory()->create(['team_id' => $this->team->id, 'provider' => 'doppler', 'token' => 'dp.st.secret', 'capabilities' => ['secrets']]);
+    $this->application->secretManagerLink()->create(['integration_token_id' => $secretsToken->id, 'settings' => ['project' => 'web', 'config' => 'prd']]);
+    $this->server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $this->cloudflareToken->id])->saveQuietly();
+    $bundle = $this->exporter->export($this->server->fresh());
+    $targetTeam = Team::factory()->create();
+
+    removeDnsTransferSource($this);
+    $result = $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $targetTokens = IntegrationToken::where('team_id', $targetTeam->id)->get()->keyBy('provider');
+    $link = Application::where('uuid', $this->application->uuid)->firstOrFail()->secretManagerLink;
+    expect($targetTokens)->toHaveCount(2)
+        ->and($targetTokens['doppler']->uuid)->not->toBe($secretsToken->uuid)
+        ->and($targetTokens['doppler']->token)->toBe('dp.st.secret')
+        ->and($targetTokens['cloudflare']->uuid)->not->toBe($this->cloudflareToken->uuid)
+        ->and($link->integration_token_id)->toBe($targetTokens['doppler']->id)
+        ->and(Server::where('uuid', $result['server_uuid'])->firstOrFail()->settings->cloudflare_tunnel_integration_token_id)->toBe($targetTokens['cloudflare']->id)
+        ->and($secretsToken->fresh()->team_id)->toBe($this->team->id);
+});
+
+test('managed DNS records, their zone and references move with the resources', function () {
+    Http::fake();
+    $appRecord = dnsTransferRecord($this, 'app.example.com', [$this->application]);
+    dnsTransferRecord($this, 'pr-3.example.com', [$this->preview], owned: false);
+    $serviceRecord = dnsTransferRecord($this, 'svc.example.com', [$this->serviceApplication]);
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    expect($bundle['dns_zones'])->toHaveCount(1)
+        ->and($bundle['integration_tokens'][0]['uuid'])->toBe($this->cloudflareToken->uuid)
+        ->and(collect($bundle['managed_dns_records'])->pluck('references', 'name')->all())->toBe([
+            'app.example.com' => [['kind' => 'application', 'uuid' => $this->application->uuid]],
+            'pr-3.example.com' => [['kind' => 'preview', 'uuid' => 'dns-transfer-preview']],
+            'svc.example.com' => [['kind' => 'service_application', 'uuid' => 'dns-transfer-service-app']],
+        ])
+        ->and($bundle['managed_dns_records'][0]['ownership_comment'])->toBe($appRecord->ownershipComment())
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('DNS record');
+
+    removeDnsTransferSource($this);
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $records = ManagedDnsRecord::with('references.resource')->get()->keyBy('name');
+    expect($result['created']['managed_dns_records'])->toBe(3)
+        ->and(DnsProviderZone::count())->toBe(1)
+        ->and($records)->toHaveCount(3)
+        ->and($records['app.example.com']->uuid)->toBe($appRecord->uuid)
+        ->and($records['app.example.com']->dns_provider_zone_id)->toBe($this->zone->id)
+        ->and($records['app.example.com']->integration_token_id)->toBe($this->cloudflareToken->id)
+        ->and($records['app.example.com']->owned)->toBeTrue()
+        ->and($records['pr-3.example.com']->owned)->toBeFalse()
+        ->and($records['svc.example.com']->uuid)->toBe($serviceRecord->uuid)
+        ->and($records['app.example.com']->references->sole()->resource->uuid)->toBe($this->application->uuid)
+        ->and($records['pr-3.example.com']->references->sole()->resource)->toBeInstanceOf(ApplicationPreview::class)
+        ->and($records['pr-3.example.com']->references->sole()->resource->uuid)->toBe('dns-transfer-preview')
+        ->and($records['svc.example.com']->references->sole()->resource)->toBeInstanceOf(ServiceApplication::class)
+        ->and($records['svc.example.com']->references->sole()->resource->uuid)->toBe('dns-transfer-service-app');
+    // Same instance id and UUID: the provider comment already proves ownership here.
+    Http::assertNothingSent();
+});
+
+test('a DNS record that a resource staying on the source also uses is not exported', function () {
+    $otherServer = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->server->private_key_id, 'ip' => '10.66.0.11']);
+    $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->firstOrFail();
+    $staying = Application::factory()->create([
+        'environment_id' => $this->environment->id, 'destination_id' => $otherDestination->id,
+        'destination_type' => $otherDestination->getMorphClass(), 'fqdn' => 'https://shared.example.com',
+    ]);
+    dnsTransferRecord($this, 'shared.example.com', [$this->application, $staying]);
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    expect($bundle['managed_dns_records'])->toBe([])
+        ->and($bundle['dns_zones'])->toBe([])
+        ->and($bundle['integration_tokens'])->toBe([])
+        ->and(implode(' ', $bundle['warnings']))->toContain('DNS record shared.example.com stays managed by this instance');
+});
+
+test('the target takes ownership of an owned record when the provider still has the source comment', function () {
+    $record = dnsTransferRecord($this, 'app.example.com', [$this->application]);
+    dnsTransferRecord($this, 'pr-3.example.com', [$this->preview], owned: false);
+    $sourceComment = $record->ownershipComment();
+    $bundle = $this->exporter->export($this->server->fresh());
+    removeDnsTransferSource($this);
+
+    $state = fakeCloudflareDns([
+        ['id' => 'cf-app.example.com', 'type' => 'A', 'name' => 'app.example.com', 'content' => '10.66.0.10', 'comment' => $sourceComment],
+        ['id' => 'cf-pr-3.example.com', 'type' => 'A', 'name' => 'pr-3.example.com', 'content' => '10.66.0.10', 'comment' => null],
+    ]);
+    config(['app.id' => 'target-instance']);
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $targetComment = ManagedDnsRecord::ownershipCommentFor($record->uuid);
+    expect($targetComment)->not->toBe($sourceComment)
+        ->and(sentDnsRequests('PATCH'))->toBe(1)
+        ->and(Http::recorded(fn (Request $request) => $request->method() === 'PATCH')->sole()[0]->data())->toBe(['comment' => $targetComment])
+        ->and($state['records']['cf-app.example.com']['comment'])->toBe($targetComment)
+        ->and(ManagedDnsRecord::where('name', 'app.example.com')->sole()->owned)->toBeTrue()
+        ->and(ManagedDnsRecord::where('name', 'pr-3.example.com')->sole()->owned)->toBeFalse()
+        ->and(implode(' ', $result['warnings']))->not->toContain('could not take ownership');
+});
+
+test('the target does not own a record it cannot adopt and the import still succeeds', function (Closure $fakeProvider) {
+    $record = dnsTransferRecord($this, 'app.example.com', [$this->application]);
+    $bundle = $this->exporter->export($this->server->fresh());
+    removeDnsTransferSource($this);
+
+    $fakeProvider($record);
+    config(['app.id' => 'target-instance']);
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    expect(sentDnsRequests('PATCH'))->toBe(0)
+        ->and(Server::where('uuid', $result['server_uuid'])->exists())->toBeTrue()
+        ->and(ManagedDnsRecord::where('name', 'app.example.com')->sole()->owned)->toBeFalse()
+        ->and($result['warnings'])->toContain('DNS record app.example.com: this instance could not take ownership; it will not change or delete it.');
+})->with([
+    'the provider comment changed' => [fn (ManagedDnsRecord $record) => fakeCloudflareDns([
+        ['id' => 'cf-app.example.com', 'type' => 'A', 'name' => 'app.example.com', 'content' => '10.66.0.10', 'comment' => 'edited by hand'],
+    ])],
+    'the provider cannot be reached' => [fn (ManagedDnsRecord $record) => Http::fake(fn () => throw new ConnectionException('Connection refused'))],
+]);
diff --git a/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php b/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
index 1d57fe9aff..2e9610d31f 100644
--- a/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
@@ -1,17 +1,23 @@
 <?php
 
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
+use App\Models\GiteaApp;
 use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
 use App\Models\GitlabApp;
 use App\Models\InstanceSettings;
 use App\Models\IntegrationToken;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
 use App\Models\PrivateKey;
 use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledTask;
 use App\Models\ScheduledVolumeBackup;
@@ -25,17 +31,28 @@ use App\Models\StandalonePostgresql;
 use App\Models\StandaloneSqlite;
 use App\Models\Tag;
 use App\Models\Team;
+use App\Models\User;
 use App\Services\ServerTransfer\ServerTransferBundle;
+use App\Services\ServerTransfer\ServerTransferClaimer;
 use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferImporter;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Validation\ValidationException;
 use Tests\TestCase;
 
 uses(TestCase::class, RefreshDatabase::class);
 
 beforeEach(function () {
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
     $this->team = Team::factory()->create();
@@ -324,12 +341,127 @@ test('round trip import preserves uuids secrets and related resources after sour
         ->and($shared->value)->toBe('shared-secret');
 });
 
+test('import validates the claimed server in the background, but a dry run does not', function () {
+    $bundle = $this->exporter->export($this->server);
+    $serverUuid = $this->server->uuid;
+
+    $this->importer->import($bundle, teamId: $this->team->id, dryRun: true);
+    Queue::assertNotPushed(ValidateAndInstallServerJob::class);
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    expect($result['claimed'])->toBeTrue();
+    Queue::assertPushed(ValidateAndInstallServerJob::class, 1);
+    Queue::assertPushed(ValidateAndInstallServerJob::class, fn (ValidateAndInstallServerJob $job) => $job->server->uuid === $serverUuid);
+});
+
 test('import fails when server ip already exists', function () {
     $bundle = $this->exporter->export($this->server);
 
     $this->importer->import($bundle, teamId: $this->team->id);
 })->throws(ValidationException::class);
 
+test('the Cloudflare tunnel token moves with the server by uuid and the raw token id of an old bundle is ignored', function () {
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare', 'token' => 'cf-tunnel-token', 'capabilities' => ['dns', 'tunnel']]);
+    $this->server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $token->id])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server);
+    expect(data_get($bundle, 'server.settings'))->not->toHaveKey('cloudflare_tunnel_integration_token_id')
+        ->and(data_get($bundle, 'server.settings.cloudflare_tunnel_integration_token_uuid'))->toBe($token->uuid)
+        ->and(data_get($bundle, 'integration_tokens.0.token'))->toBe('cf-tunnel-token')
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('Cloudflare API token');
+
+    $bundle['server']['settings']['cloudflare_tunnel_integration_token_id'] = 999999;
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    $token->delete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $imported = IntegrationToken::where('uuid', $token->uuid)->firstOrFail();
+    expect(Server::where('uuid', $result['server_uuid'])->first()->settings->cloudflare_tunnel_integration_token_id)->toBe($imported->id)
+        ->and($imported->team_id)->toBe($this->team->id)
+        ->and($imported->token)->toBe('cf-tunnel-token');
+});
+
+test('the patch check frequency moves with the server and the last patch check result stays on the source', function () {
+    $this->server->settings->forceFill([
+        'patch_check_frequency' => 'daily',
+        'patch_check_result' => ['osId' => 'ubuntu', 'package_manager' => 'apt', 'total_updates' => 0, 'updates' => []],
+        'patch_check_error' => 'old error',
+        'patch_checked_at' => now(),
+        'is_auto_security_updates_enabled' => true,
+        'auto_security_updates_time' => '04:30',
+    ])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server);
+    expect(data_get($bundle, 'server.settings'))->not->toHaveKeys(['patch_check_result', 'patch_check_error', 'patch_checked_at']);
+
+    $bundle['server']['settings']['patch_check_result'] = ['osId' => 'tampered'];
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $settings = Server::where('uuid', $result['server_uuid'])->first()->settings;
+    expect($settings->patch_check_frequency)->toBe('daily')
+        ->and($settings->is_auto_security_updates_enabled)->toBeTrue()
+        ->and($settings->auto_security_updates_time)->toBe('04:30')
+        ->and($settings->patch_check_result)->toBeNull()
+        ->and($settings->patch_checked_at)->toBeNull();
+});
+
+test('a transfer back replaces the archive of the same team in the import transaction', function () {
+    $bundle = $this->exporter->export($this->server);
+    $bundle['server']['name'] = 'changed-on-the-other-instance';
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+    $archiveId = $this->server->id;
+
+    expect(collect($this->importer->importChecks($this->server->uuid, $this->server->ip, $this->team->id))->every(fn ($check) => $check['ok']))->toBeTrue();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $this->server->uuid)->firstOrFail();
+    expect($result['claimed'])->toBeTrue()
+        ->and($server->id)->not->toBe($archiveId)
+        ->and($server->name)->toBe('changed-on-the-other-instance')
+        ->and($server->isTransferredAway())->toBeFalse()
+        ->and(Server::withTrashed()->find($archiveId))->toBeNull()
+        ->and(Application::where('uuid', $this->application->uuid)->firstOrFail()->destination->server_id)->toBe($server->id);
+    Process::assertDidntRun(fn ($process) => str_contains($process->command, 'docker rm') || str_contains($process->command, 'docker stop'));
+});
+
+test('a failed transfer back keeps the archive', function () {
+    $bundle = $this->exporter->export($this->server);
+    $bundle['projects'][0]['environments'][0]['databases'][] = [
+        'type' => 'NotARealDatabaseType', 'uuid' => 'broken-db-uuid', 'attributes' => ['name' => 'broken'], 'destination_uuid' => $this->destination->uuid,
+    ];
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    expect(fn () => $this->importer->import($bundle, teamId: $this->team->id))->toThrow(RuntimeException::class, 'Unsupported database type');
+
+    expect($this->server->fresh()?->isTransferredAway())->toBeTrue()
+        ->and(Application::where('uuid', $this->application->uuid)->exists())->toBeTrue();
+});
+
+test('the archive of another team is not replaced', function () {
+    $bundle = $this->exporter->export($this->server);
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+    $otherTeam = Team::factory()->create();
+
+    expect(fn () => $this->importer->import($bundle, teamId: $otherTeam->id))
+        ->toThrow(ValidationException::class, 'Another team of this instance has the archived copy');
+});
+
 test('import rolls back all created rows when a later resource fails', function () {
     $bundle = $this->exporter->export($this->server);
     $originalServerUuid = $this->server->uuid;
@@ -370,6 +502,7 @@ test('import reuses existing private key fingerprint on same team', function ()
     $originalKeyId = $this->privateKey->id;
 
     // Free the IP without deleting the key.
+    $this->service->forceDelete();
     $this->application->forceDelete();
     $this->database->forceDelete();
     $this->server->forceDelete();
@@ -386,6 +519,7 @@ test('import into another team creates its own key when the same key exists in a
     $targetTeam = Team::factory()->create();
 
     // Free the IP without deleting the source team's key.
+    $this->service->forceDelete();
     $this->application->forceDelete();
     $this->database->forceDelete();
     $this->server->forceDelete();
@@ -400,21 +534,6 @@ test('import into another team creates its own key when the same key exists in a
         ->and(PrivateKey::whereKey($sourceKeyId)->where('team_id', $this->team->id)->exists())->toBeTrue();
 });
 
-test('encrypted export decrypts for import', function () {
-    $bundle = $this->exporter->export($this->server);
-    $encrypted = ServerTransferBundle::encryptWithPassphrase($bundle, 'transfer-pass');
-
-    $this->application->forceDelete();
-    $this->database->forceDelete();
-    $this->server->forceDelete();
-    $this->privateKey->delete();
-
-    $plain = ServerTransferBundle::decryptWithPassphrase($encrypted, 'transfer-pass');
-    $result = $this->importer->import($plain, teamId: $this->team->id);
-
-    expect(Server::where('uuid', $result['server_uuid'])->exists())->toBeTrue();
-});
-
 test('system-wide github apps are not exported and re-link on import by uuid', function () {
     $systemWide = new GithubApp;
     $systemWide->forceFill([
@@ -883,6 +1002,53 @@ test('system-wide gitlab apps are not exported and re-link on import by uuid', f
         ->and(GitlabApp::where('is_system_wide', true)->where('uuid', 'system-gitlab-public')->count())->toBe(1);
 });
 
+test('team gitea apps round-trip and the application re-links to the imported app', function () {
+    $giteaApp = new GiteaApp;
+    $giteaApp->forceFill([
+        'name' => 'Team Gitea App',
+        'api_url' => 'https://gitea.example.com/api/v1',
+        'html_url' => 'https://gitea.example.com',
+        'is_public' => false,
+        'is_system_wide' => false,
+        'team_id' => $this->team->id,
+        'client_id' => 'gitea-client',
+        'client_secret' => 'gitea-secret',
+        'webhook_secret' => 'gitea-webhook-secret',
+    ]);
+    $giteaApp->uuid = 'team-gitea-app';
+    $giteaApp->save();
+
+    $this->application->source_type = GiteaApp::class;
+    $this->application->source_id = $giteaApp->id;
+    $this->application->save();
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['gitea_apps'])->toHaveCount(1)
+        ->and($bundle['gitea_apps'][0]['client_secret'])->toBe('gitea-secret')
+        ->and(collect($bundle['post_transfer_checklist'])->implode(' '))->toContain('{target_url}/webhooks/source/gitea/redirect');
+
+    $this->service->forceDelete();
+    Application::query()->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    $this->privateKey->delete();
+    $giteaApp->delete();
+
+    $targetTeam = Team::factory()->create();
+    $result = $this->importer->import($bundle, teamId: $targetTeam->id, preserveUuids: true, adoptMode: true);
+
+    $imported = GiteaApp::where('uuid', 'team-gitea-app')->first();
+    $application = Application::where('name', 'my-app')->first();
+
+    expect($result['created']['gitea_apps'])->toBe(1)
+        ->and($imported->team_id)->toBe($targetTeam->id)
+        ->and($imported->client_secret)->toBe('gitea-secret')
+        ->and($imported->webhook_secret)->toBe('gitea-webhook-secret')
+        ->and($application->source_type)->toBe(GiteaApp::class)
+        ->and($application->source_id)->toBe($imported->id);
+});
+
 test('import rejects unsafe host file paths before saving storage', function () {
     $importFileStorages = new ReflectionMethod(ServerTransferImporter::class, 'importFileStorages');
     $storage = [
@@ -990,7 +1156,7 @@ test('transfer keeps the link between an application volume and its sqlite datab
     ScheduledTask::query()->delete();
     $this->privateKey->delete();
 
-    $this->importer->import($bundle, teamId: $this->team->id, dryRun: false, preserveUuids: false, adoptMode: true);
+    $this->importer->import($bundle, teamId: $this->team->id, dryRun: false, preserveUuids: false, adoptMode: false);
 
     $importedSqlite = StandaloneSqlite::where('name', 'app-sqlite')->sole();
     $connectedVolume = Application::where('name', $originalAppName)->sole()
@@ -1002,23 +1168,22 @@ test('transfer keeps the link between an application volume and its sqlite datab
         ->and($importedSqlite->persistentStorages()->sole()->isSharedWithAnotherResource())->toBeTrue();
 });
 
-test('export warns about secret manager links without exporting the integration token', function () {
+test('secret manager links of applications and databases move with their integration token', function () {
     $token = IntegrationToken::factory()->create([
         'team_id' => $this->team->id,
         'provider' => 'vault',
         'token' => 'vault-root-token',
         'capabilities' => ['secrets'],
     ]);
-    $this->application->secretManagerLink()->create(['integration_token_id' => $token->id]);
-    $this->database->secretManagerLink()->create(['integration_token_id' => $token->id]);
+    $this->application->secretManagerLink()->create(['integration_token_id' => $token->id, 'settings' => ['mount' => 'secret', 'path' => 'app']]);
+    $this->database->secretManagerLink()->create(['integration_token_id' => $token->id, 'settings' => ['mount' => 'kv', 'path' => 'db']]);
 
     $bundle = $this->exporter->export($this->server);
-    $warning = collect($bundle['warnings'])->first(fn (string $warning) => str_contains($warning, 'secret manager'));
 
-    expect($warning)->not->toBeNull()
-        ->and($warning)->toContain('my-app')
-        ->and($warning)->toContain('app-db')
-        ->and(json_encode($bundle))->not->toContain('vault-root-token');
+    expect(collect($bundle['warnings'])->filter(fn (string $warning) => str_contains($warning, 'secret manager')))->toBeEmpty()
+        ->and($bundle['integration_tokens'])->toHaveCount(1)
+        ->and($bundle['integration_tokens'][0]['token'])->toBe('vault-root-token')
+        ->and(data_get($bundle, 'projects.0.environments.0.databases.0.secret_manager_link.integration_token_uuid'))->toBe($token->uuid);
 
     $this->service->forceDelete();
     $this->application->forceDelete();
@@ -1028,10 +1193,18 @@ test('export warns about secret manager links without exporting the integration
     ScheduledDatabaseBackup::query()->delete();
     ScheduledTask::query()->delete();
     $this->privateKey->delete();
+    $token->delete();
 
-    $result = $this->importer->import($bundle, teamId: $this->team->id, dryRun: false, preserveUuids: true, adoptMode: true);
+    $this->importer->import($bundle, teamId: $this->team->id, dryRun: false, preserveUuids: true, adoptMode: true);
 
-    expect($result['warnings'])->toContain($warning);
+    $imported = IntegrationToken::where('uuid', $token->uuid)->where('team_id', $this->team->id)->firstOrFail();
+    $application = Application::where('uuid', $this->application->uuid)->firstOrFail();
+    $database = StandalonePostgresql::where('uuid', $this->database->uuid)->firstOrFail();
+    expect($imported->token)->toBe('vault-root-token')
+        ->and($application->secretManagerLink->integration_token_id)->toBe($imported->id)
+        ->and($application->secretManagerLink->settings)->toBe(['mount' => 'secret', 'path' => 'app'])
+        ->and($database->secretManagerLink->integration_token_id)->toBe($imported->id)
+        ->and($database->secretManagerLink->settings)->toBe(['mount' => 'kv', 'path' => 'db']);
 });
 
 test('transfer keeps the Traefik certificate resolver of applications and service applications', function () {
@@ -1071,3 +1244,655 @@ test('transfer keeps the Traefik certificate resolver of applications and servic
     expect(Application::where('uuid', $originalAppUuid)->firstOrFail()->settings->traefik_certificate_resolver)->toBe('none')
         ->and(ServiceApplication::where('uuid', 'svc-app-resolver')->firstOrFail()->traefik_certificate_resolver)->toBe('cloudflare');
 });
+
+test('transfer keeps the cloud provider instance id of the server', function () {
+    $this->server->forceFill(['hetzner_server_id' => 4242, 'vultr_instance_id' => 'vultr-7'])->save();
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $result['server_uuid'])->sole();
+    expect((int) $server->hetzner_server_id)->toBe(4242)
+        ->and($server->vultr_instance_id)->toBe('vultr-7');
+});
+
+test('adopt mode stops the import when a resource uuid is already used', function () {
+    $bundle = $this->exporter->export($this->server);
+    $appUuid = $this->application->uuid;
+
+    // The server is gone, but the application row still holds its UUID on this instance.
+    $this->service->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    expect(fn () => $this->importer->import($bundle, teamId: $this->team->id, adoptMode: true))
+        ->toThrow(ValidationException::class, "The application UUID {$appUuid} is already used");
+
+    expect(Server::where('uuid', $bundle['server']['uuid'])->exists())->toBeFalse();
+});
+
+test('import rejects a database model class that is not a supported database type', function () {
+    $bundle = $this->exporter->export($this->server);
+    $bundle['projects'][0]['environments'][0]['databases'][] = [
+        'type' => 'Unknown',
+        'model' => Application::class,
+        'uuid' => 'not-a-database',
+        'attributes' => ['name' => 'not-a-database'],
+        'destination_uuid' => $this->destination->uuid,
+    ];
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    expect(fn () => $this->importer->import($bundle, teamId: $this->team->id))
+        ->toThrow(RuntimeException::class, 'Unsupported database type');
+
+    expect(Application::where('uuid', 'not-a-database')->exists())->toBeFalse();
+});
+
+test('import rejects unsafe server connection fields', function (string $field, mixed $value) {
+    $bundle = $this->exporter->export($this->server);
+    $bundle['server'][$field] = $value;
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    expect(fn () => $this->importer->import($bundle, teamId: $this->team->id))
+        ->toThrow(ValidationException::class);
+})->with([
+    'ip with shell characters' => ['ip', '10.0.0.1;reboot'],
+    'user with shell characters' => ['user', 'root$(id)'],
+    'port out of range' => ['port', 70000],
+]);
+
+test('export refuses credentials of another team', function () {
+    $otherKey = PrivateKey::factory()->create(['team_id' => Team::factory()->create()->id]);
+    $this->application->forceFill(['private_key_id' => $otherKey->id])->save();
+
+    expect(fn () => $this->exporter->export($this->server))
+        ->toThrow(RuntimeException::class, 'does not belong to the server team');
+});
+
+test('transfer keeps maintenance mode, the server error page and swarm cluster, environment variable flags, and the Coolify default variables switch', function () {
+    $this->application->forceFill(['is_maintenance_enabled' => true, 'maintenance_page' => '<h1>App down</h1>'])->saveQuietly();
+    $this->service->forceFill(['is_maintenance_enabled' => true, 'maintenance_page' => '<h1>Service down</h1>', 'include_coolify_default_variables' => false])->saveQuietly();
+    $this->application->settings->forceFill(['include_coolify_default_variables' => false])->saveQuietly();
+    $this->database->forceFill(['include_coolify_default_variables' => false])->saveQuietly();
+    $this->server->forceFill(['proxy_error_page' => '<h1>Proxy error</h1>', 'swarm_cluster' => 7])->saveQuietly();
+    EnvironmentVariable::withoutEvents(function () {
+        $env = new EnvironmentVariable;
+        $env->forceFill([
+            'key' => 'COMPOSE_NULL',
+            'value' => null,
+            'preserve_compose_null' => true,
+            'version' => '4.0.0-beta.400',
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $this->application->id,
+        ]);
+        $env->uuid = new_public_id();
+        $env->save();
+    });
+    $appUuid = $this->application->uuid;
+    $serviceUuid = $this->service->uuid;
+    $databaseClass = $this->database::class;
+    $databaseUuid = $this->database->uuid;
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $result['server_uuid'])->sole();
+    $application = Application::where('uuid', $appUuid)->sole();
+    $service = Service::where('uuid', $serviceUuid)->sole();
+    $variable = $application->environment_variables()->where('key', 'COMPOSE_NULL')->sole();
+    expect($application->is_maintenance_enabled)->toBeTrue()
+        ->and($application->maintenance_page)->toBe('<h1>App down</h1>')
+        ->and($service->is_maintenance_enabled)->toBeTrue()
+        ->and($service->maintenance_page)->toBe('<h1>Service down</h1>')
+        ->and($server->proxy_error_page)->toBe('<h1>Proxy error</h1>')
+        ->and((int) $server->swarm_cluster)->toBe(7)
+        ->and($variable->preserve_compose_null)->toBeTrue()
+        ->and($variable->value)->toBeNull()
+        ->and($variable->version)->toBe('4.0.0-beta.400')
+        ->and($application->settings->include_coolify_default_variables)->toBeFalse()
+        ->and($service->include_coolify_default_variables)->toBeFalse()
+        ->and($databaseClass::where('uuid', $databaseUuid)->sole()->include_coolify_default_variables)->toBeFalse();
+});
+
+test('transfer keeps preview, backup, GitHub App runner fields and canvas positions when uuids change', function () {
+    $githubApp = new GithubApp;
+    $githubApp->forceFill([
+        'name' => 'Runner App',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'team_id' => $this->team->id,
+        'organization' => 'acme',
+        'organization_self_hosted_runners' => 'write',
+        'actions' => 'read',
+        'webhook_events' => ['workflow_job', 'push'],
+        'runner_group_id' => 12,
+    ]);
+    $githubApp->uuid = 'runner-github-app';
+    $githubApp->save();
+    $this->application->forceFill(['source_type' => GithubApp::class, 'source_id' => $githubApp->id])->saveQuietly();
+
+    $preview = new ApplicationPreview;
+    $preview->forceFill([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 7,
+        'pull_request_html_url' => 'https://github.com/example/app/pull/7',
+        'fqdn' => 'https://pr-7.app.example.com',
+        'domain_port_overrides' => ['https://pr-7.app.example.com' => 8080],
+        'max_restart_count' => 5,
+    ]);
+    $preview->uuid = 'preview-pr-7';
+    $preview->saveQuietly();
+
+    $this->backup->update(['missing_backup_notification_days' => 3]);
+    ScheduledVolumeBackup::create([
+        'backupable_type' => LocalPersistentVolume::class,
+        'backupable_id' => $this->application->persistentStorages()->sole()->id,
+        'team_id' => $this->team->id,
+        'frequency' => '0 4 * * *',
+        'missing_backup_notification_days' => 2,
+    ]);
+
+    $this->environment->forceFill(['canvas_positions' => [
+        $this->application->uuid => ['x' => 10, 'y' => -20],
+        $this->database->uuid => ['x' => 300, 'y' => 40],
+        'resource-on-another-server' => ['x' => 1, 'y' => 1],
+    ]])->save();
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['projects'][0]['environments'][0]['canvas_positions'])->toHaveCount(2);
+
+    ApplicationPreview::withoutEvents(fn () => ApplicationPreview::withTrashed()->get()->each->forceDelete());
+    DB::table('scheduled_volume_backups')->delete();
+    DB::table('scheduled_database_backups')->delete();
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    GithubApp::where('uuid', 'runner-github-app')->delete();
+
+    $this->importer->import($bundle, teamId: $this->team->id, preserveUuids: false, adoptMode: false);
+
+    $application = Application::where('name', 'my-app')->sole();
+    $database = StandalonePostgresql::where('name', 'app-db')->sole();
+    $importedPreview = $application->previews()->sole();
+    $importedGithubApp = $application->source;
+    expect($importedPreview->domain_port_overrides)->toBe(['https://pr-7.app.example.com' => 8080])
+        ->and($importedPreview->max_restart_count)->toBe(5)
+        ->and(ScheduledDatabaseBackup::where('database_id', $database->id)->sole()->missing_backup_notification_days)->toBe(3)
+        ->and(ScheduledVolumeBackup::sole()->missing_backup_notification_days)->toBe(2)
+        ->and($importedGithubApp)->toBeInstanceOf(GithubApp::class)
+        ->and($importedGithubApp->organization_self_hosted_runners)->toBe('write')
+        ->and($importedGithubApp->actions)->toBe('read')
+        ->and($importedGithubApp->webhook_events)->toBe(['workflow_job', 'push'])
+        ->and($importedGithubApp->runner_group_id)->toBe(12)
+        ->and($application->uuid)->not->toBe($this->application->uuid)
+        ->and($application->environment->canvas_positions)->toBe([
+            $application->uuid => ['x' => 10, 'y' => -20],
+            $database->uuid => ['x' => 300, 'y' => 40],
+        ]);
+});
+
+test('transfer creates the referenced team shared variables in the target team', function () {
+    $this->application->environment_variables()->where('key', 'APP_SECRET')->sole()->update(['value' => 'Bearer {{team.API_TOKEN}}']);
+    EnvironmentVariable::withoutEvents(function () {
+        $env = new EnvironmentVariable;
+        $env->forceFill([
+            'key' => 'SERVICE_URL',
+            'value' => '{{ team.SERVICE_HOST }}/api',
+            'resourceable_type' => Service::class,
+            'resourceable_id' => $this->service->id,
+        ]);
+        $env->uuid = new_public_id();
+        $env->save();
+    });
+    foreach (['API_TOKEN' => 'team-secret', 'SERVICE_HOST' => 'https://svc.example.com', 'UNUSED' => 'not-referenced'] as $key => $value) {
+        SharedEnvironmentVariable::create(['key' => $key, 'value' => $value, 'type' => 'team', 'team_id' => $this->team->id, 'is_literal' => true]);
+    }
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect(collect($bundle['shared_environment_variables']['team'])->pluck('key')->sort()->values()->all())->toBe(['API_TOKEN', 'SERVICE_HOST']);
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    $targetTeam = Team::factory()->create();
+
+    $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $teamVariables = SharedEnvironmentVariable::where('type', 'team')->where('team_id', $targetTeam->id)->get()->keyBy('key');
+    expect($teamVariables->keys()->sort()->values()->all())->toBe(['API_TOKEN', 'SERVICE_HOST'])
+        ->and($teamVariables['API_TOKEN']->value)->toBe('team-secret')
+        ->and((bool) $teamVariables['API_TOKEN']->is_literal)->toBeTrue()
+        ->and($teamVariables['SERVICE_HOST']->value)->toBe('https://svc.example.com');
+});
+
+test('transfer keeps the value of a team shared variable that already exists in the target team and warns', function () {
+    $this->application->environment_variables()->where('key', 'APP_SECRET')->sole()->update(['value' => '{{team.API_TOKEN}}']);
+    $variable = SharedEnvironmentVariable::create(['key' => 'API_TOKEN', 'value' => 'source-value', 'type' => 'team', 'team_id' => $this->team->id]);
+
+    $bundle = $this->exporter->export($this->server);
+    $variable->update(['value' => 'target-value']);
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    expect(SharedEnvironmentVariable::where('type', 'team')->where('team_id', $this->team->id)->sole()->value)->toBe('target-value')
+        ->and(collect($result['warnings'])->filter(fn (string $warning) => str_contains($warning, 'API_TOKEN')))->toHaveCount(1);
+});
+
+test('import warns when the git source, private key or S3 storage of a resource cannot be found', function () {
+    $githubApp = new GithubApp;
+    $githubApp->forceFill([
+        'name' => 'Team GitHub App',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'team_id' => $this->team->id,
+    ]);
+    $githubApp->uuid = 'missing-github-app';
+    $githubApp->save();
+    $deployKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'deploy-key',
+        'private_key' => PrivateKey::generateNewKeyPair('ed25519')['private_key'],
+    ]);
+    $this->application->forceFill([
+        'source_type' => GithubApp::class,
+        'source_id' => $githubApp->id,
+        'private_key_id' => $deployKey->id,
+    ])->saveQuietly();
+    $storage = S3Storage::create([
+        'name' => 'Backups',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://93.184.216.34',
+        'team_id' => $this->team->id,
+    ]);
+    $this->backup->update(['s3_storage_id' => $storage->id, 'save_s3' => true]);
+
+    $bundle = $this->exporter->export($this->server);
+    // The target instance cannot resolve these references.
+    $bundle['github_apps'] = [];
+    $bundle['s3_storages'] = [];
+    $bundle['private_keys'] = collect($bundle['private_keys'])->reject(fn (array $key) => $key['uuid'] === $deployKey->uuid)->values()->all();
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: Team::factory()->create()->id);
+
+    expect($result['warnings'])->toContain('Application my-app: its GitHub App was not found on this instance; set the source again.')
+        ->and($result['warnings'])->toContain('Application my-app: its private key was not found on this instance; select the private key again.')
+        ->and($result['warnings'])->toContain('Backup of database app-db: S3 upload was turned off because its S3 storage was not found.');
+});
+
+test('export warns about DNS records of another team', function () {
+    $bundle = $this->exporter->export($this->server);
+    expect(implode(' ', $bundle['warnings']))->not->toContain('DNS record');
+
+    ManagedDnsRecord::factory()->create()->references()->create([
+        'resource_type' => $this->application->getMorphClass(),
+        'resource_id' => $this->application->id,
+    ]);
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    expect(implode(' ', $bundle['warnings']))->toContain('because its DNS provider token belongs to another team. The target instance does not manage it.');
+});
+
+/**
+ * Removes the source copies of the resources of beforeEach, so the target can import them with their uuids.
+ */
+function removeTransferSourceResources(object $test): void
+{
+    $test->service->forceDelete();
+    $test->application->forceDelete();
+    $test->database->forceDelete();
+    $test->server->forceDelete();
+}
+
+function transferTestGithubApp(Team $team, string $uuid, string $name): GithubApp
+{
+    $githubApp = new GithubApp;
+    $githubApp->forceFill([
+        'name' => $name,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'organization' => 'acme',
+        'app_id' => 4242,
+        'installation_id' => 4343,
+        'team_id' => $team->id,
+        'is_system_wide' => false,
+        'private_key_id' => PrivateKey::factory()->create([
+            'team_id' => $team->id,
+            'name' => "{$name} key",
+            'private_key' => PrivateKey::generateNewKeyPair('ed25519')['private_key'],
+        ])->id,
+    ]);
+    $githubApp->uuid = $uuid;
+    $githubApp->save();
+
+    return $githubApp;
+}
+
+test('canvas links between transferred resources move with their environment and the other links are left out', function () {
+    $user = User::factory()->create();
+    $otherServer = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id, 'ip' => '10.55.0.11']);
+    $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->firstOrFail();
+    $appOnOtherServer = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $otherDestination->id,
+        'destination_type' => $otherDestination->getMorphClass(),
+        'name' => 'stays-here',
+    ]);
+    $link = fn (Model $source, Model $target, ?string $label) => ResourceLink::create([
+        'environment_id' => $this->environment->id,
+        'source_type' => $source->getMorphClass(),
+        'source_id' => $source->id,
+        'target_type' => $target->getMorphClass(),
+        'target_id' => $target->id,
+        'label' => $label,
+        'created_by' => $user->id,
+    ]);
+    $appToDatabase = $link($this->application, $this->database, 'reads');
+    $link($this->service, $this->application, null);
+    $link($this->application, $appOnOtherServer, 'calls');
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['projects'][0]['environments'][0]['resource_links'])->toHaveCount(2)
+        ->and($bundle['warnings'])->toContain('1 link between resources on the environment canvas is not transferred, because one of the linked resources stays on this instance.');
+
+    removeTransferSourceResources($this);
+    ResourceLink::query()->delete();
+    $targetTeam = Team::factory()->create();
+
+    $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $environment = Project::where('team_id', $targetTeam->id)->sole()->environments()->sole();
+    $application = Application::where('uuid', $this->application->uuid)->sole();
+    $database = StandalonePostgresql::where('uuid', $this->database->uuid)->sole();
+    $service = Service::where('uuid', $this->service->uuid)->sole();
+    $links = ResourceLink::where('environment_id', $environment->id)->orderBy('id')->get();
+
+    expect($links)->toHaveCount(2)
+        ->and($links[0]->only(['uuid', 'source_type', 'source_id', 'target_type', 'target_id', 'label', 'created_by']))->toBe([
+            'uuid' => $appToDatabase->uuid,
+            'source_type' => $application->getMorphClass(),
+            'source_id' => $application->id,
+            'target_type' => $database->getMorphClass(),
+            'target_id' => $database->id,
+            'label' => 'reads',
+            'created_by' => null,
+        ])
+        ->and($links[1]->only(['source_type', 'source_id', 'target_type', 'target_id', 'label']))->toBe([
+            'source_type' => $service->getMorphClass(),
+            'source_id' => $service->id,
+            'target_type' => $application->getMorphClass(),
+            'target_id' => $application->id,
+            'label' => null,
+        ]);
+});
+
+test('the project icon moves with the project into the icon storage of the target', function () {
+    Storage::fake('images');
+    $icon = "\xFF\xD8\xFF\xE0\x00\x10JFIF\x00transfer-icon";
+    Storage::disk('images')->put("project-icons/{$this->project->uuid}/icon.jpg", $icon);
+    $this->project->forceFill(['icon_path' => "project-icons/{$this->project->uuid}/icon.jpg", 'icon_storage_type' => 'local'])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['projects'][0]['icon'])->toBe(['content_base64' => base64_encode($icon), 'extension' => 'jpg', 'mime' => 'image/jpeg']);
+
+    removeTransferSourceResources($this);
+    $targetTeam = Team::factory()->create();
+
+    $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $project = Project::where('team_id', $targetTeam->id)->sole();
+    expect($project->uuid)->not->toBe($this->project->uuid)
+        ->and($project->only(['icon_path', 'icon_storage_type', 'icon_s3_storage_id']))->toBe([
+            'icon_path' => "project-icons/{$project->uuid}/icon.jpg",
+            'icon_storage_type' => 'local',
+            'icon_s3_storage_id' => null,
+        ])
+        ->and(Storage::disk('images')->get($project->icon_path))->toBe($icon);
+});
+
+test('a project icon that cannot be read or is too large is not exported and the export warns', function (?string $stored, string $warning) {
+    Storage::fake('images');
+    if ($stored !== null) {
+        Storage::disk('images')->put('project-icons/transfer/icon.jpg', $stored);
+    }
+    $this->project->forceFill(['icon_path' => 'project-icons/transfer/icon.jpg', 'icon_storage_type' => 'local'])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['projects'][0]['icon'])->toBeNull()
+        ->and($bundle['warnings'])->toContain($warning);
+})->with([
+    'missing file' => [null, 'The icon of project Transfer Project cannot be read, so it is not transferred. Upload it again on the target instance.'],
+    'larger than 2 MB' => [str_repeat('x', ServerTransferExporter::MAX_PROJECT_ICON_BYTES + 1), 'The icon of project Transfer Project is larger than 2 MB, so it is not transferred. Upload it again on the target instance.'],
+]);
+
+test('import stores only a JPEG project icon and warns about other content', function () {
+    Storage::fake('images');
+    $bundle = $this->exporter->export($this->server);
+    $bundle['projects'][0]['icon'] = ['content_base64' => base64_encode('<svg onload="alert(1)"/>'), 'extension' => 'jpg', 'mime' => 'image/jpeg'];
+    removeTransferSourceResources($this);
+    $targetTeam = Team::factory()->create();
+
+    $result = $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    expect(Project::where('team_id', $targetTeam->id)->sole()->icon_path)->toBeNull()
+        ->and(Storage::disk('images')->allFiles())->toBe([])
+        ->and($result['warnings'])->toContain('The icon of project Transfer Project was not imported, because it is not a JPEG image. Upload it again in the project settings.');
+});
+
+test('only environments with a resource of the server are exported', function () {
+    SharedEnvironmentVariable::create(['key' => 'PROJECT_KEY', 'value' => 'project', 'type' => 'project', 'project_id' => $this->project->id, 'team_id' => $this->team->id]);
+    SharedEnvironmentVariable::create(['key' => 'PRODUCTION_KEY', 'value' => 'production', 'type' => 'environment', 'environment_id' => $this->environment->id, 'team_id' => $this->team->id]);
+    $staging = Environment::factory()->create(['project_id' => $this->project->id, 'name' => 'staging']);
+    SharedEnvironmentVariable::create(['key' => 'STAGING_KEY', 'value' => 'staging', 'type' => 'environment', 'environment_id' => $staging->id, 'team_id' => $this->team->id]);
+    $otherServer = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id, 'ip' => '10.55.0.11']);
+    $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->firstOrFail();
+    Application::factory()->create([
+        'environment_id' => $staging->id,
+        'destination_id' => $otherDestination->id,
+        'destination_type' => $otherDestination->getMorphClass(),
+        'name' => 'staging-app',
+    ]);
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect(collect($bundle['projects'][0]['environments'])->pluck('name')->all())->toBe([$this->environment->name])
+        ->and(collect($bundle['projects'][0]['shared_environment_variables'])->pluck('key')->all())->toBe(['PROJECT_KEY'])
+        ->and(collect($bundle['projects'][0]['environments'][0]['shared_environment_variables'])->pluck('key')->all())->toBe(['PRODUCTION_KEY']);
+
+    removeTransferSourceResources($this);
+    $targetTeam = Team::factory()->create();
+
+    $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $project = Project::where('team_id', $targetTeam->id)->sole();
+    expect($project->environments()->pluck('name')->all())->toBe([$this->environment->name])
+        ->and(Application::where('name', 'staging-app')->count())->toBe(1)
+        ->and(SharedEnvironmentVariable::where('key', 'STAGING_KEY')->count())->toBe(1);
+});
+
+test('the GitHub runner config moves disabled with its GitHub App and the bundle lists the manual steps', function () {
+    $githubApp = transferTestGithubApp($this->team, 'runner-only-app', 'Runner App');
+    $gitlabApp = new GitlabApp;
+    $gitlabApp->forceFill(['name' => 'Team GitLab', 'api_url' => 'https://gitlab.com/api/v4', 'html_url' => 'https://gitlab.com', 'team_id' => $this->team->id, 'is_system_wide' => false]);
+    $gitlabApp->save();
+    $this->application->forceFill(['source_type' => GitlabApp::class, 'source_id' => $gitlabApp->id])->saveQuietly();
+    $config = GithubRunnerConfig::create([
+        'server_id' => $this->server->id,
+        'github_app_id' => $githubApp->id,
+        'labels' => ['coolify', 'gpu'],
+        'is_enabled' => true,
+        'is_dedicated' => true,
+        'allow_pull_requests' => true,
+        'max_runners' => 4,
+        'docker_mode' => 'dind',
+        'runner_image' => 'ghcr.io/acme/runner:1',
+        'cpu_limit' => '1.5',
+        'memory_limit' => '2g',
+        'capacity_wait_timeout' => 30,
+        'idle_timeout' => 5,
+        'job_timeout' => 120,
+    ]);
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect(collect($bundle['github_apps'])->pluck('uuid')->all())->toBe(['runner-only-app'])
+        ->and(collect($bundle['private_keys'])->pluck('uuid'))->toContain($githubApp->privateKey->uuid)
+        ->and($bundle['github_runner_config']['github_app_uuid'])->toBe('runner-only-app')
+        ->and($bundle['post_transfer_checklist'])->toBe([
+            'On GitHub, open the settings of GitHub App Runner App. Set the Webhook URL to {target_url}/webhooks/source/github/events, the Setup URL to {target_url}/webhooks/source/github/install, and the Callback URL to {target_url}/login/github/app.',
+            'In GitLab, open Settings > Webhooks of every project that uses GitLab App Team GitLab, and set the webhook URL to {target_url}/webhooks/source/gitlab/events.',
+            'After the GitHub App sends webhooks to {target_url}, open this server there, check the runner requirements, and enable GitHub runners. Enabling them stops runners that another Coolify instance started on this server.',
+        ])
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('webhook URL')
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('runner');
+
+    removeTransferSourceResources($this);
+    $githubApp->delete();
+    $gitlabApp->delete();
+    $targetTeam = Team::factory()->create();
+
+    $result = $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $importedApp = GithubApp::where('uuid', 'runner-only-app')->where('team_id', $targetTeam->id)->sole();
+    $imported = GithubRunnerConfig::where('server_id', Server::where('uuid', $result['server_uuid'])->sole()->id)->sole();
+    expect($imported->uuid)->toBe($config->uuid)
+        ->and($imported->github_app_id)->toBe($importedApp->id)
+        ->and($imported->is_enabled)->toBeFalse()
+        ->and($imported->only(['labels', 'is_dedicated', 'allow_pull_requests', 'max_runners', 'runner_image', 'cpu_limit', 'memory_limit', 'capacity_wait_timeout', 'idle_timeout', 'job_timeout']))->toBe([
+            'labels' => ['coolify', 'gpu'],
+            'is_dedicated' => true,
+            'allow_pull_requests' => true,
+            'max_runners' => 4,
+            'runner_image' => 'ghcr.io/acme/runner:1',
+            'cpu_limit' => '1.5',
+            'memory_limit' => '2g',
+            'capacity_wait_timeout' => 30,
+            'idle_timeout' => 5,
+            'job_timeout' => 120,
+        ])
+        ->and($imported->docker_mode->value)->toBe('dind')
+        ->and($result['checklist'])->toContain('On GitHub, open the settings of GitHub App Runner App. Set the Webhook URL to https://coolify-a.test/webhooks/source/github/events, the Setup URL to https://coolify-a.test/webhooks/source/github/install, and the Callback URL to https://coolify-a.test/login/github/app.')
+        ->and(implode(' ', $result['warnings']))->not->toContain('webhook URL');
+});
+
+test('the GitHub runner config re-links a system-wide GitHub App of the target by uuid', function () {
+    $systemWide = transferTestGithubApp($this->team, 'system-runner-app', 'System Runner App');
+    $systemWide->forceFill(['is_system_wide' => true])->save();
+    GithubRunnerConfig::create(['server_id' => $this->server->id, 'github_app_id' => $systemWide->id, 'labels' => ['coolify']]);
+
+    $bundle = $this->exporter->export($this->server);
+    expect($bundle['github_apps'])->toBe([]);
+    removeTransferSourceResources($this);
+
+    $result = $this->importer->import($bundle, teamId: Team::factory()->create()->id);
+
+    expect(GithubRunnerConfig::where('server_id', Server::where('uuid', $result['server_uuid'])->sole()->id)->sole()->github_app_id)->toBe($systemWide->id);
+});
+
+test('the GitHub runner config is not imported when its GitHub App is missing on the target', function () {
+    $githubApp = transferTestGithubApp($this->team, 'missing-runner-app', 'Runner App');
+    GithubRunnerConfig::create(['server_id' => $this->server->id, 'github_app_id' => $githubApp->id, 'labels' => ['coolify']]);
+
+    $bundle = $this->exporter->export($this->server);
+    $bundle['github_apps'] = [];
+    removeTransferSourceResources($this);
+    $githubApp->delete();
+
+    $result = $this->importer->import($bundle, teamId: Team::factory()->create()->id);
+
+    expect(GithubRunnerConfig::count())->toBe(0)
+        ->and($result['warnings'])->toContain('The GitHub runner settings of this server were not imported, because their GitHub App was not found on this instance. Set up GitHub runners on the server again.');
+});
+
+test('the checklist asks to move manual webhooks of git applications without a private App', function () {
+    $this->application->forceFill(['source_type' => null, 'source_id' => null])->saveQuietly();
+
+    $checklist = implode("\n", $this->exporter->export($this->server)['post_transfer_checklist']);
+
+    expect($checklist)->toContain('If a repository of these applications has a manual webhook to Coolify, change its URL to the target: my-app.')
+        ->toContain('{target_url}/webhooks/source/gitea/events/manual');
+});
+
+test('the checklist does not ask about manual webhooks for an application that deploys through a private GitHub App', function () {
+    $githubApp = GithubApp::create([
+        'name' => 'private-app', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com',
+        'team_id' => $this->team->id, 'is_system_wide' => false, 'is_public' => false,
+    ]);
+    $this->application->forceFill(['source_type' => GithubApp::class, 'source_id' => $githubApp->id])->saveQuietly();
+
+    $checklist = implode("\n", $this->exporter->export($this->server)['post_transfer_checklist']);
+
+    expect($checklist)->not->toContain('manual webhook');
+});
+
+test('a claimed import starts the finish list and returns the server URL', function () {
+    $bundle = $this->exporter->export($this->server);
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $result['server_uuid'])->firstOrFail();
+    expect($result['server_url'])->toBe('https://coolify-a.test/server/'.$server->uuid)
+        ->and(data_get($server->server_metadata, 'transfer.status'))->toBe('claimed')
+        ->and(collect(data_get($server->server_metadata, 'transfer.finish.items'))->pluck('key'))->toContain('server_connection:server');
+});
+
+test('an application with a system-wide GitHub App that the target lacks is listed for a git source check', function () {
+    $systemApp = GithubApp::create(['name' => 'Coolify GitHub', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'team_id' => 0, 'is_system_wide' => true]);
+    $this->application->forceFill(['source_type' => GithubApp::class, 'source_id' => $systemApp->id])->saveQuietly();
+    $bundle = $this->exporter->export($this->server);
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    $systemApp->delete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $result['server_uuid'])->firstOrFail();
+    expect(data_get($bundle, 'projects.0.environments.0.applications.0.source.system_wide'))->toBeTrue()
+        ->and(data_get($server->server_metadata, 'transfer.git_source_applications'))->toBe([$this->application->uuid])
+        ->and(collect(data_get($server->server_metadata, 'transfer.finish.items'))->pluck('key'))->toContain("git_source:{$this->application->uuid}");
+});
diff --git a/tests/Unit/ServerTransfer/ServerTransferMigratorTest.php b/tests/Unit/ServerTransfer/ServerTransferMigratorTest.php
index 5599fc763b..914b416170 100644
--- a/tests/Unit/ServerTransfer/ServerTransferMigratorTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferMigratorTest.php
@@ -1,23 +1,39 @@
 <?php
 
+use App\Jobs\MigrateServerToInstanceJob;
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\Environment;
+use App\Models\GithubApp;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
+use App\Models\User;
 use App\Services\ServerTransfer\ServerTransferClaimer;
+use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferMigrator;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Sleep;
 use Illuminate\Validation\ValidationException;
 use Tests\TestCase;
 
 uses(TestCase::class, RefreshDatabase::class);
 
 beforeEach(function () {
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
+    Sleep::fake();
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
     $this->team = Team::factory()->create();
@@ -29,9 +45,10 @@ beforeEach(function () {
         'name' => 'migrate-me',
     ]);
     $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
-    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop']);
     $environment = $project->environments()->first()
         ?? Environment::factory()->create(['project_id' => $project->id]);
+    $this->environment = $environment;
     Application::factory()->create([
         'environment_id' => $environment->id,
         'destination_id' => $destination->id,
@@ -43,7 +60,7 @@ beforeEach(function () {
 
 test('migrate exports imports via http and completes locally', function () {
     Http::fake([
-        'http://8.8.8.8/api/v1/servers/import' => Http::response([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
             'dry_run' => false,
             'server_uuid' => $this->server->uuid,
             'claimed' => true,
@@ -55,12 +72,12 @@ test('migrate exports imports via http and completes locally', function () {
 
     $result = app(ServerTransferMigrator::class)->migrate(
         server: $this->server,
-        targetUrl: 'http://8.8.8.8',
+        targetUrl: 'https://8.8.8.8',
         targetToken: 'target-token-xyz',
     );
 
     expect($result['server_uuid'])->toBe($this->server->uuid)
-        ->and($result['target_url'])->toBe('http://8.8.8.8')
+        ->and($result['target_url'])->toBe('https://8.8.8.8')
         ->and($result['import']['claimed'])->toBeTrue()
         ->and($result['message'])->toContain('migrated');
 
@@ -69,7 +86,7 @@ test('migrate exports imports via http and completes locally', function () {
         ->and((bool) $this->server->settings->force_disabled)->toBeTrue();
 
     Http::assertSent(function ($request) {
-        return $request->url() === 'http://8.8.8.8/api/v1/servers/import'
+        return $request->url() === 'https://8.8.8.8/api/v1/servers/import'
             && $request->hasHeader('Authorization', 'Bearer target-token-xyz')
             && ! array_key_exists('write_remote', $request->data())
             && data_get($request->data(), 'bundle.server.uuid') === $this->server->uuid;
@@ -82,7 +99,7 @@ test('migrate rejects a private target before sending the bundle', function () {
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://127.0.0.1:8001',
+        'https://127.0.0.1:8001',
         'token',
     ))->toThrow(ValidationException::class);
 
@@ -116,7 +133,7 @@ test('migrate still rejects other private targets in development', function () {
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://10.0.0.5:8001',
+        'https://10.0.0.5:8001',
         'token',
     ))->toThrow(ValidationException::class);
 
@@ -125,26 +142,26 @@ test('migrate still rejects other private targets in development', function () {
 
 test('migrate fails clearly when target is unreachable', function () {
     Http::fake([
-        'http://8.8.4.4/*' => Http::failedConnection(),
+        'https://8.8.4.4/*' => Http::failedConnection(),
     ]);
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://8.8.4.4',
+        'https://8.8.4.4',
         'token',
     ))->toThrow(RuntimeException::class, 'Could not reach target');
 });
 
 test('migrate fails when target returns error', function () {
     Http::fake([
-        'http://8.8.8.8/api/v1/servers/import' => Http::response([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
             'message' => 'A server with IP/domain already exists',
         ], 422),
     ]);
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://8.8.8.8',
+        'https://8.8.8.8',
         'token',
     ))->toThrow(RuntimeException::class, 'Target import failed');
 
@@ -156,7 +173,7 @@ test('migrate fails when target returns error', function () {
 
 test('migrate surfaces recovery guidance when complete fails after successful remote import', function () {
     Http::fake([
-        'http://8.8.8.8/api/v1/servers/import' => Http::response([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
             'dry_run' => false,
             'server_uuid' => $this->server->uuid,
             'claimed' => true,
@@ -172,14 +189,14 @@ test('migrate surfaces recovery guidance when complete fails after successful re
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://8.8.8.8',
+        'https://8.8.8.8',
         'token',
-    ))->toThrow(RuntimeException::class, 'Disable management of this server here');
+    ))->toThrow(RuntimeException::class, 'transfer/complete on this instance');
 });
 
 test('migrate keeps managing the server here when the target could not take management', function () {
     Http::fake([
-        'http://8.8.8.8/api/v1/servers/import' => Http::response([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
             'dry_run' => false,
             'server_uuid' => $this->server->uuid,
             'claimed' => false,
@@ -189,7 +206,7 @@ test('migrate keeps managing the server here when the target could not take mana
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://8.8.8.8',
+        'https://8.8.8.8',
         'token',
     ))->toThrow(RuntimeException::class, 'could not take management');
 
@@ -197,3 +214,488 @@ test('migrate keeps managing the server here when the target could not take mana
     expect($this->server->isTransferredAway())->toBeFalse()
         ->and((bool) $this->server->settings->force_disabled)->toBeFalse();
 });
+
+test('migrate rejects a target without https outside development', function () {
+    Http::fake();
+
+    expect(fn () => app(ServerTransferMigrator::class)->migrate(
+        $this->server,
+        'http://8.8.8.8',
+        'token',
+    ))->toThrow(RuntimeException::class, 'must use https');
+
+    Http::assertNothingSent();
+});
+
+test('migrate tells the user to upgrade a target without server transfer', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response(['message' => 'Not found.'], 404),
+    ]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->migrate(
+        $this->server,
+        'https://8.8.8.8',
+        'token',
+    ))->toThrow(RuntimeException::class, 'does not support server transfer');
+});
+
+test('migrate completes when the import request times out but the target claimed the server', function () {
+    $sentExportId = null;
+    Http::fake(function ($request) use (&$sentExportId) {
+        if (str_ends_with($request->url(), '/api/v1/servers/import')) {
+            $sentExportId = data_get($request->data(), 'bundle.export_id');
+
+            return Http::response('Gateway Timeout', 504);
+        }
+
+        return Http::response([
+            'server_uuid' => $this->server->uuid,
+            'transfer' => ['status' => 'claimed', 'export_id' => $sentExportId],
+        ]);
+    });
+
+    $result = app(ServerTransferMigrator::class)->migrate($this->server, 'https://8.8.8.8', 'token');
+
+    expect($result['import']['claimed'])->toBeTrue()
+        ->and($this->server->fresh()->isTransferredAway())->toBeTrue();
+    Http::assertSent(fn ($request) => $request->url() === "https://8.8.8.8/api/v1/servers/{$this->server->uuid}/transfer");
+});
+
+test('migrate keeps the server here when the target never confirms a timed out import', function () {
+    Http::fake(function ($request) {
+        if (str_ends_with($request->url(), '/api/v1/servers/import')) {
+            return Http::response('Gateway Timeout', 504);
+        }
+
+        return Http::response(['message' => 'Server not found.'], 404);
+    });
+
+    expect(fn () => app(ServerTransferMigrator::class)->migrate($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, 'Target import failed (HTTP 504)');
+
+    expect($this->server->fresh()->isTransferredAway())->toBeFalse();
+});
+
+test('start records the running transfer and queues the job once', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
+    $migrator = app(ServerTransferMigrator::class);
+
+    $migrator->start($this->server, 'https://8.8.8.8/', 'token');
+
+    expect(data_get($this->server->fresh()->server_metadata, 'migration.status'))->toBe('running')
+        ->and(data_get($this->server->fresh()->server_metadata, 'migration.target_url'))->toBe('https://8.8.8.8');
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+
+    expect(fn () => $migrator->start($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, 'already running');
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+});
+
+test('the migrate job records a failed transfer', function () {
+    Http::fake(['*' => Http::response(['message' => 'Unauthenticated.'], 401)]);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $migration = data_get($this->server->fresh()->server_metadata, 'migration');
+    expect($migration['status'])->toBe('failed')
+        ->and($migration['error'])->toContain('HTTP 401');
+});
+
+test('the migrate job records a finished transfer', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
+            'server_uuid' => $this->server->uuid,
+            'claimed' => true,
+            'warnings' => ['check webhooks'],
+        ], 201),
+    ]);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $server = $this->server->fresh();
+    expect(data_get($server->server_metadata, 'migration.status'))->toBe('succeeded')
+        ->and(data_get($server->server_metadata, 'migration.warnings'))->toContain('check webhooks')
+        ->and($server->isTransferredAway())->toBeTrue();
+});
+
+test('start replaces a running state that a stopped worker left behind', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
+    $this->server->forceFill(['server_metadata' => ['migration' => [
+        'status' => 'running',
+        'started_at' => now()->subHour()->toIso8601String(),
+    ]]])->save();
+
+    app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+});
+
+test('start checks the target before it queues the transfer', function (int $status, string $message) {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'A server with IP/domain 10.0.0.1 already exists on this instance.'], $status)]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'wrong-token'))
+        ->toThrow(RuntimeException::class, $message);
+
+    Queue::assertNothingPushed();
+    $migration = data_get($this->server->fresh()->server_metadata, 'migration');
+    expect($migration['status'])->toBe('failed')
+        ->and($migration['phase'])->toBe('checks')
+        ->and(collect($migration['log'])->last())->toMatchArray(['level' => 'error'])
+        ->and(collect($migration['log'])->where('level', 'error')->pluck('message')->implode("\n"))->toContain('FAILED: ')->toContain($message);
+    Http::assertSent(fn ($request) => str_contains($request->url(), 'server_uuid='.$this->server->uuid)
+        && $request->hasHeader('Authorization', 'Bearer wrong-token'));
+})->with([
+    'invalid token' => [401, 'does not accept the API token'],
+    'token without the write and deploy permissions' => [403, 'write and deploy permissions'],
+    'conflict on the target' => [422, 'already exists on this instance'],
+    'target without server transfer' => [404, 'does not support server transfer'],
+]);
+
+test('start fails at once when the target cannot be reached', function () {
+    Queue::fake();
+    Http::fake(fn () => throw new ConnectionException('Connection refused'));
+
+    expect(fn () => app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, 'This instance cannot reach the target instance');
+
+    Queue::assertNothingPushed();
+});
+
+test('migrate stops waiting for a timed out import when the target rejects the token', function () {
+    Http::fake(function ($request) {
+        if (str_ends_with($request->url(), '/api/v1/servers/import')) {
+            return Http::response('Gateway Timeout', 504);
+        }
+
+        return Http::response(['message' => 'Unauthenticated.'], 401);
+    });
+
+    expect(fn () => app(ServerTransferMigrator::class)->migrate($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, 'Target import failed (HTTP 504)');
+
+    Sleep::assertSleptTimes(1);
+    expect($this->server->fresh()->isTransferredAway())->toBeFalse();
+});
+
+test('start logs every check as OK and the queued transfer', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response([
+        'message' => 'ok',
+        'checks' => [
+            ['label' => 'no server with the same IP exists', 'ok' => true, 'message' => null],
+            ['label' => 'the target can reach the SSH port of the server (10.0.0.1:22)', 'ok' => true, 'message' => null],
+        ],
+    ])]);
+
+    app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+
+    $log = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message');
+    expect($log)->toContain('OK: the server is not the Coolify host.')
+        ->toContain('OK: this instance manages the server.')
+        ->toContain('OK: no deployment is queued or running on the server.')
+        ->toContain('OK: this instance can connect to the server over SSH.')
+        ->toContain('OK: the target instance at https://8.8.8.8 can be reached.')
+        ->toContain('OK: the target instance accepts the API token.')
+        ->toContain('OK: on the target: the target can reach the SSH port of the server (10.0.0.1:22).')
+        ->and($log->last())->toBe('All checks passed. The transfer is queued.');
+    Http::assertSent(fn ($request) => str_contains($request->url(), 'schema_version=') && str_contains($request->url(), 'port='));
+});
+
+test('start runs every check and logs which are OK and which failed', function () {
+    Queue::fake();
+    Process::fake(['*' => Process::result(errorOutput: 'Connection refused', exitCode: 255)]);
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response([
+        'message' => 'A server with IP/domain 10.0.0.1 already exists on this instance.',
+        'checks' => [
+            ['label' => 'the team can have one more server', 'ok' => true, 'message' => null],
+            ['label' => 'no server with the same IP exists', 'ok' => false, 'message' => 'A server with IP/domain 10.0.0.1 already exists on this instance.'],
+        ],
+    ], 422)]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, '2 of 10 checks failed');
+
+    $log = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'));
+    expect($log->where('level', 'success')->pluck('message'))->toContain('OK: the target instance accepts the API token.')
+        ->toContain('OK: on the target: the team can have one more server.')
+        ->and($log->where('level', 'error')->pluck('message')->implode("\n"))
+        ->toContain('FAILED: this instance can connect to the server over SSH.')
+        ->toContain('FAILED: on the target: no server with the same IP exists. A server with IP/domain 10.0.0.1 already exists')
+        ->and($log->last()['message'])->toContain('2 check(s) failed');
+    Queue::assertNothingPushed();
+});
+
+test('start reports the target checks as not checked when the token is rejected', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'Unauthenticated.'], 401)]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class);
+
+    $log = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message');
+    expect($log)->toContain('OK: the target instance supports server transfer.')
+        ->toContain('NOT CHECKED: the checks on the target instance. They did not run, because "the target instance accepts the API token" failed.');
+});
+
+test('the migrate job logs each step of a finished transfer', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response(['server_uuid' => $this->server->uuid, 'claimed' => true], 201),
+    ]);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $log = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'));
+    expect($log->pluck('message')->first())->toBe('Exporting the server configuration and its resources.')
+        ->and($log->pluck('message')->implode("\n"))->toContain('Sending it to https://8.8.8.8')
+        ->toContain('manages it now')
+        ->and($log->last())->toMatchArray(['level' => 'success', 'message' => 'Transfer finished. The target instance manages the server now.']);
+});
+
+test('the migrate job logs each attempt to read the result of a timed out import', function () {
+    Http::fake(function ($request) {
+        if (str_ends_with($request->url(), '/api/v1/servers/import')) {
+            return Http::response('Gateway Timeout', 504);
+        }
+
+        return Http::response(['message' => 'Server not found.'], 404);
+    });
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $messages = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message');
+    expect($messages->filter(fn ($message) => str_starts_with($message, 'Asking the target for the import result')))->toHaveCount(ServerTransferMigrator::STATUS_PROBE_ATTEMPTS)
+        ->and($messages->last())->toStartWith('Transfer failed: Target import failed (HTTP 504)');
+});
+
+test('the migrate job stores the post-transfer checklist with the target URL', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response(['server_uuid' => $this->server->uuid, 'claimed' => true], 201),
+    ]);
+    $exporter = app(ServerTransferExporter::class);
+    $fakeExporter = Mockery::mock(ServerTransferExporter::class);
+    $fakeExporter->shouldReceive('export')->once()->andReturnUsing(fn (Server $server, bool $includeSensitive = true) => [
+        ...$exporter->export($server, $includeSensitive),
+        'post_transfer_checklist' => [
+            'Set the webhook URL of GitHub App deploy-bot to {target_url}/webhooks/source/github/events.',
+            ['not a step'],
+            'Point the DNS record of shop.example.com to the server.',
+        ],
+    ]);
+    app()->instance(ServerTransferExporter::class, $fakeExporter);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $migration = data_get($this->server->fresh()->server_metadata, 'migration');
+    expect($migration['status'])->toBe('succeeded')
+        ->and($migration['checklist'])->toBe([
+            'Set the webhook URL of GitHub App deploy-bot to https://8.8.8.8/webhooks/source/github/events.',
+            'Point the DNS record of shop.example.com to the server.',
+        ]);
+});
+
+test('the migrate job stores the checklist of the target, which has the public URL of the target', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
+            'server_uuid' => $this->server->uuid,
+            'claimed' => true,
+            'checklist' => ['Set the webhook URL of GitHub App deploy-bot to https://coolify-b.example.com/webhooks/source/github/events.'],
+        ], 201),
+    ]);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    expect(data_get($this->server->fresh()->server_metadata, 'migration.checklist'))
+        ->toBe(['Set the webhook URL of GitHub App deploy-bot to https://coolify-b.example.com/webhooks/source/github/events.']);
+});
+
+test('start notes projects that also have resources on other servers', function (int $checkStatus, bool $queued) {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []], $checkStatus)]);
+    $otherServer = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id, 'ip' => '10.88.0.11']);
+    $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->firstOrFail();
+    foreach (['web', 'worker'] as $name) {
+        Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $otherDestination->id,
+            'destination_type' => $otherDestination->getMorphClass(),
+            'name' => $name,
+        ]);
+    }
+    // A project with resources only on the other server is not affected by the transfer.
+    $otherProject = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Blog']);
+    Application::factory()->create([
+        'environment_id' => $otherProject->environments()->first()->id,
+        'destination_id' => $otherDestination->id,
+        'destination_type' => $otherDestination->getMorphClass(),
+    ]);
+
+    try {
+        app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+    } catch (RuntimeException) {
+    }
+
+    $notes = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))
+        ->filter(fn (array $entry) => str_starts_with($entry['message'], 'NOTE: '));
+    expect($notes->pluck('message')->all())->toBe([
+        "NOTE: project 'Shop' also has 2 resources on other servers. They stay on this instance; only the resources of this server are transferred.",
+    ])
+        ->and($notes->first()['level'])->toBe('info');
+    $queued ? Queue::assertPushed(MigrateServerToInstanceJob::class, 1) : Queue::assertNothingPushed();
+})->with([
+    'checks pass' => [200, true],
+    'a check fails' => [401, false],
+]);
+
+test('start adds no note when the projects have no resources on other servers', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
+
+    app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+
+    $messages = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message');
+    expect($messages->filter(fn (string $message) => str_starts_with($message, 'NOTE: ')))->toBeEmpty();
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+});
+
+test('the migrate job timeout covers the import request and every status probe', function () {
+    $worstCase = ServerTransferMigrator::IMPORT_TIMEOUT_SECONDS
+        + ServerTransferMigrator::STATUS_PROBE_ATTEMPTS
+        * (ServerTransferMigrator::STATUS_PROBE_INTERVAL_SECONDS + ServerTransferMigrator::STATUS_REQUEST_TIMEOUT_SECONDS);
+    $job = new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token');
+
+    // The rest of the timeout is for the export and the database writes.
+    expect($job->timeout)->toBeGreaterThanOrEqual($worstCase + 300)
+        ->and(ServerTransferMigrator::STALE_MIGRATION_SECONDS)->toBeGreaterThan($job->timeout);
+});
+
+function stopMigrateJobAfterExport(Server $server): void
+{
+    $metadata = $server->fresh()->server_metadata ?? [];
+    $metadata['migration'] = ['status' => 'running', 'target_url' => 'https://8.8.8.8', 'export_id' => 'export-1', 'log' => []];
+    $server->forceFill(['server_metadata' => $metadata])->save();
+
+    (new MigrateServerToInstanceJob($server, 'https://8.8.8.8', 'token'))
+        ->failed(new RuntimeException('The job has timed out.'));
+}
+
+test('a stopped migrate job completes the transfer when the target manages the server', function () {
+    Http::fake(['*' => Http::response(['transfer' => ['status' => 'claimed', 'export_id' => 'export-1']])]);
+
+    stopMigrateJobAfterExport($this->server);
+
+    $server = $this->server->fresh();
+    expect(data_get($server->server_metadata, 'migration.status'))->toBe('succeeded')
+        ->and($server->isTransferredAway())->toBeTrue();
+});
+
+test('a stopped migrate job records an unknown result when the target cannot be asked', function () {
+    Http::fake(fn () => throw new ConnectionException('Connection timed out'));
+
+    stopMigrateJobAfterExport($this->server);
+
+    $server = $this->server->fresh();
+    expect(data_get($server->server_metadata, 'migration.status'))->toBe('unknown')
+        ->and(data_get($server->server_metadata, 'migration.error'))->toContain("/api/v1/servers/{$server->uuid}/transfer/complete")
+        ->and($server->isTransferredAway())->toBeFalse();
+});
+
+test('a stopped migrate job records a failure when the target does not have the export', function (array $body, int $status) {
+    Http::fake(['*' => Http::response($body, $status)]);
+
+    stopMigrateJobAfterExport($this->server);
+
+    $server = $this->server->fresh();
+    expect(data_get($server->server_metadata, 'migration.status'))->toBe('failed')
+        ->and($server->isTransferredAway())->toBeFalse();
+})->with([
+    'not found' => [['message' => 'Server not found.'], 404],
+    'other export' => [['transfer' => ['status' => 'claimed', 'export_id' => 'export-0']], 200],
+]);
+
+test('a migrate job stopped before the export records a failure without asking the target', function () {
+    Http::fake();
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->failed(new RuntimeException('The job has timed out.'));
+
+    expect(data_get($this->server->fresh()->server_metadata, 'migration.status'))->toBe('failed');
+    Http::assertNothingSent();
+});
+
+test('migrate saves the export ID before it sends the bundle', function () {
+    $savedExportId = null;
+    Http::fake(function ($request) use (&$savedExportId) {
+        $savedExportId = data_get($this->server->fresh()->server_metadata, 'migration.export_id');
+
+        return Http::response(['server_uuid' => $this->server->uuid, 'claimed' => true], 201);
+    });
+
+    $result = app(ServerTransferMigrator::class)->migrate($this->server, 'https://8.8.8.8', 'token');
+
+    expect($savedExportId)->toBe($result['export_id']);
+});
+
+test('transfer back asks the managing instance to transfer the archive here with a short-lived token of its team', function () {
+    $user = User::factory()->create();
+    $this->team->members()->attach($user->id, ['role' => 'owner']);
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://8.8.8.8');
+    Http::fake(['https://8.8.8.8/api/v1/servers/*/migrate' => Http::response(['migration' => ['status' => 'running']], 202)]);
+
+    app(ServerTransferMigrator::class)->requestTransferBack($this->server->fresh(), $user, 'https://8.8.8.8', 'token-of-b', 'https://coolify-a.test');
+
+    $token = $user->tokens()->sole();
+    expect((int) $token->team_id)->toBe($this->team->id)
+        ->and($token->abilities)->toBe(['read', 'write'])
+        ->and($token->expires_at->isFuture())->toBeTrue()
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.transfer_back.from'))->toBe('https://8.8.8.8');
+    Http::assertSent(fn ($request) => $request->url() === "https://8.8.8.8/api/v1/servers/{$this->server->uuid}/migrate"
+        && $request->hasHeader('Authorization', 'Bearer token-of-b')
+        && $request['target_url'] === 'https://coolify-a.test'
+        && str_starts_with((string) $request['target_token'], $token->id.'|'));
+});
+
+test('a refused transfer back deletes the token and shows the reason of the other instance', function () {
+    $user = User::factory()->create();
+    $this->team->members()->attach($user->id, ['role' => 'owner']);
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://8.8.8.8');
+    Http::fake(['*' => Http::response(['message' => '1 of 13 checks failed: no server with the same IP exists.'], 422)]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->requestTransferBack($this->server->fresh(), $user, 'https://8.8.8.8', 'token-of-b', 'https://coolify-a.test'))
+        ->toThrow(RuntimeException::class, 'no server with the same IP exists');
+
+    expect($user->tokens()->count())->toBe(0)
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.transfer_back'))->toBeNull();
+});
+
+test('start notes system-wide git sources that the target does not have', function (bool $noted) {
+    Queue::fake();
+    $systemApp = GithubApp::create([
+        'name' => 'Coolify GitHub', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com',
+        'team_id' => 0, 'is_system_wide' => true, 'is_public' => false,
+    ]);
+    Application::where('name', 'app-on-server')->update(['source_type' => GithubApp::class, 'source_id' => $systemApp->id]);
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => [], 'missing_system_sources' => ['github' => $noted ? [$systemApp->uuid] : [], 'gitlab' => []]])]);
+
+    app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+
+    $notes = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message')
+        ->filter(fn (string $message) => str_contains($message, 'system-wide'));
+    expect($notes->isNotEmpty())->toBe($noted);
+    if ($noted) {
+        expect($notes->first())->toBe("NOTE: the system-wide GitHub App 'Coolify GitHub' of this instance is not transferred, and the target has no matching one. These applications need a new git source on the target: app-on-server. The finish list on the target shows them.");
+    }
+    Http::assertSent(fn ($request) => str_contains(urldecode($request->url()), "system_github_apps[0]={$systemApp->uuid}"));
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+})->with([
+    'the target has no matching App' => [true],
+    'the target has the App' => [false],
+]);
diff --git a/tests/Unit/ServerTransfer/ServerTransferS3DestinationsTest.php b/tests/Unit/ServerTransfer/ServerTransferS3DestinationsTest.php
new file mode 100644
index 0000000000..66cbeee05f
--- /dev/null
+++ b/tests/Unit/ServerTransfer/ServerTransferS3DestinationsTest.php
@@ -0,0 +1,153 @@
+<?php
+
+use App\Jobs\ValidateAndInstallServerJob;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Services\ServerTransfer\ServerTransferExporter;
+use App\Services\ServerTransfer\ServerTransferImporter;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
+
+    $this->team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+        'ip' => '10.56.0.10',
+    ]);
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = $project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-data',
+        'mount_path' => '/app/data',
+        'resource_type' => $this->application->getMorphClass(),
+        'resource_id' => $this->application->id,
+    ]);
+
+    StandalonePostgresql::withoutEvents(function () use ($environment, $destination) {
+        $database = new StandalonePostgresql;
+        $database->forceFill([
+            'name' => 'app-db',
+            'postgres_user' => 'postgres',
+            'postgres_password' => 'secret',
+            'postgres_db' => 'app',
+            'environment_id' => $environment->id,
+            'destination_id' => $destination->id,
+            'destination_type' => $destination->getMorphClass(),
+        ]);
+        $database->uuid = new_public_id();
+        $database->save();
+        $this->database = $database;
+    });
+
+    $this->firstS3 = S3Storage::create([
+        'name' => 'first', 'region' => 'us-east-1', 'key' => 'k1', 'secret' => 's1',
+        'bucket' => 'first-bucket', 'endpoint' => 'https://first.example.com', 'team_id' => $this->team->id,
+    ]);
+    $this->secondS3 = S3Storage::create([
+        'name' => 'second', 'region' => 'us-east-1', 'key' => 'k2', 'secret' => 's2',
+        'bucket' => 'second-bucket', 'endpoint' => 'https://second.example.com', 'team_id' => $this->team->id,
+    ]);
+
+    $this->databaseBackup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->team->id,
+        'save_s3' => true,
+        'frequency' => '0 2 * * *',
+        's3_storage_id' => $this->secondS3->id,
+        'database_type' => $this->database->getMorphClass(),
+        'database_id' => $this->database->id,
+    ]);
+    $this->databaseBackup->syncS3Storages([$this->firstS3->id, $this->secondS3->id]);
+
+    $this->volumeBackup = $volume->scheduledBackups()->create([
+        'team_id' => $this->team->id,
+        'save_s3' => true,
+        'frequency' => '0 3 * * *',
+        's3_storage_id' => $this->secondS3->id,
+    ]);
+    $this->volumeBackup->syncS3Storages([$this->firstS3->id, $this->secondS3->id]);
+});
+
+/**
+ * @return list<string> Buckets of the backup's destinations, primary first.
+ */
+function transferredBackupBuckets(ScheduledDatabaseBackup|ScheduledVolumeBackup $backup): array
+{
+    return $backup->selectedS3Storages()->pluck('bucket')->all();
+}
+
+function importTransferBundleIntoNewTeam(array $bundle, $context): Team
+{
+    $targetTeam = Team::factory()->create();
+    $context->application->forceDelete();
+    $context->database->forceDelete();
+    $context->server->forceDelete();
+
+    app(ServerTransferImporter::class)->import($bundle, teamId: $targetTeam->id);
+
+    return $targetTeam;
+}
+
+test('transfer keeps every S3 destination of database and volume backups', function () {
+    $bundle = app(ServerTransferExporter::class)->export($this->server);
+
+    expect(collect($bundle['s3_storages'])->pluck('uuid')->sort()->values()->all())
+        ->toEqual(collect([$this->firstS3->uuid, $this->secondS3->uuid])->sort()->values()->all());
+
+    $targetTeam = importTransferBundleIntoNewTeam($bundle, $this);
+
+    $databaseBackup = ScheduledDatabaseBackup::where('team_id', $targetTeam->id)->sole();
+    $volumeBackup = ScheduledVolumeBackup::where('team_id', $targetTeam->id)->sole();
+
+    expect(transferredBackupBuckets($databaseBackup))->toBe(['second-bucket', 'first-bucket'])
+        ->and($databaseBackup->save_s3)->toBeTruthy()
+        ->and($databaseBackup->s3->team_id)->toBe($targetTeam->id)
+        ->and(transferredBackupBuckets($volumeBackup))->toBe(['second-bucket', 'first-bucket'])
+        ->and($volumeBackup->save_s3)->toBeTrue()
+        ->and($volumeBackup->s3->team_id)->toBe($targetTeam->id);
+});
+
+test('transfer imports bundles that only have the primary S3 destination', function () {
+    $bundle = app(ServerTransferExporter::class)->export($this->server);
+    data_forget($bundle, 'projects.*.environments.*.databases.*.scheduled_backups.*.s3_storage_uuids');
+    data_forget($bundle, 'volume_backups.*.s3_storage_uuids');
+    expect(data_get($bundle, 'volume_backups.0'))->not->toHaveKey('s3_storage_uuids');
+
+    $targetTeam = importTransferBundleIntoNewTeam($bundle, $this);
+
+    expect(transferredBackupBuckets(ScheduledDatabaseBackup::where('team_id', $targetTeam->id)->sole()))->toBe(['second-bucket'])
+        ->and(transferredBackupBuckets(ScheduledVolumeBackup::where('team_id', $targetTeam->id)->sole()))->toBe(['second-bucket']);
+});
diff --git a/tests/Unit/ServerTransfer/TransferFinishChecklistTest.php b/tests/Unit/ServerTransfer/TransferFinishChecklistTest.php
new file mode 100644
index 0000000000..61d912da4f
--- /dev/null
+++ b/tests/Unit/ServerTransfer/TransferFinishChecklistTest.php
@@ -0,0 +1,278 @@
+<?php
+
+use App\Events\TransferFinishChanged;
+use App\Jobs\CheckTransferFinishStepsJob;
+use App\Livewire\Server\TransferFinish;
+use App\Models\Application;
+use App\Models\DnsProviderZone;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\ServerTransfer\TransferFinishChecklist;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Livewire;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Process::fake();
+    Storage::fake('ssh-keys');
+    InstanceSettings::forceCreate(['id' => 0, 'fqdn' => 'https://coolify-b.test']);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+
+    $rsaKey = openssl_pkey_new(['private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA]);
+    openssl_pkey_export($rsaKey, $pem);
+    $this->githubApp = GithubApp::create([
+        'name' => 'deploy-bot', 'organization' => 'acme', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com',
+        'app_id' => 1234, 'installation_id' => 5678, 'webhook_secret' => 'gh-secret', 'is_system_wide' => false, 'is_public' => false,
+        'team_id' => $this->team->id,
+        'private_key_id' => PrivateKey::create(['name' => 'gh', 'private_key' => $pem, 'team_id' => $this->team->id])->id,
+    ]);
+    $this->checklist = app(TransferFinishChecklist::class);
+});
+
+function finishTestApplication(object $test, array $attributes = []): Application
+{
+    return Application::factory()->create([
+        'destination_id' => $test->destination->id,
+        'destination_type' => $test->destination->getMorphClass(),
+        ...$attributes,
+    ]);
+}
+
+function finishTestItem(Server $server, string $key): array
+{
+    return collect(data_get($server->fresh()->server_metadata, 'transfer.finish.items'))->firstWhere('key', $key);
+}
+
+test('start lists a step for every kind of setting the server uses', function () {
+    $githubApplication = finishTestApplication($this, ['source_type' => GithubApp::class, 'source_id' => $this->githubApp->id, 'fqdn' => 'https://shop.example.test']);
+    $gitlabApp = GitlabApp::create(['name' => 'gitlab', 'api_url' => 'https://gitlab.com/api/v4', 'html_url' => 'https://gitlab.com', 'team_id' => $this->team->id, 'is_system_wide' => false]);
+    finishTestApplication($this, ['source_type' => GitlabApp::class, 'source_id' => $gitlabApp->id]);
+    $publicApplication = finishTestApplication($this, ['source_type' => null, 'source_id' => null, 'git_repository' => 'https://github.com/acme/public']);
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare']);
+    $record = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => DnsProviderZone::factory()->create(['integration_token_id' => $token->id])->id]);
+    $record->addReference($githubApplication);
+    $runnerConfig = GithubRunnerConfig::create(['server_id' => $this->server->id, 'github_app_id' => $this->githubApp->id, 'labels' => ['coolify']]);
+
+    $keys = array_column($this->checklist->start($this->server), 'key');
+
+    expect($keys)->toContain(
+        'server_connection:server',
+        'sentinel:server',
+        "github_app_webhook:{$this->githubApp->uuid}",
+        "github_app_urls:{$this->githubApp->uuid}",
+        "gitlab_webhook:{$gitlabApp->uuid}",
+        "manual_webhook:{$publicApplication->uuid}",
+        "dns_record:{$record->uuid}",
+        'domain:shop.example.test',
+        "github_runners:{$runnerConfig->uuid}",
+    )->and($keys)->not->toContain("manual_webhook:{$githubApplication->uuid}");
+});
+
+test('the GitHub App webhook step checks the URL at GitHub and sets it with one click', function () {
+    finishTestApplication($this, ['source_type' => GithubApp::class, 'source_id' => $this->githubApp->id]);
+    $this->checklist->start($this->server);
+    $key = "github_app_webhook:{$this->githubApp->uuid}";
+    $hookUrl = 'https://coolify-a.test/webhooks/source/github/events';
+    Http::fake([
+        'https://api.github.com/zen' => Http::response('ok', 200, ['Date' => now()->toRfc7231String()]),
+        'https://api.github.com/app/hook/config' => function ($request) use (&$hookUrl) {
+            if ($request->method() === 'PATCH') {
+                $hookUrl = $request['url'];
+            }
+
+            return Http::response(['url' => $hookUrl, 'content_type' => 'json']);
+        },
+    ]);
+
+    expect($this->checklist->check($this->server, $key)['status'])->toBe('action');
+
+    $item = $this->checklist->fix($this->server, $key);
+
+    expect($item['status'])->toBe('ok')
+        ->and(finishTestItem($this->server, $key)['status'])->toBe('ok');
+    Http::assertSent(fn ($request) => $request->method() === 'PATCH' && $request['url'] === 'https://coolify-b.test/webhooks/source/github/events');
+});
+
+test('a webhook step turns OK when this instance receives a webhook after the transfer', function () {
+    $application = finishTestApplication($this, ['source_type' => null, 'source_id' => null, 'git_repository' => 'https://github.com/acme/public']);
+    $this->checklist->start($this->server);
+    $key = "manual_webhook:{$application->uuid}";
+
+    expect($this->checklist->check($this->server, $key)['status'])->toBe('action');
+
+    $this->travel(1)->minutes();
+    TransferFinishChecklist::recordWebhook('application', $application->uuid);
+
+    expect($this->checklist->check($this->server, $key)['status'])->toBe('ok');
+});
+
+test('a verified GitHub App webhook is recorded for the finish list', function () {
+    $body = json_encode(['action' => 'created', 'installation' => ['id' => 5678]]);
+    $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'installation',
+        'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'gh-secret'),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    expect(Cache::get("transfer-finish:webhook:github_app:{$this->githubApp->uuid}"))->not->toBeNull();
+});
+
+test('I finished closes the list and keeps the open steps as skipped', function () {
+    $this->checklist->start($this->server);
+    $this->checklist->markDone($this->server, 'server_connection:server');
+
+    $this->checklist->finish($this->server->fresh(), $this->user);
+
+    $finish = $this->checklist->of($this->server->fresh());
+    expect($finish['finished_by'])->toBe($this->user->id)
+        ->and($finish['skipped'])->toBe(['sentinel:server'])
+        ->and($this->checklist->isOpen($this->server->fresh()))->toBeFalse();
+});
+
+test('the panel shows the open steps by group, collapses done steps, and finishes', function () {
+    $this->checklist->start($this->server);
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server])
+        ->assertSee('Finish the transfer')
+        ->assertSee('0 of 2 done.')
+        ->assertSee('Server')
+        ->assertSee('Restart Sentinel')
+        ->call('markStepDone', 'sentinel:server')
+        ->assertSee('1 of 2 done.')
+        ->assertSee('1 step is OK or done')
+        ->assertSee('Finish with open steps')
+        ->call('markStepDone', 'server_connection:server')
+        ->assertDontSee('Finish with open steps')
+        ->call('finishTransfer')
+        ->assertDontSee('Finish the transfer');
+
+    expect(finishTestItem($this->server, 'sentinel:server')['status'])->toBe('done');
+});
+
+test('the panel starts background checks when they are stale, and not again within 30 seconds', function () {
+    Queue::fake();
+    $this->checklist->start($this->server);
+    $component = Livewire::test(TransferFinish::class, ['server' => $this->server]);
+
+    $component->call('refreshSteps');
+    Queue::assertPushed(CheckTransferFinishStepsJob::class, 1);
+
+    $this->checklist->checkAll($this->server->fresh());
+    $component->call('refreshSteps');
+    Queue::assertPushed(CheckTransferFinishStepsJob::class, 1);
+});
+
+test('a failed check shows a short message and keeps the technical reason as details', function () {
+    finishTestApplication($this, ['source_type' => GithubApp::class, 'source_id' => $this->githubApp->id]);
+    $this->checklist->start($this->server);
+    Http::fake([
+        'https://api.github.com/zen' => Http::response('ok', 200, ['Date' => now()->toRfc7231String()]),
+        'https://api.github.com/app/hook/config' => Http::response(['message' => 'Bad credentials'], 401),
+    ]);
+
+    $item = $this->checklist->check($this->server, "github_app_webhook:{$this->githubApp->uuid}");
+
+    expect($item['message'])->toBe('GitHub cannot be asked with the App key. No webhook arrived since the transfer.')
+        ->and($item['error'])->toContain('Bad credentials')
+        ->and($item['hint'])->toBe('GitHub must send webhooks to this instance.')
+        ->and($item['details'][0]['value'])->toBe('https://coolify-b.test/webhooks/source/github/events');
+});
+
+test('team members cannot check or finish the transfer', function () {
+    $this->checklist->start($this->server);
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server])->call('finishTransfer')->assertForbidden();
+    Livewire::test(TransferFinish::class, ['server' => $this->server])->call('markStepDone', 'sentinel:server')->assertForbidden();
+    Livewire::test(TransferFinish::class, ['server' => $this->server])->call('fixStep', 'sentinel:server')->assertForbidden();
+
+    expect($this->checklist->isOpen($this->server->fresh()))->toBeTrue();
+});
+
+test('a Docker image application has no manual webhook step', function () {
+    $application = finishTestApplication($this, ['source_type' => null, 'source_id' => null, 'build_pack' => 'dockerimage', 'git_repository' => 'coollabsio/coolify']);
+
+    expect(array_column($this->checklist->start($this->server), 'key'))->not->toContain("manual_webhook:{$application->uuid}");
+});
+
+test('an application that lost its system-wide git source gets a git source step with a link', function () {
+    $environment = Project::factory()->create(['team_id' => $this->team->id])->environments()->first();
+    $application = finishTestApplication($this, ['source_type' => null, 'source_id' => null, 'environment_id' => $environment->id]);
+    $this->server->forceFill(['server_metadata' => ['transfer' => ['status' => 'claimed', 'git_source_applications' => [$application->uuid]]]])->save();
+    $key = "git_source:{$application->uuid}";
+
+    $items = collect($this->checklist->start($this->server));
+    $item = $items->firstWhere('key', $key);
+    expect($items->pluck('key'))->not->toContain("manual_webhook:{$application->uuid}")
+        ->and($item['link'])->toStartWith('/project/')->toEndWith("/application/{$application->uuid}/source")
+        ->and($this->checklist->check($this->server, $key)['status'])->toBe('action');
+
+    $gitlabApp = GitlabApp::create(['name' => 'gitlab', 'api_url' => 'https://gitlab.com/api/v4', 'html_url' => 'https://gitlab.com', 'team_id' => $this->team->id, 'is_system_wide' => false]);
+    $application->forceFill(['source_type' => GitlabApp::class, 'source_id' => $gitlabApp->id])->save();
+
+    expect($this->checklist->check($this->server, $key)['status'])->toBe('ok');
+});
+
+test('restarting Sentinel waits for its data instead of failing the step at once', function () {
+    $this->checklist->start($this->server);
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server])
+        ->call('fixStep', 'sentinel:server')
+        ->assertDispatched('info')
+        ->assertNotDispatched('error');
+
+    expect(finishTestItem($this->server, 'sentinel:server')['status'])->toBe('pending');
+});
+
+test('a changed step is broadcast to the team, and the open panel shows it without a reload', function () {
+    Event::fake([TransferFinishChanged::class]);
+    $this->checklist->start($this->server);
+    $component = Livewire::test(TransferFinish::class, ['server' => $this->server])->assertSee('0 of 2 done.');
+
+    $this->checklist->markDone($this->server->fresh(), 'sentinel:server');
+
+    Event::assertDispatched(TransferFinishChanged::class, fn ($event) => $event->serverUuid === $this->server->uuid && $event->teamId === $this->team->id);
+    $component->call('handleTransferFinishChanged', ['serverUuid' => $this->server->uuid])->assertSee('1 of 2 done.');
+});
+
+test('the GitHub App steps link to the App settings at GitHub', function () {
+    finishTestApplication($this, ['source_type' => GithubApp::class, 'source_id' => $this->githubApp->id]);
+    $items = collect($this->checklist->start($this->server));
+
+    expect($this->checklist->linkOf($items->firstWhere('key', "github_app_webhook:{$this->githubApp->uuid}")))->toBe(['https://github.com/organizations/acme/settings/apps/deploy-bot', 'Open on GitHub'])
+        ->and($this->checklist->linkOf($items->firstWhere('key', "github_app_urls:{$this->githubApp->uuid}")))->toBe(['https://github.com/organizations/acme/settings/apps/deploy-bot', 'Open on GitHub']);
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server])
+        ->assertSeeHtml('href="https://github.com/organizations/acme/settings/apps/deploy-bot" target="_blank"')
+        ->assertSee('Open on GitHub');
+});
diff --git a/tests/Unit/Services/FleetMetricsAggregatorRankingTest.php b/tests/Unit/Services/FleetMetricsAggregatorRankingTest.php
new file mode 100644
index 0000000000..6b6fe2ee1e
--- /dev/null
+++ b/tests/Unit/Services/FleetMetricsAggregatorRankingTest.php
@@ -0,0 +1,33 @@
+<?php
+
+use App\Services\FleetMetricsAggregator;
+
+it('sums series by bucket timestamp and sorts ascending', function () {
+    $merged = FleetMetricsAggregator::sumSeriesByBucket([
+        [[2000, 5.0], [1000, 1.0]],
+        [[1000, 2.0], [3000, 9.0]],
+    ], 'sum');
+
+    expect($merged)->toBe([[1000, 3.0], [2000, 5.0], [3000, 9.0]]);
+});
+
+it('averages series across servers per bucket', function () {
+    $merged = FleetMetricsAggregator::sumSeriesByBucket([
+        [[1000, 20.0]],
+        [[1000, 40.0]],
+    ], 'avg');
+
+    expect($merged)->toBe([[1000, 30.0]]);
+});
+
+it('ranks containers by the selected metric and caps the list', function () {
+    $containers = [
+        ['id' => 'a', 'cpu' => 10.0, 'memUsed' => 500, 'diskBytes' => 5, 'net' => 1.0],
+        ['id' => 'b', 'cpu' => 90.0, 'memUsed' => 100, 'diskBytes' => 9, 'net' => 2.0],
+        ['id' => 'c', 'cpu' => 50.0, 'memUsed' => 900, 'diskBytes' => 1, 'net' => 3.0],
+    ];
+
+    expect(array_column(FleetMetricsAggregator::rankContainers($containers, 'cpu', 2), 'id'))->toBe(['b', 'c']);
+    expect(array_column(FleetMetricsAggregator::rankContainers($containers, 'memory'), 'id'))->toBe(['c', 'a', 'b']);
+    expect(array_column(FleetMetricsAggregator::rankContainers($containers, 'network'), 'id'))->toBe(['c', 'b', 'a']);
+});
diff --git a/tests/Unit/Services/FleetMetricsAggregatorTest.php b/tests/Unit/Services/FleetMetricsAggregatorTest.php
new file mode 100644
index 0000000000..2de55616f7
--- /dev/null
+++ b/tests/Unit/Services/FleetMetricsAggregatorTest.php
@@ -0,0 +1,69 @@
+<?php
+
+use App\Services\FleetMetricsAggregator;
+
+function row(array $overrides = []): array
+{
+    return array_merge([
+        'uuid' => 'u', 'name' => 'srv', 'online' => true,
+        'cpu' => 10.0, 'memUsed' => 1_000, 'memTotal' => 10_000,
+        'diskUsed' => 1_000, 'diskTotal' => 10_000, 'diskPercent' => 10.0,
+        'load1' => 0.5, 'netRx' => 100.0, 'netTx' => 50.0, 'containers' => 2,
+    ], $overrides);
+}
+
+it('weights memory and disk by totals, not mean of percents', function () {
+    $rows = [
+        row(['memUsed' => 100, 'memTotal' => 100, 'diskUsed' => 100, 'diskTotal' => 100, 'diskPercent' => 100.0]),
+        row(['memUsed' => 10, 'memTotal' => 1_000, 'diskUsed' => 10, 'diskTotal' => 1_000, 'diskPercent' => 1.0]),
+    ];
+
+    $kpis = FleetMetricsAggregator::fleetKpis($rows);
+
+    // Σused/Σtotal = 110/1100 = 10%, not the (100+1)/2 = 50.5% a naive mean gives.
+    expect(round($kpis['memPercent'], 1))->toBe(10.0);
+    expect(round($kpis['diskPercent'], 1))->toBe(10.0);
+});
+
+it('means cpu, flags approximate for multiple servers, and finds the busiest', function () {
+    $kpis = FleetMetricsAggregator::fleetKpis([
+        row(['name' => 'a', 'cpu' => 20.0]),
+        row(['name' => 'b', 'cpu' => 80.0]),
+    ]);
+
+    expect($kpis['cpuAvg'])->toBe(50.0);
+    expect($kpis['cpuApproximate'])->toBeTrue();
+    expect($kpis['cpuBusiest'])->toBe(['name' => 'b', 'percent' => 80.0]);
+});
+
+it('sums network rates and reports busiest and average load', function () {
+    $kpis = FleetMetricsAggregator::fleetKpis([
+        row(['netRx' => 100.0, 'netTx' => 10.0, 'load1' => 0.5]),
+        row(['netRx' => 200.0, 'netTx' => 20.0, 'load1' => 2.5]),
+    ]);
+
+    expect($kpis['netRx'])->toBe(300.0);
+    expect($kpis['netTx'])->toBe(30.0);
+    expect($kpis['loadBusiest'])->toBe(2.5);
+    expect($kpis['loadAvg'])->toBe(1.5);
+});
+
+it('ignores offline rows and counts servers needing attention', function () {
+    $kpis = FleetMetricsAggregator::fleetKpis([
+        row(['cpu' => 95.0]),                 // over cpu error cutoff
+        row(['online' => false, 'cpu' => 99.0]),
+    ]);
+
+    expect($kpis['serversOnline'])->toBe(1);
+    expect($kpis['serversTotal'])->toBe(2);
+    expect($kpis['needsAttention'])->toBe(1);
+    expect($kpis['cpuAvg'])->toBe(95.0); // offline row excluded from the mean
+});
+
+it('returns zeroed kpis for no rows', function () {
+    $kpis = FleetMetricsAggregator::fleetKpis([]);
+
+    expect($kpis['serversOnline'])->toBe(0);
+    expect($kpis['cpuAvg'])->toBe(0.0);
+    expect($kpis['cpuBusiest'])->toBeNull();
+});
diff --git a/tests/Unit/Services/SentinelMetricsClientTest.php b/tests/Unit/Services/SentinelMetricsClientTest.php
new file mode 100644
index 0000000000..3efbdf42b9
--- /dev/null
+++ b/tests/Unit/Services/SentinelMetricsClientTest.php
@@ -0,0 +1,181 @@
+<?php
+
+use App\Models\Server;
+use App\Services\SentinelMetricsClient;
+use Illuminate\Support\Carbon;
+
+class FakeMetricsClient extends SentinelMetricsClient
+{
+    /** @var array<string, string> substring => body */
+    public array $bodies = [];
+
+    /** @var array<int, string> */
+    public array $failing = [];
+
+    protected function raw(string $url): string
+    {
+        foreach ($this->failing as $needle) {
+            if (str_contains($url, $needle)) {
+                throw new RuntimeException('boom');
+            }
+        }
+        foreach ($this->bodies as $needle => $body) {
+            if (str_contains($url, $needle)) {
+                return $body;
+            }
+        }
+
+        return '[]';
+    }
+}
+
+function fakeMetricsClient(): FakeMetricsClient
+{
+    $server = Server::factory()->make(['uuid' => 'srv-uuid']);
+
+    return new FakeMetricsClient($server);
+}
+
+it('normalizes the host summary, choosing the root disk mount', function () {
+    $client = fakeMetricsClient();
+    $client->bodies = [
+        '/summary' => json_encode([
+            'cpu' => ['time' => 't', 'percent' => 42.5],
+            'memory' => ['time' => 't', 'total' => 1000, 'used' => 250, 'usedPercent' => 25.0],
+            'disk' => [
+                ['time' => 't', 'mount' => '/boot', 'total' => 10, 'used' => 9, 'usedPercent' => 90.0],
+                ['time' => 't', 'mount' => '/', 'total' => 100, 'used' => 40, 'usedPercent' => 40.0],
+            ],
+            'network' => ['time' => 't', 'rxBytesPerSec' => 100.0, 'txBytesPerSec' => 20.0],
+            'load' => ['time' => 't', 'load1' => 1.5, 'load5' => 1.0, 'load15' => 0.5],
+        ]),
+    ];
+
+    $summary = $client->summary();
+
+    expect($summary['cpu'])->toBe(42.5);
+    expect($summary['memUsed'])->toBe(250);
+    expect($summary['diskPercent'])->toBe(40.0); // root mount, not /boot
+    expect($summary['netRx'])->toBe(100.0);
+    expect($summary['load1'])->toBe(1.5);
+});
+
+it('returns null summary when the endpoint fails', function () {
+    $client = fakeMetricsClient();
+    $client->failing = ['/summary'];
+
+    expect($client->summary())->toBeNull();
+});
+
+it('normalizes containers, parsing the stringified cpu percent', function () {
+    $client = fakeMetricsClient();
+    $client->bodies = [
+        '/containers/current' => json_encode([
+            ['id' => 'app-a', 'cpu' => ['time' => 't', 'percent' => '12.5'],
+                'memory' => ['used' => 500, 'usedPercent' => 5.0],
+                'disk' => ['writableLayer' => 3, 'volumesTotal' => 7],
+                'network' => ['rxBytesPerSec' => 4.0, 'txBytesPerSec' => 1.0]],
+        ]),
+    ];
+
+    $rows = $client->containersCurrent();
+
+    expect($rows[0]['id'])->toBe('app-a');
+    expect($rows[0]['cpu'])->toBe(12.5);
+    expect($rows[0]['memUsed'])->toBe(500);
+    expect($rows[0]['diskBytes'])->toBe(10); // writableLayer + volumesTotal
+    expect($rows[0]['net'])->toBe(5.0);      // rx + tx
+});
+
+it('returns an empty container list when the endpoint 404s', function () {
+    $client = fakeMetricsClient();
+    $client->failing = ['/containers/current'];
+
+    expect($client->containersCurrent())->toBe([]);
+});
+
+it('averages cpu history into range-aligned buckets', function () {
+    $client = fakeMetricsClient();
+    $client->bodies = [
+        '/cpu/history' => json_encode([
+            ['time' => '1700000000000', 'percent' => '10'],
+            ['time' => '1700000060000', 'percent' => '20'],
+            ['time' => '1700000300000', 'percent' => '40'],
+        ]),
+    ];
+
+    // 24h range → 5-minute buckets floored to absolute epoch boundaries.
+    expect($client->history('cpu', '24h'))->toBe([[1699999800000, 15.0], [1700000100000, 40.0]]);
+});
+
+it('aligns buckets across servers whose samples have different timestamps', function () {
+    $a = fakeMetricsClient();
+    $a->bodies = ['/cpu/history' => json_encode([['time' => 1700000001234, 'percent' => '10']])];
+    $b = fakeMetricsClient();
+    $b->bodies = ['/cpu/history' => json_encode([['time' => 1700000047890, 'percent' => '30']])];
+
+    expect(array_column($a->history('cpu', '24h'), 0))->toBe(array_column($b->history('cpu', '24h'), 0));
+});
+
+it('keeps long history series small', function () {
+    $rows = [];
+    // 24h of raw 20-second samples.
+    for ($i = 0; $i < 4320; $i++) {
+        $rows[] = ['time' => 1700000000000 + $i * 20_000, 'percent' => (string) ($i % 100)];
+    }
+
+    $client = fakeMetricsClient();
+    $client->bodies = ['/cpu/history' => json_encode($rows)];
+
+    expect(count($client->history('cpu', '24h')))->toBeLessThanOrEqual(300);
+});
+
+it('keeps only the root mount in disk history', function () {
+    $client = fakeMetricsClient();
+    $client->bodies = [
+        '/disk/history' => json_encode([
+            ['time' => 1700000000000, 'mount' => '/', 'usedPercent' => 85],
+            ['time' => 1700000000000, 'mount' => '/boot', 'usedPercent' => 20],
+        ]),
+    ];
+
+    expect($client->history('disk', '24h'))->toBe([[1699999800000, 85.0]]);
+});
+
+it('rounds the range start to the minute so history responses are cacheable', function () {
+    Carbon::setTestNow('2026-01-01 12:30:05');
+    $first = SentinelMetricsClient::rangeFrom('24h');
+
+    Carbon::setTestNow('2026-01-01 12:30:45');
+
+    expect(SentinelMetricsClient::rangeFrom('24h'))->toBe($first)->toBe('2025-12-31T12:30:00Z');
+
+    Carbon::setTestNow();
+});
+
+it('does not substitute another mount when root disk history is absent', function () {
+    $client = fakeMetricsClient();
+    $client->bodies = ['/disk/history' => json_encode([
+        ['time' => 1700000000000, 'mount' => '/boot', 'usedPercent' => 90],
+    ])];
+
+    expect($client->history('disk', '24h'))->toBe([]);
+});
+
+it('supports disk history without mount fields', function () {
+    $client = fakeMetricsClient();
+    $client->bodies = ['/disk/history' => json_encode([
+        ['time' => 1700000000000, 'usedPercent' => 40],
+    ])];
+
+    expect($client->history('disk', '24h'))->toBe([[1699999800000, 40.0]]);
+});
+
+it('does not substitute another disk mount in the summary', function () {
+    $client = fakeMetricsClient();
+    $client->bodies = ['/summary' => json_encode(['disk' => [
+        ['mount' => '/boot', 'used' => 90, 'total' => 100, 'usedPercent' => 90],
+    ]])];
+
+    expect($client->summary()['diskPercent'])->toBeNull();
+});
diff --git a/tests/Unit/TrafficCityHelpersTest.php b/tests/Unit/TrafficCityHelpersTest.php
new file mode 100644
index 0000000000..9d1c7437dc
--- /dev/null
+++ b/tests/Unit/TrafficCityHelpersTest.php
@@ -0,0 +1,137 @@
+<?php
+
+describe('trafficCityRows', function () {
+    it('builds labels, keeps coordinates, and sorts by requests', function () {
+        $rows = trafficCityRows([
+            ['value' => 'SG||Singapore', 'requests' => 3, 'bytesOut' => 30, 'lat' => 1.29, 'lon' => 103.85],
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900, 'lat' => 52.52, 'lon' => 13.405],
+        ]);
+
+        expect($rows)->toBe([
+            ['key' => 'DE|BE|Berlin', 'country' => 'DE', 'label' => 'Berlin, BE, DE', 'name' => 'Berlin', 'detail' => 'BE, Germany', 'requests' => 9, 'bytesOut' => 900, 'lat' => 52.52, 'lon' => 13.405],
+            ['key' => 'SG||Singapore', 'country' => 'SG', 'label' => 'Singapore, SG', 'name' => 'Singapore', 'detail' => 'Singapore', 'requests' => 3, 'bytesOut' => 30, 'lat' => 1.29, 'lon' => 103.85],
+        ]);
+    });
+
+    it('omits a subdivision that is not a letter code', function (string $value, string $label, string $detail) {
+        $rows = trafficCityRows([
+            ['value' => $value, 'requests' => 1, 'bytesOut' => 1],
+        ]);
+
+        expect($rows[0]['label'])->toBe($label)
+            ->and($rows[0]['detail'])->toBe($detail);
+    })->with([
+        'a name' => ['DE|Land Berlin|Berlin', 'Berlin, DE', 'Germany'],
+        'a number' => ['AT|3|Neunkirchen', 'Neunkirchen, AT', 'Austria'],
+        'one letter' => ['SE|O|Lidköping', 'Lidköping, SE', 'Sweden'],
+    ]);
+
+    it('labels an unknown city with its country and gives it no coordinates', function () {
+        $rows = trafficCityRows([
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900, 'lat' => 52.52, 'lon' => 13.405],
+            ['value' => 'DE||', 'requests' => 2, 'bytesOut' => 20, 'lat' => 51.0, 'lon' => 9.0],
+        ]);
+
+        expect($rows[1])->toBe([
+            'key' => 'DE||', 'country' => 'DE', 'label' => 'Unknown, DE', 'name' => 'Unknown', 'detail' => 'Germany', 'requests' => 2, 'bytesOut' => 20, 'lat' => null, 'lon' => null,
+        ]);
+    });
+
+    it('merges the remainder and malformed values into one Other row', function () {
+        $rows = trafficCityRows([
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900],
+            ['value' => '__other__', 'requests' => 40, 'bytesOut' => 40],
+            ['value' => 'Berlin', 'requests' => 1, 'bytesOut' => 10],
+            ['value' => 'DE|Berlin', 'requests' => 1, 'bytesOut' => 10],
+            ['value' => '', 'requests' => 1, 'bytesOut' => 10],
+        ]);
+
+        // "Other" has the most requests here and still stays last.
+        expect($rows)->toHaveCount(2)
+            ->and($rows[1])->toBe([
+                'key' => '__other__', 'country' => '', 'label' => 'Other', 'name' => 'Other', 'detail' => '', 'requests' => 43, 'bytesOut' => 70, 'lat' => null, 'lon' => null,
+            ]);
+    });
+
+    it('keeps a city name that contains quotes or HTML unchanged', function () {
+        $rows = trafficCityRows([
+            ['value' => "US|MO|O'Fallon <b>", 'requests' => 1, 'bytesOut' => 1],
+        ]);
+
+        expect($rows[0]['name'])->toBe("O'Fallon <b>")
+            ->and($rows[0]['label'])->toBe("O'Fallon <b>, MO, US");
+    });
+
+    it('accepts a lower-case country code', function () {
+        $rows = trafficCityRows([
+            ['value' => 'de|BE|Berlin', 'requests' => 1, 'bytesOut' => 1],
+        ]);
+
+        expect($rows[0]['country'])->toBe('DE')
+            ->and($rows[0]['label'])->toBe('Berlin, BE, DE');
+    });
+
+    it('skips rows with no requests', function () {
+        $rows = trafficCityRows([
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900],
+            ['value' => 'FR|IDF|Paris', 'requests' => 0, 'bytesOut' => 0],
+        ]);
+
+        expect($rows)->toHaveCount(1);
+    });
+
+    it('returns nothing when no row has a real city', function (array $input) {
+        expect(trafficCityRows($input))->toBe([]);
+    })->with([
+        'old sentinel' => [[]],
+        'country-only database' => [[
+            ['value' => 'DE||', 'requests' => 5, 'bytesOut' => 50],
+            ['value' => 'US||', 'requests' => 3, 'bytesOut' => 30],
+        ]],
+        'only the remainder' => [[
+            ['value' => '__other__', 'requests' => 5, 'bytesOut' => 50],
+        ]],
+    ]);
+});
+
+describe('trafficGeoMarkers', function () {
+    it('returns country markers and city markers as two sets', function () {
+        $markers = trafficGeoMarkers(
+            [
+                ['value' => 'DE', 'requests' => 12],
+                ['value' => 'us', 'requests' => 7],
+                ['value' => '', 'requests' => 3],
+                ['value' => 'FR', 'requests' => 0],
+            ],
+            [
+                ['value' => 'DE|BE|Berlin', 'requests' => 9, 'lat' => 52.52, 'lon' => 13.405],
+                ['value' => 'DE||', 'requests' => 3],
+                ['value' => 'FR|IDF|Paris', 'requests' => 0, 'lat' => 48.85, 'lon' => 2.35],
+            ],
+        );
+
+        expect($markers)->toBe([
+            'countries' => [
+                ['code' => 'DE', 'requests' => 12],
+                ['code' => 'US', 'requests' => 7],
+            ],
+            'cities' => [
+                ['lat' => 52.52, 'lon' => 13.405, 'requests' => 9],
+            ],
+        ]);
+    });
+
+    it('has no city markers when Sentinel sends no city data', function () {
+        expect(trafficGeoMarkers([['value' => 'DE', 'requests' => 12]], [])['cities'])->toBe([]);
+    });
+
+    it('accepts the rows that trafficCityRows returns', function () {
+        $rows = trafficCityRows([
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900, 'lat' => 52.52, 'lon' => 13.405],
+        ]);
+
+        expect(trafficGeoMarkers([], $rows)['cities'])->toBe([
+            ['lat' => 52.52, 'lon' => 13.405, 'requests' => 9],
+        ]);
+    });
+});
diff --git a/tests/Unit/UpdateCoolifyTest.php b/tests/Unit/UpdateCoolifyTest.php
index ddc8c2546b..73f0ae6619 100644
--- a/tests/Unit/UpdateCoolifyTest.php
+++ b/tests/Unit/UpdateCoolifyTest.php
@@ -3,7 +3,11 @@
 use App\Actions\Server\UpdateCoolify;
 use App\Livewire\Settings\Updates;
 use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\ScheduledDatabaseBackup;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
 use App\Models\Team;
 use App\Models\User;
 use App\Support\RemoteProcessCommand;
@@ -11,8 +15,10 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
 use Spatie\Activitylog\Models\Activity;
@@ -53,6 +59,58 @@ function updateCoolifyTestActionWithStatus(string $status): UpdateCoolify
     };
 }
 
+function updateCoolifyTestCreateInstanceBackup(): void
+{
+    Storage::fake('ssh-keys');
+    Notification::fake();
+    Server::query()->whereKey(0)->update(['private_key_id' => PrivateKey::factory()->create(['team_id' => 0])->id]);
+    Server::flushIdentityMap();
+    StandalonePostgresql::forceCreate([
+        'id' => 0,
+        'name' => 'coolify-db',
+        'postgres_password' => 'password',
+        'destination_type' => StandaloneDocker::class,
+        'destination_id' => 0,
+    ]);
+    ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'database_id' => 0,
+        'database_type' => StandalonePostgresql::class,
+        'team_id' => 0,
+    ]);
+}
+
+function updateCoolifyTestPrepareUpgrade(): void
+{
+    Queue::fake();
+    config([
+        'app.env' => 'testing',
+        'constants.coolify.version' => '4.0.9',
+        'constants.coolify.helper_version' => '1.0.14',
+        'constants.coolify.upgrade_script_url' => 'https://cdn.example.com/upgrade.sh',
+        'constants.ssh.mux_enabled' => false,
+    ]);
+
+    updateCoolifyTestCreateRootServerAndSettings([
+        'is_auto_update_enabled' => true,
+        'new_version_available' => true,
+        'docker_registry_url' => 'docker.io',
+    ]);
+
+    Http::fake([
+        '*' => Http::response([
+            'coolify' => ['v4' => ['version' => '4.0.10']],
+        ], 200),
+    ]);
+}
+
+function updateCoolifyTestPrepareUpdate(array $settings = []): void
+{
+    updateCoolifyTestPrepareUpgrade();
+    InstanceSettings::findOrFail(0)->update($settings);
+    updateCoolifyTestCreateInstanceBackup();
+}
+
 afterEach(function () {
     Mockery::close();
 });
@@ -363,3 +421,33 @@ it('starts an upgrade when the previous upgrade status is older than the lock ex
     expect(RemoteProcessCommand::read(Activity::query()->latest('id')->first()))
         ->toContain("bash /data/coolify/source/upgrade.sh '4.0.10'");
 });
+
+it('backs up the instance database before the update', function () {
+    updateCoolifyTestPrepareUpdate();
+    Process::fake(['*du -b*' => '128', '*' => '']);
+
+    (new UpdateCoolify)->handle(manual_update: true);
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'pg_dump'));
+    expect(RemoteProcessCommand::read(Activity::query()->latest('id')->first()))
+        ->toContain("bash /data/coolify/source/upgrade.sh '4.0.10'");
+});
+
+it('skips the backup before the update when it is disabled', function () {
+    updateCoolifyTestPrepareUpdate(['is_backup_before_update_enabled' => false]);
+    Process::fake();
+
+    (new UpdateCoolify)->handle(manual_update: true);
+
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'pg_dump'));
+    expect(Activity::query()->count())->toBe(1);
+});
+
+it('does not start the update when the instance backup fails', function () {
+    updateCoolifyTestPrepareUpdate();
+    Process::fake(['*pg_dump*' => Process::result(exitCode: 1), '*' => '']);
+
+    expect(fn () => (new UpdateCoolify)->handle(manual_update: true))
+        ->toThrow(Exception::class, 'The database backup failed, so the update was not started.')
+        ->and(Activity::query()->count())->toBe(0);
+});
diff --git a/tests/v4/Browser/ApplicationConfigurationTest.php b/tests/v4/Browser/ApplicationConfigurationTest.php
index 39b0b37a39..be745506ab 100644
--- a/tests/v4/Browser/ApplicationConfigurationTest.php
+++ b/tests/v4/Browser/ApplicationConfigurationTest.php
@@ -193,6 +193,59 @@ it('saves custom docker run options from the UI', function () {
         ->screenshot(filename: 'application-docker-run-options');
 });
 
+it('warns when the Dockerfile location repeats the base directory and applies the suggested fix', function () {
+    $this->application->update([
+        'build_pack' => 'dockerfile',
+        'base_directory' => '/apps/api',
+        'dockerfile_location' => '/apps/api/Dockerfile',
+    ]);
+
+    loginAndSkipBoarding();
+
+    $page = visit(applicationConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->application
+    ));
+
+    $page->assertSee('Base directory is repeated')
+        ->assertSee('/apps/api/apps/api/Dockerfile')
+        ->screenshot(filename: 'application-dockerfile-location-repeats-base-directory')
+        ->click('Use /Dockerfile')
+        ->assertDontSee('Base directory is repeated')
+        ->assertSee('/apps/api/Dockerfile');
+
+    submitLivewireForm($page);
+
+    $page->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-dockerfile-location-fixed');
+
+    $this->application->refresh();
+    expect($this->application->base_directory)->toBe('/apps/api')
+        ->and($this->application->dockerfile_location)->toBe('/Dockerfile');
+});
+
+it('restores the default file location when the field is cleared', function (string $buildPack, string $column, string $default) {
+    $this->application->update(['build_pack' => $buildPack, $column => '/docker/custom']);
+
+    loginAndSkipBoarding();
+
+    $page = visit(applicationConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->application
+    ));
+
+    $page->clear("input[placeholder='{$default}']")
+        ->keys("input[placeholder='{$default}']", 'Tab')
+        ->assertValue("input[placeholder='{$default}']", $default)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: "application-{$buildPack}-location-cleared");
+})->with([
+    'Dockerfile' => ['dockerfile', 'dockerfile_location', '/Dockerfile'],
+    'Docker Compose' => ['dockercompose', 'docker_compose_location', '/docker-compose.yaml'],
+]);
+
 it('opens environment variables page for the application', function () {
     loginAndSkipBoarding();
 
diff --git a/tests/v4/Browser/ApplicationHttpBasicAuthHashingTest.php b/tests/v4/Browser/ApplicationHttpBasicAuthHashingTest.php
new file mode 100644
index 0000000000..148900b144
--- /dev/null
+++ b/tests/v4/Browser/ApplicationHttpBasicAuthHashingTest.php
@@ -0,0 +1,45 @@
+<?php
+
+use App\Enums\HttpBasicAuthHashAlgorithm;
+use App\Enums\ProxyTypes;
+use App\Models\Server;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(fn () => Server::flushIdentityMap());
+
+afterEach(fn () => Server::flushIdentityMap());
+
+it('replaces the cost factor with memory and iterations when Argon2id is selected', function () {
+    $stack = seedBrowserResourceStack();
+    $stack['server']->forceFill(['proxy' => [
+        'type' => ProxyTypes::CADDY->value,
+        'status' => 'running',
+        'last_saved_settings' => 'applied',
+        'last_applied_settings' => 'applied',
+        'last_saved_proxy_configuration' => "services:\n  caddy:\n    image: 'lucaslorentz/caddy-docker-proxy:2.13-alpine'\n",
+    ]])->save();
+    $application = createBrowserApplication($stack, [
+        'name' => 'Basic Auth App',
+        'fqdn' => 'https://basic-auth.example.com',
+        'is_http_basic_auth_enabled' => true,
+        'http_basic_auth_username' => 'admin',
+        'http_basic_auth_password' => 'secret',
+    ]);
+    loginAndSkipBoarding();
+
+    $page = visit(applicationConfigurationUrl($stack['project'], $stack['environment'], $application));
+    $page->assertSee('Cost factor')
+        ->script("document.querySelector('#security-section').scrollIntoView()");
+
+    selectListboxOption($page, 'httpBasicAuthHashAlgorithm', 'Argon2id Memory-hard, more resistant to cracking');
+
+    $page->assertSeeIn('#httpBasicAuthArgon2idMemoryCost-trigger', '64 MiB')
+        ->assertSeeIn('#httpBasicAuthArgon2idTimeCost-trigger', '4')
+        ->assertDontSee('Cost factor')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-basic-auth-argon2id');
+
+    expect($application->fresh()->http_basic_auth_hash_algorithm)->toBe(HttpBasicAuthHashAlgorithm::ARGON2ID);
+});
diff --git a/tests/v4/Browser/DeployCanvasTest.php b/tests/v4/Browser/DeployCanvasTest.php
new file mode 100644
index 0000000000..a471f4f386
--- /dev/null
+++ b/tests/v4/Browser/DeployCanvasTest.php
@@ -0,0 +1,163 @@
+<?php
+
+use App\Models\Project;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    $this->stack = seedBrowserResourceStack();
+});
+
+it('opens the deploy canvas for the environment from its New resource page', function () {
+    $environmentPath = "/project/{$this->stack['project']->uuid}/environment/{$this->stack['environment']->uuid}";
+    loginAndSkipBoarding();
+
+    $page = visit("{$environmentPath}/new");
+
+    $page->assertSee('Choose a resource')
+        ->click('a:visible:has-text("Deploy canvas")')
+        ->wait(1)
+        ->assertPathIs('/canvas')
+        ->assertSee('Deploy canvas')
+        ->assertSee('Browser Project')
+        ->assertSee('production')
+        ->assertSee('localhost')
+        ->assertDontSee('API token')
+        ->wait(0.5);
+
+    expect($page->script("document.querySelector('.cv-back').getAttribute('href')"))->toBe($environmentPath);
+
+    // The Server step is there, connected to Start, with the team's only server selected.
+    $flow = $page->script("JSON.parse(localStorage.getItem('coolify-canvas:flow'))");
+    expect($flow['edges'])->toContain(['from' => 'start', 'to' => 'server'])
+        ->and(collect($flow['nodes'])->firstWhere('id', 'server')['data']['server'] ?? null)->toBe($this->stack['server']->uuid);
+    $page->screenshot(filename: 'deploy-canvas');
+});
+
+it('adds a project and an environment from the Start step', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/canvas');
+
+    $page->assertSee('Deploy canvas')
+        ->click('.cv-node[data-id="start"] .cv-field:nth-child(1) .cv-select')
+        ->click('.cv-dd-new')
+        ->fill('.cv-dd-form input', 'Shop')
+        ->keys('.cv-dd-form input', 'Enter')
+        ->wait(1.5);
+
+    $project = Project::query()->where('name', 'Shop')->firstOrFail();
+    $start = fn () => collect($page->script("JSON.parse(localStorage.getItem('coolify-canvas:flow'))")['nodes'])->firstWhere('id', 'start')['data'];
+    expect($start())->toBe(['project' => $project->uuid, 'environment' => $project->environments()->value('uuid')]);
+
+    $page->click('.cv-node[data-id="start"] .cv-field:nth-child(2) .cv-select')
+        ->click('.cv-dd-new')
+        ->fill('.cv-dd-form input', 'staging')
+        ->keys('.cv-dd-form input', 'Enter')
+        ->wait(1.5)
+        ->assertSee('staging')
+        ->screenshot(filename: 'deploy-canvas-add-environment');
+
+    expect($start()['environment'])->toBe($project->environments()->where('name', 'staging')->value('uuid'));
+});
+
+it('picks a one-click service template from a searchable list', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/canvas');
+
+    $page->assertSee('Deploy canvas')
+        ->click('.cv-palette .cv-item:has-text("Service")')
+        ->click('.cv-node:has(b:text-is("Service")) .cv-select')
+        ->fill('.cv-dd-search', 'uptime kuma')
+        ->assertSee('Uptime Kuma With Mariadb')
+        ->keys('.cv-dd-search', 'Enter')
+        ->assertSee('Uptime Kuma')
+        ->wait(0.5)
+        ->screenshot(filename: 'deploy-canvas-service-template');
+
+    $flow = $page->script("JSON.parse(localStorage.getItem('coolify-canvas:flow'))");
+    expect(collect($flow['nodes'])->firstWhere('type', 'service')['data']['type'] ?? null)->toBe('uptime-kuma');
+});
+
+it('shows a closable not-optimized-for-mobile notice only on small screens', function () {
+    $project = $this->stack['project']->uuid;
+    $environment = $this->stack['environment']->uuid;
+    loginAndSkipBoarding();
+
+    $page = visit("/canvas?project={$project}&environment={$environment}");
+
+    $page->assertSee('Deploy canvas')
+        ->assertDontSee('The canvas is not optimized for mobile yet.')
+        ->resize(390, 844)
+        ->assertSee('The canvas is not optimized for mobile yet.')
+        ->screenshot(filename: 'deploy-canvas-mobile-notice');
+
+    expect($page->script("document.querySelector('.cv-notice a').getAttribute('href')"))
+        ->toBe("/project/{$project}/environment/{$environment}/new");
+
+    $page->click('[aria-label="Close this notice"]')
+        ->assertDontSee('The canvas is not optimized for mobile yet.')
+        ->refresh()
+        ->assertSee('Deploy canvas')
+        ->assertDontSee('The canvas is not optimized for mobile yet.')
+        ->screenshot(filename: 'deploy-canvas-mobile-notice-closed');
+});
+
+it('zooms around the fingers with a two-finger pinch', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/canvas');
+    $page->assertSee('Deploy canvas')->wait(0.5);
+
+    // Two touch pointers 100px apart move to 200px apart: the zoom doubles from 100% to the 200% maximum.
+    $zoom = $page->script(<<<'JS'
+        (async () => {
+            const viewport = document.querySelector('.cv-viewport');
+            const r = viewport.getBoundingClientRect();
+            const y = r.top + r.height / 2;
+            const cx = r.left + r.width / 2;
+            const fire = (type, id, x) => viewport.dispatchEvent(new PointerEvent(type, { pointerId: id, pointerType: 'touch', isPrimary: id === 1, clientX: x, clientY: y, button: 0, bubbles: true, cancelable: true }));
+            document.querySelector('button[title="Reset zoom to 100%"]').click();
+            fire('pointerdown', 1, cx - 50);
+            fire('pointerdown', 2, cx + 50);
+            fire('pointermove', 1, cx - 100);
+            fire('pointermove', 2, cx + 100);
+            fire('pointerup', 1, cx - 100);
+            fire('pointerup', 2, cx + 100);
+            // The label is reactive: wait for Svelte to write it.
+            await new Promise(resolve => requestAnimationFrame(resolve));
+            return document.querySelector('button[title="Reset zoom to 100%"]').textContent;
+        })()
+    JS);
+
+    expect($zoom)->toBe('200%');
+    $page->screenshot(filename: 'deploy-canvas-pinch');
+});
+
+it('starts with an empty canvas after a successful deploy', function (bool $deployed, int $expectedNodes) {
+    loginAndSkipBoarding();
+
+    $page = visit('/canvas');
+
+    $page->assertSee('Deploy canvas');
+
+    $flow = json_encode(['nodes' => [
+        ['id' => 'start', 'type' => 'start', 'x' => 80, 'y' => 160, 'data' => []],
+        ['id' => 'server', 'type' => 'server', 'x' => 456, 'y' => 160, 'data' => []],
+        ['id' => 'image-1', 'type' => 'image', 'x' => 832, 'y' => 160, 'data' => ['image' => 'nginx']],
+        ['id' => 'deploy', 'type' => 'deploy', 'x' => 1240, 'y' => 160, 'data' => []],
+    ], 'edges' => []]);
+    $page->script("localStorage.setItem('coolify-canvas:flow', JSON.stringify({$flow})); localStorage.setItem('coolify-canvas:deployed', '".json_encode($deployed)."');");
+
+    $page->navigate('/canvas')
+        ->assertSee('Deploy canvas');
+
+    expect($page->script("document.querySelectorAll('.cv-node').length"))->toBe($expectedNodes);
+    $page->screenshot(filename: 'deploy-canvas-after-deploy');
+})->with([
+    'after a deploy' => [true, 3],
+    'without a deploy' => [false, 4],
+]);
diff --git a/tests/v4/Browser/FileBrowserTest.php b/tests/v4/Browser/FileBrowserTest.php
new file mode 100644
index 0000000000..39c2d9add4
--- /dev/null
+++ b/tests/v4/Browser/FileBrowserTest.php
@@ -0,0 +1,62 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+    $this->postgres = createBrowserPostgresql($this->stack, [
+        'uuid' => 'db-browser-files',
+        'name' => 'Files Postgres',
+        'status' => 'exited',
+    ]);
+});
+
+it('shows the Files tab and a stopped state for a stopped container', function () {
+    loginAndSkipBoarding();
+
+    $url = databaseConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->postgres
+    ).'/files';
+
+    $page = visit($url);
+
+    $page->assertSee('Container is not running')
+        ->assertSee('Start the container to browse its files')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'file-browser-stopped');
+});
+
+it('opens a directory whose name contains an apostrophe', function () {
+    config(['constants.ssh.mux_enabled' => false]);
+    Storage::fake('ssh-keys');
+    $this->postgres->update(['status' => 'running']);
+    Process::fake(function ($process) {
+        $output = '';
+        if (str_contains($process->command, 'docker inspect')) {
+            $output = '/data';
+        } elseif (str_contains($process->command, 'stat -c') && ! str_contains($process->command, 'folder')) {
+            $output = "dir\t0\t1\t755\troot\troot\tit's a folder";
+        }
+
+        return Process::result(output: $output);
+    });
+    loginAndSkipBoarding();
+    $url = databaseConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->postgres
+    ).'/files';
+    visit($url)
+        ->assertSee("it's a folder")
+        ->click("it's a folder")
+        ->assertSee('This folder is empty')
+        ->assertSee("it's a folder")
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'file-browser-apostrophe');
+});
diff --git a/tests/v4/Browser/FleetMetricsTableSortTest.php b/tests/v4/Browser/FleetMetricsTableSortTest.php
new file mode 100644
index 0000000000..3d3c30bf3c
--- /dev/null
+++ b/tests/v4/Browser/FleetMetricsTableSortTest.php
@@ -0,0 +1,141 @@
+<?php
+
+use App\Models\Server;
+use App\Services\SentinelMetricsClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Concurrency;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+class FakeBrowserFleetMetricsClient extends SentinelMetricsClient
+{
+    public function summary(): ?array
+    {
+        $usage = [
+            'alpha' => ['cpu' => 10.0, 'memUsed' => 80],
+            // bravo runs an older Sentinel that does not send the load.
+            'bravo' => ['cpu' => 90.0, 'memUsed' => 20, 'load1' => null],
+        ][$this->server->name] ?? null;
+
+        // charlie does not answer.
+        if ($usage === null) {
+            return null;
+        }
+
+        return array_merge([
+            'online' => true, 'memTotal' => 100,
+            'diskUsed' => 10, 'diskTotal' => 100, 'diskPercent' => 10.0,
+            'load1' => 0.4, 'netRx' => 5.0, 'netTx' => 1.0,
+        ], $usage);
+    }
+
+    public function containersCurrent(): array
+    {
+        return match ($this->server->name) {
+            'alpha' => [['id' => 'zeta', 'cpu' => 70.0, 'memUsed' => 10, 'memPercent' => 1.0, 'diskBytes' => 1, 'net' => 0.0]],
+            'bravo' => [['id' => 'beta', 'cpu' => 5.0, 'memUsed' => 20, 'memPercent' => 2.0, 'diskBytes' => 2, 'net' => 0.0]],
+            default => [],
+        };
+    }
+
+    public function history(string $metric, string $range): array
+    {
+        return [];
+    }
+
+    public function networkHistory(string $range): array
+    {
+        return ['rx' => [], 'tx' => []];
+    }
+}
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack(['serverName' => 'alpha']);
+    Concurrency::setDefaultInstance('sync');
+    // The dashboard chart reads metrics over SSH for each server with metrics on.
+    Process::fake();
+
+    $servers = [$this->stack['server']];
+    foreach (['bravo', 'charlie'] as $name) {
+        $servers[] = Server::factory()->create([
+            'name' => $name, 'team_id' => 0, 'private_key_id' => $this->stack['privateKey']->id,
+        ]);
+    }
+    foreach ($servers as $server) {
+        // Saved quietly, so the settings hook does not start Sentinel.
+        $server->settings->forceFill(['is_metrics_enabled' => true, 'is_reachable' => true, 'is_usable' => true])->saveQuietly();
+    }
+
+    app()->bind(SentinelMetricsClient::class, fn ($app, array $parameters) => new FakeBrowserFleetMetricsClient($parameters['server']));
+});
+
+/** The visible row names of one metrics table, in DOM order (the order focus and screen readers follow). */
+function visibleFleetMetricsRowNames(mixed $page, string $section): array
+{
+    return $page->script(<<<JS
+        [...document.querySelectorAll('#{$section} [data-row]')]
+            .filter((row) => getComputedStyle(row).display !== 'none')
+            .map((row) => JSON.parse(row.dataset.row).name)
+    JS);
+}
+
+it('sorts the servers and containers tables when a column header is selected', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/metrics');
+
+    // Default: CPU, largest first. The offline server is last.
+    $page->assertSee('charlie');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['bravo', 'alpha', 'charlie']);
+
+    $page->click('#metrics-servers-section button[title="Sort by server"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['alpha', 'bravo', 'charlie']);
+
+    $page->click('#metrics-servers-section button[title="Sort by memory"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['alpha', 'bravo', 'charlie']);
+
+    // A second click reverses the direction. The offline server stays last.
+    $page->click('#metrics-servers-section button[title="Sort by memory"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['bravo', 'alpha', 'charlie']);
+
+    // A server without a value stays after the servers with one, in both directions.
+    $page->click('#metrics-servers-section button[title="Sort by load"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['alpha', 'bravo', 'charlie']);
+    $page->click('#metrics-servers-section button[title="Sort by load"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['alpha', 'bravo', 'charlie']);
+
+    $page->click('#metrics-servers-section button[title="Sort by memory"]');
+    $page->click('#metrics-servers-section button[title="Sort by memory"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['bravo', 'alpha', 'charlie']);
+
+    // A data refresh keeps the sort.
+    $page->click('button:visible:has-text("7 days")')
+        ->assertQueryStringHas('range', '7d');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['bravo', 'alpha', 'charlie']);
+
+    expect(visibleFleetMetricsRowNames($page, 'metrics-containers-section'))->toBe(['zeta', 'beta']);
+    // The notification banner at the bottom of the page covers this header, so a pointer click cannot reach it.
+    $page->script('document.querySelector(\'#metrics-containers-section button[title="Sort by container"]\').click()');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-containers-section'))->toBe(['beta', 'zeta']);
+
+    $page->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'fleet-metrics-tables-sorted');
+});
+
+it('enables metrics from the empty state', function () {
+    Queue::fake();
+    Server::query()->each(fn (Server $server) => $server->settings->forceFill(['is_metrics_enabled' => false])->saveQuietly());
+
+    loginAndSkipBoarding();
+
+    $page = visit('/metrics');
+
+    $page->assertSee('No server metrics yet')
+        ->click('button:visible:has-text("Enable metrics on 3 servers")')
+        ->assertSee('Hottest containers')
+        ->assertDontSee('No server metrics yet')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'fleet-metrics-enabled-from-empty-state');
+});
diff --git a/tests/v4/Browser/NewApplicationRepositoryPathsTest.php b/tests/v4/Browser/NewApplicationRepositoryPathsTest.php
new file mode 100644
index 0000000000..7571eb06a6
--- /dev/null
+++ b/tests/v4/Browser/NewApplicationRepositoryPathsTest.php
@@ -0,0 +1,55 @@
+<?php
+
+use App\Models\Application;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('restores the default compose file when the field is cleared', function () {
+    $stack = seedBrowserResourceStack();
+    loginAndSkipBoarding();
+
+    $page = visit("/project/{$stack['project']->uuid}/environment/{$stack['environment']->uuid}/new?type=public&destination={$stack['destination']->uuid}");
+
+    $page->fill('repository_url', 'https://gitlab.com/example/monorepo.git')
+        ->click('Check repository')
+        ->assertSee('Build configuration');
+
+    selectListboxOption($page, 'build_pack', 'Docker Compose');
+
+    $page->clear("input[placeholder='/docker-compose.yaml']")
+        ->keys("input[placeholder='/docker-compose.yaml']", 'Tab')
+        ->assertValue("input[placeholder='/docker-compose.yaml']", '/docker-compose.yaml')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'new-application-compose-file-cleared');
+});
+
+it('warns when the compose file repeats the base directory and creates the application with the suggested fix', function () {
+    $stack = seedBrowserResourceStack();
+    loginAndSkipBoarding();
+
+    $page = visit("/project/{$stack['project']->uuid}/environment/{$stack['environment']->uuid}/new?type=public&destination={$stack['destination']->uuid}");
+
+    $page->fill('repository_url', 'https://gitlab.com/example/monorepo.git')
+        ->click('Check repository')
+        ->assertSee('Build configuration');
+
+    selectListboxOption($page, 'build_pack', 'Docker Compose');
+
+    $page->fill("input[placeholder='/']", 'apps/api/')
+        ->fill("input[placeholder='/docker-compose.yaml']", 'apps/api/compose.yaml')
+        ->assertSee('Base directory is repeated')
+        ->assertSee('/apps/api/apps/api/compose.yaml')
+        ->screenshot(filename: 'new-application-compose-file-repeats-base-directory')
+        ->click('button:has-text("Use /compose.yaml")')
+        ->assertDontSee('Base directory is repeated')
+        ->assertSee('/apps/api/compose.yaml')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'new-application-compose-file-fixed');
+
+    submitLivewireForm($page);
+
+    $application = Application::query()->where('git_repository', 'https://gitlab.com/example/monorepo.git')->sole();
+    expect($application->base_directory)->toBe('/apps/api')
+        ->and($application->docker_compose_location)->toBe('/compose.yaml');
+});
diff --git a/tests/v4/Browser/ScheduledTaskDeleteTest.php b/tests/v4/Browser/ScheduledTaskDeleteTest.php
index 7b180f911f..062798b068 100644
--- a/tests/v4/Browser/ScheduledTaskDeleteTest.php
+++ b/tests/v4/Browser/ScheduledTaskDeleteTest.php
@@ -38,14 +38,15 @@ function recordScheduledTaskLivewireStatuses(mixed $page): void
     JS);
 }
 
-it('deletes a service scheduled task and returns to the task list', function () {
+it('deletes a service scheduled task from its modal and stays on the task list', function () {
     loginAndSkipBoarding();
 
-    $page = visit("{$this->base}/tasks/{$this->task->uuid}")
+    $page = visit("{$this->base}/scheduled-tasks?task_uuid={$this->task->uuid}")
         ->assertSee('Task configuration');
     recordScheduledTaskLivewireStatuses($page);
 
-    $page->click('button:visible:has-text("Delete")')
+    $page->click('button:visible:has-text("Danger Zone")')
+        ->click('button:visible:has-text("Delete task")')
         ->fill('input[x-model="userConfirmationText"]', 'nightly-cleanup')
         ->click('button:visible:has-text("Permanently delete")')
         ->wait(3);
@@ -54,17 +55,18 @@ it('deletes a service scheduled task and returns to the task list', function ()
         ->and($page->script('window.livewireStatuses'))->not->toContain(404);
 
     $page->assertPathIs(parse_url("{$this->base}/scheduled-tasks", PHP_URL_PATH))
+        ->assertDontSee('Task configuration')
         ->screenshot(filename: 'scheduled-task-deleted');
 });
 
 it('keeps polling executions without a 404 after the task is deleted', function () {
     loginAndSkipBoarding();
 
-    $page = visit("{$this->base}/tasks/{$this->task->uuid}")
-        ->assertSee('Recent executions');
+    $page = visit("{$this->base}/scheduled-tasks?task_uuid={$this->task->uuid}")
+        ->assertSee('Task configuration');
     recordScheduledTaskLivewireStatuses($page);
 
-    // The executions list polls every 5 seconds, so a poll can run after the delete and before the list page loads.
+    // The executions list polls every 5 seconds, so a poll can run after the delete and before the modal closes.
     $this->task->delete();
     $page->script(<<<'JS'
         Livewire.all().find((component) => component.name === 'project.shared.scheduled-task.executions')
diff --git a/tests/v4/Browser/ServiceConfigurationTest.php b/tests/v4/Browser/ServiceConfigurationTest.php
index f6c55b994c..158a123255 100644
--- a/tests/v4/Browser/ServiceConfigurationTest.php
+++ b/tests/v4/Browser/ServiceConfigurationTest.php
@@ -258,7 +258,7 @@ it('keeps domain settings out of the overview and supports editing and removal',
         ->screenshot(filename: 'service-domain-removal-confirmation')
         ->click('button:has([x-text="step2ButtonText"]):visible')
         ->assertDontSee('https://long-public-domain-for-the-service.example.com')
-        ->assertSee('1 domain across 1 service')
+        ->assertSee('https://second.example.com')
         ->click('[aria-label="Settings for https://second.example.com"]')
         ->assertSee('www redirect')
         ->assertValue('#editingDomainParts-host', 'second.example.com')
diff --git a/tests/v4/Browser/TerminalConsoleFocusTest.php b/tests/v4/Browser/TerminalConsoleFocusTest.php
new file mode 100644
index 0000000000..fd751ab130
--- /dev/null
+++ b/tests/v4/Browser/TerminalConsoleFocusTest.php
@@ -0,0 +1,83 @@
+<?php
+
+use App\Models\Server;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Symfony\Component\Process\Process as SymfonyProcess;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    config()->set('app.maintenance.store', 'array');
+    config()->set('constants.ssh.mux_enabled', false);
+    $this->terminalServer = null;
+});
+
+afterEach(function () {
+    $this->terminalServer?->stop(0);
+});
+
+it('keeps the active input focused through all PTY startup callbacks', function (bool $attach) {
+    $stack = seedBrowserResourceStack();
+    $stack['server']->settings->update(['is_terminal_enabled' => true]);
+    Cache::flush();
+
+    Process::fake(function ($process) use ($attach) {
+        $command = (string) $process->command;
+        if (str_contains($command, 'docker ps -a')) {
+            return Process::result(output: json_encode(['Names' => 'app-terminal-focus-1', 'State' => 'running', 'Labels' => '']));
+        }
+        if (str_contains($command, 'Config.OpenStdin')) {
+            return Process::result(output: $attach ? 'true' : 'false');
+        }
+        if (str_contains($command, 'docker inspect')) {
+            return Process::result(output: json_encode(['State' => ['Status' => 'running']]));
+        }
+
+        return Process::result();
+    });
+
+    $this->terminalServer = new SymfonyProcess(['node', base_path('tests/Fixtures/terminal-websocket-rejection-server.mjs'), 'ready']);
+    $this->terminalServer->start();
+    $this->terminalServer->waitUntil(fn (string $type, string $output) => str_contains($output, "\n"));
+    config()->set('constants.terminal.protocol', 'ws');
+    config()->set('constants.terminal.host', '127.0.0.1');
+    config()->set('constants.terminal.port', trim($this->terminalServer->getOutput()));
+
+    $page = visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertSee('Dashboard')
+        ->navigate('/terminal')
+        ->click('[data-terminal-target-picker="page"] button:has-text("app-terminal-focus-1")')
+        ->assertVisible('.xterm-viewport')
+        ->wait(0.75);
+
+    $selector = $attach ? '[x-ref="consoleInput"]' : '.xterm-helper-textarea';
+    expect($page->script("document.activeElement.matches('$selector')"))->toBeTrue();
+
+    // Exercise the same ready handler on reconnect. Blur after the 100 ms callback
+    // so only the 500 ms callback can restore focus, not the initial focus call.
+    $focusedInputs = $page->script(<<<'JS'
+        async () => {
+            const terminal = Alpine.$data(document.getElementById('terminal-container'));
+            const focusedInput = () => document.activeElement.matches('[x-ref="consoleInput"]') ? 'console' :
+                document.activeElement.matches('.xterm-helper-textarea') ? 'shell' : 'other';
+            terminal.handleSocketMessage({ data: 'pty-ready' });
+            const immediate = focusedInput();
+            await new Promise(resolve => setTimeout(resolve, 150));
+            const after100ms = focusedInput();
+            document.activeElement.blur();
+            await new Promise(resolve => setTimeout(resolve, 450));
+            return [immediate, after100ms, focusedInput()];
+        }
+        JS);
+
+    $expectedInput = $attach ? 'console' : 'shell';
+    expect($focusedInputs)->toBe([$expectedInput, $expectedInput, $expectedInput]);
+    $page->assertNoJavaScriptErrors()
+        ->screenshot(filename: $attach ? 'terminal-console-startup-focus' : 'terminal-shell-startup-focus');
+})->with(['console' => true, 'shell' => false]);
diff --git a/tests/v4/Browser/TrafficGeoCitiesTest.php b/tests/v4/Browser/TrafficGeoCitiesTest.php
new file mode 100644
index 0000000000..882c3e131f
--- /dev/null
+++ b/tests/v4/Browser/TrafficGeoCitiesTest.php
@@ -0,0 +1,67 @@
+<?php
+
+use App\Services\SentinelTrafficClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+class FakeBrowserCityTrafficClient extends SentinelTrafficClient
+{
+    protected function raw(string $url): string
+    {
+        $responses = [
+            '/traffic/apps' => [],
+            '/traffic/overview' => [
+                'requests' => 1000, 'bytes_in' => 5000, 'bytes_out' => 25000,
+                'status' => ['s2xx' => 900, 's3xx' => 50, 's4xx' => 40, 's5xx' => 10],
+                'latency' => ['p50' => 12.5, 'p95' => 45.2, 'p99' => 90.1],
+                'unique_visitors' => 320,
+            ],
+            '/traffic/breakdown/country' => [
+                ['value' => 'DE', 'requests' => 600, 'bytes_out' => 15000],
+                ['value' => 'FR', 'requests' => 400, 'bytes_out' => 10000],
+            ],
+            '/traffic/breakdown/city' => [
+                ['value' => 'DE|BE|Berlin', 'requests' => 450, 'bytes_out' => 11000, 'lat' => 52.52, 'lon' => 13.405],
+                ['value' => 'FR|IDF|Paris', 'requests' => 400, 'bytes_out' => 10000, 'lat' => 48.85, 'lon' => 2.35],
+                ['value' => 'DE||', 'requests' => 150, 'bytes_out' => 4000],
+            ],
+        ];
+
+        foreach ($responses as $needle => $response) {
+            if (str_contains($url, $needle)) {
+                return json_encode($response);
+            }
+        }
+
+        return '{}';
+    }
+}
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+
+    $server = $this->stack['server'];
+    $server->settings->is_traffic_analytics_enabled = true;
+    $server->settings->save();
+
+    app()->bind(SentinelTrafficClient::class, fn () => new FakeBrowserCityTrafficClient($server));
+});
+
+it('switches the Locations card between countries and cities and remembers the selection', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/analytics');
+
+    $page->assertSee('Locations')
+        ->assertSee('Germany')
+        ->assertDontSee('BE, Germany')
+        ->click('button:visible:has-text("Cities")')
+        ->assertSee('BE, Germany')
+        ->assertSee('IDF, France')
+        ->assertDontSee('United States')
+        ->refresh()
+        ->assertSee('BE, Germany')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'analytics-locations-cities');
+});
diff --git a/tests/v4/Browser/TrafficTableSortTest.php b/tests/v4/Browser/TrafficTableSortTest.php
new file mode 100644
index 0000000000..3236e45f9b
--- /dev/null
+++ b/tests/v4/Browser/TrafficTableSortTest.php
@@ -0,0 +1,104 @@
+<?php
+
+use App\Services\SentinelTrafficClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+class FakeBrowserSortTrafficClient extends SentinelTrafficClient
+{
+    protected function raw(string $url): string
+    {
+        // Twelve paths: /p01 has the fewest requests and /p12 the most, so the
+        // first page (10 rows) by requests hides /p01 and /p02.
+        $paths = [];
+        foreach (range(1, 12) as $i) {
+            $paths[] = [
+                'path' => sprintf('/p%02d', $i), 'app' => 'app-1', 'requests' => $i * 10, 'bytes_out' => 1000,
+                's4xx' => 0, 's5xx' => 0, 'p50' => 10, 'p95' => 30,
+            ];
+        }
+
+        $responses = [
+            '/traffic/apps' => [],
+            '/traffic/overview' => [
+                'requests' => 780, 'bytes_in' => 5000, 'bytes_out' => 12000,
+                'status' => ['s2xx' => 780, 's3xx' => 0, 's4xx' => 0, 's5xx' => 0],
+                'latency' => ['p50' => 12.5, 'p95' => 45.2, 'p99' => 90.1],
+                'unique_visitors' => 320,
+            ],
+            '/traffic/paths' => $paths,
+        ];
+
+        foreach ($responses as $needle => $response) {
+            if (str_contains($url, $needle)) {
+                return json_encode($response);
+            }
+        }
+
+        return '{}';
+    }
+}
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+
+    $server = $this->stack['server'];
+    $server->settings->is_traffic_analytics_enabled = true;
+    $server->settings->save();
+
+    app()->bind(SentinelTrafficClient::class, fn () => new FakeBrowserSortTrafficClient($server));
+});
+
+/**
+ * The first visible path rows in DOM order, which is the keyboard and
+ * screen-reader order. Returns null when the screen order is different.
+ */
+function visiblePathNames(mixed $page): ?array
+{
+    return $page->script(<<<'JS'
+        (() => {
+            const rows = [...document.querySelectorAll('#analytics-paths-section [data-row]')]
+                .filter((row) => getComputedStyle(row).display !== 'none');
+            const ys = rows.map((row) => row.getBoundingClientRect().y);
+            if (ys.some((y, i) => i > 0 && y <= ys[i - 1])) {
+                return null;
+            }
+
+            return rows.slice(0, 3).map((row) => JSON.parse(row.dataset.row).name.trim());
+        })()
+    JS);
+}
+
+it('sorts the top paths table when a column header is selected', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/analytics');
+
+    // Default: requests, largest first. The two smallest are on page 2.
+    $page->assertSee('/p12')
+        ->assertDontSee('/p01');
+    expect(visiblePathNames($page))->toBe(['/p12', '/p11', '/p10']);
+
+    // Path A to Z: the two last names are on page 2.
+    $page->click('#analytics-paths-section button[title="Sort by path"]')
+        ->assertSee('/p01')
+        ->assertDontSee('/p12');
+    expect(visiblePathNames($page))->toBe(['/p01', '/p02', '/p03']);
+
+    // A data refresh keeps the sort.
+    $page->click('button:visible:has-text("7 days")')
+        ->assertQueryStringHas('range', '7d')
+        ->assertSee('/p01');
+    expect(visiblePathNames($page))->toBe(['/p01', '/p02', '/p03']);
+
+    // A second click reverses the direction, and the pager follows the sort.
+    $page->click('#analytics-paths-section button[title="Sort by path"]')
+        ->assertSee('/p12')
+        ->assertDontSee('/p01')
+        ->click('#analytics-paths-section button:has-text("Next")')
+        ->assertSee('/p01')
+        ->assertDontSee('/p12')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'analytics-paths-sorted');
+});
diff --git a/tests/v4/Browser/TransferFinishChecklistTest.php b/tests/v4/Browser/TransferFinishChecklistTest.php
new file mode 100644
index 0000000000..2994c7b781
--- /dev/null
+++ b/tests/v4/Browser/TransferFinishChecklistTest.php
@@ -0,0 +1,50 @@
+<?php
+
+use App\Models\Server;
+use App\Models\Team;
+use App\Services\ServerTransfer\TransferFinishChecklist;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    $this->stack = seedBrowserResourceStack();
+    $this->server = Server::create(['name' => 'transferred-web', 'ip' => '10.0.0.5', 'team_id' => 0, 'private_key_id' => 1]);
+    $this->server->forceFill(['uuid' => 'transferred-1'])->save();
+    createBrowserApplication([...$this->stack, 'destination' => $this->server->standaloneDockers()->first()], [
+        'name' => 'shop',
+        'build_pack' => 'nixpacks',
+        'git_repository' => 'https://github.com/acme/shop',
+    ]);
+    app(TransferFinishChecklist::class)->start($this->server);
+    app(TransferFinishChecklist::class)->markDone($this->server, 'server_connection:server');
+});
+
+it('shows the finish list on the server page and finishes it after a confirmation', function () {
+    Team::query()->update(['show_boarding' => false]);
+    Cache::flush();
+    $page = visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertSee('Dashboard');
+
+    $page->navigate('/server/transferred-1')
+        ->assertSee('Finish the transfer')
+        ->assertSee('Manual webhook of shop')
+        ->assertSee('1 step is OK or done')
+        ->screenshot(filename: 'transfer-finish-list');
+
+    $page->click('li:has-text("Manual webhook of shop") button:has-text("Details")')
+        ->wait(0.5)
+        ->assertSee('/webhooks/source/github/events/manual')
+        ->screenshot(filename: 'transfer-finish-details');
+
+    $page->click('button:visible:has-text("Finish with open steps")')
+        ->wait(1)
+        ->assertSee('Finish with open steps?')
+        ->assertSee('Skipped: Manual webhook of shop')
+        ->screenshot(filename: 'transfer-finish-confirm');
+});
diff --git a/versions.json b/versions.json
index c8ee5c91c9..50f381b7b6 100644
--- a/versions.json
+++ b/versions.json
@@ -1,20 +1,20 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.4.6"
+            "version": "4.5.0"
         },
         "nightly": {
-            "version": "4.5-rc.1"
+            "version": "4.6-rc.1"
         },
         "helper": {
-            "version": "1.0.17"
+            "version": "1.0.18"
         },
         "sentinel": {
-            "version": "1.0.2"
+            "version": "1.1.2"
         },
         "sentinel-host": {
-            "version": "1.0.2",
-            "digest": "sha256:ef4a41f2dfaf20c91c165244508bda12f9b66eb046fd8ae8b575158ccd61262e"
+            "version": "1.1.1",
+            "digest": "sha256:b8b686616eb09fc014c616eeb6ff6c2c96fd62429d2fafa06706695fdbe72f1b"
         }
     },
     "traefik": {
diff --git a/vet.json b/vet.json
new file mode 100644
index 0000000000..a6e2e321e4
--- /dev/null
+++ b/vet.json
@@ -0,0 +1,991 @@
+{
+    "require": {
+        "aws/aws-crt-php": {
+            "version": "v1.2.7",
+            "hash": "tree-v2:be22a57eb742622a1ffba6ca86d121622eb74e75f927a8494532d5d4803badce"
+        },
+        "aws/aws-sdk-php": {
+            "version": "3.398.4",
+            "hash": "tree-v2:6c1c6ac6e6c2d9508b01e8ca3953322575e866aa3e1487a7aa315e7dfb4ba2b8"
+        },
+        "bacon/bacon-qr-code": {
+            "version": "v3.1.1",
+            "hash": "tree-v2:12897f0a1a47ba843a8c4dfa9cd986bc3d7455929b42b7005d030fdd778dc72a"
+        },
+        "brick/math": {
+            "version": "0.14.8",
+            "hash": "tree-v2:79827d9b803e1ecdc82b596e792180dd785719f5d865f59a42aabbe61d85d4fb"
+        },
+        "carbonphp/carbon-doctrine-types": {
+            "version": "3.2.1",
+            "hash": "tree-v2:0f158f3b909fc01e691ed5f5121186056232b049031e7d3a914676d49881ece5"
+        },
+        "clue/redis-protocol": {
+            "version": "v0.3.2",
+            "hash": "tree-v2:8e03c9d35ac2bf5be5ceab4f331d9c122d99273da4f7c428d1c02ceb897ab68a"
+        },
+        "clue/redis-react": {
+            "version": "v2.8.0",
+            "hash": "tree-v2:919b5f4e495641eb54043ec944915a2a83b269412e2acc85a18eadacc96ee1b8"
+        },
+        "danharrin/livewire-rate-limiting": {
+            "version": "v2.3.0",
+            "hash": "tree-v2:493b9709f201171bdf9fdee2e33e3526e11a0600bd81c0ad08afa19c23703f21"
+        },
+        "dasprid/enum": {
+            "version": "1.0.7",
+            "hash": "tree-v2:82016cbedde18f90fb0d3314cfcce52943053eca20269166154b6bc2d79e7940"
+        },
+        "dflydev/dot-access-data": {
+            "version": "v3.0.3",
+            "hash": "tree-v2:05d15a85340adeabba2a95b5280336f0df3a544fcd89be9b2053e410212960b5"
+        },
+        "doctrine/dbal": {
+            "version": "4.5.0",
+            "hash": "tree-v2:20df4d8e38810d489e6b77be95cdba556096476d0cf9afc00c74641b2ebca8ab"
+        },
+        "doctrine/deprecations": {
+            "version": "1.1.6",
+            "hash": "tree-v2:8abdb22c79e82b9ea4884ab18dbaa595bb5315736231fa9e310b9d70a3ab0815"
+        },
+        "doctrine/inflector": {
+            "version": "2.1.0",
+            "hash": "tree-v2:220a8be0ed1b4c0fe4cb53530cec8bcbad2db49962deef2f9f5de47327d7855e"
+        },
+        "doctrine/lexer": {
+            "version": "3.0.2",
+            "hash": "tree-v2:7dabe75f6855468becf3d5a9c0ed9fdbf96f66af9776261cd2fdbeb4079f93e2"
+        },
+        "dragonmantank/cron-expression": {
+            "version": "v3.6.0",
+            "hash": "tree-v2:de03874981dc12b8d6108e201130ed10c174926aad4e4fc0cf4362a1e6f83cb7"
+        },
+        "egulias/email-validator": {
+            "version": "4.0.4",
+            "hash": "tree-v2:7621e009898aea85dfa2ad91d25a3441db9ef5bf90a1b55e9b8396b3a43830f9"
+        },
+        "evenement/evenement": {
+            "version": "v3.0.2",
+            "hash": "tree-v2:5bf08ea1a28ca2559ae1b79a9e99cb3bfd5c33cf13a4b8ce7cc943461473e4e3"
+        },
+        "ezyang/htmlpurifier": {
+            "version": "v4.19.1",
+            "hash": "tree-v2:fa90f54e49e566edcd7862886eb05a7712fda460a08937961defd674a4349a79"
+        },
+        "firebase/php-jwt": {
+            "version": "v7.2.1",
+            "hash": "tree-v2:270603953b72218f417df9fa995b4d833b712b3a2a0d19d1d83f6e5c5ffa7875"
+        },
+        "fruitcake/php-cors": {
+            "version": "v1.4.0",
+            "hash": "tree-v2:843a0fd0c0519e1e8e46ce45b613feb881065e0a5687b359660900b7be3d0094"
+        },
+        "graham-campbell/result-type": {
+            "version": "v1.2.0",
+            "hash": "tree-v2:19182f95f7c4750192e6cfe25b1f769686638fc59e5517710472b9f2b68315e7"
+        },
+        "guzzlehttp/guzzle": {
+            "version": "7.15.5",
+            "hash": "tree-v2:52f341c0bf614afe1fbd26362999adb2a746dd90cc5fc1f7a610f923b1b670a0"
+        },
+        "guzzlehttp/promises": {
+            "version": "2.5.3",
+            "hash": "tree-v2:fd057dc4b4c991c686151e9e6cb938c9c429c389becaa8d0607a4ce15a804f10"
+        },
+        "guzzlehttp/psr7": {
+            "version": "2.13.1",
+            "hash": "tree-v2:7607132af9efdbe31c5a6d8b92d4cac549bb4e4141caec6b0d917e813c201a19"
+        },
+        "guzzlehttp/uri-template": {
+            "version": "v1.0.11",
+            "hash": "tree-v2:8621308a489e67328265553e68e5bb49c7e887ecb33627e108bf21f59d56d445"
+        },
+        "jean85/pretty-package-versions": {
+            "version": "2.1.1",
+            "hash": "tree-v2:5cc304e8a530449d8c745eaec902384554d1740d4e083032d5f9ce3ac1cf25e3"
+        },
+        "laravel/fortify": {
+            "version": "v1.40.0",
+            "hash": "tree-v2:be1c2def5d70383bc18e9893861ecb3f4c0418961dc381549b583a187e6b8d33"
+        },
+        "laravel/framework": {
+            "version": "v12.69.3",
+            "hash": "tree-v2:406d3fd2a8e434af41c60567dc3e57830cac780dab9753e854c4ccdaab71f3a7"
+        },
+        "laravel/horizon": {
+            "version": "v5.50.0",
+            "hash": "tree-v2:524ba1806df3f59f4daafd5db7e6c7a3767a1297396303b14dc11f129f73c4eb"
+        },
+        "laravel/mcp": {
+            "version": "v1.0.1",
+            "hash": "tree-v2:9c474c4e3f7a9e35fd7d2ec2ffb24e02ac5d185328243fda4ff9cba7903dac70"
+        },
+        "laravel/pail": {
+            "version": "v1.2.7",
+            "hash": "tree-v2:6ffc8a88f56b9b5082de7e1d3c620a64fa6224f3d2ccd94c23b7b73ec903929b"
+        },
+        "laravel/passkeys": {
+            "version": "v0.2.1",
+            "hash": "tree-v2:788db1215e7e8c6cb282ee115d4b7570a7f30eb763a53b40417df4b7c5a4981c"
+        },
+        "laravel/prompts": {
+            "version": "v0.3.24",
+            "hash": "tree-v2:af7fccf97985aef4aad89febec94cee2dce8d76a74b961c1d03a680df881ef6e"
+        },
+        "laravel/reverb": {
+            "version": "v1.12.0",
+            "hash": "tree-v2:ccc8b90a2d1039edd725f432f001e6001a87796858f127609d1686d06921816f"
+        },
+        "laravel/sanctum": {
+            "version": "v4.3.3",
+            "hash": "tree-v2:63830d35780274f01c5f4999126781fb3de75408055c7ec4aac8bdf2d432c314"
+        },
+        "laravel/sentinel": {
+            "version": "v1.1.0",
+            "hash": "tree-v2:2893786cf018af94219a831c0e4056110487dd448a8dd32f80c936760a180115"
+        },
+        "laravel/serializable-closure": {
+            "version": "v2.1.0",
+            "hash": "tree-v2:46e235154eb6a796d4dc4365dc4c2fd1bc4abb91f2235b7741061116a06e0637"
+        },
+        "laravel/socialite": {
+            "version": "v5.30.0",
+            "hash": "tree-v2:935f438d7fd622b867b4752ae68b906f120cd770c126d4c2f6dbfc49eaec4dbb"
+        },
+        "laravel/tinker": {
+            "version": "v3.0.2",
+            "hash": "tree-v2:07c01215fec4bef8c1a223bba86119b769ab70dd45d7013834d3dfcdf8046fea"
+        },
+        "laravel/ui": {
+            "version": "v4.6.3",
+            "hash": "tree-v2:cdc10049a3e3b3eefa2a8f8da8afa60c1052b33d96338c7c802481aea0d3896c"
+        },
+        "lcobucci/jwt": {
+            "version": "5.6.0",
+            "hash": "tree-v2:7374370ed18d7728465afcdcdbede894a4916ff0aea1fac63d2ae85859f74d66"
+        },
+        "league/commonmark": {
+            "version": "2.10.3",
+            "hash": "tree-v2:ee619e9faf2cbab26a72cb89c809211c91e772fecf8c1a3cbc5e98f8a1233db2"
+        },
+        "league/config": {
+            "version": "v1.2.0",
+            "hash": "tree-v2:b454eb2bd1b250346c7d0af0e5b3caaeafa1b21468bca4ff4601a6a7bd91baae"
+        },
+        "league/flysystem": {
+            "version": "3.36.0",
+            "hash": "tree-v2:420e48fea76c143b41f4a8c1516031dc09ebb7e6367321af317e0a48fa998320"
+        },
+        "league/flysystem-aws-s3-v3": {
+            "version": "3.35.3",
+            "hash": "tree-v2:b444006b5245a442e5623e546c1d49d3150330574d27da41ea2da01230df0938"
+        },
+        "league/flysystem-local": {
+            "version": "3.35.3",
+            "hash": "tree-v2:7dba7c9670489313d3604b6a2801a152cf455b5e0d428bf721efda7ea37a5000"
+        },
+        "league/flysystem-sftp-v3": {
+            "version": "3.36.0",
+            "hash": "tree-v2:a5da24792e8191c3e234b897466197a20b8f6d657ae1651b68592aaa743efdc4"
+        },
+        "league/mime-type-detection": {
+            "version": "1.17.0",
+            "hash": "tree-v2:1726a64b700472e12c6e5917132914a632350a91b90816cc3c5940ddea1f92d7"
+        },
+        "league/oauth1-client": {
+            "version": "v1.12.0",
+            "hash": "tree-v2:96e3c6b7cca4d1cc2b14391f0d38bd631afbd44aecd549be6426fe78214c01a2"
+        },
+        "league/uri": {
+            "version": "7.8.1",
+            "hash": "tree-v2:4397d51a8c4e6080a42f161000bf9db6e73840654aff3cc445f27b405c36ab5c"
+        },
+        "league/uri-interfaces": {
+            "version": "7.8.1",
+            "hash": "tree-v2:227c217ed67b9cd48cc589867bf18379e95858e068724b8fbef94713311b024e"
+        },
+        "livewire/livewire": {
+            "version": "v3.8.10",
+            "hash": "tree-v2:53b5f60c4ed2d495c3a2fcb2b2390f87c7d26d5e54648b3f10efe4010d720924"
+        },
+        "log1x/laravel-webfonts": {
+            "version": "v2.0.1",
+            "hash": "tree-v2:c192111c594d02411d0fbf9dab0837775b56a044c85dd30351d20a9779929872"
+        },
+        "lorisleiva/laravel-actions": {
+            "version": "v2.12.0",
+            "hash": "tree-v2:88028833bc2531aa43a58f4af7f79fd6cc6c25d9f813732ff9b73e4df31d0a13"
+        },
+        "lorisleiva/lody": {
+            "version": "v0.7.1",
+            "hash": "tree-v2:e02bb6ff9f6b29fb36c4e9a8daf8b3fe788ed55cdd2b616d88214976b18521c7"
+        },
+        "monolog/monolog": {
+            "version": "3.12.1",
+            "hash": "tree-v2:bb7a293a3ba00d6ca00220a74a07a194fa22bdde721ae8533e8773c7c3589cc4"
+        },
+        "mtdowling/jmespath.php": {
+            "version": "2.9.2",
+            "hash": "tree-v2:c87e5d6482253928932f38ada2184333cccc8be28081642f4f1b41dc66734822"
+        },
+        "nesbot/carbon": {
+            "version": "3.14.1",
+            "hash": "tree-v2:a5a16a60481dc65e8852ac76a275ab81dcb42947cf82c48aac3b36f85a584a86"
+        },
+        "nette/schema": {
+            "version": "v1.3.6",
+            "hash": "tree-v2:502542dfdcfa7c69b22954a883a7605ef7c0d399a15df5fa09aaf695d437b358"
+        },
+        "nette/utils": {
+            "version": "v4.1.5",
+            "hash": "tree-v2:98a3f1d758153bf83c6da5b98625cb4b1ad1105369e07cb24ea29f60eff0ab63"
+        },
+        "nikic/php-parser": {
+            "version": "v5.9.0",
+            "hash": "tree-v2:bcacf1331427ef1203828abd4716eae2d19aa68027126caa55860acf46057cf7"
+        },
+        "nubs/random-name-generator": {
+            "version": "v2.2.0",
+            "hash": "tree-v2:a743094ff0ff78ddb63ec8664039da2cf81e089dc5f6c16b17520811e2e9cb84"
+        },
+        "nunomaduro/termwind": {
+            "version": "v2.4.0",
+            "hash": "tree-v2:19bb7af2b1ec2c1a8187fca9af3615fe7ba53c12948053951f9175a1a03a0e48"
+        },
+        "nyholm/psr7": {
+            "version": "1.8.2",
+            "hash": "tree-v2:13ffe5426fb64cceca6901fa1055a0688ec899fa490c81c1a63132b2d25d7ce4"
+        },
+        "paragonie/constant_time_encoding": {
+            "version": "v3.1.3",
+            "hash": "tree-v2:49dd6b293347e87932021f7c295f914e69623eafd76080a2799b14139a1a51e8"
+        },
+        "paragonie/random_compat": {
+            "version": "v9.99.100",
+            "hash": "tree-v2:3f247d4e9da196031d5ee2754558e7dc17e8d63d7506320fa384d0432c5450d1"
+        },
+        "phpdocumentor/reflection-common": {
+            "version": "2.2.1",
+            "hash": "tree-v2:b5e96fe132bff07f74d641a9d92eed23f59de9bf11828c15afe4b0a79efede7f"
+        },
+        "phpdocumentor/reflection-docblock": {
+            "version": "6.0.3",
+            "hash": "tree-v2:d4455a70c012b399cab192e5b46fc8609741b8c54d1d8d2ca241b51011f602e1"
+        },
+        "phpdocumentor/type-resolver": {
+            "version": "2.1.0",
+            "hash": "tree-v2:b38f8e64f9e625074fc0b7f271a4f4d8100e7e0771c54ae2fae397fe68a45ea0"
+        },
+        "phpoption/phpoption": {
+            "version": "1.10.0",
+            "hash": "tree-v2:88bf58174c3d5e79cc8ba99f6a072fc4c26e4aea72ad093b5d5a43d3d46ccea4"
+        },
+        "phpseclib/phpseclib": {
+            "version": "3.0.57",
+            "hash": "tree-v2:55fd680d70046da18276ca8b09dd3f45507a955c8963f01b2b65e1d576241790"
+        },
+        "phpstan/phpdoc-parser": {
+            "version": "2.3.6",
+            "hash": "tree-v2:871a2c3e3fce5505337233418c37cdac1515c9824110bf602cbb8216b4fab7cb"
+        },
+        "pion/laravel-chunk-upload": {
+            "version": "v1.6.3",
+            "hash": "tree-v2:d443106f44dc4dc50a46446d4f18b2bbb95fc771e2e28f637e0a41ae53ac61cb"
+        },
+        "poliander/cron": {
+            "version": "3.3.1",
+            "hash": "tree-v2:828c1437d249186e1dc7c8070b14b520c78460ede432120f647ce63187f89c02"
+        },
+        "pragmarx/google2fa": {
+            "version": "v9.1.0",
+            "hash": "tree-v2:c4e6d87c5e09946a20bedb4a4c1b68f39385d1cef45b17bd9bec517e39479d2b"
+        },
+        "psr/cache": {
+            "version": "3.0.0",
+            "hash": "tree-v2:ac46f271c3134fa0193f61ed54dab6b7cf822030f0b249f8c54f51a1803c867d"
+        },
+        "psr/clock": {
+            "version": "1.0.0",
+            "hash": "tree-v2:2a7e0fd2ce370b76b21dafdf64121892c972ca91f4bed220b3505db4ec870674"
+        },
+        "psr/container": {
+            "version": "2.0.2",
+            "hash": "tree-v2:e5aaa33e7ad4cc518518e652f7435918c83ef034fa359b53731e10501eb6d682"
+        },
+        "psr/event-dispatcher": {
+            "version": "1.0.0",
+            "hash": "tree-v2:091c7ba644dd4b46f4ca5a1e99e696b646f8a2a87821a8ca36e3328aba6fa182"
+        },
+        "psr/http-client": {
+            "version": "1.0.3",
+            "hash": "tree-v2:50063ed6dde84d09a63437f58a953b8aa0fdd3fcab44d5d8688a89fc48130f07"
+        },
+        "psr/http-factory": {
+            "version": "1.1.0",
+            "hash": "tree-v2:dde23cb9ba5cc39c10acd8ade52be90b01927cc77ba64e3a7db3abe7c98f40ec"
+        },
+        "psr/http-message": {
+            "version": "2.0",
+            "hash": "tree-v2:a9575ef4779a21eb0d3f04a1e2f0f008e67785cc86d750046a13455f9266ff41"
+        },
+        "psr/log": {
+            "version": "3.0.2",
+            "hash": "tree-v2:0f88d9371ba05c1791394f2e0a56979e1e17258f9bea9519ffc51f11c85b7844"
+        },
+        "psr/simple-cache": {
+            "version": "3.0.0",
+            "hash": "tree-v2:1854aa6d2cd53968d44c1fddcde547872925142ee6a5dea8d183b3a9e9551b7c"
+        },
+        "psy/psysh": {
+            "version": "v0.12.24",
+            "hash": "tree-v2:c518e85e74d1aef81854220186172a87c7e1553652d35eff97655015389e5404"
+        },
+        "purplepixie/phpdns": {
+            "version": "2.4.0",
+            "hash": "tree-v2:1c1ebac6d50b61cd01452f9c6cad774c2b641601925c67f33f6329b5d9cfa5c2"
+        },
+        "pusher/pusher-php-server": {
+            "version": "7.3.0",
+            "hash": "tree-v2:c7713b62c33d0f6504f5226e33be144a1255125ec013abfe5ee06fa619c4a340"
+        },
+        "radebatz/type-info-extras": {
+            "version": "1.0.9",
+            "hash": "tree-v2:8922f01f69a848e5332fe1e16033223e9afd552039df344b851fd2e2644488ca"
+        },
+        "ralouphie/getallheaders": {
+            "version": "3.0.3",
+            "hash": "tree-v2:db666a4e690725b904b5de22a95b230e08ba09f45559a03b32ffb933b0abb75f"
+        },
+        "ramsey/collection": {
+            "version": "2.1.1",
+            "hash": "tree-v2:ad16df2a5b3611348dc88ba0a921d27b7e074406ff667ca547c6a3579734972c"
+        },
+        "ramsey/uuid": {
+            "version": "4.9.4",
+            "hash": "tree-v2:68d8f0c8847e8275812a7af6335ada47d71f8534bb96c5b54ea18141e4739d77"
+        },
+        "ratchet/rfc6455": {
+            "version": "v0.4.1",
+            "hash": "tree-v2:f8ab0e11b00c48fdfa9849073c663a21708c640f4f6a054fdf330c0e66b7c32c"
+        },
+        "react/cache": {
+            "version": "v1.2.0",
+            "hash": "tree-v2:303d5bc29045a7370e96e9760540265fe0df3639cfb03a0914a09e3b71d85cea"
+        },
+        "react/dns": {
+            "version": "v1.14.0",
+            "hash": "tree-v2:59869424ef3faf16394bfd6957d3d42cdff87f7234ef1190b4028c56dfc8dc89"
+        },
+        "react/event-loop": {
+            "version": "v1.6.0",
+            "hash": "tree-v2:0b4ee3a9e74158fc9a291bc3e44f74ded61bd2ecf5752f53b04936bb86890e96"
+        },
+        "react/promise": {
+            "version": "v3.3.0",
+            "hash": "tree-v2:dea9b667d543e827b3640262c29c5c2348ee7535045fbb5ea9fd05b65526e8c4"
+        },
+        "react/promise-timer": {
+            "version": "v1.11.0",
+            "hash": "tree-v2:40aacf5a4884e1c2a1c8f51e5db11daaea6486b8c92439eeaedaf8d54589b1bf"
+        },
+        "react/socket": {
+            "version": "v1.17.0",
+            "hash": "tree-v2:4809bfe68cb0b7634391369c426e336355c696862bce27bf3314411293d7a493"
+        },
+        "react/stream": {
+            "version": "v1.4.0",
+            "hash": "tree-v2:24cd9a269d6eef586865cd4525abfa3068f55e7c634a0d938071300df371fbb1"
+        },
+        "resend/resend-laravel": {
+            "version": "v1.6.0",
+            "hash": "tree-v2:f5537049aaf9df6fac8e71c360f36367e7adabd64440681cc1005fcb5bc06c8a"
+        },
+        "resend/resend-php": {
+            "version": "v1.16.0",
+            "hash": "tree-v2:41aee3a1e56f0c323e4c11b2204958d7e24716a4f6ba33a82a279fabdadbc698"
+        },
+        "sentry/sentry": {
+            "version": "4.32.0",
+            "hash": "tree-v2:5a245d8c147faace301993c10f5f8df7e4b48d5c140fff3a1ca6dc91c763dffa"
+        },
+        "sentry/sentry-laravel": {
+            "version": "4.28.0",
+            "hash": "tree-v2:01d427cba075614542d54618e2e2d226ca72033e124c2168f80264cbb03b7461"
+        },
+        "socialiteproviders/authentik": {
+            "version": "5.3.0",
+            "hash": "tree-v2:b87546ceea927533581ec65ffa7f49bbc8eba19f53d3e86d276b0e266b447818"
+        },
+        "socialiteproviders/clerk": {
+            "version": "5.1.0",
+            "hash": "tree-v2:dbbdb491ea001863c8aeab896e105552c4aef5635299cc59078bcd334f8c1264"
+        },
+        "socialiteproviders/discord": {
+            "version": "4.2.0",
+            "hash": "tree-v2:b9643f1b280a1e4c705d6a0a60b450d241f83f6c07a958b79cc05ae5f2a8586e"
+        },
+        "socialiteproviders/google": {
+            "version": "4.1.0",
+            "hash": "tree-v2:4f1286cbb3220ba557ed26e44f7341b6993cc9eb8afe3d1122be309f4a7200f4"
+        },
+        "socialiteproviders/infomaniak": {
+            "version": "4.0.0",
+            "hash": "tree-v2:646fdffaaa711fb0698a2ec1647056f8c9cc23a9d4e170ea6ab62d44044993ca"
+        },
+        "socialiteproviders/manager": {
+            "version": "4.10.0",
+            "hash": "tree-v2:af08ad057ab7afee0aa8cd58b5433227e49f5eb9dce326f663eb5915ece3e8e7"
+        },
+        "socialiteproviders/microsoft-azure": {
+            "version": "5.2.1",
+            "hash": "tree-v2:cf389d095c3ed53db7e1b49192dff77af0fb63777d82bc87417f61cc27de3ed7"
+        },
+        "socialiteproviders/zitadel": {
+            "version": "4.2.0",
+            "hash": "tree-v2:00f5f3c0138d49e42364152d590e5dc74a0284ce3bb55a954efd87c5bc72989e"
+        },
+        "spatie/commonmark-shiki-highlighter": {
+            "version": "2.5.2",
+            "hash": "tree-v2:da985acdbdd912496897c3edd71e2f2547fd896059164dd5a36b628e3241fad5"
+        },
+        "spatie/laravel-activitylog": {
+            "version": "4.12.3",
+            "hash": "tree-v2:471e238146b28116bfb231b2a2cacc1dc9a0228a08e0076b8a74da389cc175e9"
+        },
+        "spatie/laravel-data": {
+            "version": "4.23.0",
+            "hash": "tree-v2:6391465cf6c5a21d901a30b4df29c3039e5e0accb6b41a0c3c71bb4f2b3deb67"
+        },
+        "spatie/laravel-markdown": {
+            "version": "2.8.0",
+            "hash": "tree-v2:35ba0757f6a53e91cdbb12000f797cca394fb4d0694d84e274c65cc94ecc6170"
+        },
+        "spatie/laravel-package-tools": {
+            "version": "1.93.3",
+            "hash": "tree-v2:4ae3f9910639e24ebdb2ee3220edcf93e27a380890e8c8442e361d113951e575"
+        },
+        "spatie/laravel-schemaless-attributes": {
+            "version": "2.6.0",
+            "hash": "tree-v2:aceb5a7bfb0f178a24b4cb744bef3d9d467400b05687ed53c8bbb5aba7137168"
+        },
+        "spatie/macroable": {
+            "version": "2.1.0",
+            "hash": "tree-v2:344a2e65018d7b2fe15a2e2a6fed2bebbcf859094233dca388c40df8261104d4"
+        },
+        "spatie/php-structure-discoverer": {
+            "version": "2.4.4",
+            "hash": "tree-v2:1aa3de6b429a12a5a58af48f8e9721d349df02ace12561b8430ca769f866b468"
+        },
+        "spatie/shiki-php": {
+            "version": "2.4.0",
+            "hash": "tree-v2:5f980c9f51efcf49a892464c70a40b2256cad3da2299ddb6f7f1ae6f51bb1bea"
+        },
+        "spatie/url": {
+            "version": "2.4.0",
+            "hash": "tree-v2:ccfbd1e8a695b968ba0e8b70663c8313ee60235ec562c27e51d1e7ec20ca5881"
+        },
+        "spomky-labs/cbor-php": {
+            "version": "3.4.2",
+            "hash": "tree-v2:5017024176dcdeeec0e9224abdc211bdad50da7d66d71fd4a7b5f4412b523290"
+        },
+        "spomky-labs/pki-framework": {
+            "version": "1.6.3",
+            "hash": "tree-v2:8878022c5dc6d32ad0c56bb2806806d5ff1602ae9a10f5bbccd8027283ae8943"
+        },
+        "stevebauman/purify": {
+            "version": "v6.3.2",
+            "hash": "tree-v2:c1a25d80b65af346fede09a960d4f643bc21cad4ec0bef81dc6741807d3d268c"
+        },
+        "stripe/stripe-php": {
+            "version": "v16.6.0",
+            "hash": "tree-v2:aa959d41f9c5b2142865352c3180308abb91a79c051c11b2a63f05d5255aa34d"
+        },
+        "symfony/clock": {
+            "version": "v8.1.0",
+            "hash": "tree-v2:7888f31d60c29c4f777204510e9a60a557c98a4e480efe5d9eb13dd617bf21f1"
+        },
+        "symfony/console": {
+            "version": "v7.4.20",
+            "hash": "tree-v2:1473afc4cb70ccac83b3bb8b6683438c5901a5d3fcd8c3b2c2c84da3a2f5b499"
+        },
+        "symfony/css-selector": {
+            "version": "v8.1.6",
+            "hash": "tree-v2:d8c1eda011461f48443b0fcb1d607979dea4d8f0c1e9e85cee5e9d2f27613cc8"
+        },
+        "symfony/deprecation-contracts": {
+            "version": "v3.7.1",
+            "hash": "tree-v2:5833e98c5092cd02ed429ffd459b82b158f20393ef0b0ec2e06b2833d7efe838"
+        },
+        "symfony/error-handler": {
+            "version": "v7.4.20",
+            "hash": "tree-v2:cee97a6ff75008c349ab2b93bf74a109bde62c4d769e6b616bf2c2235956807d"
+        },
+        "symfony/event-dispatcher": {
+            "version": "v8.1.5",
+            "hash": "tree-v2:44ed3dd86aee506338f18bd5293ebfd1e23ead8659903a8bc020cd1a263dba0a"
+        },
+        "symfony/event-dispatcher-contracts": {
+            "version": "v3.7.1",
+            "hash": "tree-v2:0ac7e6b0bd6da93975ac9b3ec9f41aa596e9c1c6217813797d1e8bb64be89139"
+        },
+        "symfony/filesystem": {
+            "version": "v8.1.6",
+            "hash": "tree-v2:0988ddfa5dbfd1d49f57b456feac3132e9ad72c09a8e994b3edcdbb3d8a48a4f"
+        },
+        "symfony/finder": {
+            "version": "v7.4.20",
+            "hash": "tree-v2:c0cb8d8344fdae5029d26bdf249f140beb07180652173fd91b992585c8380753"
+        },
+        "symfony/http-foundation": {
+            "version": "v7.4.20",
+            "hash": "tree-v2:6f0ed46431710070db850c88d9218344a14db9b33262bab8cd7a89c1b68696d6"
+        },
+        "symfony/http-kernel": {
+            "version": "v7.4.20",
+            "hash": "tree-v2:c304a88316c6d8ec8255aa9471c47973bcac5b28b042521e1bf2aec5ae0bb670"
+        },
+        "symfony/mailer": {
+            "version": "v7.4.19",
+            "hash": "tree-v2:a5b4eeb63c3601d56b876f7c331a2f5c8282fe5ad0cfcaca72af7db25ad823e5"
+        },
+        "symfony/mime": {
+            "version": "v7.4.19",
+            "hash": "tree-v2:1e8a3ebeaabd6609d46b43ca7d92e2229ad4d7733292181792788556be171a54"
+        },
+        "symfony/options-resolver": {
+            "version": "v8.1.0",
+            "hash": "tree-v2:460463358ebcddeefa642be1bbdef7cae975b10da77c231d109fb4d720275f44"
+        },
+        "symfony/polyfill-ctype": {
+            "version": "v1.37.0",
+            "hash": "tree-v2:8a05c9979125b75411bed1356ebf16439972fafc4cca1ff6baa717db25e3dfca"
+        },
+        "symfony/polyfill-intl-grapheme": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:5e6dbd2dc74543299269b89eb6e2ba8c170b51b1697674fbfe681c256e55dd47"
+        },
+        "symfony/polyfill-intl-idn": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:c923d31d3d92c64e387245034bf7ca44284e3ec6674004efd41e7d13da99a492"
+        },
+        "symfony/polyfill-intl-normalizer": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:cd506f4802cec64c0a39b6fa45cf9e22bffc84e674442ae93b6eaf936304ec5d"
+        },
+        "symfony/polyfill-mbstring": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:1178bc6cf2eca3121b218c648dc6b60c5596ba469520be8aa5744cf105dd9e5b"
+        },
+        "symfony/polyfill-php80": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:dac9a7018f6de962c077a8a96a80deaf4da282d85250f36c90e293fde4804664"
+        },
+        "symfony/polyfill-php81": {
+            "version": "v1.38.1",
+            "hash": "tree-v2:fa626280ca82a3b621da208fe448441ec61a315e5f968fabe708d8ab0ebf83f3"
+        },
+        "symfony/polyfill-php83": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:d6cc98eac4a84a4ad1bffbf3b5ae52ce3716d8e8f8ef74b2a76172ce07545d9e"
+        },
+        "symfony/polyfill-php84": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:0e8b2fc36bad3b28730f58da447ce185e1bc0b65e905d8a08f409b8444f853d4"
+        },
+        "symfony/polyfill-php85": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:7399609adce52ef72aab96a3db35805814b486e6a46d30b2ed8e69f587eb3c8f"
+        },
+        "symfony/polyfill-uuid": {
+            "version": "v1.43.0",
+            "hash": "tree-v2:d5a39f5ddaf6c4b4b53829f8cca739b82ac309b5066ac170665b010e03fe6fc1"
+        },
+        "symfony/process": {
+            "version": "v7.4.19",
+            "hash": "tree-v2:2fa5a43314ce3843a467b733c1db2c64b861424a177e07c7ded950ac8712edb7"
+        },
+        "symfony/property-access": {
+            "version": "v8.1.4",
+            "hash": "tree-v2:5f465a4a0eb7e2e8fbe080af2bf95e4c4d3fd4fe272bdf98efc63ed5c0794073"
+        },
+        "symfony/property-info": {
+            "version": "v8.1.8",
+            "hash": "tree-v2:08cd925cac3b082917a9c19315571388a1c66fba31fe438dae4af59238f45f55"
+        },
+        "symfony/psr-http-message-bridge": {
+            "version": "v8.1.0",
+            "hash": "tree-v2:5436ca31402054df5b2f0112afa655297032380d0db45baa946bad4253a8a324"
+        },
+        "symfony/routing": {
+            "version": "v7.4.20",
+            "hash": "tree-v2:19428320d0ea2565dc895a1d706d8c94497ccca8ffbff34422369fd3d9a828c2"
+        },
+        "symfony/serializer": {
+            "version": "v8.1.8",
+            "hash": "tree-v2:af5d415bda361730ecfbb542dc810a7d98ac00922c9fc625e740d3e221d645ef"
+        },
+        "symfony/service-contracts": {
+            "version": "v3.7.3",
+            "hash": "tree-v2:87421779a4d0f4aae910ba4a77c7a04bfd6d385d86190a96ec8276ec1ba48987"
+        },
+        "symfony/string": {
+            "version": "v8.1.7",
+            "hash": "tree-v2:e51a49ae27601177aa109b457a6fa3c578e8df63f80845a3101095010791f66f"
+        },
+        "symfony/translation": {
+            "version": "v8.1.5",
+            "hash": "tree-v2:5ed59b86402810a7cc27e7abb649b87fe5e32e20f982a025dee49333b77c0182"
+        },
+        "symfony/translation-contracts": {
+            "version": "v3.7.1",
+            "hash": "tree-v2:74a8e3a8f0580af687b411de0e087911c348807f6e59858632fbffabeb7bf9a9"
+        },
+        "symfony/type-info": {
+            "version": "v8.1.8",
+            "hash": "tree-v2:f5b0432361367fb8453952c9821a05fb2aadf6918fed80cb82a8b9bea4cc039c"
+        },
+        "symfony/uid": {
+            "version": "v7.4.20",
+            "hash": "tree-v2:9c354ab4077f1df6443bda228b659e01c97a28bbc64ad36b15f9976cb66bdbce"
+        },
+        "symfony/var-dumper": {
+            "version": "v7.4.18",
+            "hash": "tree-v2:6cf1763f4c700d9ead924182f1176ee815be6414cb1ea67bc6e92d13fc3461b2"
+        },
+        "symfony/yaml": {
+            "version": "v8.1.8",
+            "hash": "tree-v2:8d990fa9be574dec0fbb19199b855c71c40515b9feebaa996d44de7c954143ee"
+        },
+        "tijsverkoyen/css-to-inline-styles": {
+            "version": "v2.4.0",
+            "hash": "tree-v2:ac5b86c6dee0dc8f5c5f7f98d250d378d8c65dde04156022650e4776734f7fcb"
+        },
+        "visus/cuid2": {
+            "version": "7.0.0",
+            "hash": "tree-v2:9558deceb662c50e421e5e42402f973d6cdf72af45322f5274337f6fb741ad2a"
+        },
+        "vlucas/phpdotenv": {
+            "version": "v5.7.0",
+            "hash": "tree-v2:6c06f3ef79457956cc5468b35ba53b18504b47a0925d29278c2b195caa85bae0"
+        },
+        "voku/portable-ascii": {
+            "version": "2.1.1",
+            "hash": "tree-v2:6c1b22272d89eb3d85366cc99a0375535b76a897616d9d79bbfddc8bcded66c6"
+        },
+        "web-auth/cose-lib": {
+            "version": "4.8.2",
+            "hash": "tree-v2:de961d934f2e526f30b69334bb474ac1aa3ff77389998ea9d0f6c02ffe493936"
+        },
+        "web-auth/webauthn-lib": {
+            "version": "5.3.9",
+            "hash": "tree-v2:e0949da9b86423ae77ef6a89f893c59bf769748d6a73ef90b6b0c35ea62e8209"
+        },
+        "webmozart/assert": {
+            "version": "2.4.1",
+            "hash": "tree-v2:7376c95163e3fc61ad793a2342e94ff787b01739b28ecce59d5acd1ce8cc691b"
+        },
+        "yosymfony/parser-utils": {
+            "version": "v2.0.0",
+            "hash": "tree-v2:96588dacd406278c80997538f85fade4a9d6819d5a5a295253a15bad7bf3f7d7"
+        },
+        "yosymfony/toml": {
+            "version": "v1.0.4",
+            "hash": "tree-v2:06d6d20af34021a04bb906b2f8b28a82dc986db7e17234bbae7074b1235e7119"
+        },
+        "zircote/swagger-php": {
+            "version": "6.11.0",
+            "hash": "tree-v2:d6535e60c5f64c53eba5cfe4f8729ae437b0007f2a0d67d2a2daeae3bf01f79f"
+        }
+    },
+    "require-dev": {
+        "amphp/amp": {
+            "version": "v3.1.3",
+            "hash": "tree-v2:d3497306739d19b5afaaba19043930ea8eef2470ccd5592f03129fa374f172d7"
+        },
+        "amphp/byte-stream": {
+            "version": "v2.1.2",
+            "hash": "tree-v2:76f032d87c398e38a37a7aa8ae50496885edf16cee70178be260eefc17ada6d2"
+        },
+        "amphp/cache": {
+            "version": "v2.0.1",
+            "hash": "tree-v2:d7d30faedc5d9aaadb6cd48d296f2bcc202f5b9e9251cb749c07196398da42de"
+        },
+        "amphp/dns": {
+            "version": "v2.4.1",
+            "hash": "tree-v2:5244fcc714f0651538775d9749fb14f2d7980ec3b3f472c85724f6dd7a37efc1"
+        },
+        "amphp/hpack": {
+            "version": "v3.2.2",
+            "hash": "tree-v2:224439b904b3e3837e611183925e51859b7cbb85f80143871def0d16484578b7"
+        },
+        "amphp/http": {
+            "version": "v2.1.2",
+            "hash": "tree-v2:0c7b6dcb02552516528fc98a6ba8e92908caa010b5eb8e4471f1f12f1c9f3d0e"
+        },
+        "amphp/http-client": {
+            "version": "v5.3.6",
+            "hash": "tree-v2:5d4dd74df9cdc7b087b295b67a7c00172d8c9d2099ea5599613c9f5579c52819"
+        },
+        "amphp/http-server": {
+            "version": "v3.4.6",
+            "hash": "tree-v2:9a3424c8f2833ed3f24488f9252991502e945c79c0b0e8485ca48b4132387538"
+        },
+        "amphp/parser": {
+            "version": "v1.1.1",
+            "hash": "tree-v2:323c0ca63bcacc384f97693e57a1b4d4d25e31075633c87dbf9bb52aefdaf074"
+        },
+        "amphp/pipeline": {
+            "version": "v1.2.7",
+            "hash": "tree-v2:91f9d66bbf42eb4dbf2984ea7d8ee6fe9931db442487fde46313a3f840334957"
+        },
+        "amphp/process": {
+            "version": "v2.1.0",
+            "hash": "tree-v2:9f2b957f18f84012aa2db032780bca4bdc0468c6b55fe8112fa609430c7bc021"
+        },
+        "amphp/serialization": {
+            "version": "v1.1.0",
+            "hash": "tree-v2:a4cd50472d471a9d10fcafdb712cb3efc112bb2e643814529bb6195d43acdce4"
+        },
+        "amphp/socket": {
+            "version": "v2.4.1",
+            "hash": "tree-v2:cfe7178350f2a9cacd4b6ea1e5f68ba14889162e04838b04b279cb8389dd780b"
+        },
+        "amphp/sync": {
+            "version": "v2.3.0",
+            "hash": "tree-v2:481be54c4d2517271fa742d678abfa01fc7d6d9e4ce1c5df59ccc184b51a4fa1"
+        },
+        "amphp/websocket": {
+            "version": "v2.0.4",
+            "hash": "tree-v2:2cccf30e15de80faebf3e958db38aaabea0619a65e2162c6d26b0970d0bb17db"
+        },
+        "amphp/websocket-client": {
+            "version": "v2.0.2",
+            "hash": "tree-v2:8ec4699d0c0c88cb401db507d2bc24438050f961bb7efceea2cae31b36c53483"
+        },
+        "brianium/paratest": {
+            "version": "v7.20.0",
+            "hash": "tree-v2:075f8b7e73532ba3689126db0f91288a199bcba5f2743bc17a9bf37d53e030c1"
+        },
+        "composer/pcre": {
+            "version": "3.4.0",
+            "hash": "tree-v2:ed02f4e2009261111a40bc3f96d602af9d3d2b069df5578bcd5ca8641e55d583"
+        },
+        "composer/semver": {
+            "version": "3.5.0",
+            "hash": "tree-v2:248e81e763c49385d13df21a723d156777290b327a2cd119201d4052e26fcb38"
+        },
+        "composer/xdebug-handler": {
+            "version": "3.0.5",
+            "hash": "tree-v2:780bdd65290fbfc62bbe8de682feb4eff689bf57ac9598bd42dc83f60e734adf"
+        },
+        "daverandom/libdns": {
+            "version": "v2.1.0",
+            "hash": "tree-v2:a4f2d4abdf003756bf9b88bb6c55c8a70d8d214c81529273974c9ddda020fe02"
+        },
+        "driftingly/rector-laravel": {
+            "version": "2.6.2",
+            "hash": "tree-v2:7ad85f8d2c4fc8ae611466f654d894413f9d066999bbede4abdccda6f230be4e"
+        },
+        "fakerphp/faker": {
+            "version": "v1.24.1",
+            "hash": "tree-v2:b6f3d0f8ca79f98400b0df7c2a29004dbd9e3f39f39125ecfd5613e38b9ff6a3"
+        },
+        "fidry/cpu-core-counter": {
+            "version": "1.4.1",
+            "hash": "tree-v2:187d5e8e97709597df098f058a60567f02d205ecf769583864ae461552cdae95"
+        },
+        "filp/whoops": {
+            "version": "2.18.5",
+            "hash": "tree-v2:8c32519eacbd19b8d00468e9a8aaf35efca825f90c912fd802d74494d97e1ca5"
+        },
+        "hamcrest/hamcrest-php": {
+            "version": "v3.0.0",
+            "hash": "tree-v2:49f1c99167659adb6f9f9bf1aa7abca02fcd773f3c19041f7983dd50b83d85e7"
+        },
+        "kelunik/certificate": {
+            "version": "v1.1.3",
+            "hash": "tree-v2:760bb76fec70d2a8530c4968b49720c08824cd8eebb27dee38370d8e71ee5855"
+        },
+        "laravel/boost": {
+            "version": "v2.10.0",
+            "hash": "tree-v2:c88d4a35bf2e78d321dca9e8c342c6de41d85d06e840d0f1149d5990ac7c3a3a"
+        },
+        "laravel/pint": {
+            "version": "v1.32.1",
+            "hash": "tree-v2:6011ed0cc05d840c85dac563c64a2461bc3c09f131e7c819f75abd73c9502f64"
+        },
+        "laravel/roster": {
+            "version": "v1.0.0",
+            "hash": "tree-v2:da430a9f3d9fb06a3812b0e8a116d8265a06dce1bfde4182a1de7154ba15ad67"
+        },
+        "laravel/vet": {
+            "version": "v0.2.1",
+            "hash": "tree-v2:7c555b9f7eb265649d89769aa9b07bafc809d9e52d15ecdc3a84ee1c59fa767e"
+        },
+        "league/uri-components": {
+            "version": "7.8.1",
+            "hash": "tree-v2:a2b928f6fae0e15c66f08ae84e98f7dd8547749390ca842c83014bf1f2d68777"
+        },
+        "mockery/mockery": {
+            "version": "1.6.15",
+            "hash": "tree-v2:4bc0e2fbaea02a9469caa0f1105242dca2907278bc1fd8a3f9c6c8a2ddf920d7"
+        },
+        "myclabs/deep-copy": {
+            "version": "1.14.0",
+            "hash": "tree-v2:6f013d251808abbe250faa2a847f14d89804ba137fc7e085495311bc6ebc1822"
+        },
+        "nunomaduro/collision": {
+            "version": "v8.9.5",
+            "hash": "tree-v2:937038b0d056a8bcf7697a75ce737986eccb501a325645cf05d679e7befcf39e"
+        },
+        "pestphp/pest": {
+            "version": "v4.7.8",
+            "hash": "tree-v2:36d984a67927f4dc359da32a74528232c736b60015a6e8eb194c50076fee6544"
+        },
+        "pestphp/pest-plugin": {
+            "version": "v4.0.0",
+            "hash": "tree-v2:3103a3f5c29b851523801f4168e91bf6d802ef5e65706fd83273c24c4ec95549"
+        },
+        "pestphp/pest-plugin-arch": {
+            "version": "v4.0.2",
+            "hash": "tree-v2:37a528a6ea7283adfb14f06e80ce4dd3884a2917cc372b204c221f206b3bfe98"
+        },
+        "pestphp/pest-plugin-browser": {
+            "version": "v4.3.1",
+            "hash": "tree-v2:a9294251c3d572bcfa8ef508c2e1c88bc100fb248b01a4cd0be088b7677d0494"
+        },
+        "pestphp/pest-plugin-mutate": {
+            "version": "v4.0.1",
+            "hash": "tree-v2:90dc0a102fcecaf0314015c17c0e98e3f2e5151247da5809a174a731e8b2db89"
+        },
+        "pestphp/pest-plugin-profanity": {
+            "version": "v4.2.1",
+            "hash": "tree-v2:88b1581205235488496300f5ee233b42b122f5a5668bb2d95f8169c180121cd9"
+        },
+        "phar-io/manifest": {
+            "version": "2.0.4",
+            "hash": "tree-v2:7b98d0ed9886b77df04a08280884b27c7169ba845a24c626ca7abea0d3afc1f7"
+        },
+        "phar-io/version": {
+            "version": "3.2.1",
+            "hash": "tree-v2:0409e2019377650177c2b10da803617abc85e49d5b02b8697d450c007eab42b4"
+        },
+        "phpstan/phpstan": {
+            "version": "2.2.16",
+            "hash": "tree-v2:2c6a2e25bc83ef5a18b9a3a5fb9ac9464160a2e414cf4df481d3810becefdde1"
+        },
+        "phpunit/php-code-coverage": {
+            "version": "12.5.7",
+            "hash": "tree-v2:5cf24f83c21b6d8fce23e7ad853f77f0807e76f4c84d4f7ffb9053a167df16ca"
+        },
+        "phpunit/php-file-iterator": {
+            "version": "6.0.2",
+            "hash": "tree-v2:5899b835455b09f32cda45548e9aaa437dd3aa9508c5960076d081175aa53293"
+        },
+        "phpunit/php-invoker": {
+            "version": "6.0.0",
+            "hash": "tree-v2:6d8f648edbdac676ca9bee9c2fe97c82d6251aaf62f156c3a36c86736b812e23"
+        },
+        "phpunit/php-text-template": {
+            "version": "5.0.0",
+            "hash": "tree-v2:4470e41670dd466f1af97fb08a0705d5e31c1d09f6f09ece2404cbd7ae6a709b"
+        },
+        "phpunit/php-timer": {
+            "version": "8.0.0",
+            "hash": "tree-v2:f35fccbffc23c168f18029a433791f4dd85daa7009e53987b66f08bdbf3d4353"
+        },
+        "phpunit/phpunit": {
+            "version": "12.5.33",
+            "hash": "tree-v2:fe7d4ec3e4840290cee07c39535422b61bb31ebd2afde15a39a78373a0cd2c64"
+        },
+        "rector/rector": {
+            "version": "2.6.7",
+            "hash": "tree-v2:9e83455ef9d1fa0a25829c840dd17ad00620e4b315bed4aee4fde6a2aa10cac5"
+        },
+        "revolt/event-loop": {
+            "version": "v1.0.9",
+            "hash": "tree-v2:0ce99bc9177402510544459689f3c8f2abae7466e27abf1eefb7da8888bc0198"
+        },
+        "sebastian/cli-parser": {
+            "version": "4.2.1",
+            "hash": "tree-v2:fc44fc3e0a4b1fd529963948acebc3a3370f7b55aa8e9969c96953477b41886e"
+        },
+        "sebastian/comparator": {
+            "version": "7.1.8",
+            "hash": "tree-v2:10f9243c8a5287b8ad9e7ed4651717391adaf923891a95d75b589fa2229f5386"
+        },
+        "sebastian/complexity": {
+            "version": "5.0.0",
+            "hash": "tree-v2:f0d6eb200ba389679d875eb854ffc9d6c55884d1e5b5bdcd2e58cb27d505c362"
+        },
+        "sebastian/diff": {
+            "version": "7.0.1",
+            "hash": "tree-v2:97deb1c25a59326f762c614ccc25be2163296ae70762785f12d307ed967a5326"
+        },
+        "sebastian/environment": {
+            "version": "8.1.2",
+            "hash": "tree-v2:f6e34bc8513b7d4b3c319a99bd457c406b3ef4968db30b33c07346a6c0d46c06"
+        },
+        "sebastian/exporter": {
+            "version": "7.0.3",
+            "hash": "tree-v2:14c6a001c221469a25b6bb02ab8b7684b7e64ed98379ec6e7673853d7ee3c0a4"
+        },
+        "sebastian/global-state": {
+            "version": "8.0.3",
+            "hash": "tree-v2:61b9dda526628a2c6b44092338d4363c3b682f4290e71b9bffed49e70327f10c"
+        },
+        "sebastian/lines-of-code": {
+            "version": "4.0.1",
+            "hash": "tree-v2:10204087c002cc8387fd29d84327bec5b68cd528a854234fb79f0e29b6f12cde"
+        },
+        "sebastian/object-enumerator": {
+            "version": "7.0.0",
+            "hash": "tree-v2:7e0147f70c38947d32d81b0a88607da16c0b067ba9c357febe9779639e55d69f"
+        },
+        "sebastian/object-reflector": {
+            "version": "5.0.0",
+            "hash": "tree-v2:dc02c4b2cc26efffc26b74e5bc0e489a4ac3ce831fff0f06c939fef5b8285fc3"
+        },
+        "sebastian/recursion-context": {
+            "version": "7.0.1",
+            "hash": "tree-v2:c2713c083e6e14599b6a68f986d969692458ff45a1aedf5a6bd994699c6cc72d"
+        },
+        "sebastian/type": {
+            "version": "6.0.4",
+            "hash": "tree-v2:c18e590b1fad7140ccc8dc16086635356728f15f0eb1abfb4d3d79b243947a35"
+        },
+        "sebastian/version": {
+            "version": "6.0.0",
+            "hash": "tree-v2:b900b2263d6a49e35e6c9adf9d477f927d769f6a019ae4532a6867b44506f456"
+        },
+        "serversideup/spin": {
+            "version": "v3.5.2",
+            "hash": "tree-v2:21e14ccdd73e58677be9802890fd8d73dc3bd608e7693451ed63c34329cfe2a0"
+        },
+        "staabm/side-effects-detector": {
+            "version": "1.0.5",
+            "hash": "tree-v2:26d964435c381c94abd5dbadf497d7888b5a811f0693b66aa7976a3d01c545ba"
+        },
+        "symfony/http-client": {
+            "version": "v8.1.8",
+            "hash": "tree-v2:4ef9be0a8af777834c59a7d18c442cbb950b4e5e4d725c22250d301d1ffb7ccb"
+        },
+        "symfony/http-client-contracts": {
+            "version": "v3.7.3",
+            "hash": "tree-v2:3fba0792bd4d55c49f97b475328f8f87d3c0f761c4a533d03b7f9afea731046f"
+        },
+        "symplify/rule-doc-generator-contracts": {
+            "version": "11.2.0",
+            "hash": "tree-v2:143fc89ce64308c660e6f52de2df92429720106e1e43e1484dd93193772ed011"
+        },
+        "ta-tikoma/phpunit-architecture-test": {
+            "version": "0.8.7",
+            "hash": "tree-v2:068328d7bed81666d79d94c08e5b634b6c2f1499e8ebadf1068b4d7f19545243"
+        },
+        "theseer/tokenizer": {
+            "version": "2.0.1",
+            "hash": "tree-v2:41aaedd9e64befbc0fecc9ff7ea3ea811daa1088ea055614faa0aeef41f8744f"
+        }
+    },
+    "minimum-release-age": 3
+}
diff --git a/vite.config.js b/vite.config.js
index 1c7c5c47b3..5969419adc 100644
--- a/vite.config.js
+++ b/vite.config.js
@@ -1,5 +1,6 @@
 import { defineConfig, loadEnv } from "vite";
 import laravel from "laravel-vite-plugin";
+import { svelte } from "@sveltejs/vite-plugin-svelte";
 
 export default defineConfig(({ mode }) => {
     const env = loadEnv(mode, process.cwd(), "");
@@ -43,9 +44,12 @@ export default defineConfig(({ mode }) => {
                 input: [
                     "resources/css/app.css",
                     "resources/js/app.js",
+                    "resources/js/passkeys.js",
                 ],
                 refresh: true,
             }),
+            // Svelte 5 (runes) for the canvases: resources/js/canvas/.
+            svelte(),
         ],
     };
 });