Merge remote-tracking branch 'origin/next' into coolify-analytics-traefik-caddy

# Conflicts:
#	app/Models/ServerSetting.php
#	package-lock.json
#	package.json
#	resources/views/components/forms/listbox.blade.php

.env.development.example

@@ -3,7 +3,6 @@ APP_ENV=local
 APP_NAME=Coolify
 APP_ID=development
 APP_KEY=
-COOLIFY_FLUX_LARAVEL_API_TOKEN=development-flux-token
 APP_URL=http://localhost
 APP_PORT=8000
 APP_DEBUG=true

.env.dusk.ci

@@ -2,7 +2,6 @@ APP_ENV=production
 APP_NAME="Coolify Staging"
 APP_ID=development
 APP_KEY=
-COOLIFY_FLUX_LARAVEL_API_TOKEN=test-flux-token
 APP_URL=http://localhost
 APP_PORT=8000
 SSH_MUX_ENABLED=true

.env.testing

@@ -1,7 +1,7 @@
 APP_ENV=testing
 APP_KEY=base64:8VEfVNVkXQ9mH2L33WBWNMF4eQ0BWD5CTzB8mIxcl+k=
-COOLIFY_FLUX_LARAVEL_API_TOKEN=test-flux-token
 APP_DEBUG=true
+APP_MAINTENANCE_DRIVER=file
 
 DB_CONNECTION=testing
 

.github/ISSUE_TEMPLATE/01_BUG_REPORT.yml

@@ -8,6 +8,8 @@ body:
       value: |
         > [!IMPORTANT]
         > **Please ensure you are using the latest version of Coolify before submitting an issue, as the bug may have already been fixed in a recent update.** (Of course, if you're experiencing an issue on the latest version that wasn't present in a previous version, please let us know.)
+        >
+        > If you plan to submit a fix, branch from `main` and target `main` with your pull request.
 
   - type: textarea
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -7,12 +7,12 @@ contact_links:
 
   - name: 💡 Feature Request
     url: https://github.com/coollabsio/coolify/discussions/categories/feature-requests
-    about: Suggest a new feature for Coolify.
+    about: Suggest a new feature for Coolify. Feature code should branch from `next` and target `next`.
 
   - name: ⚙️ Service Request
     url: https://github.com/coollabsio/coolify/discussions/categories/service-requests
-    about: Request a new service integration for Coolify.
+    about: Request a new service integration for Coolify. Service code should branch from `next` and target `next`.
 
   - name: 🔧 Improvements
     url: https://github.com/coollabsio/coolify/discussions/categories/improvements
-    about: Suggest improvements to existing features for Coolify.
+    about: Suggest improvements to existing features. Small fixes should target `main`; larger changes should target `next`.

.github/pull_request_template.md

@@ -46,6 +46,6 @@
 
 > [!IMPORTANT]
 >
-> - [ ] I have read and understood the [contributor guidelines](https://github.com/coollabsio/coolify/blob/v4.x/CONTRIBUTING.md). If I have failed to follow any guideline, I understand that this PR may be closed without review.
+> - [ ] I have read and understood the [contributor guidelines](https://github.com/coollabsio/coolify/blob/HEAD/CONTRIBUTING.md). If I have failed to follow any guideline, I understand that this PR may be closed without review.
 > - [ ] I have searched [existing issues](https://github.com/coollabsio/coolify/issues) and [pull requests](https://github.com/coollabsio/coolify/pulls) (including closed ones) to ensure this isn't a duplicate.
 > - [ ] I have tested all the changes thoroughly with a local development instance of Coolify and I am confident that they will work as expected when a maintainer tests them.

.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Lock threads after 30 days of inactivity
-        uses: dessant/lock-threads@v5
+        uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-inactive-days: '30'

.github/workflows/chore-manage-pr-branch.yaml

@@ -0,0 +1,182 @@
+name: Manage PR Branch
+
+# Runs *after* the "PR Quality" workflow finishes. This is required because
+# PR Quality may close a PR that fails its checks, so we must wait for it to
+# complete before deciding whether to retarget the PR's base branch.
+on:
+  workflow_run:
+    workflows: ["PR Quality"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: manage-pr-branch-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  manage-branch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Retarget PR base branch based on category
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const run = context.payload.workflow_run;
+
+            // Branch routing based on the "Category" section of the PR body.
+            // Bug fixes and one-click service changes ship in patch releases -> main.
+            // Everything else (features, improvements) -> next.
+            const MAIN_BRANCH = 'main';
+            const NEXT_BRANCH = 'next';
+
+            // Maintainers/collaborators are trusted to pick their own base branch.
+            const EXEMPT_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
+
+            // Resolve the open PR from the triggering run.
+            //
+            // PR Quality runs on `pull_request_target`, so `run.head_sha` is the
+            // *base* branch tip, not the PR head — a commit-based lookup finds
+            // nothing. Instead match on the source branch (`head_branch`) and its
+            // owner (`head_repository.owner.login`), which uniquely identify the PR
+            // via the `owner:branch` head filter. This also works for forked PRs,
+            // where `workflow_run.pull_requests` is empty.
+            const headOwner = run.head_repository?.owner?.login;
+            const headBranch = run.head_branch;
+
+            let prRef;
+            if (headOwner && headBranch) {
+              const { data: openPrs } = await github.rest.pulls.list({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                head: `${headOwner}:${headBranch}`,
+                per_page: 100,
+              });
+              prRef = openPrs[0];
+            }
+
+            // Fallback: same-repo PRs may also be resolvable by commit association.
+            if (!prRef) {
+              const { data: associated } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                commit_sha: run.head_sha,
+              });
+              prRef = associated.find(pr => pr.state === 'open');
+            }
+
+            if (!prRef) {
+              core.info('No open PR associated with this run (possibly closed by PR Quality). Skipping.');
+              return;
+            }
+
+            // Fetch the full PR to get an up-to-date body, base ref, and state.
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prRef.number,
+            });
+
+            if (pr.state !== 'open') {
+              core.info(`PR #${pr.number} is not open. Skipping.`);
+              return;
+            }
+
+            // Skip PRs opened by owners/members/collaborators — they choose their own base.
+            if (EXEMPT_ASSOCIATIONS.has(pr.author_association)) {
+              core.info(`PR #${pr.number} author association is ${pr.author_association}. Skipping.`);
+              return;
+            }
+
+            // Skip if a maintainer has already changed the base branch manually.
+            const timeline = await github.paginate(github.rest.issues.listEventsForTimeline, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              per_page: 100,
+            });
+
+            const baseChanges = timeline.filter(e => e.event === 'base_ref_changed');
+            for (const change of baseChanges) {
+              const actor = change.actor?.login;
+              if (!actor) {
+                continue;
+              }
+              try {
+                const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  username: actor,
+                });
+                // admin/maintain/write => trusted maintainer.
+                if (['admin', 'maintain', 'write'].includes(perm.permission)) {
+                  core.info(`Base branch was changed manually by ${actor} (${perm.permission}). Skipping.`);
+                  return;
+                }
+              } catch (error) {
+                core.info(`Could not resolve permission for ${actor}: ${error.message}`);
+              }
+            }
+
+            // Parse the checked category checkboxes from the PR body.
+            const body = pr.body ?? '';
+            const checked = [];
+            const checkboxRegex = /^\s*-\s*\[([ xX])\]\s*(.+?)\s*$/gm;
+            let match;
+            while ((match = checkboxRegex.exec(body)) !== null) {
+              if (match[1].toLowerCase() === 'x') {
+                checked.push(match[2].toLowerCase());
+              }
+            }
+
+            const includesAny = (labels) => labels.some(label => checked.some(c => c.includes(label)));
+
+            const mainCategories = ['bug fix', 'adding new one click service', 'fixing or updating existing one click service'];
+            const nextCategories = ['improvement', 'new feature'];
+
+            const wantsMain = includesAny(mainCategories);
+            const wantsNext = includesAny(nextCategories);
+
+            if (!wantsMain && !wantsNext) {
+              core.info('No category selected in the PR body. Skipping.');
+              return;
+            }
+
+            // If categories from both groups are checked, prefer next: features and
+            // improvements can only be released from the development branch.
+            const targetBranch = wantsNext ? NEXT_BRANCH : MAIN_BRANCH;
+
+            if (pr.base.ref === targetBranch) {
+              core.info(`PR #${pr.number} already targets ${targetBranch}. Nothing to do.`);
+              return;
+            }
+
+            const previousBranch = pr.base.ref;
+
+            await github.rest.pulls.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+              base: targetBranch,
+            });
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              body: [
+                `Based on the selected category, this PR's base branch was automatically changed from \`${previousBranch}\` to \`${targetBranch}\`.`,
+                '',
+                targetBranch === MAIN_BRANCH
+                  ? 'Bug fixes and one-click service changes target `main`.'
+                  : 'New features and improvements target `next`.',
+                '',
+                'If you believe this is incorrect, please let a maintainer know.',
+              ].join('\n'),
+            });
+
+            core.info(`Retargeted PR #${pr.number}: ${previousBranch} -> ${targetBranch}.`);

.github/workflows/coolify-helper.yml

@@ -2,7 +2,7 @@ name: Coolify Helper Image
 
 on:
   push:
-    branches: [ "v4.x", "main" ]
+    branches: [ "main" ]
     paths:
       - .github/workflows/coolify-helper.yml
       - docker/coolify-helper/Dockerfile
@@ -16,8 +16,53 @@ env:
   DOCKER_REGISTRY: docker.io
   IMAGE_NAME: "coollabsio/coolify-helper"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  check-version:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Ensure version is not published
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getHelperVersion.php)
+          VERSION="${BASE_VERSION}"
+          for registry in "${DOCKER_REGISTRY}" "${GITHUB_REGISTRY}"; do
+            IMAGE="${registry}/${IMAGE_NAME}:${VERSION}"
+            if output=$(docker buildx imagetools inspect "$IMAGE" 2>&1); then
+              echo "::error::Version $VERSION already exists in $registry"
+              exit 1
+            fi
+            if ! grep -Eqi 'manifest unknown|not found|no such manifest' <<< "$output"; then
+              echo "::error::Could not verify $IMAGE: $output"
+              exit 1
+            fi
+          done
+          echo "Version $VERSION is available in both registries"
+
   build-push:
+    needs: check-version
     strategy:
       matrix:
         include:

.github/workflows/coolify-next-build.yml

@@ -0,0 +1,152 @@
+name: Build Coolify Next
+
+on:
+  push:
+    branches: [next]
+    paths-ignore:
+      - .github/workflows/coolify-helper.yml
+      - .github/workflows/coolify-helper-next.yml
+      - .github/workflows/coolify-realtime.yml
+      - .github/workflows/coolify-realtime-next.yml
+      - .github/workflows/pr-quality.yaml
+      - docker/coolify-helper/Dockerfile
+      - docker/coolify-realtime/Dockerfile
+      - docker/testing-host/Dockerfile
+      - templates/**
+      - CHANGELOG.md
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: coolify-next-build
+  cancel-in-progress: false
+
+env:
+  GITHUB_REGISTRY: ghcr.io
+  DOCKER_REGISTRY: docker.io
+  IMAGE_NAME: coollabsio/coolify
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04
+    outputs:
+      rc_version: ${{ steps.version.outputs.rc_version }}
+      short_sha: ${{ steps.version.outputs.short_sha }}
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Resolve next version
+        id: version
+        run: |
+          RC_VERSION=$(jq -r '.coolify.nightly.version' versions.json)
+          if [[ ! "${RC_VERSION}" =~ ^[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
+            echo "Invalid next RC version: ${RC_VERSION}"
+            exit 1
+          fi
+
+          SHORT_SHA="${GITHUB_SHA::7}"
+          VERSION="${RC_VERSION}.${SHORT_SHA}"
+          echo "rc_version=${RC_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: prepare
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            platform: linux/aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push next image (${{ matrix.arch }})
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/production/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          build-args: |
+            COOLIFY_VERSION=${{ needs.prepare.outputs.version }}
+          tags: |
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:next-build-${{ needs.prepare.outputs.short_sha }}-${{ matrix.arch }}
+            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:next-build-${{ needs.prepare.outputs.short_sha }}-${{ matrix.arch }}
+
+  publish:
+    needs: [prepare, build]
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Publish next manifest on ${{ env.GITHUB_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.GITHUB_REGISTRY }}
+          SHA: ${{ needs.prepare.outputs.short_sha }}
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SOURCE="next-build-${SHA}"
+          docker buildx imagetools create \
+            "${IMAGE}:${SOURCE}-amd64" \
+            "${IMAGE}:${SOURCE}-aarch64" \
+            --tag "${IMAGE}:sha-${SHA}" \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:next"
+
+      - name: Publish next manifest on ${{ env.DOCKER_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.DOCKER_REGISTRY }}
+          SHA: ${{ needs.prepare.outputs.short_sha }}
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SOURCE="next-build-${SHA}"
+          docker buildx imagetools create \
+            "${IMAGE}:${SOURCE}-amd64" \
+            "${IMAGE}:${SOURCE}-aarch64" \
+            --tag "${IMAGE}:sha-${SHA}" \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:next"

.github/workflows/coolify-rc-release.yml

@@ -0,0 +1,304 @@
+name: Release Coolify RC
+run-name: ${{ inputs.tag }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing draft prerelease tag (for example, v4.4-rc.1)
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: coolify-rc-release
+  cancel-in-progress: false
+
+env:
+  GITHUB_REGISTRY: ghcr.io
+  DOCKER_REGISTRY: docker.io
+  IMAGE_NAME: coollabsio/coolify
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    outputs:
+      release_id: ${{ steps.draft.outputs.release_id }}
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Reject releases outside next
+        if: ${{ github.ref != 'refs/heads/next' }}
+        run: |
+          echo "RC releases must run from the next branch, not ${{ github.ref }}."
+          exit 1
+
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Validate version
+        id: version
+        env:
+          TAG_NAME: ${{ inputs.tag }}
+        run: |
+          if [[ ! "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
+            echo "Unsupported RC tag: ${TAG_NAME}"
+            exit 1
+          fi
+
+          VERSION="${TAG_NAME#v}"
+          CONFIG_VERSION=$(jq -r '.coolify.nightly.version' versions.json)
+          if [[ "${CONFIG_VERSION}" != "${VERSION}" ]]; then
+            echo "RC tag ${VERSION} does not match nightly version ${CONFIG_VERSION}."
+            exit 1
+          fi
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate and pin draft prerelease
+        id: draft
+        uses: actions/github-script@v8
+        env:
+          TAG_NAME: ${{ inputs.tag }}
+        with:
+          script: |
+            const releases = await github.paginate(github.rest.repos.listReleases, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              per_page: 100,
+            });
+            const release = releases.find((candidate) => candidate.tag_name === process.env.TAG_NAME);
+
+            if (!release) {
+              core.setFailed(`Create a draft prerelease for ${process.env.TAG_NAME} before running this workflow.`);
+              return;
+            }
+            if (!release.draft) {
+              core.setFailed(`Release ${process.env.TAG_NAME} must still be a draft.`);
+              return;
+            }
+            if (!release.prerelease) {
+              core.setFailed(`RC release ${process.env.TAG_NAME} must be marked as a prerelease.`);
+              return;
+            }
+            if (!release.body?.trim()) {
+              core.setFailed(`Draft prerelease ${process.env.TAG_NAME} must contain reviewed release notes.`);
+              return;
+            }
+
+            try {
+              await github.rest.git.getRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `tags/${process.env.TAG_NAME}`,
+              });
+              core.setFailed(`Git tag ${process.env.TAG_NAME} already exists.`);
+              return;
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+
+            await github.rest.repos.updateRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: release.id,
+              tag_name: process.env.TAG_NAME,
+              target_commitish: context.sha,
+              prerelease: true,
+            });
+            core.setOutput('release_id', release.id);
+
+  build:
+    needs: validate
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            platform: linux/aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push RC image (${{ matrix.arch }})
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/production/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          build-args: |
+            COOLIFY_VERSION=${{ needs.validate.outputs.version }}
+          tags: |
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:rc-release-${{ needs.validate.outputs.version }}-${{ github.sha }}-${{ matrix.arch }}
+            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:rc-release-${{ needs.validate.outputs.version }}-${{ github.sha }}-${{ matrix.arch }}
+
+  revalidate:
+    needs: [validate, build]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - name: Revalidate draft prerelease
+        uses: actions/github-script@v8
+        env:
+          RELEASE_ID: ${{ needs.validate.outputs.release_id }}
+          TAG_NAME: ${{ inputs.tag }}
+        with:
+          script: |
+            const releaseId = Number(process.env.RELEASE_ID);
+            const { data: release } = await github.rest.repos.getRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: releaseId,
+            });
+
+            if (release.tag_name !== process.env.TAG_NAME || !release.draft || !release.prerelease) {
+              core.setFailed(`Draft prerelease ${process.env.TAG_NAME} changed while the images were building.`);
+              return;
+            }
+            if (!release.body?.trim()) {
+              core.setFailed(`Draft prerelease ${process.env.TAG_NAME} no longer contains release notes.`);
+              return;
+            }
+            if (release.target_commitish !== context.sha) {
+              core.setFailed(`Draft prerelease ${process.env.TAG_NAME} no longer targets ${context.sha}.`);
+              return;
+            }
+
+            try {
+              await github.rest.git.getRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `tags/${process.env.TAG_NAME}`,
+              });
+              core.setFailed(`Git tag ${process.env.TAG_NAME} was created while the images were building.`);
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+
+  publish:
+    needs: [validate, build, revalidate]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Publish RC and next on ${{ env.GITHUB_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.GITHUB_REGISTRY }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SOURCE="rc-release-${VERSION}-${GITHUB_SHA}"
+          docker buildx imagetools create \
+            "${IMAGE}:${SOURCE}-amd64" \
+            "${IMAGE}:${SOURCE}-aarch64" \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:next"
+
+      - name: Publish RC and next on ${{ env.DOCKER_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.DOCKER_REGISTRY }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SOURCE="rc-release-${VERSION}-${GITHUB_SHA}"
+          docker buildx imagetools create \
+            "${IMAGE}:${SOURCE}-amd64" \
+            "${IMAGE}:${SOURCE}-aarch64" \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:next"
+
+      - name: Publish reviewed draft prerelease
+        uses: actions/github-script@v8
+        env:
+          RELEASE_ID: ${{ needs.validate.outputs.release_id }}
+          TAG_NAME: ${{ inputs.tag }}
+        with:
+          script: |
+            const releaseId = Number(process.env.RELEASE_ID);
+            const { data: release } = await github.rest.repos.getRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: releaseId,
+            });
+
+            if (release.tag_name !== process.env.TAG_NAME || !release.draft || !release.prerelease) {
+              core.setFailed(`Draft prerelease ${process.env.TAG_NAME} changed while the images were building.`);
+              return;
+            }
+            if (!release.body?.trim()) {
+              core.setFailed(`Draft prerelease ${process.env.TAG_NAME} no longer contains release notes.`);
+              return;
+            }
+            if (release.target_commitish !== context.sha) {
+              core.setFailed(`Draft prerelease ${process.env.TAG_NAME} no longer targets ${context.sha}.`);
+              return;
+            }
+
+            try {
+              await github.rest.git.getRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `tags/${process.env.TAG_NAME}`,
+              });
+              core.setFailed(`Git tag ${process.env.TAG_NAME} was created while the images were building.`);
+              return;
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+
+            await github.rest.repos.updateRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: Number(process.env.RELEASE_ID),
+              tag_name: process.env.TAG_NAME,
+              target_commitish: context.sha,
+              prerelease: true,
+              draft: false,
+            });

.github/workflows/coolify-realtime.yml

@@ -2,7 +2,7 @@ name: Coolify Realtime
 
 on:
   push:
-    branches: [ "v4.x", "main" ]
+    branches: [ "main" ]
     paths:
       - .github/workflows/coolify-realtime.yml
       - docker/coolify-realtime/**
@@ -16,8 +16,53 @@ env:
   DOCKER_REGISTRY: docker.io
   IMAGE_NAME: "coollabsio/coolify-realtime"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  check-version:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Ensure version is not published
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getRealtimeVersion.php)
+          VERSION="${BASE_VERSION}"
+          for registry in "${DOCKER_REGISTRY}" "${GITHUB_REGISTRY}"; do
+            IMAGE="${registry}/${IMAGE_NAME}:${VERSION}"
+            if output=$(docker buildx imagetools inspect "$IMAGE" 2>&1); then
+              echo "::error::Version $VERSION already exists in $registry"
+              exit 1
+            fi
+            if ! grep -Eqi 'manifest unknown|not found|no such manifest' <<< "$output"; then
+              echo "::error::Could not verify $IMAGE: $output"
+              exit 1
+            fi
+          done
+          echo "Version $VERSION is available in both registries"
+
   build-push:
+    needs: check-version
     strategy:
       matrix:
         include:

.github/workflows/coolify-release.yml

@@ -1,4 +1,5 @@
 name: Release Coolify Stable
+run-name: ${{ inputs.tag }}
 
 on:
   workflow_dispatch:
@@ -22,17 +23,16 @@ env:
 jobs:
   validate:
     runs-on: ubuntu-24.04
-    environment: production-release
     permissions:
       contents: write
     outputs:
       release_id: ${{ steps.draft.outputs.release_id }}
       version: ${{ steps.version.outputs.version }}
     steps:
-      - name: Reject releases outside v4.x
-        if: ${{ github.ref_name != 'v4.x' }}
+      - name: Reject releases outside the production branch
+        if: ${{ github.ref_name != 'main' }}
         run: |
-          echo "Fix releases must run from v4.x, not ${{ github.ref_name }}."
+          echo "Stable releases must run from main, not ${{ github.ref_name }}."
           exit 1
 
       - uses: actions/checkout@v5

.github/workflows/coolify-sha-build.yml

@@ -2,7 +2,7 @@ name: Build Coolify (SHA)
 
 on:
   push:
-    branches: ["v4.x"]
+    branches: ["main"]
 
 permissions:
   contents: read
@@ -15,6 +15,8 @@ env:
 
 jobs:
   build-push:
+    outputs:
+      short_sha: ${{ steps.version.outputs.short_sha }}
     strategy:
       matrix:
         include:
@@ -35,6 +37,7 @@ jobs:
         run: |
           BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)
           echo "version=${BASE_VERSION}-dev.${GITHUB_SHA::9}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
@@ -60,8 +63,8 @@ jobs:
           build-args: |
             COOLIFY_VERSION=${{ steps.version.outputs.version }}
           tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}-${{ matrix.arch }}
+            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ steps.version.outputs.short_sha }}-${{ matrix.arch }}
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ steps.version.outputs.short_sha }}-${{ matrix.arch }}
 
   merge-manifest:
     runs-on: ubuntu-24.04
@@ -86,7 +89,7 @@ jobs:
       - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
         env:
           REGISTRY: ${{ env.GITHUB_REGISTRY }}
-          SHA: ${{ github.sha }}
+          SHA: ${{ needs.build-push.outputs.short_sha }}
         run: |
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
           docker buildx imagetools create \
@@ -97,7 +100,7 @@ jobs:
       - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
         env:
           REGISTRY: ${{ env.DOCKER_REGISTRY }}
-          SHA: ${{ github.sha }}
+          SHA: ${{ needs.build-push.outputs.short_sha }}
         run: |
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
           docker buildx imagetools create \

.github/workflows/coolify-staging-build.yml

@@ -1,134 +0,0 @@
-name: Staging Build
-
-on:
-  push:
-    branches-ignore:
-      - v4.x
-      - v3.x
-      - '**v5.x**'
-    paths-ignore:
-        - .github/workflows/coolify-helper.yml
-        - .github/workflows/coolify-helper-next.yml
-        - .github/workflows/coolify-realtime.yml
-        - .github/workflows/coolify-realtime-next.yml
-        - .github/workflows/pr-quality.yaml
-        - docker/coolify-helper/Dockerfile
-        - docker/coolify-realtime/Dockerfile
-        - docker/testing-host/Dockerfile
-        - templates/**
-        - CHANGELOG.md
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  GITHUB_REGISTRY: ghcr.io
-  DOCKER_REGISTRY: docker.io
-  IMAGE_NAME: "coollabsio/coolify"
-
-jobs:
-  build-push:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-24.04
-          - arch: aarch64
-            platform: linux/aarch64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Sanitize branch name for Docker tag
-        id: sanitize
-        run: |
-          # Replace slashes and other invalid characters with dashes
-          SANITIZED_NAME=$(echo "${{ github.ref_name }}" | sed 's/[\/]/-/g')
-          echo "tag=${SANITIZED_NAME}" >> $GITHUB_OUTPUT
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Build and Push Image (${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/production/Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-${{ matrix.arch }}
-          cache-from: |
-            type=gha,scope=build-${{ matrix.arch }}
-            type=registry,ref=${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=build-${{ matrix.arch }}
-
-  merge-manifest:
-    runs-on: ubuntu-24.04
-    needs: build-push
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Sanitize branch name for Docker tag
-        id: sanitize
-        run: |
-          # Replace slashes and other invalid characters with dashes
-          SANITIZED_NAME=$(echo "${{ github.ref_name }}" | sed 's/[\/]/-/g')
-          echo "tag=${SANITIZED_NAME}" >> $GITHUB_OUTPUT
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
-        run: |
-         docker buildx imagetools create \
-         ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-amd64 \
-         ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-aarch64 \
-         --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}
-
-      - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_DEV_RELEASE_CHANNEL  }}

.github/workflows/generate-changelog.yml

@@ -2,7 +2,7 @@ name: Generate Changelog
 
 on:
   push:
-    branches: [ v4.x ]
+    branches: [ main ]
     paths-ignore:
       - .github/workflows/coolify-helper.yml
       - .github/workflows/coolify-helper-next.yml

.github/workflows/pr-quality.yaml

@@ -19,13 +19,10 @@ jobs:
           max-failures: 4
 
           # PR Branch Checks
-          allowed-target-branches: "next"
+          allowed-target-branches: ""
           blocked-target-branches: ""
           allowed-source-branches: ""
-          blocked-source-branches: |
-            main
-            master
-            v4.x
+          blocked-source-branches: ""
 
           # PR Quality Checks
           max-negative-reactions: 0

.github/workflows/sync-main-to-next.yml

@@ -0,0 +1,60 @@
+name: Sync main to next
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: sync-main-to-next
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    name: Merge main into next
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout next
+        uses: actions/checkout@v5
+        with:
+          ref: next
+          fetch-depth: 0
+
+      - name: Merge main into next
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git fetch origin main next
+
+          if git merge --no-edit origin/main; then
+            git push origin HEAD:next
+            exit 0
+          fi
+
+          conflicts=$(git diff --name-only --diff-filter=U)
+          git merge --abort
+
+          if [ -z "$conflicts" ]; then
+            echo 'The merge failed without conflicts, so no pull request was created.'
+            exit 1
+          fi
+
+          existing_pr=$(gh pr list --base next --head main --state open --json url --jq '.[0].url')
+          if [ -n "$existing_pr" ]; then
+            echo "A main to next pull request already exists: $existing_pr"
+          else
+            gh pr create \
+              --base next \
+              --head main \
+              --title 'chore: merge main into next' \
+              --body 'This pull request was created automatically because main could not be merged into next without conflicts.'
+          fi
+
+          echo 'main could not be merged into next without conflicts.'
+          exit 1

.gitignore

@@ -39,6 +39,7 @@ docker/coolify-realtime/node_modules
 CHANGELOG.md
 /.workspaces
 /.superpowers/
+/docs/superpowers/plans/
 tests/Browser/Screenshots
 tests/v4/Browser/Screenshots
 ref

AGENTS.md

@@ -16,8 +16,8 @@ Docker Compose-based dev setup with services: coolify (app), postgres, redis, so
 
 ```bash
 # Start dev environment (uses docker-compose.dev.yml)
-spin up                          # or: docker compose -f docker-compose.dev.yml up -d
-spin down                        # stop services
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
+docker compose -f docker-compose.yml -f docker-compose.dev.yml down                        # stop services
 
 # Two local Coolify instances (isolated stacks; server transfer / multi-control-plane)
 ./scripts/dev-instances up                   # a:8000 + b:8001 (uses npm run build for CSS/JS)
@@ -30,6 +30,25 @@ spin down                        # stop services
 
 The app runs at `localhost:8000` by default. Instance **b** is on `8001` (db `5433`, redis `6380`, …); see `./scripts/dev-instances`.
 
+## Testing the Self-Hosted Upgrade Process
+
+Use the following workflow to test a self-hosted upgrade:
+
+1. Install the source version with the upgrade script:
+
+   ```bash
+   bash upgrade.sh sha-6492d081362c009519481ac70e50873e39ba1861
+   ```
+
+2. Set the current Coolify version and rebuild the cached configuration:
+
+   ```bash
+   docker exec -e COOLIFY_VERSION=4.3.0 coolify php artisan config:cache
+   ```
+
+3. In the Coolify UI, click **Check for Updates**.
+4. Confirm that an upgrade is available, then click **Upgrade** and verify that the upgrade completes successfully.
+
 ## Common Commands
 
 ```bash
@@ -122,6 +141,23 @@ function loginAsRoot(): mixed
 - **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
 - **Proxy** — Traefik reverse proxy managed per server.
 
+### Instance sentinels (`id = 0`)
+
+Coolify seeds **instance-owned** rows at primary key `0`. That value is a sentinel meaning “this is the Coolify instance itself”, not a normal autoincrement id. Do not migrate, resequence, or “fix” these to a positive id.
+
+| Record | Model / lookup | Meaning |
+|---|---|---|
+| Root team | `Team::find(0)`, `team_id === 0` | Instance / root team. Cloud billing and many skip-checks exempt `team_id === 0`. |
+| Localhost server | `Server::find(0)` / `findOrFail(0)` | The machine running Coolify. Upgrades, instance backups, and docker inspect target this server. |
+| Instance settings | `InstanceSettings` with `id = 0` | Singleton settings row. Tests must seed `InstanceSettings::create(['id' => 0])` (or `forceCreate`). |
+| Instance Postgres | `StandalonePostgresql` `id = 0`, name `coolify-db` | Coolify’s own database. UI treats `database_id === 0` as the instance DB (e.g. hide delete on backup screens). |
+| Local docker dest | `StandaloneDocker` `id = 0` | Destination on the localhost server (`destination_id = 0`). |
+| Root user / default GitHub App | seeders | First-install defaults. |
+
+**Do not assign `id = 0` to new or non-instance rows.** In particular, `ScheduledDatabaseBackup` and `ScheduledTask` are ordinary schedules. Legacy installs may still have a `coolify-db` backup at `id = 0`; resolve that backup via the `coolify-db` relation / uuid, not `ScheduledDatabaseBackup::find(0)`.
+
+`0` is a PHP/Eloquent landmine (`empty(0)` is true; keyset pagination `where('id', '>', $cursor)` starting at `0` skips the row). Queries that page by id must include `id = 0` on the first page (no lower bound, or cursor `< 0`). Prefer `chunkById()` over a hand-rolled `id > 0` cursor.
+
 ### Frontend
 - Livewire 3 components with Alpine.js for client-side interactivity
 - Blade templates in `resources/views/livewire/`
@@ -143,12 +179,13 @@ function loginAsRoot(): mixed
 - Run `vendor/bin/pint --dirty --format agent` before finalizing changes
 - Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
 - Check sibling files for conventions before creating new files
+- When adding remote shell commands, account for servers using non-root SSH users: commands pass through `parseCommandsByLineForSudo()`, so test pipelines, redirects, substitutions, and `sh -c`/`bash -c` scripts with the non-root sudo parser.
 
 ## Git Workflow
 
-- Main branch: `v4.x`
+- Production branch: `main`
 - Development branch: `next`
-- PRs should target `v4.x`
+- Fix PRs should target the current production branch; feature PRs should target `next`
 
 <laravel-boost-guidelines>
 === foundation rules ===

CONTRIBUTING.md

@@ -32,9 +32,7 @@ Coolify is currently at v4. While v4 is stable, it has some limitations, includi
 - A more complex user experience
 - Other smaller issues that need refinement
 
-These limitations will be addressed in Coolify v5, which is in the planning stage. Because of this, major features, architectural changes, or significant UI changes will not be accepted for v4 at this stage.
-
-We welcome contributions that help stabilize v4 for a bug free experience.
+These limitations will be addressed over time. Fixes and small improvements are accepted on the production line. New features and larger changes require prior discussion and must go through the development line.
 
 
 ## What Makes a Strong Contribution
@@ -188,8 +186,19 @@ If maintainers cannot reproduce working behavior, the PR will be closed without
 - GitHub will auto-populate the PR template
 - The contributor agreement in PR description must remain intact
 - Pull requests without the contributor agreement will be closed
-- All pull requests must target the `next` branch
-- PRs targeting other branches will be closed without review
+
+Choose the branch based on the type of change:
+
+| Change | Start from | Pull request target |
+| --- | --- | --- |
+| Fixes and small improvements | `main` | `main` |
+| Security fixes | `main` | `main` |
+| New features and larger changes | `next` | `next` |
+
+- For a fix, branch from `main` and target `main`.
+- For a feature, branch from `next` and target `next`.
+- If a fix is discovered while developing a feature, submit it separately to `main`. Maintainers will merge `main` into `next` so the fix is included there too.
+- Pull requests targeting the wrong branch may be closed or asked to retarget.
 
 
 ## FAQ

DESIGN.md

@@ -154,6 +154,21 @@ topbar instead of repeating its name or status summary in layer 2. Mobile
 resource navigation may repeat this context because the desktop global topbar
 is hidden there.
 
+Desktop resource lifecycle actions dock in `#resource-action-hud-slot` and
+use `<x-resource-heading-overflow>`. Show primary actions (Deploy, Redeploy,
+Restart, Stop) as sibling header buttons. Collapse that group into an Actions
+dropdown only when the remaining top-bar width cannot fit them (breadcrumb
+keeps a 200px floor). Infrequent operations live in a separate Advanced
+dropdown with the grid icon: force restart / force deploy / force cleanup
+on services, and Traefik dashboard / refresh proxy status on servers. Place
+Advanced immediately after Links, or first in the action cluster when there
+is no Links control. Application Deploy is a dropdown with Deploy and
+Deploy (without cache). A running service Restart control is a dropdown with
+Restart current version and Pull latest and restart. Mobile
+headings keep a full-width Actions dropdown because the desktop HUD is hidden
+below `xl`. Do not hide primary actions behind a menu on a wide desktop. Links
+stay a separate dropdown because the URL list is unbounded.
+
 Only add layer-2 tabs when they represent real sibling routes inside one
 context. Never repeat main-sidebar destinations such as Dashboard, Projects,
 Terminal, Servers, Sources, Destinations, or Storage as a second tab row. A
@@ -162,6 +177,14 @@ primary action in the page header instead. When tabs are useful, their left edge
 uses the same compact `pl-2` alignment as application navigation rather than
 the content container's wide horizontal padding.
 
+A layer-2 tab must be active on the page that renders it. A bar whose only tab
+points at a different route reads as broken navigation, so project and
+environment pages (`project.show`, `project.edit`, `project.environment.edit`,
+`project.clone-me`) carry a plain page header with a 24px title and a 13px
+muted summary instead of a bar. The environment identity and the way back to
+its resources already live in `x-top-breadcrumb`; do not restate them in a
+sub-header.
+
 The dashboard is a compact overview, not a metrics wall. Use two full-width
 sections that follow the projects-page grid pattern: projects first, then
 servers. Keep one `New` action in the page header and let its modal choose the
@@ -619,6 +642,16 @@ Application and server browser terminals use the same browser-oriented console
 shell, theme picker, compact header controls, and outline `browser-terminal`
 Reicon. Hide a container switcher when only one container exists.
 
+The themed console shell belongs to an open session. Before a target is
+selected, the global Terminal page stays a normal top-level destination: a
+full-width layer card titled `Start a terminal session`, its filter input in
+the card header actions, and grouped `Servers` / `Containers` rows reusing the
+command-palette row classes. Do not render an empty full-height console canvas
+just to host the target picker, and do not offer the console theme selector
+before a session owns that canvas. Rows show the target name, a muted server
+column that only appears when the team has more than one server, and the shared
+chevron. Group headers stick to the top of the scrolling list and carry a count.
+
 ### Logs
 
 Runtime and deployment logs should feel like a clean terminal surface:

DEVELOPMENT.md

@@ -34,8 +34,6 @@ Follow the steps below for your operating system:
      - Download and install [Docker Desktop for Windows](https://docs.docker.com/desktop/install/windows-install/?ref=coolify)
      - Ensure WSL2 backend is enabled in Docker Desktop settings
 
-2. Install Spin:
-   - Follow the instructions to install Spin on Windows from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-windows#download-and-install-spin-into-wsl2?ref=coolify)
 
 </details>
 
@@ -48,8 +46,6 @@ Follow the steps below for your operating system:
    - Docker Desktop:
      - Download and install [Docker Desktop for Mac](https://docs.docker.com/desktop/install/mac-install/?ref=coolify)
 
-2. Install Spin:
-   - Follow the instructions to install Spin on MacOS from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-macos/#download-and-install-spin?ref=coolify)
 
 </details>
 
@@ -62,22 +58,20 @@ Follow the steps below for your operating system:
    - Docker Desktop:
      - If you want a GUI, you can use [Docker Desktop for Linux](https://docs.docker.com/desktop/install/linux-install/?ref=coolify)
 
-2. Install Spin:
-   - Follow the instructions to install Spin on Linux from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-linux#configure-docker-permissions?ref=coolify)
 
 </details>
 
 
 ## 2. Verify Installation (Optional)
-After installing Docker (or Orbstack) and Spin, verify the installation:
+After installing Docker (or Orbstack), verify the installation:
 
 1. Open a terminal or command prompt
 2. Run the following commands:
    ```bash
    docker --version
-   spin --version
+   docker compose version
    ```
-   You should see version information for both Docker and Spin.
+   You should see version information for Docker and Docker Compose.
 
 
 ## 3. Fork and Setup Local Repository
@@ -105,7 +99,7 @@ After installing Docker (or Orbstack) and Spin, verify the installation:
 1. In the Code Editor, locate the `.env.development.example` file in the root directory of your local Coolify repository.
 2. Duplicate the `.env.development.example` file and rename the copy to `.env`.
 3. Open the new `.env` file and review its contents. Adjust any environment variables as needed for your development setup.
-4. If you encounter errors during database migrations, update the database connection settings in your `.env` file. Use the IP address or hostname of your PostgreSQL database container. You can find this information by running `docker ps` after executing `spin up`.
+4. If you encounter errors during database migrations, update the database connection settings in your `.env` file. Use the IP address or hostname of your PostgreSQL database container. You can find this information by running `docker ps` after executing `docker compose -f docker-compose.yml -f docker-compose.dev.yml up`.
 5. Save the changes to your `.env` file.
 
 
@@ -113,7 +107,7 @@ After installing Docker (or Orbstack) and Spin, verify the installation:
 1. Open a terminal in the local Coolify directory.
 2. Run the following command in the terminal (leave that terminal open):
    ```bash
-   spin up
+   docker compose -f docker-compose.yml -f docker-compose.dev.yml up
    ```
 
 > [!NOTE]
@@ -121,11 +115,11 @@ After installing Docker (or Orbstack) and Spin, verify the installation:
 
 3. If you encounter permission errors, especially on macOS, use:
    ```bash
-   sudo spin up
+   sudo docker compose -f docker-compose.yml -f docker-compose.dev.yml up
    ```
 
 > [!NOTE]
-> If you change environment variables afterwards or anything seems broken, press Ctrl + C to stop the process and run `spin up` again.
+> If you change environment variables afterwards or anything seems broken, press Ctrl + C to stop the process and run `docker compose -f docker-compose.yml -f docker-compose.dev.yml up` again.
 
 
 ## 6. Start Development
@@ -196,7 +190,7 @@ If you encounter issues or break your database or something else, follow these s
 
 5. Start Coolify again:
    ```bash
-   spin up
+   docker compose -f docker-compose.yml -f docker-compose.dev.yml up
    ```
 
 6. Run database migrations and seeders:

RELEASE.md

@@ -9,7 +9,14 @@
 | `feature/*` | New features based on and merged into `next` |
 | `hotfix/X.Y.Z` | Production fixes based on `main` |
 
-Release workflows never edit or commit versions. Set the intended version in `config/constants.php` before running a release workflow.
+Release workflows never edit or commit versions. Stable versions come from `config/constants.php`; RC versions come from `coolify.nightly.version` in `versions.json` and `other/nightly/versions.json`.
+
+## Where changes go
+
+- Fixes, security updates, and small improvements target `main`.
+- New features and larger changes target `next`.
+- Merge `main` into `next` regularly so every production fix is included in the next release.
+- Do not merge `next` into `main` until an RC is approved for a stable release.
 
 ## Feature and RC flow
 
@@ -18,11 +25,12 @@ feature/* → next → RC
 ```
 
 1. Merge feature branches into `next`.
-2. Set the intended RC version on `next`, such as `4.4-rc.1`.
-3. Regular builds publish `sha-<commit>`, `4.4-rc.1.<short-sha>`, and the moving `next` tag.
+2. Set `coolify.nightly.version` in both version files to the intended RC, such as `4.4-rc.1`.
+3. Regular `next` builds publish `sha-<short-sha>`, `4.4-rc.1.<short-sha>`, and the moving `next` tag. They never publish the exact `4.4-rc.1` tag.
 4. Create a reviewed draft GitHub Release named `v4.4-rc.1` and mark it as a prerelease.
-5. Run the RC workflow from `next`. It publishes `4.4-rc.1`, updates `next`, and publishes the draft.
-6. Advance `next` to the next intended RC version.
+5. Run **Release Coolify RC** manually from `next` and enter `v4.4-rc.1`.
+6. The workflow validates the draft and configured nightly version, builds the exact RC, publishes `4.4-rc.1`, updates `next`, and publishes the draft prerelease.
+7. Advance `coolify.nightly.version` to the next intended RC version.
 
 ## Stable release flow
 
@@ -45,13 +53,14 @@ next → main → stable release
 main → hotfix/X.Y.Z → main → next
 ```
 
-1. Create `hotfix/X.Y.Z` from `main` and set the intended patch version.
-2. Implement and test the fix. SHA images report `X.Y.Z-dev.<short-sha>`.
-3. Merge the hotfix into `main`.
-4. Create a reviewed draft GitHub Release named `vX.Y.Z`.
-5. Run the stable release workflow from `main`.
-6. Merge `main` into `next`, resolve the version in favor of the next intended RC, and delete the hotfix branch.
-7. Update the CDN only after the release is approved.
+1. Create `hotfix/X.Y.Z` from `main` when a patch needs an integration branch. A single fix may use a normal branch from `main` instead.
+2. Set the intended patch version.
+3. Implement and test the fix. SHA images report `X.Y.Z-dev.<short-sha>`.
+4. Merge the fix into `main`.
+5. Create a reviewed draft GitHub Release named `vX.Y.Z`.
+6. Run the stable release workflow from `main`.
+7. Merge `main` into `next`, resolve the version in favor of the next intended RC, and delete the hotfix branch if one was used.
+8. Update the CDN only after the release is approved.
 
 ## Image tags
 

app/Actions/Application/CleanupPreviewDeployment.php

@@ -54,6 +54,14 @@ class CleanupPreviewDeployment
             $server
         );
 
+        if ($result['cancelled_deployments'] > 0) {
+            try {
+                next_after_cancel($server);
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to advance deployment queue after cleaning up preview for application {$application->id}: {$e->getMessage()}");
+            }
+        }
+
         // Step 2: Stop and remove all running PR containers
         $result['killed_containers'] = $this->stopRunningContainers(
             $application,
@@ -98,13 +106,13 @@ class CleanupPreviewDeployment
                 $deployment->update([
                     'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
                 ]);
+                $cancelled++;
 
                 // Add cancellation log entry
                 $deployment->addLogEntry('Deployment cancelled: Pull request closed.', 'stderr');
 
                 // Try to kill helper container if it exists
                 $this->killHelperContainer($deployment->deployment_uuid, $server);
-                $cancelled++;
             } catch (\Throwable $e) {
                 \Log::warning("Failed to cancel deployment {$deployment->id}: {$e->getMessage()}");
             }

app/Actions/Application/StopApplication.php

@@ -28,7 +28,7 @@ class StopApplication
                 if ($server->isSwarm()) {
                     instant_remote_process(["docker stack rm {$application->uuid}"], $server);
 
-                    return;
+                    continue;
                 }
 
                 $containers = $previewDeployments
@@ -40,7 +40,7 @@ class StopApplication
 
                 foreach ($containersToStop as $containerName) {
                     instant_remote_process(command: [
-                        "docker stop --time=$timeout $containerName",
+                        dockerStopCommand($timeout, $containerName, $server),
                         "docker rm -f $containerName",
                     ], server: $server, throwError: false);
                 }
@@ -57,17 +57,15 @@ class StopApplication
             }
         }
 
+        $status = ['status' => 'exited'];
         if ($resetRestartCount) {
-            $application->update([
+            $status = array_merge($status, [
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
             ]);
-        } else {
-            $application->update([
-                'status' => 'exited',
-            ]);
         }
+        $application->update($status);
 
         ServiceStatusChanged::dispatch($application->environment->project->team->id);
     }

app/Actions/Application/StopApplicationOneServer.php

@@ -28,7 +28,7 @@ class StopApplicationOneServer
                     if ($containerName) {
                         instant_remote_process(
                             [
-                                "docker stop --time=$timeout $containerName",
+                                dockerStopCommand($timeout, $containerName, $server),
                                 "docker rm -f $containerName",
                             ],
                             $server

app/Actions/Database/StartClickhouse.php

@@ -104,7 +104,7 @@ class StartClickhouse
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

app/Actions/Database/StartDragonfly.php

@@ -191,7 +191,7 @@ class StartDragonfly
         if ($this->database->enable_ssl) {
             $this->commands[] = "chown -R 999:999 $this->configuration_dir/ssl/server.key $this->configuration_dir/ssl/server.crt";
         }
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

app/Actions/Database/StartKeydb.php

@@ -209,7 +209,7 @@ class StartKeydb
         if (! is_null($this->database->keydb_conf) && ! empty($this->database->keydb_conf)) {
             $this->commands[] = "chown 999:999 $this->configuration_dir/keydb.conf";
         }
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

app/Actions/Database/StartMariadb.php

@@ -208,13 +208,13 @@ class StartMariadb
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        if ($this->database->enable_ssl) {
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
+        }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
-        if ($this->database->enable_ssl) {
-            $this->commands[] = executeInDocker($this->database->uuid, 'chown mysql:mysql /etc/mysql/certs/server.crt /etc/mysql/certs/server.key');
-        }
 
         return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
     }

app/Actions/Database/StartMongodb.php

@@ -257,12 +257,12 @@ class StartMongodb
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        if ($this->database->enable_ssl) {
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mongodb:mongodb /etc/mongo/certs/server.pem < /dev/null";
+        }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
-        if ($this->database->enable_ssl) {
-            $this->commands[] = executeInDocker($this->database->uuid, 'chown mongodb:mongodb /etc/mongo/certs/server.pem');
-        }
         $this->commands[] = "echo 'Database started.'";
 
         return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');

app/Actions/Database/StartMysql.php

@@ -209,15 +209,13 @@ class StartMysql
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        if ($this->database->enable_ssl) {
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
+        }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
 
-        if ($this->database->enable_ssl) {
-            $mysqlUser = escapeshellarg($this->database->mysql_user);
-            $this->commands[] = executeInDocker($this->database->uuid, "chown {$mysqlUser}:{$mysqlUser} /etc/mysql/certs/server.crt /etc/mysql/certs/server.key");
-        }
-
         $this->commands[] = "echo 'Database started.'";
 
         return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');

app/Actions/Database/StartPostgresql.php

@@ -219,13 +219,12 @@ class StartPostgresql
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        if ($this->database->enable_ssl) {
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name postgres:postgres /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt < /dev/null";
+        }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
-        if ($this->database->enable_ssl) {
-            $postgresUser = escapeshellarg($this->database->postgres_user);
-            $this->commands[] = executeInDocker($this->database->uuid, "chown {$postgresUser}:{$postgresUser} /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt");
-        }
         $this->commands[] = "echo 'Database started.'";
 
         return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');

app/Actions/Database/StartRedis.php

@@ -204,7 +204,7 @@ class StartRedis
         if (! is_null($this->database->redis_conf) && ! empty($this->database->redis_conf)) {
             $this->commands[] = "chown 999:999 $this->configuration_dir/redis.conf";
         }
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

app/Actions/Database/StopDatabase.php

@@ -30,6 +30,7 @@ class StopDatabase
 
             // Reset restart tracking when database is manually stopped
             $database->update([
+                'status' => 'exited',
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
@@ -56,7 +57,7 @@ class StopDatabase
     {
         $server = $database->destination->server;
         instant_remote_process(command: [
-            "docker stop -t $timeout $containerName",
+            dockerStopCommand($timeout, $containerName, $server),
             "docker rm -f $containerName",
         ], server: $server, throwError: false);
     }

app/Actions/Development/ConfigureDevelopmentQemuHost.php

@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Actions\Development;
+
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Process;
+use Lorisleiva\Actions\Concerns\AsAction;
+use RuntimeException;
+
+class ConfigureDevelopmentQemuHost
+{
+    use AsAction;
+
+    public function handle(): void
+    {
+        $this->ensureDevelopmentEnvironment();
+        $this->installDependencies();
+        $this->runOrFail('systemctl enable --now libvirtd');
+        $this->configureLibvirtNetwork();
+        $this->configureIpForwarding();
+        $this->configureStorage();
+        $this->configureDockerForwarding();
+    }
+
+    private function installDependencies(): void
+    {
+        $binaries = ['curl', 'docker', 'iptables', 'qemu-img', 'virsh', 'virt-install'];
+        $check = collect($binaries)->map(fn (string $binary) => 'command -v '.escapeshellarg($binary))->implode(' && ');
+
+        if (Process::run($check)->successful()) {
+            return;
+        }
+
+        if (! File::exists('/usr/bin/apt-get')) {
+            throw new RuntimeException('Missing QEMU dependencies. Automatic installation currently supports apt-based development hosts.');
+        }
+
+        $this->runOrFail('apt-get update');
+        $this->runOrFail('DEBIAN_FRONTEND=noninteractive apt-get install -y curl iptables libvirt-clients libvirt-daemon-system qemu-utils qemu-system-x86 virtinst');
+    }
+
+    private function configureLibvirtNetwork(): void
+    {
+        $network = config('development-qemu.libvirt_network');
+        $networkInfo = Process::run('virsh net-info '.escapeshellarg($network));
+
+        if ($networkInfo->failed()) {
+            $networkXml = config('development-qemu.storage_path').'/libvirt-network.xml';
+            File::ensureDirectoryExists(dirname($networkXml), 0777, true);
+            File::put($networkXml, $this->libvirtNetworkXml($network));
+            $this->runOrFail('virsh net-define '.escapeshellarg($networkXml));
+            $networkInfo = Process::result(output: 'Active: no');
+        }
+
+        if (! preg_match('/^Active:\s+yes$/m', $networkInfo->output())) {
+            $this->runOrFail('virsh net-start '.escapeshellarg($network));
+        }
+
+        $this->runOrFail('virsh net-autostart '.escapeshellarg($network));
+    }
+
+    private function configureIpForwarding(): void
+    {
+        $this->runOrFail("printf 'net.ipv4.ip_forward=1\\n' > /etc/sysctl.d/99-coolify-development-qemu.conf");
+        $this->runOrFail('sysctl -w net.ipv4.ip_forward=1');
+    }
+
+    private function configureStorage(): void
+    {
+        $directory = config('development-qemu.storage_path');
+        File::ensureDirectoryExists($directory, 0777, true);
+        File::chmod($directory, 0777);
+    }
+
+    private function configureDockerForwarding(): void
+    {
+        $dockerNetwork = escapeshellarg(config('development-qemu.docker_network'));
+        $subnetResult = Process::run("docker network inspect {$dockerNetwork} --format ".escapeshellarg('{{(index .IPAM.Config 0).Subnet}}'));
+        $subnet = trim($subnetResult->output());
+
+        if ($subnetResult->failed() || $subnet === '') {
+            throw new RuntimeException('Unable to determine the Coolify Docker network subnet.');
+        }
+
+        $rule = sprintf('-s %s -d %s -o virbr0 -j ACCEPT', escapeshellarg($subnet), escapeshellarg(config('development-qemu.subnet')));
+
+        Process::run("iptables -D LIBVIRT_FWI {$rule}");
+        $this->runOrFail("iptables -I LIBVIRT_FWI 1 {$rule}");
+    }
+
+    private function libvirtNetworkXml(string $network): string
+    {
+        return <<<XML
+<network>
+  <name>{$network}</name>
+  <forward mode="nat"/>
+  <bridge name="virbr0" stp="on" delay="0"/>
+  <ip address="192.168.122.1" netmask="255.255.255.0">
+    <dhcp>
+      <range start="192.168.122.2" end="192.168.122.254"/>
+    </dhcp>
+  </ip>
+</network>
+XML;
+    }
+
+    private function runOrFail(string $command): void
+    {
+        $result = Process::forever()->run($command);
+
+        if ($result->failed()) {
+            throw new RuntimeException(trim($result->errorOutput()) ?: "Command failed: {$command}");
+        }
+    }
+
+    private function ensureDevelopmentEnvironment(): void
+    {
+        if (! in_array(config('app.env'), ['local', 'development', 'dev'], true)) {
+            throw new RuntimeException('QEMU host configuration may only run in development environments.');
+        }
+    }
+}

app/Actions/Development/ManageDevelopmentQemuVm.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Actions\Development;
+
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Facades\Process;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class ManageDevelopmentQemuVm
+{
+    use AsAction;
+
+    /** @param string|array<int, string> $profileNames */
+    public function handle(string|array $profileNames): void
+    {
+        $profileNames = is_array($profileNames) ? array_values(array_unique($profileNames)) : [$profileNames];
+
+        foreach ($profileNames as $index => $profileName) {
+            StartDevelopmentQemuVm::run($profileName, $index === 0);
+
+            try {
+                SeedDevelopmentQemuServer::run($profileName, $index === 0);
+            } catch (QueryException $exception) {
+                $keepOthers = $index === 0 ? '' : ' --keep-others';
+                $result = Process::run('docker exec coolify php artisan dev:qemu:seed '.escapeshellarg($profileName).$keepOthers);
+
+                if ($result->failed()) {
+                    throw $exception;
+                }
+            }
+        }
+    }
+}

app/Actions/Development/SeedDevelopmentQemuServer.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Actions\Development;
+
+use App\Models\PrivateKey;
+use App\Models\Server;
+use InvalidArgumentException;
+use Lorisleiva\Actions\Concerns\AsAction;
+use RuntimeException;
+
+class SeedDevelopmentQemuServer
+{
+    use AsAction;
+
+    public function handle(string $profileName, bool $removeOtherServers = true): Server
+    {
+        $this->ensureDevelopmentEnvironment();
+        $profile = config("development-qemu.profiles.{$profileName}");
+
+        if (! is_array($profile)) {
+            throw new InvalidArgumentException("Unknown development QEMU profile: {$profileName}");
+        }
+
+        $privateKey = PrivateKey::query()->find(1);
+
+        if (! $privateKey) {
+            throw new RuntimeException('Development private key 1 is missing. Run the development database seeders first.');
+        }
+
+        if ($removeOtherServers) {
+            Server::query()
+                ->where('uuid', 'like', 'development-qemu-%')
+                ->where('uuid', '!=', $profile['uuid'])
+                ->delete();
+        }
+
+        $server = Server::withTrashed()->where('uuid', $profile['uuid'])->first() ?? new Server;
+        $server->forceFill(['uuid' => $profile['uuid']]);
+        $server->fill([
+            'name' => $profile['name'],
+            'description' => 'Development-only QEMU virtual machine managed by dev:qemu.',
+            'ip' => $profile['ip'],
+            'port' => 22,
+            'user' => $profile['user'],
+            'team_id' => 0,
+            'private_key_id' => $privateKey->id,
+        ]);
+        $server->deleted_at = null;
+        $server->save();
+
+        return $server->fresh();
+    }
+
+    private function ensureDevelopmentEnvironment(): void
+    {
+        if (! in_array(config('app.env'), ['local', 'development', 'dev'], true)) {
+            throw new RuntimeException('QEMU VM servers may only be seeded in development environments.');
+        }
+    }
+}

app/Actions/Development/StartDevelopmentQemuVm.php

@@ -0,0 +1,219 @@
+<?php
+
+namespace App\Actions\Development;
+
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Process;
+use InvalidArgumentException;
+use Lorisleiva\Actions\Concerns\AsAction;
+use RuntimeException;
+
+class StartDevelopmentQemuVm
+{
+    use AsAction;
+
+    public function handle(string $profileName, bool $resetManagedVms = true): void
+    {
+        $this->ensureDevelopmentEnvironment();
+        $profiles = config('development-qemu.profiles');
+        $profile = $profiles[$profileName] ?? null;
+
+        if (! is_array($profile)) {
+            throw new InvalidArgumentException("Unknown development QEMU profile: {$profileName}");
+        }
+
+        ConfigureDevelopmentQemuHost::run();
+        $this->configureDhcpReservation($profile);
+
+        if ($resetManagedVms) {
+            foreach ($profiles as $managedProfile) {
+                Process::run('virsh destroy '.escapeshellarg($managedProfile['domain']));
+                Process::run('virsh undefine '.escapeshellarg($managedProfile['domain']));
+                $this->deleteVmData($managedProfile['domain']);
+            }
+        }
+
+        $this->createVm($profile);
+
+        ConfigureDevelopmentQemuHost::run();
+        $this->waitForSsh($profile['ip']);
+    }
+
+    /** @param array{domain: string, ip: string, user: string, mac: string, image: string, image_url: string, os_variant: string, provisioner: string} $profile */
+    private function createVm(array $profile): void
+    {
+        $directory = config('development-qemu.storage_path');
+        File::ensureDirectoryExists($directory);
+        File::chmod($directory, 0777);
+        $this->moveLegacyFiles($directory);
+        $baseImage = "{$directory}/{$profile['image']}";
+        $disk = "{$directory}/{$profile['domain']}.qcow2";
+        $userData = "{$directory}/{$profile['domain']}-user-data.yaml";
+        $networkConfig = "{$directory}/{$profile['domain']}-network.yaml";
+
+        if (! File::exists($baseImage)) {
+            $this->runOrFail(sprintf(
+                'curl --fail --location --output %s %s',
+                escapeshellarg($baseImage),
+                escapeshellarg($profile['image_url']),
+            ));
+        }
+
+        if (! File::exists($disk)) {
+            $this->runOrFail(sprintf(
+                'qemu-img create -f qcow2 -F qcow2 -b %s %s %s',
+                escapeshellarg($baseImage),
+                escapeshellarg($disk),
+                escapeshellarg(config('development-qemu.disk_size')),
+            ));
+        }
+
+        if (File::exists($baseImage)) {
+            File::chmod($baseImage, 0644);
+        }
+
+        if (File::exists($disk)) {
+            File::chmod($disk, 0666);
+        }
+
+        File::put($userData, $this->userData($profile));
+        File::put($networkConfig, $this->networkConfig($profile));
+
+        $this->runOrFail(sprintf(
+            'virt-install --connect qemu:///system --name %s --memory %d --vcpus %d --import --os-variant %s --disk path=%s,format=qcow2,bus=virtio --network network=%s,model=virtio,mac=%s --cloud-init user-data=%s,network-config=%s,disable=on --noautoconsole',
+            escapeshellarg($profile['domain']),
+            config('development-qemu.memory'),
+            config('development-qemu.vcpus'),
+            escapeshellarg($profile['os_variant']),
+            escapeshellarg($disk),
+            escapeshellarg(config('development-qemu.libvirt_network')),
+            escapeshellarg($profile['mac']),
+            escapeshellarg($userData),
+            escapeshellarg($networkConfig),
+        ));
+    }
+
+    private function moveLegacyFiles(string $directory): void
+    {
+        $legacyDirectory = storage_path('app/development-qemu');
+
+        if ($legacyDirectory === $directory || ! File::isDirectory($legacyDirectory)) {
+            return;
+        }
+
+        foreach (File::files($legacyDirectory) as $file) {
+            $destination = "{$directory}/{$file->getFilename()}";
+
+            if (! File::exists($destination)) {
+                File::move($file->getPathname(), $destination);
+            }
+        }
+    }
+
+    private function deleteVmData(string $domain): void
+    {
+        $directory = config('development-qemu.storage_path');
+        File::delete([
+            "{$directory}/{$domain}.qcow2",
+            "{$directory}/{$domain}-user-data.yaml",
+            "{$directory}/{$domain}-network.yaml",
+        ]);
+    }
+
+    /** @param array{user: string, provisioner: string} $profile */
+    private function userData(array $profile): string
+    {
+        $publicKey = config('development-qemu.public_key');
+        $adminGroup = $profile['provisioner'] === 'apt' ? 'sudo' : 'wheel';
+        $sudo = $profile['user'] === 'root' ? '' : "    groups: [{$adminGroup}]\n    sudo: ALL=(ALL) NOPASSWD:ALL\n";
+
+        [$packages, $startDocker] = match ($profile['provisioner']) {
+            'apk' => ["  - docker\n  - sudo", 'rc-update add docker default && service docker start'],
+            'rpm' => ["  - curl\n  - sudo", 'curl -fsSL https://get.docker.com | sh && systemctl enable --now docker'],
+            default => ["  - docker.io\n  - sudo", 'systemctl enable --now docker'],
+        };
+        $addUserToDockerGroup = $profile['user'] === 'root' ? '' : "\n  - usermod -aG docker {$profile['user']}";
+
+        return <<<YAML
+#cloud-config
+disable_root: false
+users:
+  - name: {$profile['user']}
+{$sudo}    shell: /bin/bash
+    lock_passwd: true
+    ssh_authorized_keys:
+      - {$publicKey}
+package_update: true
+packages:
+{$packages}
+runcmd:
+  - {$startDocker}{$addUserToDockerGroup}
+YAML;
+    }
+
+    /** @param array{mac: string} $profile */
+    private function networkConfig(array $profile): string
+    {
+        return <<<YAML
+version: 2
+ethernets:
+  default:
+    match:
+      macaddress: "{$profile['mac']}"
+    dhcp4: true
+YAML;
+    }
+
+    /** @param array{domain: string, ip: string, mac: string} $profile */
+    private function configureDhcpReservation(array $profile): void
+    {
+        $network = escapeshellarg(config('development-qemu.libvirt_network'));
+        $networkXml = Process::run("virsh net-dumpxml {$network}");
+
+        if ($networkXml->failed()) {
+            throw new RuntimeException(trim($networkXml->errorOutput()) ?: 'Unable to inspect the libvirt network.');
+        }
+
+        if (str_contains($networkXml->output(), $profile['mac']) && str_contains($networkXml->output(), $profile['ip'])) {
+            return;
+        }
+
+        $host = sprintf("<host mac='%s' name='%s' ip='%s'/>", $profile['mac'], $profile['domain'], $profile['ip']);
+        $this->runOrFail("virsh net-update {$network} add-last ip-dhcp-host ".escapeshellarg($host).' --live --config');
+    }
+
+    private function waitForSsh(string $ip): void
+    {
+        $container = escapeshellarg(config('development-qemu.coolify_container'));
+        $probe = <<<'PHP'
+$deadline = time() + 120;
+do {
+    $socket = @fsockopen($argv[1], 22, $errorCode, $errorMessage, 1);
+    if (is_resource($socket)) {
+        fclose($socket);
+        exit(0);
+    }
+    sleep(1);
+} while (time() < $deadline);
+exit(1);
+PHP;
+        $this->runOrFail("docker exec {$container} php -r ".escapeshellarg($probe).' '.escapeshellarg($ip));
+    }
+
+    private function runOrFail(string $command): void
+    {
+        $result = Process::forever()->run($command);
+
+        if ($result->failed()) {
+            throw new RuntimeException(trim($result->errorOutput()) ?: "Command failed: {$command}");
+        }
+
+    }
+
+    private function ensureDevelopmentEnvironment(): void
+    {
+        if (! in_array(config('app.env'), ['local', 'development', 'dev'], true)) {
+            throw new RuntimeException('QEMU VMs may only be managed in development environments.');
+        }
+    }
+}

app/Actions/Fortify/CreateNewUser.php

@@ -32,7 +32,7 @@ class CreateNewUser implements CreatesNewUsers
     public function create(array $input): User
     {
         $settings = instanceSettings();
-        if (! $settings->is_registration_enabled) {
+        if (! $settings->isPasswordRegistrationAllowed()) {
             abort(403);
         }
 

app/Actions/Proxy/GetProxyConfiguration.php

@@ -13,6 +13,8 @@ class GetProxyConfiguration
 {
     use AsAction;
 
+    public const MAX_CONFIGURATION_SIZE_BYTES = 5 * 1024 * 1024;
+
     public function handle(Server $server, bool $forceRegenerate = false): string
     {
         $proxyType = $server->proxyType();
@@ -98,11 +100,17 @@ class GetProxyConfiguration
     private function backfillFromDisk(Server $server): ?string
     {
         $proxy_path = $server->proxyPath();
+        $configurationPath = escapeshellarg("$proxy_path/docker-compose.yml");
+        $readLimit = self::MAX_CONFIGURATION_SIZE_BYTES + 1;
         $result = instant_remote_process([
             "mkdir -p $proxy_path",
-            "cat $proxy_path/docker-compose.yml 2>/dev/null",
+            "if [ ! -f {$configurationPath} ]; then exit 0; elif [ \"$(wc -c < {$configurationPath})\" -gt ".self::MAX_CONFIGURATION_SIZE_BYTES." ]; then echo '__COOLIFY_PROXY_CONFIG_TOO_LARGE__'; else head -c {$readLimit} {$configurationPath}; fi",
         ], $server, false);
 
+        if ($result === '__COOLIFY_PROXY_CONFIG_TOO_LARGE__' || strlen($result ?? '') > self::MAX_CONFIGURATION_SIZE_BYTES) {
+            throw new \RuntimeException('Proxy configuration exceeds the 5 MiB size limit.');
+        }
+
         if (! empty(trim($result ?? ''))) {
             $server->proxy->last_saved_proxy_configuration = $result;
             $server->save();

app/Actions/Proxy/StopProxy.php

@@ -24,7 +24,7 @@ class StopProxy
             }
 
             instant_remote_process(command: [
-                "docker stop -t=$timeout $containerName 2>/dev/null || true",
+                dockerStopCommand($timeout, $containerName, $server).' 2>/dev/null || true',
                 "docker rm -f $containerName 2>/dev/null || true",
                 '# Wait for container to be fully removed',
                 'for i in {1..10}; do',

app/Actions/Server/CheckUpdates.php

@@ -3,6 +3,7 @@
 namespace App\Actions\Server;
 
 use App\Models\Server;
+use Illuminate\Support\Facades\Log;
 use Lorisleiva\Actions\Concerns\AsAction;
 
 class CheckUpdates
@@ -106,6 +107,15 @@ class CheckUpdates
                     $out['osId'] = $osId;
                     $out['package_manager'] = $packageManager;
 
+                    return $out;
+                case 'apk':
+                    instant_remote_process(['apk update -q'], $server);
+                    $output = instant_remote_process(['LANG=C apk list --upgradable 2>/dev/null'], $server);
+
+                    $out = $this->parseApkOutput($output);
+                    $out['osId'] = $osId;
+                    $out['package_manager'] = $packageManager;
+
                     return $out;
                 default:
                     return [
@@ -266,11 +276,39 @@ class CheckUpdates
         // Include unparsed lines in the result for debugging if any exist
         if (! empty($unparsedLines)) {
             $result['unparsed_lines'] = $unparsedLines;
-            \Illuminate\Support\Facades\Log::debug('Pacman output contained unparsed lines', [
+            Log::debug('Pacman output contained unparsed lines', [
                 'unparsed_lines' => $unparsedLines,
             ]);
         }
 
         return $result;
     }
+
+    private function parseApkOutput(string $output): array
+    {
+        $updates = [];
+        $lines = explode("\n", $output);
+
+        foreach ($lines as $line) {
+            // Skip empty lines
+            if (empty($line)) {
+                continue;
+            }
+
+            // Example line: docker-cli-compose-2.31.0-r5 x86_64 {docker-cli-compose} (Apache-2.0) [upgradable from: docker-cli-compose-2.31.0-r4]
+            if (preg_match('/^(.+)-([0-9]\S*) (\S+) \{\S+\} \([^)]+\) \[upgradable from: .+?-([0-9][^\]]+)\]$/', $line, $matches)) {
+                $updates[] = [
+                    'package' => $matches[1],
+                    'new_version' => $matches[2],
+                    'architecture' => $matches[3],
+                    'current_version' => $matches[4],
+                ];
+            }
+        }
+
+        return [
+            'total_updates' => count($updates),
+            'updates' => $updates,
+        ];
+    }
 }

app/Actions/Server/CleanupDocker.php

@@ -131,7 +131,7 @@ class CleanupDocker
 
         $commands[] = "docker images --format '{{.Repository}}:{{.Tag}}' | ".
             $grepCommands.' | '.
-            "xargs -r -I {} sh -c 'docker inspect --format \"{{{{index .Config.Labels \\\"coolify.managed\\\"}}}}\" \"{}\" 2>/dev/null | grep -q true || docker rmi \"{}\" 2>/dev/null' || true";
+            "xargs -r -I {} sh -c 'docker inspect --format \"{{index .Config.Labels \\\"coolify.managed\\\"}}\" \"{}\" 2>/dev/null | grep -q true || docker rmi \"{}\" 2>/dev/null' || true";
 
         return implode(' && ', $commands);
     }

app/Actions/Server/InstallDocker.php

@@ -79,6 +79,8 @@ class InstallDocker
                 $command = $command->merge([$this->getSuseDockerInstallCommand()]);
             } elseif ($supported_os_type->contains('arch')) {
                 $command = $command->merge([$this->getArchDockerInstallCommand()]);
+            } elseif ($supported_os_type->contains('alpine')) {
+                $command = $command->merge([$this->getAlpineDockerInstallCommand()]);
             } else {
                 $command = $command->merge([$this->getGenericDockerInstallCommand()]);
             }
@@ -93,9 +95,8 @@ class InstallDocker
                 "jq -s '.[0] * .[1]' /etc/docker/daemon.json.coolify /etc/docker/daemon.json | tee /etc/docker/daemon.json.appended > /dev/null",
                 'mv /etc/docker/daemon.json.appended /etc/docker/daemon.json',
                 "echo 'Restarting Docker Engine...'",
-                'systemctl enable docker >/dev/null 2>&1 || true',
-                'systemctl restart docker',
             ]);
+            $command = $command->merge($this->getDockerServiceCommands($supported_os_type->contains('alpine')));
             if ($server->isSwarm()) {
                 $command = $command->merge([
                     'docker network create --attachable --driver overlay coolify-overlay >/dev/null 2>&1 || true',
@@ -154,6 +155,28 @@ class InstallDocker
             'systemctl start docker.service';
     }
 
+    private function getAlpineDockerInstallCommand(): string
+    {
+        return 'apk update && '.
+            'apk add docker docker-cli-buildx docker-cli-compose && '.
+            'mkdir -p /etc/docker';
+    }
+
+    private function getDockerServiceCommands(bool $usesOpenRc): array
+    {
+        if ($usesOpenRc) {
+            return [
+                'rc-update add docker default',
+                'rc-service docker restart',
+            ];
+        }
+
+        return [
+            'systemctl enable docker >/dev/null 2>&1 || true',
+            'systemctl restart docker',
+        ];
+    }
+
     private function getGenericDockerInstallCommand(): string
     {
         return 'curl -fsSL https://get.docker.com | sh';

app/Actions/Server/InstallPrerequisites.php

@@ -53,6 +53,8 @@ class InstallPrerequisites
                 "echo 'Installing Prerequisites for Arch Linux...'",
                 'pacman -Syu --noconfirm --needed curl wget git jq',
             ]);
+        } elseif ($supported_os_type->contains('alpine')) {
+            $command = $command->merge($this->getAlpinePrerequisiteCommands());
         } else {
             throw new \Exception('Unsupported OS type for prerequisites installation');
         }
@@ -61,4 +63,18 @@ class InstallPrerequisites
 
         return remote_process($command, $server);
     }
+
+    private function getAlpinePrerequisiteCommands(): array
+    {
+        return [
+            "echo 'Installing Prerequisites for Alpine Linux...'",
+            "sed -i '/^#.*\\/community/s/^#//' /etc/apk/repositories 2>/dev/null || true",
+            'apk update',
+            'command -v bash >/dev/null || apk add bash',
+            'command -v curl >/dev/null || apk add curl',
+            'command -v wget >/dev/null || apk add wget',
+            'command -v git >/dev/null || apk add git',
+            'command -v jq >/dev/null || apk add jq',
+        ];
+    }
 }

app/Actions/Server/UpdatePackage.php

@@ -58,6 +58,10 @@ class UpdatePackage
                     $commandAll = 'pacman -Syu --noconfirm';
                     $commandInstall = 'pacman -S --noconfirm '.$sanitizedPackage;
                     break;
+                case 'apk':
+                    $commandAll = 'apk update && apk upgrade';
+                    $commandInstall = 'apk upgrade '.$sanitizedPackage;
+                    break;
                 default:
                     return [
                         'error' => 'OS not supported',

app/Actions/Service/DeleteService.php

@@ -2,77 +2,52 @@
 
 namespace App\Actions\Service;
 
-use App\Actions\Server\CleanupDocker;
 use App\Models\Service;
-use Illuminate\Support\Facades\Log;
-use Lorisleiva\Actions\Concerns\AsAction;
 
 class DeleteService
 {
-    use AsAction;
-
-    public function handle(Service $service, bool $deleteVolumes, bool $deleteConnectedNetworks, bool $deleteConfigurations, bool $dockerCleanup)
+    public function cleanupRemote(Service $service, bool $deleteVolumes, bool $deleteConnectedNetworks, bool $deleteConfigurations): void
     {
-        try {
-            $server = data_get($service, 'server');
-            if ($deleteVolumes && $server->isFunctional()) {
-                $storagesToDelete = collect([]);
-
-                $service->environment_variables()->delete();
-                $commands = [];
-                foreach ($service->applications()->get() as $application) {
-                    $storages = $application->persistentStorages()->get();
-                    foreach ($storages as $storage) {
-                        $storagesToDelete->push($storage);
-                    }
-                }
-                foreach ($service->databases()->get() as $database) {
-                    $storages = $database->persistentStorages()->get();
-                    foreach ($storages as $storage) {
-                        $storagesToDelete->push($storage);
-                    }
-                }
-                foreach ($storagesToDelete as $storage) {
+        $server = data_get($service, 'server');
+        if ($deleteVolumes && $server->isFunctional()) {
+            $commands = [];
+            foreach ($service->applications()->get() as $application) {
+                foreach ($application->persistentStorages()->get() as $storage) {
                     $commands[] = 'docker volume rm -f '.escapeshellarg($storage->name);
                 }
-
-                // Execute volume deletion first, this must be done first otherwise volumes will not be deleted.
-                if (! empty($commands)) {
-                    foreach ($commands as $command) {
-                        $result = instant_remote_process([$command], $server, false);
-                        if ($result !== null && $result !== 0) {
-                            Log::error('Error deleting volumes: '.$result);
-                        }
-                    }
-                }
-            }
-
-            if ($deleteConnectedNetworks) {
-                $service->deleteConnectedNetworks();
-            }
-
-            instant_remote_process(["docker rm -f $service->uuid"], $server, throwError: false);
-        } catch (\Exception $e) {
-            throw new \RuntimeException($e->getMessage());
-        } finally {
-            if ($deleteConfigurations) {
-                $service->deleteConfigurations();
-            }
-            foreach ($service->applications()->get() as $application) {
-                $application->forceDelete();
             }
             foreach ($service->databases()->get() as $database) {
-                $database->forceDelete();
+                foreach ($database->persistentStorages()->get() as $storage) {
+                    $commands[] = 'docker volume rm -f '.escapeshellarg($storage->name);
+                }
             }
-            foreach ($service->scheduled_tasks as $task) {
-                $task->delete();
-            }
-            $service->tags()->detach();
-            $service->forceDelete();
-
-            if ($dockerCleanup) {
-                CleanupDocker::dispatch($server, false, false);
+            foreach ($commands as $command) {
+                instant_remote_process([$command], $server, false);
             }
         }
+
+        if ($deleteConnectedNetworks) {
+            $service->deleteConnectedNetworks();
+        }
+        if ($deleteConfigurations) {
+            $service->deleteConfigurations();
+        }
+        instant_remote_process(["docker rm -f $service->uuid"], $server, throwError: false);
+    }
+
+    public function deleteLocal(Service $service): void
+    {
+        foreach ($service->applications()->get() as $application) {
+            $application->forceDelete();
+        }
+        foreach ($service->databases()->get() as $database) {
+            $database->forceDelete();
+        }
+        foreach ($service->scheduled_tasks as $task) {
+            $task->delete();
+        }
+        $service->environment_variables()->delete();
+        $service->tags()->detach();
+        $service->forceDelete();
     }
 }

app/Actions/Service/StopService.php

@@ -49,6 +49,9 @@ class StopService
                 $this->stopContainersInParallel($containersToStop, $server);
             }
 
+            $applications->each->update(['status' => 'exited']);
+            $dbs->each->update(['status' => 'exited']);
+
             if ($deleteConnectedNetworks) {
                 $service->deleteConnectedNetworks();
             }
@@ -67,7 +70,7 @@ class StopService
         $timeout = count($containersToStop) > 5 ? 10 : 30;
         $commands = [];
         $containerList = implode(' ', $containersToStop);
-        $commands[] = "docker stop -t $timeout $containerList";
+        $commands[] = dockerStopCommand($timeout, $containerList, $server);
         $commands[] = "docker rm -f $containerList";
         instant_remote_process(
             command: $commands,

app/Actions/Service/StopServiceApplication.php

@@ -2,6 +2,7 @@
 
 namespace App\Actions\Service;
 
+use App\Events\ServiceStatusChanged;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
 use Lorisleiva\Actions\Concerns\AsAction;
@@ -21,5 +22,8 @@ class StopServiceApplication
         instant_remote_process([
             "docker stop {$containerName}",
         ], $server);
+
+        $serviceApplication->update(['status' => 'exited']);
+        ServiceStatusChanged::dispatch($service->environment->project->team->id);
     }
 }

app/Actions/Service/UpdateServiceApplicationFromApi.php

@@ -88,6 +88,10 @@ class UpdateServiceApplicationFromApi
             $serviceApplication->is_stripprefix_enabled = filter_var($payload['is_stripprefix_enabled'], FILTER_VALIDATE_BOOLEAN);
         }
 
+        if (array_key_exists('is_force_https_enabled', $payload)) {
+            $serviceApplication->is_force_https_enabled = filter_var($payload['is_force_https_enabled'], FILTER_VALIDATE_BOOLEAN);
+        }
+
         if (array_key_exists('is_log_drain_enabled', $payload)) {
             $enabled = filter_var($payload['is_log_drain_enabled'], FILTER_VALIDATE_BOOLEAN);
             $server = $serviceApplication->service->destination->server;

app/Actions/Team/DeleteTeam.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Actions\Team;
+
+use App\Models\Application;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use RuntimeException;
+
+class DeleteTeam
+{
+    public function handle(Team $team, User $user): ?Team
+    {
+        $newTeam = DB::transaction(function () use ($team, $user): ?Team {
+            $team = Team::query()->lockForUpdate()->findOrFail($team->id);
+
+            $role = DB::table('team_user')
+                ->where('team_id', $team->id)
+                ->where('user_id', $user->id)
+                ->lockForUpdate()
+                ->value('role');
+
+            if ($role !== 'owner') {
+                throw new AuthorizationException('Only team owners can delete a team.');
+            }
+
+            $hasRunningApplications = Application::query()
+                ->whereHas('environment.project', fn ($query) => $query->where('team_id', $team->id))
+                ->lockForUpdate()
+                ->get(['id', 'status'])
+                ->contains(fn (Application $application): bool => $application->isRunning());
+
+            if ($hasRunningApplications) {
+                throw new RuntimeException('Stop all running applications before deleting this team.');
+            }
+
+            if ($team->servers()->lockForUpdate()->get(['servers.id'])->isNotEmpty()) {
+                throw new RuntimeException('Delete all team servers before deleting this team.');
+            }
+
+            if (! $team->isEmpty()) {
+                throw new RuntimeException('Delete all team resources before deleting this team.');
+            }
+
+            $team->members()
+                ->where('users.id', '!=', $user->id)
+                ->get()
+                ->each(function (User $member) use ($team): void {
+                    $member->teams()->detach($team);
+                    DB::table('sessions')->where('user_id', $member->id)->delete();
+                });
+
+            $team->delete();
+
+            return $user->teams()->first();
+        });
+
+        Cache::forget("user:{$user->id}:team:{$team->id}");
+
+        return $newTeam;
+    }
+}

app/Actions/User/DeleteUserResources.php

@@ -70,7 +70,7 @@ class DeleteUserResources
 
         return [
             'applications' => $applications->unique('id'),
-            'databases' => $databases->unique('id'),
+            'databases' => $databases->unique(fn ($database) => $database::class.':'.$database->id),
             'services' => $services->unique('id'),
         ];
     }

app/Auth/Oidc/Exceptions/OidcDiscoveryException.php

@@ -0,0 +1,5 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+class OidcDiscoveryException extends OidcException {}

app/Auth/Oidc/Exceptions/OidcException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+use RuntimeException;
+
+class OidcException extends RuntimeException {}

app/Auth/Oidc/Exceptions/OidcJwksException.php

@@ -0,0 +1,5 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+class OidcJwksException extends OidcException {}

app/Auth/Oidc/Exceptions/OidcSigningKeyNotFoundException.php

@@ -0,0 +1,5 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+class OidcSigningKeyNotFoundException extends OidcTokenException {}

app/Auth/Oidc/Exceptions/OidcTokenException.php

@@ -0,0 +1,5 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+class OidcTokenException extends OidcException {}

app/Auth/Oidc/OidcConfig.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use App\Models\OauthSetting;
+
+final readonly class OidcConfig
+{
+    /**
+     * @param  array<int, string>  $scopes
+     */
+    public function __construct(
+        public string $issuerUrl,
+        public string $clientId,
+        public string $clientSecret,
+        public string $redirectUri,
+        public array $scopes = ['openid', 'email', 'profile'],
+        public bool $usePkce = true,
+        public int $clockSkewSeconds = 60,
+    ) {}
+
+    public static function fromOauthSetting(OauthSetting $setting): self
+    {
+        return new self(
+            issuerUrl: rtrim((string) $setting->base_url, '/'),
+            clientId: (string) $setting->client_id,
+            clientSecret: (string) $setting->client_secret,
+            redirectUri: filled($setting->redirect_uri) ? $setting->redirect_uri : route('auth.callback', 'oidc'),
+            scopes: $setting->scopeList(),
+            usePkce: $setting->use_pkce ?? true,
+            clockSkewSeconds: $setting->clock_skew_seconds ?? 60,
+        );
+    }
+}

app/Auth/Oidc/OidcDiscoveryDocument.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use App\Auth\Oidc\Exceptions\OidcDiscoveryException;
+
+final readonly class OidcDiscoveryDocument
+{
+    /**
+     * @param  array<int, string>  $supportedScopes
+     * @param  array<int, string>  $supportedClaims
+     * @param  array<int, string>  $idTokenSigningAlgValuesSupported
+     */
+    public function __construct(
+        public string $issuer,
+        public string $authorizationEndpoint,
+        public string $tokenEndpoint,
+        public string $userinfoEndpoint,
+        public string $jwksUri,
+        public ?string $endSessionEndpoint = null,
+        public array $supportedScopes = [],
+        public array $supportedClaims = [],
+        public array $idTokenSigningAlgValuesSupported = [],
+    ) {}
+
+    /**
+     * @param  array<string, mixed>  $payload
+     */
+    public static function fromArray(array $payload): self
+    {
+        foreach (['issuer', 'authorization_endpoint', 'token_endpoint', 'userinfo_endpoint', 'jwks_uri'] as $field) {
+            if (! is_string($payload[$field] ?? null) || trim($payload[$field]) === '') {
+                throw new OidcDiscoveryException("Discovery document is missing required field: {$field}");
+            }
+        }
+
+        return new self(
+            issuer: $payload['issuer'],
+            authorizationEndpoint: $payload['authorization_endpoint'],
+            tokenEndpoint: $payload['token_endpoint'],
+            userinfoEndpoint: $payload['userinfo_endpoint'],
+            jwksUri: $payload['jwks_uri'],
+            endSessionEndpoint: is_string($payload['end_session_endpoint'] ?? null) ? $payload['end_session_endpoint'] : null,
+            supportedScopes: self::stringList($payload['scopes_supported'] ?? []),
+            supportedClaims: self::stringList($payload['claims_supported'] ?? []),
+            idTokenSigningAlgValuesSupported: self::stringList($payload['id_token_signing_alg_values_supported'] ?? []),
+        );
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private static function stringList(mixed $value): array
+    {
+        if (! is_array($value)) {
+            return [];
+        }
+
+        return array_values(array_map('strval', $value));
+    }
+}

app/Auth/Oidc/OidcDiscoveryService.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use App\Auth\Oidc\Exceptions\OidcDiscoveryException;
+use App\Auth\Oidc\Exceptions\OidcJwksException;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Throwable;
+
+class OidcDiscoveryService
+{
+    public function discover(string $issuerUrl): OidcDiscoveryDocument
+    {
+        $this->assertHttpsUrl($issuerUrl, new OidcDiscoveryException('Issuer URL must be an absolute HTTPS URL.'));
+
+        $issuerUrl = rtrim($issuerUrl, '/');
+        $cacheKey = 'oidc:discovery:'.hash('sha256', $issuerUrl);
+
+        return Cache::remember($cacheKey, 3600, function () use ($issuerUrl): OidcDiscoveryDocument {
+            $url = $issuerUrl.'/.well-known/openid-configuration';
+
+            try {
+                $response = Http::timeout(5)->connectTimeout(3)->acceptJson()->get($url);
+            } catch (Throwable $e) {
+                throw new OidcDiscoveryException("Failed to fetch discovery document: {$e->getMessage()}", previous: $e);
+            }
+
+            if ($response->failed()) {
+                throw new OidcDiscoveryException("Discovery endpoint returned HTTP {$response->status()}");
+            }
+
+            $json = $response->json();
+            if (! is_array($json) || $json === []) {
+                throw new OidcDiscoveryException('Discovery endpoint returned invalid JSON.');
+            }
+
+            $discovery = OidcDiscoveryDocument::fromArray($json);
+            if (rtrim($discovery->issuer, '/') !== $issuerUrl) {
+                throw new OidcDiscoveryException('Discovery issuer does not match the configured issuer URL.');
+            }
+
+            return $discovery;
+        });
+    }
+
+    /**
+     * Fetch the JWKS for the given URI.
+     *
+     * When $forceRefresh is true the cached document is bypassed so freshly
+     * rotated signing keys become visible immediately. A short cooldown still
+     * prevents a flood of upstream requests if many logins miss the same kid.
+     *
+     * @return array<string, mixed>
+     */
+    public function jwks(string $jwksUri, bool $forceRefresh = false): array
+    {
+        $this->assertHttpsUrl($jwksUri, new OidcJwksException('JWKS URI must be an absolute HTTPS URL.'));
+
+        $cacheKey = 'oidc:jwks:'.hash('sha256', $jwksUri);
+
+        if ($forceRefresh) {
+            $cooldownKey = $cacheKey.':refresh';
+            if (Cache::add($cooldownKey, true, 60)) {
+                Cache::forget($cacheKey);
+            }
+        }
+
+        return Cache::remember($cacheKey, 21600, function () use ($jwksUri): array {
+            try {
+                $response = Http::timeout(5)->connectTimeout(3)->acceptJson()->get($jwksUri);
+            } catch (Throwable $e) {
+                throw new OidcJwksException("Failed to fetch JWKS: {$e->getMessage()}", previous: $e);
+            }
+
+            if ($response->failed()) {
+                throw new OidcJwksException("JWKS endpoint returned HTTP {$response->status()}");
+            }
+
+            $json = $response->json();
+            if (! is_array($json) || ! is_array($json['keys'] ?? null)) {
+                throw new OidcJwksException("JWKS endpoint returned an invalid payload without 'keys'.");
+            }
+
+            return $json;
+        });
+    }
+
+    private function assertHttpsUrl(string $url, Throwable $exception): void
+    {
+        $parts = parse_url($url);
+
+        if (($parts['scheme'] ?? null) !== 'https' || ! is_string($parts['host'] ?? null) || $parts['host'] === '') {
+            throw $exception;
+        }
+    }
+}

app/Auth/Oidc/OidcTokenValidator.php

@@ -0,0 +1,199 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use App\Auth\Oidc\Exceptions\OidcSigningKeyNotFoundException;
+use App\Auth\Oidc\Exceptions\OidcTokenException;
+use Firebase\JWT\JWK;
+use Firebase\JWT\JWT;
+use Throwable;
+
+class OidcTokenValidator
+{
+    /**
+     * Algorithms we accept for id_token signatures. RS256 only — this is the
+     * OIDC baseline and a strict allowlist prevents algorithm-confusion and
+     * "none" attacks.
+     */
+    private const ALLOWED_ALGORITHM = 'RS256';
+
+    /**
+     * @param  array<string, mixed>  $jwks
+     * @return array<string, mixed>
+     */
+    public function validate(
+        string $idToken,
+        OidcDiscoveryDocument $discovery,
+        array $jwks,
+        string $clientId,
+        ?string $expectedNonce = null,
+        int $clockSkewSeconds = 60,
+    ): array {
+        $kid = $this->extractKid($idToken);
+
+        try {
+            $keys = JWK::parseKeySet($this->signingKeysOnly($jwks), self::ALLOWED_ALGORITHM);
+        } catch (Throwable $e) {
+            throw new OidcTokenException("Unable to parse JWKS: {$e->getMessage()}", previous: $e);
+        }
+
+        // Surface an unknown signing key distinctly so the caller can refresh
+        // the JWKS once (key rotation) before giving up.
+        if (! array_key_exists($kid, $keys)) {
+            throw new OidcSigningKeyNotFoundException('No matching JWKS key found for id_token kid.');
+        }
+
+        $previousLeeway = JWT::$leeway;
+        JWT::$leeway = $clockSkewSeconds;
+
+        try {
+            // Validates signature, header alg against the key alg (RS256),
+            // exp, nbf and iat. Throws on any failure.
+            $claims = (array) JWT::decode($idToken, $keys);
+        } catch (OidcTokenException $e) {
+            throw $e;
+        } catch (Throwable $e) {
+            throw new OidcTokenException("id_token validation failed: {$e->getMessage()}", previous: $e);
+        } finally {
+            JWT::$leeway = $previousLeeway;
+        }
+
+        $this->assertExpiry($claims);
+        $this->assertIssuer($claims, $discovery->issuer);
+        $this->assertAudience($claims, $clientId);
+        $this->assertNonce($claims, $expectedNonce);
+        $this->assertSubject($claims);
+
+        return $claims;
+    }
+
+    /**
+     * Drop JWKS entries explicitly marked for anything other than signing
+     * (e.g. "use":"enc") so they can never verify an id_token signature.
+     * firebase/php-jwt does not honour the "use" parameter on its own.
+     *
+     * @param  array<string, mixed>  $jwks
+     * @return array<string, mixed>
+     */
+    private function signingKeysOnly(array $jwks): array
+    {
+        $keys = array_values(array_filter(
+            $jwks['keys'] ?? [],
+            fn ($jwk): bool => is_array($jwk) && (! isset($jwk['use']) || $jwk['use'] === 'sig'),
+        ));
+
+        return ['keys' => $keys];
+    }
+
+    /**
+     * Decode just the JWT header to read the kid before signature
+     * verification, so an unknown key can be reported as a rotation miss.
+     */
+    private function extractKid(string $idToken): string
+    {
+        $segments = explode('.', $idToken);
+        if (count($segments) !== 3) {
+            throw new OidcTokenException('Malformed id_token.');
+        }
+
+        $header = json_decode($this->base64UrlDecode($segments[0]), true);
+        if (! is_array($header)) {
+            throw new OidcTokenException('id_token header contains invalid JSON.');
+        }
+
+        if (($header['alg'] ?? null) !== self::ALLOWED_ALGORITHM) {
+            throw new OidcTokenException('id_token uses a disallowed algorithm.');
+        }
+
+        $kid = $header['kid'] ?? null;
+        if (! is_string($kid) || $kid === '') {
+            throw new OidcTokenException('id_token header is missing kid.');
+        }
+
+        return $kid;
+    }
+
+    private function base64UrlDecode(string $value): string
+    {
+        $remainder = strlen($value) % 4;
+        if ($remainder !== 0) {
+            $value .= str_repeat('=', 4 - $remainder);
+        }
+
+        $decoded = base64_decode(strtr($value, '-_', '+/'), true);
+        if ($decoded === false) {
+            throw new OidcTokenException('Invalid base64url value in id_token header.');
+        }
+
+        return $decoded;
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertExpiry(array $claims): void
+    {
+        // Firebase enforces the exp window when present; OIDC requires it to exist.
+        if (! is_numeric($claims['exp'] ?? null)) {
+            throw new OidcTokenException('id_token is missing the exp claim.');
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertSubject(array $claims): void
+    {
+        $subject = $claims['sub'] ?? null;
+        if (! is_string($subject) || $subject === '') {
+            throw new OidcTokenException('id_token subject is missing or invalid.');
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertIssuer(array $claims, string $expectedIssuer): void
+    {
+        if (($claims['iss'] ?? null) !== $expectedIssuer) {
+            throw new OidcTokenException('id_token issuer does not match discovery issuer.');
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertAudience(array $claims, string $clientId): void
+    {
+        $audience = $claims['aud'] ?? null;
+        if (is_string($audience)) {
+            $audience = [$audience];
+        }
+
+        if (! is_array($audience) || ! in_array($clientId, $audience, true)) {
+            throw new OidcTokenException('id_token audience does not include configured client id.');
+        }
+
+        if (count($audience) > 1 && (! isset($claims['azp']) || $claims['azp'] !== $clientId)) {
+            throw new OidcTokenException('id_token azp is required when aud contains multiple values and must match configured client id.');
+        }
+
+        if (isset($claims['azp']) && $claims['azp'] !== $clientId) {
+            throw new OidcTokenException('id_token azp does not match configured client id.');
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertNonce(array $claims, ?string $expectedNonce): void
+    {
+        if ($expectedNonce === null) {
+            return;
+        }
+
+        if (($claims['nonce'] ?? null) !== $expectedNonce) {
+            throw new OidcTokenException('id_token nonce does not match.');
+        }
+    }
+}

app/Auth/Oidc/OidcUser.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use Laravel\Socialite\Two\User as SocialiteUser;
+
+class OidcUser extends SocialiteUser
+{
+    public ?string $issuer = null;
+
+    public ?string $subject = null;
+
+    public bool $emailVerified = false;
+
+    /**
+     * @var array<string, mixed>
+     */
+    public array $idTokenClaims = [];
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    public function setIdTokenClaims(array $claims): self
+    {
+        $this->idTokenClaims = $claims;
+        $this->issuer = is_string($claims['iss'] ?? null) ? $claims['iss'] : null;
+        $this->subject = is_string($claims['sub'] ?? null) ? $claims['sub'] : null;
+        $this->emailVerified = ($claims['email_verified'] ?? false) === true;
+
+        return $this;
+    }
+}

app/Auth/Oidc/Socialite/OidcProvider.php

@@ -0,0 +1,299 @@
+<?php
+
+namespace App\Auth\Oidc\Socialite;
+
+use App\Auth\Oidc\Exceptions\OidcException;
+use App\Auth\Oidc\Exceptions\OidcSigningKeyNotFoundException;
+use App\Auth\Oidc\OidcConfig;
+use App\Auth\Oidc\OidcDiscoveryDocument;
+use App\Auth\Oidc\OidcDiscoveryService;
+use App\Auth\Oidc\OidcTokenValidator;
+use App\Auth\Oidc\OidcUser;
+use GuzzleHttp\RequestOptions;
+use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Str;
+use Laravel\Socialite\Two\AbstractProvider;
+use Laravel\Socialite\Two\InvalidStateException;
+use Laravel\Socialite\Two\ProviderInterface;
+
+class OidcProvider extends AbstractProvider implements ProviderInterface
+{
+    private const int OIDC_FLOW_TTL_MINUTES = 10;
+
+    /**
+     * @var array<int, string>
+     */
+    protected $scopes = ['openid', 'email', 'profile'];
+
+    protected $scopeSeparator = ' ';
+
+    protected ?OidcConfig $oidcConfig = null;
+
+    protected ?OidcDiscoveryDocument $discovery = null;
+
+    public function __construct(
+        Request $request,
+        protected OidcDiscoveryService $discoveryService,
+        protected OidcTokenValidator $tokenValidator,
+        string $clientId,
+        string $clientSecret,
+        string $redirectUrl,
+    ) {
+        parent::__construct($request, $clientId, $clientSecret, $redirectUrl);
+    }
+
+    public function setConfig(OidcConfig $config): self
+    {
+        $this->oidcConfig = $config;
+        $this->clientId = $config->clientId;
+        $this->clientSecret = $config->clientSecret;
+        $this->redirectUrl = $config->redirectUri;
+        $this->scopes = $config->scopes;
+        $this->discovery = null;
+
+        return $this;
+    }
+
+    public function getConfig(): OidcConfig
+    {
+        if ($this->oidcConfig === null) {
+            throw new OidcException('OIDC provider config is not set.');
+        }
+
+        return $this->oidcConfig;
+    }
+
+    protected function getAuthUrl($state): string
+    {
+        $config = $this->getConfig();
+        $nonce = Str::random(40);
+        $this->putOidcFlowValue($this->nonceSessionKey($state), $nonce);
+
+        $extra = ['nonce' => $nonce];
+        if ($config->usePkce) {
+            $verifier = $this->generateCodeVerifier();
+            $this->putOidcFlowValue($this->verifierSessionKey($state), $verifier);
+            $extra['code_challenge'] = $this->codeChallenge($verifier);
+            $extra['code_challenge_method'] = 'S256';
+        }
+
+        return $this->buildAuthUrlFromBase($this->resolveDiscovery()->authorizationEndpoint, $state)
+            .'&'.http_build_query($extra, '', '&', $this->encodingType);
+    }
+
+    protected function getTokenUrl(): string
+    {
+        return $this->resolveDiscovery()->tokenEndpoint;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function getUserByToken($token): array
+    {
+        $response = $this->getHttpClient()->get($this->resolveDiscovery()->userinfoEndpoint, [
+            RequestOptions::HEADERS => [
+                'Accept' => 'application/json',
+                'Authorization' => 'Bearer '.$token,
+            ],
+            RequestOptions::CONNECT_TIMEOUT => 5,
+            RequestOptions::TIMEOUT => 10,
+        ]);
+
+        $decoded = json_decode((string) $response->getBody(), true);
+
+        return is_array($decoded) ? $decoded : [];
+    }
+
+    /**
+     * @param  array<string, mixed>  $user
+     */
+    protected function mapUserToObject(array $user)
+    {
+        return (new OidcUser)->setRaw($user)->map([
+            'id' => $user['sub'] ?? null,
+            'nickname' => $user['preferred_username'] ?? null,
+            'name' => $this->resolveName($user),
+            'email' => $user['email'] ?? null,
+            'avatar' => $user['picture'] ?? null,
+        ]);
+    }
+
+    public function user()
+    {
+        if ($this->user) {
+            return $this->user;
+        }
+
+        if ($this->hasInvalidState()) {
+            throw new InvalidStateException;
+        }
+
+        $tokenResponse = $this->getAccessTokenResponse($this->getCode());
+        $accessToken = Arr::get($tokenResponse, 'access_token');
+        $idToken = Arr::get($tokenResponse, 'id_token');
+
+        if (! is_string($accessToken) || $accessToken === '' || ! is_string($idToken) || $idToken === '') {
+            throw new OidcException('OIDC token endpoint did not return required tokens.');
+        }
+
+        $discovery = $this->resolveDiscovery();
+        $config = $this->getConfig();
+        $expectedNonce = $this->pullOidcFlowValue($this->nonceSessionKey((string) $this->request->input('state')));
+        if ($expectedNonce === null) {
+            throw new OidcException('OIDC login session expired. Please try again.');
+        }
+
+        $claims = $this->validateIdToken($idToken, $discovery, $config, $expectedNonce);
+
+        $userinfo = $this->getUserByToken($accessToken);
+
+        // OIDC core §5.3.2: the userinfo sub MUST match the id_token sub.
+        // Reject the response rather than trust unsigned userinfo claims.
+        $userinfoSub = $userinfo['sub'] ?? null;
+        if (is_string($userinfoSub) && $userinfoSub !== '' && $userinfoSub !== ($claims['sub'] ?? null)) {
+            throw new OidcException('OIDC userinfo subject does not match the id_token subject.');
+        }
+
+        $merged = array_merge($userinfo, $claims);
+
+        /** @var OidcUser $user */
+        $user = $this->mapUserToObject($merged);
+        $user->setIdTokenClaims($claims)
+            ->setToken($accessToken)
+            ->setRefreshToken(Arr::get($tokenResponse, 'refresh_token'))
+            ->setExpiresIn(Arr::get($tokenResponse, 'expires_in'));
+
+        return $this->user = $user;
+    }
+
+    /**
+     * Validate the id_token, retrying once against a freshly fetched JWKS when
+     * the signing key is unknown. This keeps logins working immediately after
+     * the IdP rotates keys instead of failing until the JWKS cache expires.
+     *
+     * @return array<string, mixed>
+     */
+    protected function validateIdToken(
+        string $idToken,
+        OidcDiscoveryDocument $discovery,
+        OidcConfig $config,
+        ?string $expectedNonce,
+    ): array {
+        foreach ([false, true] as $forceRefresh) {
+            try {
+                return $this->tokenValidator->validate(
+                    idToken: $idToken,
+                    discovery: $discovery,
+                    jwks: $this->discoveryService->jwks($discovery->jwksUri, $forceRefresh),
+                    clientId: $config->clientId,
+                    expectedNonce: $expectedNonce,
+                    clockSkewSeconds: $config->clockSkewSeconds,
+                );
+            } catch (OidcSigningKeyNotFoundException $e) {
+                if ($forceRefresh) {
+                    throw $e;
+                }
+            }
+        }
+
+        throw new OidcSigningKeyNotFoundException('No matching JWKS key found for id_token kid.');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function getAccessTokenResponse($code)
+    {
+        $fields = $this->getTokenFields($code);
+        if ($this->getConfig()->usePkce) {
+            $verifier = $this->pullOidcFlowValue($this->verifierSessionKey((string) $this->request->input('state')));
+            if ($verifier === null) {
+                throw new OidcException('OIDC login session expired. Please try again.');
+            }
+
+            $fields['code_verifier'] = $verifier;
+        }
+
+        $response = $this->getHttpClient()->post($this->getTokenUrl(), [
+            RequestOptions::HEADERS => ['Accept' => 'application/json'],
+            RequestOptions::FORM_PARAMS => $fields,
+            RequestOptions::CONNECT_TIMEOUT => 5,
+            RequestOptions::TIMEOUT => 10,
+        ]);
+
+        $decoded = json_decode((string) $response->getBody(), true);
+
+        return is_array($decoded) ? $decoded : [];
+    }
+
+    protected function resolveDiscovery(): OidcDiscoveryDocument
+    {
+        return $this->discovery ??= $this->discoveryService->discover($this->getConfig()->issuerUrl);
+    }
+
+    protected function generateCodeVerifier(): string
+    {
+        return rtrim(strtr(base64_encode(random_bytes(64)), '+/', '-_'), '=');
+    }
+
+    protected function codeChallenge(string $verifier): string
+    {
+        return rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');
+    }
+
+    /**
+     * @param  array<string, mixed>  $user
+     */
+    protected function resolveName(array $user): ?string
+    {
+        if (is_string($user['name'] ?? null) && $user['name'] !== '') {
+            return $user['name'];
+        }
+
+        $name = trim(((string) ($user['given_name'] ?? '')).' '.((string) ($user['family_name'] ?? '')));
+
+        return $name === '' ? null : $name;
+    }
+
+    protected function putOidcFlowValue(string $key, string $value): void
+    {
+        $this->request->session()->put($key, [
+            'value' => $value,
+            'expires_at' => now()->addMinutes(self::OIDC_FLOW_TTL_MINUTES)->timestamp,
+        ]);
+    }
+
+    protected function pullOidcFlowValue(string $key): ?string
+    {
+        $entry = $this->request->session()->pull($key);
+
+        if (! is_array($entry)) {
+            return null;
+        }
+
+        $value = $entry['value'] ?? null;
+        $expiresAt = $entry['expires_at'] ?? null;
+
+        if (! is_string($value) || $value === '' || ! is_int($expiresAt)) {
+            return null;
+        }
+
+        if ($expiresAt < now()->timestamp) {
+            return null;
+        }
+
+        return $value;
+    }
+
+    protected function nonceSessionKey(string $state): string
+    {
+        return "oidc.nonce.{$state}";
+    }
+
+    protected function verifierSessionKey(string $state): string
+    {
+        return "oidc.code_verifier.{$state}";
+    }
+}

app/Console/Commands/ManageDevelopmentQemuVmCommand.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\Development\ManageDevelopmentQemuVm;
+use Illuminate\Console\Command;
+
+use function Laravel\Prompts\multiselect;
+
+class ManageDevelopmentQemuVmCommand extends Command
+{
+    protected $signature = 'dev:qemu {profiles?* : Profile keys from config/development-qemu.php}';
+
+    protected $description = 'Recreate selected development QEMU VMs and seed their Coolify servers';
+
+    public function handle(): int
+    {
+        if (! isDev()) {
+            $this->error('This command may only run in development mode.');
+
+            return self::FAILURE;
+        }
+
+        $profiles = config('development-qemu.profiles');
+        $profileNames = $this->argument('profiles') ?: multiselect(
+            label: 'Which QEMU servers should be started and seeded?',
+            options: collect($profiles)->mapWithKeys(fn (array $profile, string $key) => [$key => $profile['label']])->all(),
+            required: true,
+        );
+
+        ManageDevelopmentQemuVm::run($profileNames);
+
+        foreach ($profileNames as $profileName) {
+            $profile = $profiles[$profileName];
+            $this->info("Started and seeded {$profile['label']} at {$profile['ip']}.");
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/SeedDevelopmentQemuServerCommand.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\Development\SeedDevelopmentQemuServer;
+use Illuminate\Console\Command;
+
+class SeedDevelopmentQemuServerCommand extends Command
+{
+    protected $signature = 'dev:qemu:seed {profile : Profile key from config/development-qemu.php} {--keep-others}';
+
+    protected $description = 'Seed one development QEMU server in the Coolify database';
+
+    public function handle(): int
+    {
+        if (! isDev()) {
+            $this->error('This command may only run in development mode.');
+
+            return self::FAILURE;
+        }
+
+        $server = SeedDevelopmentQemuServer::run($this->argument('profile'), ! $this->option('keep-others'));
+        $this->info("Seeded {$server->name} at {$server->ip}.");
+
+        return self::SUCCESS;
+    }
+}

app/Console/Kernel.php

@@ -15,10 +15,7 @@ use App\Jobs\RegenerateSslCertJob;
 use App\Jobs\ScheduledJobManager;
 use App\Jobs\ServerManagerJob;
 use App\Jobs\UpdateCoolifyJob;
-use App\Jobs\V5ReconcileServersJob;
-use App\Jobs\V5RotateAgentTokensJob;
 use App\Models\InstanceSettings;
-use App\Support\V5\V5Feature;
 use Illuminate\Console\Scheduling\Schedule;
 use Illuminate\Foundation\Console\Kernel as ConsoleKernel;
 
@@ -52,11 +49,6 @@ class Kernel extends ConsoleKernel
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
 
-        if (V5Feature::enabled()) {
-            $this->scheduleInstance->job(new V5ReconcileServersJob)->everyFiveMinutes()->withoutOverlapping()->onOneServer();
-            $this->scheduleInstance->job(new V5RotateAgentTokensJob)->everyFifteenMinutes()->withoutOverlapping()->onOneServer();
-        }
-
         if (isDev()) {
             // Instance Jobs
             $this->scheduleInstance->command('horizon:snapshot')->everyMinute();

app/Helpers/SshMultiplexingHelper.php

@@ -87,15 +87,48 @@ class SshMultiplexingHelper
             return false;
         }
 
-        self::storeConnectionMetadata($server);
-
         return true;
     }
 
     public static function removeMuxFile(Server $server): void
     {
-        Process::run(self::muxControlCommand($server, 'exit'));
-        self::clearConnectionMetadata($server);
+        $checkProcess = Process::run(self::muxControlCommand($server, 'check'));
+        $pid = preg_match('/pid=(\d+)/', $checkProcess->output().$checkProcess->errorOutput(), $matches)
+            ? $matches[1]
+            : null;
+
+        if ($pid !== null) {
+            self::markMuxProcessAsRetiring($pid, self::muxSocket($server));
+        }
+
+        $stopProcess = Process::run(self::muxControlCommand($server, 'stop'));
+
+        if ($pid !== null && ! $stopProcess->successful()) {
+            self::unmarkMuxProcessAsRetiring($pid, self::muxSocket($server));
+        }
+    }
+
+    public static function markMuxProcessAsRetiring(string $pid, string $muxSocket, ?string $processStartTime = null): void
+    {
+        $processStartTime ??= self::processStartTime($pid);
+        Cache::forever(self::muxProcessRetirementKey($pid, $muxSocket, $processStartTime), true);
+    }
+
+    public static function isMuxProcessRetiring(string $pid, string $muxSocket, ?string $processStartTime = null): bool
+    {
+        $processStartTime ??= self::processStartTime($pid);
+        $key = self::muxProcessRetirementKey($pid, $muxSocket, $processStartTime);
+        if (! Cache::has($key)) {
+            return false;
+        }
+
+        return true;
+    }
+
+    public static function unmarkMuxProcessAsRetiring(string $pid, string $muxSocket, ?string $processStartTime = null): void
+    {
+        $processStartTime ??= self::processStartTime($pid);
+        Cache::forget(self::muxProcessRetirementKey($pid, $muxSocket, $processStartTime));
     }
 
     public static function generateScpCommand(Server $server, string $source, string $dest): string
@@ -210,12 +243,18 @@ class SshMultiplexingHelper
 
         $delimiter = base64_encode(Hash::make($command));
         $command = str_replace($delimiter, '', $command);
+        $remoteShellCommand = self::remoteShellCommand();
 
-        return $sshCommand.self::escapedUserAtHost($server)." 'bash -se' << \\$delimiter".PHP_EOL
+        return $sshCommand.self::escapedUserAtHost($server)." '{$remoteShellCommand}' << \\$delimiter".PHP_EOL
             .$command.PHP_EOL
             .$delimiter;
     }
 
+    private static function remoteShellCommand(): string
+    {
+        return 'if command -v bash >/dev/null 2>&1; then exec bash -se; else exec sh -se; fi';
+    }
+
     public static function getConnectionTimeout(Server $server): int
     {
         $timeout = data_get($server, 'settings.connection_timeout');
@@ -242,25 +281,6 @@ class SshMultiplexingHelper
         return $process->exitCode() === 0 && str_contains($process->output(), 'health_check_ok');
     }
 
-    public static function isConnectionExpired(Server $server): bool
-    {
-        $connectionAge = self::getConnectionAge($server);
-        $maxAge = config('constants.ssh.mux_max_age');
-
-        return $connectionAge !== null && $connectionAge > $maxAge;
-    }
-
-    public static function getConnectionAge(Server $server): ?int
-    {
-        $connectionTime = Cache::get("ssh_mux_connection_time_{$server->uuid}");
-
-        if ($connectionTime === null) {
-            return null;
-        }
-
-        return time() - $connectionTime;
-    }
-
     public static function refreshMultiplexedConnection(Server $server): bool
     {
         self::removeMuxFile($server);
@@ -273,6 +293,28 @@ class SshMultiplexingHelper
         return 'ssh_mux_lock_'.(gethostname() ?: 'unknown').'_'.$server->uuid;
     }
 
+    private static function muxProcessRetirementKey(string $pid, string $muxSocket, ?string $processStartTime): string
+    {
+        return 'ssh_mux_retiring_'.hash('sha256', self::processScope().'|'.$pid.'|'.$processStartTime.'|'.$muxSocket);
+    }
+
+    private static function processScope(): string
+    {
+        return (gethostname() ?: 'unknown').'|'.(@readlink('/proc/self/ns/pid') ?: 'unknown');
+    }
+
+    private static function processStartTime(string $pid): ?string
+    {
+        $stat = @file_get_contents("/proc/{$pid}/stat");
+        if ($stat === false || ! preg_match('/^\d+ \(.*\) (.*)$/', trim($stat), $matches)) {
+            return null;
+        }
+
+        $fields = preg_split('/\s+/', $matches[1]);
+
+        return $fields[19] ?? null;
+    }
+
     private static function masterConnectionExists(Server $server): bool
     {
         return Process::run(self::muxControlCommand($server, 'check'))->exitCode() === 0;
@@ -284,14 +326,6 @@ class SshMultiplexingHelper
             return false;
         }
 
-        if (self::getConnectionAge($server) === null) {
-            self::storeConnectionMetadata($server);
-        }
-
-        if (self::isConnectionExpired($server)) {
-            return false;
-        }
-
         if (config('constants.ssh.mux_health_check_enabled') && ! self::isConnectionHealthy($server)) {
             return false;
         }
@@ -382,14 +416,4 @@ class SshMultiplexingHelper
 
         return $options.'-p '.escapeshellarg((string) $server->port).' ';
     }
-
-    private static function storeConnectionMetadata(Server $server): void
-    {
-        Cache::put("ssh_mux_connection_time_{$server->uuid}", time(), config('constants.ssh.mux_persist_time') + 300);
-    }
-
-    private static function clearConnectionMetadata(Server $server): void
-    {
-        Cache::forget("ssh_mux_connection_time_{$server->uuid}");
-    }
 }

app/Http/Controllers/Api/ApplicationsController.php

@@ -2884,6 +2884,10 @@ class ApplicationsController extends Controller
             ], 422);
         }
 
+        $requestHasHttpBasicAuth = $request->has('is_http_basic_auth_enabled')
+            || $request->has('http_basic_auth_username')
+            || $request->has('http_basic_auth_password');
+
         if ($request->has('is_http_basic_auth_enabled') && $request->is_http_basic_auth_enabled === true) {
             if (blank($application->http_basic_auth_username) || blank($application->http_basic_auth_password)) {
                 $validationErrors = [];
@@ -2901,10 +2905,6 @@ class ApplicationsController extends Controller
                 }
             }
         }
-        if ($request->has('is_http_basic_auth_enabled') && $application->is_container_label_readonly_enabled === false) {
-            $application->custom_labels = str(implode('|coolify|', generateLabelsApplication($application)))->replace('|coolify|', "\n");
-            $application->save();
-        }
 
         // For dockercompose applications, domains (fqdn) field should not be used
         // Only docker_compose_domains should be used to set domains for individual services
@@ -3119,7 +3119,7 @@ class ApplicationsController extends Controller
             // Must run after fqdn is filled: flags are kept only for domains the app still has.
             $application->setNoindexDomains($request->input('noindex_domains') ?? []);
         }
-        if ($application->settings->is_container_label_readonly_enabled && ($requestHasDomains || $requestHasNoindexDomains) && $server->isProxyShouldRun()) {
+        if ($application->settings->is_container_label_readonly_enabled && ($requestHasDomains || $requestHasNoindexDomains || $requestHasHttpBasicAuth) && $server->isProxyShouldRun()) {
             $application->custom_labels = str(implode('|coolify|', generateLabelsApplication($application)))->replace('|coolify|', "\n");
         }
         $application->save();

app/Http/Controllers/Api/DeployController.php

@@ -238,57 +238,71 @@ class DeployController extends Controller
             ApplicationDeploymentStatus::IN_PROGRESS->value,
         ];
 
-        if (! in_array($deployment->status, $cancellableStatuses)) {
+        if (! in_array($deployment->status, $cancellableStatuses, true)) {
             return response()->json([
                 'message' => "Deployment cannot be cancelled. Current status: {$deployment->status}",
             ], 400);
         }
 
         // Perform the cancellation
+        $cancelled = false;
+        $deploymentServer = Server::whereTeamId($teamId)->find($deployment->server_id);
+
         try {
             $deployment_uuid = $deployment->deployment_uuid;
             $kill_command = "docker rm -f {$deployment_uuid}";
             $build_server_id = $deployment->build_server_id ?? $deployment->server_id;
 
             // Mark deployment as cancelled
-            $deployment->update([
-                'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
-            ]);
+            $updated = ApplicationDeploymentQueue::whereKey($deployment->getKey())
+                ->whereIn('status', $cancellableStatuses)
+                ->update(['status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value]);
+
+            if ($updated !== 1) {
+                $deployment->refresh();
+
+                return response()->json([
+                    'message' => "Deployment cannot be cancelled. Current status: {$deployment->status}",
+                ], 400);
+            }
+
+            $deployment->status = ApplicationDeploymentStatus::CANCELLED_BY_USER->value;
+            $cancelled = true;
 
             // Get the server
             $server = Server::whereTeamId($teamId)->find($build_server_id);
 
-            if ($server) {
-                // Add cancellation log entry
-                $deployment->addLogEntry('Deployment cancelled by user via API.', 'stderr');
+            try {
+                if ($server) {
+                    // Add cancellation log entry
+                    $deployment->addLogEntry('Deployment cancelled by user via API.', 'stderr');
 
-                // Check if container exists and kill it
-                $checkCommand = "docker ps -a --filter name={$deployment_uuid} --format '{{.Names}}'";
-                $containerExists = instant_remote_process([$checkCommand], $server);
+                    // Check if container exists and kill it
+                    $checkCommand = "docker ps -a --filter name={$deployment_uuid} --format '{{.Names}}'";
+                    $containerExists = instant_remote_process([$checkCommand], $server);
 
-                if ($containerExists && str($containerExists)->trim()->isNotEmpty()) {
-                    instant_remote_process([$kill_command], $server);
-                    $deployment->addLogEntry('Deployment container stopped.');
-                } else {
-                    $deployment->addLogEntry('Deployment container not yet started. Will be cancelled when job checks status.');
-                }
+                    if ($containerExists && str($containerExists)->trim()->isNotEmpty()) {
+                        instant_remote_process([$kill_command], $server);
+                        $deployment->addLogEntry('Deployment container stopped.');
+                    } else {
+                        $deployment->addLogEntry('Deployment container not yet started. Will be cancelled when job checks status.');
+                    }
 
-                // Kill running process if process ID exists
-                if ($deployment->current_process_id) {
-                    try {
+                    // Kill running process if process ID exists
+                    if ($deployment->current_process_id) {
                         $processKillCommand = "kill -9 {$deployment->current_process_id}";
                         instant_remote_process([$processKillCommand], $server);
-                    } catch (\Throwable $e) {
-                        // Process might already be gone
                     }
                 }
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to clean up cancelled deployment {$deployment->id}: {$e->getMessage()}");
             }
 
             auditLog('api.deployment.cancelled', [
                 'team_id' => $teamId,
                 'deployment_uuid' => $deployment->deployment_uuid,
-                'application_id' => $application?->id,
-                'application_uuid' => $application?->uuid,
+                'application_id' => $deployment->application_id,
+                'application_uuid' => $deployment->application?->uuid,
                 'server_id' => $deployment->server_id,
             ]);
 
@@ -301,6 +315,14 @@ class DeployController extends Controller
             return response()->json([
                 'message' => 'Failed to cancel deployment: '.$e->getMessage(),
             ], 500);
+        } finally {
+            if ($cancelled) {
+                try {
+                    next_after_cancel($deploymentServer);
+                } catch (\Throwable $e) {
+                    \Log::warning("Failed to advance deployment queue after cancelling deployment {$deployment->id}: {$e->getMessage()}");
+                }
+            }
         }
     }
 

app/Http/Controllers/Api/InstanceEmailSettingsController.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\InstanceSettings;
+use App\Rules\ValidHostname;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
+use OpenApi\Attributes as OA;
+
+class InstanceEmailSettingsController extends Controller
+{
+    private const FIELDS = [
+        'smtp_enabled', 'smtp_from_address', 'smtp_from_name', 'smtp_host',
+        'smtp_port', 'smtp_encryption', 'smtp_username', 'smtp_password',
+        'smtp_timeout', 'smtp_ehlo_domain', 'resend_enabled', 'resend_api_key',
+    ];
+
+    #[OA\Get(
+        summary: 'Get instance email settings',
+        description: 'Get instance-wide SMTP and Resend settings. Requires a root-team token belonging to a root-team admin or owner. Sensitive fields require the `read:sensitive` or `root` token ability.',
+        path: '/settings/email', operationId: 'get-instance-email-settings',
+        security: [['bearerAuth' => []]], tags: ['Settings'],
+        responses: [
+            new OA\Response(response: 200, description: 'Instance email settings.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Forbidden.'),
+        ]
+    )]
+    public function show(): JsonResponse
+    {
+        $settings = InstanceSettings::get();
+        $this->authorizeRootTeam('view', $settings);
+
+        return response()->json($this->serialize($settings));
+    }
+
+    #[OA\Patch(
+        summary: 'Update instance email settings',
+        description: 'Update instance-wide SMTP and Resend settings. Requires `write:sensitive` and a root-team token belonging to a root-team admin or owner.',
+        path: '/settings/email', operationId: 'update-instance-email-settings',
+        security: [['bearerAuth' => []]], tags: ['Settings'],
+        responses: [
+            new OA\Response(response: 200, description: 'Updated instance email settings.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Forbidden.'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ]
+    )]
+    public function update(Request $request): JsonResponse
+    {
+        $settings = InstanceSettings::get();
+        $this->authorizeRootTeam('update', $settings);
+
+        $validator = customApiValidator($request->json()->all(), [
+            'smtp_enabled' => 'sometimes|boolean',
+            'smtp_from_address' => 'sometimes|nullable|email',
+            'smtp_from_name' => 'sometimes|nullable|string|max:255',
+            'smtp_host' => 'sometimes|nullable|string|max:255',
+            'smtp_port' => 'sometimes|nullable|integer|min:1|max:65535',
+            'smtp_encryption' => 'sometimes|nullable|string|in:starttls,tls,none',
+            'smtp_username' => 'sometimes|nullable|string|max:255',
+            'smtp_password' => 'sometimes|nullable|string|max:255',
+            'smtp_timeout' => 'sometimes|nullable|integer|min:0',
+            'smtp_ehlo_domain' => ['sometimes', 'nullable', 'string', 'max:255', new ValidHostname],
+            'resend_enabled' => 'sometimes|boolean',
+            'resend_api_key' => 'sometimes|nullable|string|max:255',
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $validator->errors()], 422);
+        }
+
+        $settings->fill($validator->validated());
+        $settings->save();
+
+        auditLog('api.settings.email.updated', ['changed_fields' => array_keys($validator->validated())]);
+
+        return response()->json($this->serialize($settings->refresh()));
+    }
+
+    private function authorizeRootTeam(string $ability, InstanceSettings $settings): void
+    {
+        $teamId = getTeamIdFromToken();
+        abort_unless(! is_null($teamId) && (int) $teamId === 0, 403, 'Instance email settings require a root-team API token.');
+        $this->authorize($ability, $settings);
+    }
+
+    private function serialize(InstanceSettings $settings): array
+    {
+        exposeSensitiveFields($settings);
+
+        return Arr::only($settings->toArray(), self::FIELDS);
+    }
+}

app/Http/Controllers/Api/NotificationsController.php

@@ -11,6 +11,7 @@ use App\Models\Team;
 use App\Models\TelegramNotificationSettings;
 use App\Models\WebhookNotificationSettings;
 use App\Rules\SafeWebhookUrl;
+use App\Rules\ValidHostname;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -37,6 +38,7 @@ class NotificationsController extends Controller
                     'smtp_username' => 'sometimes|nullable|string|max:255',
                     'smtp_password' => 'sometimes|nullable|string|max:255',
                     'smtp_timeout' => 'sometimes|nullable|integer|min:0',
+                    'smtp_ehlo_domain' => ['sometimes', 'nullable', 'string', 'max:255', new ValidHostname],
                     'resend_enabled' => 'sometimes|boolean',
                     'resend_api_key' => 'sometimes|nullable|string|max:255',
                     'use_instance_email_settings' => 'sometimes|boolean',
@@ -283,7 +285,7 @@ class NotificationsController extends Controller
 
     #[OA\Get(
         summary: 'Get email notification settings',
-        description: 'Get the current team email notification settings. Encrypted secrets are only returned when the token has `read:sensitive` (or `root`) and the user is a team admin/owner.',
+        description: 'Get the current team email notification settings, including `smtp_ehlo_domain`, the hostname sent with SMTP EHLO. Encrypted secrets are only returned when the token has `read:sensitive` (or `root`) and the user is a team admin/owner.',
         path: '/notifications/email',
         operationId: 'get-current-team-email-notifications',
         security: [['bearerAuth' => []]],
@@ -301,7 +303,7 @@ class NotificationsController extends Controller
 
     #[OA\Patch(
         summary: 'Update email notification settings',
-        description: 'Update the current team email notification settings.',
+        description: 'Update the current team email notification settings. Set `smtp_ehlo_domain` to a valid hostname to control the SMTP EHLO domain, or `null` to use the system default.',
         path: '/notifications/email',
         operationId: 'update-current-team-email-notifications',
         security: [['bearerAuth' => []]],

app/Http/Controllers/Api/OtherController.php

@@ -316,6 +316,6 @@ class OtherController extends Controller
     )]
     public function healthcheck(Request $request)
     {
-        return 'OK';
+        return response('OK');
     }
 }

app/Http/Controllers/Api/ServiceApplicationsController.php

@@ -256,6 +256,7 @@ class ServiceApplicationsController extends Controller
                         'is_log_drain_enabled' => new OA\Property(property: 'is_log_drain_enabled', type: 'boolean', nullable: true),
                         'is_gzip_enabled' => new OA\Property(property: 'is_gzip_enabled', type: 'boolean', nullable: true),
                         'is_stripprefix_enabled' => new OA\Property(property: 'is_stripprefix_enabled', type: 'boolean', nullable: true),
+                        'is_force_https_enabled' => new OA\Property(property: 'is_force_https_enabled', type: 'boolean', nullable: true),
                     ]
                 )
             )
@@ -328,6 +329,7 @@ class ServiceApplicationsController extends Controller
             'is_log_drain_enabled',
             'is_gzip_enabled',
             'is_stripprefix_enabled',
+            'is_force_https_enabled',
         ];
 
         $validationRules = [
@@ -341,6 +343,7 @@ class ServiceApplicationsController extends Controller
             'is_log_drain_enabled' => 'sometimes|boolean',
             'is_gzip_enabled' => 'sometimes|boolean',
             'is_stripprefix_enabled' => 'sometimes|boolean',
+            'is_force_https_enabled' => 'sometimes|boolean',
         ];
 
         $validator = Validator::make($payload, $validationRules);

app/Http/Controllers/Api/VolumeBackupsController.php

@@ -34,7 +34,7 @@ use RuntimeException;
         new OA\Property(property: 'retention_amount_s3', type: 'integer', default: 7, minimum: 0, maximum: 10000),
         new OA\Property(property: 'retention_days_s3', type: 'integer', default: 0, maximum: 2147483647, minimum: 0),
         new OA\Property(property: 'retention_max_storage_s3', type: 'number', format: 'float', default: 0, maximum: 9999999999, minimum: 0),
-        new OA\Property(property: 'timeout', type: 'integer', default: 3600, minimum: 60, maximum: 36000),
+        new OA\Property(property: 'timeout', type: 'integer', default: ScheduledVolumeBackup::DEFAULT_TIMEOUT, minimum: 60, maximum: 36000),
     ],
     type: 'object',
     additionalProperties: false,
@@ -261,7 +261,7 @@ class VolumeBackupsController extends Controller
         string $resourceType,
         Model $resource,
     ): JsonResponse {
-        $backup = $storage->scheduledBackups()->updateOrCreate([], [
+        $attributes = [
             'team_id' => $teamId,
             'frequency' => $request->string('frequency')->toString(),
             'enabled' => $request->boolean('enabled', true),
@@ -275,8 +275,12 @@ class VolumeBackupsController extends Controller
             'retention_amount_s3' => $request->integer('retention_amount_s3', 7),
             'retention_days_s3' => $request->integer('retention_days_s3'),
             'retention_max_storage_s3' => $request->float('retention_max_storage_s3'),
-            'timeout' => $request->integer('timeout', 3600),
-        ]);
+        ];
+        if ($request->has('timeout')) {
+            $attributes['timeout'] = $request->integer('timeout');
+        }
+
+        $backup = $storage->scheduledBackups()->updateOrCreate([], $attributes);
         $created = $backup->wasRecentlyCreated;
 
         auditLog('api.volume_backup.schedule_set', [

app/Http/Controllers/Controller.php

@@ -8,12 +8,15 @@ use App\Models\User;
 use App\Providers\RouteServiceProvider;
 use Illuminate\Auth\Events\Verified;
 use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Foundation\Validation\ValidatesRequests;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller as BaseController;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Password;
 use Illuminate\Support\Str;
@@ -95,61 +98,105 @@ class Controller extends BaseController
         return response()->json(['message' => 'Transactional emails are not active'], 400);
     }
 
-    public function link()
+    public function link(): View|RedirectResponse
     {
         $token = request()->get('token');
-        if (is_string($token) && $token !== '') {
-            try {
-                $decrypted = Crypt::decryptString($token);
-            } catch (DecryptException) {
-                return redirect()->route('login')->with('error', 'Invalid credentials.');
-            }
-
-            if (! str_contains($decrypted, '@@@')) {
-                return redirect()->route('login')->with('error', 'Invalid credentials.');
-            }
-
-            $payload = explode('@@@', $decrypted, 3);
-            if (count($payload) === 3) {
-                [$email, $invitationUuid, $password] = $payload;
-            } else {
-                [$email, $password] = $payload;
-                $invitationUuid = null;
-            }
-
-            $email = Str::lower($email);
-            $user = User::whereEmail($email)->first();
-            if (! $user) {
-                return redirect()->route('login');
-            }
-
-            $invitation = TeamInvitation::query()
-                ->where('email', $email)
-                ->when($invitationUuid, fn ($query) => $query->where('uuid', $invitationUuid))
-                ->first();
-            if (! $invitation || ! $this->invitationLinkMatchesToken($invitation, $token) || ! $invitation->isValid()) {
-                return redirect()->route('login')->with('error', 'Invitation has expired or been revoked.');
-            }
-
-            if (Hash::check($password, $user->password)) {
-                $team = $invitation->team;
-                if (! $user->teams()->where('team_id', $team->id)->exists()) {
-                    $user->teams()->attach($team->id, ['role' => $invitation->role]);
-                }
-                $invitation->delete();
-
-                $user->forceFill([
-                    'password' => Hash::make(Str::random(64)),
-                ])->save();
-
-                Auth::login($user);
-                session(['currentTeam' => $team]);
-
-                return redirect()->route('dashboard');
-            }
+        $credentials = is_string($token) ? $this->magicLinkCredentials($token) : null;
+        if (! $credentials) {
+            return redirect()->route('login')->with('error', 'Invitation has expired or been revoked.');
         }
 
-        return redirect()->route('login')->with('error', 'Invalid credentials.');
+        [$user, $invitation] = $credentials;
+
+        return view('invitation.accept', [
+            'invitation' => $invitation,
+            'team' => $invitation->team,
+            'alreadyMember' => $user->teams()->where('team_id', $invitation->team_id)->exists(),
+            'formAction' => route('auth.link.accept'),
+            'token' => $token,
+        ]);
+    }
+
+    public function acceptLink(Request $request): RedirectResponse
+    {
+        $token = $request->input('token');
+        if (! is_string($token)) {
+            return redirect()->route('login')->with('error', 'Invitation has expired or been revoked.');
+        }
+
+        $acceptedInvitation = DB::transaction(function () use ($token) {
+            $credentials = $this->magicLinkCredentials($token, lockForUpdate: true);
+            if (! $credentials) {
+                return null;
+            }
+
+            [$user, $invitation] = $credentials;
+            $team = $invitation->team;
+            if (! $user->teams()->where('team_id', $team->id)->exists()) {
+                $user->teams()->attach($team->id, ['role' => $invitation->role]);
+            }
+
+            $user->forceFill([
+                'password' => Hash::make(Str::random(64)),
+            ])->save();
+            $invitation->delete();
+
+            return [$user, $team];
+        });
+
+        if (! $acceptedInvitation) {
+            return redirect()->route('login')->with('error', 'Invitation has expired or been revoked.');
+        }
+
+        [$user, $team] = $acceptedInvitation;
+
+        Auth::login($user);
+        session(['currentTeam' => $team]);
+
+        return redirect()->route('dashboard');
+    }
+
+    /**
+     * @return array{0: User, 1: TeamInvitation}|null
+     */
+    private function magicLinkCredentials(string $token, bool $lockForUpdate = false): ?array
+    {
+        if ($token === '') {
+            return null;
+        }
+
+        try {
+            $decrypted = Crypt::decryptString($token);
+        } catch (DecryptException) {
+            return null;
+        }
+
+        $payload = explode('@@@', $decrypted, 3);
+        if (count($payload) === 3) {
+            [$email, $invitationUuid, $password] = $payload;
+        } elseif (count($payload) === 2) {
+            [$email, $password] = $payload;
+            $invitationUuid = null;
+        } else {
+            return null;
+        }
+
+        $email = Str::lower($email);
+        $user = User::query()->where('email', $email)->first();
+        $invitationQuery = TeamInvitation::query()
+            ->where('email', $email)
+            ->when($lockForUpdate, fn ($query) => $query->lockForUpdate());
+        $invitation = $invitationUuid
+            ? $invitationQuery->where('uuid', $invitationUuid)->first()
+            : $invitationQuery->get()->first(
+                fn (TeamInvitation $invitation) => $this->invitationLinkMatchesToken($invitation, $token)
+            );
+
+        if (! $user || ! $invitation || $invitation->hasExpired() || ! $this->invitationLinkMatchesToken($invitation, $token)) {
+            return null;
+        }
+
+        return Hash::check($password, $user->password) ? [$user, $invitation] : null;
     }
 
     private function invitationLinkMatchesToken(TeamInvitation $invitation, string $token): bool
@@ -185,6 +232,7 @@ class Controller extends BaseController
             'invitation' => $invitation,
             'team' => $invitation->team,
             'alreadyMember' => $alreadyMember,
+            'formAction' => route('team.invitation.accept', $invitation->uuid),
         ]);
     }
 

app/Http/Controllers/OauthController.php

@@ -2,47 +2,60 @@
 
 namespace App\Http\Controllers;
 
-use App\Models\User;
-use Illuminate\Support\Facades\Auth;
+use App\Models\OauthSetting;
+use App\Services\Auth\OauthLoginService;
+use Illuminate\Support\Facades\Log;
 use Symfony\Component\HttpKernel\Exception\HttpException;
 
 class OauthController extends Controller
 {
     public function redirect(string $provider)
     {
-        $socialite_provider = get_socialite_provider($provider);
+        $oauthSetting = $this->enabledProvider($provider);
+        $socialiteProvider = get_socialite_provider($oauthSetting->provider);
 
-        return $socialite_provider->redirect();
+        return $socialiteProvider->redirect();
     }
 
-    public function callback(string $provider)
+    public function callback(string $provider, OauthLoginService $oauthLoginService)
     {
         try {
-            $oauthUser = get_socialite_provider($provider)->user();
-            $email = trim((string) $oauthUser->email);
-            if ($email === '') {
-                abort(403, 'OAuth provider did not return an email address');
-            }
-            $email = strtolower($email);
-            $user = User::whereEmail($email)->first();
-            if (! $user) {
-                $settings = instanceSettings();
-                if (! $settings->is_registration_enabled) {
-                    abort(403, 'Registration is disabled');
-                }
-
-                $user = User::create([
-                    'name' => $oauthUser->name,
-                    'email' => $email,
-                ]);
-            }
-            Auth::login($user);
+            $oauthSetting = $this->enabledProvider($provider);
+            $oauthUser = get_socialite_provider($oauthSetting->provider)->user();
+            $oauthLoginService->login($oauthSetting->provider, $oauthUser, $oauthSetting);
 
             return redirect('/');
         } catch (\Exception $e) {
+            $this->logCallbackFailure($provider, $e);
+
             $errorCode = $e instanceof HttpException ? 'auth.failed' : 'auth.failed.callback';
 
             return redirect()->route('login')->withErrors([__($errorCode)]);
         }
     }
+
+    private function logCallbackFailure(string $provider, \Throwable $exception): void
+    {
+        Log::error('OAuth callback failed.', [
+            'provider' => $provider,
+            'exception_class' => $exception::class,
+            'exception_message' => $exception->getMessage(),
+            'request_error' => request()->query('error'),
+            'request_error_description' => request()->query('error_description'),
+            'has_code' => request()->query->has('code'),
+            'has_state' => request()->query->has('state'),
+            'ip' => request()->ip(),
+            'exception' => $exception,
+        ]);
+    }
+
+    private function enabledProvider(string $provider): OauthSetting
+    {
+        $oauthSetting = OauthSetting::where('provider', $provider)->first();
+        if (! $oauthSetting || ! $oauthSetting->enabled || ! $oauthSetting->couldBeEnabled()) {
+            throw new HttpException(403, 'OAuth provider is not enabled');
+        }
+
+        return $oauthSetting;
+    }
 }

app/Http/Controllers/ProjectIconController.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Project;
+use App\Services\ProjectIconStorageService;
+use Illuminate\Http\Response;
+
+class ProjectIconController extends Controller
+{
+    public function __invoke(string $project_uuid, ProjectIconStorageService $iconStorage): Response
+    {
+        $project = Project::ownedByCurrentTeam()->where('uuid', $project_uuid)->firstOrFail();
+        $contents = $iconStorage->projectContents($project);
+
+        abort_if($contents === null, 404);
+
+        return response($contents)->header('Content-Type', 'image/jpeg');
+    }
+}

app/Http/Controllers/Webhook/Gitlab.php

@@ -15,6 +15,7 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
+use Visus\Cuid2\Cuid2;
 
 class Gitlab extends Controller
 {

app/Http/Kernel.php

@@ -20,8 +20,6 @@ use App\Http\Middleware\RedirectIfAuthenticated;
 use App\Http\Middleware\TrimStrings;
 use App\Http\Middleware\TrustHosts;
 use App\Http\Middleware\TrustProxies;
-use App\Http\Middleware\V5\EnsureCurrentTeam as V5EnsureCurrentTeam;
-use App\Http\Middleware\V5\HandleInertiaRequests as V5HandleInertiaRequests;
 use App\Http\Middleware\ValidateSignature;
 use App\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
@@ -82,23 +80,6 @@ class Kernel extends HttpKernel
 
         ],
 
-        'v5.web' => [
-            EncryptCookies::class,
-            AddQueuedCookiesToResponse::class,
-            StartSession::class,
-            ShareErrorsFromSession::class,
-            VerifyCsrfToken::class,
-            SubstituteBindings::class,
-            V5HandleInertiaRequests::class,
-        ],
-
-        'v5.authenticated' => [
-            'auth',
-            'verified',
-            'throttle:v5',
-            V5EnsureCurrentTeam::class,
-        ],
-
         'api' => [
             // \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
             ThrottleRequests::class.':api',

app/Jobs/ApiTokenExpirationWarningJob.php

@@ -41,6 +41,10 @@ class ApiTokenExpirationWarningJob implements ShouldBeEncrypted, ShouldQueue, Si
                         continue;
                     }
 
+                    if (! $team->members()->whereKey($token->tokenable_id)->exists()) {
+                        continue;
+                    }
+
                     $warningSentAt = now();
 
                     $team->notify(new ApiTokenExpiringNotification($token));

app/Jobs/ApplicationDeploymentJob.php

@@ -52,6 +52,8 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private const RAILPACK_GENERATED_CONFIG_PATH = '.coolify/railpack.generated.json';
 
+    private const CONTAINER_REMOVE_TIMEOUT_MARKER = '__COOLIFY_CONTAINER_REMOVE_TIMEOUT__';
+
     private const DOCKER_CLIENT_ENV_KEYS = [
         'BUILDKIT_HOST',
         'BUILDX_BUILDER',
@@ -431,6 +433,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 ["docker version --format '{{.Server.Version}}'"],
                 $serverToCheck
             );
+            $serverToCheck->rememberDockerVersion($dockerVersion);
 
             $versionParts = explode('.', $dockerVersion);
             $majorVersion = (int) $versionParts[0];
@@ -3972,19 +3975,49 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
 
             if ($skipRemove) {
                 $this->execute_remote_command(
-                    ["docker stop --time=$timeout $containerName", 'hidden' => true, 'ignore_errors' => true]
+                    [dockerStopCommand($timeout, $containerName, $this->server), 'hidden' => true, 'ignore_errors' => true]
                 );
             } else {
                 $this->execute_remote_command(
-                    ["docker stop --time=$timeout $containerName", 'hidden' => true, 'ignore_errors' => true],
-                    ["docker rm -f $containerName", 'hidden' => true, 'ignore_errors' => true]
+                    [dockerStopCommand($timeout, $containerName, $this->server), 'hidden' => true, 'ignore_errors' => true]
                 );
+                $this->removeContainerWithTimeout($containerName);
             }
         } catch (Exception $error) {
             $this->application_deployment_queue->addLogEntry("Error stopping container $containerName: ".$error->getMessage(), 'stderr');
         }
     }
 
+    private function removeContainerWithTimeout(string $containerName): void
+    {
+        $outputKey = 'container_remove_'.md5($containerName);
+
+        $this->execute_remote_command([
+            dockerRemoveCommandWithTimeout($containerName),
+            'hidden' => true,
+            'ignore_errors' => true,
+            'save' => $outputKey,
+            'append' => false,
+        ]);
+
+        if (! isset($this->saved_outputs)) {
+            return;
+        }
+
+        $output = (string) $this->saved_outputs->get($outputKey, '');
+        if (! str_contains($output, self::CONTAINER_REMOVE_TIMEOUT_MARKER)) {
+            return;
+        }
+
+        $this->application_deployment_queue->addLogEntry(
+            "Warning: Removing container {$containerName} timed out after 60 seconds. The deployment will continue and cleanup will be retried in 5 minutes.",
+            'stderr'
+        );
+
+        RemoveContainerJob::dispatch($this->server->id, $containerName)
+            ->delay(now()->addMinutes(5));
+    }
+
     private function stop_running_container(bool $force = false)
     {
         try {
@@ -5015,9 +5048,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                     // do not remove already running container for PR deployments
                 } else {
                     $this->application_deployment_queue->addLogEntry('Deployment failed. Removing the new version of your application.', 'stderr');
-                    $this->execute_remote_command(
-                        ["docker rm -f $this->container_name >/dev/null 2>&1", 'hidden' => true, 'ignore_errors' => true]
-                    );
+                    $this->removeContainerWithTimeout($this->container_name);
                 }
             }
         }

app/Jobs/CheckAndStartSentinelJob.php

@@ -21,6 +21,10 @@ class CheckAndStartSentinelJob implements ShouldBeEncrypted, ShouldQueue
 
     public function handle(): void
     {
+        if (! $this->sentinelIsEnabled()) {
+            return;
+        }
+
         $latestVersion = get_latest_sentinel_version();
 
         // Check if sentinel is running
@@ -28,7 +32,7 @@ class CheckAndStartSentinelJob implements ShouldBeEncrypted, ShouldQueue
         $sentinelFoundJson = json_decode($sentinelFound, true);
         $sentinelStatus = data_get($sentinelFoundJson, '0.State.Status', 'exited');
         if ($sentinelStatus !== 'running') {
-            StartSentinel::run(server: $this->server, restart: true, latestVersion: $latestVersion);
+            $this->startSentinel($latestVersion);
 
             return;
         }
@@ -38,15 +42,31 @@ class CheckAndStartSentinelJob implements ShouldBeEncrypted, ShouldQueue
             $runningVersion = '0.0.0';
         }
         if ($latestVersion === '0.0.0' && $runningVersion === '0.0.0') {
-            StartSentinel::run(server: $this->server, restart: true, latestVersion: 'latest');
+            $this->startSentinel('latest');
 
             return;
         } else {
             if (version_compare($runningVersion, $latestVersion, '<')) {
-                StartSentinel::run(server: $this->server, restart: true, latestVersion: $latestVersion);
+                $this->startSentinel($latestVersion);
 
                 return;
             }
         }
     }
+
+    private function sentinelIsEnabled(): bool
+    {
+        $this->server->unsetRelation('settings');
+
+        return $this->server->isSentinelEnabled();
+    }
+
+    private function startSentinel(string $latestVersion): void
+    {
+        if (! $this->sentinelIsEnabled()) {
+            return;
+        }
+
+        StartSentinel::run(server: $this->server, restart: true, latestVersion: $latestVersion);
+    }
 }

app/Jobs/CheckTraefikVersionForServerJob.php

@@ -33,10 +33,11 @@ class CheckTraefikVersionForServerJob implements ShouldBeEncrypted, ShouldQueue
      */
     public function handle(): void
     {
+        $this->clearOutdatedInfo();
+
         // Detect current version (makes SSH call)
         $currentVersion = getTraefikVersionFromDockerCompose($this->server);
 
-        // Update detected version in database
         $this->server->update(['detected_traefik_version' => $currentVersion]);
 
         if (! $currentVersion) {
@@ -113,6 +114,11 @@ class CheckTraefikVersionForServerJob implements ShouldBeEncrypted, ShouldQueue
         ProxyStatusChangedUI::dispatch($this->server->team_id);
     }
 
+    private function clearOutdatedInfo(): void
+    {
+        $this->server->update(['traefik_outdated_info' => null]);
+    }
+
     /**
      * Get information about newer branches if available.
      */

app/Jobs/CleanupStaleMultiplexedConnections.php

@@ -2,8 +2,8 @@
 
 namespace App\Jobs;
 
+use App\Helpers\SshMultiplexingHelper;
 use App\Models\Server;
-use Carbon\Carbon;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
@@ -51,7 +51,9 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
                 continue;
             }
 
-            if ($process['etimes'] >= $minAge && ! file_exists($pathMatch[1])) {
+            if ($process['etimes'] >= $minAge
+                && ! file_exists($pathMatch[1])
+                && ! SshMultiplexingHelper::isMuxProcessRetiring($process['pid'], $pathMatch[1])) {
                 $this->reapOrphan('ssh', $process);
             }
         }
@@ -169,14 +171,6 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
 
             if ($checkProcess->exitCode() !== 0) {
                 $this->removeMultiplexFile($muxFile, 'connection_check_failed');
-            } else {
-                $muxContent = Storage::disk('ssh-mux')->get($muxFile);
-                $establishedAt = Carbon::parse(substr($muxContent, 37));
-                $expirationTime = $establishedAt->addSeconds(config('constants.ssh.mux_persist_time'));
-
-                if (Carbon::now()->isAfter($expirationTime)) {
-                    $this->removeMultiplexFile($muxFile, 'expired');
-                }
             }
         }
     }
@@ -216,8 +210,20 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
         }
 
         $muxSocket = "/var/www/html/storage/app/ssh/mux/{$muxFile}";
-        $closeCommand = "ssh -O exit -o ControlPath={$muxSocket} localhost 2>/dev/null";
-        Process::run($closeCommand);
+        $checkProcess = Process::run("ssh -O check -o ControlPath={$muxSocket} localhost");
+        $pid = preg_match('/pid=(\d+)/', $checkProcess->output().$checkProcess->errorOutput(), $matches)
+            ? $matches[1]
+            : null;
+
+        if ($pid !== null) {
+            SshMultiplexingHelper::markMuxProcessAsRetiring($pid, $muxSocket);
+        }
+
+        $closeCommand = "ssh -O stop -o ControlPath={$muxSocket} localhost 2>/dev/null";
+        $stopProcess = Process::run($closeCommand);
+        if ($pid !== null && ! $stopProcess->successful()) {
+            SshMultiplexingHelper::unmarkMuxProcessAsRetiring($pid, $muxSocket);
+        }
         Storage::disk('ssh-mux')->delete($muxFile);
 
         Log::info('Removed stale mux file', [

app/Jobs/DatabaseBackupJob.php

@@ -18,6 +18,7 @@ use App\Notifications\Database\BackupFailed;
 use App\Notifications\Database\BackupSuccess;
 use App\Notifications\Database\BackupSuccessWithS3Warning;
 use App\Rules\SafeWebhookUrl;
+use App\Support\BackupCompression;
 use App\Support\ClickhouseBackupCommand;
 use Carbon\Carbon;
 use Illuminate\Bus\Queueable;
@@ -278,33 +279,10 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                 } else {
                     return;
                 }
-            } else {
-                if (str($databaseType)->contains('postgres')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif (str($databaseType)->contains('mongo')) {
-                    // Format: db1:collection1,collection2|db2:collection3,collection4
-                    // Only explode if it's a string, not if it's already an array
-                    if (is_string($databasesToBackup)) {
-                        $databasesToBackup = explode('|', $databasesToBackup);
-                        $databasesToBackup = array_map('trim', $databasesToBackup);
-                    }
-                } elseif (str($databaseType)->contains('mysql')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif (str($databaseType)->contains('mariadb')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif ($this->database instanceof StandaloneClickhouse) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } else {
-                    return;
-                }
+            }
+            $databasesToBackup = $this->databasesToBackup($databaseType, $databasesToBackup);
+            if ($databasesToBackup === []) {
+                return;
             }
             $this->backup_dir = backup_dir().'/databases/'.str($this->team->name)->slug().'-'.$this->team->id.'/'.$this->directory_name;
             if ($this->database->name === 'coolify-db') {
@@ -599,6 +577,30 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /** @return array<int, string> */
+    private function databasesToBackup(string $databaseType, string|array $databases): array
+    {
+        $type = str($databaseType);
+
+        if ($this->backup->dump_all && $type->contains(['postgres', 'mysql', 'mariadb'])) {
+            return ['all'];
+        }
+
+        if (is_array($databases)) {
+            return $databases;
+        }
+
+        if ($type->contains('mongo')) {
+            return array_map('trim', explode('|', $databases));
+        }
+
+        if ($type->contains(['postgres', 'mysql', 'mariadb', 'clickhouse'])) {
+            return array_map('trim', explode(',', $databases));
+        }
+
+        return [];
+    }
+
     private function backup_standalone_postgresql(string $database): void
     {
         try {
@@ -609,7 +611,8 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             }
             $escapedUsername = escapeshellarg($this->database->postgres_user);
             if ($this->backup->dump_all) {
-                $backupCommand .= " $this->container_name pg_dumpall --username $escapedUsername | gzip > $this->backup_location";
+                $backupCommand .= " $this->container_name pg_dumpall --username $escapedUsername";
+                $backupCommand = $this->buildCompressedDumpCommand($backupCommand).' > '.escapeshellarg($this->backup_location);
             } else {
                 // Validate and escape database name to prevent command injection
                 validateShellSafePath($database, 'database name');
@@ -635,7 +638,8 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             $commands[] = 'mkdir -p '.$this->backup_dir;
             $escapedPassword = escapeshellarg($this->database->mysql_root_password);
             if ($this->backup->dump_all) {
-                $commands[] = "docker exec $this->container_name mysqldump -u root -p$escapedPassword --all-databases --single-transaction --quick --lock-tables=false --compress | gzip > $this->backup_location";
+                $dumpCommand = "docker exec $this->container_name mysqldump -u root -p$escapedPassword --all-databases --single-transaction --quick --lock-tables=false";
+                $commands[] = $this->buildCompressedDumpCommand($dumpCommand).' > '.escapeshellarg($this->backup_location);
             } else {
                 // Validate and escape database name to prevent command injection
                 validateShellSafePath($database, 'database name');
@@ -659,7 +663,8 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             $commands[] = 'mkdir -p '.$this->backup_dir;
             $escapedPassword = escapeshellarg($this->database->mariadb_root_password);
             if ($this->backup->dump_all) {
-                $commands[] = "docker exec $this->container_name mariadb-dump -u root -p$escapedPassword --all-databases --single-transaction --quick --lock-tables=false --compress > $this->backup_location";
+                $dumpCommand = "docker exec $this->container_name mariadb-dump -u root -p$escapedPassword --all-databases --single-transaction --quick --lock-tables=false";
+                $commands[] = $this->buildCompressedDumpCommand($dumpCommand).' > '.escapeshellarg($this->backup_location);
             } else {
                 // Validate and escape database name to prevent command injection
                 validateShellSafePath($database, 'database name');
@@ -785,7 +790,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
 
             $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc alias set{$resolveOptions} temporary {$escapedEndpoint} {$escapedKey} {$escapedSecret}";
             $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc cp {$escapedBackupLocation} {$escapedS3Destination}";
-            instant_remote_process($commands, $this->server, true, false, null, disableMultiplexing: true);
+            instant_remote_process($commands, $this->server, true, false, $this->timeout, disableMultiplexing: true);
 
             $this->s3_uploaded = true;
         } catch (Throwable $e) {
@@ -806,6 +811,15 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         return "{$helperImage}:{$latestVersion}";
     }
 
+    private function buildCompressedDumpCommand(string $dumpCommand): string
+    {
+        $cpuPercentage = BackupCompression::cpuPercentage($this->server->settings->backup_compression_cpu_percentage);
+        $compressorCommand = BackupCompression::compressorCommand($cpuPercentage);
+        $script = "compressor=\$({$compressorCommand}); exec \$compressor";
+
+        return $dumpCommand.' | docker run --rm -i '.escapeshellarg($this->getFullImageName()).' sh -c '.escapeshellarg($script);
+    }
+
     private function markStaleExecutionsAsFailed(): void
     {
         try {

app/Jobs/DeleteResourceJob.php

@@ -4,7 +4,6 @@ namespace App\Jobs;
 
 use App\Actions\Application\StopApplication;
 use App\Actions\Database\StopDatabase;
-use App\Actions\Server\CleanupDocker;
 use App\Actions\Service\DeleteService;
 use App\Actions\Service\StopService;
 use App\Actions\Shared\DeleteScheduledVolumeBackup;
@@ -28,6 +27,8 @@ use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
 
 class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -43,20 +44,17 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
         $this->onQueue('high');
     }
 
-    public function handle()
+    public function handle(): void
     {
-        if (! $this->resource instanceof ApplicationPreview) {
-            $this->deleteScheduledVolumeBackups();
+        if ($this->resource instanceof ApplicationPreview) {
+            DB::transaction(function (): void {
+                $this->deleteApplicationPreview();
+            });
+
+            return;
         }
 
         try {
-            // Handle ApplicationPreview instances separately
-            if ($this->resource instanceof ApplicationPreview) {
-                $this->deleteApplicationPreview();
-
-                return;
-            }
-
             switch ($this->resource->type()) {
                 case 'application':
                     StopApplication::run($this->resource, previewDeployments: true, dockerCleanup: $this->dockerCleanup);
@@ -73,21 +71,71 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
                     break;
                 case 'service':
                     StopService::run($this->resource, $this->deleteConnectedNetworks, $this->dockerCleanup);
-                    DeleteService::run($this->resource, $this->deleteVolumes, $this->deleteConnectedNetworks, $this->deleteConfigurations, $this->dockerCleanup);
-
-                    return;
+                    app(DeleteService::class)->cleanupRemote(
+                        $this->resource,
+                        $this->deleteVolumes,
+                        $this->deleteConnectedNetworks,
+                        $this->deleteConfigurations,
+                    );
+                    break;
             }
 
-            if ($this->deleteConfigurations) {
-                $this->resource->deleteConfigurations();
+            if (! $this->resource instanceof Service) {
+                if ($this->deleteConfigurations) {
+                    $this->resource->deleteConfigurations();
+                }
+                if ($this->deleteVolumes) {
+                    $this->resource->deleteVolumes();
+                }
+                if ($this->deleteConnectedNetworks && $this->resource->type() === 'application') {
+                    $this->resource->deleteConnectedNetworks();
+                }
             }
+        } catch (\Throwable $e) {
+            Log::warning('Remote cleanup failed while deleting resource; continuing with local deletion.', [
+                'resource_id' => $this->resource->id,
+                'resource_type' => $this->resource->type(),
+                'error' => $e->getMessage(),
+            ]);
+        }
+
+        DB::transaction(function (): void {
+            try {
+                $this->deleteScheduledVolumeBackups();
+            } catch (\Throwable $e) {
+                Log::warning('Remote backup cleanup failed while deleting resource; continuing with local deletion.', [
+                    'resource_id' => $this->resource->id,
+                    'resource_type' => $this->resource->type(),
+                    'error' => $e->getMessage(),
+                ]);
+            }
+
+            if ($this->resource instanceof Service) {
+                app(DeleteService::class)->deleteLocal($this->resource);
+
+                return;
+            }
+
             if ($this->deleteVolumes) {
-                $this->resource->deleteVolumes();
                 $this->resource->persistentStorages()->delete();
             }
-            $this->resource->fileStorages()->delete(); // these are file mounts which should probably have their own flag
+            $this->resource->fileStorages()->delete();
 
-            $isDatabase = $this->resource instanceof StandalonePostgresql
+            if ($this->isDatabase()) {
+                $this->resource->sslCertificates()->delete();
+                $this->resource->scheduledBackups()->delete();
+                $this->resource->tags()->detach();
+            }
+            $this->resource->environment_variables()->delete();
+            $this->resource->forceDelete();
+        });
+
+        Artisan::queue('cleanup:stucked-resources');
+    }
+
+    private function isDatabase(): bool
+    {
+        return $this->resource instanceof StandalonePostgresql
             || $this->resource instanceof StandaloneRedis
             || $this->resource instanceof StandaloneMongodb
             || $this->resource instanceof StandaloneMysql
@@ -95,29 +143,6 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             || $this->resource instanceof StandaloneKeydb
             || $this->resource instanceof StandaloneDragonfly
             || $this->resource instanceof StandaloneClickhouse;
-
-            if ($isDatabase) {
-                $this->resource->sslCertificates()->delete();
-                $this->resource->scheduledBackups()->delete();
-                $this->resource->tags()->detach();
-            }
-            $this->resource->environment_variables()->delete();
-
-            if ($this->deleteConnectedNetworks && $this->resource->type() === 'application') {
-                $this->resource->deleteConnectedNetworks();
-            }
-        } catch (\Throwable $e) {
-            throw $e;
-        } finally {
-            $this->resource->forceDelete();
-            if ($this->dockerCleanup) {
-                $server = data_get($this->resource, 'server') ?? data_get($this->resource, 'destination.server');
-                if ($server) {
-                    CleanupDocker::dispatch($server, false, false);
-                }
-            }
-            Artisan::queue('cleanup:stucked-resources');
-        }
     }
 
     private function deleteScheduledVolumeBackups(): void
@@ -158,12 +183,15 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             ])
             ->get();
 
+        $cancelledDeployments = 0;
+
         foreach ($activeDeployments as $activeDeployment) {
             try {
                 // Mark deployment as cancelled
                 $activeDeployment->update([
                     'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
                 ]);
+                $cancelledDeployments++;
 
                 // Add cancellation log entry
                 $activeDeployment->addLogEntry('Deployment cancelled: Pull request closed.', 'stderr');
@@ -186,6 +214,14 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             }
         }
 
+        if ($cancelledDeployments > 0) {
+            try {
+                next_after_cancel($server);
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to advance deployment queue after deleting preview {$this->resource->id}: {$e->getMessage()}");
+            }
+        }
+
         try {
             if ($server->isSwarm()) {
                 $escapedStackName = escapeshellarg("{$application->uuid}-{$pull_request_id}");
@@ -216,7 +252,7 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
 
         $containerList = implode(' ', array_map('escapeshellarg', $containerNames));
         $commands = [
-            "docker stop -t $timeout $containerList",
+            dockerStopCommand($timeout, $containerList, $server),
             "docker rm -f $containerList",
         ];
         instant_remote_process(

app/Jobs/DockerCleanupJob.php

@@ -155,4 +155,38 @@ class DockerCleanupJob implements ShouldBeEncrypted, ShouldQueue
             }
         }
     }
+
+    public function failed(?\Throwable $exception): void
+    {
+        $execution = DockerCleanupExecution::query()
+            ->where('server_id', $this->server->id)
+            ->where('status', 'running')
+            ->whereNull('finished_at')
+            ->latest('id')
+            ->first();
+
+        if (! $execution) {
+            return;
+        }
+
+        $message = $exception?->getMessage() ?? 'Docker cleanup job failed without an exception.';
+
+        $updated = DockerCleanupExecution::query()
+            ->whereKey($execution->id)
+            ->where('status', 'running')
+            ->whereNull('finished_at')
+            ->update([
+                'status' => 'failed',
+                'message' => $message,
+                'finished_at' => Carbon::now()->toImmutable(),
+            ]);
+
+        if ($updated === 0) {
+            return;
+        }
+
+        $execution->refresh();
+        event(new DockerCleanupDone($execution));
+        $this->server->team?->notify(new DockerCleanupFailed($this->server, 'Docker cleanup job failed with the following error: '.$message));
+    }
 }

app/Jobs/PushServerUpdateJob.php

@@ -188,7 +188,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             Cache::forget($storageCacheKey);
         }
 
-        if ($this->containers->isEmpty()) {
+        if ($this->containers->isEmpty() && ! $this->isCompleteSnapshot()) {
             return;
         }
 
@@ -625,12 +625,6 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             return;
         }
 
-        // Only protection: Verify we received any container data at all
-        // If containers collection is completely empty, Sentinel might have failed
-        if ($this->containers->isEmpty()) {
-            return;
-        }
-
         // Batch update: mark all not-found applications as exited (excluding already exited ones)
         Application::whereIn('id', $notFoundApplicationIds)
             ->where('status', 'not like', 'exited%')
@@ -644,12 +638,6 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             return;
         }
 
-        // Only protection: Verify we received any container data at all
-        // If containers collection is completely empty, Sentinel might have failed
-        if ($this->containers->isEmpty()) {
-            return;
-        }
-
         // Collect IDs of previews that need to be marked as exited
         $previewIdsToUpdate = collect();
         foreach ($notFoundApplicationPreviewsIds as $previewKey) {
@@ -738,12 +726,6 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             return;
         }
 
-        // Only protection: Verify we received any container data at all
-        // If containers collection is completely empty, Sentinel might have failed
-        if ($this->containers->isEmpty()) {
-            return;
-        }
-
         $notFoundDatabaseUuids->each(function ($databaseUuid) {
             $database = $this->databasesByUuid->get($databaseUuid);
             if ($database) {

app/Jobs/RemoveContainerJob.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Server;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+class RemoveContainerJob implements ShouldBeEncrypted, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 3;
+
+    public int $timeout = 90;
+
+    public function __construct(public int $serverId, public string $containerName) {}
+
+    public function handle(): void
+    {
+        $server = Server::findOrFail($this->serverId);
+
+        instant_remote_process(
+            [dockerRemoveCommandWithTimeout($this->containerName)],
+            $server,
+            timeout: 75,
+            disableMultiplexing: true,
+        );
+    }
+
+    public function backoff(): array
+    {
+        return [300, 900];
+    }
+
+    public function failed(?\Throwable $exception): void
+    {
+        Log::warning('Deferred container removal failed', [
+            'server_id' => $this->serverId,
+            'container' => $this->containerName,
+            'error' => $exception?->getMessage(),
+        ]);
+    }
+}

app/Jobs/RestartProxyJob.php

@@ -98,7 +98,7 @@ class RestartProxyJob implements ShouldBeEncrypted, ShouldQueue
         // === STOP PHASE ===
         $commands = $commands->merge([
             "echo 'Stopping proxy...'",
-            "docker stop -t=$stopTimeout $containerName 2>/dev/null || true",
+            dockerStopCommand($stopTimeout, $containerName, $this->server).' 2>/dev/null || true',
             "docker rm -f $containerName 2>/dev/null || true",
             '# Wait for container to be fully removed',
             'for i in {1..15}; do',

app/Jobs/ScheduledJobManager.php

@@ -149,8 +149,8 @@ class ScheduledJobManager implements ShouldQueue
 
     private function processScheduledBackupsAndTasks(): void
     {
-        $lastBackupId = 0;
-        $lastTaskId = 0;
+        $lastBackupId = null;
+        $lastTaskId = null;
 
         do {
             $backups = $this->scheduledBackupQuery($lastBackupId)->get();
@@ -190,16 +190,16 @@ class ScheduledJobManager implements ShouldQueue
         }
     }
 
-    private function scheduledBackupQuery(int $lastBackupId): Builder
+    private function scheduledBackupQuery(?int $lastBackupId): Builder
     {
         return ScheduledDatabaseBackup::with(['database', 'team.subscription'])
             ->where('enabled', true)
-            ->where('id', '>', $lastBackupId)
+            ->when($lastBackupId !== null, fn (Builder $query) => $query->where('id', '>', $lastBackupId))
             ->orderBy('id')
             ->limit(self::CHUNK_SIZE);
     }
 
-    private function scheduledTaskQuery(int $lastTaskId): Builder
+    private function scheduledTaskQuery(?int $lastTaskId): Builder
     {
         return ScheduledTask::with([
             'service.destination.server.settings',
@@ -208,7 +208,7 @@ class ScheduledJobManager implements ShouldQueue
             'application.destination.server.team.subscription',
         ])
             ->where('enabled', true)
-            ->where('id', '>', $lastTaskId)
+            ->when($lastTaskId !== null, fn (Builder $query) => $query->where('id', '>', $lastTaskId))
             ->orderBy('id')
             ->limit(self::CHUNK_SIZE);
     }

app/Jobs/ScheduledTaskJob.php

@@ -25,6 +25,8 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
 {
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
+    public const MAX_OUTPUT_SIZE_BYTES = 5 * 1024 * 1024;
+
     /**
      * The number of times the job may be attempted.
      */
@@ -148,10 +150,12 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
             foreach ($this->containers as $containerName) {
                 if (count($this->containers) == 1 || str_starts_with($containerName, $this->task->container.'-'.$this->resource->uuid)) {
                     $cmd = "sh -c '".str_replace("'", "'\''", $this->task->command)."'";
-                    $exec = "docker exec {$containerName} {$cmd}";
+                    $dockerCommand = $this->server->isNonRoot() ? 'sudo docker' : 'docker';
+                    $execCommand = "{$dockerCommand} exec {$containerName} {$cmd}";
+                    $exec = $this->boundedTaskCommand($execCommand);
                     // Disable SSH multiplexing to prevent race conditions when multiple tasks run concurrently
                     // See: https://github.com/coollabsio/coolify/issues/6736
-                    $this->task_output = instant_remote_process([$exec], $this->server, true, false, $this->timeout, disableMultiplexing: true);
+                    $this->task_output = instant_remote_process([$exec], $this->server, throwError: true, no_sudo: true, timeout: $this->timeout, disableMultiplexing: true);
                     $this->task_log->update([
                         'status' => 'success',
                         'message' => $this->task_output,
@@ -204,6 +208,14 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function boundedTaskCommand(string $command): string
+    {
+        $maxOutputBytes = self::MAX_OUTPUT_SIZE_BYTES;
+        $readLimit = $maxOutputBytes + 1;
+
+        return "output_file=\$(mktemp); trap 'rm -f \"\$output_file\"' EXIT; set +e; set -o pipefail; {$command} 2>&1 | { head -c {$readLimit} > \"\$output_file\"; cat > /dev/null; }; exit_code=\${PIPESTATUS[0]}; if [ \"\$(wc -c < \"\$output_file\")\" -gt {$maxOutputBytes} ]; then truncate -s {$maxOutputBytes} \"\$output_file\"; printf '\n\n[... Output truncated at 5MB limit ...]' >> \"\$output_file\"; fi; if [ \"\$exit_code\" -eq 0 ]; then cat \"\$output_file\"; else cat \"\$output_file\" >&2; fi; exit \$exit_code";
+    }
+
     /**
      * Calculate the number of seconds to wait before retrying the job.
      */

app/Jobs/ServerConnectionCheckJob.php

@@ -194,6 +194,20 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
             $output = trim($output);
             if (! empty($output)) {
                 $dockerInfo = json_decode($output, true);
+                $dockerVersion = dockerEngineVersionFromJson($output);
+                if ($dockerVersion !== null) {
+                    $this->server->rememberDockerVersion($dockerVersion);
+                }
+
+                $composeOutput = instant_remote_process_with_timeout(
+                    ['docker compose version --short'],
+                    $this->server,
+                    false
+                );
+                $composeVersion = parseDockerEngineVersion($composeOutput);
+                if ($composeVersion !== null) {
+                    $this->server->rememberComposeVersion($composeVersion);
+                }
 
                 return isset($dockerInfo['Server']['Version']);
             }

app/Jobs/VolumeBackupJob.php

@@ -8,6 +8,7 @@ use App\Models\ScheduledVolumeBackup;
 use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
 use App\Rules\SafeWebhookUrl;
+use App\Support\BackupCompression;
 use Carbon\Carbon;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
@@ -27,14 +28,14 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
 
     public int $maxExceptions = 1;
 
-    public int $timeout = 3600;
+    public int $timeout = ScheduledVolumeBackup::DEFAULT_TIMEOUT;
 
     private ?ScheduledVolumeBackupExecution $execution = null;
 
     public function __construct(public ScheduledVolumeBackup $backup)
     {
         $this->onQueue(crons_queue());
-        $this->timeout = $backup->timeout ?? 3600;
+        $this->timeout = $backup->timeout ?? ScheduledVolumeBackup::DEFAULT_TIMEOUT;
     }
 
     public function middleware(): array
@@ -77,14 +78,19 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $source = $this->backup->sourcePath();
             $containerName = 'volume-backup-'.$this->execution->uuid;
             $image = coolifyHelperImage().':'.getHelperVersion();
+            $compressionCpuPercentage = BackupCompression::cpuPercentage($server->settings->backup_compression_cpu_percentage);
+            $this->logCompressorInDevelopment($image, $server, $compressionCpuPercentage);
             $verifySourceCommand = $target instanceof LocalPersistentVolume && blank($target->host_path)
                 ? 'docker volume inspect '.escapeshellarg($source).' >/dev/null'
                 : 'test -d '.escapeshellarg($source);
 
+            $compressorCommand = BackupCompression::compressorCommand($compressionCpuPercentage);
+            $archiveScript = "compressor=\$({$compressorCommand}); tar -I \"\$compressor\" -cf - -C /volume .";
             $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
                 .' -v '.escapeshellarg($source.':/volume:ro')
                 .' '.escapeshellarg($image)
-                .' tar -czf - -C /volume . > '.escapeshellarg($backupLocation);
+                .' sh -c '.escapeshellarg($archiveScript)
+                .' > '.escapeshellarg($backupLocation);
 
             if ($this->backup->stop_during_backup) {
                 $containers = $this->containersUsingVolume($source, $server);
@@ -332,6 +338,29 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function logCompressorInDevelopment(string $image, Server $server, int $compressionCpuPercentage): void
+    {
+        if (! isDev()) {
+            return;
+        }
+
+        $script = BackupCompression::compressorCommand($compressionCpuPercentage);
+        $compressor = instant_remote_process(
+            ['docker run --rm '.escapeshellarg($image).' sh -c '.escapeshellarg($script)],
+            $server,
+            timeout: 60,
+            disableMultiplexing: true,
+        );
+
+        Log::info('Volume backup compressor selected', [
+            'backup_id' => $this->backup->id,
+            'execution_id' => $this->execution?->id,
+            'compressor' => $compressor,
+            'helper_image' => $image,
+            'cpu_percentage' => $compressionCpuPercentage,
+        ]);
+    }
+
     private function removeExpiredBackups(Server $server): void
     {
         if ($this->hasRetentionLimits(

app/Livewire/ActivityMonitor.php

@@ -29,7 +29,10 @@ class ActivityMonitor extends Component
 
     public static $eventDispatched = false;
 
-    protected $listeners = ['activityMonitor' => 'newMonitorActivity'];
+    protected $listeners = [
+        'activityMonitor' => 'newMonitorActivity',
+        'processDialogClosed' => 'clearActivity',
+    ];
 
     public function newMonitorActivity($activityId, $eventToDispatch = 'activityFinished', $eventData = null, $header = null)
     {
@@ -50,6 +53,16 @@ class ActivityMonitor extends Component
         $this->isPollingActive = true;
     }
 
+    public function clearActivity(): void
+    {
+        $this->activityId = null;
+        $this->activity = null;
+        $this->isPollingActive = false;
+        $this->eventToDispatch = 'activityFinished';
+        $this->eventData = null;
+        self::$eventDispatched = false;
+    }
+
     public function hydrateActivity()
     {
         if ($this->activityId === null) {

app/Livewire/DeploymentsIndicator.php

@@ -54,12 +54,6 @@ class DeploymentsIndicator extends Component
         return $this->deployments->count();
     }
 
-    #[Computed]
-    public function shouldReduceOpacity(): bool
-    {
-        return request()->routeIs('project.application.deployment.*');
-    }
-
     public function toggleExpanded()
     {
         $this->expanded = ! $this->expanded;

app/Livewire/NavbarDeleteTeam.php

@@ -2,10 +2,8 @@
 
 namespace App\Livewire;
 
+use App\Actions\Team\DeleteTeam;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Cache;
-use Illuminate\Support\Facades\DB;
 use Livewire\Component;
 
 class NavbarDeleteTeam extends Component
@@ -28,22 +26,7 @@ class NavbarDeleteTeam extends Component
 
             $currentTeam = currentTeam();
             $this->authorize('delete', $currentTeam);
-
-            $currentTeam->members->each(function ($user) use ($currentTeam) {
-                if ($user->id === Auth::id()) {
-                    return;
-                }
-                $user->teams()->detach($currentTeam);
-                $session = DB::table('sessions')->where('user_id', $user->id)->first();
-                if ($session) {
-                    DB::table('sessions')->where('id', $session->id)->delete();
-                }
-            });
-
-            Cache::forget('user:'.Auth::id().':team:'.$currentTeam->id);
-            $currentTeam->delete();
-
-            $newTeam = Auth::user()->teams()->first();
+            $newTeam = app(DeleteTeam::class)->handle($currentTeam, auth()->user());
             refreshSession($newTeam);
 
             return redirect()->route('team.index');

app/Livewire/Notifications/Discord.php

@@ -166,6 +166,30 @@ class Discord extends Component
         }
     }
 
+    public function toggleDiscordEnabled(): void
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->discordEnabled) {
+                $this->discordEnabled = false;
+            } else {
+                $this->validate([
+                    'discordWebhookUrl' => 'required',
+                ], [
+                    'discordWebhookUrl.required' => 'Discord Webhook URL is required.',
+                ]);
+                $this->discordEnabled = true;
+            }
+
+            $this->saveModel();
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            handleError($e, $this);
+        }
+    }
+
     public function instantSave()
     {
         try {