From 14ecadc0debb2a86975ea4d48dc6abc8ddc3ceb0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 16 Jul 2026 14:24:12 +0200
Subject: [PATCH 01/42] fix(services): avoid reading bind-mount files when
 syncing volumes

Stop catting remote file contents into memory for non-git bind mounts in
getFilesystemVolumesFromServer; git-based volumes still load via
loadStorageOnServer().
---
 bootstrap/helpers/services.php                | 19 +++++++++----------
 tests/Unit/LocalFileVolumeContentSizeTest.php | 13 +++++++++++++
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index 20b184a013..e46769a15c 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -139,7 +139,7 @@ function replaceVariables(string $variable): Stringable
 function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Application $oneService, bool $isInit = false)
 {
     try {
-        if ($oneService->getMorphClass() === \App\Models\Application::class) {
+        if ($oneService->getMorphClass() === Application::class) {
             $workdir = $oneService->workdir();
             $server = $oneService->destination->server;
         } else {
@@ -167,13 +167,12 @@ function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Appli
             $isDir = instant_remote_process(["test -d $fileLocation && echo OK || echo NOK"], $server);
 
             if ($isFile === 'OK') {
-                // If its a file & exists
-                $filesystemContent = instant_remote_process(["cat $fileLocation"], $server);
                 if ($fileVolume->is_based_on_git) {
-                    $fileVolume->content = $filesystemContent;
+                    $fileVolume->loadStorageOnServer();
+                } else {
+                    $fileVolume->is_directory = false;
+                    $fileVolume->save();
                 }
-                $fileVolume->is_directory = false;
-                $fileVolume->save();
             } elseif ($isDir === 'OK') {
                 // If its a directory & exists
                 $fileVolume->content = null;
@@ -204,7 +203,7 @@ function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Appli
                 instant_remote_process(["mkdir -p $fileLocation"], $server);
             }
         }
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         return handleError($e);
     }
 }
@@ -214,7 +213,7 @@ function updateCompose(ServiceApplication|ServiceDatabase $resource)
         $name = data_get($resource, 'name');
         $dockerComposeRaw = data_get($resource, 'service.docker_compose_raw');
         if (! $dockerComposeRaw) {
-            throw new \Exception('No compose file found or not a valid YAML file.');
+            throw new Exception('No compose file found or not a valid YAML file.');
         }
         $dockerCompose = Yaml::parse($dockerComposeRaw);
 
@@ -396,7 +395,7 @@ function updateCompose(ServiceApplication|ServiceDatabase $resource)
                 }
             }
         }
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         return handleError($e);
     }
 }
@@ -495,7 +494,7 @@ function applyServiceApplicationPrerequisites(Service $service): void
                 }
             }
         }
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         // Log error but don't throw - prerequisites are nice-to-have, not critical
         Log::error('Failed to apply service application prerequisites', [
             'service_id' => $service->id,
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
index 1fd315884e..0ad69e28aa 100644
--- a/tests/Unit/LocalFileVolumeContentSizeTest.php
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -64,3 +64,16 @@ it('exposes the too-large flag via toArray for Livewire serialization', function
     expect($array)->toHaveKey('is_too_large');
     expect($array['is_too_large'])->toBeTrue();
 });
+
+it('does not read regular bind-mounted file contents while loading service settings', function () {
+    $helpers = file_get_contents(base_path('bootstrap/helpers/services.php'));
+    $filesystemSync = str($helpers)
+        ->after('function getFilesystemVolumesFromServer')
+        ->before('function updateCompose');
+
+    expect($filesystemSync->value())
+        ->not->toContain('instant_remote_process(["cat $fileLocation"]');
+    expect($filesystemSync->value())
+        ->toContain('if ($fileVolume->is_based_on_git)')
+        ->toContain('$fileVolume->loadStorageOnServer();');
+});

From 2749f45ba6e464681929e9485730395452a246f3 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:21:00 +0200
Subject: [PATCH 02/42] fix: cap remote logs, tasks, and config output sizes

Bound proxy config, docker compose, scheduled task, log viewer, and
dynamic proxy config reads so large remote output cannot overwhelm PHP.
---
 app/Actions/Proxy/GetProxyConfiguration.php   | 10 ++-
 app/Jobs/ScheduledTaskJob.php                 | 12 ++-
 app/Livewire/Project/Shared/GetLogs.php       | 39 ++++++--
 .../Server/Proxy/DynamicConfigurations.php    | 35 +++++++-
 app/Models/Application.php                    | 15 +++-
 tests/Unit/RemoteOutputSizeLimitsTest.php     | 90 +++++++++++++++++++
 6 files changed, 187 insertions(+), 14 deletions(-)
 create mode 100644 tests/Unit/RemoteOutputSizeLimitsTest.php

diff --git a/app/Actions/Proxy/GetProxyConfiguration.php b/app/Actions/Proxy/GetProxyConfiguration.php
index 159f122526..7df16c52b4 100644
--- a/app/Actions/Proxy/GetProxyConfiguration.php
+++ b/app/Actions/Proxy/GetProxyConfiguration.php
@@ -13,6 +13,8 @@ class GetProxyConfiguration
 {
     use AsAction;
 
+    public const MAX_CONFIGURATION_SIZE_BYTES = 5 * 1024 * 1024;
+
     public function handle(Server $server, bool $forceRegenerate = false): string
     {
         $proxyType = $server->proxyType();
@@ -98,11 +100,17 @@ class GetProxyConfiguration
     private function backfillFromDisk(Server $server): ?string
     {
         $proxy_path = $server->proxyPath();
+        $configurationPath = escapeshellarg("$proxy_path/docker-compose.yml");
+        $readLimit = self::MAX_CONFIGURATION_SIZE_BYTES + 1;
         $result = instant_remote_process([
             "mkdir -p $proxy_path",
-            "cat $proxy_path/docker-compose.yml 2>/dev/null",
+            "if [ ! -f {$configurationPath} ]; then exit 0; elif [ \"$(wc -c < {$configurationPath})\" -gt ".self::MAX_CONFIGURATION_SIZE_BYTES." ]; then echo '__COOLIFY_PROXY_CONFIG_TOO_LARGE__'; else head -c {$readLimit} {$configurationPath}; fi",
         ], $server, false);
 
+        if ($result === '__COOLIFY_PROXY_CONFIG_TOO_LARGE__') {
+            throw new \RuntimeException('Proxy configuration exceeds the 5 MiB size limit.');
+        }
+
         if (! empty(trim($result ?? ''))) {
             $server->proxy->last_saved_proxy_configuration = $result;
             $server->save();
diff --git a/app/Jobs/ScheduledTaskJob.php b/app/Jobs/ScheduledTaskJob.php
index dc11ec89e7..02f3daa3b4 100644
--- a/app/Jobs/ScheduledTaskJob.php
+++ b/app/Jobs/ScheduledTaskJob.php
@@ -25,6 +25,8 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
 {
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
+    public const MAX_OUTPUT_SIZE_BYTES = 5 * 1024 * 1024;
+
     /**
      * The number of times the job may be attempted.
      */
@@ -148,7 +150,8 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
             foreach ($this->containers as $containerName) {
                 if (count($this->containers) == 1 || str_starts_with($containerName, $this->task->container.'-'.$this->resource->uuid)) {
                     $cmd = "sh -c '".str_replace("'", "'\''", $this->task->command)."'";
-                    $exec = "docker exec {$containerName} {$cmd}";
+                    $execCommand = "docker exec {$containerName} {$cmd}";
+                    $exec = $this->boundedTaskCommand($execCommand);
                     // Disable SSH multiplexing to prevent race conditions when multiple tasks run concurrently
                     // See: https://github.com/coollabsio/coolify/issues/6736
                     $this->task_output = instant_remote_process([$exec], $this->server, true, false, $this->timeout, disableMultiplexing: true);
@@ -204,6 +207,13 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function boundedTaskCommand(string $command): string
+    {
+        $maxOutputBytes = self::MAX_OUTPUT_SIZE_BYTES;
+
+        return "output_file=\$(mktemp); trap 'rm -f \"\$output_file\"' EXIT; set +e; set -o pipefail; {$command} 2>&1 | { head -c {$maxOutputBytes} > \"\$output_file\"; if IFS= read -r -n 1 extra_byte; then printf '\n\n[... Output truncated at 5MB limit ...]' >> \"\$output_file\"; fi; cat > /dev/null; }; exit_code=\${PIPESTATUS[0]}; if [ \"\$exit_code\" -eq 0 ]; then cat \"\$output_file\"; else cat \"\$output_file\" >&2; fi; exit \$exit_code";
+    }
+
     /**
      * Calculate the number of seconds to wait before retrying the job.
      */
diff --git a/app/Livewire/Project/Shared/GetLogs.php b/app/Livewire/Project/Shared/GetLogs.php
index d0121bdc51..fa575073f7 100644
--- a/app/Livewire/Project/Shared/GetLogs.php
+++ b/app/Livewire/Project/Shared/GetLogs.php
@@ -25,6 +25,8 @@ class GetLogs extends Component
 {
     public const MAX_LOG_LINES = 50000;
 
+    public const MAX_DISPLAY_SIZE_BYTES = 5 * 1024 * 1024;
+
     public const MAX_DOWNLOAD_SIZE_BYTES = 50 * 1024 * 1024; // 50MB
 
     public string $outputs = '';
@@ -154,14 +156,12 @@ class GetLogs extends Component
                         $command = parseCommandsByLineForSudo(collect($command), $this->server);
                         $command = $command[0];
                     }
-                    $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
                 } else {
                     $command = "docker logs -n {$this->numberOfLines} -t {$this->container}";
                     if ($this->server->isNonRoot()) {
                         $command = parseCommandsByLineForSudo(collect($command), $this->server);
                         $command = $command[0];
                     }
-                    $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
                 }
             } else {
                 if ($this->server->isSwarm()) {
@@ -170,22 +170,39 @@ class GetLogs extends Component
                         $command = parseCommandsByLineForSudo(collect($command), $this->server);
                         $command = $command[0];
                     }
-                    $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
                 } else {
                     $command = "docker logs -n {$this->numberOfLines} {$this->container}";
                     if ($this->server->isNonRoot()) {
                         $command = parseCommandsByLineForSudo(collect($command), $this->server);
                         $command = $command[0];
                     }
-                    $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
                 }
             }
+            $command = $this->boundedLogCommand($command, self::MAX_DISPLAY_SIZE_BYTES);
+            $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
+
             // Collect new logs into temporary variable first to prevent flickering
             // (avoids clearing output before new data is ready)
             // Use array accumulation + implode for O(n) instead of O(n²) string concatenation
             $logChunks = [];
-            Process::timeout(config('constants.ssh.command_timeout'))->run($sshCommand, function (string $type, string $output) use (&$logChunks) {
-                $logChunks[] = removeAnsiColors($output);
+            $accumulatedBytes = 0;
+            $truncated = false;
+            Process::timeout(config('constants.ssh.command_timeout'))->run($sshCommand, function (string $type, string $output) use (&$logChunks, &$accumulatedBytes, &$truncated) {
+                if ($truncated) {
+                    return;
+                }
+
+                $output = removeAnsiColors($output);
+                $remainingBytes = self::MAX_DISPLAY_SIZE_BYTES - $accumulatedBytes;
+                if (strlen($output) > $remainingBytes) {
+                    $logChunks[] = substr($output, 0, max(0, $remainingBytes));
+                    $truncated = true;
+
+                    return;
+                }
+
+                $logChunks[] = $output;
+                $accumulatedBytes += strlen($output);
             });
             $newOutputs = implode('', $logChunks);
 
@@ -198,6 +215,10 @@ class GetLogs extends Component
                 })->join("\n");
             }
 
+            if ($truncated) {
+                $newOutputs .= "\n\n[... Output truncated at 5MB limit ...]";
+            }
+
             // Only update outputs after new data is ready (atomic update prevents flicker)
             $this->outputs = $newOutputs;
         }
@@ -239,6 +260,7 @@ class GetLogs extends Component
             $command = $command[0];
         }
 
+        $command = $this->boundedLogCommand($command, self::MAX_DOWNLOAD_SIZE_BYTES);
         $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
 
         // Use array accumulation + implode for O(n) instead of O(n²) string concatenation
@@ -287,6 +309,11 @@ class GetLogs extends Component
         return sanitizeLogsForExport($allLogs);
     }
 
+    private function boundedLogCommand(string $command, int $maxBytes): string
+    {
+        return "({$command}) 2>&1 | head -c ".($maxBytes + 1);
+    }
+
     public function render()
     {
         return view('livewire.project.shared.get-logs');
diff --git a/app/Livewire/Server/Proxy/DynamicConfigurations.php b/app/Livewire/Server/Proxy/DynamicConfigurations.php
index f824645aa6..6351dace86 100644
--- a/app/Livewire/Server/Proxy/DynamicConfigurations.php
+++ b/app/Livewire/Server/Proxy/DynamicConfigurations.php
@@ -11,6 +11,12 @@ class DynamicConfigurations extends Component
 {
     use AuthorizesRequests;
 
+    public const MAX_CONFIGURATION_FILE_SIZE_BYTES = 1024 * 1024;
+
+    public const MAX_TOTAL_CONFIGURATION_SIZE_BYTES = 5 * 1024 * 1024;
+
+    public const MAX_CONFIGURATION_FILES = 100;
+
     public ?Server $server = null;
 
     public $parameters = [];
@@ -44,15 +50,36 @@ class DynamicConfigurations extends Component
             return handleError($e, $this);
         }
         $proxy_path = $this->server->proxyPath();
-        $files = instant_remote_process(["mkdir -p $proxy_path/dynamic && ls -1 {$proxy_path}/dynamic"], $this->server);
+        $fileLimit = self::MAX_CONFIGURATION_FILES + 1;
+        $files = instant_remote_process(["mkdir -p $proxy_path/dynamic && ls -1 {$proxy_path}/dynamic | head -n {$fileLimit}"], $this->server);
         $files = collect(explode("\n", $files))->filter(fn ($file) => ! empty($file));
         $files = $files->map(fn ($file) => trim($file));
         $files = $files->sort();
         $contents = collect([]);
-        foreach ($files as $file) {
+        $skippedFiles = collect([]);
+        $totalBytes = 0;
+        if ($files->count() > self::MAX_CONFIGURATION_FILES) {
+            $skippedFiles->push('additional files');
+        }
+        foreach ($files->take(self::MAX_CONFIGURATION_FILES) as $file) {
             $without_extension = str_replace('.', '|', $file);
-            $content = instant_remote_process(["cat {$proxy_path}/dynamic/{$file}"], $this->server);
-            $contents[$without_extension] = $content ?? '';
+            $filePath = escapeshellarg("{$proxy_path}/dynamic/{$file}");
+            $readLimit = self::MAX_CONFIGURATION_FILE_SIZE_BYTES + 1;
+            $content = instant_remote_process(["head -c {$readLimit} {$filePath}"], $this->server);
+            $content = $content ?? '';
+            $contentBytes = strlen($content);
+
+            if ($contentBytes > self::MAX_CONFIGURATION_FILE_SIZE_BYTES || $totalBytes + $contentBytes > self::MAX_TOTAL_CONFIGURATION_SIZE_BYTES) {
+                $skippedFiles->push($file);
+
+                continue;
+            }
+
+            $contents[$without_extension] = $content;
+            $totalBytes += $contentBytes;
+        }
+        if ($skippedFiles->isNotEmpty()) {
+            $this->dispatch('warning', 'Some dynamic configurations were not loaded because they exceed the safe display limits: '.$skippedFiles->implode(', '));
         }
         $this->contents = $contents;
         $this->dispatch('$refresh');
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 732142b0de..6f11027171 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -119,6 +119,8 @@ class Application extends BaseModel
 {
     use ClearsGlobalSearchCache, HasConfiguration, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
+    public const MAX_DOCKER_COMPOSE_SIZE_BYTES = 5 * 1024 * 1024;
+
     private static $parserVersion = '5';
 
     protected $fillable = [
@@ -1936,6 +1938,9 @@ class Application extends BaseModel
         $workdir = rtrim($this->base_directory, '/');
         $composeFile = $this->docker_compose_location;
         $fileList = collect([".$workdir$composeFile"]);
+        $composeFilePath = escapeshellarg(".$workdir$composeFile");
+        $composeReadLimit = self::MAX_DOCKER_COMPOSE_SIZE_BYTES + 1;
+        $readComposeFile = "if [ \"$(wc -c < {$composeFilePath})\" -gt ".self::MAX_DOCKER_COMPOSE_SIZE_BYTES." ]; then echo '__COOLIFY_COMPOSE_TOO_LARGE__'; else head -c {$composeReadLimit} {$composeFilePath}; fi";
         $gitRemoteStatus = $this->getGitRemoteStatus(deployment_uuid: $uuid);
         if (! $gitRemoteStatus['is_accessible']) {
             throw new RuntimeException('Failed to read Git source. Please verify repository access and try again.');
@@ -1966,7 +1971,7 @@ class Application extends BaseModel
                 'git sparse-checkout init',
                 "git sparse-checkout set {$fileList->implode(' ')}",
                 'git read-tree -mu HEAD',
-                "cat .$workdir$composeFile",
+                $readComposeFile,
             ]);
         } else {
             $commands = collect([
@@ -1978,11 +1983,14 @@ class Application extends BaseModel
                 'git sparse-checkout init --cone',
                 "git sparse-checkout set {$fileList->implode(' ')}",
                 'git read-tree -mu HEAD',
-                "cat .$workdir$composeFile",
+                $readComposeFile,
             ]);
         }
         try {
             $composeFileContent = instant_remote_process($commands, $this->destination->server);
+            if ($composeFileContent === '__COOLIFY_COMPOSE_TOO_LARGE__') {
+                throw new RuntimeException('Docker Compose file exceeds the 5 MiB size limit.');
+            }
         } catch (\Exception $e) {
             // Restore original values on failure only
             $this->docker_compose_location = $initialDockerComposeLocation;
@@ -1998,6 +2006,9 @@ class Application extends BaseModel
                 }
                 throw new RuntimeException('Repository does not exist. Please check your repository URL and try again.');
             }
+            if (str($e->getMessage())->contains('exceeds the 5 MiB size limit')) {
+                throw $e;
+            }
             throw new RuntimeException('Failed to read the Docker Compose file from the repository.');
         } finally {
             // Cleanup only - restoration happens in catch block
diff --git a/tests/Unit/RemoteOutputSizeLimitsTest.php b/tests/Unit/RemoteOutputSizeLimitsTest.php
new file mode 100644
index 0000000000..e010970bba
--- /dev/null
+++ b/tests/Unit/RemoteOutputSizeLimitsTest.php
@@ -0,0 +1,90 @@
+<?php
+
+use App\Actions\Proxy\GetProxyConfiguration;
+use App\Jobs\ScheduledTaskJob;
+use App\Livewire\Project\Shared\GetLogs;
+use App\Livewire\Server\Proxy\DynamicConfigurations;
+use App\Models\Application;
+
+function remoteOutputSource(string $path): string
+{
+    return file_get_contents(__DIR__.'/../../'.$path);
+}
+
+it('bounds dynamic proxy configuration files and their combined Livewire payload', function () {
+    $source = remoteOutputSource('app/Livewire/Server/Proxy/DynamicConfigurations.php');
+
+    expect($source)
+        ->toContain('MAX_CONFIGURATION_FILE_SIZE_BYTES')
+        ->toContain('MAX_TOTAL_CONFIGURATION_SIZE_BYTES')
+        ->toContain('MAX_CONFIGURATION_FILES')
+        ->toContain('head -c')
+        ->toContain('$totalBytes');
+
+    expect(DynamicConfigurations::MAX_CONFIGURATION_FILE_SIZE_BYTES)->toBe(1024 * 1024)
+        ->and(DynamicConfigurations::MAX_TOTAL_CONFIGURATION_SIZE_BYTES)->toBe(5 * 1024 * 1024)
+        ->and(DynamicConfigurations::MAX_CONFIGURATION_FILES)->toBe(100);
+});
+
+it('bounds regular log viewer output before it reaches PHP', function () {
+    $source = remoteOutputSource('app/Livewire/Project/Shared/GetLogs.php');
+
+    expect($source)
+        ->toContain('MAX_DISPLAY_SIZE_BYTES')
+        ->toContain('boundedLogCommand(')
+        ->toContain('[... Output truncated at');
+
+    $method = new ReflectionMethod(GetLogs::class, 'boundedLogCommand');
+    $command = $method->invoke(new GetLogs, 'docker logs example', 100);
+
+    expect(GetLogs::MAX_DISPLAY_SIZE_BYTES)->toBe(5 * 1024 * 1024)
+        ->and($command)->toBe('(docker logs example) 2>&1 | head -c 101');
+});
+
+it('bounds docker compose files loaded from git before parsing', function () {
+    $source = remoteOutputSource('app/Models/Application.php');
+
+    expect($source)
+        ->toContain('MAX_DOCKER_COMPOSE_SIZE_BYTES')
+        ->toContain('MAX_DOCKER_COMPOSE_SIZE_BYTES + 1')
+        ->toContain('head -c');
+
+    expect(Application::MAX_DOCKER_COMPOSE_SIZE_BYTES)->toBe(5 * 1024 * 1024);
+});
+
+it('bounds scheduled task output before storing or notifying', function () {
+    $source = remoteOutputSource('app/Jobs/ScheduledTaskJob.php');
+
+    expect($source)
+        ->toContain('MAX_OUTPUT_SIZE_BYTES')
+        ->toContain('head -c {$maxOutputBytes}')
+        ->toContain('[... Output truncated at');
+
+    $reflection = new ReflectionClass(ScheduledTaskJob::class);
+    $method = $reflection->getMethod('boundedTaskCommand');
+    $command = $method->invoke($reflection->newInstanceWithoutConstructor(), 'printf hello');
+    $failureCommand = $method->invoke($reflection->newInstanceWithoutConstructor(), "bash -c 'printf failure; exit 7'");
+    exec('bash -n -c '.escapeshellarg($command), $output, $exitCode);
+    exec('bash -c '.escapeshellarg($command), $commandOutput, $commandExitCode);
+    exec('bash -c '.escapeshellarg($failureCommand).' 2>&1', $failureOutput, $failureExitCode);
+
+    expect(ScheduledTaskJob::MAX_OUTPUT_SIZE_BYTES)->toBe(5 * 1024 * 1024)
+        ->and($command)->toContain('head -c 5242880')
+        ->and($exitCode)->toBe(0)
+        ->and($commandExitCode)->toBe(0)
+        ->and(implode("\n", $commandOutput))->toBe('hello')
+        ->and($failureExitCode)->toBe(7)
+        ->and(implode("\n", $failureOutput))->toBe('failure');
+});
+
+it('bounds proxy configuration backfill before storing it', function () {
+    $source = remoteOutputSource('app/Actions/Proxy/GetProxyConfiguration.php');
+
+    expect($source)
+        ->toContain('MAX_CONFIGURATION_SIZE_BYTES')
+        ->toContain('MAX_CONFIGURATION_SIZE_BYTES + 1')
+        ->toContain('head -c')
+        ->toContain('Proxy configuration exceeds');
+
+    expect(GetProxyConfiguration::MAX_CONFIGURATION_SIZE_BYTES)->toBe(5 * 1024 * 1024);
+});

From 60129c2c4701431a18c15fe4c7b40e4f8607c07c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 16 Jul 2026 16:02:51 +0200
Subject: [PATCH 03/42] fix: measure log size before ANSI strip; harden tasks
 and volumes

Truncate GetLogs against raw byte length, then strip ANSI colors.
Run scheduled-task docker exec with explicit sudo docker and no_sudo
to avoid double sudo rewriting on non-root servers. Mark git-based
file volumes as files before refreshing content from the server.
---
 app/Jobs/ScheduledTaskJob.php                 |  5 ++-
 app/Livewire/Project/Shared/GetLogs.php       | 15 ++++---
 bootstrap/helpers/services.php                |  5 +--
 tests/Feature/GetLogsCommandInjectionTest.php | 41 ++++++++++++++++++-
 tests/Unit/LocalFileVolumeContentSizeTest.php | 11 +++++
 tests/Unit/RemoteOutputSizeLimitsTest.php     | 20 +++++++++
 6 files changed, 83 insertions(+), 14 deletions(-)

diff --git a/app/Jobs/ScheduledTaskJob.php b/app/Jobs/ScheduledTaskJob.php
index 02f3daa3b4..d24f36350b 100644
--- a/app/Jobs/ScheduledTaskJob.php
+++ b/app/Jobs/ScheduledTaskJob.php
@@ -150,11 +150,12 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
             foreach ($this->containers as $containerName) {
                 if (count($this->containers) == 1 || str_starts_with($containerName, $this->task->container.'-'.$this->resource->uuid)) {
                     $cmd = "sh -c '".str_replace("'", "'\''", $this->task->command)."'";
-                    $execCommand = "docker exec {$containerName} {$cmd}";
+                    $dockerCommand = $this->server->isNonRoot() ? 'sudo docker' : 'docker';
+                    $execCommand = "{$dockerCommand} exec {$containerName} {$cmd}";
                     $exec = $this->boundedTaskCommand($execCommand);
                     // Disable SSH multiplexing to prevent race conditions when multiple tasks run concurrently
                     // See: https://github.com/coollabsio/coolify/issues/6736
-                    $this->task_output = instant_remote_process([$exec], $this->server, true, false, $this->timeout, disableMultiplexing: true);
+                    $this->task_output = instant_remote_process([$exec], $this->server, throwError: true, no_sudo: true, timeout: $this->timeout, disableMultiplexing: true);
                     $this->task_log->update([
                         'status' => 'success',
                         'message' => $this->task_output,
diff --git a/app/Livewire/Project/Shared/GetLogs.php b/app/Livewire/Project/Shared/GetLogs.php
index fa575073f7..67a040ef77 100644
--- a/app/Livewire/Project/Shared/GetLogs.php
+++ b/app/Livewire/Project/Shared/GetLogs.php
@@ -192,17 +192,17 @@ class GetLogs extends Component
                     return;
                 }
 
-                $output = removeAnsiColors($output);
                 $remainingBytes = self::MAX_DISPLAY_SIZE_BYTES - $accumulatedBytes;
-                if (strlen($output) > $remainingBytes) {
-                    $logChunks[] = substr($output, 0, max(0, $remainingBytes));
+                $outputBytes = strlen($output);
+                if ($outputBytes > $remainingBytes) {
+                    $logChunks[] = removeAnsiColors(substr($output, 0, max(0, $remainingBytes)));
                     $truncated = true;
 
                     return;
                 }
 
-                $logChunks[] = $output;
-                $accumulatedBytes += strlen($output);
+                $logChunks[] = removeAnsiColors($output);
+                $accumulatedBytes += $outputBytes;
             });
             $newOutputs = implode('', $logChunks);
 
@@ -274,20 +274,19 @@ class GetLogs extends Component
                 return;
             }
 
-            $output = removeAnsiColors($output);
             $outputBytes = strlen($output);
 
             if ($accumulatedBytes + $outputBytes > self::MAX_DOWNLOAD_SIZE_BYTES) {
                 $remaining = self::MAX_DOWNLOAD_SIZE_BYTES - $accumulatedBytes;
                 if ($remaining > 0) {
-                    $logChunks[] = substr($output, 0, $remaining);
+                    $logChunks[] = removeAnsiColors(substr($output, 0, $remaining));
                 }
                 $truncated = true;
 
                 return;
             }
 
-            $logChunks[] = $output;
+            $logChunks[] = removeAnsiColors($output);
             $accumulatedBytes += $outputBytes;
         });
 
diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index e46769a15c..05430930b7 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -167,11 +167,10 @@ function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Appli
             $isDir = instant_remote_process(["test -d $fileLocation && echo OK || echo NOK"], $server);
 
             if ($isFile === 'OK') {
+                $fileVolume->is_directory = false;
+                $fileVolume->save();
                 if ($fileVolume->is_based_on_git) {
                     $fileVolume->loadStorageOnServer();
-                } else {
-                    $fileVolume->is_directory = false;
-                    $fileVolume->save();
                 }
             } elseif ($isDir === 'OK') {
                 // If its a directory & exists
diff --git a/tests/Feature/GetLogsCommandInjectionTest.php b/tests/Feature/GetLogsCommandInjectionTest.php
index db75f7b757..c920b94ede 100644
--- a/tests/Feature/GetLogsCommandInjectionTest.php
+++ b/tests/Feature/GetLogsCommandInjectionTest.php
@@ -3,6 +3,7 @@
 use App\Livewire\Project\Shared\GetLogs;
 use App\Models\Application;
 use App\Models\Environment;
+use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
@@ -10,6 +11,8 @@ use App\Models\Team;
 use App\Models\User;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Process\FakeProcessResult;
+use Illuminate\Support\Facades\Process;
 use Livewire\Attributes\Locked;
 use Livewire\Livewire;
 
@@ -20,7 +23,11 @@ beforeEach(function () {
     $this->team = Team::factory()->create();
     $this->user->teams()->attach($this->team, ['role' => 'owner']);
 
-    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
     // Server::created auto-creates a StandaloneDocker, reuse it
     $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
     $this->project = Project::factory()->create(['team_id' => $this->team->id]);
@@ -67,6 +74,38 @@ describe('GetLogs locked properties', function () {
 });
 
 describe('GetLogs Livewire action validation', function () {
+    test('getLogs marks ANSI-colored output truncated based on raw bytes', function () {
+        $this->server->settings->fill([
+            'is_reachable' => true,
+            'is_usable' => true,
+            'force_disabled' => false,
+        ])->save();
+        $server = Server::with('settings')->find($this->server->id);
+        $output = "\e[31m".str_repeat('a', GetLogs::MAX_DISPLAY_SIZE_BYTES - 4);
+
+        expect(strlen($output))->toBe(GetLogs::MAX_DISPLAY_SIZE_BYTES + 1);
+
+        Process::shouldReceive('timeout')->once()->andReturnSelf();
+        Process::shouldReceive('run')->andReturnUsing(function (string $command, ?callable $callback = null) use ($output): FakeProcessResult {
+            if ($callback) {
+                $callback('out', $output);
+            }
+
+            return new FakeProcessResult(command: $command);
+        });
+
+        $component = new GetLogs;
+        $component->server = $server;
+        $component->resource = $this->application;
+        $component->container = 'test-container';
+        $component->showTimeStamps = false;
+        $component->getLogs(true);
+
+        expect($component->outputs)
+            ->toContain('[... Output truncated at 5MB limit ...]')
+            ->not->toContain("\e[31m");
+    });
+
     test('getLogs rejects invalid container name', function () {
         // Make server functional by setting settings directly
         $this->server->settings->fill([
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
index 0ad69e28aa..1954539785 100644
--- a/tests/Unit/LocalFileVolumeContentSizeTest.php
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -77,3 +77,14 @@ it('does not read regular bind-mounted file contents while loading service setti
         ->toContain('if ($fileVolume->is_based_on_git)')
         ->toContain('$fileVolume->loadStorageOnServer();');
 });
+
+it('marks git-based file volumes as files before refreshing their content', function () {
+    $helpers = file_get_contents(base_path('bootstrap/helpers/services.php'));
+    $fileBranch = str($helpers)
+        ->after("if (\$isFile === 'OK') {")
+        ->before("} elseif (\$isDir === 'OK') {");
+
+    expect($fileBranch->value())->toMatch(
+        '/\$fileVolume->is_directory = false;\s+\$fileVolume->save\(\);\s+if \(\$fileVolume->is_based_on_git\) \{/'
+    );
+});
diff --git a/tests/Unit/RemoteOutputSizeLimitsTest.php b/tests/Unit/RemoteOutputSizeLimitsTest.php
index e010970bba..b8341dd73f 100644
--- a/tests/Unit/RemoteOutputSizeLimitsTest.php
+++ b/tests/Unit/RemoteOutputSizeLimitsTest.php
@@ -5,6 +5,7 @@ use App\Jobs\ScheduledTaskJob;
 use App\Livewire\Project\Shared\GetLogs;
 use App\Livewire\Server\Proxy\DynamicConfigurations;
 use App\Models\Application;
+use App\Models\Server;
 
 function remoteOutputSource(string $path): string
 {
@@ -77,6 +78,25 @@ it('bounds scheduled task output before storing or notifying', function () {
         ->and(implode("\n", $failureOutput))->toBe('failure');
 });
 
+it('does not pass the scheduled task output wrapper through the sudo rewriter', function () {
+    $source = remoteOutputSource('app/Jobs/ScheduledTaskJob.php');
+    $reflection = new ReflectionClass(ScheduledTaskJob::class);
+    $method = $reflection->getMethod('boundedTaskCommand');
+    $command = $method->invoke($reflection->newInstanceWithoutConstructor(), 'sudo docker exec example true');
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+    $rewrittenCommand = parseCommandsByLineForSudo(collect([$command]), $server)[0];
+
+    exec('bash -n -c '.escapeshellarg($command), $output, $exitCode);
+    exec('bash -n -c '.escapeshellarg($rewrittenCommand).' 2>/dev/null', $rewrittenOutput, $rewrittenExitCode);
+
+    expect($source)
+        ->toContain("\$dockerCommand = \$this->server->isNonRoot() ? 'sudo docker' : 'docker'")
+        ->toContain('instant_remote_process([$exec], $this->server, throwError: true, no_sudo: true')
+        ->and($exitCode)->toBe(0)
+        ->and($rewrittenExitCode)->not->toBe(0);
+});
+
 it('bounds proxy configuration backfill before storing it', function () {
     $source = remoteOutputSource('app/Actions/Proxy/GetProxyConfiguration.php');
 

From 49c8f6cb5d1850fd9c49b59f1f06f359ea0172de Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 13 Aug 2026 11:31:26 +0200
Subject: [PATCH 04/42] fix: cap remote file and task reads after size-check
 races

Read local file volumes with a bounded head instead of cat so a file that grows after the size check cannot be fully slurped into PHP memory. Treat oversized bounded reads as too large and skip binary detection on that placeholder. For scheduled tasks, read one extra byte, then truncate and append the 5MB notice instead of relying on a one-byte peek.
---
 app/Jobs/ScheduledTaskJob.php                 |  3 +-
 app/Models/LocalFileVolume.php                | 27 ++++++++++++--
 tests/Unit/LocalFileVolumeContentSizeTest.php | 35 +++++++++++++++++++
 tests/Unit/RemoteOutputSizeLimitsTest.php     | 18 ++++++++--
 4 files changed, 77 insertions(+), 6 deletions(-)

diff --git a/app/Jobs/ScheduledTaskJob.php b/app/Jobs/ScheduledTaskJob.php
index d24f36350b..f7bd5f933d 100644
--- a/app/Jobs/ScheduledTaskJob.php
+++ b/app/Jobs/ScheduledTaskJob.php
@@ -211,8 +211,9 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
     private function boundedTaskCommand(string $command): string
     {
         $maxOutputBytes = self::MAX_OUTPUT_SIZE_BYTES;
+        $readLimit = $maxOutputBytes + 1;
 
-        return "output_file=\$(mktemp); trap 'rm -f \"\$output_file\"' EXIT; set +e; set -o pipefail; {$command} 2>&1 | { head -c {$maxOutputBytes} > \"\$output_file\"; if IFS= read -r -n 1 extra_byte; then printf '\n\n[... Output truncated at 5MB limit ...]' >> \"\$output_file\"; fi; cat > /dev/null; }; exit_code=\${PIPESTATUS[0]}; if [ \"\$exit_code\" -eq 0 ]; then cat \"\$output_file\"; else cat \"\$output_file\" >&2; fi; exit \$exit_code";
+        return "output_file=\$(mktemp); trap 'rm -f \"\$output_file\"' EXIT; set +e; set -o pipefail; {$command} 2>&1 | { head -c {$readLimit} > \"\$output_file\"; cat > /dev/null; }; exit_code=\${PIPESTATUS[0]}; if [ \"\$(wc -c < \"\$output_file\")\" -gt {$maxOutputBytes} ]; then truncate -s {$maxOutputBytes} \"\$output_file\"; printf '\n\n[... Output truncated at 5MB limit ...]' >> \"\$output_file\"; fi; if [ \"\$exit_code\" -eq 0 ]; then cat \"\$output_file\"; else cat \"\$output_file\" >&2; fi; exit \$exit_code";
     }
 
     /**
diff --git a/app/Models/LocalFileVolume.php b/app/Models/LocalFileVolume.php
index 968e6c3d04..6b0124cb97 100644
--- a/app/Models/LocalFileVolume.php
+++ b/app/Models/LocalFileVolume.php
@@ -113,9 +113,9 @@ class LocalFileVolume extends BaseModel
 
                 return;
             }
-            $content = instant_remote_process(["cat {$escapedPath}"], $server, false);
+            $content = $this->readRemoteFileContent($escapedPath, $server);
             // Check if content contains binary data by looking for null bytes or non-printable characters
-            if (str_contains($content, "\0") || preg_match('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', $content)) {
+            if ($content !== self::TOO_LARGE_PLACEHOLDER && (str_contains($content, "\0") || preg_match('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', $content))) {
                 $content = self::BINARY_PLACEHOLDER;
             }
             $this->content = $content;
@@ -136,6 +136,27 @@ class LocalFileVolume extends BaseModel
         return $size > self::MAX_CONTENT_SIZE;
     }
 
+    /**
+     * Cap the remote read itself so a file that grows after the size check
+     * cannot be fully slurped into PHP memory.
+     */
+    protected function readRemoteFileContent(string $escapedPath, $server): string
+    {
+        $readLimit = self::MAX_CONTENT_SIZE + 1;
+        $content = instant_remote_process(["head -c {$readLimit} {$escapedPath}"], $server, false);
+
+        return self::contentFromBoundedRead($content);
+    }
+
+    public static function contentFromBoundedRead(?string $content): string
+    {
+        if (strlen((string) $content) > self::MAX_CONTENT_SIZE) {
+            return self::TOO_LARGE_PLACEHOLDER;
+        }
+
+        return (string) $content;
+    }
+
     public function deleteStorageOnServer()
     {
         if ($this->is_host_file) {
@@ -228,7 +249,7 @@ class LocalFileVolume extends BaseModel
             if ($this->remoteFileExceedsLimit($escapedPath, $server)) {
                 $this->content = self::TOO_LARGE_PLACEHOLDER;
             } else {
-                $this->content = instant_remote_process(["cat {$escapedPath}"], $server, false);
+                $this->content = $this->readRemoteFileContent($escapedPath, $server);
             }
             $this->is_directory = false;
             $this->save();
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
index 1954539785..1894bf4394 100644
--- a/tests/Unit/LocalFileVolumeContentSizeTest.php
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -88,3 +88,38 @@ it('marks git-based file volumes as files before refreshing their content', func
         '/\$fileVolume->is_directory = false;\s+\$fileVolume->save\(\);\s+if \(\$fileVolume->is_based_on_git\) \{/'
     );
 });
+
+it('bounds the remote file read itself to prevent a size-check race', function () {
+    $source = file_get_contents(app_path('Models/LocalFileVolume.php'));
+    $loadStorage = str($source)
+        ->after('public function loadStorageOnServer()')
+        ->before('public function deleteStorageOnServer()');
+
+    expect($loadStorage->value())
+        ->toContain('head -c')
+        ->not->toContain('instant_remote_process(["cat {$escapedPath}"]');
+});
+
+it('bounds directory-to-file conflict reads the same way', function () {
+    $source = file_get_contents(app_path('Models/LocalFileVolume.php'));
+    $saveStorage = str($source)
+        ->after('public function saveStorageOnServer()')
+        ->before('protected function plainMountPath');
+
+    expect($saveStorage->value())
+        ->not->toContain('instant_remote_process(["cat {$escapedPath}"]');
+});
+
+it('treats a bounded remote read that exceeds the limit as too large', function () {
+    $oversized = str_repeat('a', LocalFileVolume::MAX_CONTENT_SIZE + 1);
+
+    expect(LocalFileVolume::contentFromBoundedRead($oversized))
+        ->toBe(LocalFileVolume::TOO_LARGE_PLACEHOLDER);
+});
+
+it('keeps a bounded remote read that fits the limit', function () {
+    expect(LocalFileVolume::contentFromBoundedRead('hello'))
+        ->toBe('hello')
+        ->and(LocalFileVolume::contentFromBoundedRead(null))
+        ->toBe('');
+});
diff --git a/tests/Unit/RemoteOutputSizeLimitsTest.php b/tests/Unit/RemoteOutputSizeLimitsTest.php
index b8341dd73f..3660e88284 100644
--- a/tests/Unit/RemoteOutputSizeLimitsTest.php
+++ b/tests/Unit/RemoteOutputSizeLimitsTest.php
@@ -58,7 +58,7 @@ it('bounds scheduled task output before storing or notifying', function () {
 
     expect($source)
         ->toContain('MAX_OUTPUT_SIZE_BYTES')
-        ->toContain('head -c {$maxOutputBytes}')
+        ->toContain('head -c {$readLimit}')
         ->toContain('[... Output truncated at');
 
     $reflection = new ReflectionClass(ScheduledTaskJob::class);
@@ -70,7 +70,7 @@ it('bounds scheduled task output before storing or notifying', function () {
     exec('bash -c '.escapeshellarg($failureCommand).' 2>&1', $failureOutput, $failureExitCode);
 
     expect(ScheduledTaskJob::MAX_OUTPUT_SIZE_BYTES)->toBe(5 * 1024 * 1024)
-        ->and($command)->toContain('head -c 5242880')
+        ->and($command)->toContain('head -c 5242881')
         ->and($exitCode)->toBe(0)
         ->and($commandExitCode)->toBe(0)
         ->and(implode("\n", $commandOutput))->toBe('hello')
@@ -78,6 +78,20 @@ it('bounds scheduled task output before storing or notifying', function () {
         ->and(implode("\n", $failureOutput))->toBe('failure');
 });
 
+it('marks scheduled task output that exceeds the limit as truncated', function () {
+    $reflection = new ReflectionClass(ScheduledTaskJob::class);
+    $method = $reflection->getMethod('boundedTaskCommand');
+    $largeOutputCommand = 'head -c '.(ScheduledTaskJob::MAX_OUTPUT_SIZE_BYTES + 1).' /dev/zero | tr "\\0" "x"';
+    $command = $method->invoke($reflection->newInstanceWithoutConstructor(), $largeOutputCommand);
+
+    exec('bash -c '.escapeshellarg($command), $output, $exitCode);
+    $taskOutput = implode("\n", $output);
+
+    expect($exitCode)->toBe(0)
+        ->and(strlen($taskOutput))->toBeGreaterThan(ScheduledTaskJob::MAX_OUTPUT_SIZE_BYTES)
+        ->and($taskOutput)->toEndWith('[... Output truncated at 5MB limit ...]');
+});
+
 it('does not pass the scheduled task output wrapper through the sudo rewriter', function () {
     $source = remoteOutputSource('app/Jobs/ScheduledTaskJob.php');
     $reflection = new ReflectionClass(ScheduledTaskJob::class);

From 20a627ffe6f84f48643cacfb4d6a1b6ba03e0316 Mon Sep 17 00:00:00 2001
From: MarkosTech <markostechbusiness@gmail.com>
Date: Sun, 16 Aug 2026 13:14:28 +0200
Subject: [PATCH 05/42] fix(databases): redirect stdin for the SSL cert chown

Remote command lists are piped into `bash -se`, so the script sits on
stdin. `docker compose run` attaches stdin and eats the rest of it,
including the `docker compose up -d` that follows. The container is
removed and never recreated, and bash exits 0, so the deploy reports
success.

`-T` does not help, it does not detach stdin.

Affects MongoDB, MySQL, MariaDB and PostgreSQL when enable_ssl is set.
---
 app/Actions/Database/StartMariadb.php    | 2 +-
 app/Actions/Database/StartMongodb.php    | 2 +-
 app/Actions/Database/StartMysql.php      | 2 +-
 app/Actions/Database/StartPostgresql.php | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index f44008085c..c4f98cfdfe 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -211,7 +211,7 @@ class StartMariadb
         $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
-            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt";
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
         }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index b31251ce20..0f9bba6797 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -260,7 +260,7 @@ class StartMongodb
         $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
-            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mongodb:mongodb /etc/mongo/certs/server.pem";
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mongodb:mongodb /etc/mongo/certs/server.pem < /dev/null";
         }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index 16b8e15856..3eab004643 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -212,7 +212,7 @@ class StartMysql
         $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
-            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt";
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
         }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
 
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 3b0f820df3..21cb278fbb 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -222,7 +222,7 @@ class StartPostgresql
         $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
-            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name postgres:postgres /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt";
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name postgres:postgres /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt < /dev/null";
         }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

From 70b9acc42467278373e00de77abb40684e25b395 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 16 Aug 2026 23:48:25 +0200
Subject: [PATCH 06/42] fix(ui): position table dropdowns outside overflowing
 containers

Update Coolify release metadata to version 4.3.7 and nightly 4.3.8.
---
 config/constants.php                          |  2 +-
 other/nightly/versions.json                   |  4 +--
 .../views/components/table/dropdown.blade.php | 31 ++++++++++++++++---
 tests/Feature/StandardTableComponentsTest.php |  4 +--
 tests/Feature/TablePaginationLoadingTest.php  | 14 +++++++++
 tests/Unit/ProductionImageWorkflowTest.php    |  6 ++--
 versions.json                                 |  4 +--
 7 files changed, 51 insertions(+), 14 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 1e6395df8b..76e34334c2 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.6',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.7',
         'helper_version' => '1.0.15',
         'realtime_version' => '1.0.17',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index e32d035c55..2f449eed8c 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.6"
+            "version": "4.3.7"
         },
         "nightly": {
-            "version": "4.3.7"
+            "version": "4.3.8"
         },
         "helper": {
             "version": "1.0.15"
diff --git a/resources/views/components/table/dropdown.blade.php b/resources/views/components/table/dropdown.blade.php
index e236bff305..6a0472191e 100644
--- a/resources/views/components/table/dropdown.blade.php
+++ b/resources/views/components/table/dropdown.blade.php
@@ -4,13 +4,36 @@
     'multiselectable' => false,
 ])
 
-<div class="relative" x-data="{ open: false }" @click.outside="open = false" @keydown.escape.window="open = false">
-    <div @click="open = !open">
+<div class="relative" x-data="{
+    open: false,
+    panelStyle: 'display: none;',
+    toggle() {
+        this.open = !this.open;
+
+        if (this.open) {
+            this.$nextTick(() => this.updatePosition());
+        }
+    },
+    updatePosition() {
+        const trigger = this.$refs.trigger.getBoundingClientRect();
+        const panel = this.$refs.panel.getBoundingClientRect();
+        const viewportPadding = 8;
+        const left = Math.max(viewportPadding, Math.min(trigger.right - panel.width, window.innerWidth - panel.width - viewportPadding));
+        const spaceBelow = window.innerHeight - trigger.bottom - viewportPadding;
+        const top = spaceBelow >= panel.height
+            ? trigger.bottom + 4
+            : Math.max(viewportPadding, trigger.top - panel.height - 4);
+
+        this.panelStyle = `position: fixed; left: ${left}px; top: ${top}px;`;
+    }
+}" @click.outside="open = false" @keydown.escape.window="open = false"
+    x-on:resize.window="if (open) updatePosition()" x-on:scroll.window="if (open) updatePosition()">
+    <div x-ref="trigger" @click="toggle()">
         {{ $trigger }}
     </div>
 
-    <div x-show="open" x-cloak
-        class="listbox-panel absolute top-full! right-0! left-auto! mt-1! {{ $panelClass }}" role="{{ $role }}"
+    <div x-ref="panel" x-show="open" x-cloak :style="panelStyle"
+        class="listbox-panel fixed! top-auto! right-auto! bottom-auto! z-[90]! mt-0! {{ $panelClass }}" role="{{ $role }}"
         @if ($multiselectable) aria-multiselectable="true" @endif>
         {{ $slot }}
     </div>
diff --git a/tests/Feature/StandardTableComponentsTest.php b/tests/Feature/StandardTableComponentsTest.php
index 684234518f..28f07a9a2f 100644
--- a/tests/Feature/StandardTableComponentsTest.php
+++ b/tests/Feature/StandardTableComponentsTest.php
@@ -24,8 +24,8 @@ it('renders the standard table toolbar controls', function () {
         ->toContain('wire:model.live="search"')
         ->not->toContain('x-teleport="body"')
         ->not->toContain('floatingDropdown(')
-        ->not->toContain('position: fixed')
-        ->toContain('absolute top-full')
+        ->toContain('position: fixed')
+        ->toContain('getBoundingClientRect()')
         ->toContain('x-show="open"')
         ->toContain('aria-multiselectable="true"')
         ->toContain('Reset filters')
diff --git a/tests/Feature/TablePaginationLoadingTest.php b/tests/Feature/TablePaginationLoadingTest.php
index f6e5f5a81a..d26a1a33da 100644
--- a/tests/Feature/TablePaginationLoadingTest.php
+++ b/tests/Feature/TablePaginationLoadingTest.php
@@ -30,6 +30,20 @@ it('renders the shared page size selector', function () {
         ->toContain('max="100"');
 });
 
+it('positions table dropdown panels outside overflowing containers', function () {
+    $html = Blade::render(<<<'BLADE'
+        <x-table.dropdown>
+            <x-slot:trigger><button type="button">Open</button></x-slot:trigger>
+            <button type="button">Option</button>
+        </x-table.dropdown>
+    BLADE);
+
+    expect($html)
+        ->toContain('position: fixed')
+        ->toContain('getBoundingClientRect()')
+        ->toContain('x-on:scroll.window');
+});
+
 it('renders compact client-side pagination', function () {
     $html = Blade::render('<x-client-pagination summary="1-10 of 20" page-size-model="pageSize" storage-key="tests.page-size" />');
 
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index c7d1229d2f..754eca1c30 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,9 +23,9 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.6'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.6')
-        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.7')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.7'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.7')
+        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.8')
         ->and($nightlyVersions)->toBe($versions);
 });
 
diff --git a/versions.json b/versions.json
index e32d035c55..2f449eed8c 100644
--- a/versions.json
+++ b/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.6"
+            "version": "4.3.7"
         },
         "nightly": {
-            "version": "4.3.7"
+            "version": "4.3.8"
         },
         "helper": {
             "version": "1.0.15"

From 5872cc095cd2de92ab92466d646e51bd1bf76440 Mon Sep 17 00:00:00 2001
From: Dion VH <91065539+dionvanhecke@users.noreply.github.com>
Date: Mon, 17 Aug 2026 12:07:12 +0200
Subject: [PATCH 07/42] fix(docker): docker cleanup correctly checks the
 coolify.managed label (#8831)

---
 app/Actions/Server/CleanupDocker.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Actions/Server/CleanupDocker.php b/app/Actions/Server/CleanupDocker.php
index e065161886..04fe00ad48 100644
--- a/app/Actions/Server/CleanupDocker.php
+++ b/app/Actions/Server/CleanupDocker.php
@@ -131,7 +131,7 @@ class CleanupDocker
 
         $commands[] = "docker images --format '{{.Repository}}:{{.Tag}}' | ".
             $grepCommands.' | '.
-            "xargs -r -I {} sh -c 'docker inspect --format \"{{{{index .Config.Labels \\\"coolify.managed\\\"}}}}\" \"{}\" 2>/dev/null | grep -q true || docker rmi \"{}\" 2>/dev/null' || true";
+            "xargs -r -I {} sh -c 'docker inspect --format \"{{index .Config.Labels \\\"coolify.managed\\\"}}\" \"{}\" 2>/dev/null | grep -q true || docker rmi \"{}\" 2>/dev/null' || true";
 
         return implode(' && ', $commands);
     }

From 282227b238c1958a01721cb935da09761099db0a Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:05:21 +0200
Subject: [PATCH 08/42] fix(domains): preserve ports in split URL inputs
 (#11328)

---
 app/Livewire/Project/Application/Domains.php  | 34 ++++++++++
 app/Livewire/Project/Service/Domains.php      | 35 ++++++++++
 app/Livewire/Storage/Create.php               | 13 ++++
 app/Livewire/Storage/Form.php                 | 18 +++++
 .../components/forms/domain-input.blade.php   | 67 ++++---------------
 .../views/components/forms/listbox.blade.php  |  5 +-
 .../project/application/domains.blade.php     | 31 ++-------
 .../application/partials/domain-row.blade.php |  7 +-
 .../project/service/domains.blade.php         | 30 ++-------
 .../service/partials/domain-table.blade.php   |  8 +--
 .../views/livewire/storage/create.blade.php   |  2 +-
 .../views/livewire/storage/form.blade.php     |  2 +-
 tests/Feature/ApplicationDomainsTest.php      | 24 +++++--
 .../Feature/ListboxTriggerTruncationTest.php  |  9 +++
 tests/Feature/ServiceDomainsTest.php          |  4 +-
 tests/Feature/SplitUrlInputTest.php           | 50 +++++---------
 .../S3StorageEndpointNormalizationTest.php    |  4 +-
 17 files changed, 182 insertions(+), 161 deletions(-)

diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 9ddd5e740e..477abc08e6 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -6,6 +6,7 @@ use App\Livewire\Concerns\InteractsWithCloudflareDomainConnect;
 use App\Livewire\Project\Shared\ConfigurationChecker;
 use App\Models\Application;
 use App\Models\Server;
+use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
@@ -35,12 +36,20 @@ class Domains extends Component
 
     public string $newDomain = '';
 
+    public array $newDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $newDomainPartsChanged = false;
+
     public ?string $newDomainService = null;
 
     public ?int $editingIndex = null;
 
     public string $editingDomain = '';
 
+    public array $editingDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $editingDomainPartsChanged = false;
+
     public ?string $editingService = null;
 
     /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool}> */
@@ -662,6 +671,12 @@ class Domains extends Component
         $this->resetAddDomainDnsGate();
     }
 
+    public function updatedNewDomainParts(): void
+    {
+        $this->newDomainPartsChanged = true;
+        $this->resetAddDomainDnsGate();
+    }
+
     public function updatedNewDomainService(): void
     {
         $this->resetAddDomainDnsGate();
@@ -677,6 +692,8 @@ class Domains extends Component
     public function resetAddDomainForm(): void
     {
         $this->newDomain = '';
+        $this->newDomainParts = DomainUrlParts::empty();
+        $this->newDomainPartsChanged = false;
         $this->resetAddDomainDnsGate();
         $this->resetErrorBag('newDomain');
     }
@@ -743,6 +760,9 @@ class Domains extends Component
                 return;
             }
 
+            if ($this->newDomainPartsChanged) {
+                $this->newDomain = DomainUrlParts::compose(...$this->newDomainParts);
+            }
             $this->validateOnly('newDomain');
 
             $normalized = ValidationPatterns::normalizeApplicationDomains($this->newDomain);
@@ -893,6 +913,12 @@ class Domains extends Component
         $this->resetEditDomainDnsGate();
     }
 
+    public function updatedEditingDomainParts(): void
+    {
+        $this->editingDomainPartsChanged = true;
+        $this->resetEditDomainDnsGate();
+    }
+
     public function resetEditDomainDnsGate(): void
     {
         $this->editDomainDnsFailed = false;
@@ -908,10 +934,13 @@ class Domains extends Component
 
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
+        $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $this->editingDomainPartsChanged = false;
         $this->editingService = $this->domainRows[$index]['service'];
         $this->resetEditDomainDnsGate();
         $this->resetErrorBag('editingDomain');
         $this->showEditDomainModal = true;
+        $this->dispatch('open-edit-domain');
     }
 
     public function addSuggestedDomain(int $index): void
@@ -990,6 +1019,8 @@ class Domains extends Component
         $this->showEditDomainModal = false;
         $this->editingIndex = null;
         $this->editingDomain = '';
+        $this->editingDomainParts = DomainUrlParts::empty();
+        $this->editingDomainPartsChanged = false;
         $this->editingService = null;
         $this->resetEditDomainDnsGate();
         $this->resetErrorBag('editingDomain');
@@ -1021,6 +1052,9 @@ class Domains extends Component
                 return;
             }
 
+            if ($this->editingDomainPartsChanged) {
+                $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
+            }
             $this->validateOnly('editingDomain');
 
             $normalized = ValidationPatterns::normalizeApplicationDomains($this->editingDomain);
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index a5479ca069..ad31560b5a 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -43,10 +43,18 @@ class Domains extends Component
 
     public string $newDomain = '';
 
+    public array $newDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $newDomainPartsChanged = false;
+
     public ?int $editingIndex = null;
 
     public string $editingDomain = '';
 
+    public array $editingDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $editingDomainPartsChanged = false;
+
     public ?int $editingServiceApplicationId = null;
 
     public bool $showEditDomainModal = false;
@@ -515,6 +523,12 @@ class Domains extends Component
         $this->forceSaveDns = false;
     }
 
+    public function updatedNewDomainParts(): void
+    {
+        $this->newDomainPartsChanged = true;
+        $this->resetAddDomainDnsGate();
+    }
+
     public function updatedEditingDomain(): void
     {
         $this->editDomainDnsFailed = false;
@@ -522,6 +536,12 @@ class Domains extends Component
         $this->forceSaveEditDns = false;
     }
 
+    public function updatedEditingDomainParts(): void
+    {
+        $this->editingDomainPartsChanged = true;
+        $this->updatedEditingDomain();
+    }
+
     public function confirmAddDomainDespiteDns(): void
     {
         $this->forceSaveDns = true;
@@ -842,6 +862,9 @@ class Domains extends Component
     {
         try {
             $this->authorize('update', $this->service);
+            if ($this->newDomainPartsChanged) {
+                $this->newDomain = DomainUrlParts::compose(...$this->newDomainParts);
+            }
             $this->validateOnly('newDomain');
 
             $app = $this->findServiceApp($this->newServiceApplicationId);
@@ -893,6 +916,8 @@ class Domains extends Component
             }
 
             $this->newDomain = '';
+            $this->newDomainParts = DomainUrlParts::empty();
+            $this->newDomainPartsChanged = false;
             $this->addDomainDnsFailed = false;
             $this->addDomainDnsMessage = '';
             $this->forceSaveDns = false;
@@ -916,12 +941,15 @@ class Domains extends Component
 
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
+        $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $this->editingDomainPartsChanged = false;
         $this->editingServiceApplicationId = (int) $this->domainRows[$index]['service_application_id'];
         $this->editDomainDnsFailed = false;
         $this->editDomainDnsMessage = '';
         $this->forceSaveEditDns = false;
         $this->resetErrorBag('editingDomain');
         $this->showEditDomainModal = true;
+        $this->dispatch('open-edit-domain');
     }
 
     public function cancelEdit(): void
@@ -929,6 +957,8 @@ class Domains extends Component
         $this->showEditDomainModal = false;
         $this->editingIndex = null;
         $this->editingDomain = '';
+        $this->editingDomainParts = DomainUrlParts::empty();
+        $this->editingDomainPartsChanged = false;
         $this->editingServiceApplicationId = null;
         $this->editDomainDnsFailed = false;
         $this->editDomainDnsMessage = '';
@@ -945,6 +975,9 @@ class Domains extends Component
                 return;
             }
 
+            if ($this->editingDomainPartsChanged) {
+                $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
+            }
             $this->validateOnly('editingDomain');
 
             $app = $this->findServiceApp($this->editingServiceApplicationId);
@@ -1130,6 +1163,8 @@ class Domains extends Component
             }
 
             $this->newDomain = $domain;
+            $this->newDomainParts = DomainUrlParts::split($domain);
+            $this->newDomainPartsChanged = true;
             $this->updatedNewDomain();
         } catch (\Throwable $e) {
             handleError($e, $this);
diff --git a/app/Livewire/Storage/Create.php b/app/Livewire/Storage/Create.php
index d741e69180..9e22e5491e 100644
--- a/app/Livewire/Storage/Create.php
+++ b/app/Livewire/Storage/Create.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Storage;
 use App\Models\S3Storage;
 use App\Rules\SafeWebhookUrl;
 use App\Rules\ValidS3BucketName;
+use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Uri;
@@ -28,6 +29,10 @@ class Create extends Component
 
     public string $endpoint = '';
 
+    public array $endpointParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $endpointPartsChanged = false;
+
     public S3Storage $storage;
 
     protected function rules(): array
@@ -76,6 +81,9 @@ class Create extends Component
         try {
             $this->authorize('create', S3Storage::class);
 
+            if ($this->endpointPartsChanged) {
+                $this->endpoint = DomainUrlParts::compose(...$this->endpointParts);
+            }
             $this->endpoint = $this->normalizeEndpoint($this->endpoint);
             $this->validate();
             $this->storage = new S3Storage;
@@ -101,6 +109,11 @@ class Create extends Component
         }
     }
 
+    public function updatedEndpointParts(): void
+    {
+        $this->endpointPartsChanged = true;
+    }
+
     private function connectionErrorDescription(\Throwable $exception): string
     {
         $settingsUrl = route('settings.advanced').'#endpoint-section';
diff --git a/app/Livewire/Storage/Form.php b/app/Livewire/Storage/Form.php
index 94a0657efc..30084dcd39 100644
--- a/app/Livewire/Storage/Form.php
+++ b/app/Livewire/Storage/Form.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Storage;
 use App\Models\S3Storage;
 use App\Rules\SafeWebhookUrl;
 use App\Rules\ValidS3BucketName;
+use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
@@ -24,6 +25,10 @@ class Form extends Component
 
     public string $endpoint;
 
+    public array $endpointParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $endpointPartsChanged = false;
+
     public string $bucket;
 
     public string $region;
@@ -101,6 +106,8 @@ class Form extends Component
             $this->name = $this->storage->name;
             $this->description = $this->storage->description;
             $this->endpoint = $this->storage->endpoint;
+            $this->endpointParts = DomainUrlParts::split($this->endpoint);
+            $this->endpointPartsChanged = false;
             $this->bucket = $this->storage->bucket;
             $this->region = $this->storage->region;
             $this->key = $this->storage->key;
@@ -126,6 +133,9 @@ class Form extends Component
 
         try {
             $this->authorize('validateConnection', $this->storage);
+            if ($this->endpointPartsChanged) {
+                $this->endpoint = DomainUrlParts::compose(...$this->endpointParts);
+            }
             $testedStorage = new S3Storage;
             $testedStorage->uuid = $this->storage->uuid;
             $testedStorage->team_id = $this->storage->team_id;
@@ -166,6 +176,9 @@ class Form extends Component
     {
         try {
             $this->authorize('update', $this->storage);
+            if ($this->endpointPartsChanged) {
+                $this->endpoint = DomainUrlParts::compose(...$this->endpointParts);
+            }
 
             DB::transaction(function () {
                 $this->validate();
@@ -195,4 +208,9 @@ class Form extends Component
             return handleError($e, $this);
         }
     }
+
+    public function updatedEndpointParts(): void
+    {
+        $this->endpointPartsChanged = true;
+    }
 }
diff --git a/resources/views/components/forms/domain-input.blade.php b/resources/views/components/forms/domain-input.blade.php
index d6e6bce856..5a4b5f950e 100644
--- a/resources/views/components/forms/domain-input.blade.php
+++ b/resources/views/components/forms/domain-input.blade.php
@@ -1,68 +1,27 @@
 @props([
     'id',
-    'wire' => true,
-    'value' => '',
     'errorId' => null,
     'hostLabel' => 'Domain',
     'hostPlaceholder' => 'app.example.com',
 ])
 
-<div class="grid gap-4 sm:grid-cols-[8rem_minmax(0,1fr)_8rem]" x-data="{
-    value: @if ($wire) @entangle($id) @else @js($value) @endif,
-    scheme: 'https',
-    host: '',
-    port: '',
-    path: '',
-    syncing: false,
-    init() {
-        this.read(this.value);
-        this.$watch('value', value => {
-            if (!this.syncing) this.read(value);
-        });
-        ['scheme', 'host', 'port', 'path'].forEach(part => this.$watch(part, () => this.write()));
-    },
-    read(value) {
-        if (!value) return;
-        try {
-            const url = new URL(value);
-            const authority = value.match(/^[a-z][a-z0-9+.-]*:\/\/(?:\[[^\]]+\]|[^\/:?#]+)(?::(\d+))?/i);
-            this.syncing = true;
-            this.scheme = url.protocol.replace(':', '') === 'http' ? 'http' : 'https';
-            this.host = url.hostname;
-            this.port = authority?.[1] || url.port;
-            this.path = `${url.pathname === '/' ? '' : url.pathname}${url.search}${url.hash}`;
-            this.$nextTick(() => this.syncing = false);
-        } catch (_) {}
-    },
-    write() {
-        if (this.syncing) return;
-        const path = this.path.trim();
-        const normalizedPath = path && !['/', '?', '#'].includes(path[0]) ? `/${path}` : path;
-        const next = `${this.scheme}://${this.host.trim()}${this.port ? `:${this.port}` : ''}${normalizedPath}`;
-        if (this.value !== next) {
-            this.syncing = true;
-            this.value = next;
-            this.$nextTick(() => this.syncing = false);
-        }
-    },
-}" x-modelable="value" {{ $attributes->whereStartsWith('x-model') }}>
+<div class="grid gap-4 sm:grid-cols-[8rem_minmax(0,1fr)_8rem]">
     <div class="min-w-0">
-        <x-forms.listbox id="{{ $id }}-protocol" label="Protocol" :wire="false" value="https"
-            x-model="scheme" portal :options="[
-                ['value' => 'https', 'label' => 'https'],
-                ['value' => 'http', 'label' => 'http'],
-            ]" />
+        <x-forms.listbox id="{{ $id }}.scheme" htmlId="{{ $id }}-protocol" label="Protocol" portal :options="[
+            ['value' => 'https', 'label' => 'https'],
+            ['value' => 'http', 'label' => 'http'],
+        ]" />
     </div>
 
     <div class="min-w-0">
         <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
-            <label for="{{ $id }}" class="mb-0! flex items-center gap-1.5 leading-4">
+            <label for="{{ $id }}-host" class="mb-0! flex items-center gap-1.5 leading-4">
                 {{ $hostLabel }} <x-highlighted text="*" />
             </label>
         </div>
-        <input id="{{ $id }}" type="text" class="input" x-model="host" placeholder="{{ $hostPlaceholder }}"
-            autocomplete="off" required />
-        @error($errorId ?? $id)
+        <input id="{{ $id }}-host" type="text" class="input" wire:model="{{ $id }}.host"
+            placeholder="{{ $hostPlaceholder }}" autocomplete="off" required />
+        @error($errorId ?? "{$id}.host")
             @php
                 preg_match('/(https?:\/\/\S+)$/', $message, $validationLinkMatches);
                 $validationLink = $validationLinkMatches[1] ?? null;
@@ -82,16 +41,16 @@
         <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
             <label for="{{ $id }}-port" class="mb-0! flex items-center gap-1.5 leading-4">Port</label>
         </div>
-        <input id="{{ $id }}-port" type="number" class="input" x-model="port" placeholder="3000"
-            min="1" max="65535" inputmode="numeric" />
+        <input id="{{ $id }}-port" type="number" class="input" wire:model="{{ $id }}.port"
+            placeholder="3000" min="1" max="65535" inputmode="numeric" />
     </div>
 
     <div class="min-w-0 sm:col-span-3">
         <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
             <label for="{{ $id }}-path" class="mb-0! flex items-center gap-1.5 leading-4">Path</label>
         </div>
-        <input id="{{ $id }}-path" type="text" class="input" x-model="path" placeholder="/api/v3"
-            autocomplete="off" />
+        <input id="{{ $id }}-path" type="text" class="input" wire:model="{{ $id }}.path"
+            placeholder="/api/v3" autocomplete="off" />
         <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-dim">
             Optional path, query, or fragment appended after the domain and port.
         </p>
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index bfcb4437e7..4677911d94 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -90,6 +90,9 @@
             const gap = 4;
             const edge = 12;
             const triggerRect = trigger.getBoundingClientRect();
+            panel.style.width = 'max-content';
+            panel.style.minWidth = `${triggerRect.width}px`;
+            panel.style.maxWidth = `${window.innerWidth - (edge * 2)}px`;
             const panelWidth = Math.min(
                 Math.max(triggerRect.width, panel.offsetWidth),
                 window.innerWidth - (edge * 2),
@@ -107,8 +110,6 @@
             panel.style.top = `${top}px`;
             panel.style.left = `${left}px`;
             panel.style.width = `${panelWidth}px`;
-            panel.style.maxWidth = `${window.innerWidth - (edge * 2)}px`;
-            panel.style.minWidth = `${triggerRect.width}px`;
             this.positioned = true;
         },
     }" x-modelable="value" :class="{ 'pointer-events-none opacity-70': saving }"
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index fb5bf9b1df..04dd249c7e 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -15,30 +15,14 @@
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: @js($editingService ?? ''),
-        localEditingIndex: @js($editingIndex),
-        localEditingDomain: @js($editingDomain),
-        localEditingService: @js($editingService),
-        openEditDomain(index, url, service) {
-            this.localEditingIndex = index;
-            this.localEditingDomain = url;
-            this.localEditingService = service;
-            this.editingServiceLabel = service || '';
+        openEditDomain() {
+            this.editingServiceLabel = $wire.editingService || '';
             this.modalOpen = true;
             this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
             this.editingServiceLabel = '';
-            this.localEditingIndex = null;
-            this.localEditingDomain = '';
-            this.localEditingService = null;
-        },
-        prepareEditSubmit() {
-            // Sync Alpine → Livewire only when the user actually saves (one request).
-            $wire.editingIndex = this.localEditingIndex;
-            $wire.editingDomain = this.localEditingDomain;
-            $wire.editingService = this.localEditingService;
-            $wire.showEditDomainModal = true;
         },
         matchesDomainSearch(value) {
             return !this.domainSearch.trim() || value.toLowerCase().includes(this.domainSearch.trim().toLowerCase());
@@ -47,7 +31,7 @@
             return values.some((value) => this.matchesDomainSearch(value));
         },
     }"
-    @open-edit-domain.window="openEditDomain($event.detail.index, $event.detail.url, $event.detail.service)"
+    @open-edit-domain.window="openEditDomain()"
     @edit-domain-saved.window="closeEditDomain()">
     <x-application.settings-section id="domains-section" title="Domains">
         @can('update', $application)
@@ -128,7 +112,7 @@
                                         :disabled="! auth()->user()->can('update', $application)" />
                                 @endif
 
-                                <x-forms.domain-input id="newDomain" />
+                                <x-forms.domain-input id="newDomainParts" errorId="newDomain" />
 
                                 @if ($addDomainDnsFailed)
                                     <x-callout type="danger" title="DNS is not pointing to the right IP">
@@ -320,7 +304,7 @@
                         </header>
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
-                            <form @submit.prevent="prepareEditSubmit(); $wire.updateDomain()" class="flex flex-col gap-4">
+                            <form wire:submit="updateDomain" class="flex flex-col gap-4">
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service</label>
@@ -328,8 +312,7 @@
                                     <input type="text" class="input" readonly x-bind:value="editingServiceLabel" />
                                 </div>
 
-                                <x-forms.domain-input id="editingDomainLocal" errorId="editingDomain" :wire="false"
-                                    x-model="localEditingDomain" />
+                                <x-forms.domain-input id="editingDomainParts" errorId="editingDomain" />
 
                                 @if ($editDomainDnsFailed)
                                     <x-callout type="danger" title="DNS is not pointing to the right IP">
@@ -345,7 +328,7 @@
                                 <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
                                     @if ($editDomainDnsFailed)
                                         <x-forms.button type="button" isError
-                                            @click="prepareEditSubmit(); $wire.forceSaveEditDns = true; $wire.confirmUpdateDomainDespiteDns()">
+                                            wire:click="confirmUpdateDomainDespiteDns">
                                             Continue
                                         </x-forms.button>
                                     @else
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index d5baaee56e..10aa21200a 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -178,12 +178,7 @@
                             </x-forms.button>
                         @endif
                     @else
-                        <button type="button"
-                            @click="$dispatch('open-edit-domain', {
-                                index: {{ $index }},
-                                url: @js($row['url']),
-                                service: @js($row['service'] ?? null),
-                            })"
+                        <button type="button" wire:click="startEdit({{ $index }})"
                             class="icon-button shrink-0"
                             title="Edit domain" aria-label="Edit domain">
                             <x-reicon name="settings" class="size-3.5" />
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 730d4b8554..59f5736012 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -19,29 +19,14 @@
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: '',
-        localEditingIndex: @js($editingIndex),
-        localEditingDomain: @js($editingDomain),
-        localEditingServiceApplicationId: @js($editingServiceApplicationId),
-        openEditDomain(index, url, serviceApplicationId, serviceLabel) {
-            this.localEditingIndex = index;
-            this.localEditingDomain = url;
-            this.localEditingServiceApplicationId = serviceApplicationId;
-            this.editingServiceLabel = serviceLabel || '';
+        openEditDomain() {
+            this.editingServiceLabel = $wire.serviceApps.find(app => app.id === $wire.editingServiceApplicationId)?.name || '';
             this.modalOpen = true;
             this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
             this.editingServiceLabel = '';
-            this.localEditingIndex = null;
-            this.localEditingDomain = '';
-            this.localEditingServiceApplicationId = null;
-        },
-        prepareEditSubmit() {
-            $wire.editingIndex = this.localEditingIndex;
-            $wire.editingDomain = this.localEditingDomain;
-            $wire.editingServiceApplicationId = this.localEditingServiceApplicationId;
-            $wire.showEditDomainModal = true;
         },
         matchesDomainSearch(value) {
             return !this.domainSearch.trim() || value.toLowerCase().includes(this.domainSearch.trim().toLowerCase());
@@ -50,7 +35,7 @@
             return values.some((value) => this.matchesDomainSearch(value));
         },
     }"
-    @open-edit-domain.window="openEditDomain($event.detail.index, $event.detail.url, $event.detail.serviceApplicationId, $event.detail.serviceLabel)"
+    @open-edit-domain.window="openEditDomain()"
     @edit-domain-saved.window="closeEditDomain()">
     <x-application.settings-section id="service-domains-section" title="Domains">
         @can('update', $service)
@@ -116,7 +101,7 @@
                                 ])->values()->all()"
                                 :disabled="! auth()->user()->can('update', $service)" />
 
-                            <x-forms.domain-input id="newDomain" />
+                            <x-forms.domain-input id="newDomainParts" errorId="newDomain" />
 
                             @if ($addDomainDnsFailed)
                                 <x-callout type="danger" title="DNS is not pointing to the right IP">
@@ -232,7 +217,7 @@
                         </header>
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
-                            <form @submit.prevent="prepareEditSubmit(); $wire.updateDomain()" class="flex flex-col gap-4">
+                            <form wire:submit="updateDomain" class="flex flex-col gap-4">
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service application</label>
@@ -243,8 +228,7 @@
                                     </p>
                                 </div>
 
-                                <x-forms.domain-input id="editingDomainLocal" errorId="editingDomain" :wire="false"
-                                    x-model="localEditingDomain" />
+                                <x-forms.domain-input id="editingDomainParts" errorId="editingDomain" />
 
                                 @if ($editDomainDnsFailed)
                                     <x-callout type="danger" title="DNS is not pointing to the right IP">
@@ -260,7 +244,7 @@
                                 <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
                                     @if ($editDomainDnsFailed)
                                         <x-forms.button type="button" isError
-                                            @click="prepareEditSubmit(); $wire.forceSaveEditDns = true; $wire.confirmUpdateDomainDespiteDns()">
+                                            wire:click="confirmUpdateDomainDespiteDns">
                                             Continue
                                         </x-forms.button>
                                     @else
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index f245c27e06..81daa100fe 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -201,13 +201,7 @@
                                 </x-forms.button>
                             @endif
                         @else
-                            <button type="button"
-                                @click="$dispatch('open-edit-domain', {
-                                    index: {{ $index }},
-                                    url: @js($row['url']),
-                                serviceApplicationId: {{ (int) ($row['service_application_id'] ?? 0) }},
-                                serviceLabel: @js($serviceLabel),
-                            })"
+                            <button type="button" wire:click="startEdit({{ $index }})"
                                 class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
                                 <x-reicon name="settings" class="size-3.5" />
                             </button>
diff --git a/resources/views/livewire/storage/create.blade.php b/resources/views/livewire/storage/create.blade.php
index 1154a7e90b..c0d6a6e273 100644
--- a/resources/views/livewire/storage/create.blade.php
+++ b/resources/views/livewire/storage/create.blade.php
@@ -7,7 +7,7 @@
                 <x-forms.input required label="Name" id="name" />
                 <x-forms.input label="Description" id="description" />
             </div>
-            <x-forms.domain-input id="endpoint" host-label="Host"
+            <x-forms.domain-input id="endpointParts" errorId="endpoint" host-label="Host"
                 host-placeholder="minio.internal or 192.168.1.50" />
             <div class="flex gap-2">
                 <x-forms.input required label="Bucket" id="bucket" />
diff --git a/resources/views/livewire/storage/form.blade.php b/resources/views/livewire/storage/form.blade.php
index 2a76e7cc61..d13d632fbe 100644
--- a/resources/views/livewire/storage/form.blade.php
+++ b/resources/views/livewire/storage/form.blade.php
@@ -17,7 +17,7 @@
             <x-forms.input canGate="update" :canResource="$storage" label="Description" id="description" />
             <div class="lg:col-span-2">
                 @can('update', $storage)
-                    <x-forms.domain-input id="endpoint" host-label="Host"
+                    <x-forms.domain-input id="endpointParts" errorId="endpoint" host-label="Host"
                         host-placeholder="minio.internal or 192.168.1.50" />
                 @else
                     <x-forms.input label="Endpoint" :value="$endpoint" disabled />
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 288952a7d4..fbe72230d1 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -236,6 +236,22 @@ it('adds a domain to the application', function () {
         ->toBe(['https://app.example.com', 'https://www.app.example.com']);
 });
 
+it('composes the complete port on the server without duplicating an existing www domain', function () {
+    $this->application->update(['fqdn' => 'https://www.example.com:3000']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect(explode(',', (string) $this->application->fresh()->fqdn))->toBe([
+        'https://www.example.com:3000',
+        'https://example.com:3000',
+    ]);
+});
+
 it('adds multiple domains without replacing existing ones', function () {
     $this->application->update([
         'fqdn' => 'https://app.example.com',
@@ -1222,16 +1238,16 @@ it('uses segmented fields when adding and editing application domains', function
     $component = file_get_contents(resource_path('views/components/forms/domain-input.blade.php'));
 
     expect($view)
-        ->toContain('<x-forms.domain-input id="newDomain"')
-        ->toContain('<x-forms.domain-input id="editingDomainLocal"')
+        ->toContain('<x-forms.domain-input id="newDomainParts"')
+        ->toContain('<x-forms.domain-input id="editingDomainParts"')
         ->not->toContain('placeholder="https://app.example.com"')
         ->and($component)
         ->toContain('Protocol')
         ->toContain('Domain')
         ->toContain('Port')
         ->toContain('Path')
-        ->toContain("scheme: 'https'")
-        ->toContain('<x-forms.listbox id="{{ $id }}-protocol"')
+        ->toContain('wire:model="{{ $id }}.host"')
+        ->toContain('<x-forms.listbox id="{{ $id }}.scheme"')
         ->not->toContain('<select id="{{ $id }}-protocol"')
         ->toContain("['value' => 'https', 'label' => 'https']")
         ->toContain("['value' => 'http', 'label' => 'http']")
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index 835f60c0c5..a64a97dd8a 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -60,6 +60,15 @@ test('mobile listbox panels stay anchored to their trigger', function () {
         ->not->toContain('transform: translate(-50%, -50%) !important;');
 });
 
+test('portaled listboxes measure content without inheriting the viewport width', function () {
+    $listbox = file_get_contents(resource_path('views/components/forms/listbox.blade.php'));
+
+    expect($listbox)
+        ->toContain("panel.style.width = 'max-content';")
+        ->toContain('panel.style.minWidth = `${triggerRect.width}px`;')
+        ->toContain('Math.max(triggerRect.width, panel.offsetWidth)');
+});
+
 test('searchable listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.searchable-listbox id="tz" label="Timezone"
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index a4d7d7db35..36f602856f 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -141,8 +141,8 @@ it('uses segmented fields when adding and editing service domains', function ()
     $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
 
     expect($view)
-        ->toContain('<x-forms.domain-input id="newDomain"')
-        ->toContain('<x-forms.domain-input id="editingDomainLocal"')
+        ->toContain('<x-forms.domain-input id="newDomainParts"')
+        ->toContain('<x-forms.domain-input id="editingDomainParts"')
         ->not->toContain('placeholder="https://app.example.com"');
 });
 
diff --git a/tests/Feature/SplitUrlInputTest.php b/tests/Feature/SplitUrlInputTest.php
index e05cc9eb2b..2f317c7974 100644
--- a/tests/Feature/SplitUrlInputTest.php
+++ b/tests/Feature/SplitUrlInputTest.php
@@ -1,51 +1,31 @@
 <?php
 
-use Illuminate\Support\Facades\Blade;
-use Illuminate\Support\Facades\View;
-use Illuminate\Support\MessageBag;
-use Illuminate\Support\ViewErrorBag;
-
 it('renders configurable host copy for S3 endpoints', function () {
-    View::share('errors', new ViewErrorBag);
-
-    $html = Blade::render(<<<'BLADE'
-        <x-forms.domain-input id="endpoint" :wire="false" value="http://192.168.1.50:9000/s3"
-            host-label="Host" host-placeholder="minio.internal or 192.168.1.50" />
-    BLADE);
+    $html = file_get_contents(resource_path('views/components/forms/domain-input.blade.php'));
 
     expect($html)
-        ->toContain('Host')
-        ->toContain('minio.internal or 192.168.1.50')
-        ->toContain("scheme: 'https'")
-        ->toContain("host: ''")
-        ->toContain("port: ''")
-        ->toContain("path: ''");
+        ->toContain('{{ $hostLabel }}')
+        ->toContain('{{ $hostPlaceholder }}')
+        ->toContain('wire:model="{{ $id }}.host"')
+        ->toContain('wire:model="{{ $id }}.port"')
+        ->toContain('wire:model="{{ $id }}.path"');
 });
 
-it('does not reparse partial numeric hosts while typing', function () {
+it('binds URL parts directly to Livewire without Alpine synchronization', function () {
     $view = file_get_contents(resource_path('views/components/forms/domain-input.blade.php'));
-    $writeMethod = str($view)->between('write() {', "\n    },\n}")->value();
 
-    expect($writeMethod)
-        ->toContain('this.syncing = true;')
-        ->toContain('this.value = next;')
-        ->toContain('this.$nextTick(() => this.syncing = false);')
-        ->and(strpos($writeMethod, 'this.syncing = true;'))
-        ->toBeLessThan(strpos($writeMethod, 'this.value = next;'));
+    expect($view)
+        ->toContain('wire:model="{{ $id }}.host"')
+        ->toContain('wire:model="{{ $id }}.port"')
+        ->not->toContain('x-data=')
+        ->not->toContain('$watch');
 });
 
 it('keeps validation errors attached to the composed endpoint', function () {
-    $settingsUrl = route('settings.advanced').'#endpoint-section';
-    $errors = new ViewErrorBag;
-    $errors->put('default', new MessageBag([
-        'endpoint' => "The endpoint is invalid. Configure allowed internal targets: {$settingsUrl}",
-    ]));
-    View::share('errors', $errors);
-
-    $html = Blade::render('<x-forms.domain-input id="endpoint" :wire="false" />');
+    $html = file_get_contents(resource_path('views/components/forms/domain-input.blade.php'));
 
     expect($html)
-        ->toContain('The endpoint is invalid.')
-        ->toContain('href="'.$settingsUrl.'"')
+        ->toContain('@error($errorId ?? "{$id}.host")')
+        ->toContain('href="{{ $validationLink }}"')
         ->toContain('Set them here.');
 });
diff --git a/tests/Unit/S3StorageEndpointNormalizationTest.php b/tests/Unit/S3StorageEndpointNormalizationTest.php
index ee2ecc04a4..09c1a8a257 100644
--- a/tests/Unit/S3StorageEndpointNormalizationTest.php
+++ b/tests/Unit/S3StorageEndpointNormalizationTest.php
@@ -11,11 +11,11 @@ it('uses the shared split URL input without a Livewire blur request', function (
 
     expect($createView)
         ->not->toContain('wire:model.blur="endpoint"')
-        ->toContain('<x-forms.domain-input id="endpoint"')
+        ->toContain('<x-forms.domain-input id="endpointParts"')
         ->toContain('host-label="Host"')
         ->toContain('host-placeholder="minio.internal or 192.168.1.50"')
         ->and($editView)
-        ->toContain('<x-forms.domain-input id="endpoint"')
+        ->toContain('<x-forms.domain-input id="endpointParts"')
         ->toContain('@can(\'update\', $storage)');
 });
 

From a5dedc07cd72d58a3f0a843fcee7d120f9000d7c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:19:41 +0200
Subject: [PATCH 09/42] feat(storage): persist local images and unify clipboard
 copying

Add a private images disk with persistent container mounts and installation/upgrade setup, while routing avatar and project icon storage through it. Reuse the copy button component for API tokens and support clipboard copying through the shared helper.
---
 app/Services/AvatarStorageService.php         |  2 +-
 config/filesystems.php                        |  7 +++++
 docker-compose.prod.yml                       |  1 +
 docker-compose.windows.yml                    |  1 +
 other/nightly/docker-compose.prod.yml         |  1 +
 .../components/forms/copy-button.blade.php    |  9 ++----
 .../livewire/security/api-tokens.blade.php    | 13 +-------
 scripts/install.sh                            |  1 +
 scripts/upgrade.sh                            |  4 +++
 tests/Feature/PersistentImageStorageTest.php  | 31 +++++++++++++++++++
 tests/Feature/ProfileAvatarTest.php           | 22 ++++++-------
 tests/Feature/ProjectIconTest.php             | 14 ++++-----
 .../Feature/ResourceDetailsVisibilityTest.php | 13 ++++++--
 13 files changed, 79 insertions(+), 40 deletions(-)
 create mode 100644 tests/Feature/PersistentImageStorageTest.php

diff --git a/app/Services/AvatarStorageService.php b/app/Services/AvatarStorageService.php
index d1446ea37e..983b144b94 100644
--- a/app/Services/AvatarStorageService.php
+++ b/app/Services/AvatarStorageService.php
@@ -71,7 +71,7 @@ class AvatarStorageService
     protected function disk(string $storageType, ?int $s3StorageId): FilesystemAdapter
     {
         if ($storageType !== 's3') {
-            return Storage::disk('local');
+            return Storage::disk('images');
         }
 
         $storage = S3Storage::query()->whereKey($s3StorageId)->where('is_usable', true)->first();
diff --git a/config/filesystems.php b/config/filesystems.php
index ba0921a794..966cd0d5a8 100644
--- a/config/filesystems.php
+++ b/config/filesystems.php
@@ -35,6 +35,13 @@ return [
             'throw' => false,
         ],
 
+        'images' => [
+            'driver' => 'local',
+            'root' => storage_path('app/images'),
+            'visibility' => 'private',
+            'throw' => false,
+        ],
+
         'public' => [
             'driver' => 'local',
             'root' => storage_path('app/public'),
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 9edc00e702..0d7caceb95 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -11,6 +11,7 @@ services:
       - /data/coolify/databases:/var/www/html/storage/app/databases
       - /data/coolify/services:/var/www/html/storage/app/services
       - /data/coolify/backups:/var/www/html/storage/app/backups
+      - /data/coolify/images:/var/www/html/storage/app/images
     environment:
       - APP_ENV=${APP_ENV:-production}
       - PHP_MEMORY_LIMIT=${PHP_MEMORY_LIMIT:-256M}
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index 43f6f0d0e9..33709873f2 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -25,6 +25,7 @@ services:
       - ./databases:/var/www/html/storage/app/databases
       - ./services:/var/www/html/storage/app/services
       - ./backups:/var/www/html/storage/app/backups
+      - ./images:/var/www/html/storage/app/images
     env_file:
       - .env
     environment:
diff --git a/other/nightly/docker-compose.prod.yml b/other/nightly/docker-compose.prod.yml
index 9edc00e702..0d7caceb95 100644
--- a/other/nightly/docker-compose.prod.yml
+++ b/other/nightly/docker-compose.prod.yml
@@ -11,6 +11,7 @@ services:
       - /data/coolify/databases:/var/www/html/storage/app/databases
       - /data/coolify/services:/var/www/html/storage/app/services
       - /data/coolify/backups:/var/www/html/storage/app/backups
+      - /data/coolify/images:/var/www/html/storage/app/images
     environment:
       - APP_ENV=${APP_ENV:-production}
       - PHP_MEMORY_LIMIT=${PHP_MEMORY_LIMIT:-256M}
diff --git a/resources/views/components/forms/copy-button.blade.php b/resources/views/components/forms/copy-button.blade.php
index 7a12cdfe43..e299610eb2 100644
--- a/resources/views/components/forms/copy-button.blade.php
+++ b/resources/views/components/forms/copy-button.blade.php
@@ -1,21 +1,18 @@
 @props(['text', 'label' => null])
 
-<div class="w-full"
-    x-data="{ copied: false, canCopy: window.isSecureContext && typeof navigator.clipboard?.writeText === 'function' }">
+<div class="w-full" x-data="{ copied: false }">
     @if ($label)
         <label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white">{{ $label }}</label>
     @endif
     <div class="relative">
         <input type="text" value="{{ $text }}"
-            class="input bg-white dark:bg-coolgray-100 dark:read-only:bg-coolgray-100 dark:read-only:text-white"
-            x-bind:class="{ 'input-with-copy-button': canCopy }"
+            class="input input-with-copy-button bg-white dark:bg-coolgray-100 dark:read-only:bg-coolgray-100 dark:read-only:text-white"
             readonly
             @keydown.prevent @paste.prevent @cut.prevent @drop.prevent
             @focus="$event.target.select()">
         <button
-            x-show="canCopy"
             type="button"
-            @click.prevent="copied = true; navigator.clipboard.writeText({{ Js::from($text) }}); setTimeout(() => copied = false, 1000)"
+            @click.prevent="await window.copyToClipboard({{ Js::from($text) }}); copied = true; setTimeout(() => copied = false, 1000)"
             class="copy-button flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer text-neutral-500 transition-colors hover:text-black focus-visible:ring-2 focus-visible:ring-coollabs focus-visible:ring-offset-2 dark:text-neutral-400 dark:hover:text-white dark:focus-visible:ring-warning dark:focus-visible:ring-offset-base"
             title="Copy to clipboard"
             aria-label="Copy to clipboard">
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index 4f87f9f2c4..38db6aa3a6 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -109,18 +109,7 @@
             @if (session()->has('token'))
                 <x-application.settings-section title="Copy your token"
                     description="This value will not be shown again after you leave this page.">
-                    <div class="relative" x-data="{ copied: false }">
-                        <input type="text" value="{{ session('token') }}" readonly
-                            class="input w-full pr-12! font-mono text-[12px] text-black dark:text-fg">
-                        <button type="button"
-                            x-on:click="copied = true; navigator.clipboard.writeText(@js(session('token'))); setTimeout(() => copied = false, 1200)"
-                            class="absolute top-1/2 right-2 flex size-7 -translate-y-1/2 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:hover:bg-white/[0.06] dark:hover:text-fg"
-                            title="Copy token">
-                            <x-reicon name="file-content" class="size-3.5" />
-                        </button>
-                        <span x-cloak x-show="copied"
-                            class="absolute top-full right-0 mt-1 text-[10px] text-success">Copied</span>
-                    </div>
+                    <x-forms.copy-button :text="session('token')" />
                 </x-application.settings-section>
             @endif
 
diff --git a/scripts/install.sh b/scripts/install.sh
index 1773f37f1f..226b1cc5e0 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -229,6 +229,7 @@ if [ "$WARNING_SPACE" = true ]; then
 fi
 
 mkdir -p /data/coolify/{source,ssh,applications,databases,backups,services,proxy,sentinel}
+mkdir -p /data/coolify/images
 mkdir -p /data/coolify/ssh/{keys,mux}
 mkdir -p /data/coolify/proxy/dynamic
 
diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh
index a909d2e49a..516a9d7ebc 100644
--- a/scripts/upgrade.sh
+++ b/scripts/upgrade.sh
@@ -170,6 +170,10 @@ else
     log "Network 'coolify' already exists"
 fi
 
+mkdir -p /data/coolify/images/{avatars,project-icons}
+chown -R 9999:root /data/coolify/images
+chmod -R 700 /data/coolify/images
+
 # Fix SSH directory ownership if not owned by container user UID 9999 (fixes #6621)
 # Only changes owner — preserves existing group to respect custom setups
 SSH_OWNER=$(stat -c '%u' /data/coolify/ssh 2>/dev/null || echo "unknown")
diff --git a/tests/Feature/PersistentImageStorageTest.php b/tests/Feature/PersistentImageStorageTest.php
new file mode 100644
index 0000000000..59d88e3f0b
--- /dev/null
+++ b/tests/Feature/PersistentImageStorageTest.php
@@ -0,0 +1,31 @@
+<?php
+
+it('configures a dedicated private disk for persisted images', function () {
+    expect(config('filesystems.disks.images'))
+        ->toMatchArray([
+            'driver' => 'local',
+            'root' => storage_path('app/images'),
+            'visibility' => 'private',
+        ]);
+});
+
+it('persists images in stable and nightly production compose files', function (string $composeFile) {
+    expect(file_get_contents(base_path($composeFile)))
+        ->toContain('/data/coolify/images:/var/www/html/storage/app/images');
+})->with([
+    'stable' => 'docker-compose.prod.yml',
+    'nightly' => 'other/nightly/docker-compose.prod.yml',
+]);
+
+it('persists images in the Windows compose file', function () {
+    expect(file_get_contents(base_path('docker-compose.windows.yml')))
+        ->toContain('./images:/var/www/html/storage/app/images');
+});
+
+it('creates the persistent image directory during installation and upgrades', function (string $script) {
+    expect(file_get_contents(base_path($script)))
+        ->toContain('/data/coolify/images');
+})->with([
+    'install' => 'scripts/install.sh',
+    'upgrade' => 'scripts/upgrade.sh',
+]);
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index e5abb2ef5c..cf313882f4 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -19,7 +19,7 @@ beforeEach(function () {
 });
 
 it('compresses and stores an uploaded profile picture on the configured local storage', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $user = User::factory()->create(['name' => 'Test User']);
     $this->actingAs($user);
 
@@ -35,18 +35,18 @@ it('compresses and stores an uploaded profile picture on the configured local st
         ->and($user->avatar_storage_type)->toBe('local')
         ->and($user->avatar_s3_storage_id)->toBeNull();
 
-    Storage::disk('local')->assertExists($user->avatar_path);
+    Storage::disk('images')->assertExists($user->avatar_path);
 
-    $image = getimagesizefromstring(Storage::disk('local')->get($user->avatar_path));
+    $image = getimagesizefromstring(Storage::disk('images')->get($user->avatar_path));
 
     expect($image[0])->toBeLessThanOrEqual(256)
         ->and($image[1])->toBeLessThanOrEqual(256)
         ->and($image['mime'])->toBe('image/jpeg')
-        ->and(Storage::disk('local')->size($user->avatar_path))->toBeLessThan(100_000);
+        ->and(Storage::disk('images')->size($user->avatar_path))->toBeLessThan(100_000);
 });
 
 it('stores an already compressed browser JPEG without server image extensions', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $user = User::factory()->create(['name' => 'Test User']);
     $contents = base64_decode('/9j/4AAQSkZJRgABAQEAYABgAAD//gA7Q1JFQVRPUjogZ2QtanBlZyB2MS4wICh1c2luZyBJSkcgSlBFRyB2NjIpLCBxdWFsaXR5ID0gODAK/9sAQwAGBAUGBQQGBgUGBwcGCAoQCgoJCQoUDg8MEBcUGBgXFBYWGh0lHxobIxwWFiAsICMmJykqKRkfLTAtKDAlKCko/9sAQwEHBwcKCAoTCgoTKBoWGigoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgo/8AAEQgAAgACAwEiAAIRAQMRAf/EAB8AAAEFAQEBAQEBAAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5+v/EAB8BAAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkKC//EALURAAIBAgQEAwQHBQQEAAECdwABAgMRBAUhMQYSQVEHYXETIjKBCBRCkaGxwQkjM1LwFWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/aAAwDAQACEQMRAD8A+qaKKKAP/9k=');
     $path = tempnam(sys_get_temp_dir(), 'avatar');
@@ -55,17 +55,17 @@ it('stores an already compressed browser JPEG without server image extensions',
 
     app(AvatarStorageService::class)->store($user, $upload);
 
-    expect(Storage::disk('local')->get("avatars/{$user->id}/avatar.jpg"))->toBe($contents);
+    expect(Storage::disk('images')->get("avatars/{$user->id}/avatar.jpg"))->toBe($contents);
 });
 
 it('serves the authenticated users profile picture', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $user = User::factory()->create([
         'name' => 'Test User',
         'avatar_path' => 'avatars/1/avatar.jpg',
         'avatar_storage_type' => 'local',
     ]);
-    Storage::disk('local')->put($user->avatar_path, 'avatar-content');
+    Storage::disk('images')->put($user->avatar_path, 'avatar-content');
 
     $this->withoutMiddleware()->actingAs($user)
         ->get(route('profile.avatar'))
@@ -74,13 +74,13 @@ it('serves the authenticated users profile picture', function () {
 });
 
 it('removes the current profile picture', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $user = User::factory()->create([
         'name' => 'Test User',
         'avatar_path' => 'avatars/1/avatar.jpg',
         'avatar_storage_type' => 'local',
     ]);
-    Storage::disk('local')->put($user->avatar_path, 'avatar-content');
+    Storage::disk('images')->put($user->avatar_path, 'avatar-content');
     $this->actingAs($user);
 
     Livewire::test(Index::class)
@@ -88,7 +88,7 @@ it('removes the current profile picture', function () {
         ->assertHasNoErrors();
 
     expect($user->refresh()->avatar_path)->toBeNull();
-    Storage::disk('local')->assertMissing('avatars/1/avatar.jpg');
+    Storage::disk('images')->assertMissing('avatars/1/avatar.jpg');
 });
 
 it('falls back cleanly when the avatars S3 storage no longer exists', function () {
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index 3599c0b4b5..b5b6ed0887 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -31,7 +31,7 @@ beforeEach(function () {
 });
 
 it('stores a project icon using the instance image storage setting', function () {
-    Storage::fake('local');
+    Storage::fake('images');
 
     $upload = UploadedFile::fake()->createWithContent('project.jpg', file_get_contents(base_path('tests/Fixtures/project-icon.jpg')));
 
@@ -47,16 +47,16 @@ it('stores a project icon using the instance image storage setting', function ()
         ->and($this->project->icon_storage_type)->toBe('local')
         ->and($this->project->icon_s3_storage_id)->toBeNull();
 
-    Storage::disk('local')->assertExists($this->project->icon_path);
+    Storage::disk('images')->assertExists($this->project->icon_path);
 });
 
 it('serves a project icon only to a member of its team', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $this->project->forceFill([
         'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
         'icon_storage_type' => 'local',
     ])->save();
-    Storage::disk('local')->put($this->project->icon_path, 'icon-content');
+    Storage::disk('images')->put($this->project->icon_path, 'icon-content');
 
     $this->withoutMiddleware()->get(route('project.icon', ['project_uuid' => $this->project->uuid]))
         ->assertSuccessful()
@@ -73,20 +73,20 @@ it('serves a project icon only to a member of its team', function () {
 });
 
 it('removes a project icon', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $path = "project-icons/{$this->project->uuid}/icon.jpg";
     $this->project->forceFill([
         'icon_path' => $path,
         'icon_storage_type' => 'local',
     ])->save();
-    Storage::disk('local')->put($path, 'icon-content');
+    Storage::disk('images')->put($path, 'icon-content');
 
     Livewire::test(Edit::class, ['project_uuid' => $this->project->uuid])
         ->call('removeIcon')
         ->assertHasNoErrors();
 
     expect($this->project->refresh()->icon_path)->toBeNull();
-    Storage::disk('local')->assertMissing($path);
+    Storage::disk('images')->assertMissing($path);
 });
 
 it('exposes the icon URL on the projects index', function () {
diff --git a/tests/Feature/ResourceDetailsVisibilityTest.php b/tests/Feature/ResourceDetailsVisibilityTest.php
index 6466a33ed7..29f611cbaa 100644
--- a/tests/Feature/ResourceDetailsVisibilityTest.php
+++ b/tests/Feature/ResourceDetailsVisibilityTest.php
@@ -38,15 +38,22 @@ it('renders copy fields as visible readonly controls with an accessible copy act
     expect($html)
         ->toContain('label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white"')
         ->toContain('readonly')
-        ->toContain("canCopy: window.isSecureContext && typeof navigator.clipboard?.writeText === 'function'")
-        ->toContain("x-bind:class=\"{ 'input-with-copy-button': canCopy }\"")
-        ->toContain('x-show="canCopy"')
+        ->toContain('window.copyToClipboard')
+        ->toContain('input-with-copy-button')
         ->toContain('copy-button')
         ->toContain('aria-label="Copy to clipboard"')
         ->toContain('title="Copy to clipboard"')
         ->toContain('class="size-[18px] text-green-500"');
 });
 
+it('uses the shared copy field for newly issued api tokens', function () {
+    $blade = file_get_contents(resource_path('views/livewire/security/api-tokens.blade.php'));
+
+    expect($blade)
+        ->toContain('<x-forms.copy-button :text="session(\'token\')" />')
+        ->not->toContain('navigator.clipboard.writeText(@js(session(\'token\')))');
+});
+
 it('keeps copy button padding above settings-workspace input overrides', function () {
     $css = file_get_contents(resource_path('css/app.css'));
 

From c314319a7eff0fcd39e3ed0b75e8cd2c19e68e77 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:23:30 +0200
Subject: [PATCH 10/42] fix(sudo): preserve substitutions in backup shell
 commands (#11329)

---
 AGENTS.md                                     |  1 +
 bootstrap/helpers/sudo.php                    |  1 +
 tests/Unit/ParseCommandsByLineForSudoTest.php | 18 ++++++++++++++++++
 3 files changed, 20 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 86fc0f00b0..5563a18ec1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -179,6 +179,7 @@ Coolify seeds **instance-owned** rows at primary key `0`. That value is a sentin
 - Run `vendor/bin/pint --dirty --format agent` before finalizing changes
 - Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
 - Check sibling files for conventions before creating new files
+- When adding remote shell commands, account for servers using non-root SSH users: commands pass through `parseCommandsByLineForSudo()`, so test pipelines, redirects, substitutions, and `sh -c`/`bash -c` scripts with the non-root sudo parser.
 
 ## Git Workflow
 
diff --git a/bootstrap/helpers/sudo.php b/bootstrap/helpers/sudo.php
index b8ef846877..397efc387c 100644
--- a/bootstrap/helpers/sudo.php
+++ b/bootstrap/helpers/sudo.php
@@ -95,6 +95,7 @@ function parseCommandsByLineForSudo(Collection $commands, Server $server): array
         $isComplexPipeCommand = (
             $line->contains(' | sh') ||
             $line->contains(' | bash') ||
+            $line->contains(' sh -c ') ||
             ($line->contains(' | ') && ($line->contains('||') || $line->contains('&&')))
         );
 
diff --git a/tests/Unit/ParseCommandsByLineForSudoTest.php b/tests/Unit/ParseCommandsByLineForSudoTest.php
index f294de35fa..b741b875f2 100644
--- a/tests/Unit/ParseCommandsByLineForSudoTest.php
+++ b/tests/Unit/ParseCommandsByLineForSudoTest.php
@@ -24,6 +24,24 @@ test('wraps complex Docker install command with pipes in bash -c', function () {
     expect($result[0])->toBe("sudo bash -c 'curl https://releases.rancher.com/install-docker/27.3.sh | sh || curl https://get.docker.com | sh'");
 });
 
+test('preserves command substitutions inside database and volume backup scripts', function () {
+    $script = 'compressor=$(if command -v pigz; then printf pigz; else printf gzip; fi); exec $compressor';
+    $command = 'docker exec database pg_dumpall | docker run --rm -i helper sh -c '.escapeshellarg($script);
+    $volumeCommand = 'docker run --rm helper sh -c '.escapeshellarg($script).' > /data/coolify/backups/volume.tar.gz';
+
+    $result = parseCommandsByLineForSudo(collect([$command, $volumeCommand]), $this->server);
+
+    expect($result[0])
+        ->toStartWith("sudo bash -c '")
+        ->toContain('compressor=$(if command -v pigz; then')
+        ->not->toContain('$(sudo if')
+        ->not->toContain('| sudo docker run')
+        ->and($result[1])
+        ->toStartWith("sudo bash -c '")
+        ->toContain('compressor=$(if command -v pigz; then')
+        ->not->toContain('$(sudo if');
+});
+
 test('wraps complex Docker install command with multiple fallbacks', function () {
     $commands = collect([
         'curl --max-time 300 https://releases.rancher.com/install-docker/27.3.sh | sh || curl https://get.docker.com | sh -s -- --version 27.3',

From 5152698757c5aa4fe5c731f58003fcfd24075aac Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:27:00 +0200
Subject: [PATCH 11/42] fix(deployments): advance queue after cancellations
 (#11330)

---
 .../Application/CleanupPreviewDeployment.php  |  10 +-
 app/Http/Controllers/Api/DeployController.php |  68 ++++++++----
 app/Jobs/DeleteResourceJob.php                |  11 ++
 app/Mcp/Tools/CancelDeployment.php            |   7 ++
 .../Api/DeploymentCancellationApiTest.php     | 102 +++++++++++++++++-
 ...ApplicationPreviewQueueAdvancementTest.php |  94 ++++++++++++++++
 tests/Feature/Mcp/McpReadToolsTest.php        |  23 ++++
 7 files changed, 288 insertions(+), 27 deletions(-)
 create mode 100644 tests/Feature/ApplicationPreviewQueueAdvancementTest.php

diff --git a/app/Actions/Application/CleanupPreviewDeployment.php b/app/Actions/Application/CleanupPreviewDeployment.php
index 74e2ff615f..803eef3983 100644
--- a/app/Actions/Application/CleanupPreviewDeployment.php
+++ b/app/Actions/Application/CleanupPreviewDeployment.php
@@ -54,6 +54,14 @@ class CleanupPreviewDeployment
             $server
         );
 
+        if ($result['cancelled_deployments'] > 0) {
+            try {
+                next_after_cancel($server);
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to advance deployment queue after cleaning up preview for application {$application->id}: {$e->getMessage()}");
+            }
+        }
+
         // Step 2: Stop and remove all running PR containers
         $result['killed_containers'] = $this->stopRunningContainers(
             $application,
@@ -98,13 +106,13 @@ class CleanupPreviewDeployment
                 $deployment->update([
                     'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
                 ]);
+                $cancelled++;
 
                 // Add cancellation log entry
                 $deployment->addLogEntry('Deployment cancelled: Pull request closed.', 'stderr');
 
                 // Try to kill helper container if it exists
                 $this->killHelperContainer($deployment->deployment_uuid, $server);
-                $cancelled++;
             } catch (\Throwable $e) {
                 \Log::warning("Failed to cancel deployment {$deployment->id}: {$e->getMessage()}");
             }
diff --git a/app/Http/Controllers/Api/DeployController.php b/app/Http/Controllers/Api/DeployController.php
index 396844cb02..a0f0cc1aed 100644
--- a/app/Http/Controllers/Api/DeployController.php
+++ b/app/Http/Controllers/Api/DeployController.php
@@ -238,57 +238,71 @@ class DeployController extends Controller
             ApplicationDeploymentStatus::IN_PROGRESS->value,
         ];
 
-        if (! in_array($deployment->status, $cancellableStatuses)) {
+        if (! in_array($deployment->status, $cancellableStatuses, true)) {
             return response()->json([
                 'message' => "Deployment cannot be cancelled. Current status: {$deployment->status}",
             ], 400);
         }
 
         // Perform the cancellation
+        $cancelled = false;
+        $deploymentServer = Server::whereTeamId($teamId)->find($deployment->server_id);
+
         try {
             $deployment_uuid = $deployment->deployment_uuid;
             $kill_command = "docker rm -f {$deployment_uuid}";
             $build_server_id = $deployment->build_server_id ?? $deployment->server_id;
 
             // Mark deployment as cancelled
-            $deployment->update([
-                'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
-            ]);
+            $updated = ApplicationDeploymentQueue::whereKey($deployment->getKey())
+                ->whereIn('status', $cancellableStatuses)
+                ->update(['status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value]);
+
+            if ($updated !== 1) {
+                $deployment->refresh();
+
+                return response()->json([
+                    'message' => "Deployment cannot be cancelled. Current status: {$deployment->status}",
+                ], 400);
+            }
+
+            $deployment->status = ApplicationDeploymentStatus::CANCELLED_BY_USER->value;
+            $cancelled = true;
 
             // Get the server
             $server = Server::whereTeamId($teamId)->find($build_server_id);
 
-            if ($server) {
-                // Add cancellation log entry
-                $deployment->addLogEntry('Deployment cancelled by user via API.', 'stderr');
+            try {
+                if ($server) {
+                    // Add cancellation log entry
+                    $deployment->addLogEntry('Deployment cancelled by user via API.', 'stderr');
 
-                // Check if container exists and kill it
-                $checkCommand = "docker ps -a --filter name={$deployment_uuid} --format '{{.Names}}'";
-                $containerExists = instant_remote_process([$checkCommand], $server);
+                    // Check if container exists and kill it
+                    $checkCommand = "docker ps -a --filter name={$deployment_uuid} --format '{{.Names}}'";
+                    $containerExists = instant_remote_process([$checkCommand], $server);
 
-                if ($containerExists && str($containerExists)->trim()->isNotEmpty()) {
-                    instant_remote_process([$kill_command], $server);
-                    $deployment->addLogEntry('Deployment container stopped.');
-                } else {
-                    $deployment->addLogEntry('Deployment container not yet started. Will be cancelled when job checks status.');
-                }
+                    if ($containerExists && str($containerExists)->trim()->isNotEmpty()) {
+                        instant_remote_process([$kill_command], $server);
+                        $deployment->addLogEntry('Deployment container stopped.');
+                    } else {
+                        $deployment->addLogEntry('Deployment container not yet started. Will be cancelled when job checks status.');
+                    }
 
-                // Kill running process if process ID exists
-                if ($deployment->current_process_id) {
-                    try {
+                    // Kill running process if process ID exists
+                    if ($deployment->current_process_id) {
                         $processKillCommand = "kill -9 {$deployment->current_process_id}";
                         instant_remote_process([$processKillCommand], $server);
-                    } catch (\Throwable $e) {
-                        // Process might already be gone
                     }
                 }
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to clean up cancelled deployment {$deployment->id}: {$e->getMessage()}");
             }
 
             auditLog('api.deployment.cancelled', [
                 'team_id' => $teamId,
                 'deployment_uuid' => $deployment->deployment_uuid,
-                'application_id' => $application?->id,
-                'application_uuid' => $application?->uuid,
+                'application_id' => $deployment->application_id,
+                'application_uuid' => $deployment->application?->uuid,
                 'server_id' => $deployment->server_id,
             ]);
 
@@ -301,6 +315,14 @@ class DeployController extends Controller
             return response()->json([
                 'message' => 'Failed to cancel deployment: '.$e->getMessage(),
             ], 500);
+        } finally {
+            if ($cancelled) {
+                try {
+                    next_after_cancel($deploymentServer);
+                } catch (\Throwable $e) {
+                    \Log::warning("Failed to advance deployment queue after cancelling deployment {$deployment->id}: {$e->getMessage()}");
+                }
+            }
         }
     }
 
diff --git a/app/Jobs/DeleteResourceJob.php b/app/Jobs/DeleteResourceJob.php
index 436bf788bd..124cc16cca 100644
--- a/app/Jobs/DeleteResourceJob.php
+++ b/app/Jobs/DeleteResourceJob.php
@@ -158,12 +158,15 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             ])
             ->get();
 
+        $cancelledDeployments = 0;
+
         foreach ($activeDeployments as $activeDeployment) {
             try {
                 // Mark deployment as cancelled
                 $activeDeployment->update([
                     'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
                 ]);
+                $cancelledDeployments++;
 
                 // Add cancellation log entry
                 $activeDeployment->addLogEntry('Deployment cancelled: Pull request closed.', 'stderr');
@@ -186,6 +189,14 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             }
         }
 
+        if ($cancelledDeployments > 0) {
+            try {
+                next_after_cancel($server);
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to advance deployment queue after deleting preview {$this->resource->id}: {$e->getMessage()}");
+            }
+        }
+
         try {
             if ($server->isSwarm()) {
                 $escapedStackName = escapeshellarg("{$application->uuid}-{$pull_request_id}");
diff --git a/app/Mcp/Tools/CancelDeployment.php b/app/Mcp/Tools/CancelDeployment.php
index bbec091265..1133f34291 100644
--- a/app/Mcp/Tools/CancelDeployment.php
+++ b/app/Mcp/Tools/CancelDeployment.php
@@ -104,6 +104,13 @@ class CancelDeployment extends Tool
             'server_id' => $deployment->server_id,
         ]);
 
+        try {
+            $deploymentServer = Server::whereTeamId($teamId)->find($deployment->server_id);
+            next_after_cancel($deploymentServer);
+        } catch (\Throwable $e) {
+            \Log::warning("Failed to advance deployment queue after cancelling deployment {$deployment->id}: {$e->getMessage()}");
+        }
+
         return $this->mcpSuccess($request, $this->respond([
             'ok' => true,
             'message' => 'Deployment cancelled successfully.',
diff --git a/tests/Feature/Api/DeploymentCancellationApiTest.php b/tests/Feature/Api/DeploymentCancellationApiTest.php
index 046af059a5..81087a68dd 100644
--- a/tests/Feature/Api/DeploymentCancellationApiTest.php
+++ b/tests/Feature/Api/DeploymentCancellationApiTest.php
@@ -1,17 +1,32 @@
 <?php
 
 use App\Enums\ApplicationDeploymentStatus;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
 use App\Models\InstanceSettings;
+use App\Models\Project;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]));
 
     // Create a team with owner
     $this->team = Team::factory()->create();
@@ -119,23 +134,104 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
     });
 
     test('cancels queued deployment and updates status in database', function () {
+        $otherTeam = Team::factory()->create();
+        $buildServer = Server::factory()->create(['team_id' => $otherTeam->id]);
         $deployment = ApplicationDeploymentQueue::create([
             'deployment_uuid' => 'queued-deployment-uuid',
             'application_id' => 1,
             'server_id' => $this->server->id,
+            'build_server_id' => $buildServer->id,
             'status' => ApplicationDeploymentStatus::QUEUED->value,
         ]);
 
-        $this->withHeaders([
+        $response = $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
-        // The controller updates status before SSH calls, so DB state is always correct
+        $response->assertSuccessful()->assertJson([
+            'message' => 'Deployment cancelled successfully.',
+            'deployment_uuid' => $deployment->deployment_uuid,
+            'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
+        ]);
+
         $deployment->refresh();
         expect($deployment->status)->toBe(ApplicationDeploymentStatus::CANCELLED_BY_USER->value);
     });
 
+    test('starts the next queued deployment after cancellation', function () {
+        Queue::fake();
+
+        $otherTeam = Team::factory()->create();
+        $buildServer = Server::factory()->create(['team_id' => $otherTeam->id]);
+        $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+        $project = Project::factory()->create(['team_id' => $this->team->id]);
+        $environment = Environment::factory()->create(['project_id' => $project->id]);
+        $application = Application::factory()->create([
+            'environment_id' => $environment->id,
+            'destination_id' => $destination->id,
+            'destination_type' => $destination->getMorphClass(),
+        ]);
+        $deployment = ApplicationDeploymentQueue::create([
+            'deployment_uuid' => 'cancelled-queue-head-uuid',
+            'application_id' => $application->id,
+            'server_id' => $this->server->id,
+            'build_server_id' => $buildServer->id,
+            'destination_id' => $destination->id,
+            'commit' => 'first-commit',
+            'pull_request_id' => 0,
+            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
+        ]);
+        $nextDeployment = ApplicationDeploymentQueue::create([
+            'deployment_uuid' => 'next-queued-deployment-uuid',
+            'application_id' => $application->id,
+            'server_id' => $this->server->id,
+            'destination_id' => $destination->id,
+            'commit' => 'second-commit',
+            'pull_request_id' => 0,
+            'status' => ApplicationDeploymentStatus::QUEUED->value,
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
+
+        $response->assertSuccessful();
+        expect($nextDeployment->fresh()->status)->toBe(ApplicationDeploymentStatus::IN_PROGRESS->value);
+        Queue::assertPushed(ApplicationDeploymentJob::class, fn (ApplicationDeploymentJob $job) => $job->application_deployment_queue_id === $nextDeployment->id);
+    });
+
+    test('updates only a still cancellable deployment and treats cleanup as best effort', function () {
+        Process::fake(fn () => throw new RuntimeException('SSH unavailable'));
+
+        $deployment = ApplicationDeploymentQueue::create([
+            'deployment_uuid' => 'atomic-cancellation-uuid',
+            'application_id' => 1,
+            'server_id' => $this->server->id,
+            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
+        ]);
+        $updates = [];
+        DB::listen(function ($query) use (&$updates) {
+            if (str_starts_with(strtolower(ltrim($query->sql)), 'update')) {
+                $updates[] = strtolower($query->sql);
+            }
+        });
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
+
+        $response->assertSuccessful();
+        expect($deployment->fresh()->status)->toBe(ApplicationDeploymentStatus::CANCELLED_BY_USER->value)
+            ->and(collect($updates)->contains(
+                fn (string $sql) => str_contains($sql, 'application_deployment_queues')
+                    && str_contains($sql, 'status')
+                    && str_contains($sql, ' in '),
+            ))->toBeTrue();
+    });
+
     test('cancels in-progress deployment and updates status in database', function () {
         $deployment = ApplicationDeploymentQueue::create([
             'deployment_uuid' => 'in-progress-deployment-uuid',
diff --git a/tests/Feature/ApplicationPreviewQueueAdvancementTest.php b/tests/Feature/ApplicationPreviewQueueAdvancementTest.php
new file mode 100644
index 0000000000..3048398084
--- /dev/null
+++ b/tests/Feature/ApplicationPreviewQueueAdvancementTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Actions\Application\CleanupPreviewDeployment;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Jobs\DeleteResourceJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = $project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $this->preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/example/repository/pull/42',
+        'fqdn' => 'https://pr-42.example.com',
+    ]);
+
+    Process::fake(['*' => Process::result(output: '')]);
+    Queue::fake();
+});
+
+function createPreviewDeploymentsForQueueAdvancementTest(): array
+{
+    $activeDeployment = ApplicationDeploymentQueue::create([
+        'application_id' => test()->application->id,
+        'deployment_uuid' => 'preview-active-'.fake()->uuid(),
+        'status' => 'in_progress',
+        'server_id' => test()->server->id,
+        'destination_id' => test()->destination->id,
+        'commit' => 'preview-commit',
+        'pull_request_id' => 42,
+    ]);
+    $nextDeployment = ApplicationDeploymentQueue::create([
+        'application_id' => test()->application->id,
+        'deployment_uuid' => 'preview-next-'.fake()->uuid(),
+        'status' => 'queued',
+        'server_id' => test()->server->id,
+        'destination_id' => test()->destination->id,
+        'commit' => 'next-commit',
+        'pull_request_id' => 0,
+    ]);
+
+    return [$activeDeployment, $nextDeployment];
+}
+
+test('preview cleanup advances the deployment queue after cancelling active deployments', function () {
+    [$activeDeployment, $nextDeployment] = createPreviewDeploymentsForQueueAdvancementTest();
+
+    CleanupPreviewDeployment::run($this->application, 42, $this->preview);
+
+    expect($activeDeployment->fresh()->status)->toBe('cancelled-by-user')
+        ->and($nextDeployment->fresh()->status)->toBe('in_progress');
+    Queue::assertPushed(ApplicationDeploymentJob::class, fn (ApplicationDeploymentJob $job) => $job->application_deployment_queue_id === $nextDeployment->id);
+});
+
+test('deleting a preview advances the deployment queue after cancelling active deployments', function () {
+    [$activeDeployment, $nextDeployment] = createPreviewDeploymentsForQueueAdvancementTest();
+
+    (new DeleteResourceJob($this->preview))->handle();
+
+    expect($activeDeployment->fresh()->status)->toBe('cancelled-by-user')
+        ->and($nextDeployment->fresh()->status)->toBe('in_progress')
+        ->and(ApplicationPreview::withTrashed()->find($this->preview->id))->toBeNull();
+    Queue::assertPushed(ApplicationDeploymentJob::class, fn (ApplicationDeploymentJob $job) => $job->application_deployment_queue_id === $nextDeployment->id);
+});
diff --git a/tests/Feature/Mcp/McpReadToolsTest.php b/tests/Feature/Mcp/McpReadToolsTest.php
index b755e75b98..c3433bf455 100644
--- a/tests/Feature/Mcp/McpReadToolsTest.php
+++ b/tests/Feature/Mcp/McpReadToolsTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\ApplicationDeploymentJob;
 use App\Mcp\Concerns\BuildsResponse;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
@@ -30,11 +31,19 @@ use Illuminate\Support\Facades\Bus;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+
     InstanceSettings::query()->where('id', 0)->delete();
     InstanceSettings::query()->delete();
     $settings = new InstanceSettings(['is_mcp_server_enabled' => true]);
@@ -1744,6 +1753,7 @@ test('cancel_deployment cancels team deployment and rejects other team', functio
     Process::fake([
         '*' => Process::result(output: ''),
     ]);
+    Queue::fake();
 
     $deployment = ApplicationDeploymentQueue::create([
         'application_id' => $this->application->id,
@@ -1755,6 +1765,17 @@ test('cancel_deployment cancels team deployment and rejects other team', functio
         'commit' => 'abc',
         'current_process_id' => '12345',
     ]);
+    $nextDeployment = ApplicationDeploymentQueue::create([
+        'application_id' => $this->application->id,
+        'deployment_uuid' => 'dep-next-'.fake()->uuid(),
+        'status' => 'queued',
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'application_name' => $this->application->name,
+        'server_name' => $this->server->name,
+        'commit' => 'def',
+        'pull_request_id' => 0,
+    ]);
 
     $token = $this->user->createToken('mcp-cancel', ['read', 'deploy'])->plainTextToken;
     $ok = test()->withHeaders([
@@ -1777,6 +1798,8 @@ test('cancel_deployment cancels team deployment and rejects other team', functio
     expect($body['data']['ok'])->toBeTrue()
         ->and($body['data']['status'])->toBe('cancelled-by-user');
     expect($deployment->fresh()->status)->toBe('cancelled-by-user');
+    expect($nextDeployment->fresh()->status)->toBe('in_progress');
+    Queue::assertPushed(ApplicationDeploymentJob::class, fn (ApplicationDeploymentJob $job) => $job->application_deployment_queue_id === $nextDeployment->id);
 
     $otherTeam = Team::factory()->create();
     $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);

From db1316f878d3238d3cbdfe386600136783da1441 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 17:00:00 +0200
Subject: [PATCH 12/42] fix(backups): render form for directory-only targets
 (#11332)

---
 app/Livewire/Project/Application/Backup/Create.php |  2 +-
 tests/Feature/VolumeBackupTest.php                 | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/app/Livewire/Project/Application/Backup/Create.php b/app/Livewire/Project/Application/Backup/Create.php
index 68115e7751..f26d81b887 100644
--- a/app/Livewire/Project/Application/Backup/Create.php
+++ b/app/Livewire/Project/Application/Backup/Create.php
@@ -82,7 +82,7 @@ class Create extends Component
                 'type' => 'Directory',
                 'name' => $directory->fs_path,
             ]);
-        $this->targets = $volumes->concat($directories)->values();
+        $this->targets = collect($volumes->concat($directories)->all())->values();
         $this->targetKey = $this->selectedTargetKey ?? data_get($this->targets->first(), 'key');
         $this->loadSelectedBackup();
     }
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index 88e679a7c7..4968945916 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -222,6 +222,18 @@ it('creates a scheduled backup for a preselected application directory', functio
     expect(ScheduledVolumeBackup::query()->sole()->backupable->is($directory))->toBeTrue();
 });
 
+it('renders the backup form for an application with only a directory target', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $volume->delete();
+    $directory = createApplicationBackupDirectory($application);
+
+    Livewire::test(CreateScheduledVolumeBackup::class, ['application' => $application])
+        ->assertSet('targetKey', 'directory:'.$directory->id)
+        ->assertSuccessful();
+});
+
 it('rejects files and directory mounts owned by another application as backup targets', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);

From 5c6defbc7618008529e807dfd8ab7f77152d1a5d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 18:29:09 +0200
Subject: [PATCH 13/42] fix(backups): honor full dumps and selected storage
 deletion (#11331)

---
 app/Jobs/DatabaseBackupJob.php                | 55 ++++++++++---------
 .../Project/Database/BackupExecutions.php     | 26 ++++++---
 app/Models/ScheduledDatabaseBackup.php        |  1 +
 tests/Feature/Jobs/DatabaseBackupJobTest.php  | 46 ++++++++++++++++
 4 files changed, 92 insertions(+), 36 deletions(-)

diff --git a/app/Jobs/DatabaseBackupJob.php b/app/Jobs/DatabaseBackupJob.php
index 82e35b73ce..1838feb9e7 100644
--- a/app/Jobs/DatabaseBackupJob.php
+++ b/app/Jobs/DatabaseBackupJob.php
@@ -279,33 +279,10 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                 } else {
                     return;
                 }
-            } else {
-                if (str($databaseType)->contains('postgres')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif (str($databaseType)->contains('mongo')) {
-                    // Format: db1:collection1,collection2|db2:collection3,collection4
-                    // Only explode if it's a string, not if it's already an array
-                    if (is_string($databasesToBackup)) {
-                        $databasesToBackup = explode('|', $databasesToBackup);
-                        $databasesToBackup = array_map('trim', $databasesToBackup);
-                    }
-                } elseif (str($databaseType)->contains('mysql')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif (str($databaseType)->contains('mariadb')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif ($this->database instanceof StandaloneClickhouse) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } else {
-                    return;
-                }
+            }
+            $databasesToBackup = $this->databasesToBackup($databaseType, $databasesToBackup);
+            if ($databasesToBackup === []) {
+                return;
             }
             $this->backup_dir = backup_dir().'/databases/'.str($this->team->name)->slug().'-'.$this->team->id.'/'.$this->directory_name;
             if ($this->database->name === 'coolify-db') {
@@ -600,6 +577,30 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /** @return array<int, string> */
+    private function databasesToBackup(string $databaseType, string|array $databases): array
+    {
+        $type = str($databaseType);
+
+        if ($this->backup->dump_all && $type->contains(['postgres', 'mysql', 'mariadb'])) {
+            return ['all'];
+        }
+
+        if (is_array($databases)) {
+            return $databases;
+        }
+
+        if ($type->contains('mongo')) {
+            return array_map('trim', explode('|', $databases));
+        }
+
+        if ($type->contains(['postgres', 'mysql', 'mariadb', 'clickhouse'])) {
+            return array_map('trim', explode(',', $databases));
+        }
+
+        return [];
+    }
+
     private function backup_standalone_postgresql(string $database): void
     {
         try {
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index 41fb1681bf..73877a945e 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -98,26 +98,34 @@ class BackupExecutions extends Component
             return;
         }
 
-        $server = $execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class
-            ? $execution->scheduledDatabaseBackup->database->service->destination->server
-            : $execution->scheduledDatabaseBackup->database->destination->server;
-
         try {
-            if ($execution->filename) {
-                deleteBackupsLocally($execution->filename, $server);
+            $deleteFromS3 = in_array('delete_backup_s3', $selectedActions, true);
 
-                if ($this->delete_backup_s3 && $execution->scheduledDatabaseBackup->s3) {
-                    deleteBackupsS3($execution->filename, $execution->scheduledDatabaseBackup->s3);
+            if ($execution->filename && ! $execution->local_storage_deleted) {
+                $server = $this->backup->server();
+                if (! $server) {
+                    throw new \RuntimeException('The backup server is unavailable.');
                 }
+
+                deleteBackupsLocally($execution->filename, $server, throwError: true);
+            }
+
+            if ($deleteFromS3 && $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
+                if (! $execution->scheduledDatabaseBackup->s3) {
+                    throw new \RuntimeException('The S3 storage is unavailable.');
+                }
+
+                deleteBackupsS3($execution->filename, $execution->scheduledDatabaseBackup->s3);
             }
 
             $execution->delete();
+            $this->delete_backup_s3 = false;
             $this->dispatch('success', 'Backup deleted.');
             $this->refreshBackupExecutions();
         } catch (\Exception $e) {
             $this->dispatch('error', 'Failed to delete backup: '.$e->getMessage());
 
-            return true;
+            return false;
         }
 
         return true;
diff --git a/app/Models/ScheduledDatabaseBackup.php b/app/Models/ScheduledDatabaseBackup.php
index 4038c6288c..e41c793c86 100644
--- a/app/Models/ScheduledDatabaseBackup.php
+++ b/app/Models/ScheduledDatabaseBackup.php
@@ -11,6 +11,7 @@ class ScheduledDatabaseBackup extends BaseModel
     protected function casts(): array
     {
         return [
+            'dump_all' => 'boolean',
             'database_backup_retention_max_storage_locally' => 'float',
             'database_backup_retention_max_storage_s3' => 'float',
         ];
diff --git a/tests/Feature/Jobs/DatabaseBackupJobTest.php b/tests/Feature/Jobs/DatabaseBackupJobTest.php
index 7e47126ab1..23e1bbd8d2 100644
--- a/tests/Feature/Jobs/DatabaseBackupJobTest.php
+++ b/tests/Feature/Jobs/DatabaseBackupJobTest.php
@@ -44,6 +44,14 @@ test('scheduled database backup execution model casts storage deletion fields co
     expect($casts['s3_storage_deleted'])->toBe('boolean');
 });
 
+test('scheduled database backup casts full dump selection to boolean', function () {
+    $model = new ScheduledDatabaseBackup;
+
+    expect($model->getCasts())->toMatchArray(['dump_all' => 'boolean'])
+        ->and((new ScheduledDatabaseBackup(['dump_all' => '0']))->dump_all)->toBeFalse()
+        ->and((new ScheduledDatabaseBackup(['dump_all' => '1']))->dump_all)->toBeTrue();
+});
+
 test('upload_to_s3 throws exception and disables s3 when storage is null', function () {
     $backup = ScheduledDatabaseBackup::create([
         'frequency' => '0 0 * * *',
@@ -362,3 +370,41 @@ test('all dump all database commands use shared helper compression', function ()
         ->and(substr_count($source, '$this->buildCompressedDumpCommand($dumpCommand)'))->toBe(2)
         ->and($source)->not->toContain('| gzip >');
 });
+
+test('full database dumps create one logical all-databases archive regardless of saved database names', function (string $databaseType) {
+    $backup = new ScheduledDatabaseBackup([
+        'dump_all' => true,
+        'databases_to_backup' => 'default,analytics',
+    ]);
+    $job = new DatabaseBackupJob($backup);
+
+    $databases = (new ReflectionClass($job))
+        ->getMethod('databasesToBackup')
+        ->invoke($job, $databaseType, $backup->databases_to_backup);
+
+    expect($databases)->toBe(['all']);
+})->with(['postgresql', 'mysql', 'mariadb']);
+
+test('specific database dumps keep every selected database', function (string $databaseType) {
+    $backup = new ScheduledDatabaseBackup([
+        'dump_all' => false,
+        'databases_to_backup' => 'default, analytics',
+    ]);
+    $job = new DatabaseBackupJob($backup);
+
+    $databases = (new ReflectionClass($job))
+        ->getMethod('databasesToBackup')
+        ->invoke($job, $databaseType, $backup->databases_to_backup);
+
+    expect($databases)->toBe(['default', 'analytics']);
+})->with(['postgresql', 'mysql', 'mariadb']);
+
+test('individual database backup deletion surfaces local failures and honors selected S3 deletion', function () {
+    $source = file_get_contents(app_path('Livewire/Project/Database/BackupExecutions.php'));
+
+    expect($source)
+        ->toContain("in_array('delete_backup_s3', \$selectedActions, true)")
+        ->toContain('deleteBackupsLocally($execution->filename, $server, throwError: true)')
+        ->toContain("throw new \\RuntimeException('The backup server is unavailable.')")
+        ->not->toContain('deleteBackupsLocally($execution->filename, $server);');
+});

From 43cd1f4c0dfc883ab8c8cdea923b5be2aa4cd0c3 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 20:56:02 +0200
Subject: [PATCH 14/42] chore(release): bump Coolify versions to 4.3.8

---
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 4 ++--
 tests/Unit/ProductionImageWorkflowTest.php | 6 +++---
 versions.json                              | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 76e34334c2..bc21514677 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.7',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.8',
         'helper_version' => '1.0.15',
         'realtime_version' => '1.0.17',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 2f449eed8c..ebc1151c32 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.7"
+            "version": "4.3.8"
         },
         "nightly": {
-            "version": "4.3.8"
+            "version": "4.3.9"
         },
         "helper": {
             "version": "1.0.15"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 754eca1c30..e57587f289 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,9 +23,9 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.7'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.7')
-        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.8')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.8'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.8')
+        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.9')
         ->and($nightlyVersions)->toBe($versions);
 });
 
diff --git a/versions.json b/versions.json
index 2f449eed8c..ebc1151c32 100644
--- a/versions.json
+++ b/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.7"
+            "version": "4.3.8"
         },
         "nightly": {
-            "version": "4.3.8"
+            "version": "4.3.9"
         },
         "helper": {
             "version": "1.0.15"

From 9d64b30612af2d80bf32ff46a09d9d9bdb5f3b64 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 21:26:57 +0200
Subject: [PATCH 15/42] fix(ui): improve listbox hover state and Traefik
 redirects

Add an opaque hover background for listbox triggers and preserve single-escaped
Traefik redirect capture groups when generating application labels.
---
 bootstrap/helpers/docker.php                   | 11 ++++++++---
 resources/css/app.css                          |  4 ++++
 tests/Feature/ListboxTriggerTruncationTest.php |  7 +++++++
 tests/Unit/TraefikServiceNameSegmentTest.php   | 12 ++++++++++++
 4 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 3be2ae008b..d4466d3893 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -563,7 +563,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
     return $labels->sort();
 }
 
-function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null)
+function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true)
 {
     $labels = collect([]);
     $labels->push('traefik.enable=true');
@@ -646,14 +646,15 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
 
             $to_www_name = "{$loop}-{$uuid}-to-www";
             $to_non_www_name = "{$loop}-{$uuid}-to-non-www";
+            $redirect_capture_prefix = $escape_redirect_replacement_for_compose ? '$$' : '$';
             $redirect_to_non_www = [
                 "traefik.http.middlewares.{$to_non_www_name}.redirectregex.regex=^(http|https)://www\.(.+)",
-                "traefik.http.middlewares.{$to_non_www_name}.redirectregex.replacement=\$\${1}://\$\${2}",
+                "traefik.http.middlewares.{$to_non_www_name}.redirectregex.replacement={$redirect_capture_prefix}{1}://{$redirect_capture_prefix}{2}",
                 "traefik.http.middlewares.{$to_non_www_name}.redirectregex.permanent=false",
             ];
             $redirect_to_www = [
                 "traefik.http.middlewares.{$to_www_name}.redirectregex.regex=^(http|https)://(?:www\.)?(.+)",
-                "traefik.http.middlewares.{$to_www_name}.redirectregex.replacement=\$\${1}://www.\$\${2}",
+                "traefik.http.middlewares.{$to_www_name}.redirectregex.replacement={$redirect_capture_prefix}{1}://www.{$redirect_capture_prefix}{2}",
                 "traefik.http.middlewares.{$to_www_name}.redirectregex.permanent=false",
             ];
             if ($schema === 'https') {
@@ -876,6 +877,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
                             noindex_domains: $noindexDomains,
+                            escape_redirect_replacement_for_compose: false,
                         ));
                         break;
                 }
@@ -892,6 +894,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     http_basic_auth_username: $application->http_basic_auth_username,
                     http_basic_auth_password: $application->http_basic_auth_password,
                     noindex_domains: $noindexDomains,
+                    escape_redirect_replacement_for_compose: false,
                 ));
                 $labels = $labels->merge(fqdnLabelsForCaddy(
                     network: $application->destination->network,
@@ -932,6 +935,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         http_basic_auth_username: $application->http_basic_auth_username,
                         http_basic_auth_password: $application->http_basic_auth_password,
                         noindex_domains: $noindexDomains,
+                        escape_redirect_replacement_for_compose: false,
                     ));
                     break;
                 case ProxyTypes::CADDY->value:
@@ -962,6 +966,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 http_basic_auth_username: $application->http_basic_auth_username,
                 http_basic_auth_password: $application->http_basic_auth_password,
                 noindex_domains: $noindexDomains,
+                escape_redirect_replacement_for_compose: false,
             ));
             $labels = $labels->merge(fqdnLabelsForCaddy(
                 network: $application->destination->network,
diff --git a/resources/css/app.css b/resources/css/app.css
index 95e0207ce2..566f290317 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1903,6 +1903,10 @@ html[data-theme="custom"] textarea:disabled {
     color: var(--color-fg);
 }
 
+.listbox-trigger:hover {
+    background: var(--coollabs-fill);
+}
+
 .listbox-trigger:disabled {
     cursor: not-allowed;
     opacity: 0.5;
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index a64a97dd8a..a35ff8cbee 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -22,6 +22,13 @@ test('listbox trigger height matches shared inputs', function () {
         ->toMatch('/\.application-settings-workspace \.listbox-trigger[^}]*height: 2rem;/s');
 });
 
+test('listbox trigger uses an opaque background on hover', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)
+        ->toMatch('/\.listbox-trigger:hover \{[^}]*background: var\(--coollabs-fill\);/s');
+});
+
 test('listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.listbox id="longOption" label="Example"
diff --git a/tests/Unit/TraefikServiceNameSegmentTest.php b/tests/Unit/TraefikServiceNameSegmentTest.php
index 60dd1f153d..ef882961e0 100644
--- a/tests/Unit/TraefikServiceNameSegmentTest.php
+++ b/tests/Unit/TraefikServiceNameSegmentTest.php
@@ -95,3 +95,15 @@ test('fqdnLabelsForTraefik hyphenated services also receive a hash suffix', func
 
     expect($routerLine)->toContain("https-0-{$uuid}-another-service-{$hash}.rule=");
 });
+
+test('application labels keep redirect capture groups single escaped before compose generation', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'application-uuid',
+        domains: collect(['https://example.com']),
+        redirect_direction: 'www',
+        escape_redirect_replacement_for_compose: false,
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.middlewares.0-application-uuid-to-www.redirectregex.replacement=${1}://www.${2}');
+});

From 92d6fe9d4e3261e0447dc3a8e6024f8b4587b805 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 21:38:44 +0200
Subject: [PATCH 16/42] fix(ui): use solid surfaces for deployment indicator
 states

Remove deployment opacity fading and translucent dark-theme surfaces, and drop the global listbox hover background rule.
---
 app/Livewire/DeploymentsIndicator.php         |  6 ------
 resources/css/app.css                         |  4 ----
 .../livewire/deployments-indicator.blade.php  | 20 +++++++++----------
 .../DeploymentsIndicatorLayoutTest.php        | 15 +++++++++++++-
 .../Feature/ListboxTriggerTruncationTest.php  |  7 -------
 5 files changed, 23 insertions(+), 29 deletions(-)

diff --git a/app/Livewire/DeploymentsIndicator.php b/app/Livewire/DeploymentsIndicator.php
index 235071dbe2..28c9a00c61 100644
--- a/app/Livewire/DeploymentsIndicator.php
+++ b/app/Livewire/DeploymentsIndicator.php
@@ -54,12 +54,6 @@ class DeploymentsIndicator extends Component
         return $this->deployments->count();
     }
 
-    #[Computed]
-    public function shouldReduceOpacity(): bool
-    {
-        return request()->routeIs('project.application.deployment.*');
-    }
-
     public function toggleExpanded()
     {
         $this->expanded = ! $this->expanded;
diff --git a/resources/css/app.css b/resources/css/app.css
index 566f290317..95e0207ce2 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1903,10 +1903,6 @@ html[data-theme="custom"] textarea:disabled {
     color: var(--color-fg);
 }
 
-.listbox-trigger:hover {
-    background: var(--coollabs-fill);
-}
-
 .listbox-trigger:disabled {
     cursor: not-allowed;
     opacity: 0.5;
diff --git a/resources/views/livewire/deployments-indicator.blade.php b/resources/views/livewire/deployments-indicator.blade.php
index ece7e4b441..5b9e41f76f 100644
--- a/resources/views/livewire/deployments-indicator.blade.php
+++ b/resources/views/livewire/deployments-indicator.blade.php
@@ -1,18 +1,16 @@
 <div wire:poll.3000ms x-on:livewire:navigated.window="
         $wire.updateShouldShowFromPath(window.location.pathname || '/')
     " x-data="{
-    expanded: @entangle('expanded'),
-    reduceOpacity: @js($this->shouldReduceOpacity)
+    expanded: @entangle('expanded')
 }" class="fixed bottom-0 left-0 z-60 mb-4 ml-4 transition-[left] duration-200"
     :class="collapsed ? 'lg:left-16' : 'lg:left-56'">
     @if ($this->shouldShow && $this->deploymentCount > 0)
-        <div class="relative transition-opacity duration-200"
-            :class="{ 'opacity-100': expanded || !reduceOpacity, 'opacity-60 hover:opacity-100': reduceOpacity && !expanded }">
+        <div class="relative">
             {{-- Expanded deployment list (above the pill) --}}
             <div x-show="expanded" x-transition:enter="transition ease-out duration-200"
-                x-transition:enter-start="opacity-0 translate-y-2" x-transition:enter-end="opacity-100 translate-y-0"
-                x-transition:leave="transition ease-in duration-150" x-transition:leave-start="opacity-100 translate-y-0"
-                x-transition:leave-end="opacity-0 translate-y-2" x-cloak
+                x-transition:enter-start="translate-y-2" x-transition:enter-end="translate-y-0"
+                x-transition:leave="transition ease-in duration-150" x-transition:leave-start="translate-y-0"
+                x-transition:leave-end="translate-y-2" x-cloak
                 class="absolute bottom-full mb-2 w-[min(22rem,calc(100vw-2rem))] overflow-hidden rounded-xl"
                 style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
                 <div class="max-h-96 space-y-1 overflow-y-auto p-2 scrollbar">
@@ -26,9 +24,9 @@
                         @endphp
                         <a wire:key="indicator-deployment-{{ $deployment->id }}"
                             href="{{ $deployment->deployment_url }}" {{ wireNavigate() }}
-                            class="flex items-start gap-3 rounded-lg border border-transparent p-3 transition-colors hover:border-neutral-200 hover:bg-neutral-50 hover:no-underline dark:hover:border-white/[0.08] dark:hover:bg-white/[0.04]">
+                            class="flex items-start gap-3 rounded-lg border border-transparent p-3 transition-colors hover:border-neutral-200 hover:bg-neutral-50 hover:no-underline dark:border-coolgray-300 dark:hover:border-coolgray-400 dark:hover:bg-raised">
                             <div
-                                class="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-coollabs dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-warning">
+                                class="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-coollabs dark:border-coolgray-300 dark:bg-raised dark:text-warning">
                                 @if ($deployment->status === 'in_progress')
                                     <svg class="size-3.5 animate-spin" xmlns="http://www.w3.org/2000/svg" fill="none"
                                         viewBox="0 0 24 24" aria-hidden="true">
@@ -61,7 +59,7 @@
                                 <p class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
                                     {{ $deployment->server_name ?: '-' }}
                                     @if ($deployment->pull_request_id)
-                                        <span class="px-1 text-neutral-300 dark:text-white/15">·</span>
+                                        <span class="px-1 text-neutral-300 dark:text-fg-faint">·</span>
                                         PR #{{ $deployment->pull_request_id }}
                                     @endif
                                 </p>
@@ -73,7 +71,7 @@
 
             {{-- Collapsed pill --}}
             <button type="button" @click="expanded = !expanded"
-                class="flex items-center gap-2 rounded-xl border border-neutral-200 bg-white px-3.5 py-2 text-sm font-medium text-neutral-800 transition-colors hover:bg-neutral-50 dark:border-white/[0.08] dark:bg-surface dark:text-fg dark:hover:bg-white/[0.04]"
+                class="flex items-center gap-2 rounded-xl border border-neutral-200 bg-white px-3.5 py-2 text-sm font-medium text-neutral-800 transition-colors hover:bg-neutral-50 dark:border-coolgray-300 dark:bg-surface dark:text-fg dark:hover:bg-raised"
                 style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal);"
                 :aria-expanded="expanded.toString()" aria-label="Active deployments">
                 <svg class="loading-indicator size-3.5 shrink-0 animate-spin"
diff --git a/tests/Feature/DeploymentsIndicatorLayoutTest.php b/tests/Feature/DeploymentsIndicatorLayoutTest.php
index d70679d452..c1676dd817 100644
--- a/tests/Feature/DeploymentsIndicatorLayoutTest.php
+++ b/tests/Feature/DeploymentsIndicatorLayoutTest.php
@@ -30,7 +30,7 @@ it('uses the redesigned elevated surface and status badge patterns', function ()
         ->toContain("'In progress'")
         ->toContain("'Queued'")
         ->toContain('dark:text-fg')
-        ->toContain('dark:border-white/[0.08]')
+        ->toContain('dark:border-coolgray-300')
         ->toContain('$this->shouldShow')
         ->toContain('updateShouldShowFromPath')
         ->toContain('livewire:navigated')
@@ -39,3 +39,16 @@ it('uses the redesigned elevated surface and status badge patterns', function ()
         ->not->toContain('text-gray-800')
         ->not->toContain("str_replace('_', ' ', \$deployment->status)");
 });
+
+it('uses solid surfaces in every deployments indicator state', function () {
+    $indicatorView = file_get_contents(resource_path('views/livewire/deployments-indicator.blade.php'));
+
+    expect($indicatorView)
+        ->not->toContain('reduceOpacity')
+        ->not->toContain('transition-opacity')
+        ->not->toContain('x-transition:enter-start="opacity-0')
+        ->not->toContain('x-transition:leave-end="opacity-0')
+        ->not->toContain('dark:bg-white/[')
+        ->not->toContain('dark:hover:bg-white/[')
+        ->not->toContain('dark:border-white/[');
+});
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index a35ff8cbee..a64a97dd8a 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -22,13 +22,6 @@ test('listbox trigger height matches shared inputs', function () {
         ->toMatch('/\.application-settings-workspace \.listbox-trigger[^}]*height: 2rem;/s');
 });
 
-test('listbox trigger uses an opaque background on hover', function () {
-    $css = file_get_contents(resource_path('css/app.css'));
-
-    expect($css)
-        ->toMatch('/\.listbox-trigger:hover \{[^}]*background: var\(--coollabs-fill\);/s');
-});
-
 test('listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.listbox id="longOption" label="Example"

From 3d025a2a9b221b040090f1dff8a66067e22cb43f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 22:38:44 +0200
Subject: [PATCH 17/42] docs: design external TLS redirect control

---
 ...08-17-external-tls-http-redirect-design.md | 90 +++++++++++++++++++
 1 file changed, 90 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-08-17-external-tls-http-redirect-design.md

diff --git a/docs/superpowers/specs/2026-08-17-external-tls-http-redirect-design.md b/docs/superpowers/specs/2026-08-17-external-tls-http-redirect-design.md
new file mode 100644
index 0000000000..7693ce13da
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-17-external-tls-http-redirect-design.md
@@ -0,0 +1,90 @@
+# External TLS HTTP Redirect Design
+
+## Problem
+
+The Cloudflare Tunnel all-resource setup sends public HTTPS requests to Coolify's proxy through `http://localhost:80`. When a resource domain is stored as `https://` and Coolify redirects HTTP traffic to HTTPS, the tunneled request repeatedly returns to the HTTP entrypoint and causes `TOO_MANY_REDIRECTS`.
+
+The current documentation avoids the loop by telling users to store the public domain as `http://`. That misrepresents the public URL and can produce incorrect secure cookies, OAuth callback URLs, and canonical links. Applications can already disable forced HTTPS in advanced settings, but the control is not near domain configuration. Service applications always enable the redirect in generated proxy configuration.
+
+## Goals
+
+- Store the externally visible URL accurately as `https://`.
+- Let an upstream proxy such as Cloudflare handle the HTTP-to-HTTPS redirect.
+- Apply the behavior consistently to applications and service applications.
+- Keep existing resources secure and behaviorally unchanged by default.
+- Keep the feature generic rather than coupling it to Cloudflare or a server-wide tunnel mode.
+
+## Non-goals
+
+- Detect Cloudflare automatically.
+- Add a server-wide all-resource tunnel mode.
+- Configure trusted forwarded-header networks.
+- Replace the end-to-end origin TLS workflow.
+- Change the default redirect behavior of existing or new resources.
+
+## User Experience
+
+The Domains page shows a boolean control named **Redirect HTTP to HTTPS** when a resource has at least one `https://` domain.
+
+The control defaults to enabled. Its help text explains:
+
+> Disable this when HTTPS and redirects are handled by Cloudflare Tunnel or another reverse proxy that connects to Coolify over HTTP.
+
+A Cloudflare Tunnel user configures `https://app.example.com` and disables the control. A directly exposed resource leaves it enabled.
+
+For regular and Docker Compose applications, the control edits the existing `ApplicationSetting::is_force_https_enabled` value. The existing Advanced-page control must not become an independent source of truth; it should either be removed from that page or remain bound to the same setting with the clearer label.
+
+For service applications, the Domains page provides the same control for each application service. Database-only service entries do not expose it.
+
+## Data Model
+
+Add `is_force_https_enabled` to service applications as a non-null boolean with a default of `true`. Existing service applications therefore keep their current behavior after migration.
+
+Regular applications continue using the existing application setting. No Cloudflare-specific state is stored.
+
+## Proxy Configuration
+
+Domain scheme and redirect policy remain independent:
+
+- An `https://` domain continues generating the HTTPS router/listener.
+- Its HTTP router/listener is also generated.
+- When redirect is enabled, the HTTP router applies the HTTPS redirect middleware.
+- When redirect is disabled, the HTTP router forwards the request to the resource without that middleware.
+
+The stored service-application setting replaces the currently hardcoded `true` passed into Traefik and Caddy label generation. Existing path stripping, gzip, authentication, noindex, and www/non-www middleware behavior remains unchanged.
+
+Preview deployments inherit the parent application's existing redirect setting, matching current application behavior.
+
+## Validation and Authorization
+
+The new service-application value is validated as a boolean. Updating it uses the same authorization checks as other service domain settings. Changing the value marks proxy configuration as changed and follows the existing save/redeploy flow used by domain configuration.
+
+The control is relevant only when an HTTPS domain exists. Hiding it for HTTP-only resources does not reset the stored value.
+
+## Documentation
+
+Update the Cloudflare all-resource guide to instruct users to:
+
+1. Store the public resource domain using `https://`.
+2. Disable **Redirect HTTP to HTTPS** for that resource.
+3. Let Cloudflare perform the public redirect and TLS termination.
+
+The guide should retain the full TLS guide as the alternative for users who want TLS between cloudflared and Coolify's HTTPS entrypoint.
+
+## Testing
+
+Automated tests must cover:
+
+- Application HTTPS domains with redirects enabled and disabled.
+- Service-application HTTPS domains with redirects enabled and disabled.
+- The service-application default remains enabled.
+- Traefik and Caddy omit only the redirect behavior when disabled.
+- Other middleware remains present when the redirect is disabled.
+- HTTP-only resources do not show an irrelevant control.
+- The Domains UI persists changes with existing authorization rules.
+
+A manual smoke test should route a Cloudflare Tunnel hostname to `http://localhost:80`, save the Coolify resource as `https://`, disable the redirect, and verify the public HTTPS URL loads without a redirect loop.
+
+## Compatibility
+
+The database default of `true` preserves service behavior. Existing application values are unchanged. No automatic migration attempts to infer which resources are behind Cloudflare.

From 69dbfe00795f3a4b666189ce3634a8ccce152259 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 23:34:56 +0200
Subject: [PATCH 18/42] fix(modal): use checkbox ids for Livewire bindings
 (#11335)

---
 .../components/modal-confirmation.blade.php      |  1 -
 .../ModalConfirmationStep1NoCancelTest.php       | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/resources/views/components/modal-confirmation.blade.php b/resources/views/components/modal-confirmation.blade.php
index 8cc233a0c6..0e4350f50f 100644
--- a/resources/views/components/modal-confirmation.blade.php
+++ b/resources/views/components/modal-confirmation.blade.php
@@ -236,7 +236,6 @@
                             @foreach ($checkboxes as $index => $checkbox)
                                 <div class="flex justify-between items-center mb-2">
                                     <x-forms.checkbox fullWidth :label="$checkbox['label']" :id="$checkbox['id']"
-                                        :wire:model="$checkbox['id']"
                                         x-on:change="toggleAction('{{ $checkbox['id'] }}')" :checked="$this->{$checkbox['id']}"
                                         x-bind:checked="selectedActions.includes('{{ $checkbox['id'] }}')" />
                                 </div>
diff --git a/tests/Feature/ModalConfirmationStep1NoCancelTest.php b/tests/Feature/ModalConfirmationStep1NoCancelTest.php
index ec1425e7e3..0311cd0ecf 100644
--- a/tests/Feature/ModalConfirmationStep1NoCancelTest.php
+++ b/tests/Feature/ModalConfirmationStep1NoCancelTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use Illuminate\Support\Facades\Blade;
+
 /**
  * Step 1 (checkbox options) should only show Continue — dismiss is the header X.
  */
@@ -13,3 +15,17 @@ test('modal confirmation step 1 does not render a cancel button', function () {
         ->toContain('step1ButtonText')
         ->not->toContain('Cancel');
 });
+
+test('modal confirmation lets checkbox ids define their Livewire model binding', function () {
+    $checkbox = Blade::render(<<<'BLADE'
+        <x-forms.checkbox id="deleteVolumes"
+            x-on:change="toggleAction('deleteVolumes')"
+            x-bind:checked="selectedActions.includes('deleteVolumes')" />
+    BLADE);
+
+    expect($checkbox)
+        ->toContain('x-on:change="toggleAction(\'deleteVolumes\')"')
+        ->toContain('x-bind:checked="selectedActions.includes(\'deleteVolumes\')"')
+        ->toContain('wire:model=deleteVolumes')
+        ->toMatch('/id="deleteVolumes-[a-zA-Z0-9]{24}"/');
+});

From 17d9d1a3701da90c2a515d02bf6c2875839a6c08 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:08:18 +0200
Subject: [PATCH 19/42] feat(domains): add configurable HTTPS redirects for
 service apps

---
 .../UpdateServiceApplicationFromApi.php       |  4 ++
 .../Api/ServiceApplicationsController.php     |  3 +
 app/Livewire/Project/Application/Domains.php  | 16 +++++
 app/Livewire/Project/Service/Domains.php      | 36 +++++++++-
 app/Mcp/Concerns/BuildsResponse.php           | 13 ++++
 app/Models/ServiceApplication.php             | 11 +++
 app/View/Components/Services/Links.php        |  2 +-
 bootstrap/helpers/docker.php                  | 33 +++++----
 bootstrap/helpers/parsers.php                 | 14 ++--
 bootstrap/helpers/shared.php                  |  8 +--
 ..._enabled_to_service_applications_table.php | 28 ++++++++
 .../views/auth/two-factor-challenge.blade.php | 46 +++----------
 .../views/components/services/links.blade.php | 16 +++--
 .../project/application/domains.blade.php     | 15 ++++
 .../project/service/domains.blade.php         | 18 ++++-
 .../project/service/heading.blade.php         |  8 +--
 .../shared/resource-operations.blade.php      |  2 +-
 tests/Feature/ApplicationDomainsTest.php      | 21 ++++++
 ...licationParserDockerComposeDomainsTest.php |  4 +-
 .../Auth/TwoFactorChallengeAccessTest.php     | 12 ++++
 .../Feature/ListboxTriggerTruncationTest.php  |  3 +-
 tests/Feature/Mcp/McpEndpointTest.php         | 10 +++
 tests/Feature/Mcp/McpReadToolsTest.php        | 45 ++++++++++++
 tests/Feature/ModelFillableCreationTest.php   | 21 ++++++
 .../ResourceHeadingUnifiedNavbarTest.php      | 33 ++++++---
 tests/Feature/ServiceApplicationsApiTest.php  | 14 ++++
 tests/Feature/ServiceDomainsTest.php          | 30 ++++++++
 .../TraefikServiceDockerNetworkLabelTest.php  |  4 +-
 tests/Unit/FqdnLabelsNoindexTest.php          | 68 ++++++++++++++++++-
 .../ServerTransferExporterImporterTest.php    |  2 +
 30 files changed, 444 insertions(+), 96 deletions(-)
 create mode 100644 database/migrations/2026_08_17_000000_add_is_force_https_enabled_to_service_applications_table.php

diff --git a/app/Actions/Service/UpdateServiceApplicationFromApi.php b/app/Actions/Service/UpdateServiceApplicationFromApi.php
index 9d97c47380..123b752c0f 100644
--- a/app/Actions/Service/UpdateServiceApplicationFromApi.php
+++ b/app/Actions/Service/UpdateServiceApplicationFromApi.php
@@ -88,6 +88,10 @@ class UpdateServiceApplicationFromApi
             $serviceApplication->is_stripprefix_enabled = filter_var($payload['is_stripprefix_enabled'], FILTER_VALIDATE_BOOLEAN);
         }
 
+        if (array_key_exists('is_force_https_enabled', $payload)) {
+            $serviceApplication->is_force_https_enabled = filter_var($payload['is_force_https_enabled'], FILTER_VALIDATE_BOOLEAN);
+        }
+
         if (array_key_exists('is_log_drain_enabled', $payload)) {
             $enabled = filter_var($payload['is_log_drain_enabled'], FILTER_VALIDATE_BOOLEAN);
             $server = $serviceApplication->service->destination->server;
diff --git a/app/Http/Controllers/Api/ServiceApplicationsController.php b/app/Http/Controllers/Api/ServiceApplicationsController.php
index 414aff0359..e8446467de 100644
--- a/app/Http/Controllers/Api/ServiceApplicationsController.php
+++ b/app/Http/Controllers/Api/ServiceApplicationsController.php
@@ -256,6 +256,7 @@ class ServiceApplicationsController extends Controller
                         'is_log_drain_enabled' => new OA\Property(property: 'is_log_drain_enabled', type: 'boolean', nullable: true),
                         'is_gzip_enabled' => new OA\Property(property: 'is_gzip_enabled', type: 'boolean', nullable: true),
                         'is_stripprefix_enabled' => new OA\Property(property: 'is_stripprefix_enabled', type: 'boolean', nullable: true),
+                        'is_force_https_enabled' => new OA\Property(property: 'is_force_https_enabled', type: 'boolean', nullable: true),
                     ]
                 )
             )
@@ -328,6 +329,7 @@ class ServiceApplicationsController extends Controller
             'is_log_drain_enabled',
             'is_gzip_enabled',
             'is_stripprefix_enabled',
+            'is_force_https_enabled',
         ];
 
         $validationRules = [
@@ -341,6 +343,7 @@ class ServiceApplicationsController extends Controller
             'is_log_drain_enabled' => 'sometimes|boolean',
             'is_gzip_enabled' => 'sometimes|boolean',
             'is_stripprefix_enabled' => 'sometimes|boolean',
+            'is_force_https_enabled' => 'sometimes|boolean',
         ];
 
         $validator = Validator::make($payload, $validationRules);
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 477abc08e6..45a76a4c33 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -23,6 +23,8 @@ class Domains extends Component
 
     public string $redirect = 'both';
 
+    public bool $isForceHttpsEnabled = true;
+
     /**
      * Per compose-service www/non-www redirect direction.
      * Keys are wire-safe (dots encoded) — use serviceRedirectWireKey().
@@ -109,6 +111,7 @@ class Domains extends Component
             'newDomain' => ValidationPatterns::applicationDomainRules(),
             'editingDomain' => ValidationPatterns::applicationDomainRules(),
             'redirect' => 'string|required|in:both,www,non-www',
+            'isForceHttpsEnabled' => 'boolean',
             'serviceRedirects' => 'array',
             'serviceRedirects.*' => 'string|in:both,www,non-www',
         ];
@@ -160,6 +163,18 @@ class Domains extends Component
         $this->setRedirect();
     }
 
+    public function updateForceHttps(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->validateOnly('isForceHttpsEnabled');
+
+        $this->application->settings->is_force_https_enabled = $this->isForceHttpsEnabled;
+        $this->application->settings->save();
+        $this->resetDefaultLabels();
+        $this->dispatch('configurationChanged')->to(ConfigurationChecker::class);
+        $this->dispatch('success', 'HTTP to HTTPS redirect updated.');
+    }
+
     public function loadDomainState(): void
     {
         $this->application->refresh();
@@ -168,6 +183,7 @@ class Domains extends Component
         $this->isCompose = $this->application->build_pack === 'dockercompose';
         $this->labelsAreWritable = $this->application->settings->is_container_label_readonly_enabled === false;
         $this->redirect = $this->application->redirect ?? 'both';
+        $this->isForceHttpsEnabled = $this->application->isForceHttpsEnabled();
 
         $settings = instanceSettings();
         $this->dnsValidationEnabled = (bool) data_get($settings, 'is_dns_validation_enabled', true);
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index ad31560b5a..4690335d86 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -33,6 +33,9 @@ class Domains extends Component
      */
     public array $serviceRedirects = [];
 
+    /** @var array<int|string, bool> */
+    public array $forceHttpsRedirects = [];
+
     /** Service application id when a pending domain conflict belongs to setServiceRedirect. */
     public ?int $pendingRedirectServiceApplicationId = null;
 
@@ -110,6 +113,8 @@ class Domains extends Component
             'newServiceApplicationId' => 'nullable|integer',
             'serviceRedirects' => 'array',
             'serviceRedirects.*' => 'string|in:both,www,non-www',
+            'forceHttpsRedirects' => 'array',
+            'forceHttpsRedirects.*' => 'boolean',
         ];
     }
 
@@ -143,6 +148,22 @@ class Domains extends Component
         $this->dispatch('success', 'Search engine indexing updated.');
     }
 
+    public function updateForceHttps(int $serviceApplicationId, bool $enabled): void
+    {
+        $application = $this->service->applications()->findOrFail($serviceApplicationId);
+        $this->authorize('update', $application);
+
+        $this->forceHttpsRedirects[$serviceApplicationId] = $enabled;
+        $this->validateOnly("forceHttpsRedirects.{$serviceApplicationId}");
+
+        $application->is_force_https_enabled = $enabled;
+        $application->save();
+        $this->service->parse();
+        $this->refreshDomains();
+        $this->dispatch('configurationChanged')->to(ConfigurationChecker::class);
+        $this->dispatch('success', 'HTTP to HTTPS redirect updated.');
+    }
+
     public function loadDomainState(): void
     {
         $this->service->loadMissing(['applications', 'server']);
@@ -167,6 +188,10 @@ class Domains extends Component
             $this->serverIpConfigured = null;
         }
 
+        $this->forceHttpsRedirects = $this->service->applications
+            ->mapWithKeys(fn (ServiceApplication $app) => [$app->id => $app->isForceHttpsEnabled()])
+            ->all();
+
         $this->serviceApps = $this->service->applications
             ->sortBy(fn (ServiceApplication $app) => strtolower($app->human_name ?: $app->name))
             ->values()
@@ -518,9 +543,7 @@ class Domains extends Component
 
     public function updatedNewDomain(): void
     {
-        $this->addDomainDnsFailed = false;
-        $this->addDomainDnsMessage = '';
-        $this->forceSaveDns = false;
+        $this->resetAddDomainDnsGate();
     }
 
     public function updatedNewDomainParts(): void
@@ -529,6 +552,13 @@ class Domains extends Component
         $this->resetAddDomainDnsGate();
     }
 
+    public function resetAddDomainDnsGate(): void
+    {
+        $this->addDomainDnsFailed = false;
+        $this->addDomainDnsMessage = '';
+        $this->forceSaveDns = false;
+    }
+
     public function updatedEditingDomain(): void
     {
         $this->editDomainDnsFailed = false;
diff --git a/app/Mcp/Concerns/BuildsResponse.php b/app/Mcp/Concerns/BuildsResponse.php
index d429edb5ff..280e26b9e7 100644
--- a/app/Mcp/Concerns/BuildsResponse.php
+++ b/app/Mcp/Concerns/BuildsResponse.php
@@ -47,6 +47,18 @@ trait BuildsResponse
         // app/env secrets
         'value', 'real_value', 'http_basic_auth_password',
 
+        // free-form commands / configurations can embed credentials
+        'git_full_url',
+        'install_command', 'build_command', 'start_command',
+        'health_check_command', 'health_check_response_text',
+        'custom_docker_run_options', 'pre_deployment_command', 'post_deployment_command',
+        'docker_compose_custom_start_command', 'docker_compose_custom_build_command',
+        'custom_nginx_configuration',
+
+        // raw database configuration blobs
+        'postgres_conf', 'mysql_conf', 'mariadb_conf', 'mongo_conf',
+        'redis_conf', 'keydb_conf',
+
         // database connection strings embed credentials
         'internal_db_url', 'external_db_url', 'init_scripts',
 
@@ -58,6 +70,7 @@ trait BuildsResponse
 
         // bulky / unsafe blobs
         'dockerfile', 'docker_compose', 'docker_compose_raw',
+        'last_saved_proxy_configuration',
         'custom_labels', 'environment_variables',
         'environment_variables_preview', 'validation_logs',
         'server_metadata', 'logs', 'configuration_snapshot',
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index 4afc6c29d2..9763fa894b 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -31,6 +31,7 @@ class ServiceApplication extends BaseModel
         'is_include_timestamps',
         'is_gzip_enabled',
         'is_stripprefix_enabled',
+        'is_force_https_enabled',
         'last_online_at',
         'is_migrated',
     ];
@@ -44,11 +45,16 @@ class ServiceApplication extends BaseModel
         'domain_dns_statuses',
     ];
 
+    protected $attributes = [
+        'is_force_https_enabled' => true,
+    ];
+
     protected function casts(): array
     {
         return [
             'domain_dns_statuses' => 'array',
             'noindex_domains' => 'array',
+            'is_force_https_enabled' => 'boolean',
         ];
     }
 
@@ -124,6 +130,11 @@ class ServiceApplication extends BaseModel
         return data_get($this, 'is_gzip_enabled', true);
     }
 
+    public function isForceHttpsEnabled(): bool
+    {
+        return $this->is_force_https_enabled;
+    }
+
     public function type()
     {
         return 'service';
diff --git a/app/View/Components/Services/Links.php b/app/View/Components/Services/Links.php
index 147b49d686..5b77dc90f3 100644
--- a/app/View/Components/Services/Links.php
+++ b/app/View/Components/Services/Links.php
@@ -12,7 +12,7 @@ class Links extends Component
 {
     public Collection $links;
 
-    public function __construct(public Service $service, public bool $fullWidth = false)
+    public function __construct(public Service $service, public bool $fullWidth = false, public bool $compact = false)
     {
         $this->links = collect([]);
         $service->applications()->get()->map(function ($application) {
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index d4466d3893..ae29637554 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -518,6 +518,10 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         $path = $url->getPath();
         $host_without_www = str($host)->replace('www.', '');
         $schema = $url->getScheme();
+        $siteAddress = "{$schema}://{$host}";
+        if ($schema === 'https' && ! $is_force_https_enabled) {
+            $siteAddress = "http://{$host}, https://{$host}";
+        }
         $port = $url->getPort();
         $handle = 'handle_path';
         if (! $is_stripprefix_enabled) {
@@ -529,7 +533,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         if (is_null($port) && $predefinedPort) {
             $port = $predefinedPort;
         }
-        $labels->push("caddy_{$loop}={$schema}://{$host}");
+        $labels->push("caddy_{$loop}={$siteAddress}");
         if (isNoindexDomain($domain, $noindex_domains)) {
             // Caddy's header directive takes either inline arguments or a block,
             // never both, so -Server has to move into the block alongside it.
@@ -549,11 +553,12 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         if ($is_gzip_enabled) {
             $labels->push("caddy_{$loop}.encode=zstd gzip");
         }
+        $redirect_schema = $is_force_https_enabled ? $schema : '{scheme}';
         if ($redirect_direction === 'www' && ! str($host)->startsWith('www.')) {
-            $labels->push("caddy_{$loop}.redir={$schema}://www.{$host}{uri}");
+            $labels->push("caddy_{$loop}.redir={$redirect_schema}://www.{$host}{uri}");
         }
         if ($redirect_direction === 'non-www' && str($host)->startsWith('www.')) {
-            $labels->push("caddy_{$loop}.redir={$schema}://{$host_without_www}{uri}");
+            $labels->push("caddy_{$loop}.redir={$redirect_schema}://{$host_without_www}{uri}");
         }
         if ($is_http_basic_auth_enabled) {
             $labels->push("caddy_{$loop}.basicauth.{$http_basic_auth_username}=\"{$hashedPassword}\"");
@@ -696,8 +701,7 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
                         $middlewares->push($middleware_name);
                     });
                     if ($middlewares->isNotEmpty()) {
-                        $middlewares = $middlewares->join(',');
-                        $labels->push("traefik.http.routers.{$https_label}.middlewares={$middlewares}");
+                        $labels->push("traefik.http.routers.{$https_label}.middlewares={$middlewares->join(',')}");
                     }
                 } else {
                     $middlewares = collect([]);
@@ -725,8 +729,7 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
                         $middlewares->push($middleware_name);
                     });
                     if ($middlewares->isNotEmpty()) {
-                        $middlewares = $middlewares->join(',');
-                        $labels->push("traefik.http.routers.{$https_label}.middlewares={$middlewares}");
+                        $labels->push("traefik.http.routers.{$https_label}.middlewares={$middlewares->join(',')}");
                     }
                 }
                 $labels->push("traefik.http.routers.{$https_label}.tls=true");
@@ -739,15 +742,17 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
                     $labels->push("traefik.http.services.{$http_label}.loadbalancer.server.port=$port");
                     $labels->push("traefik.http.routers.{$http_label}.service={$http_label}");
                 }
-                $middlewares = collect([]);
-                if ($is_noindex) {
-                    $middlewares->push($noindex_name);
-                }
                 if ($is_force_https_enabled) {
-                    $middlewares->push('redirect-to-https');
+                    $httpMiddlewares = collect([]);
+                    if ($is_noindex) {
+                        $httpMiddlewares->push($noindex_name);
+                    }
+                    $httpMiddlewares->push('redirect-to-https');
+                } else {
+                    $httpMiddlewares = $middlewares;
                 }
-                if ($middlewares->isNotEmpty()) {
-                    $labels->push("traefik.http.routers.{$http_label}.middlewares={$middlewares->join(',')}");
+                if ($httpMiddlewares->isNotEmpty()) {
+                    $labels->push("traefik.http.routers.{$http_label}.middlewares={$httpMiddlewares->join(',')}");
                 }
             } else {
                 // Set labels for http
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index ddfd455319..7dd1c163c0 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1359,9 +1359,6 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                 ? $composeRedirect
                 : 'both';
-            if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
-                $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
-            }
             if ($shouldGenerateLabelsExactly) {
                 switch ($server->proxyType()) {
                     case ProxyTypes::TRAEFIK->value:
@@ -2636,16 +2633,13 @@ function serviceParser(Service $resource): Collection
             $redirectDirection = in_array(data_get($originalResource, 'redirect'), ['www', 'non-www', 'both'], true)
                 ? data_get($originalResource, 'redirect')
                 : 'both';
-            if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
-                $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
-            }
             if ($shouldGenerateLabelsExactly) {
                 switch ($server->proxyType()) {
                     case ProxyTypes::TRAEFIK->value:
                         $serviceLabels = $serviceLabels->merge(fqdnLabelsForTraefik(
                             uuid: $uuid,
                             domains: $fqdns,
-                            is_force_https_enabled: true,
+                            is_force_https_enabled: $originalResource->isForceHttpsEnabled(),
                             serviceLabels: $serviceLabels,
                             is_gzip_enabled: $originalResource->isGzipEnabled(),
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
@@ -2660,7 +2654,7 @@ function serviceParser(Service $resource): Collection
                             network: $network,
                             uuid: $uuid,
                             domains: $fqdns,
-                            is_force_https_enabled: true,
+                            is_force_https_enabled: $originalResource->isForceHttpsEnabled(),
                             serviceLabels: $serviceLabels,
                             is_gzip_enabled: $originalResource->isGzipEnabled(),
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
@@ -2676,7 +2670,7 @@ function serviceParser(Service $resource): Collection
                 $serviceLabels = $serviceLabels->merge(fqdnLabelsForTraefik(
                     uuid: $uuid,
                     domains: $fqdns,
-                    is_force_https_enabled: true,
+                    is_force_https_enabled: $originalResource->isForceHttpsEnabled(),
                     serviceLabels: $serviceLabels,
                     is_gzip_enabled: $originalResource->isGzipEnabled(),
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
@@ -2689,7 +2683,7 @@ function serviceParser(Service $resource): Collection
                     network: $network,
                     uuid: $uuid,
                     domains: $fqdns,
-                    is_force_https_enabled: true,
+                    is_force_https_enabled: $originalResource->isForceHttpsEnabled(),
                     serviceLabels: $serviceLabels,
                     is_gzip_enabled: $originalResource->isGzipEnabled(),
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index cf63c4776a..78a1f95e50 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3050,7 +3050,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     $serviceLabels = $serviceLabels->merge(fqdnLabelsForTraefik(
                                         uuid: $resource->uuid,
                                         domains: $fqdns,
-                                        is_force_https_enabled: true,
+                                        is_force_https_enabled: $savedService->isForceHttpsEnabled(),
                                         serviceLabels: $serviceLabels,
                                         is_gzip_enabled: $savedService->isGzipEnabled(),
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
@@ -3065,7 +3065,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         network: $resource->destination->network,
                                         uuid: $resource->uuid,
                                         domains: $fqdns,
-                                        is_force_https_enabled: true,
+                                        is_force_https_enabled: $savedService->isForceHttpsEnabled(),
                                         serviceLabels: $serviceLabels,
                                         is_gzip_enabled: $savedService->isGzipEnabled(),
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
@@ -3080,7 +3080,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                             $serviceLabels = $serviceLabels->merge(fqdnLabelsForTraefik(
                                 uuid: $resource->uuid,
                                 domains: $fqdns,
-                                is_force_https_enabled: true,
+                                is_force_https_enabled: $savedService->isForceHttpsEnabled(),
                                 serviceLabels: $serviceLabels,
                                 is_gzip_enabled: $savedService->isGzipEnabled(),
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
@@ -3093,7 +3093,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 network: $resource->destination->network,
                                 uuid: $resource->uuid,
                                 domains: $fqdns,
-                                is_force_https_enabled: true,
+                                is_force_https_enabled: $savedService->isForceHttpsEnabled(),
                                 serviceLabels: $serviceLabels,
                                 is_gzip_enabled: $savedService->isGzipEnabled(),
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
diff --git a/database/migrations/2026_08_17_000000_add_is_force_https_enabled_to_service_applications_table.php b/database/migrations/2026_08_17_000000_add_is_force_https_enabled_to_service_applications_table.php
new file mode 100644
index 0000000000..f389ef27d1
--- /dev/null
+++ b/database/migrations/2026_08_17_000000_add_is_force_https_enabled_to_service_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->boolean('is_force_https_enabled')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->dropColumn('is_force_https_enabled');
+        });
+    }
+};
diff --git a/resources/views/auth/two-factor-challenge.blade.php b/resources/views/auth/two-factor-challenge.blade.php
index 4170b188fe..b15afc24de 100644
--- a/resources/views/auth/two-factor-challenge.blade.php
+++ b/resources/views/auth/two-factor-challenge.blade.php
@@ -2,35 +2,13 @@
     <x-auth.shell title="Coolify" description="Verify your identity to finish signing in.">
         <div class="flex flex-col gap-4" x-data="{
             showRecovery: false,
-            digits: ['', '', '', '', '', ''],
-            code: '',
-            focusNext(event) {
-                const nextInput = event.target.nextElementSibling;
-                if (nextInput?.tagName === 'INPUT') nextInput.focus();
-            },
-            focusPrevious(event) {
-                if (event.key !== 'Backspace' || event.target.value) return;
+            submitAuthenticatorCode(event) {
+                event.target.value = event.target.value.replace(/\D/g, '').slice(0, 6);
 
-                const previousInput = event.target.previousElementSibling;
-                if (previousInput?.tagName === 'INPUT') previousInput.focus();
-            },
-            updateCode() {
-                this.code = this.digits.join('');
-
-                if (this.code.length === 6) {
+                if (event.target.value.length === 6) {
                     this.$nextTick(() => this.$refs.challengeForm.requestSubmit());
                 }
             },
-            pasteCode(event) {
-                event.preventDefault();
-
-                const pastedDigits = event.clipboardData.getData('text').replace(/\D/g, '').slice(0, 6).split('');
-                const inputs = event.currentTarget.querySelectorAll('input[type=text]');
-
-                pastedDigits.forEach((digit, index) => this.digits[index] = digit);
-                this.updateCode();
-                inputs[Math.min(pastedDigits.length, 6) - 1]?.focus();
-            },
         }">
             @if (session('status'))
                 <x-auth.alert type="success">{{ session('status') }}</x-auth.alert>
@@ -56,17 +34,11 @@
                 @csrf
 
                 <div x-show="!showRecovery" class="flex flex-col gap-3">
-                    <input type="hidden" name="code" x-model="code" :disabled="showRecovery">
-                    <div class="flex justify-center gap-2" aria-label="Two-factor authentication code"
-                        @paste="pasteCode($event)">
-                        <template x-for="(digit, index) in digits" :key="index">
-                            <input type="text" inputmode="numeric" pattern="[0-9]*" maxlength="1"
-                                x-model="digits[index]" :aria-label="`Digit ${index + 1}`"
-                                @input="focusNext($event); updateCode()" @keydown="focusPrevious($event)"
-                                class="h-12 w-11 rounded-md border border-neutral-300 bg-white text-center text-lg font-semibold text-neutral-900 transition-colors focus:border-warning focus:outline-none focus:ring-1 focus:ring-warning dark:border-white/10 dark:bg-coolgray-100 dark:text-white sm:h-14 sm:w-12 sm:text-xl"
-                                autocomplete="one-time-code" />
-                        </template>
-                    </div>
+                    <input x-ref="authenticatorCode" type="text" name="code" inputmode="numeric"
+                        pattern="[0-9]*" maxlength="6" autocomplete="one-time-code" autofocus
+                        aria-label="Two-factor authentication code" :disabled="showRecovery"
+                        @input="submitAuthenticatorCode($event)"
+                        class="mx-auto h-14 w-64 rounded-md border border-neutral-300 bg-white px-4 text-center text-xl font-semibold tracking-[0.5em] text-neutral-900 transition-colors focus:border-warning focus:outline-none focus:ring-1 focus:ring-warning dark:border-white/10 dark:bg-coolgray-100 dark:text-white" />
                     <button type="button" class="auth-text-link self-center"
                         x-on:click="showRecovery = true; $nextTick(() => $refs.recoveryCode.focus())">
                         Use a recovery code
@@ -77,7 +49,7 @@
                     <x-forms.input x-ref="recoveryCode" name="recovery_code" autocomplete="one-time-code"
                         x-bind:disabled="!showRecovery" label="{{ __('input.recovery_code') }}" />
                     <button type="button" class="auth-text-link self-center"
-                        x-on:click="showRecovery = false; $nextTick(() => $el.closest('form').querySelector('input[type=text]').focus())">
+                        x-on:click="showRecovery = false; $nextTick(() => $refs.authenticatorCode.focus())">
                         Use an authenticator code
                     </button>
                 </div>
diff --git a/resources/views/components/services/links.blade.php b/resources/views/components/services/links.blade.php
index 5d78846288..32de3af618 100644
--- a/resources/views/components/services/links.blade.php
+++ b/resources/views/components/services/links.blade.php
@@ -2,15 +2,22 @@
     $linkItemClasses = 'listbox-option justify-start! gap-2.5!';
 @endphp
 
-<div @class(['relative', 'w-full' => $fullWidth]) x-data="{ open: false }"
+<div @class([
+    'relative' => !$compact,
+    'static' => $compact,
+    'w-full' => $fullWidth,
+]) x-data="{ open: false }"
     x-effect="$dispatch('resource-actions-toggled', { open })" @keydown.escape.window="open = false">
     <button type="button" @click="open = !open" @click.outside="open = false" title="Open service links"
         @class([
-            'app-tab shrink-0 gap-1' => !$fullWidth,
+            'app-tab shrink-0 gap-1' => !$fullWidth && !$compact,
             'button w-full justify-between' => $fullWidth,
+            'inline-flex h-6 shrink-0 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-100 px-2 text-xs font-medium leading-none text-neutral-700 dark:border-white/[0.12] dark:bg-white/[0.07] dark:text-white' => $compact,
         ])>
         <span class="inline-flex items-center gap-2">
-            <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
+            @unless ($compact)
+                <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
+            @endunless
             Links
         </span>
         <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
@@ -21,7 +28,8 @@
         @class([
             'listbox-panel top-full! mt-1! max-h-80! overflow-y-auto!',
             'left-0! right-0! w-full! min-w-0! max-w-none!' => $fullWidth,
-            'right-0! left-auto! min-w-60! max-w-96!' => !$fullWidth,
+            'left-1/2! right-auto! w-[calc(100vw-2rem)]! max-w-md! min-w-0! -translate-x-1/2' => $compact,
+            'right-0! left-auto! min-w-60! max-w-96!' => !$fullWidth && !$compact,
         ])>
         @forelse ($links as $link)
             <a class="{{ $linkItemClasses }}" target="_blank" href="{{ $link }}">
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index 04dd249c7e..a11e6930f1 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -8,6 +8,9 @@
     $helperText = $isCompose
         ? 'Manage domains for every service in this Docker Compose application.'
         : 'Manage domains for this application.';
+    $hasHttpsDomains = collect($domainRows)->contains(
+        fn ($row) => ! ($row['is_suggested'] ?? false) && str_starts_with(strtolower($row['url']), 'https://')
+    );
 @endphp
 
 <div class="flex flex-col gap-4"
@@ -66,6 +69,18 @@
             {{ $helperText }}
         </p>
 
+        @if ($hasHttpsDomains && ! $labelsAreWritable)
+            <div class="mt-4 max-w-md">
+                <x-forms.listbox id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
+                    onChange="updateForceHttps"
+                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
+                    :options="[
+                        ['value' => true, 'label' => 'Enabled'],
+                        ['value' => false, 'label' => 'Disabled'],
+                    ]" :disabled="! auth()->user()->can('update', $application)" />
+            </div>
+        @endif
+
     </x-application.settings-section>
 
     {{-- Toolbar --}}
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 59f5736012..9399efe7f9 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -159,12 +159,28 @@
                 @php
                     $app = collect($serviceApps)->firstWhere('id', (int) $appId);
                     $heading = \Illuminate\Support\Str::headline($app['name'] ?? $rows->first()['service_name'] ?? 'Service');
+                    $hasHttpsDomains = $rows->contains(
+                        fn ($row) => ! ($row['is_suggested'] ?? false) && str_starts_with(strtolower($row['url']), 'https://')
+                    );
                 @endphp
                 <section id="service-domain-group-{{ $appId }}" wire:key="service-domain-group-{{ $appId }}"
                     x-show="matchesDomainSearch(@js($heading.' '.$rows->pluck('url')->implode(' ')))"
                     class="border-b border-neutral-200 last:border-b-0 dark:border-white/10">
-                    <div class="flex w-full items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]">
+                    <div class="flex w-full flex-wrap items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]">
                         <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">{{ $heading }}</span>
+                        @if ($hasHttpsDomains)
+                            <div class="w-full sm:w-72">
+                                <x-forms.listbox id="forceHttpsRedirects.{{ $appId }}"
+                                    htmlId="service-force-https-{{ $appId }}"
+                                    label="Redirect HTTP to HTTPS" onChange="updateForceHttps"
+                                    :onChangeArgs="[(int) $appId]"
+                                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
+                                    :options="[
+                                        ['value' => true, 'label' => 'Enabled'],
+                                        ['value' => false, 'label' => 'Disabled'],
+                                    ]" :disabled="! auth()->user()->can('update', $service)" />
+                            </div>
+                        @endif
                     </div>
 
                     <div wire:key="service-domain-rows-{{ $appId }}-{{ md5(serialize($rows->all())) }}">
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index fd8f604cd3..113a6c5a3f 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -64,7 +64,10 @@
                 <h1 class="min-w-0 max-w-full truncate text-[24px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
                     {{ $service->name }}
                 </h1>
-                <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
+                <div class="relative flex w-full min-w-0 items-center gap-2">
+                    <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
+                    <x-services.links :service="$service" compact />
+                </div>
             </div>
         </div>
 
@@ -169,9 +172,6 @@
                 </a>
             @endif
 
-            <div class="resource-heading-menus w-full">
-                <x-services.links :service="$service" full-width />
-            </div>
         </div>
 
         @teleport('#resource-action-hud-slot')
diff --git a/resources/views/livewire/project/shared/resource-operations.blade.php b/resources/views/livewire/project/shared/resource-operations.blade.php
index 70ba5acfa8..255336d7de 100644
--- a/resources/views/livewire/project/shared/resource-operations.blade.php
+++ b/resources/views/livewire/project/shared/resource-operations.blade.php
@@ -246,7 +246,7 @@
                     {{ data_get($resource, 'destination.network') }}.
                 </p>
                 <x-forms.button
-                    @click="$wire.cloneTo(@js($resource->destination->uuid), selectedCloneEnvironment)">
+                    @click="$wire.cloneTo(currentDestinationUuid, selectedCloneEnvironment)">
                     Clone resource
                 </x-forms.button>
             </div>
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index fbe72230d1..50c71fe958 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -119,6 +119,27 @@ it('lists existing domains as individual rows', function () {
     expect(substr_count($html, 'this.$wire.updateRedirect('))->toBe(2);
 });
 
+it('shows the HTTP redirect control for HTTPS domains and persists changes', function () {
+    $this->application->update(['fqdn' => 'https://app.example.com']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('isForceHttpsEnabled', true)
+        ->assertSee('Redirect HTTP to HTTPS')
+        ->assertSee('Keep enabled when Cloudflare uses Full or Full (Strict) SSL.')
+        ->set('isForceHttpsEnabled', false)
+        ->call('updateForceHttps')
+        ->assertHasNoErrors();
+
+    expect($this->application->settings->fresh()->is_force_https_enabled)->toBeFalse();
+});
+
+it('hides the HTTP redirect control for HTTP-only domains', function () {
+    $this->application->update(['fqdn' => 'http://app.example.com']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertDontSee('Redirect HTTP to HTTPS');
+});
+
 it('shows one redirect direction control in each compose service header', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 270927ca18..1b3e61be07 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -399,7 +399,7 @@ YAML;
     expect(json_decode($plainApplication->docker_compose_domains, true))->toBeNull();
 });
 
-test('applicationParser selects the Coolify network for Traefik routed compose services', function () {
+test('applicationParser does not force the private resource network for Traefik routed compose services', function () {
     $application = Application::factory()->create([
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
@@ -422,7 +422,7 @@ YAML,
     $parsedCompose = applicationParser($application);
     $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
 
-    expect($labels->values()->all())->toContain("traefik.docker.network={$application->uuid}");
+    expect($labels->values()->all())->not->toContain("traefik.docker.network={$application->uuid}");
 });
 
 test('applicationParser preserves a user-selected Traefik network', function () {
diff --git a/tests/Feature/Auth/TwoFactorChallengeAccessTest.php b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
index 4f1dee08c5..f0dd97cc31 100644
--- a/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
+++ b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
@@ -23,6 +23,18 @@ it('allows unauthenticated access to two-factor-challenge page', function () {
     expect($response->status())->toBeIn([200, 302]);
 });
 
+it('uses one mobile-friendly field for authenticator code paste and autofill', function () {
+    $challenge = file_get_contents(resource_path('views/auth/two-factor-challenge.blade.php'));
+
+    expect($challenge)
+        ->toContain('name="code"')
+        ->toContain('autocomplete="one-time-code"')
+        ->toContain('inputmode="numeric"')
+        ->toContain('maxlength="6"')
+        ->toContain('@input="submitAuthenticatorCode($event)"')
+        ->not->toContain('x-for="(digit, index) in digits"');
+});
+
 it('includes two-factor-challenge in allowed paths for unsubscribed accounts', function () {
     $paths = allowedPathsForUnsubscribedAccounts();
 
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index a64a97dd8a..d5f259a853 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -114,7 +114,8 @@ test('listbox forwards dynamic disabled state to its trigger', function () {
         ->toContain('x-model="selectedCloneProject"')
         ->toContain('x-model="selectedCloneEnvironment"')
         ->toContain('$wire.cloneTo(selectedCloneDestination)')
-        ->toContain('$wire.cloneTo(@js($resource->destination->uuid), selectedCloneEnvironment)')
+        ->toContain('$wire.cloneTo(currentDestinationUuid, selectedCloneEnvironment)')
+        ->not->toContain('$wire.cloneTo(@js(')
         ->toContain('x-bind:disabled="!selectedMoveProject || availableEnvironments.length === 0"');
 });
 
diff --git a/tests/Feature/Mcp/McpEndpointTest.php b/tests/Feature/Mcp/McpEndpointTest.php
index 240f5b2e14..01ba0ecf16 100644
--- a/tests/Feature/Mcp/McpEndpointTest.php
+++ b/tests/Feature/Mcp/McpEndpointTest.php
@@ -216,6 +216,13 @@ test('get_infrastructure_overview returns counts', function () {
 
 test('get_server scrubs sensitive nested data and exposes connection_timeout', function () {
     $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('last_saved_proxy_configuration', <<<'YAML'
+services:
+  traefik:
+    environment:
+      CF_DNS_API_TOKEN: plaintext-cloudflare-token
+YAML);
+    $server->saveQuietly();
     // creating hook auto-generates a sentinel_token; bump connection_timeout
     // via saveQuietly to avoid triggering restartSentinel.
     $server->settings->forceFill(['connection_timeout' => 42])->saveQuietly();
@@ -229,6 +236,9 @@ test('get_server scrubs sensitive nested data and exposes connection_timeout', f
     $raw = json_encode($body);
 
     expect($raw)->not->toContain('sentinel_token');
+    expect($raw)->not->toContain('last_saved_proxy_configuration');
+    expect($raw)->not->toContain('CF_DNS_API_TOKEN');
+    expect($raw)->not->toContain('plaintext-cloudflare-token');
     expect($raw)->not->toContain('"team_id"');
     expect($raw)->not->toContain('"private_key_id"');
     expect($body['data']['connection_timeout'])->toBe(42);
diff --git a/tests/Feature/Mcp/McpReadToolsTest.php b/tests/Feature/Mcp/McpReadToolsTest.php
index c3433bf455..6e146e7190 100644
--- a/tests/Feature/Mcp/McpReadToolsTest.php
+++ b/tests/Feature/Mcp/McpReadToolsTest.php
@@ -590,6 +590,51 @@ test('list_env_keys never returns values and is team scoped', function () {
     expect($denied->json('result.isError'))->toBeTrue();
 });
 
+test('get_application omits free-form configuration that can contain secrets', function () {
+    $this->application->update([
+        'git_full_url' => 'https://oauth2:application-secret@example.com/repository.git',
+        'build_command' => 'API_TOKEN=application-secret npm run build',
+        'custom_docker_run_options' => '--env API_TOKEN=application-secret',
+        'custom_nginx_configuration' => base64_encode('proxy_set_header Authorization "Bearer application-secret";'),
+    ]);
+
+    $response = mcpReadCall('get_application', ['uuid' => $this->application->uuid]);
+    $response->assertOk();
+
+    $body = mcpReadJson($response);
+    $raw = json_encode($body);
+
+    expect($body['data']['uuid'])->toBe($this->application->uuid)
+        ->and($raw)->not->toContain('application-secret')
+        ->and($raw)->not->toContain('git_full_url')
+        ->and($raw)->not->toContain('build_command')
+        ->and($raw)->not->toContain('custom_docker_run_options')
+        ->and($raw)->not->toContain('custom_nginx_configuration');
+});
+
+test('get_database omits configuration blobs that can contain secrets', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'Secret-bearing config',
+        'postgres_password' => 'database-password',
+        'postgres_conf' => "primary_conninfo = 'password=database-config-secret'",
+        'custom_docker_run_options' => '--env API_TOKEN=database-config-secret',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $response = mcpReadCall('get_database', ['uuid' => $database->uuid]);
+    $response->assertOk();
+
+    $body = mcpReadJson($response);
+    $raw = json_encode($body);
+
+    expect($body['data']['uuid'])->toBe($database->uuid)
+        ->and($raw)->not->toContain('database-config-secret')
+        ->and($raw)->not->toContain('postgres_conf')
+        ->and($raw)->not->toContain('custom_docker_run_options');
+});
+
 test('list_destinations and get_destination are team scoped', function () {
     $response = mcpReadCall('list_destinations');
     $response->assertOk();
diff --git a/tests/Feature/ModelFillableCreationTest.php b/tests/Feature/ModelFillableCreationTest.php
index 50b6e02a98..46d9c36daa 100644
--- a/tests/Feature/ModelFillableCreationTest.php
+++ b/tests/Feature/ModelFillableCreationTest.php
@@ -463,6 +463,7 @@ it('creates ServiceApplication with all fillable attributes', function () {
         'is_include_timestamps' => true,
         'is_gzip_enabled' => true,
         'is_stripprefix_enabled' => true,
+        'is_force_https_enabled' => false,
         'last_online_at' => now()->toISOString(),
         'is_migrated' => false,
     ]);
@@ -473,6 +474,26 @@ it('creates ServiceApplication with all fillable attributes', function () {
     expect($svcApp->human_name)->toBe('Web Server');
     expect($svcApp->image)->toBe('nginx:latest');
     expect($svcApp->is_log_drain_enabled)->toBeTrue();
+    expect($svcApp->is_force_https_enabled)->toBeFalse();
+    expect($svcApp->isForceHttpsEnabled())->toBeFalse();
+});
+
+it('enables HTTPS redirects for service applications by default', function () {
+    $service = Service::create([
+        'docker_compose_raw' => 'services: {}',
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $serviceApplication = ServiceApplication::create([
+        'service_id' => $service->id,
+        'name' => 'web-default-redirect',
+    ]);
+
+    expect($serviceApplication->is_force_https_enabled)->toBeTrue();
+    expect($serviceApplication->isForceHttpsEnabled())->toBeTrue();
 });
 
 it('creates ServiceDatabase with all fillable attributes', function () {
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index 81e596ebf1..bb9e888982 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -635,20 +635,31 @@ it('shows application Links as a compact badge beside the mobile status', functi
         ->toContain('<x-reicon name="chevron-down"');
 });
 
-it('keeps service Links full width on mobile headings', function () {
+it('shows service Links as a compact badge beside the mobile status', function () {
     $service = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
-    $mobileServiceSection = str($service)->between('class="w-full md:hidden"', 'class="hidden w-full items-center md:flex')->toString();
-
-    expect($mobileServiceSection)
-        ->toContain('<x-services.links')
-        ->toContain('full-width')
-        ->toContain('resource-heading-menus')
-        ->not->toContain('<x-resource-heading-tabs');
-
     $serviceLinks = file_get_contents(resource_path('views/components/services/links.blade.php'));
+    $serviceLinksComponent = file_get_contents(app_path('View/Components/Services/Links.php'));
+    $mobileServiceTitle = str($service)->between('class="mb-3 w-full xl:hidden"', '<div class="w-full xl:hidden">')->toString();
+    $mobileServiceActions = str($service)->between('<div class="w-full xl:hidden">', '@teleport')->toString();
+
+    expect($mobileServiceTitle)
+        ->toContain('<x-status-summary')
+        ->toContain('<x-services.links')
+        ->toContain('relative flex w-full min-w-0 items-center gap-2')
+        ->toContain('compact')
+        ->not->toContain('full-width');
+
+    expect($mobileServiceActions)
+        ->not->toContain('<x-services.links');
+
+    expect($serviceLinksComponent)
+        ->toContain('public bool $compact = false');
+
     expect($serviceLinks)
-        ->toContain("'button w-full justify-between' => \$fullWidth")
-        ->toContain("'left-0! right-0! w-full! min-w-0! max-w-none!' => \$fullWidth")
+        ->toContain("'static' => \$compact")
+        ->toContain("'inline-flex h-6 shrink-0 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-100 px-2 text-xs font-medium leading-none text-neutral-700 dark:border-white/[0.12] dark:bg-white/[0.07] dark:text-white' => \$compact")
+        ->toContain('@unless ($compact)')
+        ->toContain("'left-1/2! right-auto! w-[calc(100vw-2rem)]! max-w-md! min-w-0! -translate-x-1/2' => \$compact")
         ->toContain('<x-reicon name="chevron-down"')
         ->toContain('No links available');
 
diff --git a/tests/Feature/ServiceApplicationsApiTest.php b/tests/Feature/ServiceApplicationsApiTest.php
index d65967bd80..c8dd33a46b 100644
--- a/tests/Feature/ServiceApplicationsApiTest.php
+++ b/tests/Feature/ServiceApplicationsApiTest.php
@@ -199,6 +199,20 @@ describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
         expect($ctx->serviceApplication->human_name)->toBe('Web UI');
     });
 
+    test('updates the HTTP to HTTPS redirect setting', function () {
+        config(['app.maintenance.driver' => 'file']);
+        $ctx = createServiceWithApplicationForApiTest($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
+            'is_force_https_enabled' => false,
+        ]);
+
+        $response->assertSuccessful();
+        expect($ctx->serviceApplication->fresh()->is_force_https_enabled)->toBeFalse();
+    });
+
     test('returns 422 for invalid url scheme', function () {
         $ctx = createServiceWithApplicationForApiTest($this);
 
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 36f602856f..62ea41d96d 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -125,6 +125,24 @@ it('groups configured domains and shows redirect settings in the table', functio
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
 
+it('shows and persists the HTTP redirect control for HTTPS service applications', function () {
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Redirect HTTP to HTTPS')
+        ->assertSee('Keep enabled when Cloudflare uses Full or Full (Strict) SSL.')
+        ->call('updateForceHttps', $this->apiApp->id, false)
+        ->assertHasNoErrors();
+
+    expect($this->apiApp->fresh()->is_force_https_enabled)->toBeFalse();
+    expect($this->service->fresh()->docker_compose)->not->toContain('middlewares=redirect-to-https');
+});
+
+it('hides the HTTP redirect control for HTTP-only service applications', function () {
+    $this->apiApp->update(['fqdn' => 'http://api.example.com']);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertDontSee('Redirect HTTP to HTTPS');
+});
+
 it('shows one redirect control for each www and non-www pair', function () {
     $this->apiApp->update([
         'fqdn' => 'https://api.example.com,https://www.api.example.com,https://admin.example.com,https://www.admin.example.com',
@@ -146,6 +164,18 @@ it('uses segmented fields when adding and editing service domains', function ()
         ->not->toContain('placeholder="https://app.example.com"');
 });
 
+it('resets the add domain dns gate when segmented domain fields change', function () {
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('addDomainDnsFailed', true)
+        ->set('addDomainDnsMessage', 'DNS validation failed.')
+        ->set('forceSaveDns', true)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->assertSet('newDomainPartsChanged', true)
+        ->assertSet('addDomainDnsFailed', false)
+        ->assertSet('addDomainDnsMessage', '')
+        ->assertSet('forceSaveDns', false);
+});
+
 it('shows dns entries control next to Add', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSuccessful()
diff --git a/tests/Feature/TraefikServiceDockerNetworkLabelTest.php b/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
index 4cf4ebc568..f1d7087a29 100644
--- a/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
+++ b/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
@@ -12,7 +12,7 @@ use Illuminate\Support\Facades\Bus;
 
 uses(RefreshDatabase::class);
 
-it('selects the Coolify service network for Traefik routed compose services', function () {
+it('does not force the private service network for Traefik routed compose services', function () {
     Bus::fake();
 
     $team = Team::factory()->create();
@@ -45,5 +45,5 @@ YAML,
     $parsedCompose = serviceParser($service);
     $labels = collect(data_get($parsedCompose, 'services.app.labels'));
 
-    expect($labels->values()->all())->toContain("traefik.docker.network={$service->uuid}");
+    expect($labels->values()->all())->not->toContain("traefik.docker.network={$service->uuid}");
 });
diff --git a/tests/Unit/FqdnLabelsNoindexTest.php b/tests/Unit/FqdnLabelsNoindexTest.php
index 48f2f49126..332d548989 100644
--- a/tests/Unit/FqdnLabelsNoindexTest.php
+++ b/tests/Unit/FqdnLabelsNoindexTest.php
@@ -17,13 +17,14 @@ function traefikLabels(array $domains, ?array $noindex = null, bool $forceHttps
     )->values()->all();
 }
 
-function caddyLabels(array $domains, ?array $noindex = null): array
+function caddyLabels(array $domains, ?array $noindex = null, bool $forceHttps = false): array
 {
     return fqdnLabelsForCaddy(
         network: 'testnetwork',
         uuid: 'testuuid',
         domains: collect($domains),
         onlyPort: 3000,
+        is_force_https_enabled: $forceHttps,
         noindex_domains: $noindex === null ? null : collect($noindex),
     )->values()->all();
 }
@@ -43,6 +44,33 @@ function middlewaresOf(array $labels, string $router): array
 }
 
 describe('Traefik noindex middleware', function () {
+    test('the HTTP router inherits the HTTPS middleware chain when redirects are disabled', function () {
+        $labels = fqdnLabelsForTraefik(
+            uuid: 'testuuid',
+            domains: collect(['https://example.com/api']),
+            is_force_https_enabled: false,
+            onlyPort: 3000,
+            serviceLabels: collect(['coolify.traefik.middlewares=rate-limit']),
+            redirect_direction: 'www',
+            is_http_basic_auth_enabled: true,
+            http_basic_auth_username: 'user',
+            http_basic_auth_password: 'secret',
+            noindex_domains: collect(['https://example.com/api']),
+        )->values()->all();
+
+        expect(middlewaresOf($labels, 'http-0-testuuid'))
+            ->toBe(middlewaresOf($labels, 'https-0-testuuid'))
+            ->toContain(
+                'https-0-testuuid-stripprefix',
+                'gzip',
+                '0-testuuid-to-www',
+                'http-basic-auth-testuuid',
+                '0-testuuid-noindex',
+                'rate-limit',
+            )
+            ->not->toContain('redirect-to-https');
+    });
+
     test('only the flagged domain gets the header', function () {
         $labels = traefikLabels(
             domains: ['https://prod.example.com', 'https://staging.example.com'],
@@ -138,6 +166,44 @@ describe('Traefik noindex middleware', function () {
 });
 
 describe('Caddy noindex header', function () {
+    test('serves an HTTPS public domain over HTTP and HTTPS when the HTTPS redirect is disabled', function () {
+        expect(caddyLabels(['https://example.com'], forceHttps: false))
+            ->toContain('caddy_0=http://example.com, https://example.com');
+    });
+
+    test('serves an HTTPS public domain over HTTPS when the HTTPS redirect is enabled', function () {
+        expect(caddyLabels(['https://example.com'], forceHttps: true))
+            ->toContain('caddy_0=https://example.com');
+    });
+
+    test('canonical redirects preserve the request scheme when the HTTPS redirect is disabled', function (string $domain, string $redirectDirection, string $expectedRedirect, string $httpsRedirect) {
+        $labels = fqdnLabelsForCaddy(
+            network: 'testnetwork',
+            uuid: 'testuuid',
+            domains: collect([$domain]),
+            is_force_https_enabled: false,
+            onlyPort: 3000,
+            redirect_direction: $redirectDirection,
+        );
+
+        expect($labels)
+            ->toContain($expectedRedirect)
+            ->not->toContain($httpsRedirect);
+    })->with([
+        'www redirect' => [
+            'https://example.com',
+            'www',
+            'caddy_0.redir={scheme}://www.example.com{uri}',
+            'caddy_0.redir=https://www.example.com{uri}',
+        ],
+        'non-www redirect' => [
+            'https://www.example.com',
+            'non-www',
+            'caddy_0.redir={scheme}://example.com{uri}',
+            'caddy_0.redir=https://example.com{uri}',
+        ],
+    ]);
+
     test('the flagged domain uses the header block, the other keeps the inline form', function () {
         $labels = caddyLabels(
             domains: ['https://prod.example.com', 'https://staging.example.com'],
diff --git a/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php b/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
index 28675903ba..5f940108c3 100644
--- a/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
@@ -509,6 +509,7 @@ test('service nested apps dbs volumes backups and db file storages round-trip',
         'is_log_drain_enabled' => true,
         'is_gzip_enabled' => false,
         'is_stripprefix_enabled' => false,
+        'is_force_https_enabled' => false,
         'status' => 'running:healthy',
     ]);
     $serviceApp->uuid = 'svc-app-whoami';
@@ -722,6 +723,7 @@ test('service nested apps dbs volumes backups and db file storages round-trip',
         ->and($importedSvcApp->exposes)->toBe('80')
         ->and((bool) $importedSvcApp->is_gzip_enabled)->toBeFalse()
         ->and((bool) $importedSvcApp->is_stripprefix_enabled)->toBeFalse()
+        ->and((bool) $importedSvcApp->is_force_https_enabled)->toBeFalse()
         ->and($importedSvcApp->environment_variables()->where('key', 'WHOAMI_NAME')->first()?->value)->toBe('nested-secret')
         ->and($importedSvcApp->persistentStorages)->toHaveCount(1)
         ->and($importedSvcApp->fileStorages)->toHaveCount(1)

From 0d23b29775b0325801e9d9c0e0b768bea91ccc33 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:16:29 +0200
Subject: [PATCH 20/42] fix: honor GitHub default branches and reconcile proxy
 networks

Use searchable repository and branch selectors, select each repository's default branch when available, and discover running container networks during proxy reconciliation.
---
 .../Project/New/GithubPrivateRepository.php   | 10 ++--
 bootstrap/helpers/proxy.php                   | 23 ++++----
 .../forms/searchable-listbox.blade.php        |  2 +-
 .../new/github-private-repository.blade.php   |  8 +--
 tests/Feature/GithubPrivateRepositoryTest.php | 48 +++++++++++++++--
 .../RuntimeNetworkReconciliationTest.php      | 53 +++++++++++++++++++
 .../SearchableListboxComponentTest.php        |  1 +
 7 files changed, 123 insertions(+), 22 deletions(-)
 create mode 100644 tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php

diff --git a/app/Livewire/Project/New/GithubPrivateRepository.php b/app/Livewire/Project/New/GithubPrivateRepository.php
index 925f8d9698..cef0cf6ac7 100644
--- a/app/Livewire/Project/New/GithubPrivateRepository.php
+++ b/app/Livewire/Project/New/GithubPrivateRepository.php
@@ -134,8 +134,9 @@ class GithubPrivateRepository extends Component
 
     public function loadBranches()
     {
-        $this->selected_repository_owner = $this->repositories->where('id', $this->selected_repository_id)->first()['owner']['login'];
-        $this->selected_repository_repo = $this->repositories->where('id', $this->selected_repository_id)->first()['name'];
+        $repository = $this->repositories->firstWhere('id', $this->selected_repository_id);
+        $this->selected_repository_owner = data_get($repository, 'owner.login');
+        $this->selected_repository_repo = data_get($repository, 'name');
         $this->branches = collect();
         $this->page = 1;
         $this->loadBranchByPage();
@@ -146,7 +147,10 @@ class GithubPrivateRepository extends Component
             }
         }
         $this->branches = sortBranchesByPriority($this->branches);
-        $this->selected_branch_name = data_get($this->branches, '0.name', 'main');
+        $defaultBranch = data_get($repository, 'default_branch', 'main');
+        $this->selected_branch_name = $this->branches->contains('name', $defaultBranch)
+            ? $defaultBranch
+            : data_get($this->branches, '0.name', 'main');
     }
 
     protected function loadBranchByPage()
diff --git a/bootstrap/helpers/proxy.php b/bootstrap/helpers/proxy.php
index 6997043937..31e55da336 100644
--- a/bootstrap/helpers/proxy.php
+++ b/bootstrap/helpers/proxy.php
@@ -107,8 +107,8 @@ function collectDockerNetworksByServer(Server $server)
 }
 function connectProxyToNetworks(Server $server)
 {
-    ['networks' => $networks] = collectDockerNetworksByServer($server);
     if ($server->isSwarm()) {
+        ['networks' => $networks] = collectDockerNetworksByServer($server);
         $commands = $networks->map(function ($network) {
             $safe = escapeshellarg($network);
 
@@ -118,19 +118,20 @@ function connectProxyToNetworks(Server $server)
                 "echo 'Successfully connected coolify-proxy to {$safe} network.'",
             ];
         });
-    } else {
-        $commands = $networks->map(function ($network) {
-            $safe = escapeshellarg($network);
 
-            return [
-                "docker network ls --format '{{.Name}}' | grep '^{$network}$' >/dev/null || docker network create --attachable {$safe} >/dev/null",
-                "docker network connect {$safe} coolify-proxy >/dev/null 2>&1 || true",
-                "echo 'Successfully connected coolify-proxy to {$safe} network.'",
-            ];
-        });
+        return $commands->flatten();
     }
 
-    return $commands->flatten();
+    return collect([
+        'for network in $(docker inspect $(docker ps --filter label=coolify.managed=true --format "{{.ID}}") --format=\'{{range $network, $_ := .NetworkSettings.Networks}}{{println $network}}{{end}}\' 2>/dev/null | sort -u); do',
+        '    if [ -z "$network" ] || [ "$network" = "bridge" ] || [ "$network" = "host" ] || [ "$network" = "none" ] || [ "$network" = "default" ]; then',
+        '        continue',
+        '    fi',
+        '    if docker network inspect "$network" >/dev/null 2>&1; then',
+        '        docker network connect "$network" coolify-proxy >/dev/null 2>&1 || true',
+        '    fi',
+        'done',
+    ]);
 }
 
 /**
diff --git a/resources/views/components/forms/searchable-listbox.blade.php b/resources/views/components/forms/searchable-listbox.blade.php
index c75a50c0ba..9a7a88efd5 100644
--- a/resources/views/components/forms/searchable-listbox.blade.php
+++ b/resources/views/components/forms/searchable-listbox.blade.php
@@ -111,7 +111,7 @@
             @click.stop>
             <div class="searchable-listbox-search">
                 <x-reicon name="search"
-                    class="pointer-events-none absolute top-1/2 left-2.5 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                    class="pointer-events-none absolute top-1/2 left-3 size-3 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
                 <input x-ref="search" type="search" x-model="query" autocomplete="off"
                     placeholder="{{ $searchPlaceholder }}"
                     class="searchable-listbox-search-input"
diff --git a/resources/views/livewire/project/new/github-private-repository.blade.php b/resources/views/livewire/project/new/github-private-repository.blade.php
index be4c189a3e..26aaf3530f 100644
--- a/resources/views/livewire/project/new/github-private-repository.blade.php
+++ b/resources/views/livewire/project/new/github-private-repository.blade.php
@@ -72,10 +72,11 @@
             <div class="application-settings-section-body">
                 @if ($repositories->isNotEmpty())
                     <div class="flex items-end gap-2">
-                        <x-forms.listbox id="selected_repository_id" label="Repository" required live
+                        <x-forms.searchable-listbox id="selected_repository_id" label="Repository" required live
+                            searchPlaceholder="Search repositories…"
                             :options="$repositories->map(fn ($repository) => [
                                 'value' => data_get($repository, 'id'),
-                                'label' => data_get($repository, 'name'),
+                                'label' => data_get($repository, 'full_name', data_get($repository, 'name')),
                             ])->values()->all()" />
                         <x-forms.button :showLoadingIndicator="false" wire:click.prevent="loadBranches"
                             wire:loading.attr="disabled"
@@ -104,7 +105,8 @@
                     </div>
                     <div class="application-settings-section-body space-y-5">
                         <div class="grid gap-4 sm:grid-cols-2">
-                            <x-forms.listbox id="selected_branch_name" label="Branch" required
+                            <x-forms.searchable-listbox id="selected_branch_name" label="Branch" required
+                                searchPlaceholder="Search branches…"
                                 :options="$branches->map(fn ($branch) => [
                                     'value' => data_get($branch, 'name'),
                                     'label' => data_get($branch, 'name'),
diff --git a/tests/Feature/GithubPrivateRepositoryTest.php b/tests/Feature/GithubPrivateRepositoryTest.php
index 9884bca8c3..6de13f0c79 100644
--- a/tests/Feature/GithubPrivateRepositoryTest.php
+++ b/tests/Feature/GithubPrivateRepositoryTest.php
@@ -105,19 +105,59 @@ describe('GitHub Private Repository Component', function () {
             ->assertSet('selected_repository_id', 1);
     });
 
-    test('repository selection uses the shared listbox and disables loading action', function () {
+    test('repository selection uses the searchable listbox and disables loading action', function () {
         fakeGithubHttp([
             ['id' => 1, 'name' => 'alpha-repo', 'owner' => ['login' => 'testuser']],
         ]);
 
         Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
             ->call('loadRepositories', $this->githubApp->id)
-            ->assertSee('id="selected_repository_id-trigger"', false)
+            ->assertSee('class="listbox-panel searchable-listbox-panel"', false)
+            ->assertSee('placeholder="Search repositories…"', false)
             ->assertSee('wire:loading.attr="disabled"', false)
             ->assertSee('wire:target="loadBranches,selected_repository_id"', false)
             ->assertDontSee('<datalist', false);
     });
 
+    test('loadBranches fetches available branches and selects the repository default branch', function () {
+        $repository = [
+            'id' => 1,
+            'name' => 'alpha-repo',
+            'default_branch' => 'production',
+            'owner' => ['login' => 'testuser'],
+        ];
+
+        fakeGithubHttp([$repository]);
+        Http::fake([
+            'https://api.github.com/zen' => Http::response('Keep it logically awesome.', 200, [
+                'Date' => now()->toRfc7231String(),
+            ]),
+            'https://api.github.com/app/installations/67890/access_tokens' => Http::response([
+                'token' => 'fake-installation-token',
+            ], 201),
+            'https://api.github.com/installation/repositories*' => Http::response([
+                'total_count' => 1,
+                'repositories' => [$repository],
+            ], 200),
+            'https://api.github.com/repos/testuser/alpha-repo/branches*' => Http::response([
+                ['name' => 'main'],
+                ['name' => 'feature/login'],
+                ['name' => 'production'],
+            ], 200),
+        ]);
+
+        Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
+            ->call('loadRepositories', $this->githubApp->id)
+            ->call('loadBranches')
+            ->assertSet('selected_branch_name', 'production')
+            ->assertSet('branches', collect([
+                ['name' => 'main'],
+                ['name' => 'feature/login'],
+                ['name' => 'production'],
+            ]))
+            ->assertSee('placeholder="Search branches…"', false);
+    });
+
     test('continue button uses the shared submit loading indicator', function () {
         fakeGithubHttp([
             ['id' => 1, 'name' => 'alpha-repo', 'owner' => ['login' => 'testuser']],
@@ -301,11 +341,11 @@ describe('GitHub Private Repository Component', function () {
 
         Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
             ->call('loadRepositories', $this->githubApp->id)
-            ->assertSee('Refresh Repository List');
+            ->assertSee('Refresh');
     });
 
     test('refresh button is not visible before repositories are loaded', function () {
         Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
-            ->assertDontSee('Refresh Repository List');
+            ->assertDontSee('Refresh');
     });
 });
diff --git a/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php b/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php
new file mode 100644
index 0000000000..7194555399
--- /dev/null
+++ b/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php
@@ -0,0 +1,53 @@
+<?php
+
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('discovers running container networks instead of relying on cached resource statuses', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+
+    $commands = connectProxyToNetworks($server)->implode("\n");
+
+    expect($commands)
+        ->toContain('docker ps --filter label=coolify.managed=true')
+        ->toContain('.NetworkSettings.Networks')
+        ->toContain('docker network inspect "$network"')
+        ->toContain('docker network connect "$network" coolify-proxy')
+        ->not->toContain('docker network create');
+});
+
+it('skips Docker system networks during runtime reconciliation', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+
+    $commands = connectProxyToNetworks($server)->implode("\n");
+
+    expect($commands)
+        ->toContain('"$network" = "bridge"')
+        ->toContain('"$network" = "host"')
+        ->toContain('"$network" = "none"')
+        ->toContain('"$network" = "default"');
+});
+
+it('preserves runtime reconciliation loops for non-root SSH users', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'user' => 'ubuntu',
+    ]);
+
+    $commands = collect(parseCommandsByLineForSudo(connectProxyToNetworks($server), $server))->implode("\n");
+
+    expect($commands)
+        ->toContain('$(sudo docker ps')
+        ->toMatch('/sudo\s+docker inspect/')
+        ->toMatch('/sudo\s+docker network inspect/')
+        ->toMatch('/sudo\s+docker network connect/')
+        ->not->toContain('sudo while')
+        ->not->toContain('sudo done')
+        ->not->toContain('sudo continue');
+});
diff --git a/tests/Feature/SearchableListboxComponentTest.php b/tests/Feature/SearchableListboxComponentTest.php
index a0f66d4220..828e498f24 100644
--- a/tests/Feature/SearchableListboxComponentTest.php
+++ b/tests/Feature/SearchableListboxComponentTest.php
@@ -19,6 +19,7 @@ test('searchable listbox renders search field and filters options client-side',
         ->toContain('No matching timezone')
         ->toContain('serverTimezone-trigger')
         ->toContain('x-ref="search"')
+        ->toContain('left-3 size-3')
         ->toContain('get filtered()')
         ->toContain('searchable-listbox-panel')
         ->toContain('Berlin')

From 8ecf77eadbbd1667c9565fac223cfdbffd0a9e17 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:42:22 +0200
Subject: [PATCH 21/42] fix(postgresql): persist selected public access state

---
 .../Project/Database/Postgresql/General.php         |  6 +++++-
 .../project/database/postgresql/general.blade.php   |  2 +-
 tests/Feature/DatabasePublicAccessLoadingTest.php   | 13 +++++++++++++
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 8993cc251b..051fb515d9 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -209,11 +209,15 @@ class General extends Component
         }
     }
 
-    public function instantSave()
+    public function instantSave(?bool $isPublic = null)
     {
         try {
             $this->authorize('update', $this->database);
 
+            if ($isPublic !== null) {
+                $this->isPublic = $isPublic;
+            }
+
             if ($this->isPublic && ! $this->publicPort) {
                 $this->dispatch('error', 'Public port is required.');
                 $this->isPublic = false;
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 3288a0ac61..705cad4412 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -89,7 +89,7 @@
             <x-table.loading target="instantSave" text="Updating public access..." />
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
-                    <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
+                    <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave" :onChangeArgs="[]"
                         :disabled="! auth()->user()->can('update', $database)" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
diff --git a/tests/Feature/DatabasePublicAccessLoadingTest.php b/tests/Feature/DatabasePublicAccessLoadingTest.php
index 81529fb1de..4b81d5f283 100644
--- a/tests/Feature/DatabasePublicAccessLoadingTest.php
+++ b/tests/Feature/DatabasePublicAccessLoadingTest.php
@@ -26,3 +26,16 @@ it('shows a loading indicator while database public access is changing', functio
             ->not->toContain('id="publicPort" live');
     }
 });
+
+it('passes the selected PostgreSQL public access state to the save action', function () {
+    $generalSettings = file_get_contents(resource_path('views/livewire/project/database/postgresql/general.blade.php'));
+
+    expect($generalSettings)
+        ->toContain('onChange="instantSave" :onChangeArgs="[]"');
+
+    $component = file_get_contents(app_path('Livewire/Project/Database/Postgresql/General.php'));
+
+    expect($component)
+        ->toContain('public function instantSave(?bool $isPublic = null)')
+        ->toContain('$this->isPublic = $isPublic;');
+});

From ab5025f0a77879a620213ac759ff1231a90f9aa0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:42:36 +0200
Subject: [PATCH 22/42] fix: select Traefik networks and stabilize dropdown
 positioning

---
 bootstrap/helpers/parsers.php                       |  6 ++++++
 resources/views/components/table/dropdown.blade.php | 13 ++++++++-----
 .../ApplicationParserDockerComposeDomainsTest.php   |  4 ++--
 tests/Feature/StandardTableComponentsTest.php       |  3 +++
 .../TraefikServiceDockerNetworkLabelTest.php        |  4 ++--
 5 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 7dd1c163c0..b47e570477 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1359,6 +1359,9 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                 ? $composeRedirect
                 : 'both';
+            if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
+                $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
+            }
             if ($shouldGenerateLabelsExactly) {
                 switch ($server->proxyType()) {
                     case ProxyTypes::TRAEFIK->value:
@@ -2633,6 +2636,9 @@ function serviceParser(Service $resource): Collection
             $redirectDirection = in_array(data_get($originalResource, 'redirect'), ['www', 'non-www', 'both'], true)
                 ? data_get($originalResource, 'redirect')
                 : 'both';
+            if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
+                $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
+            }
             if ($shouldGenerateLabelsExactly) {
                 switch ($server->proxyType()) {
                     case ProxyTypes::TRAEFIK->value:
diff --git a/resources/views/components/table/dropdown.blade.php b/resources/views/components/table/dropdown.blade.php
index 6a0472191e..b290128f97 100644
--- a/resources/views/components/table/dropdown.blade.php
+++ b/resources/views/components/table/dropdown.blade.php
@@ -6,13 +6,16 @@
 
 <div class="relative" x-data="{
     open: false,
-    panelStyle: 'display: none;',
+    panelStyle: 'position: fixed; min-width: 0; visibility: hidden;',
     toggle() {
-        this.open = !this.open;
-
         if (this.open) {
-            this.$nextTick(() => this.updatePosition());
+            this.open = false;
+            return;
         }
+
+        this.panelStyle = 'position: fixed; min-width: 0; visibility: hidden;';
+        this.open = true;
+        this.$nextTick(() => this.updatePosition());
     },
     updatePosition() {
         const trigger = this.$refs.trigger.getBoundingClientRect();
@@ -24,7 +27,7 @@
             ? trigger.bottom + 4
             : Math.max(viewportPadding, trigger.top - panel.height - 4);
 
-        this.panelStyle = `position: fixed; left: ${left}px; top: ${top}px;`;
+        this.panelStyle = `position: fixed; left: ${left}px; top: ${top}px; min-width: 0;`;
     }
 }" @click.outside="open = false" @keydown.escape.window="open = false"
     x-on:resize.window="if (open) updatePosition()" x-on:scroll.window="if (open) updatePosition()">
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 1b3e61be07..ebcb51fe19 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -399,7 +399,7 @@ YAML;
     expect(json_decode($plainApplication->docker_compose_domains, true))->toBeNull();
 });
 
-test('applicationParser does not force the private resource network for Traefik routed compose services', function () {
+test('applicationParser selects the resource network for Traefik routed compose services', function () {
     $application = Application::factory()->create([
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
@@ -422,7 +422,7 @@ YAML,
     $parsedCompose = applicationParser($application);
     $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
 
-    expect($labels->values()->all())->not->toContain("traefik.docker.network={$application->uuid}");
+    expect($labels->values()->all())->toContain("traefik.docker.network={$application->uuid}");
 });
 
 test('applicationParser preserves a user-selected Traefik network', function () {
diff --git a/tests/Feature/StandardTableComponentsTest.php b/tests/Feature/StandardTableComponentsTest.php
index 28f07a9a2f..9741268bc7 100644
--- a/tests/Feature/StandardTableComponentsTest.php
+++ b/tests/Feature/StandardTableComponentsTest.php
@@ -24,7 +24,10 @@ it('renders the standard table toolbar controls', function () {
         ->toContain('wire:model.live="search"')
         ->not->toContain('x-teleport="body"')
         ->not->toContain('floatingDropdown(')
+        ->toContain("panelStyle: 'position: fixed; min-width: 0; visibility: hidden;'")
+        ->toContain("this.panelStyle = 'position: fixed; min-width: 0; visibility: hidden;'")
         ->toContain('position: fixed')
+        ->toContain('min-width: 0')
         ->toContain('getBoundingClientRect()')
         ->toContain('x-show="open"')
         ->toContain('aria-multiselectable="true"')
diff --git a/tests/Feature/TraefikServiceDockerNetworkLabelTest.php b/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
index f1d7087a29..c098a2e93a 100644
--- a/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
+++ b/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
@@ -12,7 +12,7 @@ use Illuminate\Support\Facades\Bus;
 
 uses(RefreshDatabase::class);
 
-it('does not force the private service network for Traefik routed compose services', function () {
+it('selects the private service network for Traefik routed compose services', function () {
     Bus::fake();
 
     $team = Team::factory()->create();
@@ -45,5 +45,5 @@ YAML,
     $parsedCompose = serviceParser($service);
     $labels = collect(data_get($parsedCompose, 'services.app.labels'));
 
-    expect($labels->values()->all())->not->toContain("traefik.docker.network={$service->uuid}");
+    expect($labels->values()->all())->toContain("traefik.docker.network={$service->uuid}");
 });

From 48da7ee6e2764e28554cea7e691683edde364001 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:02:28 +0200
Subject: [PATCH 23/42] fix(table): preserve computed dropdown top position

---
 resources/views/components/table/dropdown.blade.php | 2 +-
 tests/Feature/TablePaginationLoadingTest.php        | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/resources/views/components/table/dropdown.blade.php b/resources/views/components/table/dropdown.blade.php
index b290128f97..c3ff1a2e5b 100644
--- a/resources/views/components/table/dropdown.blade.php
+++ b/resources/views/components/table/dropdown.blade.php
@@ -36,7 +36,7 @@
     </div>
 
     <div x-ref="panel" x-show="open" x-cloak :style="panelStyle"
-        class="listbox-panel fixed! top-auto! right-auto! bottom-auto! z-[90]! mt-0! {{ $panelClass }}" role="{{ $role }}"
+        class="listbox-panel fixed! right-auto! bottom-auto! z-[90]! mt-0! {{ $panelClass }}" role="{{ $role }}"
         @if ($multiselectable) aria-multiselectable="true" @endif>
         {{ $slot }}
     </div>
diff --git a/tests/Feature/TablePaginationLoadingTest.php b/tests/Feature/TablePaginationLoadingTest.php
index d26a1a33da..49bb974001 100644
--- a/tests/Feature/TablePaginationLoadingTest.php
+++ b/tests/Feature/TablePaginationLoadingTest.php
@@ -41,7 +41,8 @@ it('positions table dropdown panels outside overflowing containers', function ()
     expect($html)
         ->toContain('position: fixed')
         ->toContain('getBoundingClientRect()')
-        ->toContain('x-on:scroll.window');
+        ->toContain('x-on:scroll.window')
+        ->not->toContain('top-auto!');
 });
 
 it('renders compact client-side pagination', function () {

From a3e78a36778e98634e6ad37ebdbef494aeb6b1bc Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:18:52 +0200
Subject: [PATCH 24/42] fix(authorization): gate mutable Livewire controls by
 policy

Disable unauthorized listbox inputs and hide application deploy actions, with updated disabled styling and coverage.
---
 resources/css/app.css                         |  8 +-
 .../components/database-status-info.blade.php |  4 +-
 .../views/components/forms/listbox.blade.php  |  7 ++
 .../livewire/notifications/discord.blade.php  |  2 +-
 .../livewire/notifications/email.blade.php    | 10 +--
 .../project/application/domains.blade.php     |  4 +-
 .../project/application/heading.blade.php     |  4 +
 .../project/application/swarm.blade.php       |  2 +-
 .../database/clickhouse/general.blade.php     |  4 +-
 .../database/dragonfly/general.blade.php      |  4 +-
 .../project/database/heading.blade.php        |  4 +
 .../project/database/keydb/general.blade.php  |  4 +-
 .../database/mariadb/general.blade.php        |  4 +-
 .../database/mongodb/general.blade.php        |  4 +-
 .../project/database/mysql/general.blade.php  |  4 +-
 .../database/postgresql/general.blade.php     |  4 +-
 .../project/database/redis/general.blade.php  |  4 +-
 .../project/service/domains.blade.php         |  4 +-
 .../project/service/heading.blade.php         |  4 +
 .../project/service/stack-form.blade.php      |  2 +-
 .../shared/scheduled-task/show.blade.php      | 10 +--
 .../storages/volume-backups/s3.blade.php      |  4 +-
 .../livewire/server/log-drains.blade.php      |  6 +-
 .../views/livewire/server/swarm.blade.php     |  4 +-
 .../livewire/source/github/change.blade.php   |  4 +-
 .../livewire/source/gitlab/change.blade.php   |  2 +-
 resources/views/livewire/team/index.blade.php |  2 +-
 .../Feature/ListboxTriggerTruncationTest.php  |  9 ++
 ...bleLivewireComponentsAuthorizationTest.php | 83 +++++++++++++++++++
 29 files changed, 164 insertions(+), 47 deletions(-)

diff --git a/resources/css/app.css b/resources/css/app.css
index 95e0207ce2..636cf2ce8a 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1905,7 +1905,13 @@ html[data-theme="custom"] textarea:disabled {
 
 .listbox-trigger:disabled {
     cursor: not-allowed;
-    opacity: 0.5;
+    background-color: var(--color-neutral-100);
+    color: var(--color-neutral-400);
+}
+
+.dark .listbox-trigger:disabled {
+    background-color: color-mix(in oklab, var(--color-white) 3%, transparent);
+    color: var(--color-fg-faint);
 }
 
 .listbox-trigger:focus-visible {
diff --git a/resources/views/components/database-status-info.blade.php b/resources/views/components/database-status-info.blade.php
index 5e352c206b..b9298e2689 100644
--- a/resources/views/components/database-status-info.blade.php
+++ b/resources/views/components/database-status-info.blade.php
@@ -65,7 +65,7 @@
                 </div>
             @endif
             <div class="grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="enableSsl" label="SSL"
+                <x-forms.listbox canGate="update" :canResource="$database" id="enableSsl" label="SSL"
                     onChange="instantSaveSSL"
                     :disabled="! $isExited || ! auth()->user()?->can('update', $database)"
                     :options="[
@@ -73,7 +73,7 @@
                         ['value' => false, 'label' => 'Disabled'],
                     ]" />
                 @if ($sslModeOptions)
-                    <x-forms.listbox id="sslMode" label="SSL mode" :helper="$sslModeHelper"
+                    <x-forms.listbox canGate="update" :canResource="$database" id="sslMode" label="SSL mode" :helper="$sslModeHelper"
                         onChange="instantSaveSSL"
                         :disabled="! $enableSsl || ! $isExited || ! auth()->user()?->can('update', $database)"
                         :options="collect($sslModeOptions)->map(fn ($option, $value) => [
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index 4677911d94..d04a5f57e5 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -16,9 +16,16 @@
     'tooltip' => true,
     'portal' => false,
     'preserveValue' => false,
+    'canGate' => null,
+    'canResource' => null,
+    'autoDisable' => true,
 ])
 
 @php
+    if ($canGate && $canResource && $autoDisable && ! Illuminate\Support\Facades\Gate::allows($canGate, $canResource)) {
+        $disabled = true;
+    }
+
     $triggerId = ($htmlId ?? $id).'-trigger';
     $panelId = ($htmlId ?? $id).'-panel';
 @endphp
diff --git a/resources/views/livewire/notifications/discord.blade.php b/resources/views/livewire/notifications/discord.blade.php
index 5fdeb10da9..9e568c8459 100644
--- a/resources/views/livewire/notifications/discord.blade.php
+++ b/resources/views/livewire/notifications/discord.blade.php
@@ -15,7 +15,7 @@
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">
-                    <x-forms.listbox id="discordPingEnabled" label="Critical event mention"
+                    <x-forms.listbox canGate="update" :canResource="$settings" id="discordPingEnabled" label="Critical event mention"
                         helper="Mention @here when a critical event occurs."
                         onChange="instantSaveDiscordPingEnabled"
                         :disabled="!auth()->user()->can('update', $settings)" :options="[
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index e571d5083f..5ca19e8daa 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -41,7 +41,7 @@
                     <div class="lg:col-span-2">
                         @if (isCloud())
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="useInstanceEmailSettings" label="Email service"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="useInstanceEmailSettings" label="Email service"
                                     onChange="instantSave"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Use hosted email service'],
@@ -50,7 +50,7 @@
                             </div>
                         @else
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="useInstanceEmailSettings" label="Email service"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="useInstanceEmailSettings" label="Email service"
                                     onChange="instantSave"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Use system-wide settings'],
@@ -85,7 +85,7 @@
                     <div class="grid gap-4 lg:grid-cols-3">
                         <div class="lg:col-span-3">
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="smtpEnabled" label="SMTP delivery"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="smtpEnabled" label="SMTP delivery"
                                     onChange="submitSmtp"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Enabled'],
@@ -97,7 +97,7 @@
                             placeholder="smtp.mailgun.org" label="Host" />
                         <x-forms.input canGate="update" :canResource="$settings" required id="smtpPort"
                             type="number" placeholder="587" label="Port" />
-                        <x-forms.listbox id="smtpEncryption" label="Encryption" required
+                        <x-forms.listbox canGate="update" :canResource="$settings" id="smtpEncryption" label="Encryption" required
                             :disabled="!auth()->user()->can('update', $settings)" :options="[
                             ['value' => 'starttls', 'label' => 'StartTLS'],
                             ['value' => 'tls', 'label' => 'TLS / SSL'],
@@ -120,7 +120,7 @@
             <div class="application-settings-form">
                 <x-application.settings-section title="Resend">
                     <div class="grid gap-4 lg:grid-cols-2">
-                        <x-forms.listbox id="resendEnabled" label="Resend delivery"
+                        <x-forms.listbox canGate="update" :canResource="$settings" id="resendEnabled" label="Resend delivery"
                             onChange="submitResend"
                             :disabled="!auth()->user()->can('update', $settings)" :options="[
                                 ['value' => true, 'label' => 'Enabled'],
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index a11e6930f1..4adbcf8ff1 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -71,7 +71,7 @@
 
         @if ($hasHttpsDomains && ! $labelsAreWritable)
             <div class="mt-4 max-w-md">
-                <x-forms.listbox id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
+                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
                     onChange="updateForceHttps"
                     helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
                     :options="[
@@ -119,7 +119,7 @@
                             </x-slot:content>
                             <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                                 @if ($isCompose && count($composeServices) > 0)
-                                    <x-forms.listbox label="Service" id="newDomainService" required
+                                    <x-forms.listbox canGate="update" :canResource="$application" label="Service" id="newDomainService" required
                                         :options="collect($composeServices)->map(fn ($serviceName) => [
                                             'value' => $serviceName,
                                             'label' => $serviceName,
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index d7efc8f2fa..3892a623ca 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -39,6 +39,7 @@
 
         <div class="w-full xl:hidden">
             @if (!($application->build_pack === 'dockercompose' && is_null($application->docker_compose_raw)))
+                @can('deploy', $application)
                 <div id="application-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -149,6 +150,7 @@
                         @endif
                     </div>
                 </div>
+                @endcan
             @endif
             <div class="hidden" aria-hidden="true">
                 <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
@@ -185,6 +187,7 @@
                         <div class="resource-heading-menus shrink-0">
                             <x-applications.links :application="$application" />
                         </div>
+                        @can('deploy', $application)
                         <div id="application-desktop-actions" class="relative" x-data="{ open: false }"
                             x-effect="$dispatch('resource-actions-toggled', { open })"
                             @click.outside="open = false" @keydown.escape.window="open = false">
@@ -279,6 +282,7 @@
                                 @endif
                             </div>
                         </div>
+                        @endcan
                     @endif
                 </div>
             </div>
diff --git a/resources/views/livewire/project/application/swarm.blade.php b/resources/views/livewire/project/application/swarm.blade.php
index fc8112afbe..6bd593b933 100644
--- a/resources/views/livewire/project/application/swarm.blade.php
+++ b/resources/views/livewire/project/application/swarm.blade.php
@@ -14,7 +14,7 @@
         <div class="mt-4 grid gap-4 lg:grid-cols-2">
             <x-forms.input id="swarmReplicas" label="Replicas" required canGate="update"
                 :canResource="$application" />
-            <x-forms.listbox id="isSwarmOnlyWorkerNodes" label="Node placement" live onChange="instantSave"
+            <x-forms.listbox canGate="update" :canResource="$application" id="isSwarmOnlyWorkerNodes" label="Node placement" live onChange="instantSave"
                 :disabled="! auth()->user()->can('update', $application)" :options="[
                     ['value' => true, 'label' => 'Worker nodes only'],
                     ['value' => false, 'label' => 'Manager and worker nodes'],
diff --git a/resources/views/livewire/project/database/clickhouse/general.blade.php b/resources/views/livewire/project/database/clickhouse/general.blade.php
index 33486f8e0d..1a83934c8d 100644
--- a/resources/views/livewire/project/database/clickhouse/general.blade.php
+++ b/resources/views/livewire/project/database/clickhouse/general.blade.php
@@ -79,7 +79,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -94,7 +94,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/dragonfly/general.blade.php b/resources/views/livewire/project/database/dragonfly/general.blade.php
index 8dabe8c9aa..592396c0ae 100644
--- a/resources/views/livewire/project/database/dragonfly/general.blade.php
+++ b/resources/views/livewire/project/database/dragonfly/general.blade.php
@@ -80,7 +80,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -95,7 +95,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index c36020ee9a..bcdf1cf855 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -69,6 +69,7 @@
 
         <div class="w-full xl:hidden">
             @if ($database->destination->server->isFunctional())
+                @can('manage', $database)
                 <div id="database-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -127,6 +128,7 @@
                         @endif
                     </div>
                 </div>
+                @endcan
             @endif
 
         </div>
@@ -137,6 +139,7 @@
                 class="resource-heading-navbar application-heading-actions flex w-auto min-w-0 items-center justify-end gap-1 overflow-visible">
                 <div class="resource-heading-actions flex shrink-0 items-center gap-0.5">
                     @if ($database->destination->server->isFunctional())
+                        @can('manage', $database)
                         <div id="database-desktop-actions" class="flex items-center gap-0.5">
                             @if (! $databaseStatus->startsWith('exited'))
                                 <button type="button" class="button button-highlighted"
@@ -156,6 +159,7 @@
                                 </x-forms.button>
                             @endif
                         </div>
+                        @endcan
                     @else
                         <x-status-badge status="Server unavailable" type="error" />
                     @endif
diff --git a/resources/views/livewire/project/database/keydb/general.blade.php b/resources/views/livewire/project/database/keydb/general.blade.php
index e6b7ff985f..6d894df04b 100644
--- a/resources/views/livewire/project/database/keydb/general.blade.php
+++ b/resources/views/livewire/project/database/keydb/general.blade.php
@@ -81,7 +81,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -104,7 +104,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mariadb/general.blade.php b/resources/views/livewire/project/database/mariadb/general.blade.php
index a604bb700a..f2df51f661 100644
--- a/resources/views/livewire/project/database/mariadb/general.blade.php
+++ b/resources/views/livewire/project/database/mariadb/general.blade.php
@@ -86,7 +86,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -107,7 +107,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mongodb/general.blade.php b/resources/views/livewire/project/database/mongodb/general.blade.php
index 62d57910a5..ac47d8d69f 100644
--- a/resources/views/livewire/project/database/mongodb/general.blade.php
+++ b/resources/views/livewire/project/database/mongodb/general.blade.php
@@ -83,7 +83,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -104,7 +104,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mysql/general.blade.php b/resources/views/livewire/project/database/mysql/general.blade.php
index e2cd3802ed..7f7b40085d 100644
--- a/resources/views/livewire/project/database/mysql/general.blade.php
+++ b/resources/views/livewire/project/database/mysql/general.blade.php
@@ -86,7 +86,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -107,7 +107,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 705cad4412..738c46fea9 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -90,7 +90,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave" :onChangeArgs="[]"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -111,7 +111,7 @@
 
         <x-application.settings-section id="log-delivery-section" title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/redis/general.blade.php b/resources/views/livewire/project/database/redis/general.blade.php
index 39fa2c8522..3fdf256190 100644
--- a/resources/views/livewire/project/database/redis/general.blade.php
+++ b/resources/views/livewire/project/database/redis/general.blade.php
@@ -85,7 +85,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -110,7 +110,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 9399efe7f9..05e5792fe2 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -93,7 +93,7 @@
                         </x-slot:content>
                         <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                             {{-- Always show which service receives the domain --}}
-                            <x-forms.listbox label="Service application" id="newServiceApplicationId" required
+                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required
                                 helper="Domain will be assigned to this compose service application."
                                 :options="collect($serviceApps)->map(fn ($app) => [
                                     'value' => $app['id'],
@@ -170,7 +170,7 @@
                         <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">{{ $heading }}</span>
                         @if ($hasHttpsDomains)
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="forceHttpsRedirects.{{ $appId }}"
+                                <x-forms.listbox canGate="update" :canResource="$service" id="forceHttpsRedirects.{{ $appId }}"
                                     htmlId="service-force-https-{{ $appId }}"
                                     label="Redirect HTTP to HTTPS" onChange="updateForceHttps"
                                     :onChangeArgs="[(int) $appId]"
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 113a6c5a3f..b022eef10c 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -73,6 +73,7 @@
 
         <div class="w-full xl:hidden">
             @if ($service->isDeployable)
+                @can('deploy', $service)
                 <div id="service-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -165,6 +166,7 @@
                         @endif
                     </div>
                 </div>
+                @endcan
             @else
                 <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
                     class="mb-3 inline-flex" aria-label="Open required environment variables">
@@ -183,6 +185,7 @@
                         <div class="resource-heading-menus shrink-0">
                             <x-services.links :service="$service" />
                         </div>
+                        @can('deploy', $service)
                         <div id="service-desktop-actions" class="relative" x-data="{ open: false }"
                                 x-effect="$dispatch('resource-actions-toggled', { open })"
                                 @click.outside="open = false" @keydown.escape.window="open = false">
@@ -247,6 +250,7 @@
                                     @endif
                                 </div>
                         </div>
+                        @endcan
                     @else
                         <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
                             aria-label="Open required environment variables">
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index d6c55ecfe3..423ea0aaf8 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -52,7 +52,7 @@
 
     <x-application.settings-section title="Network"
         description="Control whether this Compose stack joins Coolify's predefined network.">
-        <x-forms.listbox id="connectToDockerNetwork" label="Network attachment" live onChange="instantSave"
+        <x-forms.listbox canGate="update" :canResource="$service" id="connectToDockerNetwork" label="Network attachment" live onChange="instantSave"
             :disabled="! auth()->user()->can('update', $service)" :options="[
                 ['value' => false, 'label' => 'Use the stack network only'],
                 ['value' => true, 'label' => 'Connect to the predefined Coolify network'],
diff --git a/resources/views/livewire/project/shared/scheduled-task/show.blade.php b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
index dcf90fd2ee..c5be9974ba 100644
--- a/resources/views/livewire/project/shared/scheduled-task/show.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
@@ -27,21 +27,21 @@
             </x-slot:actions>
 
             <div class="grid gap-4 md:grid-cols-2">
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="Name" id="name"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" placeholder="Name" id="name"
                     label="Name" required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)"
                     placeholder="0 0 * * * or daily" id="frequency" label="Schedule"
                     helper="Use every_minute, hourly, daily, weekly, monthly, yearly, or a cron expression."
                     required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" type="number"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" type="number"
                     placeholder="300" id="timeout" helper="Maximum execution time from 60 to 36,000 seconds."
                     label="Timeout (seconds)" required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="php"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" placeholder="php"
                     helper="Leave empty when the resource only has one container." id="container"
                     label="{{ $type === 'service' ? 'Service' : 'Container' }}" />
             </div>
             <div class="mt-4">
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)"
                     placeholder="php artisan schedule:run" id="command" label="Command" required />
             </div>
         </x-application.settings-section>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
index 2dc32b3e31..eeaca78479 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
@@ -39,13 +39,13 @@
                 @endif
             </div>
             <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="s3StorageId" label="S3 storage" :required="$saveToS3"
+                <x-forms.listbox canGate="update" :canResource="$resource" id="s3StorageId" label="S3 storage" :required="$saveToS3"
                     :disabled="! auth()->user()?->can('update', $resource)"
                     :options="$availableS3Storages->map(fn ($s3Storage) => [
                         'value' => $s3Storage->id,
                         'label' => $s3Storage->name,
                     ])->values()->all()" />
-                <x-forms.listbox id="disableLocalBackup" label="Local copy"
+                <x-forms.listbox canGate="update" :canResource="$resource" id="disableLocalBackup" label="Local copy"
                     :disabled="! $saveToS3 || ! auth()->user()?->can('update', $resource)" :options="[
                         ['value' => false, 'label' => 'Keep local backup'],
                         ['value' => true, 'label' => 'Delete after S3 upload'],
diff --git a/resources/views/livewire/server/log-drains.blade.php b/resources/views/livewire/server/log-drains.blade.php
index 66f7985032..ac908a7c9d 100644
--- a/resources/views/livewire/server/log-drains.blade.php
+++ b/resources/views/livewire/server/log-drains.blade.php
@@ -29,7 +29,7 @@
                     <x-application.settings-section id="server-new-relic-drain-section" title="New Relic"
                         helper="Send logs through the New Relic Log API.">
                         <div class="grid gap-4 lg:grid-cols-3">
-                            <x-forms.listbox id="isLogDrainNewRelicEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainNewRelicEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
@@ -48,7 +48,7 @@
                     <x-application.settings-section id="server-axiom-drain-section" title="Axiom"
                         helper="Send logs to an Axiom dataset using its ingest API.">
                         <div class="grid gap-4 lg:grid-cols-3">
-                            <x-forms.listbox id="isLogDrainAxiomEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainAxiomEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
@@ -65,7 +65,7 @@
                     <x-application.settings-section id="server-custom-drain-section" title="Custom Fluent Bit"
                         helper="Provide a custom Fluent Bit output and optional parser configuration.">
                         <div class="mb-4 max-w-sm">
-                            <x-forms.listbox id="isLogDrainCustomEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainCustomEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
diff --git a/resources/views/livewire/server/swarm.blade.php b/resources/views/livewire/server/swarm.blade.php
index 8d807fcc5b..a3e8dfce4a 100644
--- a/resources/views/livewire/server/swarm.blade.php
+++ b/resources/views/livewire/server/swarm.blade.php
@@ -23,14 +23,14 @@
                 </x-callout>
 
                 <div class="mt-4 grid gap-4 lg:grid-cols-2">
-                    <x-forms.listbox id="isSwarmManager" label="Manager role"
+                    <x-forms.listbox canGate="update" :canResource="$server" id="isSwarmManager" label="Manager role"
                         helper="Managers control scheduling and cluster state." onChange="instantSave"
                         :options="[
                             ['value' => false, 'label' => 'Not a Swarm manager'],
                             ['value' => true, 'label' => 'Swarm manager'],
                         ]"
                         :disabled="$server->settings->is_swarm_worker || !auth()->user()->can('update', $server)" />
-                    <x-forms.listbox id="isSwarmWorker" label="Worker role"
+                    <x-forms.listbox canGate="update" :canResource="$server" id="isSwarmWorker" label="Worker role"
                         helper="Workers run tasks assigned by a Swarm manager." onChange="instantSave"
                         :options="[
                             ['value' => false, 'label' => 'Not a Swarm worker'],
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index 5cafb3edb3..2730c19a97 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -127,7 +127,7 @@
 
                                         @if (!isCloud())
                                             <div class="lg:col-span-2">
-                                                <x-forms.listbox id="isSystemWide" label="Availability" :options="[
+                                                <x-forms.listbox canGate="update" :canResource="$github_app" id="isSystemWide" label="Availability" :options="[
                                                     ['value' => false, 'label' => 'Only this team'],
                                                     ['value' => true, 'label' => 'Every team on this instance'],
                                                 ]"
@@ -161,7 +161,7 @@
                                             label="Client secret" type="password" required />
                                         <x-forms.input canGate="update" :canResource="$github_app" id="webhookSecret"
                                             label="Webhook secret" type="password" required />
-                                        <x-forms.listbox id="privateKeyId" label="Private key" required
+                                        <x-forms.listbox canGate="update" :canResource="$github_app" id="privateKeyId" label="Private key" required
                                             :options="$privateKeyOptions" :disabled="!auth()->user()->can('update', $github_app)" />
                                     </div>
                                 </x-application.settings-section>
diff --git a/resources/views/livewire/source/gitlab/change.blade.php b/resources/views/livewire/source/gitlab/change.blade.php
index a8a499e6ba..5629e1e364 100644
--- a/resources/views/livewire/source/gitlab/change.blade.php
+++ b/resources/views/livewire/source/gitlab/change.blade.php
@@ -82,7 +82,7 @@
                     <x-forms.input canGate="update" :canResource="$gitlab_app" type="number" id="customPort"
                         label="SSH port" />
                     <div class="lg:col-span-2">
-                        <x-forms.listbox id="privateKeyId" label="SSH private key (optional)"
+                        <x-forms.listbox canGate="update" :canResource="$gitlab_app" id="privateKeyId" label="SSH private key (optional)"
                             :options="collect($privateKeys)->map(fn ($key) => [
                                 'value' => $key->id,
                                 'label' => $key->name,
diff --git a/resources/views/livewire/team/index.blade.php b/resources/views/livewire/team/index.blade.php
index 64fe0994a4..d30df3411d 100644
--- a/resources/views/livewire/team/index.blade.php
+++ b/resources/views/livewire/team/index.blade.php
@@ -18,7 +18,7 @@
                     <x-forms.input id="name" label="Name" required canGate="update" :canResource="$team" />
                     <x-forms.input id="description" label="Description" canGate="update" :canResource="$team" />
                     <div class="lg:col-span-2">
-                        <x-forms.listbox id="is_mcp_server_enabled" label="MCP server"
+                        <x-forms.listbox canGate="update" :canResource="$team" id="is_mcp_server_enabled" label="MCP server"
                             helper="Controls whether this team's API tokens can use the instance MCP endpoint."
                             :disabled="! auth()->user()->can('update', $team)" :options="[
                                 ['value' => false, 'label' => 'Disabled for this team'],
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index d5f259a853..82e526bb3b 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -22,6 +22,15 @@ test('listbox trigger height matches shared inputs', function () {
         ->toMatch('/\.application-settings-workspace \.listbox-trigger[^}]*height: 2rem;/s');
 });
 
+test('disabled listboxes use the same colors as disabled inputs', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)
+        ->toMatch('/\.listbox-trigger:disabled \{[^}]*background-color: var\(--color-neutral-100\);[^}]*color: var\(--color-neutral-400\);/s')
+        ->toMatch('/\.dark \.listbox-trigger:disabled \{[^}]*background-color: color-mix\(in oklab, var\(--color-white\) 3%, transparent\);[^}]*color: var\(--color-fg-faint\);/s')
+        ->not->toMatch('/\.listbox-trigger:disabled \{[^}]*opacity:/s');
+});
+
 test('listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.listbox id="longOption" label="Example"
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index ffaefa8635..f6991025c8 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -1,9 +1,58 @@
 <?php
 
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Gate;
 
 uses(RefreshDatabase::class);
 
+it('auto-disables listboxes when the gate denies access', function () {
+    Gate::define('update-listbox-test', fn (): bool => false);
+
+    $html = Blade::render(<<<'BLADE'
+        <x-forms.listbox id="status" :wire="false" value="enabled"
+            canGate="update-listbox-test" :canResource="new stdClass"
+            :options="[['value' => 'enabled', 'label' => 'Enabled']]" />
+    BLADE);
+
+    expect($html)->toMatch('/<button[^>]*id="status-trigger"[^>]*\sdisabled(?:[=\s>])/');
+});
+
+it('declares gate attributes on form controls with update permission checks', function () {
+    $controlPattern = '/<x-forms\.(?:listbox|input|select|checkbox|textarea|button|toggle)\b.*?(?:\/>|<\/x-forms\.[^>]+>)/s';
+
+    foreach (File::allFiles(resource_path('views')) as $file) {
+        $path = $file->getPathname();
+        $source = file_get_contents($path);
+        preg_match_all($controlPattern, $source, $controls);
+
+        foreach ($controls[0] as $control) {
+            if (! preg_match('/can\(\s*[\'\"]update[\'\"]/', $control)) {
+                continue;
+            }
+
+            expect($control, $path)->toContain('canGate="update"')
+                ->toContain(':canResource=');
+        }
+    }
+});
+
+it('hides resource action menus when the user cannot manage the resource', function (string $path, string $ability, string $resource, string $prefix) {
+    $source = file_get_contents(resource_path($path));
+
+    foreach (['mobile', 'desktop'] as $viewport) {
+        expect($source)->toMatch(
+            "/@can\\('{$ability}', \\$".$resource."\\)[\\s\\S]*?<div id=\"{$prefix}-{$viewport}-actions\"/"
+        );
+    }
+})->with([
+    'application actions' => ['views/livewire/project/application/heading.blade.php', 'deploy', 'application', 'application'],
+    'service actions' => ['views/livewire/project/service/heading.blade.php', 'deploy', 'service', 'service'],
+    'database actions' => ['views/livewire/project/database/heading.blade.php', 'manage', 'database', 'database'],
+    'server actions' => ['views/livewire/server/navbar.blade.php', 'manageProxy', 'server', 'server'],
+]);
+
 it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
     $source = file_get_contents(base_path($path));
 
@@ -69,4 +118,38 @@ it('authorizes every volume backup form control', function (string $path, array
             '/wire:click="checkAllDns"/s',
         ],
     ],
+    'postgres public access control' => [
+        'resources/views/livewire/project/database/postgresql/general.blade.php',
+        [
+            '/<x-forms\.listbox id="isPublic"[\s\S]*?:disabled="! auth\(\)->user\(\)->can\(\'update\', \$database\)" canGate="update" :canResource="\$database" :options=/',
+        ],
+    ],
+    'redis public access control' => [
+        'resources/views/livewire/project/database/redis/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mongodb public access control' => [
+        'resources/views/livewire/project/database/mongodb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'clickhouse public access control' => [
+        'resources/views/livewire/project/database/clickhouse/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mariadb public access control' => [
+        'resources/views/livewire/project/database/mariadb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'dragonfly public access control' => [
+        'resources/views/livewire/project/database/dragonfly/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mysql public access control' => [
+        'resources/views/livewire/project/database/mysql/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'keydb public access control' => [
+        'resources/views/livewire/project/database/keydb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
 ]);

From c9d5c4c41fc46220448cd1b3b7d144c3477d000d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:41:45 +0200
Subject: [PATCH 25/42] fix(upgrade): handle missing status after restart
 (#11350)

---
 resources/views/livewire/upgrade.blade.php | 10 ++++++++++
 tests/Unit/CoolifyUpgradeStatusTest.php    | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/resources/views/livewire/upgrade.blade.php b/resources/views/livewire/upgrade.blade.php
index f93c7bcea7..97c08c0357 100644
--- a/resources/views/livewire/upgrade.blade.php
+++ b/resources/views/livewire/upgrade.blade.php
@@ -295,6 +295,16 @@
                         }
                         throw error;
                     }
+                    if (!data) {
+                        if (this.instanceWentDown) {
+                            // The upgraded instance can no longer return data for the old Livewire component.
+                            // A healthy response after observed downtime confirms that the restart completed.
+                            this.showSuccess();
+                        } else {
+                            this.currentStatus = this.getReviveStatusMessage(elapsedMinutes, this.healthCheckAttempts);
+                        }
+                        return;
+                    }
                     if (data.status === 'complete') {
                         this.showSuccess();
                     } else if (data.status === 'error') {
diff --git a/tests/Unit/CoolifyUpgradeStatusTest.php b/tests/Unit/CoolifyUpgradeStatusTest.php
index a00283615f..2248e382b5 100644
--- a/tests/Unit/CoolifyUpgradeStatusTest.php
+++ b/tests/Unit/CoolifyUpgradeStatusTest.php
@@ -149,6 +149,16 @@ it('finishes after health recovers from observed downtime for older target relea
         ->toContain('return;');
 });
 
+it('finishes when the post-restart Livewire status response is undefined', function () {
+    $upgradeView = file_get_contents(__DIR__.'/../../resources/views/livewire/upgrade.blade.php');
+
+    expect($upgradeView)
+        ->toContain('if (!data) {')
+        ->toContain('if (this.instanceWentDown) {')
+        ->toContain('this.showSuccess();')
+        ->toContain('return;');
+});
+
 it('tells users to reload manually if the automatic reload does not happen', function () {
     $upgradeView = file_get_contents(__DIR__.'/../../resources/views/livewire/upgrade.blade.php');
 

From 88eccbf78fb6e9044f00ff4f088ec675d5d1ad44 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 11:29:01 +0200
Subject: [PATCH 26/42] chore(release): bump Coolify versions to 4.3.9

---
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 4 ++--
 tests/Unit/ProductionImageWorkflowTest.php | 6 +++---
 versions.json                              | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index bc21514677..e0aefe8e2b 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.8',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.9',
         'helper_version' => '1.0.15',
         'realtime_version' => '1.0.17',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index ebc1151c32..92a88ea023 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.8"
+            "version": "4.3.9"
         },
         "nightly": {
-            "version": "4.3.9"
+            "version": "4.3.10"
         },
         "helper": {
             "version": "1.0.15"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index e57587f289..c3b5e665f3 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,9 +23,9 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.8'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.8')
-        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.9')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.9'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.9')
+        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.10')
         ->and($nightlyVersions)->toBe($versions);
 });
 
diff --git a/versions.json b/versions.json
index ebc1151c32..92a88ea023 100644
--- a/versions.json
+++ b/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.8"
+            "version": "4.3.9"
         },
         "nightly": {
-            "version": "4.3.9"
+            "version": "4.3.10"
         },
         "helper": {
             "version": "1.0.15"

From 05ebba9f1a9875b3e0f5faf42c71fbafc031d37e Mon Sep 17 00:00:00 2001
From: Prai'ns <sleskov2013@yandex.ru>
Date: Tue, 18 Aug 2026 12:30:09 +0300
Subject: [PATCH 27/42] fix: compress dashboard over HTTPS (#10828)

Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
---
 app/Models/Server.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/Models/Server.php b/app/Models/Server.php
index 1acc4e45f1..0f5a35364c 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -736,6 +736,9 @@ class Server extends BaseModel
                     ];
 
                     $traefik_dynamic_conf['http']['routers']['coolify-https'] = [
+                        'middlewares' => [
+                            0 => 'gzip',
+                        ],
                         'entryPoints' => [
                             0 => 'https',
                         ],
@@ -791,6 +794,7 @@ class Server extends BaseModel
                 $schema = $url->getScheme();
                 $caddy_file = "
 $schema://$host {
+    encode zstd gzip
     handle /app/* {
         reverse_proxy coolify-realtime:6001
     }

From 30da9e96eb05b89020d1da8b155207c7d9e5d4c3 Mon Sep 17 00:00:00 2001
From: NrwPlay <nrwplay@nrwplay.de>
Date: Tue, 18 Aug 2026 11:38:01 +0200
Subject: [PATCH 28/42] fix(notification): update storage email link in S3
 error (#8633)

---
 app/Models/S3Storage.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index e8e1788e3f..e4b1e2fd68 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -198,7 +198,7 @@ class S3Storage extends BaseModel
                 try {
                     $mail = new MailMessage;
                     $mail->subject('Coolify: S3 Storage Connection Error');
-                    $mail->view('emails.s3-connection-error', ['name' => $this->name, 'reason' => $exception->getMessage(), 'url' => route('storage.show', ['storage_uuid' => $this->uuid])]);
+                    $mail->view('emails.s3-connection-error', ['name' => $this->name, 'reason' => $e->getMessage(), 'url' => base_url().'/storages/'.$this->uuid]);
 
                     // Load the team with its members and their roles explicitly
                     $team = $this->team()->with(['members' => function ($query) {

From d360da327067174ebe10340aac5172d3877016c0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 11:55:55 +0200
Subject: [PATCH 29/42] fix(databases): chown SSL certs before container
 replacement (#11352)

---
 app/Actions/Database/StartMariadb.php          |  4 ++--
 app/Actions/Database/StartMongodb.php          |  4 ++--
 app/Actions/Database/StartMysql.php            |  4 ++--
 app/Actions/Database/StartPostgresql.php       |  4 ++--
 .../Unit/DatabaseSslCredentialEscapingTest.php | 18 +++++++++++++-----
 5 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index c4f98cfdfe..2f030ae299 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -208,11 +208,11 @@ class StartMariadb
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
-        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
             $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
         }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
+        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index 0f9bba6797..097e19f7b2 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -257,11 +257,11 @@ class StartMongodb
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
-        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
             $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mongodb:mongodb /etc/mongo/certs/server.pem < /dev/null";
         }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
+        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index 3eab004643..d21ee02fb1 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -209,11 +209,11 @@ class StartMysql
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
-        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
             $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
         }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
+        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
 
         $this->commands[] = "echo 'Database started.'";
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 21cb278fbb..f70e8f3cfd 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -219,11 +219,11 @@ class StartPostgresql
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
-        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
             $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name postgres:postgres /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt < /dev/null";
         }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
+        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
diff --git a/tests/Unit/DatabaseSslCredentialEscapingTest.php b/tests/Unit/DatabaseSslCredentialEscapingTest.php
index 8ddc10a048..7b2ecf927e 100644
--- a/tests/Unit/DatabaseSslCredentialEscapingTest.php
+++ b/tests/Unit/DatabaseSslCredentialEscapingTest.php
@@ -21,33 +21,41 @@ it('escapeshellarg wraps postgres_user in single quotes for chown command', func
         ->toContain('chown');
 });
 
-it('sets postgres SSL file ownership before starting the database container', function () {
+it('sets postgres SSL file ownership before replacing the database container', function () {
     $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartPostgresql.php');
 
     $permissionCommandPosition = strpos($source, '--entrypoint chown');
+    $stopCommandPosition = strpos($source, 'dockerStopCommand');
     $startCommandPosition = strpos($source, 'docker-compose.yml up -d');
 
     expect($permissionCommandPosition)->not->toBeFalse()
+        ->and($stopCommandPosition)->not->toBeFalse()
         ->and($startCommandPosition)->not->toBeFalse()
+        ->and($permissionCommandPosition)->toBeLessThan($stopCommandPosition)
         ->and($permissionCommandPosition)->toBeLessThan($startCommandPosition)
+        ->and($source)->toContain('/var/lib/postgresql/certs/server.crt < /dev/null')
         ->and($source)->toContain('postgres:postgres /var/lib/postgresql/certs/server.key')
         ->not->toContain('chown {$postgresUser}:{$postgresUser}');
 });
 
-it('sets database SSL file ownership before startup', function (string $action, string $owner, string $keyPath) {
+it('sets database SSL file ownership before replacing the container', function (string $action, string $owner, string $keyPath, string $lastCertificatePath) {
     $source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
 
     $permissionCommandPosition = strpos($source, '--entrypoint chown');
+    $stopCommandPosition = strpos($source, 'dockerStopCommand');
     $startCommandPosition = strpos($source, 'docker-compose.yml up -d');
 
     expect($permissionCommandPosition)->not->toBeFalse()
+        ->and($stopCommandPosition)->not->toBeFalse()
         ->and($startCommandPosition)->not->toBeFalse()
+        ->and($permissionCommandPosition)->toBeLessThan($stopCommandPosition)
         ->and($permissionCommandPosition)->toBeLessThan($startCommandPosition)
+        ->and($source)->toContain("{$lastCertificatePath} < /dev/null")
         ->and($source)->toContain("{$owner} {$keyPath}");
 })->with([
-    'mysql' => ['StartMysql', 'mysql:mysql', '/etc/mysql/certs/server.key'],
-    'mariadb' => ['StartMariadb', 'mysql:mysql', '/etc/mysql/certs/server.key'],
-    'mongodb' => ['StartMongodb', 'mongodb:mongodb', '/etc/mongo/certs/server.pem'],
+    'mysql' => ['StartMysql', 'mysql:mysql', '/etc/mysql/certs/server.key', '/etc/mysql/certs/server.crt'],
+    'mariadb' => ['StartMariadb', 'mysql:mysql', '/etc/mysql/certs/server.key', '/etc/mysql/certs/server.crt'],
+    'mongodb' => ['StartMongodb', 'mongodb:mongodb', '/etc/mongo/certs/server.pem', '/etc/mongo/certs/server.pem'],
 ]);
 
 it('advisory PoC postgres_user payload is contained by escapeshellarg in chown command', function () {

From c2b7978e3ee01baeef58632f9c32c94e7c5a7d2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Far=C3=A8s=20SIONI?=
 <82713835+fsioni@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:21:49 +0200
Subject: [PATCH 30/42] fix(ui): improve highlighted button and spinner
 contrast (#11279)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: 🏔️ Peak <122374094+peaklabs-dev@users.noreply.github.com>
---
 resources/css/app.css                            | 10 ++++++----
 resources/css/utilities.css                      |  2 +-
 resources/views/components/unsaved-bar.blade.php |  2 +-
 tests/Feature/HighlightedButtonStylingTest.php   | 15 ++++++++++++++-
 tests/Feature/SentinelUnsavedBarFlashTest.php    |  6 +++---
 5 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/resources/css/app.css b/resources/css/app.css
index 636cf2ce8a..9dc39b7cc5 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -398,9 +398,12 @@ html[data-theme="custom"] .animate-spin {
     color: var(--theme-bright-color) !important;
 }
 
-/* Opt out of the brand spinner when the surrounding surface is a selected/neutral control. */
+/* Opt out of the brand spinner when the surrounding surface is a selected/neutral control
+   or a highlighted button, whose accent surface would camouflage a brand-colored spinner. */
 .dark .animate-spin.spinner-current,
-html[data-theme="custom"] .animate-spin.spinner-current {
+html[data-theme="custom"] .animate-spin.spinner-current,
+html[data-theme="custom"] .button-highlighted .animate-spin,
+html[data-theme="custom"] button[isHighlighted] .animate-spin {
     color: inherit !important;
 }
 
@@ -993,8 +996,7 @@ html[data-theme="custom"] {
 }
 
 html[data-theme="custom"] .control-selected,
-html[data-theme="custom"] .logs-viewer-btn-active,
-html[data-theme="custom"] .button-highlighted:hover {
+html[data-theme="custom"] .logs-viewer-btn-active {
     color: var(--color-accent-foreground);
 }
 
diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 44218b0f3c..7c690cba75 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -131,7 +131,7 @@
 }
 
 @utility button-highlighted {
-    @apply border-coollabs-200 bg-linear-to-b from-coollabs-100 to-coollabs-200 text-white! hover:from-coollabs-100 hover:to-coollabs hover:text-white!;
+    @apply border-coollabs-200 bg-linear-to-b from-coollabs-100 to-coollabs-200 text-accent-foreground! hover:from-coollabs-100 hover:to-coollabs hover:text-accent-foreground!;
 }
 
 @utility control-selected {
diff --git a/resources/views/components/unsaved-bar.blade.php b/resources/views/components/unsaved-bar.blade.php
index 1a5f85d3a0..8d029c2fb3 100644
--- a/resources/views/components/unsaved-bar.blade.php
+++ b/resources/views/components/unsaved-bar.blade.php
@@ -67,7 +67,7 @@
             class="button-highlighted flex h-8 items-center gap-2 rounded-lg px-4 text-[13px] font-semibold transition-[transform,background-color] active:scale-[0.98]">
             <span>Save changes</span>
             <kbd
-                class="rounded border border-coollabs/20 bg-coollabs/10 px-1.5 py-0.5 text-[10px] leading-none font-medium text-coollabs-200 dark:border-white/20 dark:bg-white/10 dark:text-white/75">Enter</kbd>
+                class="rounded border border-current/20 bg-current/10 px-1.5 py-0.5 text-[10px] leading-none font-medium text-current">Enter</kbd>
         </button>
     </div>
 </div>
diff --git a/tests/Feature/HighlightedButtonStylingTest.php b/tests/Feature/HighlightedButtonStylingTest.php
index eae11deaff..834d792cee 100644
--- a/tests/Feature/HighlightedButtonStylingTest.php
+++ b/tests/Feature/HighlightedButtonStylingTest.php
@@ -10,10 +10,23 @@ test('highlighted buttons use the shared coollabs style in every color scheme',
 
     expect($utilities)
         ->toContain('@utility button-highlighted')
-        ->toContain('@apply border-coollabs-200 bg-linear-to-b from-coollabs-100 to-coollabs-200 text-white! hover:from-coollabs-100 hover:to-coollabs hover:text-white!;')
+        ->toContain('@apply border-coollabs-200 bg-linear-to-b from-coollabs-100 to-coollabs-200 text-accent-foreground! hover:from-coollabs-100 hover:to-coollabs hover:text-accent-foreground!;')
         ->and($appStyles)
         ->toContain('button[isHighlighted]:not(:disabled)')
         ->toContain('@apply button-highlighted;')
         ->and($views)
         ->not->toContain('dark:bg-warning/15! dark:text-warning! dark:ring-warning/25');
 });
+
+test('custom theme highlighted buttons use the computed contrasting foreground', function () {
+    $utilities = file_get_contents(resource_path('css/utilities.css'));
+    $appStyles = file_get_contents(resource_path('css/app.css'));
+
+    expect($utilities)
+        ->toContain('text-accent-foreground!')
+        ->toContain('hover:text-accent-foreground!')
+        ->not->toContain('text-white! hover:')
+        ->and($appStyles)
+        ->toContain('html[data-theme="custom"] .button-highlighted .animate-spin')
+        ->toContain('html[data-theme="custom"] button[isHighlighted] .animate-spin');
+});
diff --git a/tests/Feature/SentinelUnsavedBarFlashTest.php b/tests/Feature/SentinelUnsavedBarFlashTest.php
index ac8f72ddf0..0c5d196c03 100644
--- a/tests/Feature/SentinelUnsavedBarFlashTest.php
+++ b/tests/Feature/SentinelUnsavedBarFlashTest.php
@@ -76,9 +76,9 @@ test('unsaved bar keyboard shortcut remains visible in light mode', function ()
     $contents = file_get_contents(resource_path('views/components/unsaved-bar.blade.php'));
 
     expect($contents)
-        ->toContain('border-coollabs/20 bg-coollabs/10')
-        ->toContain('text-coollabs-200')
-        ->toContain('dark:border-white/20 dark:bg-white/10 dark:text-white/75');
+        ->toContain('border-current/20 bg-current/10')
+        ->toContain('text-current')
+        ->not->toContain('text-coollabs-200');
 });
 
 test('unsaved bar uses a light surface in light mode', function () {

From 264cb8e2b01dc8087f0bc1e21dbe9a0f97fbba36 Mon Sep 17 00:00:00 2001
From: Andrew Matia <73502748+drewmt@users.noreply.github.com>
Date: Tue, 18 Aug 2026 13:24:06 +0300
Subject: [PATCH 31/42] fix(webhook): restore GitLab source deployments
 (#11284)

---
 app/Http/Controllers/Webhook/Gitlab.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/Http/Controllers/Webhook/Gitlab.php b/app/Http/Controllers/Webhook/Gitlab.php
index e521093d7e..c9a554e2a5 100644
--- a/app/Http/Controllers/Webhook/Gitlab.php
+++ b/app/Http/Controllers/Webhook/Gitlab.php
@@ -15,6 +15,7 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
+use Visus\Cuid2\Cuid2;
 
 class Gitlab extends Controller
 {

From d2d6c8ac967a9c7e8b68cf470a445333b52a49cf Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:51:54 +0200
Subject: [PATCH 32/42] fix(deployments): defer container cleanup and configure
 dashboard HTTPS

---
 app/Jobs/ApplicationDeploymentJob.php         | 40 +++++++-
 app/Jobs/RemoveContainerJob.php               | 49 ++++++++++
 app/Livewire/Settings/Index.php               |  5 +
 app/Models/InstanceSettings.php               |  6 ++
 app/Models/Server.php                         | 25 ++++-
 bootstrap/helpers/docker.php                  |  9 ++
 ...tps_enabled_to_instance_settings_table.php | 28 ++++++
 .../views/livewire/settings/index.blade.php   | 17 +++-
 tests/Feature/DashboardHttpsRedirectTest.php  | 94 +++++++++++++++++++
 tests/Unit/DockerRemoveWithTimeoutTest.php    | 78 +++++++++++++++
 10 files changed, 341 insertions(+), 10 deletions(-)
 create mode 100644 app/Jobs/RemoveContainerJob.php
 create mode 100644 database/migrations/2026_08_18_104130_add_is_dashboard_force_https_enabled_to_instance_settings_table.php
 create mode 100644 tests/Feature/DashboardHttpsRedirectTest.php
 create mode 100644 tests/Unit/DockerRemoveWithTimeoutTest.php

diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 3047bcc01a..1e8450c1b9 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -52,6 +52,8 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private const RAILPACK_GENERATED_CONFIG_PATH = '.coolify/railpack.generated.json';
 
+    private const CONTAINER_REMOVE_TIMEOUT_MARKER = '__COOLIFY_CONTAINER_REMOVE_TIMEOUT__';
+
     private const DOCKER_CLIENT_ENV_KEYS = [
         'BUILDKIT_HOST',
         'BUILDX_BUILDER',
@@ -3977,15 +3979,45 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                 );
             } else {
                 $this->execute_remote_command(
-                    [dockerStopCommand($timeout, $containerName, $this->server), 'hidden' => true, 'ignore_errors' => true],
-                    ["docker rm -f $containerName", 'hidden' => true, 'ignore_errors' => true]
+                    [dockerStopCommand($timeout, $containerName, $this->server), 'hidden' => true, 'ignore_errors' => true]
                 );
+                $this->removeContainerWithTimeout($containerName);
             }
         } catch (Exception $error) {
             $this->application_deployment_queue->addLogEntry("Error stopping container $containerName: ".$error->getMessage(), 'stderr');
         }
     }
 
+    private function removeContainerWithTimeout(string $containerName): void
+    {
+        $outputKey = 'container_remove_'.md5($containerName);
+
+        $this->execute_remote_command([
+            dockerRemoveCommandWithTimeout($containerName),
+            'hidden' => true,
+            'ignore_errors' => true,
+            'save' => $outputKey,
+            'append' => false,
+        ]);
+
+        if (! isset($this->saved_outputs)) {
+            return;
+        }
+
+        $output = (string) $this->saved_outputs->get($outputKey, '');
+        if (! str_contains($output, self::CONTAINER_REMOVE_TIMEOUT_MARKER)) {
+            return;
+        }
+
+        $this->application_deployment_queue->addLogEntry(
+            "Warning: Removing container {$containerName} timed out after 60 seconds. The deployment will continue and cleanup will be retried in 5 minutes.",
+            'stderr'
+        );
+
+        RemoveContainerJob::dispatch($this->server->id, $containerName)
+            ->delay(now()->addMinutes(5));
+    }
+
     private function stop_running_container(bool $force = false)
     {
         try {
@@ -5016,9 +5048,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                     // do not remove already running container for PR deployments
                 } else {
                     $this->application_deployment_queue->addLogEntry('Deployment failed. Removing the new version of your application.', 'stderr');
-                    $this->execute_remote_command(
-                        ["docker rm -f $this->container_name >/dev/null 2>&1", 'hidden' => true, 'ignore_errors' => true]
-                    );
+                    $this->removeContainerWithTimeout($this->container_name);
                 }
             }
         }
diff --git a/app/Jobs/RemoveContainerJob.php b/app/Jobs/RemoveContainerJob.php
new file mode 100644
index 0000000000..de21603248
--- /dev/null
+++ b/app/Jobs/RemoveContainerJob.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Server;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+class RemoveContainerJob implements ShouldBeEncrypted, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 3;
+
+    public int $timeout = 90;
+
+    public function __construct(public int $serverId, public string $containerName) {}
+
+    public function handle(): void
+    {
+        $server = Server::findOrFail($this->serverId);
+
+        instant_remote_process(
+            [dockerRemoveCommandWithTimeout($this->containerName)],
+            $server,
+            timeout: 75,
+            disableMultiplexing: true,
+        );
+    }
+
+    public function backoff(): array
+    {
+        return [300, 900];
+    }
+
+    public function failed(?\Throwable $exception): void
+    {
+        Log::warning('Deferred container removal failed', [
+            'server_id' => $this->serverId,
+            'container' => $this->containerName,
+            'error' => $exception?->getMessage(),
+        ]);
+    }
+}
diff --git a/app/Livewire/Settings/Index.php b/app/Livewire/Settings/Index.php
index 91bc03d214..40705617f1 100644
--- a/app/Livewire/Settings/Index.php
+++ b/app/Livewire/Settings/Index.php
@@ -20,6 +20,9 @@ class Index extends Component
     #[Validate('nullable|string|max:255|url')]
     public ?string $fqdn = null;
 
+    #[Validate('boolean')]
+    public bool $is_dashboard_force_https_enabled = true;
+
     #[Validate('required|integer|min:1025|max:65535')]
     public int $public_port_min;
 
@@ -68,6 +71,7 @@ class Index extends Component
             $this->server = Server::findOrFail(0);
         }
         $this->fqdn = $this->settings->fqdn;
+        $this->is_dashboard_force_https_enabled = $this->settings->is_dashboard_force_https_enabled;
         $this->public_port_min = $this->settings->public_port_min;
         $this->public_port_max = $this->settings->public_port_max;
         $this->instance_name = $this->settings->instance_name;
@@ -91,6 +95,7 @@ class Index extends Component
         $this->authorize('update', $this->settings);
         $this->validate();
         $this->settings->fqdn = $this->fqdn ? trim($this->fqdn) : $this->fqdn;
+        $this->settings->is_dashboard_force_https_enabled = $this->is_dashboard_force_https_enabled;
         $this->settings->public_port_min = $this->public_port_min;
         $this->settings->public_port_max = $this->public_port_max;
         $this->settings->instance_name = $this->instance_name;
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index 877fc5b12f..adf5a4abdc 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -9,6 +9,10 @@ use Spatie\Url\Url;
 
 class InstanceSettings extends Model
 {
+    protected $attributes = [
+        'is_dashboard_force_https_enabled' => true,
+    ];
+
     protected $fillable = [
         'public_ipv4',
         'public_ipv6',
@@ -51,6 +55,7 @@ class InstanceSettings extends Model
         'webhook_allow_localhost',
         'avatar_storage_type',
         'avatar_s3_storage_id',
+        'is_dashboard_force_https_enabled',
     ];
 
     protected $hidden = [
@@ -89,6 +94,7 @@ class InstanceSettings extends Model
         'is_mcp_server_enabled' => 'boolean',
         'webhook_allowed_internal_hosts' => 'array',
         'webhook_allow_localhost' => 'boolean',
+        'is_dashboard_force_https_enabled' => 'boolean',
     ];
 
     protected static function booted(): void
diff --git a/app/Models/Server.php b/app/Models/Server.php
index 0f5a35364c..b5b11d26a5 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -731,9 +731,7 @@ class Server extends BaseModel
                 ];
 
                 if ($schema === 'https') {
-                    $traefik_dynamic_conf['http']['routers']['coolify-http']['middlewares'] = [
-                        0 => 'redirect-to-https',
-                    ];
+                    $traefik_dynamic_conf['http']['routers']['coolify-http']['middlewares'] = $this->dashboardHttpMiddlewares($settings);
 
                     $traefik_dynamic_conf['http']['routers']['coolify-https'] = [
                         'middlewares' => [
@@ -792,8 +790,9 @@ class Server extends BaseModel
                 $url = Url::fromString($settings->fqdn);
                 $host = $url->getHost();
                 $schema = $url->getScheme();
+                $siteAddress = $this->dashboardCaddySiteAddress($settings, $schema, $host);
                 $caddy_file = "
-$schema://$host {
+$siteAddress {
     encode zstd gzip
     handle /app/* {
         reverse_proxy coolify-realtime:6001
@@ -819,6 +818,24 @@ $schema://$host {
         ], $this);
     }
 
+    public function dashboardHttpMiddlewares(InstanceSettings $settings): array
+    {
+        if ($settings->is_dashboard_force_https_enabled) {
+            return ['redirect-to-https'];
+        }
+
+        return ['gzip'];
+    }
+
+    public function dashboardCaddySiteAddress(InstanceSettings $settings, string $schema, string $host): string
+    {
+        if ($schema === 'https' && ! $settings->is_dashboard_force_https_enabled) {
+            return "http://{$host}, https://{$host}";
+        }
+
+        return "{$schema}://{$host}";
+    }
+
     public function proxyPath()
     {
         $base_path = config('constants.coolify.base_config_path');
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index ae29637554..a60ba675be 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -263,6 +263,15 @@ function dockerStopCommand(int $timeout, string $containers, Server|string|null
 
     return $command;
 }
+
+function dockerRemoveCommandWithTimeout(string $container, int $timeout = 60, int $killAfter = 10): string
+{
+    $container = escapeShellValue($container);
+    $script = "if command -v timeout >/dev/null 2>&1; then timeout -k {$killAfter}s {$timeout}s docker rm -f {$container}; exit_code=\$?; else exit_code=124; fi; if [ \"\$exit_code\" -eq 124 ]; then echo '__COOLIFY_CONTAINER_REMOVE_TIMEOUT__'; fi; exit \$exit_code";
+
+    return 'bash -c '.escapeShellValue($script);
+}
+
 function escapeShellValue(string $value): string
 {
     return "'".str_replace("'", "'\\''", $value)."'";
diff --git a/database/migrations/2026_08_18_104130_add_is_dashboard_force_https_enabled_to_instance_settings_table.php b/database/migrations/2026_08_18_104130_add_is_dashboard_force_https_enabled_to_instance_settings_table.php
new file mode 100644
index 0000000000..d88f9be3fc
--- /dev/null
+++ b/database/migrations/2026_08_18_104130_add_is_dashboard_force_https_enabled_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->boolean('is_dashboard_force_https_enabled')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('is_dashboard_force_https_enabled');
+        });
+    }
+};
diff --git a/resources/views/livewire/settings/index.blade.php b/resources/views/livewire/settings/index.blade.php
index 7992b4ca9f..518f1a45dc 100644
--- a/resources/views/livewire/settings/index.blade.php
+++ b/resources/views/livewire/settings/index.blade.php
@@ -11,12 +11,27 @@
                 targets="fqdn,instance_name,public_ipv4,public_ipv6,dev_helper_version" />
             <x-application.settings-section title="General">
                 <div class="grid gap-4 lg:grid-cols-2">
-                    <div class="lg:col-span-2">
+                    <div @class([
+                        'lg:col-span-2' => !str_starts_with(strtolower($fqdn ?? ''), 'https://'),
+                    ])>
                         <x-forms.input canGate="update" :canResource="$settings" id="fqdn" label="URL"
                             helper="Enter the full URL of the instance (for example, https://dashboard.example.com).<br><br><span class='text-coollabs dark:text-warning'>Important:</span> Include <b>https://</b> to secure the dashboard with HTTPS."
                             placeholder="https://coolify.yourdomain.com" />
                     </div>
 
+                    @if (str_starts_with(strtolower($fqdn ?? ''), 'https://'))
+                        <div>
+                            <x-forms.listbox canGate="update" :canResource="$settings"
+                                id="is_dashboard_force_https_enabled" label="Redirect HTTP to HTTPS"
+                                onChange="submit"
+                                helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
+                                :options="[
+                                    ['value' => true, 'label' => 'Enabled'],
+                                    ['value' => false, 'label' => 'Disabled'],
+                                ]" />
+                        </div>
+                    @endif
+
                     <x-forms.input canGate="update" :canResource="$settings" id="instance_name" label="Name"
                         placeholder="Coolify" helper="Custom name for this Coolify instance." />
 
diff --git a/tests/Feature/DashboardHttpsRedirectTest.php b/tests/Feature/DashboardHttpsRedirectTest.php
new file mode 100644
index 0000000000..d709b84289
--- /dev/null
+++ b/tests/Feature/DashboardHttpsRedirectTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Livewire\Settings\Index;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+test('dashboard proxy keeps existing HTTPS redirect behavior by default', function () {
+    $settings = new InstanceSettings;
+    $server = new Server;
+
+    expect($settings->is_dashboard_force_https_enabled)->toBeTrue()
+        ->and($server->dashboardHttpMiddlewares($settings))->toBe(['redirect-to-https'])
+        ->and($server->dashboardCaddySiteAddress($settings, 'https', 'dashboard.example.com'))
+        ->toBe('https://dashboard.example.com');
+});
+
+test('dashboard proxy accepts HTTP and HTTPS when its redirect is disabled', function () {
+    $settings = new InstanceSettings(['is_dashboard_force_https_enabled' => false]);
+    $server = new Server;
+
+    expect($server->dashboardHttpMiddlewares($settings))->toBe(['gzip'])
+        ->and($server->dashboardCaddySiteAddress($settings, 'https', 'dashboard.example.com'))
+        ->toBe('http://dashboard.example.com, https://dashboard.example.com')
+        ->and($server->dashboardCaddySiteAddress($settings, 'http', 'dashboard.example.com'))
+        ->toBe('http://dashboard.example.com');
+});
+
+test('instance administrators can configure the dashboard HTTPS redirect', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
+    $settings = InstanceSettings::forceCreate([
+        'id' => 0,
+        'fqdn' => 'https://dashboard.example.com',
+    ]);
+    Once::flush();
+
+    $user = User::factory()->create();
+    $rootTeam->members()->attach($user->id, ['role' => 'admin']);
+
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::test(Index::class)
+        ->assertSet('is_dashboard_force_https_enabled', true)
+        ->assertSee('Redirect HTTP to HTTPS')
+        ->assertSee('Keep enabled when Cloudflare uses Full or Full (Strict) SSL.')
+        ->set('is_dashboard_force_https_enabled', false)
+        ->call('instantSave')
+        ->assertHasNoErrors();
+
+    expect($settings->fresh()->is_dashboard_force_https_enabled)->toBeFalse();
+});
+
+test('dashboard HTTPS redirect saves immediately when changed', function () {
+    $contents = file_get_contents(resource_path('views/livewire/settings/index.blade.php'));
+
+    expect($contents)
+        ->toMatch('/id="is_dashboard_force_https_enabled"[\s\S]*?onChange="submit"/')
+        ->and($contents)->not->toContain('targets="fqdn,is_dashboard_force_https_enabled');
+});
+
+test('dashboard HTTPS redirect is next to the URL on desktop', function () {
+    $contents = file_get_contents(resource_path('views/livewire/settings/index.blade.php'));
+
+    expect($contents)
+        ->toContain("'lg:col-span-2' => !str_starts_with")
+        ->not->toContain('<div class="lg:col-span-2 max-w-md">');
+});
+
+test('dashboard HTTPS redirect control is hidden for an HTTP URL', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
+    InstanceSettings::forceCreate([
+        'id' => 0,
+        'fqdn' => 'http://dashboard.example.com',
+    ]);
+    Once::flush();
+
+    $user = User::factory()->create();
+    $rootTeam->members()->attach($user->id, ['role' => 'admin']);
+
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::test(Index::class)
+        ->assertDontSee('Redirect HTTP to HTTPS');
+});
diff --git a/tests/Unit/DockerRemoveWithTimeoutTest.php b/tests/Unit/DockerRemoveWithTimeoutTest.php
new file mode 100644
index 0000000000..a3b9f15dc5
--- /dev/null
+++ b/tests/Unit/DockerRemoveWithTimeoutTest.php
@@ -0,0 +1,78 @@
+<?php
+
+use App\Jobs\RemoveContainerJob;
+use App\Models\Server;
+use Symfony\Component\Process\Process;
+
+it('bounds forced container removal and reports a timeout marker', function () {
+    expect(dockerRemoveCommandWithTimeout('container name'))
+        ->toStartWith("bash -c '")
+        ->toContain('timeout -k 10s 60s docker rm -f')
+        ->toContain('__COOLIFY_CONTAINER_REMOVE_TIMEOUT__');
+});
+
+it('uses timeout syntax supported by coreutils and busybox', function () {
+    expect(dockerRemoveCommandWithTimeout('container-name'))
+        ->toContain('command -v timeout')
+        ->toContain('timeout -k 10s 60s')
+        ->not->toContain('--kill-after');
+});
+
+it('preserves bounded cleanup when commands are adapted for non-root servers', function () {
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+    $server->shouldReceive('setAttribute')->andReturnSelf();
+    $server->user = 'ubuntu';
+
+    $commands = parseCommandsByLineForSudo(
+        collect([dockerRemoveCommandWithTimeout('container-name')]),
+        $server
+    );
+    $command = $commands[0];
+
+    expect($command)
+        ->toStartWith("sudo bash -c '")
+        ->toContain('timeout -k 10s 60s docker rm -f')
+        ->toContain('__COOLIFY_CONTAINER_REMOVE_TIMEOUT__');
+});
+
+it('escapes container names in bounded removal commands', function () {
+    $containerName = "container'; reboot; '";
+    $directory = sys_get_temp_dir().'/coolify-docker-remove-'.bin2hex(random_bytes(4));
+    $captureFile = $directory.'/arguments';
+    mkdir($directory);
+    file_put_contents($directory.'/docker', "#!/bin/sh\nprintf '%s\\n' \"\$@\" > \"\$CAPTURE_FILE\"\n");
+    chmod($directory.'/docker', 0755);
+
+    $process = new Process(['/bin/sh', '-c', dockerRemoveCommandWithTimeout($containerName)], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+        'CAPTURE_FILE' => $captureFile,
+    ]);
+    $process->run();
+
+    expect($process->isSuccessful())->toBeTrue()
+        ->and(file_get_contents($captureFile))->toBe("rm\n-f\n{$containerName}\n");
+
+    unlink($captureFile);
+    unlink($directory.'/docker');
+    rmdir($directory);
+});
+
+it('configures deferred removal attempts to outlive the shell timeout', function () {
+    $job = new RemoveContainerJob(123, 'container-name');
+
+    expect($job->serverId)->toBe(123)
+        ->and($job->containerName)->toBe('container-name')
+        ->and($job->timeout)->toBeGreaterThan(60)
+        ->and($job->tries)->toBeGreaterThan(1);
+});
+
+it('continues deployments and schedules deferred cleanup after a removal timeout', function () {
+    $source = file_get_contents(dirname(__DIR__, 2).'/app/Jobs/ApplicationDeploymentJob.php');
+
+    expect($source)
+        ->toContain('dockerRemoveCommandWithTimeout($containerName)')
+        ->toContain('timed out after 60 seconds. The deployment will continue')
+        ->toContain('RemoveContainerJob::dispatch($this->server->id, $containerName)')
+        ->toContain('->delay(now()->addMinutes(5))');
+});

From 3cca2a0bfe184344b17fc650f2f1fa54ab7e5e8e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:53:41 +0200
Subject: [PATCH 33/42] fix(ui): add spacing between database backup sections

Add a flex column gap to the backup edit layout and cover the spacing with a feature test.
---
 .../views/livewire/project/database/backup-edit.blade.php  | 2 +-
 tests/Feature/DatabaseBackupsLayoutTest.php                | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/resources/views/livewire/project/database/backup-edit.blade.php b/resources/views/livewire/project/database/backup-edit.blade.php
index 31637d7f9d..d85d506a0b 100644
--- a/resources/views/livewire/project/database/backup-edit.blade.php
+++ b/resources/views/livewire/project/database/backup-edit.blade.php
@@ -1,4 +1,4 @@
-<div>
+<div class="flex flex-col gap-6">
     @if ($backup->database_id === 0)
         @include('livewire.project.database.backup-edit.general')
         @include('livewire.project.database.backup-edit.s3')
diff --git a/tests/Feature/DatabaseBackupsLayoutTest.php b/tests/Feature/DatabaseBackupsLayoutTest.php
index b2ab349d97..2b4941c091 100644
--- a/tests/Feature/DatabaseBackupsLayoutTest.php
+++ b/tests/Feature/DatabaseBackupsLayoutTest.php
@@ -50,3 +50,10 @@ it('keeps backup execution actions in the normal table flow', function () {
     expect($executions)
         ->not->toContain('sticky right-0');
 });
+
+it('spaces instance backup settings sections', function () {
+    $edit = file_get_contents(resource_path('views/livewire/project/database/backup-edit.blade.php'));
+
+    expect($edit)
+        ->toStartWith('<div class="flex flex-col gap-6">');
+});

From 861a9049920cf227ef3dd8bbf3e308850225833c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 13:53:40 +0200
Subject: [PATCH 34/42] fix(server): surface pending proxy and outdated Traefik
 states

---
 app/Jobs/CheckTraefikVersionForServerJob.php  |  8 +-
 app/Livewire/ActivityMonitor.php              | 15 +++-
 app/Livewire/Server/Navbar.php                | 19 +++-
 app/Livewire/Server/Proxy.php                 |  6 +-
 app/Models/Server.php                         | 27 ++++++
 resources/css/utilities.css                   |  3 +-
 .../proxy-configuration-warning.blade.php     | 37 ++++++++
 .../views/components/server/sidebar.blade.php | 20 ++++-
 .../views/livewire/server/index.blade.php     | 39 +++++---
 .../views/livewire/server/navbar.blade.php    | 16 +++-
 .../views/livewire/server/proxy.blade.php     | 15 +++-
 .../Feature/ActivityMonitorCrossTeamTest.php  | 20 +++++
 tests/Feature/ButtonHeightConsistencyTest.php |  4 +-
 .../DashboardServerMetricsChartTest.php       | 19 ++++
 tests/Feature/Proxy/RestartProxyTest.php      | 59 ++++++++++++
 .../ProxyConfigurationLoadingStateTest.php    | 12 +++
 tests/Feature/ServerSidebarIconsTest.php      | 14 +++
 tests/Feature/TraefikVersionStateTest.php     | 89 +++++++++++++++++++
 18 files changed, 398 insertions(+), 24 deletions(-)
 create mode 100644 resources/views/components/proxy-configuration-warning.blade.php
 create mode 100644 tests/Feature/ProxyConfigurationLoadingStateTest.php
 create mode 100644 tests/Feature/TraefikVersionStateTest.php

diff --git a/app/Jobs/CheckTraefikVersionForServerJob.php b/app/Jobs/CheckTraefikVersionForServerJob.php
index 91869eb12d..054a739bc6 100644
--- a/app/Jobs/CheckTraefikVersionForServerJob.php
+++ b/app/Jobs/CheckTraefikVersionForServerJob.php
@@ -33,10 +33,11 @@ class CheckTraefikVersionForServerJob implements ShouldBeEncrypted, ShouldQueue
      */
     public function handle(): void
     {
+        $this->clearOutdatedInfo();
+
         // Detect current version (makes SSH call)
         $currentVersion = getTraefikVersionFromDockerCompose($this->server);
 
-        // Update detected version in database
         $this->server->update(['detected_traefik_version' => $currentVersion]);
 
         if (! $currentVersion) {
@@ -113,6 +114,11 @@ class CheckTraefikVersionForServerJob implements ShouldBeEncrypted, ShouldQueue
         ProxyStatusChangedUI::dispatch($this->server->team_id);
     }
 
+    private function clearOutdatedInfo(): void
+    {
+        $this->server->update(['traefik_outdated_info' => null]);
+    }
+
     /**
      * Get information about newer branches if available.
      */
diff --git a/app/Livewire/ActivityMonitor.php b/app/Livewire/ActivityMonitor.php
index 665d14ba0e..25935d88e2 100644
--- a/app/Livewire/ActivityMonitor.php
+++ b/app/Livewire/ActivityMonitor.php
@@ -29,7 +29,10 @@ class ActivityMonitor extends Component
 
     public static $eventDispatched = false;
 
-    protected $listeners = ['activityMonitor' => 'newMonitorActivity'];
+    protected $listeners = [
+        'activityMonitor' => 'newMonitorActivity',
+        'processDialogClosed' => 'clearActivity',
+    ];
 
     public function newMonitorActivity($activityId, $eventToDispatch = 'activityFinished', $eventData = null, $header = null)
     {
@@ -50,6 +53,16 @@ class ActivityMonitor extends Component
         $this->isPollingActive = true;
     }
 
+    public function clearActivity(): void
+    {
+        $this->activityId = null;
+        $this->activity = null;
+        $this->isPollingActive = false;
+        $this->eventToDispatch = 'activityFinished';
+        $this->eventData = null;
+        self::$eventDispatched = false;
+    }
+
     public function hydrateActivity()
     {
         if ($this->activityId === null) {
diff --git a/app/Livewire/Server/Navbar.php b/app/Livewire/Server/Navbar.php
index 31a8578657..d9f70ea253 100644
--- a/app/Livewire/Server/Navbar.php
+++ b/app/Livewire/Server/Navbar.php
@@ -163,6 +163,7 @@ class Navbar extends Component
         $previousStatus = $this->proxyStatus;
         $this->server->refresh();
         $this->proxyStatus = $this->server->proxy->status ?? 'unknown';
+        $this->dispatchProxyConfigurationState();
 
         // If event contains activityId, open activity monitor
         if ($event && isset($event['activityId'])) {
@@ -227,6 +228,16 @@ class Navbar extends Component
     {
         $this->server->refresh();
         $this->server->load('settings');
+        $this->dispatchProxyConfigurationState();
+    }
+
+    private function dispatchProxyConfigurationState(): void
+    {
+        $this->dispatch(
+            'proxy-configuration-state-changed',
+            pending: $this->server->hasPendingProxyConfiguration(),
+            traefikOutdated: $this->server->hasCurrentTraefikOutdatedInfo(),
+        );
     }
 
     public function refreshSentinelStatus($event = null): void
@@ -248,10 +259,12 @@ class Navbar extends Component
             return false;
         }
 
-        // Check if server has outdated info stored
-        $outdatedInfo = $this->server->traefik_outdated_info;
+        return $this->server->hasCurrentTraefikOutdatedInfo();
+    }
 
-        return ! empty($outdatedInfo) && isset($outdatedInfo['type']);
+    public function getHasPendingProxyConfigurationProperty(): bool
+    {
+        return $this->server->hasPendingProxyConfiguration();
     }
 
     public function render()
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 8cd4e96405..811a01eb19 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -161,6 +161,7 @@ class Proxy extends Component
             $this->server->proxy->redirect_url = $this->redirectUrl;
             $this->server->save();
             $this->server->setupDefaultRedirect();
+            $this->dispatch('refreshServerShow');
             $this->dispatch('success', 'Proxy configuration saved.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -175,6 +176,7 @@ class Proxy extends Component
             $this->proxySettings = GetProxyConfiguration::run($this->server, forceRegenerate: true);
             SaveProxyConfiguration::run($this->server, $this->proxySettings);
             $this->server->save();
+            $this->dispatch('refreshServerShow');
             $this->dispatch('success', 'Proxy configuration reset to default.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -276,7 +278,9 @@ class Proxy extends Component
 
             // Check if we have outdated info stored for this server (faster than computing)
             $outdatedInfo = $this->server->traefik_outdated_info;
-            if ($outdatedInfo && isset($outdatedInfo['type']) && $outdatedInfo['type'] === 'minor_upgrade') {
+            $storedCurrentVersion = ltrim((string) data_get($outdatedInfo, 'current'), 'v');
+            $detectedCurrentVersion = ltrim($currentVersion, 'v');
+            if ($storedCurrentVersion === $detectedCurrentVersion && data_get($outdatedInfo, 'type') === 'minor_upgrade') {
                 // Use the upgrade_target field if available (e.g., "v3.6")
                 if (isset($outdatedInfo['upgrade_target'])) {
                     return str_starts_with($outdatedInfo['upgrade_target'], 'v')
diff --git a/app/Models/Server.php b/app/Models/Server.php
index b5b11d26a5..f7a4bf20c0 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -858,6 +858,33 @@ $siteAddress {
         return data_get($this->proxy, 'type');
     }
 
+    public function hasPendingProxyConfiguration(): bool
+    {
+        if ($this->proxy->get('status') !== 'running') {
+            return false;
+        }
+
+        $savedSettings = $this->proxy->get('last_saved_settings');
+        $appliedSettings = $this->proxy->get('last_applied_settings');
+
+        return filled($savedSettings) && filled($appliedSettings) && $savedSettings !== $appliedSettings;
+    }
+
+    public function hasCurrentTraefikOutdatedInfo(): bool
+    {
+        if ($this->proxyType() !== ProxyTypes::TRAEFIK->value) {
+            return false;
+        }
+
+        $detectedVersion = ltrim((string) $this->detected_traefik_version, 'v');
+        $storedVersion = ltrim((string) data_get($this->traefik_outdated_info, 'current'), 'v');
+        $type = data_get($this->traefik_outdated_info, 'type');
+
+        return filled($detectedVersion)
+            && $storedVersion === $detectedVersion
+            && in_array($type, ['patch_update', 'minor_upgrade'], true);
+    }
+
     public function scopeWithProxy(): Builder
     {
         return $this->proxy->modelScope();
diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 7c690cba75..6fdd260b5f 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -126,8 +126,7 @@
 }
 
 @utility button {
-    /* h-9 matches input-select; nowrap + shrink-0 keep side-by-side action rows equal height */
-    @apply inline-flex shrink-0 gap-1.5 justify-center items-center whitespace-nowrap px-2.5 h-9 min-h-9 text-[13px] text-black normal-case rounded-md border outline-0 cursor-pointer font-medium transition-colors bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-white/[0.06] dark:text-fg dark:hover:text-fg dark:hover:bg-white/[0.1] dark:border-white/[0.08] hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-fg-faint disabled:border-neutral-200 dark:disabled:border-white/[0.06] disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent;
+    @apply inline-flex shrink-0 gap-1.5 justify-center items-center whitespace-nowrap px-2.5 h-8 min-h-8 text-[13px] text-black normal-case rounded-md border outline-0 cursor-pointer font-medium transition-colors bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-white/[0.06] dark:text-fg dark:hover:text-fg dark:hover:bg-white/[0.1] dark:border-white/[0.08] hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-fg-faint disabled:border-neutral-200 dark:disabled:border-white/[0.06] disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent;
 }
 
 @utility button-highlighted {
diff --git a/resources/views/components/proxy-configuration-warning.blade.php b/resources/views/components/proxy-configuration-warning.blade.php
new file mode 100644
index 0000000000..7337779d0e
--- /dev/null
+++ b/resources/views/components/proxy-configuration-warning.blade.php
@@ -0,0 +1,37 @@
+@props(['canRestart' => false])
+
+<div class="relative" x-data="{ open: false }" @click.outside="open = false" @keydown.escape.window="open = false">
+    <button type="button" aria-label="Proxy configuration changes not applied" aria-haspopup="dialog"
+        :aria-expanded="open" @click="open = !open"
+        class="flex h-8 items-center justify-center gap-1.5 rounded-lg px-2 text-amber-700 transition-colors hover:bg-amber-100 dark:text-warning dark:hover:bg-warning/10">
+        <x-reicon name="alert-triangle" class="size-4" />
+        <span class="hidden text-xs font-medium lg:inline">Changes pending</span>
+    </button>
+
+    <div x-show="open" x-cloak x-transition.opacity role="dialog"
+        class="fixed top-14 left-1/2 z-[1100] w-[calc(100vw-2rem)] max-w-sm -translate-x-1/2 rounded-lg p-3 lg:absolute lg:top-full lg:right-0 lg:left-auto lg:mt-2 lg:translate-x-0"
+        style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
+        <div class="flex items-start gap-2.5">
+            <span
+                class="flex size-7 shrink-0 items-center justify-center rounded-md bg-amber-100 text-amber-700 dark:bg-warning/10 dark:text-warning">
+                <x-reicon name="alert-triangle" class="size-4" />
+            </span>
+            <div class="min-w-0 flex-1">
+                <p class="text-[13px] leading-4 font-semibold text-neutral-950 dark:text-fg">
+                    The saved proxy configuration has not been applied
+                </p>
+                <p class="mt-0.5 text-[11px] leading-4 text-neutral-600 dark:text-fg-dim">
+                    Restart the proxy to apply these changes.
+                    @if ($canRestart)
+                        <button type="button"
+                            class="ml-0.5 inline-flex items-center gap-0.5 font-semibold text-coollabs transition-colors hover:text-coollabs-100 dark:text-warning dark:hover:text-warning/80"
+                            @click="open = false; document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                            Restart proxy
+                            <x-reicon name="arrow-right" class="size-2.5" />
+                        </button>
+                    @endif
+                </p>
+            </div>
+        </div>
+    </div>
+</div>
diff --git a/resources/views/components/server/sidebar.blade.php b/resources/views/components/server/sidebar.blade.php
index 006efb2cac..41cbd7ce9d 100644
--- a/resources/views/components/server/sidebar.blade.php
+++ b/resources/views/components/server/sidebar.blade.php
@@ -55,6 +55,8 @@
             'icon' => 'network',
             'group' => 'Platform',
             'visible' => ! $server->isSwarmWorker() && ! $server->settings->is_build_server,
+            'warning' => $server->hasCurrentTraefikOutdatedInfo(),
+            'tracks_proxy_configuration' => true,
             'children' => [
                 ['label' => 'Configuration', 'route' => 'server.proxy', 'active' => $activeSubMenu === 'configuration', 'icon' => 'settings'],
                 ['label' => 'Dynamic Configurations', 'route' => 'server.proxy.dynamic-confs', 'active' => $activeSubMenu === 'dynamic-confs', 'icon' => 'sliders', 'visible' => $server->proxySet()],
@@ -167,7 +169,15 @@
     $groupedServerMenuItems = $serverMenuItems->groupBy('group');
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start">
+<aside class="application-settings-navigation min-w-0 xl:self-start"
+    x-data="{
+        proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),
+        traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo())
+    }"
+    @proxy-configuration-state-changed.window="
+        proxyConfigurationPending = $event.detail.pending;
+        traefikOutdated = $event.detail.traefikOutdated;
+    ">
     <nav aria-label="Server configuration sections"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
         @foreach ($groupedServerMenuItems as $groupLabel => $groupItems)
@@ -186,6 +196,14 @@
                     href="{{ route($menuItem['route'], $serverRouteParameters) }}">
                     <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
                     <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                    @if ($menuItem['tracks_proxy_configuration'] ?? false)
+                        <x-reicon name="alert-triangle" x-cloak
+                            x-show="proxyConfigurationPending || traefikOutdated"
+                            class="ml-auto size-3.5 shrink-0 text-orange-500 dark:text-warning" />
+                    @elseif ($menuItem['warning'] ?? false)
+                        <x-reicon name="alert-triangle"
+                            class="ml-auto size-3.5 shrink-0 text-orange-500 dark:text-warning" />
+                    @endif
                 </a>
                 @if ($menuItem['active'] && isset($menuItem['children']))
                     <div class="col-span-full grid grid-cols-2 gap-0.5 border-l border-neutral-200 pl-2 sm:grid-cols-3 xl:grid-cols-1 dark:border-white/[0.08]">
diff --git a/resources/views/livewire/server/index.blade.php b/resources/views/livewire/server/index.blade.php
index 2bb9e10c74..2aa93aa7f9 100644
--- a/resources/views/livewire/server/index.blade.php
+++ b/resources/views/livewire/server/index.blade.php
@@ -126,24 +126,41 @@
 
             <div x-cloak x-show="viewMode === 'grid'"
                 class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
-                <template x-for="server in filteredServers" :key="server.uuid">
-                    <a :href="server.href" {{ wireNavigate() }}
+                @foreach ($servers as $server)
+                    @php
+                        $serverRow = $serverRows->firstWhere('uuid', $server->uuid);
+                    @endphp
+                    <a x-cloak
+                        x-show="filteredServers.some(server => server.uuid === @js($server->uuid))"
+                        href="{{ $serverRow['href'] }}" {{ wireNavigate() }}
                         class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
-                        <div class="flex items-start gap-3">
-                            <div :title="server.status" :aria-label="`Server status: ${server.status}`"
-                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.04] dark:text-fg-dim"
-                                :class="server.statusType === 'success' ? 'border-emerald-500/70' : server.statusType === 'warning' ? 'border-amber-500/70' : 'border-red-500/70'">
+                        @if ($server->isMetricsEnabled())
+                            <livewire:dashboard.server-metrics-chart :server="$server"
+                                :key="'server-index-metrics-'.$server->uuid" />
+                        @endif
+
+                        <div class="pointer-events-none relative z-10 flex items-start gap-3">
+                            <div title="{{ $serverRow['status'] }}"
+                                aria-label="Server status: {{ $serverRow['status'] }}"
+                                @class([
+                                    'flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.04] dark:text-fg-dim',
+                                    'border-emerald-500/70' => $serverRow['statusType'] === 'success',
+                                    'border-amber-500/70' => $serverRow['statusType'] === 'warning',
+                                    'border-red-500/70' => $serverRow['statusType'] === 'error',
+                                ])>
                                 <x-reicon name="servers" class="size-4" />
                             </div>
                             <div class="min-w-0 flex-1">
-                                <h2 class="truncate text-[13px]! leading-4! font-semibold! text-black dark:text-fg"
-                                    x-text="server.name"></h2>
-                                <p class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint"
-                                    x-text="server.description"></p>
+                                <h2 class="truncate text-[13px]! leading-4! font-semibold! text-black dark:text-fg">
+                                    {{ $serverRow['name'] }}
+                                </h2>
+                                <p class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+                                    {{ $serverRow['description'] }}
+                                </p>
                             </div>
                         </div>
                     </a>
-                </template>
+                @endforeach
             </div>
 
             <div x-show="viewMode === 'table'"
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index 7879f5727f..e75f77b5b4 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -43,7 +43,7 @@
                 'route' => 'server.proxy',
                 'active' => request()->routeIs('server.proxy', 'server.proxy.*'),
                 'visible' => ! $server->isSwarmWorker() && ! $server->settings->is_build_server,
-                'warning' => $this->hasTraefikOutdated,
+                'warning' => $this->hasTraefikOutdated || $this->hasPendingProxyConfiguration,
             ],
             [
                 'label' => 'Sentinel',
@@ -89,6 +89,20 @@
         $proxyCanBeStopped = in_array($proxyStatus, ['running', 'starting', 'restarting'], true);
     @endphp
 
+    @if ($this->hasPendingProxyConfiguration)
+        @teleport('#configuration-warning-hud-slot')
+            <div>
+                <x-proxy-configuration-warning :can-restart="auth()->user()?->can('manageProxy', $server) ?? false" />
+            </div>
+        @endteleport
+
+        @teleport('#configuration-warning-hud-slot-mobile')
+            <div>
+                <x-proxy-configuration-warning :can-restart="auth()->user()?->can('manageProxy', $server) ?? false" />
+            </div>
+        @endteleport
+    @endif
+
     @teleport('#server-topbar-context')
         <div data-testid="server-topbar-context"
             class="flex min-w-0 items-center gap-1 text-[13px]">
diff --git a/resources/views/livewire/server/proxy.blade.php b/resources/views/livewire/server/proxy.blade.php
index 0e15bd1e29..aeb661bcdf 100644
--- a/resources/views/livewire/server/proxy.blade.php
+++ b/resources/views/livewire/server/proxy.blade.php
@@ -6,6 +6,9 @@
             <form wire:submit="submit" class="contents">
                 <x-unsaved-bar action="submit" />
 
+                <fieldset class="contents" wire:loading.attr="disabled"
+                    wire:target="submit,resetProxyConfiguration">
+
                 <x-application.settings-section id="server-proxy-overview-section" title="Proxy configuration"
                     helper="Configure the reverse proxy and request handling for this server.">
                     <x-slot:actions>
@@ -126,7 +129,16 @@
                         @endif
 
                         @if ($proxySettings)
-                            <div class="mt-4">
+                            <div class="relative mt-4" wire:loading.class="pointer-events-none opacity-50"
+                                wire:target="submit,resetProxyConfiguration" aria-live="polite">
+                                <div wire:loading.flex wire:target="submit,resetProxyConfiguration"
+                                    class="absolute inset-0 z-20 hidden items-center justify-center rounded-lg bg-white/75 backdrop-blur-[1px] dark:bg-black/55">
+                                    <div
+                                        class="flex items-center gap-2 rounded-lg bg-white px-3 py-2 text-xs font-medium text-neutral-700 shadow-sm ring-1 ring-neutral-200 dark:bg-coolgray-100 dark:text-fg dark:ring-white/10">
+                                        <x-loading />
+                                        Updating proxy configuration…
+                                    </div>
+                                </div>
                                 <x-forms.textarea canGate="update" :canResource="$server" useMonacoEditor
                                     monacoEditorLanguage="yaml"
                                     label="Configuration file · {{ $this->configurationFilePath }}"
@@ -135,6 +147,7 @@
                         @endif
                     </x-application.settings-section>
                 @endif
+                </fieldset>
             </form>
         @elseif($selectedProxy === 'NONE')
             <x-application.settings-section title="Custom proxy"
diff --git a/tests/Feature/ActivityMonitorCrossTeamTest.php b/tests/Feature/ActivityMonitorCrossTeamTest.php
index 9966ac2ddc..dc15140c6c 100644
--- a/tests/Feature/ActivityMonitorCrossTeamTest.php
+++ b/tests/Feature/ActivityMonitorCrossTeamTest.php
@@ -130,3 +130,23 @@ test('activityId property is locked and cannot be set from client', function ()
         ->set('activityId', $otherActivity->id)
         ->assertStatus(500);
 })->throws(CannotUpdateLockedPropertyException::class);
+
+test('closing a process dialog clears the previous activity logs', function () {
+    $activity = Activity::create([
+        'log_name' => 'default',
+        'description' => 'proxy restart activity',
+        'properties' => ['team_id' => $this->team->id],
+    ]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => ['id' => $this->team->id]]);
+
+    Livewire::test(ActivityMonitor::class)
+        ->call('newMonitorActivity', $activity->id)
+        ->assertSet('activityId', $activity->id)
+        ->assertSet('isPollingActive', true)
+        ->dispatch('processDialogClosed')
+        ->assertSet('activityId', null)
+        ->assertSet('activity', null)
+        ->assertSet('isPollingActive', false);
+});
diff --git a/tests/Feature/ButtonHeightConsistencyTest.php b/tests/Feature/ButtonHeightConsistencyTest.php
index 06b45d7825..ac72cb2ba4 100644
--- a/tests/Feature/ButtonHeightConsistencyTest.php
+++ b/tests/Feature/ButtonHeightConsistencyTest.php
@@ -1,10 +1,10 @@
 <?php
 
-it('uses the standard button height inside application forms and workspaces', function () {
+it('uses the compact height for all standard buttons', function () {
     $utilities = file_get_contents(resource_path('css/utilities.css'));
     $applicationStyles = file_get_contents(resource_path('css/app.css'));
 
-    expect($utilities)->toContain('px-2.5 h-9 min-h-9')
+    expect($utilities)->toContain('px-2.5 h-8 min-h-8')
         ->and($applicationStyles)
         ->not->toContain('.application-settings-workspace .button')
         ->not->toContain('.application-settings-form .button');
diff --git a/tests/Feature/DashboardServerMetricsChartTest.php b/tests/Feature/DashboardServerMetricsChartTest.php
index 196526fcf7..4d7c64d0fd 100644
--- a/tests/Feature/DashboardServerMetricsChartTest.php
+++ b/tests/Feature/DashboardServerMetricsChartTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Livewire\Dashboard;
+use App\Livewire\Server\Index as ServerIndex;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Server;
@@ -45,6 +46,24 @@ it('renders a metrics chart only for servers with metrics enabled', function ()
         ->assertDontSeeHtml("dashboard-server-metrics-{$disabledServer->uuid}");
 });
 
+it('renders dashboard metrics charts on the server index grid', function () {
+    $enabledServer = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $enabledServer->settings->update(['is_metrics_enabled' => true]);
+
+    $disabledServer = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $disabledServer->settings->update(['is_metrics_enabled' => false]);
+
+    Livewire::test(ServerIndex::class)
+        ->assertSeeHtml("dashboard-server-metrics-{$enabledServer->uuid}")
+        ->assertDontSeeHtml("dashboard-server-metrics-{$disabledServer->uuid}");
+});
+
 it('configures the dashboard chart as a ten minute cpu and memory sparkline with hover details', function () {
     $chart = file_get_contents(resource_path('views/livewire/dashboard/server-metrics-chart.blade.php'));
     $component = file_get_contents(app_path('Livewire/Dashboard/ServerMetricsChart.php'));
diff --git a/tests/Feature/Proxy/RestartProxyTest.php b/tests/Feature/Proxy/RestartProxyTest.php
index 60c0571350..16cddd36ea 100644
--- a/tests/Feature/Proxy/RestartProxyTest.php
+++ b/tests/Feature/Proxy/RestartProxyTest.php
@@ -72,6 +72,65 @@ test('admin can see proxy restart and stop buttons', function () {
         ->assertSee('Stop Proxy');
 });
 
+test('running proxy shows pending configuration warning when saved settings differ from applied settings', function () {
+    [$user, $team, $server] = setupProxyUser('admin');
+    makeServerProxyRunning($server);
+    $server->proxy->last_saved_settings = 'saved-hash';
+    $server->proxy->last_applied_settings = 'applied-hash';
+    $server->detected_traefik_version = '3.6.23';
+    $server->traefik_outdated_info = [
+        'current' => '3.6.23',
+        'latest' => '3.7.8',
+        'type' => 'minor_upgrade',
+        'upgrade_target' => 'v3.7',
+    ];
+    $server->save();
+
+    expect($server->fresh()->hasPendingProxyConfiguration())->toBeTrue();
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    $component = Livewire::test('server.navbar', ['server' => $server->fresh()])
+        ->assertSee('Changes pending')
+        ->assertSee('The saved proxy configuration has not been applied')
+        ->assertSee('Restart proxy');
+
+    $server->refresh();
+    $server->proxy->last_applied_settings = 'saved-hash';
+    $server->traefik_outdated_info = null;
+    $server->save();
+
+    $component->call('showNotification')
+        ->assertDispatched('proxy-configuration-state-changed', pending: false, traefikOutdated: false)
+        ->assertDontSee('The saved proxy configuration has not been applied');
+});
+
+test('running proxy hides pending configuration warning when saved settings match applied settings', function () {
+    [$user, $team, $server] = setupProxyUser('admin');
+    makeServerProxyRunning($server);
+    $server->proxy->last_saved_settings = 'matching-hash';
+    $server->proxy->last_applied_settings = 'matching-hash';
+    $server->save();
+
+    expect($server->fresh()->hasPendingProxyConfiguration())->toBeFalse();
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    $component = Livewire::test('server.navbar', ['server' => $server->fresh()])
+        ->assertDontSee('The saved proxy configuration has not been applied');
+
+    $server->refresh();
+    $server->proxy->last_saved_settings = 'new-saved-hash';
+    $server->save();
+
+    $component->dispatch('refreshServerShow')
+        ->assertDispatched('proxy-configuration-state-changed', pending: true, traefikOutdated: false)
+        ->assertSee('Changes pending')
+        ->assertSee('The saved proxy configuration has not been applied');
+});
+
 test('admin can stop a proxy while it is starting', function () {
     [$user, $team, $server] = setupProxyUser('admin');
 
diff --git a/tests/Feature/ProxyConfigurationLoadingStateTest.php b/tests/Feature/ProxyConfigurationLoadingStateTest.php
new file mode 100644
index 0000000000..112f68d8cc
--- /dev/null
+++ b/tests/Feature/ProxyConfigurationLoadingStateTest.php
@@ -0,0 +1,12 @@
+<?php
+
+it('disables proxy configuration controls and covers the editor while saving', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/proxy.blade.php'));
+
+    expect($view)
+        ->toContain('wire:loading.attr="disabled"')
+        ->toContain('wire:target="submit,resetProxyConfiguration"')
+        ->toContain('wire:loading.class="pointer-events-none opacity-50"')
+        ->toContain('Updating proxy configuration')
+        ->toContain('aria-live="polite"');
+});
diff --git a/tests/Feature/ServerSidebarIconsTest.php b/tests/Feature/ServerSidebarIconsTest.php
index 414a86381e..205429d678 100644
--- a/tests/Feature/ServerSidebarIconsTest.php
+++ b/tests/Feature/ServerSidebarIconsTest.php
@@ -46,3 +46,17 @@ it('uses the network reicon for proxy in the server sidebar', function () {
         ->toMatch("/'label' => 'Proxy'[\s\S]*?'icon' => 'network'/")
         ->not->toMatch("/'label' => 'Proxy'[\s\S]*?'icon' => 'settings',\s*'group' => 'Platform'/");
 });
+
+it('shows a warning icon when a server menu item requires attention', function () {
+    $contents = file_get_contents(resource_path('views/components/server/sidebar.blade.php'));
+
+    expect($contents)
+        ->toContain('proxyConfigurationPending: @js($server->hasPendingProxyConfiguration())')
+        ->toContain('proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),')
+        ->toContain('traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo())')
+        ->toContain('@proxy-configuration-state-changed.window')
+        ->toContain("\$menuItem['warning'] ?? false")
+        ->toContain('name="alert-triangle"');
+
+    expect(substr_count($contents, 'traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo())'))->toBe(1);
+});
diff --git a/tests/Feature/TraefikVersionStateTest.php b/tests/Feature/TraefikVersionStateTest.php
new file mode 100644
index 0000000000..9068683f69
--- /dev/null
+++ b/tests/Feature/TraefikVersionStateTest.php
@@ -0,0 +1,89 @@
+<?php
+
+use App\Enums\ProxyTypes;
+use App\Jobs\CheckTraefikVersionForServerJob;
+use App\Livewire\Server\Proxy;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+
+uses(RefreshDatabase::class);
+
+it('ignores stale minor upgrade information for the detected Traefik version', function () {
+    Cache::put('coolify:versions:all', [
+        'traefik' => [
+            'v3.7' => '3.7.8',
+            'v3.6' => '3.6.23',
+        ],
+    ]);
+
+    $server = Server::factory()->make([
+        'proxy' => ['type' => ProxyTypes::TRAEFIK->value],
+        'detected_traefik_version' => '3.7.8',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+
+    expect($component->getNewerTraefikBranchAvailableProperty())->toBeNull();
+});
+
+it('does not mark stale Traefik outdated information as a current warning', function () {
+    $server = Server::factory()->make([
+        'proxy' => ['type' => ProxyTypes::TRAEFIK->value],
+        'detected_traefik_version' => '3.7.8',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    expect($server->hasCurrentTraefikOutdatedInfo())->toBeFalse();
+});
+
+it('marks matching Traefik outdated information as a current warning', function () {
+    $server = Server::factory()->make([
+        'proxy' => ['type' => ProxyTypes::TRAEFIK->value],
+        'detected_traefik_version' => 'v3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    expect($server->hasCurrentTraefikOutdatedInfo())->toBeTrue();
+});
+
+it('clears stale outdated information before detecting the current version', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $job = new CheckTraefikVersionForServerJob($server, ['v3.7' => '3.7.8']);
+    $method = new ReflectionMethod($job, 'clearOutdatedInfo');
+    $method->invoke($job);
+
+    $server->refresh();
+
+    expect($server->detected_traefik_version)->toBe('3.6.23')
+        ->and($server->traefik_outdated_info)->toBeNull();
+});

From b2af1c11a5c65d10d0fd4f9efec1902ee6221ac1 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:02:48 +0200
Subject: [PATCH 35/42] fix(logs): clean up deployment log scrolling on
 teardown

---
 .../project/shared/get-logs.blade.php         | 41 +++++++++++++------
 .../Feature/DeploymentLogToolbarStyleTest.php | 11 +++++
 2 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index f96667b57d..57391233d4 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -7,7 +7,9 @@
         alwaysScroll: false,
         followManuallyDisabled: false,
         rafId: null,
+        scrollTimeout: null,
         scrollDebounce: null,
+        destroyed: false,
         colorLogs: localStorage.getItem('coolify-color-logs') === 'true',
         logFilters: JSON.parse(localStorage.getItem('coolify-log-filters')) || {error: true, warning: true, debug: true, info: true},
         searchQuery: '',
@@ -17,10 +19,7 @@
             this.fullscreen = !this.fullscreen;
             if (this.fullscreen === false) {
                 this.alwaysScroll = false;
-                if (this.rafId) {
-                    cancelAnimationFrame(this.rafId);
-                    this.rafId = null;
-                }
+                this.cancelScrollLoop();
             }
         },
         handleKeyDown(event) {
@@ -33,10 +32,21 @@
         disableFollow() {
             if (!this.alwaysScroll) return;
             this.alwaysScroll = false;
+            this.cancelScrollLoop();
+        },
+        cancelScrollLoop() {
             if (this.rafId) {
                 cancelAnimationFrame(this.rafId);
                 this.rafId = null;
             }
+            if (this.scrollTimeout) {
+                clearTimeout(this.scrollTimeout);
+                this.scrollTimeout = null;
+            }
+            if (this.scrollDebounce) {
+                clearTimeout(this.scrollDebounce);
+                this.scrollDebounce = null;
+            }
         },
         handleWheel(event) {
             if (this.alwaysScroll && event.deltaY < 0) {
@@ -62,7 +72,8 @@
             }
         },
         scrollToBottom() {
-            const logsContainer = document.getElementById('logsContainer');
+            if (this.destroyed) return;
+            const logsContainer = this.$root.querySelector('#logsContainer');
             if (logsContainer) {
                 this.isScrolling = true;
                 logsContainer.scrollTop = logsContainer.scrollHeight;
@@ -70,11 +81,12 @@
             }
         },
         scheduleScroll() {
-            if (!this.alwaysScroll) return;
+            if (!this.alwaysScroll || this.destroyed) return;
             this.rafId = requestAnimationFrame(() => {
+                if (!this.alwaysScroll || this.destroyed) return;
                 this.scrollToBottom();
-                if (this.alwaysScroll) {
-                    setTimeout(() => this.scheduleScroll(), 250);
+                if (this.alwaysScroll && !this.destroyed) {
+                    this.scrollTimeout = setTimeout(() => this.scheduleScroll(), 250);
                 }
             });
         },
@@ -85,16 +97,14 @@
                 this.scheduleScroll();
             } else {
                 this.followManuallyDisabled = true;
-                if (this.rafId) {
-                    cancelAnimationFrame(this.rafId);
-                    this.rafId = null;
-                }
+                this.cancelScrollLoop();
             }
         },
         handleScroll(event) {
-            if (this.isScrolling) return;
+            if (this.isScrolling || this.destroyed) return;
             clearTimeout(this.scrollDebounce);
             this.scrollDebounce = setTimeout(() => {
+                if (this.destroyed) return;
                 const el = event.target;
                 const distanceFromBottom = el.scrollHeight - el.scrollTop - el.clientHeight;
                 if (!this.alwaysScroll && !this.followManuallyDisabled && distanceFromBottom <= 10) {
@@ -253,6 +263,11 @@
                     applyAfterUpdate();
                 }
             });
+        },
+        destroy() {
+            this.destroyed = true;
+            this.alwaysScroll = false;
+            this.cancelScrollLoop();
         }
     }" @keydown.window="handleKeyDown($event)">
         @if ($collapsible)
diff --git a/tests/Feature/DeploymentLogToolbarStyleTest.php b/tests/Feature/DeploymentLogToolbarStyleTest.php
index a33fb5315f..24cf01376a 100644
--- a/tests/Feature/DeploymentLogToolbarStyleTest.php
+++ b/tests/Feature/DeploymentLogToolbarStyleTest.php
@@ -45,3 +45,14 @@ test('turning off follow logs stays off at the bottom of the log viewer', functi
             ->toContain('this.followManuallyDisabled = false');
     }
 });
+
+test('runtime log follow loop is cleaned up when navigating away', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/get-logs.blade.php'));
+
+    expect($view)
+        ->toContain('scrollTimeout: null')
+        ->toContain("this.\$root.querySelector('#logsContainer')")
+        ->toContain('destroy() {')
+        ->toContain('this.destroyed = true')
+        ->toContain('this.cancelScrollLoop()');
+});

From 288dc98ca7bd803fd927e6c677550f10e136842b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:03:33 +0200
Subject: [PATCH 36/42] fix: enforce remote output size limits

---
 app/Actions/Proxy/GetProxyConfiguration.php   |   2 +-
 app/Models/Application.php                    |   2 +-
 tests/Feature/GetLogsCommandInjectionTest.php |   6 +-
 tests/Pest.php                                |  17 +++
 tests/Unit/LocalFileVolumeContentSizeTest.php |  73 +++++++----
 tests/Unit/RemoteOutputSizeLimitsTest.php     | 119 +++++++++++++-----
 6 files changed, 163 insertions(+), 56 deletions(-)

diff --git a/app/Actions/Proxy/GetProxyConfiguration.php b/app/Actions/Proxy/GetProxyConfiguration.php
index 7df16c52b4..d09aae802a 100644
--- a/app/Actions/Proxy/GetProxyConfiguration.php
+++ b/app/Actions/Proxy/GetProxyConfiguration.php
@@ -107,7 +107,7 @@ class GetProxyConfiguration
             "if [ ! -f {$configurationPath} ]; then exit 0; elif [ \"$(wc -c < {$configurationPath})\" -gt ".self::MAX_CONFIGURATION_SIZE_BYTES." ]; then echo '__COOLIFY_PROXY_CONFIG_TOO_LARGE__'; else head -c {$readLimit} {$configurationPath}; fi",
         ], $server, false);
 
-        if ($result === '__COOLIFY_PROXY_CONFIG_TOO_LARGE__') {
+        if ($result === '__COOLIFY_PROXY_CONFIG_TOO_LARGE__' || strlen($result ?? '') > self::MAX_CONFIGURATION_SIZE_BYTES) {
             throw new \RuntimeException('Proxy configuration exceeds the 5 MiB size limit.');
         }
 
diff --git a/app/Models/Application.php b/app/Models/Application.php
index a74941f023..fef76cd393 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -2161,7 +2161,7 @@ class Application extends BaseModel
         }
         try {
             $composeFileContent = instant_remote_process($commands, $this->destination->server);
-            if ($composeFileContent === '__COOLIFY_COMPOSE_TOO_LARGE__') {
+            if ($composeFileContent === '__COOLIFY_COMPOSE_TOO_LARGE__' || strlen($composeFileContent) > self::MAX_DOCKER_COMPOSE_SIZE_BYTES) {
                 throw new RuntimeException('Docker Compose file exceeds the 5 MiB size limit.');
             }
         } catch (\Exception $e) {
diff --git a/tests/Feature/GetLogsCommandInjectionTest.php b/tests/Feature/GetLogsCommandInjectionTest.php
index c920b94ede..2c86d73284 100644
--- a/tests/Feature/GetLogsCommandInjectionTest.php
+++ b/tests/Feature/GetLogsCommandInjectionTest.php
@@ -80,7 +80,7 @@ describe('GetLogs Livewire action validation', function () {
             'is_usable' => true,
             'force_disabled' => false,
         ])->save();
-        $server = Server::with('settings')->find($this->server->id);
+        $server = Server::with('settings')->findOrFail($this->server->id);
         $output = "\e[31m".str_repeat('a', GetLogs::MAX_DISPLAY_SIZE_BYTES - 4);
 
         expect(strlen($output))->toBe(GetLogs::MAX_DISPLAY_SIZE_BYTES + 1);
@@ -114,7 +114,7 @@ describe('GetLogs Livewire action validation', function () {
             'force_disabled' => false,
         ])->save();
         // Reload server with fresh settings to ensure casted values
-        $server = Server::with('settings')->find($this->server->id);
+        $server = Server::with('settings')->findOrFail($this->server->id);
 
         Livewire::test(GetLogs::class, [
             'server' => $server,
@@ -144,7 +144,7 @@ describe('GetLogs Livewire action validation', function () {
             'is_usable' => true,
             'force_disabled' => false,
         ])->save();
-        $server = Server::with('settings')->find($this->server->id);
+        $server = Server::with('settings')->findOrFail($this->server->id);
 
         Livewire::test(GetLogs::class, [
             'server' => $server,
diff --git a/tests/Pest.php b/tests/Pest.php
index 7100bfaa72..25d9440108 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -27,6 +27,23 @@ uses(TestCase::class)->in('Feature', 'v4/Feature', 'v4/Browser', 'v5/Browser');
 
 require_once __DIR__.'/Support/BrowserTestHelpers.php';
 
+function remoteOutputSource(string $path): string
+{
+    $fixturePath = dirname(__DIR__).'/'.$path;
+
+    if (! is_readable($fixturePath)) {
+        throw new RuntimeException("Unable to read source fixture: {$fixturePath}");
+    }
+
+    $source = file_get_contents($fixturePath);
+
+    if ($source === false) {
+        throw new RuntimeException("Unable to read source fixture: {$fixturePath}");
+    }
+
+    return $source;
+}
+
 /*
 |--------------------------------------------------------------------------
 | Test Hooks
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
index 1894bf4394..2a22234012 100644
--- a/tests/Unit/LocalFileVolumeContentSizeTest.php
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -9,10 +9,18 @@
  * payload, crashing the browser.
  */
 
+use App\Models\Application;
 use App\Models\LocalFileVolume;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Relations\MorphMany;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
 use Tests\TestCase;
 
-uses(TestCase::class);
+uses(TestCase::class, RefreshDatabase::class);
 
 it('exposes a 5 MiB content size limit', function () {
     expect(LocalFileVolume::MAX_CONTENT_SIZE)->toBe(5_242_880);
@@ -66,31 +74,50 @@ it('exposes the too-large flag via toArray for Livewire serialization', function
 });
 
 it('does not read regular bind-mounted file contents while loading service settings', function () {
-    $helpers = file_get_contents(base_path('bootstrap/helpers/services.php'));
-    $filesystemSync = str($helpers)
-        ->after('function getFilesystemVolumesFromServer')
-        ->before('function updateCompose');
+    $user = User::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $user->teams()->first()->id]);
+    Storage::fake('ssh-keys');
+    $server = Server::factory()->create([
+        'team_id' => $user->teams()->first()->id,
+        'private_key_id' => $privateKey->id,
+    ]);
 
-    expect($filesystemSync->value())
-        ->not->toContain('instant_remote_process(["cat $fileLocation"]');
-    expect($filesystemSync->value())
-        ->toContain('if ($fileVolume->is_based_on_git)')
-        ->toContain('$fileVolume->loadStorageOnServer();');
-});
+    $volume = Mockery::mock(LocalFileVolume::class)->makePartial();
+    $volume->fs_path = '/data/large.bin';
+    $volume->is_based_on_git = false;
+    $volume->shouldReceive('save')->once();
+    $volume->shouldNotReceive('loadStorageOnServer');
 
-it('marks git-based file volumes as files before refreshing their content', function () {
-    $helpers = file_get_contents(base_path('bootstrap/helpers/services.php'));
-    $fileBranch = str($helpers)
-        ->after("if (\$isFile === 'OK') {")
-        ->before("} elseif (\$isDir === 'OK') {");
+    $fileStorages = Mockery::mock(MorphMany::class);
+    $fileStorages->shouldReceive('get')->once()->andReturn(collect([$volume]));
 
-    expect($fileBranch->value())->toMatch(
-        '/\$fileVolume->is_directory = false;\s+\$fileVolume->save\(\);\s+if \(\$fileVolume->is_based_on_git\) \{/'
-    );
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('getMorphClass')->andReturn(Application::class);
+    $application->shouldReceive('workdir')->once()->andReturn('/data/application');
+    $application->shouldReceive('fileStorages')->once()->andReturn($fileStorages);
+    $application->setRelation('destination', (object) ['server' => $server]);
+
+    Process::fake(function ($process) {
+        if (str_contains($process->command, 'test -f /data/large.bin')) {
+            return Process::result(output: 'OK');
+        }
+
+        if (str_contains($process->command, 'test -d /data/large.bin')) {
+            return Process::result(output: 'NOK');
+        }
+
+        return Process::result();
+    });
+
+    getFilesystemVolumesFromServer($application);
+
+    expect($volume->is_directory)->toBeFalse();
+    Process::assertRan(fn ($process) => str_contains($process->command, 'test -f /data/large.bin'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'cat /data/large.bin') || str_contains($process->command, 'head -c'));
 });
 
 it('bounds the remote file read itself to prevent a size-check race', function () {
-    $source = file_get_contents(app_path('Models/LocalFileVolume.php'));
+    $source = remoteOutputSource('app/Models/LocalFileVolume.php');
     $loadStorage = str($source)
         ->after('public function loadStorageOnServer()')
         ->before('public function deleteStorageOnServer()');
@@ -101,7 +128,7 @@ it('bounds the remote file read itself to prevent a size-check race', function (
 });
 
 it('bounds directory-to-file conflict reads the same way', function () {
-    $source = file_get_contents(app_path('Models/LocalFileVolume.php'));
+    $source = remoteOutputSource('app/Models/LocalFileVolume.php');
     $saveStorage = str($source)
         ->after('public function saveStorageOnServer()')
         ->before('protected function plainMountPath');
@@ -118,8 +145,12 @@ it('treats a bounded remote read that exceeds the limit as too large', function
 });
 
 it('keeps a bounded remote read that fits the limit', function () {
+    $maximumSizedContent = str_repeat('a', LocalFileVolume::MAX_CONTENT_SIZE);
+
     expect(LocalFileVolume::contentFromBoundedRead('hello'))
         ->toBe('hello')
+        ->and(LocalFileVolume::contentFromBoundedRead($maximumSizedContent))
+        ->toBe($maximumSizedContent)
         ->and(LocalFileVolume::contentFromBoundedRead(null))
         ->toBe('');
 });
diff --git a/tests/Unit/RemoteOutputSizeLimitsTest.php b/tests/Unit/RemoteOutputSizeLimitsTest.php
index 3660e88284..dda82a0fb1 100644
--- a/tests/Unit/RemoteOutputSizeLimitsTest.php
+++ b/tests/Unit/RemoteOutputSizeLimitsTest.php
@@ -5,27 +5,65 @@ use App\Jobs\ScheduledTaskJob;
 use App\Livewire\Project\Shared\GetLogs;
 use App\Livewire\Server\Proxy\DynamicConfigurations;
 use App\Models\Application;
+use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Spatie\SchemalessAttributes\SchemalessAttributes;
+use Tests\TestCase;
 
-function remoteOutputSource(string $path): string
+uses(TestCase::class, RefreshDatabase::class);
+
+function remoteOutputTestServer(): Server
 {
-    return file_get_contents(__DIR__.'/../../'.$path);
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    Storage::fake('ssh-keys');
+
+    return Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
 }
 
 it('bounds dynamic proxy configuration files and their combined Livewire payload', function () {
-    $source = remoteOutputSource('app/Livewire/Server/Proxy/DynamicConfigurations.php');
+    $server = Mockery::mock(remoteOutputTestServer())->makePartial();
+    $server->shouldReceive('proxyPath')->andReturn('/data/proxy');
+    $files = collect(range(1, 101))->map(fn (int $number) => sprintf('file%03d.yml', $number))->implode("\n");
 
-    expect($source)
-        ->toContain('MAX_CONFIGURATION_FILE_SIZE_BYTES')
-        ->toContain('MAX_TOTAL_CONFIGURATION_SIZE_BYTES')
-        ->toContain('MAX_CONFIGURATION_FILES')
-        ->toContain('head -c')
-        ->toContain('$totalBytes');
+    Process::fake(function ($process) use ($files) {
+        if (str_contains($process->command, 'ls -1')) {
+            return Process::result(output: $files);
+        }
 
-    expect(DynamicConfigurations::MAX_CONFIGURATION_FILE_SIZE_BYTES)->toBe(1024 * 1024)
-        ->and(DynamicConfigurations::MAX_TOTAL_CONFIGURATION_SIZE_BYTES)->toBe(5 * 1024 * 1024)
-        ->and(DynamicConfigurations::MAX_CONFIGURATION_FILES)->toBe(100);
+        if (str_contains($process->command, 'file001.yml')) {
+            return Process::result(output: str_repeat('x', DynamicConfigurations::MAX_CONFIGURATION_FILE_SIZE_BYTES + 1));
+        }
+
+        if (preg_match('/file00[2-6]\.yml/', $process->command)) {
+            return Process::result(output: str_repeat('x', DynamicConfigurations::MAX_CONFIGURATION_FILE_SIZE_BYTES));
+        }
+
+        return Process::result(output: 'x');
+    });
+
+    $component = Mockery::mock(DynamicConfigurations::class)->makePartial();
+    $component->server = $server;
+    $component->shouldReceive('authorize')->once();
+    $component->shouldReceive('dispatch')->andReturnSelf();
+    $component->loadDynamicConfigurations();
+
+    expect($component->contents)->toHaveCount(5)
+        ->toHaveKeys(['file002|yml', 'file003|yml', 'file004|yml', 'file005|yml', 'file006|yml'])
+        ->not->toHaveKeys(['file001|yml', 'file007|yml', 'file101|yml']);
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'file101.yml'));
 });
+it('fails explicitly when a source fixture cannot be read', function () {
+    remoteOutputSource('missing-source-fixture.php');
+})->throws(RuntimeException::class, 'Unable to read source fixture:');
 
 it('bounds regular log viewer output before it reaches PHP', function () {
     $source = remoteOutputSource('app/Livewire/Project/Shared/GetLogs.php');
@@ -42,17 +80,34 @@ it('bounds regular log viewer output before it reaches PHP', function () {
         ->and($command)->toBe('(docker logs example) 2>&1 | head -c 101');
 });
 
-it('bounds docker compose files loaded from git before parsing', function () {
-    $source = remoteOutputSource('app/Models/Application.php');
+it('rejects oversized docker compose files loaded from git before parsing', function () {
+    $server = remoteOutputTestServer();
 
-    expect($source)
-        ->toContain('MAX_DOCKER_COMPOSE_SIZE_BYTES')
-        ->toContain('MAX_DOCKER_COMPOSE_SIZE_BYTES + 1')
-        ->toContain('head -c');
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->base_directory = '/';
+    $application->docker_compose_location = '/docker-compose.yml';
+    $application->setRelation('destination', (object) ['server' => $server]);
+    $application->shouldReceive('generateGitImportCommands')->andReturn(['commands' => collect(['git clone example checkout'])]);
+    $application->shouldReceive('getGitRemoteStatus')->andReturn(['is_accessible' => true]);
+    $application->shouldReceive('save')->once();
 
-    expect(Application::MAX_DOCKER_COMPOSE_SIZE_BYTES)->toBe(5 * 1024 * 1024);
+    Process::fake(function ($process) {
+        if (str_contains($process->command, 'git --version')) {
+            return Process::result(output: 'git version 2.40.0');
+        }
+
+        if (str_contains($process->command, 'wc -c')) {
+            return Process::result(output: '__COOLIFY_COMPOSE_TOO_LARGE__');
+        }
+
+        return Process::result();
+    });
+
+    expect(fn () => $application->loadComposeFile())
+        ->toThrow(RuntimeException::class, 'Docker Compose file exceeds the 5 MiB size limit.');
+    expect($application->docker_compose_raw)->toBeNull();
+    Process::assertRan(fn ($process) => str_contains($process->command, 'head -c '.(Application::MAX_DOCKER_COMPOSE_SIZE_BYTES + 1)));
 });
-
 it('bounds scheduled task output before storing or notifying', function () {
     $source = remoteOutputSource('app/Jobs/ScheduledTaskJob.php');
 
@@ -97,8 +152,7 @@ it('does not pass the scheduled task output wrapper through the sudo rewriter',
     $reflection = new ReflectionClass(ScheduledTaskJob::class);
     $method = $reflection->getMethod('boundedTaskCommand');
     $command = $method->invoke($reflection->newInstanceWithoutConstructor(), 'sudo docker exec example true');
-    $server = Mockery::mock(Server::class)->makePartial();
-    $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+    $server = new Server(['user' => 'ubuntu']);
     $rewrittenCommand = parseCommandsByLineForSudo(collect([$command]), $server)[0];
 
     exec('bash -n -c '.escapeshellarg($command), $output, $exitCode);
@@ -111,14 +165,19 @@ it('does not pass the scheduled task output wrapper through the sudo rewriter',
         ->and($rewrittenExitCode)->not->toBe(0);
 });
 
-it('bounds proxy configuration backfill before storing it', function () {
-    $source = remoteOutputSource('app/Actions/Proxy/GetProxyConfiguration.php');
+it('rejects oversized proxy configuration backfill before persistence', function () {
+    $proxy = Mockery::mock(SchemalessAttributes::class);
+    $proxy->shouldNotReceive('set');
+    $server = Mockery::mock(remoteOutputTestServer())->makePartial();
+    $server->shouldReceive('proxyPath')->andReturn('/data/proxy');
+    $server->shouldReceive('getAttribute')->with('proxy')->andReturn($proxy);
+    $server->shouldNotReceive('save');
 
-    expect($source)
-        ->toContain('MAX_CONFIGURATION_SIZE_BYTES')
-        ->toContain('MAX_CONFIGURATION_SIZE_BYTES + 1')
-        ->toContain('head -c')
-        ->toContain('Proxy configuration exceeds');
+    Process::fake(['*' => Process::result(output: '__COOLIFY_PROXY_CONFIG_TOO_LARGE__')]);
 
-    expect(GetProxyConfiguration::MAX_CONFIGURATION_SIZE_BYTES)->toBe(5 * 1024 * 1024);
+    $method = new ReflectionMethod(GetProxyConfiguration::class, 'backfillFromDisk');
+
+    expect(fn () => $method->invoke(new GetProxyConfiguration, $server))
+        ->toThrow(RuntimeException::class, 'Proxy configuration exceeds the 5 MiB size limit.');
+    Process::assertRan(fn ($process) => str_contains($process->command, 'head -c '.(GetProxyConfiguration::MAX_CONFIGURATION_SIZE_BYTES + 1)));
 });

From dd597d152722cb8f141dfa76b4de694fd4283618 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:10:23 +0200
Subject: [PATCH 37/42] fix(backups): support long-running volume backups

---
 .../Api/VolumeBackupsController.php           |  4 +-
 app/Jobs/VolumeBackupJob.php                  |  4 +-
 .../Project/Shared/Storages/VolumeBackups.php |  2 +-
 app/Models/ScheduledVolumeBackup.php          |  2 +
 config/horizon.php                            |  6 ++-
 ...increase_default_volume_backup_timeout.php | 27 ++++++++++++++
 tests/Feature/VolumeBackupTest.php            | 37 +++++++++++++++++++
 7 files changed, 76 insertions(+), 6 deletions(-)
 create mode 100644 database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php

diff --git a/app/Http/Controllers/Api/VolumeBackupsController.php b/app/Http/Controllers/Api/VolumeBackupsController.php
index e51bf31f8e..a5225f5dd7 100644
--- a/app/Http/Controllers/Api/VolumeBackupsController.php
+++ b/app/Http/Controllers/Api/VolumeBackupsController.php
@@ -34,7 +34,7 @@ use RuntimeException;
         new OA\Property(property: 'retention_amount_s3', type: 'integer', default: 7, minimum: 0, maximum: 10000),
         new OA\Property(property: 'retention_days_s3', type: 'integer', default: 0, maximum: 2147483647, minimum: 0),
         new OA\Property(property: 'retention_max_storage_s3', type: 'number', format: 'float', default: 0, maximum: 9999999999, minimum: 0),
-        new OA\Property(property: 'timeout', type: 'integer', default: 3600, minimum: 60, maximum: 36000),
+        new OA\Property(property: 'timeout', type: 'integer', default: ScheduledVolumeBackup::DEFAULT_TIMEOUT, minimum: 60, maximum: 36000),
     ],
     type: 'object',
     additionalProperties: false,
@@ -275,7 +275,7 @@ class VolumeBackupsController extends Controller
             'retention_amount_s3' => $request->integer('retention_amount_s3', 7),
             'retention_days_s3' => $request->integer('retention_days_s3'),
             'retention_max_storage_s3' => $request->float('retention_max_storage_s3'),
-            'timeout' => $request->integer('timeout', 3600),
+            'timeout' => $request->integer('timeout', ScheduledVolumeBackup::DEFAULT_TIMEOUT),
         ]);
         $created = $backup->wasRecentlyCreated;
 
diff --git a/app/Jobs/VolumeBackupJob.php b/app/Jobs/VolumeBackupJob.php
index 39998a1f60..b567a71b7f 100644
--- a/app/Jobs/VolumeBackupJob.php
+++ b/app/Jobs/VolumeBackupJob.php
@@ -28,14 +28,14 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
 
     public int $maxExceptions = 1;
 
-    public int $timeout = 3600;
+    public int $timeout = ScheduledVolumeBackup::DEFAULT_TIMEOUT;
 
     private ?ScheduledVolumeBackupExecution $execution = null;
 
     public function __construct(public ScheduledVolumeBackup $backup)
     {
         $this->onQueue(crons_queue());
-        $this->timeout = $backup->timeout ?? 3600;
+        $this->timeout = $backup->timeout ?? ScheduledVolumeBackup::DEFAULT_TIMEOUT;
     }
 
     public function middleware(): array
diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index a03820b4b5..a10eb5ad03 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -56,7 +56,7 @@ class VolumeBackups extends Component
 
     public string $timezone = '';
 
-    public int $timeout = 3600;
+    public int $timeout = ScheduledVolumeBackup::DEFAULT_TIMEOUT;
 
     public int $perPage = 10;
 
diff --git a/app/Models/ScheduledVolumeBackup.php b/app/Models/ScheduledVolumeBackup.php
index a333681427..7f33fd92b9 100644
--- a/app/Models/ScheduledVolumeBackup.php
+++ b/app/Models/ScheduledVolumeBackup.php
@@ -11,6 +11,8 @@ use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 class ScheduledVolumeBackup extends BaseModel
 {
+    public const int DEFAULT_TIMEOUT = 36000;
+
     protected $fillable = [
         'uuid',
         'backupable_type',
diff --git a/config/horizon.php b/config/horizon.php
index d86c52affe..fe35734c2d 100644
--- a/config/horizon.php
+++ b/config/horizon.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\ScheduledVolumeBackup;
 use Illuminate\Support\Str;
 
 return [
@@ -202,7 +203,10 @@ return [
             'tries' => 1,
             'nice' => 0,
             'sleep' => 3,
-            'timeout' => env('HORIZON_TIMEOUT', 36000),
+            'timeout' => min(
+                max((int) env('HORIZON_TIMEOUT', 39600), ScheduledVolumeBackup::DEFAULT_TIMEOUT + 600),
+                85800,
+            ),
         ],
 
     ],
diff --git a/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php b/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
new file mode 100644
index 0000000000..f895c7837c
--- /dev/null
+++ b/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
@@ -0,0 +1,27 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('scheduled_volume_backups')
+            ->where('timeout', 3600)
+            ->update(['timeout' => 36000]);
+
+        Schema::table('scheduled_volume_backups', function (Blueprint $table) {
+            $table->unsignedInteger('timeout')->default(36000)->change();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('scheduled_volume_backups', function (Blueprint $table) {
+            $table->unsignedInteger('timeout')->default(3600)->change();
+        });
+    }
+};
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index 4968945916..e18f1475f4 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -51,6 +51,43 @@ it('provides the volume backup domain classes and relationship', function () {
         ->and(method_exists(LocalFileVolume::class, 'scheduledBackups'))->toBeTrue();
 });
 
+it('allows large volume backups to run for ten hours by default', function () {
+    $backup = new ScheduledVolumeBackup;
+    $job = new VolumeBackupJob($backup);
+
+    expect($job->timeout)->toBe(36000)
+        ->and((new VolumeBackups)->timeout)->toBe(36000)
+        ->and(config('horizon.defaults.s6.timeout'))->toBeGreaterThan($job->timeout)
+        ->and(config('queue.connections.redis.retry_after'))->toBeGreaterThan(config('horizon.defaults.s6.timeout'));
+});
+
+it('upgrades existing default volume backup timeouts without changing custom timeouts', function () {
+    $team = Team::factory()->create();
+    [$application, $defaultVolume] = createVolumeBackupApplication($team);
+    $customVolume = LocalPersistentVolume::create([
+        'name' => 'custom-timeout-data',
+        'mount_path' => '/custom-data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $defaultBackup = $defaultVolume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'timeout' => 3600,
+    ]);
+    $customBackup = $customVolume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'timeout' => 7200,
+    ]);
+
+    $migration = require database_path('migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php');
+    $migration->up();
+
+    expect($defaultBackup->fresh()->timeout)->toBe(36000)
+        ->and($customBackup->fresh()->timeout)->toBe(7200);
+});
+
 it('includes parallel gzip support in the Coolify helper image', function () {
     $dockerfile = file_get_contents(base_path('docker/coolify-helper/Dockerfile'));
 

From ee843b723029c39fd2a19b45e592a407741fa891 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:51:40 +0200
Subject: [PATCH 38/42] fix(ui): show server warnings with alert icons

---
 resources/views/livewire/dashboard.blade.php  | 22 +++++++-----
 .../views/livewire/server/index.blade.php     | 34 ++++++++++++-------
 .../ServerStatusIndicatorDesignTest.php       | 18 +++++-----
 3 files changed, 44 insertions(+), 30 deletions(-)

diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index e9f8b32731..175fdb39a7 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -196,14 +196,9 @@
                                     :key="'dashboard-server-metrics-'.$server->uuid" />
                             @endif
 
-                            <div class="pointer-events-none relative z-10 flex min-w-0 items-start gap-3">
-                                <div title="{{ $serverStatus }}" aria-label="Server status: {{ $serverStatus }}"
-                                    @class([
-                                        'flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.04] dark:text-fg-dim',
-                                        'border-emerald-500/70' => $serverStatusType === 'success',
-                                        'border-amber-500/70' => $serverStatusType === 'warning',
-                                        'border-red-500/70' => $serverStatusType === 'error',
-                                    ])>
+                            <div class="relative z-10 flex min-w-0 items-start gap-3">
+                                <div
+                                    class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.04] dark:text-fg-dim">
                                     <x-reicon name="servers" class="size-4" />
                                 </div>
                                 <div class="min-w-0 flex-1">
@@ -215,6 +210,17 @@
                                         {{ $server->description ?: 'No description' }}
                                     </p>
                                 </div>
+                                @if ($serverStatusType !== 'success')
+                                    <span data-tooltip="{{ $serverStatus }}"
+                                        aria-label="Server status: {{ $serverStatus }}"
+                                        @class([
+                                            'flex size-6 shrink-0 items-center justify-center rounded-md',
+                                            'text-orange-500 dark:text-warning' => $serverStatusType === 'warning',
+                                            'text-red-500 dark:text-red-400' => $serverStatusType === 'error',
+                                        ])>
+                                        <x-reicon name="alert-triangle" class="size-4" />
+                                    </span>
+                                @endif
                             </div>
                         </a>
                     @endforeach
diff --git a/resources/views/livewire/server/index.blade.php b/resources/views/livewire/server/index.blade.php
index 2aa93aa7f9..d89e8b891f 100644
--- a/resources/views/livewire/server/index.blade.php
+++ b/resources/views/livewire/server/index.blade.php
@@ -139,15 +139,9 @@
                                 :key="'server-index-metrics-'.$server->uuid" />
                         @endif
 
-                        <div class="pointer-events-none relative z-10 flex items-start gap-3">
-                            <div title="{{ $serverRow['status'] }}"
-                                aria-label="Server status: {{ $serverRow['status'] }}"
-                                @class([
-                                    'flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.04] dark:text-fg-dim',
-                                    'border-emerald-500/70' => $serverRow['statusType'] === 'success',
-                                    'border-amber-500/70' => $serverRow['statusType'] === 'warning',
-                                    'border-red-500/70' => $serverRow['statusType'] === 'error',
-                                ])>
+                        <div class="relative z-10 flex items-start gap-3">
+                            <div
+                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.04] dark:text-fg-dim">
                                 <x-reicon name="servers" class="size-4" />
                             </div>
                             <div class="min-w-0 flex-1">
@@ -158,6 +152,17 @@
                                     {{ $serverRow['description'] }}
                                 </p>
                             </div>
+                            @if ($serverRow['statusType'] !== 'success')
+                                <span data-tooltip="{{ $serverRow['status'] }}"
+                                    aria-label="Server status: {{ $serverRow['status'] }}"
+                                    @class([
+                                        'ml-auto flex size-6 shrink-0 items-center justify-center rounded-md',
+                                        'text-orange-500 dark:text-warning' => $serverRow['statusType'] === 'warning',
+                                        'text-red-500 dark:text-red-400' => $serverRow['statusType'] === 'error',
+                                    ])>
+                                    <x-reicon name="alert-triangle" class="size-4" />
+                                </span>
+                            @endif
                         </div>
                     </a>
                 @endforeach
@@ -174,9 +179,8 @@
                     <a :href="server.href" {{ wireNavigate() }}
                         class="grid min-h-14 min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                         <div class="flex min-w-0 items-center gap-3">
-                            <div :title="server.status" :aria-label="`Server status: ${server.status}`"
-                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.035] dark:text-fg-dim"
-                                :class="server.statusType === 'success' ? 'border-emerald-500/70' : server.statusType === 'warning' ? 'border-amber-500/70' : 'border-red-500/70'">
+                            <div
+                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.035] dark:text-fg-dim">
                                 <x-reicon name="servers" class="size-4" />
                             </div>
                             <div class="min-w-0">
@@ -185,6 +189,12 @@
                                 <p class="truncate text-[11px] text-neutral-500 dark:text-fg-faint"
                                     x-text="server.description"></p>
                             </div>
+                            <span x-show="server.statusType !== 'success'" :data-tooltip="server.status"
+                                :aria-label="`Server status: ${server.status}`"
+                                class="ml-auto flex size-6 shrink-0 items-center justify-center rounded-md"
+                                :class="server.statusType === 'warning' ? 'text-orange-500 dark:text-warning' : 'text-red-500 dark:text-red-400'">
+                                <x-reicon name="alert-triangle" class="size-4" />
+                            </span>
                         </div>
                         <div class="text-[11px] font-medium text-neutral-600 dark:text-fg-dim">
                             <span x-text="server.status"></span>
diff --git a/tests/Feature/ServerStatusIndicatorDesignTest.php b/tests/Feature/ServerStatusIndicatorDesignTest.php
index 34e0f4cbd8..090d6d816a 100644
--- a/tests/Feature/ServerStatusIndicatorDesignTest.php
+++ b/tests/Feature/ServerStatusIndicatorDesignTest.php
@@ -1,16 +1,15 @@
 <?php
 
-test('server cards use icon borders instead of ready badges', function () {
+test('server cards use warning icons instead of colored icon borders', function () {
     $dashboard = file_get_contents(resource_path('views/livewire/dashboard.blade.php'));
     $serverIndex = file_get_contents(resource_path('views/livewire/server/index.blade.php'));
 
     expect($dashboard)
         ->not->toContain('<x-status-badge :status="$serverStatus"')
-        ->toContain("'border-emerald-500/70' => \$serverStatusType === 'success'")
-        ->toContain("'border-amber-500/70' => \$serverStatusType === 'warning'")
-        ->toContain("'border-red-500/70' => \$serverStatusType === 'error'")
-        ->toContain('title="{{ $serverStatus }}"')
-        ->toContain('aria-label="Server status: {{ $serverStatus }}"');
+        ->not->toContain("'border-amber-500/70' => \$serverStatusType === 'warning'")
+        ->toContain('@if ($serverStatusType !== \'success\')')
+        ->toContain('data-tooltip="{{ $serverStatus }}"')
+        ->toContain('<x-reicon name="alert-triangle"');
 
     expect(substr_count($serverIndex, '<x-status-badge'))->toBe(1)
         ->and($serverIndex)
@@ -20,10 +19,9 @@ test('server cards use icon borders instead of ready badges', function () {
         ->toContain("\$isReady => 'success'")
         ->toContain("\$isTransferredAway || \$server->settings->force_disabled => 'error'")
         ->toContain("default => 'error'")
-        ->toContain("server.statusType === 'success' ? 'border-emerald-500/70'")
-        ->toContain("server.statusType === 'warning' ? 'border-amber-500/70'")
-        ->toContain("'border-red-500/70'")
-        ->toContain(':title="server.status"')
+        ->not->toContain("server.statusType === 'warning' ? 'border-amber-500/70'")
+        ->toContain('x-show="server.statusType !== \'success\'"')
+        ->toContain(':data-tooltip="server.status"')
         ->toContain(':aria-label="`Server status: ${server.status}`"');
 });
 

From 1073bbca83a6cda81f237b26ca43ef2b02c59c1d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:06:05 +0200
Subject: [PATCH 39/42] fix(sentinel): clarify restart after settings update

Add a regression test for the updated success notification.
---
 app/Livewire/Server/Sentinel.php                 | 2 +-
 tests/Feature/Livewire/SentinelComponentTest.php | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/app/Livewire/Server/Sentinel.php b/app/Livewire/Server/Sentinel.php
index cd05002aae..a69eb3f807 100644
--- a/app/Livewire/Server/Sentinel.php
+++ b/app/Livewire/Server/Sentinel.php
@@ -146,7 +146,7 @@ class Sentinel extends Component
     {
         try {
             $this->syncData(true);
-            $this->dispatch('success', 'Sentinel settings updated.');
+            $this->dispatch('success', 'Sentinel settings updated. Restarting Sentinel.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/tests/Feature/Livewire/SentinelComponentTest.php b/tests/Feature/Livewire/SentinelComponentTest.php
index 41b3f2b497..01250910aa 100644
--- a/tests/Feature/Livewire/SentinelComponentTest.php
+++ b/tests/Feature/Livewire/SentinelComponentTest.php
@@ -36,3 +36,12 @@ it('does not repeat a disabled status badge in the sentinel empty state', functi
 
     expect($view)->not->toContain("? 'Disabled'");
 });
+
+it('tells the user that saving sentinel settings initiates a restart', function () {
+    $componentSource = file_get_contents(app_path('Livewire/Server/Sentinel.php'));
+
+    preg_match('/public function submit\([^)]*\).*?\{(?<body>.*?)\n    \}/s', $componentSource, $matches);
+
+    expect($matches['body'] ?? '')
+        ->toContain("\$this->dispatch('success', 'Sentinel settings updated. Restarting Sentinel.');");
+});

From b075693274341f78f894783e5ca18c6712eab6d1 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:30:59 +0200
Subject: [PATCH 40/42] fix(backups): preserve existing volume backup timeouts

Change only the default timeout for new volume backups without modifying existing schedules.
---
 ...6_08_15_000000_increase_default_volume_backup_timeout.php | 5 -----
 tests/Feature/VolumeBackupTest.php                           | 4 ++--
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php b/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
index f895c7837c..32eccce96b 100644
--- a/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
+++ b/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
@@ -2,17 +2,12 @@
 
 use Illuminate\Database\Migrations\Migration;
 use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 
 return new class extends Migration
 {
     public function up(): void
     {
-        DB::table('scheduled_volume_backups')
-            ->where('timeout', 3600)
-            ->update(['timeout' => 36000]);
-
         Schema::table('scheduled_volume_backups', function (Blueprint $table) {
             $table->unsignedInteger('timeout')->default(36000)->change();
         });
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index e18f1475f4..b4f78d9e0a 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -61,7 +61,7 @@ it('allows large volume backups to run for ten hours by default', function () {
         ->and(config('queue.connections.redis.retry_after'))->toBeGreaterThan(config('horizon.defaults.s6.timeout'));
 });
 
-it('upgrades existing default volume backup timeouts without changing custom timeouts', function () {
+it('changes the default volume backup timeout without changing existing timeouts', function () {
     $team = Team::factory()->create();
     [$application, $defaultVolume] = createVolumeBackupApplication($team);
     $customVolume = LocalPersistentVolume::create([
@@ -84,7 +84,7 @@ it('upgrades existing default volume backup timeouts without changing custom tim
     $migration = require database_path('migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php');
     $migration->up();
 
-    expect($defaultBackup->fresh()->timeout)->toBe(36000)
+    expect($defaultBackup->fresh()->timeout)->toBe(3600)
         ->and($customBackup->fresh()->timeout)->toBe(7200);
 });
 

From a3e968d03e38807a676fc573770f366b0e581be9 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:41:31 +0200
Subject: [PATCH 41/42] fix(backups): preserve existing volume backup timeouts

Only update timeout when the API request explicitly provides one, with coverage for custom timeout values.
---
 app/Http/Controllers/Api/VolumeBackupsController.php | 10 +++++++---
 tests/Feature/Api/VolumeBackupScheduleApiTest.php    |  4 +++-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/app/Http/Controllers/Api/VolumeBackupsController.php b/app/Http/Controllers/Api/VolumeBackupsController.php
index a5225f5dd7..26ff938a10 100644
--- a/app/Http/Controllers/Api/VolumeBackupsController.php
+++ b/app/Http/Controllers/Api/VolumeBackupsController.php
@@ -261,7 +261,7 @@ class VolumeBackupsController extends Controller
         string $resourceType,
         Model $resource,
     ): JsonResponse {
-        $backup = $storage->scheduledBackups()->updateOrCreate([], [
+        $attributes = [
             'team_id' => $teamId,
             'frequency' => $request->string('frequency')->toString(),
             'enabled' => $request->boolean('enabled', true),
@@ -275,8 +275,12 @@ class VolumeBackupsController extends Controller
             'retention_amount_s3' => $request->integer('retention_amount_s3', 7),
             'retention_days_s3' => $request->integer('retention_days_s3'),
             'retention_max_storage_s3' => $request->float('retention_max_storage_s3'),
-            'timeout' => $request->integer('timeout', ScheduledVolumeBackup::DEFAULT_TIMEOUT),
-        ]);
+        ];
+        if ($request->has('timeout')) {
+            $attributes['timeout'] = $request->integer('timeout');
+        }
+
+        $backup = $storage->scheduledBackups()->updateOrCreate([], $attributes);
         $created = $backup->wasRecentlyCreated;
 
         auditLog('api.volume_backup.schedule_set', [
diff --git a/tests/Feature/Api/VolumeBackupScheduleApiTest.php b/tests/Feature/Api/VolumeBackupScheduleApiTest.php
index 4f4bc395bf..e60f2919da 100644
--- a/tests/Feature/Api/VolumeBackupScheduleApiTest.php
+++ b/tests/Feature/Api/VolumeBackupScheduleApiTest.php
@@ -130,6 +130,7 @@ it('updates the existing backup schedule instead of creating another one', funct
         'save_s3' => true,
         'disable_local_backup' => true,
         's3_storage_id' => $this->s3Storage->id,
+        'timeout' => 7200,
     ]);
 
     $response = $this->withHeaders($this->headers)
@@ -146,7 +147,8 @@ it('updates the existing backup schedule instead of creating another one', funct
         ->and($backup->enabled)->toBeFalse()
         ->and($backup->save_s3)->toBeFalse()
         ->and($backup->disable_local_backup)->toBeFalse()
-        ->and($backup->s3_storage_id)->toBeNull();
+        ->and($backup->s3_storage_id)->toBeNull()
+        ->and($backup->timeout)->toBe(7200);
 });
 
 it('sets a directory backup schedule through the API', function () {

From 8170798115427b59c068167b5caa50b30a7cf779 Mon Sep 17 00:00:00 2001
From: Helge Sverre <helge.sverre@gmail.com>
Date: Tue, 18 Aug 2026 16:01:17 +0200
Subject: [PATCH 42/42] fix(security): enforce team-scoped authorization for
 scheduled tasks (#11239)

Co-authored-by: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
---
 .../Shared/ScheduledTask/Executions.php       |   4 +-
 .../Project/Shared/ScheduledTask/Show.php     |   7 +
 app/Policies/ScheduledTaskPolicy.php          |  70 ++++++++++
 app/Providers/AuthServiceProvider.php         |   5 +
 .../ScheduledTaskCrossTeamIdorTest.php        | 125 ++++++++++++++++++
 5 files changed, 210 insertions(+), 1 deletion(-)
 create mode 100644 app/Policies/ScheduledTaskPolicy.php
 create mode 100644 tests/Feature/ScheduledTaskCrossTeamIdorTest.php

diff --git a/app/Livewire/Project/Shared/ScheduledTask/Executions.php b/app/Livewire/Project/Shared/ScheduledTask/Executions.php
index ca2bbd9b45..e95fd2f5a1 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Executions.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Executions.php
@@ -10,6 +10,7 @@ use Livewire\Component;
 
 class Executions extends Component
 {
+    #[Locked]
     public ScheduledTask $task;
 
     #[Locked]
@@ -28,6 +29,7 @@ class Executions extends Component
 
     public $logsPerPage = 100;
 
+    #[Locked]
     public $selectedExecution = null;
 
     public $isPollingActive = false;
@@ -45,7 +47,7 @@ class Executions extends Component
     {
         try {
             $this->taskId = $taskId;
-            $this->task = ScheduledTask::findOrFail($taskId);
+            $this->task = ScheduledTask::where('team_id', Auth::user()->currentTeam()->id)->findOrFail($taskId);
             $this->executions = $this->task->executions()->take(20)->get();
             $this->serverTimezone = data_get($this->task, 'application.destination.server.settings.server_timezone');
             if (! $this->serverTimezone) {
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 882737f09b..11df001531 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -15,8 +15,10 @@ class Show extends Component
 {
     use AuthorizesRequests;
 
+    #[Locked]
     public Application|Service $resource;
 
+    #[Locked]
     public ScheduledTask $task;
 
     #[Locked]
@@ -115,6 +117,7 @@ class Show extends Component
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('update', $this->task);
             $this->isEnabled = ! $this->isEnabled;
             $this->task->enabled = $this->isEnabled;
             $this->task->save();
@@ -128,6 +131,7 @@ class Show extends Component
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('update', $this->task);
             $this->syncData(true);
             $this->dispatch('success', 'Scheduled task updated.');
             $this->refreshTasks();
@@ -140,6 +144,7 @@ class Show extends Component
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('update', $this->task);
             $this->syncData(true);
             $this->dispatch('success', 'Scheduled task updated.');
         } catch (\Exception $e) {
@@ -160,6 +165,7 @@ class Show extends Component
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('delete', $this->task);
             $this->task->delete();
 
             if ($this->type === 'application') {
@@ -176,6 +182,7 @@ class Show extends Component
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('update', $this->task);
             ScheduledTaskJob::dispatch($this->task);
             $this->dispatch('success', 'Scheduled task executed.');
         } catch (\Exception $e) {
diff --git a/app/Policies/ScheduledTaskPolicy.php b/app/Policies/ScheduledTaskPolicy.php
new file mode 100644
index 0000000000..fac7e7b228
--- /dev/null
+++ b/app/Policies/ScheduledTaskPolicy.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\ScheduledTask;
+use App\Models\User;
+use Illuminate\Auth\Access\Response;
+
+class ScheduledTaskPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, ScheduledTask $scheduledTask): bool
+    {
+        return $user->teams->contains('id', $scheduledTask->team_id);
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, ScheduledTask $scheduledTask): Response
+    {
+        if (! $user->isAdminOfTeam($scheduledTask->team_id)) {
+            return Response::deny('You need at least admin or owner permissions to update this scheduled task.');
+        }
+
+        return Response::allow();
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, ScheduledTask $scheduledTask): bool
+    {
+        return $user->isAdminOfTeam($scheduledTask->team_id);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, ScheduledTask $scheduledTask): bool
+    {
+        return false;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, ScheduledTask $scheduledTask): bool
+    {
+        return false;
+    }
+}
diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index 0adf9e2329..09b2a3e089 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -19,6 +19,7 @@ use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\PushoverNotificationSettings;
 use App\Models\S3Storage;
+use App\Models\ScheduledTask;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -56,6 +57,7 @@ use App\Policies\PrivateKeyPolicy;
 use App\Policies\ProjectPolicy;
 use App\Policies\ResourceCreatePolicy;
 use App\Policies\S3StoragePolicy;
+use App\Policies\ScheduledTaskPolicy;
 use App\Policies\ServerPolicy;
 use App\Policies\ServiceApplicationPolicy;
 use App\Policies\ServiceDatabasePolicy;
@@ -118,6 +120,9 @@ class AuthServiceProvider extends ServiceProvider
         // S3 storage policy
         S3Storage::class => S3StoragePolicy::class,
 
+        // Scheduled task policy
+        ScheduledTask::class => ScheduledTaskPolicy::class,
+
         // Team policy
         Team::class => TeamPolicy::class,
 
diff --git a/tests/Feature/ScheduledTaskCrossTeamIdorTest.php b/tests/Feature/ScheduledTaskCrossTeamIdorTest.php
new file mode 100644
index 0000000000..b250db119b
--- /dev/null
+++ b/tests/Feature/ScheduledTaskCrossTeamIdorTest.php
@@ -0,0 +1,125 @@
+<?php
+
+use App\Livewire\Project\Shared\ScheduledTask\Executions;
+use App\Livewire\Project\Shared\ScheduledTask\Show;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Gate;
+use Livewire\Attributes\Locked;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->attacker = User::factory()->create();
+    $this->attackerTeam = Team::factory()->create();
+    $this->attacker->teams()->attach($this->attackerTeam, ['role' => 'owner']);
+
+    $this->victim = User::factory()->create();
+    $this->victimTeam = Team::factory()->create();
+    $this->victim->teams()->attach($this->victimTeam, ['role' => 'owner']);
+
+    // Attacker team gets a real server/project/env/app so Show can mount + authorize
+    $this->server = Server::factory()->create(['team_id' => $this->attackerTeam->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->attackerTeam->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->attacker);
+    session(['currentTeam' => $this->attackerTeam]);
+});
+
+describe('ScheduledTask locked properties', function () {
+    test('Show component task property has Locked attribute', function () {
+        $property = new ReflectionProperty(Show::class, 'task');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('Show component resource property has Locked attribute', function () {
+        $property = new ReflectionProperty(Show::class, 'resource');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('Executions component task property has Locked attribute', function () {
+        $property = new ReflectionProperty(Executions::class, 'task');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('Executions component selected execution property has Locked attribute', function () {
+        $property = new ReflectionProperty(Executions::class, 'selectedExecution');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+});
+
+describe('ScheduledTask cross-team access', function () {
+    test('Executions rejects mounting another team task id', function () {
+        $victimTask = ScheduledTask::factory()->create([
+            'team_id' => $this->victimTeam->id,
+            'command' => 'echo top-secret-victim-command',
+        ]);
+
+        Livewire::test(Executions::class, ['taskId' => $victimTask->id])
+            ->assertStatus(404);
+    });
+
+    test('Show policy denies updating another team task', function () {
+        $victimTask = ScheduledTask::factory()->create([
+            'team_id' => $this->victimTeam->id,
+            'name' => 'victim-task',
+            'command' => 'echo original-victim-command',
+        ]);
+
+        expect(
+            Gate::forUser($this->attacker)->allows('update', $victimTask)
+        )->toBeFalse();
+    });
+
+    test('Show policy denies deleting another team task', function () {
+        $victimTask = ScheduledTask::factory()->create([
+            'team_id' => $this->victimTeam->id,
+            'name' => 'victim-task',
+            'command' => 'echo original-victim-command',
+        ]);
+
+        expect(
+            Gate::forUser($this->attacker)->allows('delete', $victimTask)
+        )->toBeFalse();
+    });
+
+    test('Show policy allows updating own team task', function () {
+        $ownTask = ScheduledTask::factory()->create([
+            'team_id' => $this->attackerTeam->id,
+            'application_id' => $this->application->id,
+            'name' => 'own-task',
+            'command' => 'echo original-command',
+        ]);
+
+        expect(
+            Gate::forUser($this->attacker)->allows('update', $ownTask)
+        )->toBeTrue();
+    });
+});