starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 13:10:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(service): bump PHP templates to patched images and re-enable them

Browse Source 
Update the templates that pinned images with a PHP release vulnerable
to CVE-2026-109618 and CVE-2026-109619, and remove their ignore flag:

- appwrite 2.6.1 (console 1.2.97, orchestrator 2.2.4, exiftool service)
- castopod 1.15.6
- freescout: move to nfrastack/freescout:2.2.21 (tiredofit image removed)
- grocy 4.7.1
- opnform 2.6.1 (nginx route for Nuxt icons)
- paymenter v1.5.9
- pterodactyl panel v1.15.2, wings v1.13.4
- snipe-it v8.8.3
This commit is contained in:
Andras Bacsai
2026-10-22 20:39:08 +02:00
parent 7acfcdff24
commit 624bc098c6
9 changed files with 67 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/compose/appwrite.yaml
+37 -12
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation: https://appwrite.io/docs
# slogan: A backend-as-a-service platform that simplifies the web & mobile app development.
# category: backend
@@ -8,7 +7,7 @@
services:
appwrite:
image: appwrite/appwrite:2.5.0
image: appwrite/appwrite:2.6.1
environment:
- SERVICE_URL_APPWRITE=/v1
- _APP_DNS_EXTERNAL=${_APP_DNS_EXTERNAL}
@@ -99,6 +98,7 @@ services:
- _APP_STORAGE_LIMIT=${_APP_STORAGE_LIMIT:-30000000}
- _APP_STORAGE_PREVIEW_LIMIT=${_APP_STORAGE_PREVIEW_LIMIT:-20000000}
- _APP_AUTOGRAVITY_HOST=${_APP_AUTOGRAVITY_HOST}
- _APP_EXIFTOOL_HOST=${_APP_EXIFTOOL_HOST:-http://appwrite-exiftool:8080}
- _APP_STORAGE_ANTIVIRUS=${_APP_STORAGE_ANTIVIRUS:-disabled}
- _APP_STORAGE_ANTIVIRUS_HOST=${_APP_STORAGE_ANTIVIRUS_HOST}
- _APP_STORAGE_ANTIVIRUS_PORT=${_APP_STORAGE_ANTIVIRUS_PORT:-3310}
@@ -108,6 +108,7 @@ services:
- _APP_STORAGE_S3_REGION=${_APP_STORAGE_S3_REGION:-us-east-1}
- _APP_STORAGE_S3_BUCKET=${_APP_STORAGE_S3_BUCKET}
- _APP_STORAGE_S3_ENDPOINT=${_APP_STORAGE_S3_ENDPOINT}
- _APP_STORAGE_S3_PATH_STYLE=${_APP_STORAGE_S3_PATH_STYLE}
- _APP_STORAGE_DO_SPACES_ACCESS_KEY=${_APP_STORAGE_DO_SPACES_ACCESS_KEY}
- _APP_STORAGE_DO_SPACES_SECRET=${_APP_STORAGE_DO_SPACES_SECRET}
- _APP_STORAGE_DO_SPACES_REGION=${_APP_STORAGE_DO_SPACES_REGION:-us-east-1}
@@ -176,6 +177,10 @@ services:
- _APP_VCS_BITBUCKET_WEBHOOK_SECRET=${_APP_VCS_BITBUCKET_WEBHOOK_SECRET}
- _APP_VCS_ORIGIN_CLIENT_ID=${_APP_VCS_ORIGIN_CLIENT_ID}
- _APP_VCS_ORIGIN_PRIVATE_KEY=${_APP_VCS_ORIGIN_PRIVATE_KEY}
- _APP_VCS_ENTIRE_PLUGIN=${_APP_VCS_ENTIRE_PLUGIN}
- _APP_VCS_ENTIRE_PRIVATE_KEY=${_APP_VCS_ENTIRE_PRIVATE_KEY}
- _APP_VCS_ENTIRE_ISSUER=${_APP_VCS_ENTIRE_ISSUER}
- _APP_VCS_ENTIRE_ENDPOINT=${_APP_VCS_ENTIRE_ENDPOINT}
- _APP_VCS_WEBHOOK_URL=${_APP_VCS_WEBHOOK_URL}
- _APP_MIGRATIONS_FIREBASE_CLIENT_ID=${_APP_MIGRATIONS_FIREBASE_CLIENT_ID}
- _APP_MIGRATIONS_FIREBASE_CLIENT_SECRET=${_APP_MIGRATIONS_FIREBASE_CLIENT_SECRET}
@@ -212,19 +217,21 @@ services:
condition: service_healthy
appwrite-geo:
condition: service_healthy
appwrite-exiftool:
condition: service_started
healthcheck:
test: ["CMD-SHELL", "curl -fsS -o /dev/null http://localhost/v1/health/version || exit 1"]
test: ["CMD-SHELL", "test -f /tmp/.appwrite-ready && curl -fsS -o /dev/null http://localhost/v1/health/version || exit 1"]
interval: 20s
timeout: 5s
retries: 6
start_period: 120s
appwrite-console:
image: appwrite/new:1.2.74-self-hosted
image: appwrite/new:1.2.97-self-hosted
environment:
- SERVICE_URL_APPWRITE_3000=/
- VITE_CONSOLE_PROFILE=self-hosted
- VITE_APPWRITE_VERSION=2.5.0
- VITE_APPWRITE_VERSION=2.6.1
- APPWRITE_ENDPOINT_SAME_ORIGIN=true
depends_on:
appwrite:
@@ -236,7 +243,7 @@ services:
retries: 3
appwrite-realtime:
image: appwrite/appwrite:2.5.0
image: appwrite/appwrite:2.6.1
entrypoint: realtime
environment:
- SERVICE_URL_APPWRITE=/v1/realtime
@@ -294,7 +301,7 @@ services:
retries: 3
appwrite-worker:
image: appwrite/appwrite:2.5.0
image: appwrite/appwrite:2.6.1
entrypoint: worker
environment:
- _APP_ENV=${_APP_ENV:-production}
@@ -309,9 +316,10 @@ services:
- _APP_MAINTENANCE_RETENTION_USAGE_TTL=${_APP_MAINTENANCE_RETENTION_USAGE_TTL:-180}
- _APP_STATS_USAGE_QUEUE_NAME=${_APP_STATS_USAGE_QUEUE_NAME:-v1-stats-usage}
- _APP_STATS_RESOURCES_QUEUE_NAME=${_APP_STATS_RESOURCES_QUEUE_NAME:-v1-stats-resources}
- _APP_MAINTENANCE_QUEUE_NAME=${_APP_MAINTENANCE_QUEUE_NAME:-v1-maintenance}
- _APP_STATS_RESOURCES_INTERVAL=${_APP_STATS_RESOURCES_INTERVAL:-3600}
- _APP_WORKERS_NUM=1
- _APP_WORKER_MAX_COROUTINES=78
- _APP_WORKER_MAX_COROUTINES=79
- _APP_WORKER_PER_CORE=${_APP_WORKER_PER_CORE:-6}
- _APP_OPENSSL_KEY_V1=$SERVICE_PASSWORD_64_APPWRITE
- _APP_EMAIL_SECURITY=${_APP_EMAIL_SECURITY:-security@appwrite.io}
@@ -364,6 +372,7 @@ services:
- _APP_STORAGE_S3_REGION=${_APP_STORAGE_S3_REGION:-us-east-1}
- _APP_STORAGE_S3_BUCKET=${_APP_STORAGE_S3_BUCKET}
- _APP_STORAGE_S3_ENDPOINT=${_APP_STORAGE_S3_ENDPOINT}
- _APP_STORAGE_S3_PATH_STYLE=${_APP_STORAGE_S3_PATH_STYLE}
- _APP_STORAGE_DO_SPACES_ACCESS_KEY=${_APP_STORAGE_DO_SPACES_ACCESS_KEY}
- _APP_STORAGE_DO_SPACES_SECRET=${_APP_STORAGE_DO_SPACES_SECRET}
- _APP_STORAGE_DO_SPACES_REGION=${_APP_STORAGE_DO_SPACES_REGION:-us-east-1}
@@ -409,6 +418,10 @@ services:
- _APP_VCS_BITBUCKET_WEBHOOK_SECRET=${_APP_VCS_BITBUCKET_WEBHOOK_SECRET}
- _APP_VCS_ORIGIN_CLIENT_ID=${_APP_VCS_ORIGIN_CLIENT_ID}
- _APP_VCS_ORIGIN_PRIVATE_KEY=${_APP_VCS_ORIGIN_PRIVATE_KEY}
- _APP_VCS_ENTIRE_PLUGIN=${_APP_VCS_ENTIRE_PLUGIN}
- _APP_VCS_ENTIRE_PRIVATE_KEY=${_APP_VCS_ENTIRE_PRIVATE_KEY}
- _APP_VCS_ENTIRE_ISSUER=${_APP_VCS_ENTIRE_ISSUER}
- _APP_VCS_ENTIRE_ENDPOINT=${_APP_VCS_ENTIRE_ENDPOINT}
- _APP_VCS_WEBHOOK_URL=${_APP_VCS_WEBHOOK_URL}
- _APP_BUILDS_VOLUME=${COMPOSE_PROJECT_NAME}_appwrite-builds
- _APP_JOBS_HOST=${_APP_JOBS_HOST:-http://orchestrator:8080}
@@ -463,7 +476,7 @@ services:
retries: 3
appwrite-task-scheduler:
image: appwrite/appwrite:2.5.0
image: appwrite/appwrite:2.6.1
entrypoint: schedule
environment:
- _APP_ENV=${_APP_ENV:-production}
@@ -476,6 +489,7 @@ services:
- _APP_MAINTENANCE_RETENTION_USAGE_TTL=${_APP_MAINTENANCE_RETENTION_USAGE_TTL:-180}
- _APP_STATS_USAGE_QUEUE_NAME=${_APP_STATS_USAGE_QUEUE_NAME:-v1-stats-usage}
- _APP_STATS_RESOURCES_QUEUE_NAME=${_APP_STATS_RESOURCES_QUEUE_NAME:-v1-stats-resources}
- _APP_MAINTENANCE_QUEUE_NAME=${_APP_MAINTENANCE_QUEUE_NAME:-v1-maintenance}
- _APP_STATS_RESOURCES_INTERVAL=${_APP_STATS_RESOURCES_INTERVAL:-3600}
- _APP_LOGGING_FORMAT=${_APP_LOGGING_FORMAT:-pretty}
- _APP_WORKER_MAX_COROUTINES=8
@@ -500,6 +514,7 @@ services:
- _APP_DB_PASS=$SERVICE_PASSWORD_POSTGRES
- _APP_DATABASE_SHARED_TABLES=${_APP_DATABASE_SHARED_TABLES}
- _APP_FUNCTIONS_SCHEDULE_SPREAD=${_APP_FUNCTIONS_SCHEDULE_SPREAD:-0}
- _APP_MAINTENANCE_INACTIVE_INTERVAL=${_APP_MAINTENANCE_INACTIVE_INTERVAL:-604800}
depends_on:
appwrite-postgresql:
condition: service_healthy
@@ -512,7 +527,7 @@ services:
retries: 3
appwrite-task-maintenance:
image: appwrite/appwrite:2.5.0
image: appwrite/appwrite:2.6.1
entrypoint: maintenance
environment:
- _APP_ENV=${_APP_ENV:-production}
@@ -559,7 +574,7 @@ services:
retries: 3
appwrite-task-interval:
image: appwrite/appwrite:2.5.0
image: appwrite/appwrite:2.6.1
entrypoint: interval
environment:
- _APP_ENV=${_APP_ENV:-production}
@@ -618,6 +633,15 @@ services:
- 8.8.8.8
exclude_from_hc: true
appwrite-exiftool:
image: ghcr.io/appwrite/exiftool:0.1.0
healthcheck:
test: ["CMD", "healthcheck"]
interval: 20s
timeout: 5s
retries: 3
start_period: 15s
openruntimes-executor:
image: openruntimes/executor:1.1.2
hostname: openruntimes-executor
@@ -651,7 +675,7 @@ services:
start_period: 10s
orchestrator:
image: ghcr.io/open-runtimes/orchestrator/orchestrator:2.2.2
image: ghcr.io/open-runtimes/orchestrator/orchestrator:2.2.4
hostname: orchestrator
user: root
environment:
@@ -674,6 +698,7 @@ services:
appwrite-postgresql:
image: appwrite/postgres:0.1.0
shm_size: 1g
environment:
- POSTGRES_DB=${_APP_DB_SCHEMA:-appwrite}
- POSTGRES_USER=$SERVICE_USER_POSTGRES
templates/compose/castopod.yaml
+1 -2
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation:https://docs.castopod.org/main/en/
# slogan: Castopod is a free & open-source hosting platform made for podcasters who want engage and interact with their audience.
# category: media
@@ -8,7 +7,7 @@
services:
castopod:
image: castopod/castopod:1.15.4
image: castopod/castopod:1.15.6
volumes:
- castopod-media:/var/www/castopod/public/media
environment:
templates/compose/freescout.yaml
+8 -7
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation: https://github.com/freescout-help-desk/freescout/wiki/
# slogan: FreeScout is the super lightweight and powerful free open source help desk and shared inbox written in PHP (Laravel framework).
# category: helpdesk
@@ -8,27 +7,29 @@
services:
freescout:
image: tiredofit/freescout:latest
image: nfrastack/freescout:2.2.21
volumes:
- freescout-data:/data
- freescout-logs:/www/logs
- freescout-logs:/logs
depends_on:
mariadb:
condition: service_healthy
environment:
- SERVICE_URL_FREESCOUT_80
- DB_TYPE=mariadb
- DB_HOST=mariadb
- DB_PORT=3306
- DB_NAME=${MARIADB_DATABASE:-freescout}
- DB_USER=${SERVICE_USER_MARIADB:-freescout}
- DB_PASS=${SERVICE_PASSWORD_MARIADB}
- SITE_URL=${SERVICE_URL_FREESCOUT}
- APP_URL=${SERVICE_URL_FREESCOUT}
- ADMIN_EMAIL=${ADMIN_EMAIL:-admin@example.com}
- ADMIN_PASS=${SERVICE_PASSWORD_ADMIN}
- DISPLAY_ERRORS=${DISPLAY_ERRORS:-FALSE}
- FREESCOUT_APP_DEBUG=${FREESCOUT_APP_DEBUG:-false}
- TIMEZONE=${TIMEZONE:-UTC}
healthcheck:
test: ["CMD", "curl", "-f", "http://127.0.0.1"]
start_period: 10s
test: ["CMD-SHELL", "busybox wget -qO /dev/null --header 'X-Forwarded-Proto: https' http://127.0.0.1/login || exit 1"]
start_period: 60s
interval: 5s
timeout: 10s
retries: 15
templates/compose/grocy.yaml
+1 -2
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation: https://github.com/grocy/grocy
# slogan: Grocy is a web-based household management and grocery list application.
# category: productivity
@@ -8,7 +7,7 @@
services:
grocy:
image: lscr.io/linuxserver/grocy:4.6.0
image: lscr.io/linuxserver/grocy:4.7.1
environment:
- SERVICE_URL_GROCY
- PUID=1000
templates/compose/opnform.yaml
+15 -5
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation: https://docs.opnform.com/introduction
# slogan: OpnForm is an open-source form builder that lets you create beautiful forms and share them anywhere. It's super fast, you don't need to know how to code
# category: productivity
@@ -56,7 +55,7 @@ x-shared-env: &shared-api-env
services:
opnform-api:
image: jhumanj/opnform-api:2.2.4
image: jhumanj/opnform-api:2.6.1
volumes:
- api-storage:/usr/share/nginx/html/storage
environment:
@@ -83,7 +82,7 @@ services:
start_period: 60s
api-worker:
image: jhumanj/opnform-api:2.2.4
image: jhumanj/opnform-api:2.6.1
volumes:
- api-storage:/usr/share/nginx/html/storage
environment:
@@ -104,7 +103,7 @@ services:
start_period: 30s
api-scheduler:
image: jhumanj/opnform-api:2.2.4
image: jhumanj/opnform-api:2.6.1
volumes:
- api-storage:/usr/share/nginx/html/storage
environment:
@@ -128,7 +127,7 @@ services:
start_period: 70s # Allow time for first scheduled run and cache write
opnform-ui:
image: jhumanj/opnform-client:2.2.4
image: jhumanj/opnform-client:2.6.1
environment:
- NUXT_PUBLIC_APP_URL=/
- NUXT_PUBLIC_API_BASE=/api
@@ -212,6 +211,17 @@ services:
proxy_set_header Connection "Upgrade";
}
# Proxy Nuxt icon requests to client container
location ^~ /api/_nuxt_icon/ {
proxy_http_version 1.1;
proxy_pass http://opnform-ui:3000;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
location ~/(api|open|local\/temp|forms\/assets)/ {
set $original_uri $uri;
try_files $uri $uri/ /index.php$is_args$args;
templates/compose/paymenter.yaml
+1 -2
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation: https://paymenter.org/docs/guides/docker
# slogan: Open-Source Billing, Built for Hosting
# category: finance
@@ -8,7 +7,7 @@
services:
paymenter:
image: 'ghcr.io/paymenter/paymenter:v1.4.5'
image: 'ghcr.io/paymenter/paymenter:v1.5.9'
volumes:
- 'app_logs:/app/storage/logs'
- 'extenstions:/app/extensions'
templates/compose/pterodactyl-panel.yaml
+1 -2
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation: https://pterodactyl.io/
# slogan: Pterodactyl is a free, open-source game server management panel
# category: media
@@ -33,7 +32,7 @@ services:
retries: 3
pterodactyl:
image: ghcr.io/pterodactyl/panel:v1.12.3
image: ghcr.io/pterodactyl/panel:v1.15.2
volumes:
- "panel-var:/app/var/"
- "panel-nginx:/etc/nginx/http.d/"
templates/compose/pterodactyl-with-wings.yaml
+2 -3
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation: https://pterodactyl.io/
# slogan: Pterodactyl is a free, open-source game server management panel
# category: media
@@ -34,7 +33,7 @@ services:
timeout: 1s
retries: 3
pterodactyl:
image: 'ghcr.io/pterodactyl/panel:v1.12.3'
image: 'ghcr.io/pterodactyl/panel:v1.15.2'
volumes:
- 'panel-var:/app/var/'
- 'panel-nginx:/etc/nginx/http.d/'
@@ -110,7 +109,7 @@ services:
- MAIL_PASSWORD=$MAIL_PASSWORD
- MAIL_ENCRYPTION=$MAIL_ENCRYPTION
wings:
image: 'ghcr.io/pterodactyl/wings:v1.12.1'
image: 'ghcr.io/pterodactyl/wings:v1.13.4'
restart: unless-stopped
ports:
- "2022:2022"
templates/compose/snipe-it.yaml
+1 -2
View File
@@ -1,4 +1,3 @@
# ignore: true
# documentation: https://snipe-it.readme.io/docs/introduction
# slogan: Snipe-IT is an open-source asset management platform built for IT departments.
# category: productivity
@@ -8,7 +7,7 @@
services:
app:
image: snipe/snipe-it:v8.7.1
image: snipe/snipe-it:v8.8.3
environment:
- SERVICE_URL_SNIPEIT_80
- APP_ENV=production