From f9f53f2fea1a775c51aae101b02cc3b512c134ff Mon Sep 17 00:00:00 2001
From: Ousama Ben Younes <benyounes.ousama@gmail.com>
Date: Thu, 27 Aug 2026 04:36:12 +0000
Subject: [PATCH 01/48] fix(notifications): implement toWebhook() for
 always-send notifications

WebhookChannel::send() calls toWebhook() unconditionally, but the five
notifications reachable through alwaysSendEvents did not implement it, so
enabling the webhook channel turned those events into fatal queued jobs.
---
 .../ApiTokenExpiringNotification.php          |  12 ++
 .../Internal/GeneralNotification.php          |  10 ++
 app/Notifications/Server/ForceDisabled.php    |  12 ++
 app/Notifications/Server/ForceEnabled.php     |  12 ++
 .../SslExpirationNotification.php             |  14 +++
 .../Channels/WebhookChannelTest.php           | 113 ++++++++++++++++++
 6 files changed, 173 insertions(+)
 create mode 100644 tests/Unit/Notifications/Channels/WebhookChannelTest.php

diff --git a/app/Notifications/ApiTokenExpiringNotification.php b/app/Notifications/ApiTokenExpiringNotification.php
index 451dd312a1..c5567a3a64 100644
--- a/app/Notifications/ApiTokenExpiringNotification.php
+++ b/app/Notifications/ApiTokenExpiringNotification.php
@@ -100,4 +100,16 @@ class ApiTokenExpiringNotification extends CustomEmailNotification
             color: SlackMessage::warningColor(),
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "API token '{$this->tokenName}' expires on {$this->expiresAt}. Rotate this token before it expires to avoid API outages.",
+            'event' => 'api_token_expiring',
+            'token_name' => $this->tokenName,
+            'expires_at' => $this->expiresAt,
+            'url' => $this->manageUrl,
+        ];
+    }
 }
diff --git a/app/Notifications/Internal/GeneralNotification.php b/app/Notifications/Internal/GeneralNotification.php
index 1d23672100..52e986ed6e 100644
--- a/app/Notifications/Internal/GeneralNotification.php
+++ b/app/Notifications/Internal/GeneralNotification.php
@@ -58,4 +58,14 @@ class GeneralNotification extends Notification implements ShouldQueue
             color: SlackMessage::infoColor(),
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => true,
+            'message' => $this->message,
+            'event' => 'general',
+            'url' => base_url(),
+        ];
+    }
 }
diff --git a/app/Notifications/Server/ForceDisabled.php b/app/Notifications/Server/ForceDisabled.php
index 4b56f5860b..2d2ebabaf0 100644
--- a/app/Notifications/Server/ForceDisabled.php
+++ b/app/Notifications/Server/ForceDisabled.php
@@ -74,4 +74,16 @@ class ForceDisabled extends CustomEmailNotification
             color: SlackMessage::errorColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "Server ({$this->server->name}) disabled because it is not paid! All automations and integrations are stopped.",
+            'event' => 'server_force_disabled',
+            'server_name' => $this->server->name,
+            'server_uuid' => $this->server->uuid,
+            'url' => base_url().'/server/'.$this->server->uuid,
+        ];
+    }
 }
diff --git a/app/Notifications/Server/ForceEnabled.php b/app/Notifications/Server/ForceEnabled.php
index 36dad3c60f..61022d36b5 100644
--- a/app/Notifications/Server/ForceEnabled.php
+++ b/app/Notifications/Server/ForceEnabled.php
@@ -65,4 +65,16 @@ class ForceEnabled extends CustomEmailNotification
             color: SlackMessage::successColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => true,
+            'message' => "Server ({$this->server->name}) enabled again!",
+            'event' => 'server_force_enabled',
+            'server_name' => $this->server->name,
+            'server_uuid' => $this->server->uuid,
+            'url' => base_url().'/server/'.$this->server->uuid,
+        ];
+    }
 }
diff --git a/app/Notifications/SslExpirationNotification.php b/app/Notifications/SslExpirationNotification.php
index 78e1e8be9c..73c7a665d3 100644
--- a/app/Notifications/SslExpirationNotification.php
+++ b/app/Notifications/SslExpirationNotification.php
@@ -148,4 +148,18 @@ class SslExpirationNotification extends CustomEmailNotification
             color: SlackMessage::warningColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        $resourceNames = $this->resources->pluck('name');
+
+        return [
+            'success' => false,
+            'message' => "SSL certificates have been renewed for: {$resourceNames->join(', ')}. These resources need to be redeployed manually for the new SSL certificates to take effect.",
+            'event' => 'ssl_certificate_renewal',
+            'resources' => $resourceNames->values()->all(),
+            'urls' => $this->urls,
+            'url' => base_url(),
+        ];
+    }
 }
diff --git a/tests/Unit/Notifications/Channels/WebhookChannelTest.php b/tests/Unit/Notifications/Channels/WebhookChannelTest.php
new file mode 100644
index 0000000000..783159e69e
--- /dev/null
+++ b/tests/Unit/Notifications/Channels/WebhookChannelTest.php
@@ -0,0 +1,113 @@
+<?php
+
+use App\Jobs\SendWebhookJob;
+use App\Models\InstanceSettings;
+use App\Models\PersonalAccessToken;
+use App\Models\Server;
+use App\Models\Team;
+use App\Notifications\ApiTokenExpiringNotification;
+use App\Notifications\Channels\WebhookChannel;
+use App\Notifications\Internal\GeneralNotification;
+use App\Notifications\Server\ForceDisabled;
+use App\Notifications\Server\ForceEnabled;
+use App\Notifications\SslExpirationNotification;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Notifications\Notification;
+use Illuminate\Support\Facades\Queue;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    // base_url() resolves the instance settings singleton, which lives at the id = 0 sentinel.
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->updateOrCreate(['id' => 0], [
+        'fqdn' => 'https://coolify.example.com',
+    ]));
+    Queue::fake();
+
+    $this->team = Team::create([
+        'name' => 'Webhook Channel Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    // Assign through the model so the `encrypted` cast on webhook_url is applied.
+    $settings = $this->team->webhookNotificationSettings;
+    $settings->webhook_enabled = true;
+    $settings->webhook_url = 'https://webhook.example.com/coolify';
+    $settings->save();
+    $this->team->refresh();
+});
+
+/**
+ * Send a notification through the webhook channel and return the dispatched payload.
+ *
+ * @return array<string, mixed>
+ */
+function deliverOverWebhook(Team $team, Notification $notification): array
+{
+    expect($notification->via($team))->toContain(WebhookChannel::class);
+
+    (new WebhookChannel)->send($team, $notification);
+
+    $payload = null;
+    Queue::assertPushed(SendWebhookJob::class, function (SendWebhookJob $job) use (&$payload) {
+        $payload = $job->payload;
+
+        return true;
+    });
+
+    expect($payload)->toBeArray()
+        ->and($payload['success'])->toBeBool()
+        ->and($payload['message'])->toBeString()->not->toBeEmpty();
+
+    return $payload;
+}
+
+it('delivers ssl certificate renewal notifications over the webhook channel', function () {
+    $payload = deliverOverWebhook(
+        $this->team,
+        new SslExpirationNotification([(object) ['name' => 'my-application']])
+    );
+
+    expect($payload['event'])->toBe('ssl_certificate_renewal')
+        ->and($payload['resources'])->toBe(['my-application']);
+});
+
+it('delivers api token expiring notifications over the webhook channel', function () {
+    $token = new PersonalAccessToken([
+        'name' => 'ci-token',
+        'expires_at' => now()->addDay(),
+    ]);
+
+    $payload = deliverOverWebhook($this->team, new ApiTokenExpiringNotification($token));
+
+    expect($payload['event'])->toBe('api_token_expiring')
+        ->and($payload['token_name'])->toBe('ci-token');
+});
+
+it('delivers server force enabled notifications over the webhook channel', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $payload = deliverOverWebhook($this->team, new ForceEnabled($server));
+
+    expect($payload['event'])->toBe('server_force_enabled')
+        ->and($payload['success'])->toBeTrue()
+        ->and($payload['server_uuid'])->toBe($server->uuid);
+});
+
+it('delivers server force disabled notifications over the webhook channel', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $payload = deliverOverWebhook($this->team, new ForceDisabled($server));
+
+    expect($payload['event'])->toBe('server_force_disabled')
+        ->and($payload['success'])->toBeFalse()
+        ->and($payload['server_uuid'])->toBe($server->uuid);
+});
+
+it('delivers general notifications over the webhook channel', function () {
+    $payload = deliverOverWebhook($this->team, new GeneralNotification('Something happened'));
+
+    expect($payload['event'])->toBe('general')
+        ->and($payload['message'])->toBe('Something happened');
+});

From b7f00e72676558bc1e75918e3eabaeb9232a75b1 Mon Sep 17 00:00:00 2001
From: kashik0i <amr.badawy13@gmail.com>
Date: Fri, 28 Aug 2026 02:45:17 +0300
Subject: [PATCH 02/48] fix(docker): detect unqualified helper images

---
 app/Jobs/CleanupHelperContainersJob.php       |  7 +-
 tests/Unit/CleanupHelperContainersJobTest.php | 69 +++++++++++++++++++
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/CleanupHelperContainersJobTest.php

diff --git a/app/Jobs/CleanupHelperContainersJob.php b/app/Jobs/CleanupHelperContainersJob.php
index f1635d6d4d..425dd2591c 100644
--- a/app/Jobs/CleanupHelperContainersJob.php
+++ b/app/Jobs/CleanupHelperContainersJob.php
@@ -19,6 +19,11 @@ class CleanupHelperContainersJob implements ShouldBeEncrypted, ShouldBeUnique, S
 
     public function __construct(public Server $server) {}
 
+    private static function helperContainersCommand(): string
+    {
+        return 'docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image|test("^([^/]+/)?coollabsio/coolify-helper(:|@)")))\'';
+    }
+
     public function handle(): void
     {
         try {
@@ -36,7 +41,7 @@ class CleanupHelperContainersJob implements ShouldBeEncrypted, ShouldBeUnique, S
                 'active_deployment_uuids' => $activeDeployments,
             ]);
 
-            $containers = instant_remote_process_with_timeout(['docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image | contains("'.coolifyRegistryUrl().'/coollabsio/coolify-helper")))\''], $this->server, false);
+            $containers = instant_remote_process_with_timeout([self::helperContainersCommand()], $this->server, false);
             $helperContainers = collect(json_decode($containers));
 
             if ($helperContainers->count() > 0) {
diff --git a/tests/Unit/CleanupHelperContainersJobTest.php b/tests/Unit/CleanupHelperContainersJobTest.php
new file mode 100644
index 0000000000..a649985d28
--- /dev/null
+++ b/tests/Unit/CleanupHelperContainersJobTest.php
@@ -0,0 +1,69 @@
+<?php
+
+use App\Jobs\CleanupHelperContainersJob;
+use App\Models\Server;
+use Symfony\Component\Process\Process;
+
+it('matches helper image references without matching similarly named images', function () {
+    $command = (new ReflectionMethod(CleanupHelperContainersJob::class, 'helperContainersCommand'))->invoke(null);
+    $directory = sys_get_temp_dir().'/coolify-helper-filter-'.bin2hex(random_bytes(4));
+    $docker = $directory.'/docker';
+    $images = [
+        'coollabsio/coolify-helper:1.0.15',
+        'docker.io/coollabsio/coolify-helper:1.0.16',
+        'ghcr.io/coollabsio/coolify-helper@sha256:abc',
+        'registry.example/team/coollabsio/coolify-helper:latest',
+        'evil/coollabsio/coolify-helper-copy:latest',
+        'coollabsio/not-coolify-helper:latest',
+    ];
+
+    mkdir($directory);
+    file_put_contents($docker, "#!/bin/sh\n".implode("\n", array_map(
+        fn (string $image): string => 'echo '.escapeshellarg(json_encode(['Image' => $image], JSON_THROW_ON_ERROR)),
+        $images
+    ))."\n");
+    chmod($docker, 0755);
+
+    try {
+        $process = new Process(['/bin/sh', '-c', $command], env: [
+            'PATH' => $directory.':'.getenv('PATH'),
+        ]);
+        $process->mustRun();
+
+        expect(array_column(json_decode($process->getOutput(), true, flags: JSON_THROW_ON_ERROR), 'Image'))
+            ->toBe(array_slice($images, 0, 3));
+    } finally {
+        unlink($docker);
+        rmdir($directory);
+    }
+});
+
+it('preserves the helper image filter for non-root servers', function () {
+    $command = (new ReflectionMethod(CleanupHelperContainersJob::class, 'helperContainersCommand'))->invoke(null);
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->user = 'ubuntu';
+    $command = parseCommandsByLineForSudo(collect([$command]), $server)[0];
+    $directory = sys_get_temp_dir().'/coolify-helper-sudo-filter-'.bin2hex(random_bytes(4));
+    $docker = $directory.'/docker';
+    $sudo = $directory.'/sudo';
+
+    mkdir($directory);
+    file_put_contents($docker, "#!/bin/sh\necho '{\"Image\":\"coollabsio/coolify-helper:1.0.15\"}'\n");
+    file_put_contents($sudo, "#!/bin/sh\nexec \"\$@\"\n");
+    chmod($docker, 0755);
+    chmod($sudo, 0755);
+
+    try {
+        $process = new Process(['/bin/sh', '-c', $command], env: [
+            'PATH' => $directory.':'.getenv('PATH'),
+        ]);
+        $process->mustRun();
+
+        expect(array_column(json_decode($process->getOutput(), true, flags: JSON_THROW_ON_ERROR), 'Image'))
+            ->toBe(['coollabsio/coolify-helper:1.0.15']);
+    } finally {
+        unlink($docker);
+        unlink($sudo);
+        rmdir($directory);
+    }
+});

From 76414296a6eb2bff60e5969e4ef02e35b11d1922 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:12:06 +0200
Subject: [PATCH 03/48] fix(ui): typo on storage delete modal (#11541)

---
 app/Livewire/Project/Service/FileStorage.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index d6ab2ac151..cd209f6ae9 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -308,10 +308,10 @@ class FileStorage extends Component
     {
         return view('livewire.project.service.file-storage', [
             'directoryDeletionCheckboxes' => [
-                ['id' => 'permanently_delete', 'label' => 'The selected directory and all its contents will be permantely deleted form the server.'],
+                ['id' => 'permanently_delete', 'label' => 'The selected directory and all its contents will be permanently deleted from the server.'],
             ],
             'fileDeletionCheckboxes' => [
-                ['id' => 'permanently_delete', 'label' => 'The selected file will be permanently deleted form the server.'],
+                ['id' => 'permanently_delete', 'label' => 'The selected file will be permanently deleted from the server.'],
             ],
             'hostFileDeletionCheckboxes' => [
                 ['id' => 'permanently_delete', 'label' => 'Only the mount configuration will be removed. The host file will not be deleted.'],

From 45466b50695f231851c83fcd57c5dd0a9606e547 Mon Sep 17 00:00:00 2001
From: Devin Dissanayaka <dsdissanayaka2002@gmail.com>
Date: Thu, 3 Sep 2026 22:05:07 +0530
Subject: [PATCH 04/48] fix(notifications): send traefik outdated alerts to the
 correct topic id (#11526)

---
 .../Channels/TelegramChannel.php              |  3 +-
 .../TelegramNotificationThreadRoutingTest.php | 89 +++++++++++++++++++
 2 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 tests/Feature/TelegramNotificationThreadRoutingTest.php

diff --git a/app/Notifications/Channels/TelegramChannel.php b/app/Notifications/Channels/TelegramChannel.php
index 4f311bf681..a52feda087 100644
--- a/app/Notifications/Channels/TelegramChannel.php
+++ b/app/Notifications/Channels/TelegramChannel.php
@@ -17,6 +17,7 @@ use App\Notifications\Server\DockerCleanupSuccess;
 use App\Notifications\Server\HighDiskUsage;
 use App\Notifications\Server\Reachable;
 use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\TraefikVersionOutdated;
 use App\Notifications\Server\Unreachable;
 
 class TelegramChannel
@@ -50,7 +51,7 @@ class TelegramChannel
             Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
             Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
             ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
-
+            TraefikVersionOutdated::class => $settings->telegram_notifications_traefik_outdated_thread_id,
             default => null,
         };
 
diff --git a/tests/Feature/TelegramNotificationThreadRoutingTest.php b/tests/Feature/TelegramNotificationThreadRoutingTest.php
new file mode 100644
index 0000000000..474d2b157d
--- /dev/null
+++ b/tests/Feature/TelegramNotificationThreadRoutingTest.php
@@ -0,0 +1,89 @@
+<?php
+
+use App\Jobs\SendMessageToTelegramJob;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Notifications\Channels\TelegramChannel;
+use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\TraefikVersionOutdated;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->team->telegramNotificationSettings->update([
+        'telegram_enabled' => true,
+        'telegram_token' => 'test-token',
+        'telegram_chat_id' => '-1001234567890',
+    ]);
+
+    Queue::fake();
+});
+
+function telegramTestServer(Team $team): Server
+{
+    return Server::factory()->make([
+        'name' => 'Test Server',
+        'uuid' => 'test-uuid',
+        'team_id' => $team->id,
+    ]);
+}
+
+function outdatedTraefikServer(Team $team): Server
+{
+    $server = telegramTestServer($team);
+
+    $server->outdatedInfo = [
+        'current' => '3.5.0',
+        'latest' => '3.5.6',
+        'type' => 'patch_update',
+    ];
+
+    return $server;
+}
+
+it('sends the traefik outdated notification to its configured topic', function () {
+    $this->team->telegramNotificationSettings->update([
+        'telegram_notifications_traefik_outdated_thread_id' => '42',
+    ]);
+
+    $notification = new TraefikVersionOutdated(collect([outdatedTraefikServer($this->team)]));
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === '42'
+    );
+});
+
+it('sends the server patch notification to its configured topic', function () {
+    $this->team->telegramNotificationSettings->update([
+        'telegram_notifications_server_patch_thread_id' => '7',
+    ]);
+
+    $notification = new ServerPatchCheck(telegramTestServer($this->team), ['total_updates' => 3]);
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === '7'
+    );
+});
+
+it('falls back to the main chat when no topic is configured', function () {
+    $notification = new TraefikVersionOutdated(collect([outdatedTraefikServer($this->team)]));
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === null
+    );
+});

From 1d0d6b4a79f3280584ffb57409bdc4e309cb7dd0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 3 Sep 2026 19:23:08 +0200
Subject: [PATCH 05/48] fix(scheduler): run stuck resource cleanup in
 background at 03:17

Bump the Coolify release version to 4.3.16 and update schedule coverage.
---
 app/Console/Kernel.php                     | 5 +++--
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 2 +-
 tests/Feature/ScheduleOnOneServerTest.php  | 8 +++++---
 tests/Unit/ProductionImageWorkflowTest.php | 4 ++--
 versions.json                              | 2 +-
 6 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index 8d4d017c81..8eb010b8ac 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -47,9 +47,10 @@ class Kernel extends ConsoleKernel
             ->when(fn () => config('constants.ssh.mux_enabled') && ! config('constants.coolify.is_windows_docker_desktop'));
         $this->scheduleInstance->command('cleanup:redis --clear-locks')->daily();
         $this->scheduleInstance->command('cleanup:stucked-resources')
-            ->daily()
+            ->dailyAt('03:17')
             ->onOneServer()
-            ->withoutOverlapping(60);
+            ->withoutOverlapping(60)
+            ->runInBackground();
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
 
diff --git a/config/constants.php b/config/constants.php
index 457a8a1ff8..d2e2a9f33d 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.15',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.16',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 455918fdc0..a3a660f9cb 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.15"
+            "version": "4.3.16"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index ef2d80e648..3ad3808631 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -59,7 +59,7 @@ it('does not schedule Stripe subscription reconciliation automatically', functio
     expect($event)->toBeNull();
 });
 
-it('schedules stuck resource cleanup once per day on one server', function () {
+it('schedules stuck resource cleanup in the background once per day', function () {
     $schedule = app(Schedule::class);
 
     $event = collect($schedule->events())->first(
@@ -67,6 +67,8 @@ it('schedules stuck resource cleanup once per day on one server', function () {
     );
 
     expect($event)->not->toBeNull()
-        ->and($event->expression)->toBe('0 0 * * *')
-        ->and($event->onOneServer)->toBeTrue();
+        ->and($event->expression)->toBe('17 3 * * *')
+        ->and($event->onOneServer)->toBeTrue()
+        ->and($event->withoutOverlapping)->toBeTrue()
+        ->and($event->runInBackground)->toBeTrue();
 });
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 293c9422e9..4e6229d073 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.15'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.15')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.16'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.16')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index 455918fdc0..a3a660f9cb 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.15"
+            "version": "4.3.16"
         },
         "nightly": {
             "version": "4.4-rc.1"

From 986ece457d4e13304c30a6f81c27717ac800280b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 3 Sep 2026 20:38:19 +0200
Subject: [PATCH 06/48] fix(domains): use Compose service ports for internal
 routing

Detect Docker Compose service ports for domain internal ports and proxy labels, with application ports as a fallback.
---
 app/Livewire/Project/Application/Domains.php  | 12 +++++-
 .../Project/Application/PreviewDomains.php    | 12 +++++-
 bootstrap/helpers/docker.php                  | 33 +++++++++++++++
 bootstrap/helpers/parsers.php                 |  2 +-
 bootstrap/helpers/shared.php                  |  2 +-
 tests/Feature/ApplicationDomainsTest.php      | 42 +++++++++++++++++++
 ...licationParserDockerComposeDomainsTest.php | 32 ++++++++++++++
 7 files changed, 129 insertions(+), 6 deletions(-)

diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 9f1e7fc176..d7797935f5 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -500,7 +500,7 @@ class Domains extends Component
     {
         $key = $this->domainDnsStatusKey($url, $service);
         $entry = $stored[$key] ?? null;
-        $port = $this->effectiveDomainInternalPort($url);
+        $port = $this->effectiveDomainInternalPort($url, $service);
 
         $row = [
             'url' => $url,
@@ -532,7 +532,7 @@ class Domains extends Component
     /**
      * @return array{internal_port: ?int, has_port_override: bool}
      */
-    protected function effectiveDomainInternalPort(string $url): array
+    protected function effectiveDomainInternalPort(string $url, ?string $service = null): array
     {
         $canonical = DomainPortOverrides::withoutPort($url);
         $overrides = $this->application->domain_port_overrides ?? [];
@@ -561,6 +561,14 @@ class Domains extends Component
             ];
         }
 
+        $composePort = dockerComposeServicePort($this->application->docker_compose_raw, $service);
+        if ($composePort !== null) {
+            return [
+                'internal_port' => $composePort,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index 21296978f7..e6e9f5d60f 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -439,7 +439,7 @@ class PreviewDomains extends Component
     private function makeRow(string $url, ?string $service, array $statuses = []): array
     {
         $status = $statuses[$this->statusKey($url, $service)] ?? [];
-        $port = $this->effectiveDomainInternalPort($url);
+        $port = $this->effectiveDomainInternalPort($url, $service);
 
         return [
             'url' => $url,
@@ -500,7 +500,7 @@ class PreviewDomains extends Component
     /**
      * @return array{internal_port: ?int, has_port_override: bool}
      */
-    private function effectiveDomainInternalPort(string $url): array
+    private function effectiveDomainInternalPort(string $url, ?string $service = null): array
     {
         $canonical = DomainPortOverrides::withoutPort($url);
         $overrides = $this->preview->domain_port_overrides ?? [];
@@ -529,6 +529,14 @@ class PreviewDomains extends Component
             ];
         }
 
+        $composePort = dockerComposeServicePort($this->preview->application->docker_compose_raw, $service);
+        if ($composePort !== null) {
+            return [
+                'internal_port' => $composePort,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->preview->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index f80fccafb2..84232a8d72 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -601,6 +601,39 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
     return $labels->sort();
 }
 
+function firstDockerComposeServicePort(mixed $service): ?int
+{
+    $portDefinitions = collect(data_get($service, 'expose', []))
+        ->merge(data_get($service, 'ports', []));
+
+    foreach ($portDefinitions as $definition) {
+        $port = is_array($definition)
+            ? data_get($definition, 'target')
+            : str((string) $definition)->before('/')->afterLast(':')->value();
+
+        if (is_numeric($port) && (int) $port >= 1 && (int) $port <= 65535) {
+            return (int) $port;
+        }
+    }
+
+    return null;
+}
+
+function dockerComposeServicePort(?string $compose, ?string $serviceName): ?int
+{
+    if (blank($compose) || blank($serviceName)) {
+        return null;
+    }
+
+    try {
+        $services = data_get(Yaml::parse($compose), 'services', []);
+    } catch (Throwable) {
+        return null;
+    }
+
+    return firstDockerComposeServicePort(is_array($services) ? ($services[$serviceName] ?? null) : null);
+}
+
 function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [])
 {
     $labels = collect([]);
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index f65b626984..590b68d162 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1358,7 +1358,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                 ? ($previewForPorts?->domain_port_overrides ?? [])
                 : ($originalResource->domain_port_overrides ?? []);
             $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
-            $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
+            $onlyPort = firstDockerComposeServicePort($service) ?? ($exposedPorts[0] ?? null);
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 9f18c466da..f9bf44dffa 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3916,7 +3916,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                             ? ($resource->domain_port_overrides ?? [])
                             : ($preview?->domain_port_overrides ?? []);
                         $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
-                        $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
+                        $onlyPort = firstDockerComposeServicePort($service) ?? ($exposedPorts[0] ?? null);
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 9d0739d1ce..19dca79661 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -2311,6 +2311,48 @@ it('distinguishes an inherited internal port from a domain port override', funct
         ->assertDontSee('Custom internal port for this domain', false);
 });
 
+it('shows the detected compose service port as the inherited internal port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose:\n      - '8069'\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', 8069)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 8069')
+        ->assertDontSee('Internal port 3000');
+});
+
+it('shows the detected compose service port for preview domains', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    ports:\n      - '18069:8069'\n",
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 8069,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/8069',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://preview.example.com'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', 8069)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 8069')
+        ->assertDontSee('Internal port 3000');
+});
+
 it('keeps a legacy port-bearing url port in the edit field as an internal port override', function () {
     $this->application->update([
         'ports_exposes' => '3000,8080',
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 0c40d4a86c..30305ef596 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -599,3 +599,35 @@ YAML,
         ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
         ->toBeTrue();
 });
+
+test('applicationParser compose labels prefer the service exposed port over application ports_exposes', function (string $portConfiguration) {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<YAML
+services:
+  frontend:
+    image: myapp/frontend:latest
+{$portConfiguration}
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $labels = collect(data_get(applicationParser($application->fresh()), 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8069')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8069}}')))
+        ->toBeTrue();
+})->with([
+    'expose' => "    expose:\n      - '8069'",
+    'short port syntax' => "    ports:\n      - '18069:8069'",
+    'long port syntax' => "    ports:\n      - target: 8069\n        published: 18069",
+]);

From d0b77b26375a94e0e5e530d8312d6d23b63c453b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 3 Sep 2026 21:51:53 +0200
Subject: [PATCH 07/48] chore(release): bump Coolify version to 4.3.17

---
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 2 +-
 tests/Unit/ProductionImageWorkflowTest.php | 4 ++--
 versions.json                              | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index d2e2a9f33d..7ad0c4594f 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.16',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.17',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index a3a660f9cb..0e83c0cf74 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.16"
+            "version": "4.3.17"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 4e6229d073..140a6276f2 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.16'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.16')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.17'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.17')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index a3a660f9cb..0e83c0cf74 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.16"
+            "version": "4.3.17"
         },
         "nightly": {
             "version": "4.4-rc.1"

From 89a66dd255262f9a105dc9d4007c8aefe9f8456a Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 06:30:35 +0200
Subject: [PATCH 08/48] fix(service): show disabled deploy action when
 variables are missing

---
 .../views/livewire/project/service/heading.blade.php   |  6 ++++++
 tests/Feature/ResourceHeadingUnifiedNavbarTest.php     | 10 +++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index e7da50c809..79899e8795 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -188,6 +188,12 @@
                 </div>
                 @endcan
             @else
+                @can('deploy', $service)
+                    <button type="button" class="button mb-2 w-full justify-between" disabled>
+                        <span>Deploy</span>
+                        <span class="text-xs font-normal opacity-70">Fill required variables first</span>
+                    </button>
+                @endcan
                 <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
                     class="mb-3 inline-flex" aria-label="Open required environment variables">
                     <x-status-badge status="Required variables missing" type="error" />
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index 330afa7edf..ce69f26ef7 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -84,11 +84,19 @@ it('docks desktop resource actions in the top bar instead of floating over conte
 
 it('links the service header missing variables warning to environment variables', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    $mobileActions = str($heading)
+        ->after('<div class="w-full xl:hidden">')
+        ->before("@teleport('#resource-action-hud-slot')")
+        ->toString();
 
     expect($heading)
         ->toContain("route('project.service.environment-variables'")
         ->toContain('Required variables missing')
-        ->toContain('href="{{ $environmentVariablesUrl }}"');
+        ->toContain('href="{{ $environmentVariablesUrl }}"')
+        ->and($mobileActions)
+        ->toContain('Fill required variables first')
+        ->toContain('disabled')
+        ->toContain('Deploy');
 });
 
 it('places the account menu beside the desktop sidebar toggle while retaining it on mobile', function () {

From 6abbf84520bdfc245c3346661fd6b7fd1b50e113 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:43:07 +0200
Subject: [PATCH 09/48] fix(notifications): build api token expiry notification
 link from the instance url

---
 app/Notifications/ApiTokenExpiringNotification.php |  2 +-
 tests/Feature/ApiTokenExpirationWarningTest.php    | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/Notifications/ApiTokenExpiringNotification.php b/app/Notifications/ApiTokenExpiringNotification.php
index 451dd312a1..40bd3ead0d 100644
--- a/app/Notifications/ApiTokenExpiringNotification.php
+++ b/app/Notifications/ApiTokenExpiringNotification.php
@@ -21,7 +21,7 @@ class ApiTokenExpiringNotification extends CustomEmailNotification
         $this->onQueue('high');
         $this->tokenName = $token->name;
         $this->expiresAt = $token->expires_at?->format('Y-m-d H:i:s') ?? '';
-        $this->manageUrl = route('security.api-tokens');
+        $this->manageUrl = base_url().'/security/api-tokens';
     }
 
     public function via(object $notifiable): array
diff --git a/tests/Feature/ApiTokenExpirationWarningTest.php b/tests/Feature/ApiTokenExpirationWarningTest.php
index 92c2076077..a6bbffbbc3 100644
--- a/tests/Feature/ApiTokenExpirationWarningTest.php
+++ b/tests/Feature/ApiTokenExpirationWarningTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Jobs\ApiTokenExpirationWarningJob;
+use App\Models\InstanceSettings;
 use App\Models\PersonalAccessToken;
 use App\Models\Team;
 use App\Models\User;
@@ -14,6 +15,7 @@ use Illuminate\Support\Facades\Notification;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
@@ -137,4 +139,15 @@ describe('ApiTokenExpirationWarningJob', function () {
         Notification::assertNothingSent();
         expect($token->fresh()->api_token_expiration_warning_sent_at)->toBeNull();
     });
+
+    test('manage url uses the instance fqdn when configured', function () {
+        InstanceSettings::query()->update(['fqdn' => 'https://coolify.example.com']);
+        $token = createTokenExpiring($this->user, $this->team, Carbon::now()->addHours(12));
+
+        $notification = new ApiTokenExpiringNotification($token);
+
+        expect($notification->toSlack()->description)
+            ->toContain('https://coolify.example.com/security/api-tokens')
+            ->not->toContain('localhost');
+    });
 });

From 306d4833a99f58cb2931b2f35628e9fe9989a0ca Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:45:40 +0200
Subject: [PATCH 10/48] fix(notifications): build restart limit links from the
 instance url

---
 .../Application/RestartLimitReached.php       | 22 ++++++---
 ...pplicationStoppedAfterRestartLimitTest.php | 49 +++++++++++++++----
 2 files changed, 55 insertions(+), 16 deletions(-)

diff --git a/app/Notifications/Application/RestartLimitReached.php b/app/Notifications/Application/RestartLimitReached.php
index 687fd30867..de9de1f981 100644
--- a/app/Notifications/Application/RestartLimitReached.php
+++ b/app/Notifications/Application/RestartLimitReached.php
@@ -2,8 +2,11 @@
 
 namespace App\Notifications\Application;
 
+use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\BaseModel;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
@@ -49,14 +52,19 @@ class RestartLimitReached extends CustomEmailNotification
         if (str($this->fqdn)->explode(',')->count() > 1) {
             $this->fqdn = str($this->fqdn)->explode(',')->first();
         }
-        $service = data_get($resource, 'service');
-        $this->resource_url = match (true) {
-            method_exists($this->resource, 'link') => $this->resource->link(),
-            $resource instanceof ApplicationPreview => $resource->application->link(),
-            is_object($service) && method_exists($service, 'link') => $service->link(),
-            default => null,
+        $this->resource_url = $this->resolveResourceUrl($resource);
+    }
+
+    private function resolveResourceUrl(BaseModel $resource): string
+    {
+        [$type, $uuid] = match (true) {
+            $resource instanceof Application => ['application', $resource->uuid],
+            $resource instanceof ApplicationPreview => ['application', $resource->application->uuid],
+            $resource instanceof ServiceApplication, $resource instanceof ServiceDatabase => ['service', $resource->service->uuid],
+            default => ['database', $resource->uuid],
         };
-        $this->resource_url ??= base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}";
+
+        return base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/{$type}/{$uuid}";
     }
 
     public function via(object $notifiable): array
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
index 3e6e04629d..58ebb8c703 100644
--- a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -6,10 +6,21 @@ use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\BaseModel;
+use App\Models\InstanceSettings;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandalonePostgresql;
 use App\Notifications\Application\RestartLimitReached;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Mockery\MockInterface;
 
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0, 'fqdn' => 'https://coolify.test']);
+});
+
 function applicationWithRestartState(array $attributes = []): Application
 {
     $application = new Application;
@@ -161,14 +172,8 @@ it('preserves restart-limit applications only while their exited container exist
         ->and($sentinelJob)->toContain('if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(');
 });
 
-it('uses the application link for restart limit notifications', function () {
-    $application = new class extends Application
-    {
-        public function link()
-        {
-            return 'https://coolify.test/project/link-from-model';
-        }
-    };
+it('builds restart limit notification urls from the instance base url', function () {
+    $application = new Application;
     $application->forceFill([
         'name' => 'crashy-app',
         'uuid' => 'application-uuid',
@@ -183,7 +188,33 @@ it('uses the application link for restart limit notifications', function () {
 
     $notification = new RestartLimitReached($application);
 
-    expect($notification->resource_url)->toBe('https://coolify.test/project/link-from-model');
+    expect($notification->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/application/application-uuid');
+});
+
+it('links preview, service resource and database restart limit notifications to their pages', function () {
+    $environment = (object) ['uuid' => 'environment-uuid', 'name' => 'production', 'project' => (object) ['uuid' => 'project-uuid']];
+
+    $application = new Application;
+    $application->forceFill(['name' => 'app', 'uuid' => 'application-uuid']);
+    $application->setRelation('environment', $environment);
+    $preview = new ApplicationPreview;
+    $preview->forceFill(['uuid' => 'preview-uuid', 'pull_request_id' => 42, 'restart_count' => 2, 'max_restart_count' => 2]);
+    $preview->setRelation('application', $application);
+
+    $service = new Service;
+    $service->forceFill(['uuid' => 'service-uuid']);
+    $service->setRelation('environment', $environment);
+    $serviceApplication = new ServiceApplication;
+    $serviceApplication->forceFill(['name' => 'database', 'uuid' => 'service-application-uuid', 'restart_count' => 2, 'max_restart_count' => 2]);
+    $serviceApplication->setRelation('service', $service);
+
+    $database = new StandalonePostgresql;
+    $database->forceFill(['name' => 'postgres', 'uuid' => 'database-uuid', 'restart_count' => 2, 'max_restart_count' => 2]);
+    $database->setRelation('environment', $environment);
+
+    expect((new RestartLimitReached($preview))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/application/application-uuid')
+        ->and((new RestartLimitReached($serviceApplication))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/service/service-uuid')
+        ->and((new RestartLimitReached($database))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/database/database-uuid');
 });
 
 it('uses the resolved environment project name in Slack restart limit notifications', function () {

From 85ec70643f4a5960b5ccce694b8de7b5425a563c Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:48:16 +0200
Subject: [PATCH 11/48] refactor(notifications): build scheduled task links
 from the instance url

- replace the taskLink() helpers on Application and Service with links built from base_url() in the task notifications
---
 app/Models/Application.php                    | 26 ------------------
 app/Models/Service.php                        | 27 -------------------
 .../ScheduledTask/TaskFailed.php              |  9 ++++---
 .../ScheduledTask/TaskSuccess.php             |  9 ++++---
 4 files changed, 10 insertions(+), 61 deletions(-)

diff --git a/app/Models/Application.php b/app/Models/Application.php
index f8eb75a5ab..6bfbb6de75 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -621,32 +621,6 @@ class Application extends BaseModel
             && $this->restart_limit_reached === true;
     }
 
-    public function taskLink($task_uuid)
-    {
-        if (data_get($this, 'environment.project.uuid')) {
-            $route = route('project.application.scheduled-tasks', [
-                'project_uuid' => data_get($this, 'environment.project.uuid'),
-                'environment_uuid' => data_get($this, 'environment.uuid'),
-                'application_uuid' => data_get($this, 'uuid'),
-                'task_uuid' => $task_uuid,
-            ]);
-            $settings = instanceSettings();
-            if (data_get($settings, 'fqdn')) {
-                $url = Url::fromString($route);
-                $url = $url->withPort(null);
-                $fqdn = data_get($settings, 'fqdn');
-                $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                $url = $url->withHost($fqdn);
-
-                return $url->__toString();
-            }
-
-            return $route;
-        }
-
-        return null;
-    }
-
     public function settings()
     {
         return $this->hasOne(ApplicationSetting::class);
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 66c67ca8de..1e6a33ad69 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -15,7 +15,6 @@ use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Storage;
 use OpenApi\Attributes as OA;
 use Spatie\Activitylog\Models\Activity;
-use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
 
 #[OA\Schema(
@@ -1463,32 +1462,6 @@ class Service extends BaseModel
         return null;
     }
 
-    public function taskLink($task_uuid)
-    {
-        if (data_get($this, 'environment.project.uuid')) {
-            $route = route('project.service.scheduled-tasks', [
-                'project_uuid' => data_get($this, 'environment.project.uuid'),
-                'environment_uuid' => data_get($this, 'environment.uuid'),
-                'service_uuid' => data_get($this, 'uuid'),
-                'task_uuid' => $task_uuid,
-            ]);
-            $settings = InstanceSettings::get();
-            if (data_get($settings, 'fqdn')) {
-                $url = Url::fromString($route);
-                $url = $url->withPort(null);
-                $fqdn = data_get($settings, 'fqdn');
-                $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                $url = $url->withHost($fqdn);
-
-                return $url->__toString();
-            }
-
-            return $route;
-        }
-
-        return null;
-    }
-
     public function documentation()
     {
         $services = get_service_templates();
diff --git a/app/Notifications/ScheduledTask/TaskFailed.php b/app/Notifications/ScheduledTask/TaskFailed.php
index bd060112ae..2ca3874ba0 100644
--- a/app/Notifications/ScheduledTask/TaskFailed.php
+++ b/app/Notifications/ScheduledTask/TaskFailed.php
@@ -2,6 +2,7 @@
 
 namespace App\Notifications\ScheduledTask;
 
+use App\Models\Application;
 use App\Models\ScheduledTask;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
@@ -16,10 +17,10 @@ class TaskFailed extends CustomEmailNotification
     public function __construct(public ScheduledTask $task, public string $output)
     {
         $this->onQueue('high');
-        if ($task->application) {
-            $this->url = $task->application->taskLink($task->uuid);
-        } elseif ($task->service) {
-            $this->url = $task->service->taskLink($task->uuid);
+        $resource = $task->application ?? $task->service;
+        if ($resource) {
+            $type = $resource instanceof Application ? 'application' : 'service';
+            $this->url = base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/{$type}/{$resource->uuid}/tasks/{$task->uuid}";
         }
     }
 
diff --git a/app/Notifications/ScheduledTask/TaskSuccess.php b/app/Notifications/ScheduledTask/TaskSuccess.php
index 58c959bd8d..2978eaed32 100644
--- a/app/Notifications/ScheduledTask/TaskSuccess.php
+++ b/app/Notifications/ScheduledTask/TaskSuccess.php
@@ -2,6 +2,7 @@
 
 namespace App\Notifications\ScheduledTask;
 
+use App\Models\Application;
 use App\Models\ScheduledTask;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
@@ -16,10 +17,10 @@ class TaskSuccess extends CustomEmailNotification
     public function __construct(public ScheduledTask $task, public string $output)
     {
         $this->onQueue('high');
-        if ($task->application) {
-            $this->url = $task->application->taskLink($task->uuid);
-        } elseif ($task->service) {
-            $this->url = $task->service->taskLink($task->uuid);
+        $resource = $task->application ?? $task->service;
+        if ($resource) {
+            $type = $resource instanceof Application ? 'application' : 'service';
+            $this->url = base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/{$type}/{$resource->uuid}/tasks/{$task->uuid}";
         }
     }
 

From 0eb9d5e5a8952552d8a81bb8472bf4207035776d Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:07:26 +0200
Subject: [PATCH 12/48] fix(notifications): urls for ssl renewal notifications

---
 app/Jobs/RegenerateSslCertJob.php             |  5 ++-
 .../SslExpirationNotification.php             | 37 ++-----------------
 2 files changed, 7 insertions(+), 35 deletions(-)

diff --git a/app/Jobs/RegenerateSslCertJob.php b/app/Jobs/RegenerateSslCertJob.php
index 6f49cf30be..ed2d1c4546 100644
--- a/app/Jobs/RegenerateSslCertJob.php
+++ b/app/Jobs/RegenerateSslCertJob.php
@@ -66,7 +66,10 @@ class RegenerateSslCertJob implements ShouldBeEncrypted, ShouldQueue
                     caCert: $caCert->ssl_certificate,
                     caKey: $caCert->ssl_private_key,
                 );
-                $regenerated->push($certificate);
+                $resource = $certificate->database;
+                if ($resource) {
+                    $regenerated->push($resource);
+                }
             } catch (\Exception $e) {
                 Log::error('Failed to regenerate SSL certificate: '.$e->getMessage());
             }
diff --git a/app/Notifications/SslExpirationNotification.php b/app/Notifications/SslExpirationNotification.php
index 78e1e8be9c..023031ddd7 100644
--- a/app/Notifications/SslExpirationNotification.php
+++ b/app/Notifications/SslExpirationNotification.php
@@ -7,7 +7,6 @@ use App\Notifications\Dto\PushoverMessage;
 use App\Notifications\Dto\SlackMessage;
 use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Support\Collection;
-use Spatie\Url\Url;
 
 class SslExpirationNotification extends CustomEmailNotification
 {
@@ -19,39 +18,9 @@ class SslExpirationNotification extends CustomEmailNotification
     {
         $this->onQueue('high');
         $this->resources = collect($resources);
-
-        // Collect URLs for each resource
-        $this->resources->each(function ($resource) {
-            if (data_get($resource, 'environment.project.uuid')) {
-                $routeName = match ($resource->type()) {
-                    'application' => 'project.application.configuration',
-                    'database' => 'project.database.configuration',
-                    'service' => 'project.service.configuration',
-                    default => null
-                };
-
-                if ($routeName) {
-                    $route = route($routeName, [
-                        'project_uuid' => data_get($resource, 'environment.project.uuid'),
-                        'environment_uuid' => data_get($resource, 'environment.uuid'),
-                        $resource->type().'_uuid' => data_get($resource, 'uuid'),
-                    ]);
-
-                    $settings = instanceSettings();
-                    if (data_get($settings, 'fqdn')) {
-                        $url = Url::fromString($route);
-                        $url = $url->withPort(null);
-                        $fqdn = data_get($settings, 'fqdn');
-                        $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                        $url = $url->withHost($fqdn);
-
-                        $this->urls[$resource->name] = $url->__toString();
-                    } else {
-                        $this->urls[$resource->name] = $route;
-                    }
-                }
-            }
-        });
+        $this->urls = $this->resources->mapWithKeys(fn ($resource) => [
+            $resource->name => base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/database/{$resource->uuid}",
+        ])->all();
     }
 
     public function via(object $notifiable): array

From 94995c2a0e8d60ee4adbcb71aab0ff9ecf5855d2 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:08:08 +0200
Subject: [PATCH 13/48] fix(deployments): build deployment log links from the
 instance url

---
 app/Jobs/ApplicationDeploymentJob.php | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 88036f5191..01a365a0c5 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -2362,12 +2362,8 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 destination: $destination,
                 no_questions_asked: true,
             );
-            $this->application_deployment_queue->addLogEntry("Deployment to {$server->name}. Logs: ".route('project.application.deployment.show', [
-                'project_uuid' => data_get($this->application, 'environment.project.uuid'),
-                'application_uuid' => data_get($this->application, 'uuid'),
-                'deployment_uuid' => $deployment_uuid,
-                'environment_uuid' => data_get($this->application, 'environment.uuid'),
-            ]));
+            $deployment_url = base_url().'/project/'.data_get($this->application, 'environment.project.uuid').'/environment/'.data_get($this->application, 'environment.uuid').'/application/'.data_get($this->application, 'uuid')."/deployment/{$deployment_uuid}";
+            $this->application_deployment_queue->addLogEntry("Deployment to {$server->name}. Logs: {$deployment_url}");
         }
     }
 

From 51cab061be1cda01b9b0708979f7e6a51abd333f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:19:21 +0200
Subject: [PATCH 14/48] fix(domains): sync Docker Compose domains for noindex
 settings

---
 app/Traits/HasNoindexDomains.php         | 11 ++++++++++-
 tests/Feature/ApplicationDomainsTest.php | 22 ++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/app/Traits/HasNoindexDomains.php b/app/Traits/HasNoindexDomains.php
index 7afe0d4f25..f3858cc61d 100644
--- a/app/Traits/HasNoindexDomains.php
+++ b/app/Traits/HasNoindexDomains.php
@@ -58,7 +58,16 @@ trait HasNoindexDomains
 
     private function currentDomains(): Collection
     {
-        return collect(ValidationPatterns::applicationDomainList($this->fqdn))
+        $domains = collect(ValidationPatterns::applicationDomainList($this->fqdn));
+        $composeDomains = json_decode((string) ($this->getAttributes()['docker_compose_domains'] ?? null), true);
+
+        if (is_array($composeDomains)) {
+            foreach ($composeDomains as $entry) {
+                $domains->push(...ValidationPatterns::applicationDomainList(composeDomainEntryString($entry)));
+            }
+        }
+
+        return $domains
             ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain));
     }
 
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 19dca79661..a13b5fdbfd 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -2066,6 +2066,28 @@ it('updates search engine indexing from the domains view', function () {
         ->toBe(['https://staging.example.com']);
 });
 
+it('updates search engine indexing for a git docker compose domain', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://compose.example.com'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('toggleNoindexDomain', 'https://compose.example.com', 'noindex')
+        ->assertDispatched('configurationChanged')
+        ->assertDispatched('success');
+
+    expect($this->application->refresh()->noindexDomains()->all())
+        ->toBe(['https://compose.example.com']);
+
+    $component->call('toggleNoindexDomain', 'https://compose.example.com', 'index');
+
+    expect($this->application->refresh()->noindexDomains()->all())->toBe([]);
+});
+
 it('keeps noindex domains when normalizing a custom domain port', function () {
     $this->application->update([
         'fqdn' => 'https://staging.example.com:8080',

From 8dc35e2b5fe958086dcba6acca79847c8efcf9a3 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:27:24 +0200
Subject: [PATCH 15/48] fix: TypeError when adding a new scheduled task

---
 app/Livewire/Project/Shared/ScheduledTask/Add.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/Livewire/Project/Shared/ScheduledTask/Add.php b/app/Livewire/Project/Shared/ScheduledTask/Add.php
index f170a0a6f0..717007bc04 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Add.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Add.php
@@ -102,7 +102,7 @@ class Add extends Component
         }
     }
 
-    private function saveScheduledTask(): mixed
+    private function saveScheduledTask(): void
     {
         try {
             $task = new ScheduledTask;
@@ -128,7 +128,7 @@ class Add extends Component
             $this->dispatch('refreshTasks');
             $this->dispatch('success', 'Scheduled task added.');
         } catch (\Throwable $e) {
-            return handleError($e, $this);
+            handleError($e, $this);
         }
     }
 

From 053b030c4280471d2b3867fa103da42575e4f10e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:42:26 +0200
Subject: [PATCH 16/48] fix: remove database restart limits and clear stale
 Traefik state

Drop restart-limit fields and enforcement from database resources, clear cached Traefik version data when proxies change, and show missing service environment variables from disabled deploy actions.
---
 app/Actions/Database/StartDatabase.php        |  6 +-
 app/Actions/Database/StopDatabase.php         |  6 +-
 app/Actions/Docker/GetContainersStatus.php    | 20 ++---
 app/Actions/Service/StartService.php          |  1 -
 app/Actions/Service/StopService.php           |  1 -
 .../Service/StopServiceApplication.php        |  2 +-
 app/Jobs/CheckTraefikVersionForServerJob.php  | 12 ++-
 app/Jobs/CheckTraefikVersionJob.php           | 14 ++++
 app/Jobs/PushServerUpdateJob.php              | 25 ++----
 app/Livewire/Server/Proxy.php                 |  2 +
 app/Models/Server.php                         |  2 +
 app/Models/ServiceDatabase.php                |  3 +-
 app/Models/StandaloneClickhouse.php           |  3 +-
 app/Models/StandaloneDragonfly.php            |  3 +-
 app/Models/StandaloneKeydb.php                |  3 +-
 app/Models/StandaloneMariadb.php              |  3 +-
 app/Models/StandaloneMongodb.php              |  3 +-
 app/Models/StandaloneMysql.php                |  3 +-
 app/Models/StandalonePostgresql.php           |  3 +-
 app/Models/StandaloneRedis.php                |  3 +-
 ...7_remove_restart_limits_from_databases.php | 56 +++++++++++++
 .../restart-limit-warning.blade.php           |  2 +-
 .../project/service/heading.blade.php         | 53 +++++++++---
 .../Feature/AllResourceRestartLimitsTest.php  | 84 ++++++++++++++-----
 .../ResourceHeadingUnifiedNavbarTest.php      | 26 ++++--
 tests/Feature/TraefikVersionStateTest.php     | 82 +++++++++++++++++-
 tests/Unit/StopActionsPersistStatusTest.php   |  2 +-
 27 files changed, 326 insertions(+), 97 deletions(-)
 create mode 100644 database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php

diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index 7735c77d88..cd7e083286 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -28,7 +28,11 @@ class StartDatabase
         if (! $server->isFunctional()) {
             return 'Server is not functional';
         }
-        $database->resetRestartLimit();
+        $database->update([
+            'restart_count' => 0,
+            'last_restart_at' => null,
+            'last_restart_type' => null,
+        ]);
         switch ($database->getMorphClass()) {
             case StandalonePostgresql::class:
                 $activity = StartPostgresql::run($database);
diff --git a/app/Actions/Database/StopDatabase.php b/app/Actions/Database/StopDatabase.php
index f3c591acfc..8005311b5b 100644
--- a/app/Actions/Database/StopDatabase.php
+++ b/app/Actions/Database/StopDatabase.php
@@ -32,7 +32,11 @@ class StopDatabase
             // Reset restart tracking when database is manually stopped
             $database->update(['status' => 'exited']);
             if ($resetRestartCount) {
-                $database->resetRestartLimit();
+                $database->update([
+                    'restart_count' => 0,
+                    'last_restart_at' => null,
+                    'last_restart_type' => null,
+                ]);
             }
 
             if ($dockerCleanup) {
diff --git a/app/Actions/Docker/GetContainersStatus.php b/app/Actions/Docker/GetContainersStatus.php
index be098e481c..c69bd1855f 100644
--- a/app/Actions/Docker/GetContainersStatus.php
+++ b/app/Actions/Docker/GetContainersStatus.php
@@ -5,7 +5,6 @@ namespace App\Actions\Docker;
 use App\Actions\Application\StopApplication;
 use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
-use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
@@ -249,9 +248,12 @@ class GetContainersStatus
 
                             $database->update($updateData);
 
-                            if ($database->trackRestartCount((int) $restartCount)) {
-                                StopDatabase::dispatch($database, false, false, false);
-                                $database->team()?->notify(new ApplicationRestartLimitReached($database));
+                            if ($restartCount > ($database->restart_count ?? 0)) {
+                                $database->update([
+                                    'restart_count' => (int) $restartCount,
+                                    'last_restart_at' => now(),
+                                    'last_restart_type' => 'crash',
+                                ]);
                             }
 
                             if ($isPublic) {
@@ -357,7 +359,9 @@ class GetContainersStatus
                 continue;
             }
 
-            if (! $exitedService->stoppedAfterRestartLimit()) {
+            if ($exitedService instanceof ServiceDatabase) {
+                $exitedService->update(['status' => 'exited']);
+            } elseif (! $exitedService->stoppedAfterRestartLimit()) {
                 $exitedService->update([
                     'status' => 'exited',
                     'restart_count' => 0,
@@ -424,9 +428,6 @@ class GetContainersStatus
         $notRunningDatabases = $databases->pluck('id')->diff($foundDatabases);
         foreach ($notRunningDatabases as $database) {
             $database = $databases->where('id', $database)->first();
-            if ($database->stoppedAfterRestartLimit()) {
-                continue;
-            }
             if (str($database->status)->startsWith('exited')) {
                 continue;
             }
@@ -442,7 +443,6 @@ class GetContainersStatus
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
-                'restart_limit_reached' => false,
             ]);
 
             // Stop proxy if database was public
@@ -582,7 +582,7 @@ class GetContainersStatus
             $restartCount = isset($this->serviceContainerRestartCounts)
                 ? ($this->serviceContainerRestartCounts->get($key)?->max() ?? 0)
                 : 0;
-            if ($subResource->trackRestartCount($restartCount)) {
+            if (! $subResource instanceof ServiceDatabase && $subResource->trackRestartCount($restartCount)) {
                 StopServiceApplication::dispatch($subResource, false, false);
                 $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
 
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 13371d1265..3dc5c98b3f 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -25,7 +25,6 @@ class StartService
         $service->saveComposeConfigs();
         $service->isConfigurationChanged(save: true);
         $service->applications()->get()->each->resetRestartLimit();
-        $service->databases()->get()->each->resetRestartLimit();
         $workdir = $service->workdir();
         // $commands[] = "cd {$workdir}";
         $commands[] = "echo 'Saved configuration files to {$workdir}.'";
diff --git a/app/Actions/Service/StopService.php b/app/Actions/Service/StopService.php
index 341687d0d2..52d9edda19 100644
--- a/app/Actions/Service/StopService.php
+++ b/app/Actions/Service/StopService.php
@@ -55,7 +55,6 @@ class StopService
             });
             $dbs->each(function ($database): void {
                 $database->update(['status' => 'exited']);
-                $database->resetRestartLimit();
             });
 
             if ($deleteConnectedNetworks) {
diff --git a/app/Actions/Service/StopServiceApplication.php b/app/Actions/Service/StopServiceApplication.php
index fa93a78807..11ad337ed6 100644
--- a/app/Actions/Service/StopServiceApplication.php
+++ b/app/Actions/Service/StopServiceApplication.php
@@ -30,7 +30,7 @@ class StopServiceApplication
         instant_remote_process($commands, $server, throwError: ! $removeContainer);
 
         $serviceApplication->update(['status' => 'exited']);
-        if ($resetRestartCount) {
+        if ($resetRestartCount && $serviceApplication instanceof ServiceApplication) {
             $serviceApplication->resetRestartLimit();
         }
         ServiceStatusChanged::dispatch($service->environment->project->team->id);
diff --git a/app/Jobs/CheckTraefikVersionForServerJob.php b/app/Jobs/CheckTraefikVersionForServerJob.php
index 054a739bc6..e56b93c9e5 100644
--- a/app/Jobs/CheckTraefikVersionForServerJob.php
+++ b/app/Jobs/CheckTraefikVersionForServerJob.php
@@ -2,6 +2,8 @@
 
 namespace App\Jobs;
 
+use App\Enums\ProxyStatus;
+use App\Enums\ProxyTypes;
 use App\Events\ProxyStatusChangedUI;
 use App\Models\Server;
 use App\Notifications\Server\TraefikVersionOutdated;
@@ -33,8 +35,13 @@ class CheckTraefikVersionForServerJob implements ShouldBeEncrypted, ShouldQueue
      */
     public function handle(): void
     {
+        $this->server->refresh();
         $this->clearOutdatedInfo();
 
+        if ($this->server->proxyType() !== ProxyTypes::TRAEFIK->value || $this->server->proxy->get('status') !== ProxyStatus::RUNNING->value) {
+            return;
+        }
+
         // Detect current version (makes SSH call)
         $currentVersion = getTraefikVersionFromDockerCompose($this->server);
 
@@ -116,7 +123,10 @@ class CheckTraefikVersionForServerJob implements ShouldBeEncrypted, ShouldQueue
 
     private function clearOutdatedInfo(): void
     {
-        $this->server->update(['traefik_outdated_info' => null]);
+        $this->server->update([
+            'detected_traefik_version' => null,
+            'traefik_outdated_info' => null,
+        ]);
     }
 
     /**
diff --git a/app/Jobs/CheckTraefikVersionJob.php b/app/Jobs/CheckTraefikVersionJob.php
index ac94aa23f5..0a9eeba005 100644
--- a/app/Jobs/CheckTraefikVersionJob.php
+++ b/app/Jobs/CheckTraefikVersionJob.php
@@ -19,6 +19,20 @@ class CheckTraefikVersionJob implements ShouldBeEncrypted, ShouldQueue
 
     public function handle(): void
     {
+        Server::query()
+            ->where(function ($query) {
+                $query->whereNull('proxy')
+                    ->orWhere('proxy->type', '!=', ProxyTypes::TRAEFIK->value);
+            })
+            ->where(function ($query) {
+                $query->whereNotNull('detected_traefik_version')
+                    ->orWhereNotNull('traefik_outdated_info');
+            })
+            ->update([
+                'detected_traefik_version' => null,
+                'traefik_outdated_info' => null,
+            ]);
+
         // Load versions from cached data
         $traefikVersions = get_traefik_versions();
 
diff --git a/app/Jobs/PushServerUpdateJob.php b/app/Jobs/PushServerUpdateJob.php
index 0e73ee41b2..ef83d19446 100644
--- a/app/Jobs/PushServerUpdateJob.php
+++ b/app/Jobs/PushServerUpdateJob.php
@@ -5,7 +5,6 @@ namespace App\Jobs;
 use App\Actions\Application\StopApplication;
 use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
-use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Proxy\CheckProxy;
 use App\Actions\Proxy\StartProxy;
@@ -483,7 +482,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             ])
             ->with([
                 'applications:id,service_id,status,last_online_at,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
-                'databases:id,service_id,status,last_online_at,is_public,name,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
+                'databases:id,service_id,status,last_online_at,is_public,name',
             ])
             ->get();
     }
@@ -506,8 +505,6 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             'restart_count',
             'last_restart_at',
             'last_restart_type',
-            'max_restart_count',
-            'restart_limit_reached',
         ];
 
         return collect([
@@ -675,7 +672,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             }
 
             $restartCount = $this->serviceContainerRestartCounts->get($key)?->max() ?? 0;
-            if ($subResource->trackRestartCount($restartCount)) {
+            if (! $subResource instanceof ServiceDatabase && $subResource->trackRestartCount($restartCount)) {
                 StopServiceApplication::dispatch($subResource, false, false);
                 $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
 
@@ -821,11 +818,12 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             $database->status = $containerStatus;
             $database->save();
         }
-        if (is_numeric($restartCount) && $database->trackRestartCount((int) $restartCount)) {
-            StopDatabase::dispatch($database, false, false, false);
-            $database->team()?->notify(new ApplicationRestartLimitReached($database));
-
-            return;
+        if (is_numeric($restartCount) && $restartCount > ($database->restart_count ?? 0)) {
+            $database->update([
+                'restart_count' => (int) $restartCount,
+                'last_restart_at' => now(),
+                'last_restart_type' => 'crash',
+            ]);
         }
         if (! $this->isCompleteSnapshot()) {
             return;
@@ -883,16 +881,12 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         $notFoundDatabaseUuids->each(function ($databaseUuid) {
             $database = $this->databasesByUuid->get($databaseUuid);
             if ($database) {
-                if ($database->stoppedAfterRestartLimit()) {
-                    return;
-                }
                 if (! str($database->status)->startsWith('exited')) {
                     $database->update([
                         'status' => 'exited',
                         'restart_count' => 0,
                         'last_restart_at' => null,
                         'last_restart_type' => null,
-                        'restart_limit_reached' => false,
                     ]);
                 }
                 if ($database->is_public) {
@@ -918,9 +912,8 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         // Batch update service databases
         if ($notFoundServiceDatabaseIds->isNotEmpty()) {
             ServiceDatabase::whereIn('id', $notFoundServiceDatabaseIds)
-                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
+                ->update(['status' => 'exited']);
         }
     }
 
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 68cb52a926..296fd4da5d 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -106,6 +106,8 @@ class Proxy extends Component
         try {
             $this->authorize('update', $this->server);
             $this->server->proxy = null;
+            $this->server->detected_traefik_version = null;
+            $this->server->traefik_outdated_info = null;
             $this->server->save();
 
             $this->dispatch('reloadWindow');
diff --git a/app/Models/Server.php b/app/Models/Server.php
index f7a4bf20c0..dccbed15ed 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -1812,6 +1812,8 @@ $siteAddress {
             $this->proxy->set('last_saved_proxy_configuration', null);
             $this->proxy->set('last_saved_settings', null);
             $this->proxy->set('last_applied_settings', null);
+            $this->detected_traefik_version = null;
+            $this->traefik_outdated_info = null;
             $this->save();
             if ($this->proxySet()) {
                 if ($async) {
diff --git a/app/Models/ServiceDatabase.php b/app/Models/ServiceDatabase.php
index c932791a78..603d11a7f3 100644
--- a/app/Models/ServiceDatabase.php
+++ b/app/Models/ServiceDatabase.php
@@ -2,13 +2,12 @@
 
 namespace App\Models;
 
-use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class ServiceDatabase extends BaseModel
 {
-    use HasFactory, HasRestartLimit, SoftDeletes;
+    use HasFactory, SoftDeletes;
 
     protected $fillable = [
         'service_id',
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index ee8558bb0a..7ca45cc3b7 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneClickhouse extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index c728419550..769d9f00c4 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneDragonfly extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index 9c4e4aa664..15a1fe2f82 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneKeydb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index 4eada8a008..378d36395d 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -14,7 +13,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMariadb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index d0a68d4e71..1010ca5f37 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMongodb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index 4f9e737193..90828bf012 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMysql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index 6027288552..e7db812858 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandalonePostgresql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 8a74824be8..3262611903 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneRedis extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php b/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php
new file mode 100644
index 0000000000..710578fd92
--- /dev/null
+++ b/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php
@@ -0,0 +1,56 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    private const STANDALONE_DATABASE_TABLES = [
+        'standalone_postgresqls',
+        'standalone_redis',
+        'standalone_mongodbs',
+        'standalone_mysqls',
+        'standalone_mariadbs',
+        'standalone_keydbs',
+        'standalone_dragonflies',
+        'standalone_clickhouses',
+    ];
+
+    public function up(): void
+    {
+        foreach (self::STANDALONE_DATABASE_TABLES as $tableName) {
+            Schema::table($tableName, function (Blueprint $table) {
+                $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+            });
+        }
+
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+
+    public function down(): void
+    {
+        foreach (self::STANDALONE_DATABASE_TABLES as $tableName) {
+            Schema::table($tableName, function (Blueprint $table) {
+                $table->integer('max_restart_count')->default(10);
+                $table->boolean('restart_limit_reached')->default(false);
+            });
+        }
+
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+};
diff --git a/resources/views/components/application/restart-limit-warning.blade.php b/resources/views/components/application/restart-limit-warning.blade.php
index 3d08c803d5..5a35623fc4 100644
--- a/resources/views/components/application/restart-limit-warning.blade.php
+++ b/resources/views/components/application/restart-limit-warning.blade.php
@@ -1,6 +1,6 @@
 @props(['application'])
 
-@if ($application->stoppedAfterRestartLimit())
+@if (method_exists($application, 'stoppedAfterRestartLimit') && $application->stoppedAfterRestartLimit())
     @php($restartLimit = method_exists($application, 'restartLimitMaximum') ? $application->restartLimitMaximum() : ($application->max_restart_count ?? 0))
     @php($displayRestartCount = max($application->restart_count ?? 0, $restartLimit))
     <x-status-badge
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 79899e8795..22ce7dab3e 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -189,15 +189,28 @@
                 @endcan
             @else
                 @can('deploy', $service)
-                    <button type="button" class="button mb-2 w-full justify-between" disabled>
-                        <span>Deploy</span>
-                        <span class="text-xs font-normal opacity-70">Fill required variables first</span>
-                    </button>
+                    <div id="service-mobile-actions" class="relative mb-3"
+                        x-data="{ open: false }" @click.outside="open = false"
+                        @keydown.escape.window="open = false">
+                        <button type="button" class="button w-full justify-between" @click="open = !open"
+                            :aria-expanded="open" aria-haspopup="menu">
+                            <span>Actions</span>
+                            <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
+                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
+                            </span>
+                        </button>
+
+                        <div x-cloak x-show="open" x-transition.origin.top.left
+                            class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
+                            <div class="listbox-option cursor-default! justify-start! gap-2.5! text-neutral-400! dark:text-fg-faint!"
+                                role="menuitem" aria-disabled="true">
+                                <x-reicon name="play-circle" class="size-3.5 opacity-70" />
+                                <span>Deploy (<a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
+                                        class="cursor-pointer underline underline-offset-2">missing required env vars</a>)</span>
+                            </div>
+                        </div>
+                    </div>
                 @endcan
-                <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
-                    class="mb-3 inline-flex" aria-label="Open required environment variables">
-                    <x-status-badge status="Required variables missing" type="error" />
-                </a>
             @endif
 
         </div>
@@ -287,10 +300,26 @@
                         </div>
                         @endcan
                     @else
-                        <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
-                            aria-label="Open required environment variables">
-                            <x-status-badge status="Required variables missing" type="error" />
-                        </a>
+                        @can('deploy', $service)
+                            <div id="service-desktop-actions" class="relative" x-data="{ open: false }"
+                                x-effect="$dispatch('resource-actions-toggled', { open })"
+                                @click.outside="open = false" @keydown.escape.window="open = false">
+                                <button type="button" class="button button-highlighted" @click="open = !open"
+                                    :aria-expanded="open" aria-haspopup="menu">
+                                    Actions
+                                    <x-reicon name="chevron-down" class="size-3 opacity-55" />
+                                </button>
+                                <div x-cloak x-show="open" x-transition.origin.top.right
+                                    class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="menu">
+                                    <div class="listbox-option cursor-default! justify-start! gap-2.5! text-neutral-400! dark:text-fg-faint!"
+                                        role="menuitem" aria-disabled="true">
+                                        <x-reicon name="play-circle" class="size-3.5 opacity-70" />
+                                        <span>Deploy (<a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
+                                                class="cursor-pointer underline underline-offset-2">missing required env vars</a>)</span>
+                                    </div>
+                                </div>
+                            </div>
+                        @endcan
                     @endif
                 </div>
             </div>
diff --git a/tests/Feature/AllResourceRestartLimitsTest.php b/tests/Feature/AllResourceRestartLimitsTest.php
index 8418b552cd..7da82f7d65 100644
--- a/tests/Feature/AllResourceRestartLimitsTest.php
+++ b/tests/Feature/AllResourceRestartLimitsTest.php
@@ -1,5 +1,8 @@
 <?php
 
+use App\Actions\Docker\GetContainersStatus;
+use App\Actions\Service\StopServiceApplication;
+use App\Jobs\PushServerUpdateJob;
 use App\Models\ApplicationPreview;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
@@ -14,9 +17,10 @@ use App\Models\StandaloneRedis;
 use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\Schema;
 
-it('gives every independently runnable non-application resource restart limit state', function (string $modelClass) {
+it('gives independently runnable application resources restart limit state', function (string $modelClass) {
     expect(class_uses_recursive($modelClass))->toContain(HasRestartLimit::class);
 
     $resource = new $modelClass;
@@ -34,17 +38,8 @@ it('gives every independently runnable non-application resource restart limit st
         'last_restart_at' => 'datetime',
     ]);
 })->with([
-    ApplicationPreview::class,
-    ServiceApplication::class,
-    ServiceDatabase::class,
-    StandaloneClickhouse::class,
-    StandaloneDragonfly::class,
-    StandaloneKeydb::class,
-    StandaloneMariadb::class,
-    StandaloneMongodb::class,
-    StandaloneMysql::class,
-    StandalonePostgresql::class,
-    StandaloneRedis::class,
+    [ApplicationPreview::class],
+    [ServiceApplication::class],
 ]);
 
 it('collects restart counts for preview and service containers from both status sources', function () {
@@ -157,7 +152,7 @@ it('imports the application model used when claiming a restart limit', function
         ->toContain('Application::query()');
 });
 
-it('adds restart limit columns to previews services and standalone databases', function () {
+it('limits restarts only for applications', function () {
     $migrations = collect(glob(database_path('migrations/*.php')))
         ->map(fn (string $path): string => file_get_contents($path))
         ->implode("\n");
@@ -165,19 +160,62 @@ it('adds restart limit columns to previews services and standalone databases', f
     expect($migrations)
         ->toContain("'application_previews'")
         ->toContain("'service_applications'")
-        ->toContain("'service_databases'")
         ->toContain("'max_restart_count'")
-        ->toContain("'restart_limit_reached'");
+        ->toContain("'restart_limit_reached'")
+        ->toContain("dropColumn(['max_restart_count', 'restart_limit_reached'])");
 
-    $restartLimitMigrations = collect(glob(database_path('migrations/*_add_restart_limit_to_*.php')));
+    $databaseModels = [
+        ServiceDatabase::class,
+        StandalonePostgresql::class,
+        StandaloneRedis::class,
+        StandaloneMongodb::class,
+        StandaloneMysql::class,
+        StandaloneMariadb::class,
+        StandaloneKeydb::class,
+        StandaloneDragonfly::class,
+        StandaloneClickhouse::class,
+    ];
 
-    expect($restartLimitMigrations)->toHaveCount(11);
-    expect($restartLimitMigrations->map(
-        fn (string $path): string => substr(basename($path), 0, 17)
-    )->unique())->toHaveCount(11);
-    $restartLimitMigrations->each(function (string $path): void {
-        expect(file_get_contents($path))->not->toContain('foreach (');
-    });
+    foreach ($databaseModels as $databaseModel) {
+        expect(class_uses_recursive($databaseModel))->not->toContain(HasRestartLimit::class);
+    }
+
+    foreach ([
+        'service_databases',
+        'standalone_postgresqls',
+        'standalone_redis',
+        'standalone_mongodbs',
+        'standalone_mysqls',
+        'standalone_mariadbs',
+        'standalone_keydbs',
+        'standalone_dragonflies',
+        'standalone_clickhouses',
+    ] as $databaseTable) {
+        expect(Schema::hasColumn($databaseTable, 'max_restart_count'))->toBeFalse()
+            ->and(Schema::hasColumn($databaseTable, 'restart_limit_reached'))->toBeFalse();
+    }
+
+    foreach ([GetContainersStatus::class, PushServerUpdateJob::class] as $statusUpdater) {
+        $source = file_get_contents((new ReflectionClass($statusUpdater))->getFileName());
+
+        expect($source)
+            ->not->toContain('$database->trackRestartCount')
+            ->not->toContain('$database->stoppedAfterRestartLimit()');
+    }
+
+    $stopServiceResource = file_get_contents((new ReflectionClass(StopServiceApplication::class))->getFileName());
+
+    expect($stopServiceResource)
+        ->toContain('$resetRestartCount && $serviceApplication instanceof ServiceApplication');
+});
+
+it('does not render restart limit warnings for service databases', function () {
+    $html = Blade::render(
+        '<x-application.restart-limit-warning :application="$database" />',
+        ['database' => new ServiceDatabase],
+    );
+
+    expect(trim($html))->toBeEmpty();
 });
 
 it('atomically claims a resource restart limit once and can reset it', function () {
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index ce69f26ef7..f7951e93a0 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -82,21 +82,31 @@ it('docks desktop resource actions in the top bar instead of floating over conte
     }
 });
 
-it('links the service header missing variables warning to environment variables', function () {
+it('shows disabled deploy actions when service variables are missing', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
     $mobileActions = str($heading)
         ->after('<div class="w-full xl:hidden">')
         ->before("@teleport('#resource-action-hud-slot')")
         ->toString();
+    $desktopActions = str($heading)
+        ->after("@teleport('#resource-action-hud-slot')")
+        ->before('@endteleport')
+        ->toString();
 
-    expect($heading)
-        ->toContain("route('project.service.environment-variables'")
-        ->toContain('Required variables missing')
+    expect($mobileActions)
+        ->toContain('id="service-mobile-actions"')
+        ->toContain('aria-disabled="true"')
+        ->toContain('Deploy')
+        ->toContain('missing required env vars')
         ->toContain('href="{{ $environmentVariablesUrl }}"')
-        ->and($mobileActions)
-        ->toContain('Fill required variables first')
-        ->toContain('disabled')
-        ->toContain('Deploy');
+        ->toContain('underline')
+        ->and($desktopActions)
+        ->toContain('id="service-desktop-actions"')
+        ->toContain('aria-disabled="true"')
+        ->toContain('Deploy')
+        ->toContain('missing required env vars')
+        ->toContain('href="{{ $environmentVariablesUrl }}"')
+        ->toContain('underline');
 });
 
 it('places the account menu beside the desktop sidebar toggle while retaining it on mobile', function () {
diff --git a/tests/Feature/TraefikVersionStateTest.php b/tests/Feature/TraefikVersionStateTest.php
index 3dad5423e5..de3cf8e17c 100644
--- a/tests/Feature/TraefikVersionStateTest.php
+++ b/tests/Feature/TraefikVersionStateTest.php
@@ -1,12 +1,16 @@
 <?php
 
 use App\Enums\ProxyTypes;
+use App\Events\ProxyStatusChangedUI;
 use App\Jobs\CheckTraefikVersionForServerJob;
+use App\Jobs\CheckTraefikVersionJob;
 use App\Livewire\Server\Proxy;
 use App\Models\Server;
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
 
 uses(RefreshDatabase::class);
 
@@ -185,7 +189,7 @@ it('marks matching Traefik outdated information as a current warning', function
     expect($server->hasCurrentTraefikOutdatedInfo())->toBeTrue();
 });
 
-it('clears stale outdated information before detecting the current version', function () {
+it('clears stale Traefik version state before detecting the current version', function () {
     $team = Team::factory()->create();
     $server = Server::factory()->create([
         'team_id' => $team->id,
@@ -204,6 +208,80 @@ it('clears stale outdated information before detecting the current version', fun
 
     $server->refresh();
 
-    expect($server->detected_traefik_version)->toBe('3.6.23')
+    expect($server->detected_traefik_version)->toBeNull()
         ->and($server->traefik_outdated_info)->toBeNull();
 });
+
+it('clears Traefik version state when the proxy changes', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+
+    $server->changeProxy(ProxyTypes::NONE->value);
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+});
+
+it('cleans stale Traefik version state while selecting servers to check', function () {
+    Bus::fake();
+    Cache::put('coolify:versions:all', [
+        'traefik' => ['v3.7' => '3.7.8'],
+    ]);
+
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::NONE->value,
+            'status' => 'exited',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+
+    (new CheckTraefikVersionJob)->handle();
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+});
+
+it('does not inspect a server after its Traefik proxy has been disabled', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::NONE->value,
+            'status' => 'exited',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+    Event::fake();
+
+    (new CheckTraefikVersionForServerJob($server, ['v3.7' => '3.7.8']))->handle();
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+
+    Event::assertNotDispatched(ProxyStatusChangedUI::class);
+});
diff --git a/tests/Unit/StopActionsPersistStatusTest.php b/tests/Unit/StopActionsPersistStatusTest.php
index 35b6052dd3..67a7a8c6f9 100644
--- a/tests/Unit/StopActionsPersistStatusTest.php
+++ b/tests/Unit/StopActionsPersistStatusTest.php
@@ -21,7 +21,7 @@ it('persists exited status for all children when stopping a service', function (
         ->toContain("\$application->update(['status' => 'exited']);")
         ->toContain('$application->resetRestartLimit();')
         ->toContain("\$database->update(['status' => 'exited']);")
-        ->toContain('$database->resetRestartLimit();');
+        ->not->toContain('$database->resetRestartLimit();');
 });
 
 it('persists exited status when stopping an individual service resource', function () {

From 2ebbc5113ec8ab4e329e3c14daf9cacc3b0d5155 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:44:18 +0200
Subject: [PATCH 17/48] fix: return null for invalid repository URLs

---
 app/Models/Application.php                  |  6 +++++-
 tests/Unit/ApplicationGitCommitLinkTest.php | 11 +++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/Models/Application.php b/app/Models/Application.php
index 6bfbb6de75..7f7ce5ea1f 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -714,7 +714,7 @@ class Application extends BaseModel
         );
     }
 
-    public function gitCommitLink($link): string
+    public function gitCommitLink($link): ?string
     {
         if (! is_null(data_get($this, 'source.html_url')) && ! is_null(data_get($this, 'git_repository')) && ! is_null(data_get($this, 'git_branch'))) {
             if (str($this->source->html_url)->contains('bitbucket')) {
@@ -731,6 +731,10 @@ class Application extends BaseModel
             $git_repository = 'https://'.parse_url($git_repository, PHP_URL_HOST).parse_url($git_repository, PHP_URL_PATH);
         }
 
+        if (! filter_var($git_repository, FILTER_VALIDATE_URL)) {
+            return null;
+        }
+
         $url = Url::fromString(Str::replaceEnd('.git', '', $git_repository));
         $url = $url->withUserInfo('');
         $commitPath = str($git_repository)->contains('bitbucket') ? 'commits' : 'commit';
diff --git a/tests/Unit/ApplicationGitCommitLinkTest.php b/tests/Unit/ApplicationGitCommitLinkTest.php
index e1a15e7149..378384fe8f 100644
--- a/tests/Unit/ApplicationGitCommitLinkTest.php
+++ b/tests/Unit/ApplicationGitCommitLinkTest.php
@@ -26,3 +26,14 @@ it('generates commit links for direct repository remotes', function (string $rep
         'https://bitbucket.org/coollabsio/coolify/commits/1234567890abcdef',
     ],
 ]);
+
+it('does not generate commit links from incomplete repository URLs', function (string $repository) {
+    $application = new Application;
+    $application->setRelation('source', null);
+    $application->git_repository = $repository;
+
+    expect($application->gitCommitLink('1234567890abcdef'))->toBeNull();
+})->with([
+    'missing host' => 'https://',
+    'missing scheme' => 'github.com/coollabsio/coolify',
+]);

From 89814743c8233fa856d58fcb72a2f04ecc9e600c Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:45:55 +0200
Subject: [PATCH 18/48] fix(applications): TypeError when stopping an
 application

---
 app/Actions/Application/StopApplication.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index 3feb5117d8..fcf1e1d0fe 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -78,5 +78,7 @@ class StopApplication
         $application->update($status);
 
         ServiceStatusChanged::dispatch($application->environment->project->team->id);
+
+        return null;
     }
 }

From aafef73aa651366d4ec14f8fa2a1d426817eb105 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:53:49 +0200
Subject: [PATCH 19/48] fix(docker): match helper containers at any registry
 depth

---
 app/Jobs/CleanupHelperContainersJob.php       | 2 +-
 tests/Unit/CleanupHelperContainersJobTest.php | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/app/Jobs/CleanupHelperContainersJob.php b/app/Jobs/CleanupHelperContainersJob.php
index 425dd2591c..52b4064feb 100644
--- a/app/Jobs/CleanupHelperContainersJob.php
+++ b/app/Jobs/CleanupHelperContainersJob.php
@@ -21,7 +21,7 @@ class CleanupHelperContainersJob implements ShouldBeEncrypted, ShouldBeUnique, S
 
     private static function helperContainersCommand(): string
     {
-        return 'docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image|test("^([^/]+/)?coollabsio/coolify-helper(:|@)")))\'';
+        return 'docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image|test("(^|/)coollabsio/coolify-helper(:|@)")))\'';
     }
 
     public function handle(): void
diff --git a/tests/Unit/CleanupHelperContainersJobTest.php b/tests/Unit/CleanupHelperContainersJobTest.php
index a649985d28..bd3e2e175d 100644
--- a/tests/Unit/CleanupHelperContainersJobTest.php
+++ b/tests/Unit/CleanupHelperContainersJobTest.php
@@ -13,6 +13,11 @@ it('matches helper image references without matching similarly named images', fu
         'docker.io/coollabsio/coolify-helper:1.0.16',
         'ghcr.io/coollabsio/coolify-helper@sha256:abc',
         'registry.example/team/coollabsio/coolify-helper:latest',
+        'coollabsio/coolify:latest',
+        'coollabsio/coolify:4.3.12',
+        'coollabsio/coolify-realtime:1.0.10',
+        'coolify-helper:latest',
+        'someone/coolify-helper:1.0.16',
         'evil/coollabsio/coolify-helper-copy:latest',
         'coollabsio/not-coolify-helper:latest',
     ];
@@ -31,7 +36,7 @@ it('matches helper image references without matching similarly named images', fu
         $process->mustRun();
 
         expect(array_column(json_decode($process->getOutput(), true, flags: JSON_THROW_ON_ERROR), 'Image'))
-            ->toBe(array_slice($images, 0, 3));
+            ->toBe(array_slice($images, 0, 4));
     } finally {
         unlink($docker);
         rmdir($directory);

From 92c0035002d977cea4925984999e1895766910fd Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:34:40 +0200
Subject: [PATCH 20/48] ci: sync main to next once a day instead of on every
 push

merging main into next after every commit clutters the next branch with too many merge commits.
---
 .github/workflows/sync-main-to-next.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sync-main-to-next.yml b/.github/workflows/sync-main-to-next.yml
index 595a21e799..b9b8b361f2 100644
--- a/.github/workflows/sync-main-to-next.yml
+++ b/.github/workflows/sync-main-to-next.yml
@@ -1,8 +1,8 @@
 name: Sync main to next
 
 on:
-  push:
-    branches: [main]
+  schedule:
+    - cron: '0 3 * * *'
   workflow_dispatch:
 
 permissions:

From a04c2ecb442c3ed8a4eac60a6bb9e3413111d13c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:38:24 +0200
Subject: [PATCH 21/48] fix(docker): preserve restart policies when stopping
 containers

---
 app/Actions/Application/StopApplication.php           |  2 --
 app/Actions/Application/StopApplicationPreview.php    |  2 --
 app/Actions/Database/StopDatabase.php                 |  2 --
 app/Actions/Service/StopServiceApplication.php        |  5 +----
 .../ApplicationStoppedAfterRestartLimitTest.php       |  2 +-
 tests/Unit/StopActionsPersistStatusTest.php           | 11 +++++++++++
 6 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index fcf1e1d0fe..12ac569009 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -44,8 +44,6 @@ class StopApplication
                     $commands = [dockerStopCommand($timeout, $containerName, $server)];
                     if ($removeContainers) {
                         $commands[] = "docker rm -f $containerName";
-                    } else {
-                        array_unshift($commands, "docker update --restart=no $containerName");
                     }
 
                     instant_remote_process(command: $commands, server: $server, throwError: false);
diff --git a/app/Actions/Application/StopApplicationPreview.php b/app/Actions/Application/StopApplicationPreview.php
index af5f3fc0f0..8bb3a3dc08 100644
--- a/app/Actions/Application/StopApplicationPreview.php
+++ b/app/Actions/Application/StopApplicationPreview.php
@@ -20,8 +20,6 @@ class StopApplicationPreview
             $commands = [dockerStopCommand($application->settings->stopGracePeriodSeconds(), $containerName, $server)];
             if ($removeContainer) {
                 $commands[] = "docker rm -f $containerName";
-            } else {
-                array_unshift($commands, "docker update --restart=no $containerName");
             }
             instant_remote_process($commands, $server, false);
         }
diff --git a/app/Actions/Database/StopDatabase.php b/app/Actions/Database/StopDatabase.php
index 8005311b5b..d3c6fafc4d 100644
--- a/app/Actions/Database/StopDatabase.php
+++ b/app/Actions/Database/StopDatabase.php
@@ -62,8 +62,6 @@ class StopDatabase
         $commands = [dockerStopCommand($timeout, $containerName, $server)];
         if ($removeContainer) {
             $commands[] = "docker rm -f $containerName";
-        } else {
-            array_unshift($commands, "docker update --restart=no $containerName");
         }
         instant_remote_process(command: $commands, server: $server, throwError: false);
     }
diff --git a/app/Actions/Service/StopServiceApplication.php b/app/Actions/Service/StopServiceApplication.php
index 11ad337ed6..1b53472656 100644
--- a/app/Actions/Service/StopServiceApplication.php
+++ b/app/Actions/Service/StopServiceApplication.php
@@ -22,10 +22,7 @@ class StopServiceApplication
         if ($removeContainer) {
             $commands = ["docker rm -f {$containerName}"];
         } else {
-            $commands = [
-                "docker update --restart=no {$containerName}",
-                "docker stop {$containerName}",
-            ];
+            $commands = ["docker stop {$containerName}"];
         }
         instant_remote_process($commands, $server, throwError: ! $removeContainer);
 
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
index 58ebb8c703..f5875adb2c 100644
--- a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -126,7 +126,7 @@ it('can stop an application without removing its containers', function () {
 
     expect($removeContainers)->not->toBeNull()
         ->and($removeContainers->getDefaultValue())->toBeTrue()
-        ->and($action)->toContain('docker update --restart=no')
+        ->and($action)->not->toContain('docker update --restart=no')
         ->and($action)->toContain('if ($removeContainers)');
 });
 
diff --git a/tests/Unit/StopActionsPersistStatusTest.php b/tests/Unit/StopActionsPersistStatusTest.php
index 67a7a8c6f9..a6d8d2fc1e 100644
--- a/tests/Unit/StopActionsPersistStatusTest.php
+++ b/tests/Unit/StopActionsPersistStatusTest.php
@@ -6,6 +6,17 @@ it('persists exited status when stopping standalone databases', function () {
     expect($action)->toContain("'status' => 'exited'");
 });
 
+it('does not change Docker restart policies when retaining stopped containers', function (string $actionPath) {
+    $action = file_get_contents(__DIR__.'/../../'.$actionPath);
+
+    expect($action)->not->toContain('docker update --restart=no');
+})->with([
+    'applications' => 'app/Actions/Application/StopApplication.php',
+    'application previews' => 'app/Actions/Application/StopApplicationPreview.php',
+    'service applications' => 'app/Actions/Service/StopServiceApplication.php',
+    'standalone databases' => 'app/Actions/Database/StopDatabase.php',
+]);
+
 it('persists exited status for every full application stop path', function () {
     $action = file_get_contents(__DIR__.'/../../app/Actions/Application/StopApplication.php');
 

From 851a902346aa1f1b847ce9dd4fa79d2a2513f941 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:47:12 +0200
Subject: [PATCH 22/48] fix(domains): preserve removed compose service domains

---
 bootstrap/helpers/domains.php            | 20 ++++++++++++++++++
 bootstrap/helpers/parsers.php            |  7 ++----
 tests/Feature/ApplicationDomainsTest.php | 27 ++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 5 deletions(-)

diff --git a/bootstrap/helpers/domains.php b/bootstrap/helpers/domains.php
index 4e4ad73e6f..28ff41b3df 100644
--- a/bootstrap/helpers/domains.php
+++ b/bootstrap/helpers/domains.php
@@ -443,6 +443,26 @@ function getComposeServiceDomainString(array|Collection $domains, string $servic
     return $matches[0]['domain'];
 }
 
+/**
+ * Determine whether a compose service already has a domain-map entry, including
+ * an explicitly empty entry left when a user removes its generated domain.
+ *
+ * @param  array<string, mixed>|Collection<string, mixed>  $domains
+ */
+function hasComposeServiceDomainEntry(array|Collection $domains, string $serviceName): bool
+{
+    $normalized = normalizeComposeServiceName($serviceName);
+
+    foreach (collect($domains)->keys() as $key) {
+        $key = (string) $key;
+        if ($key === $serviceName || normalizeComposeServiceName($key) === $normalized) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
 function composeDomainEntryString(mixed $entry): ?string
 {
     if (is_object($entry)) {
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 590b68d162..03ebf5af7a 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -525,8 +525,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                 $originalServiceName = findComposeServiceName($normalizedServiceName, array_keys($services));
                 if ($originalServiceName !== null) {
                     $domains = json_decode(data_get($resource, 'docker_compose_domains') ?: '[]', true) ?: [];
-                    $domainExists = getComposeServiceDomainString($domains, $originalServiceName);
-                    if (is_null($domainExists)) {
+                    if (! hasComposeServiceDomainEntry($domains, $originalServiceName)) {
                         $serviceNameForDomain = str($parsed['service_name'])->replace('_', '-')->value();
                         $domainValue = generateUrl(server: $server, random: "$serviceNameForDomain-$uuid");
                         if ($value && get_class($value) === Stringable::class && $value->startsWith('/')) {
@@ -648,12 +647,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                         // Only add domain if the service exists
                         if ($composeServiceName !== null) {
                             $domains = json_decode(data_get($resource, 'docker_compose_domains') ?: '[]', true) ?: [];
-                            $domainExists = getComposeServiceDomainString($domains, $composeServiceName);
-
                             // Update domain using URL with port if applicable
                             $domainValue = $port ? $urlWithPort : $url;
 
-                            if (is_null($domainExists)) {
+                            if (! hasComposeServiceDomainEntry($domains, $composeServiceName)) {
                                 $resource->docker_compose_domains = json_encode(putComposeServiceDomain(
                                     $domains,
                                     $composeServiceName,
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index a13b5fdbfd..f2beb22f13 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -111,6 +111,33 @@ it('does not add a single-label hostname as an application domain', function ()
     expect($this->application->fresh()->fqdn)->toBeNull();
 });
 
+it('keeps a compose domain removed when the service declares a magic URL variable', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      SERVICE_URL_WEB: /api
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com/api'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $domainKey = hash('sha256', 'https://web.example.com/api|web');
+
+    $component
+        ->call('removeDomainByKey', $domainKey)
+        ->assertDispatched('success')
+        ->assertSet('domainRows', []);
+
+    expect(json_decode($this->application->fresh()->docker_compose_domains, true))
+        ->toMatchArray(['web' => ['domain' => null]]);
+});
+
 it('generates a preview domain when the application has no domain', function () {
     $preview = ApplicationPreview::create([
         'application_id' => $this->application->id,

From 5ff21103974a30e107ce046190fb478658a214e7 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:01:42 +0200
Subject: [PATCH 23/48] fix(environment-variables): preserve generated Compose
 variables

Exclude protected Compose variables from bulk deletion and developer views, and propagate deletion failures correctly.
---
 .../Shared/EnvironmentVariable/All.php        | 42 +++++++-----
 .../EnvironmentVariableAsyncLoadTest.php      | 66 +++++++++++++++++++
 2 files changed, 90 insertions(+), 18 deletions(-)

diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/All.php b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
index ea8394c1b1..47080cd86b 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/All.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
@@ -818,19 +818,21 @@ class All extends Component
     {
         $isMember = auth()->user()?->isMember();
 
-        return $variables->map(function ($item) use ($isMember) {
-            if ($isMember) {
-                return "$item->key=(Hidden, only admins can view)";
-            }
-            if ($item->is_shown_once) {
-                return "$item->key=(Locked Secret, delete and add again to change)";
-            }
-            if ($item->is_multiline) {
-                return "$item->key=(Multiline environment variable, edit in normal view)";
-            }
+        return $variables
+            ->reject(fn ($item): bool => $this->isProtectedEnvironmentVariable($item->key))
+            ->map(function ($item) use ($isMember) {
+                if ($isMember) {
+                    return "$item->key=(Hidden, only admins can view)";
+                }
+                if ($item->is_shown_once) {
+                    return "$item->key=(Locked Secret, delete and add again to change)";
+                }
+                if ($item->is_multiline) {
+                    return "$item->key=(Multiline environment variable, edit in normal view)";
+                }
 
-            return "$item->key=$item->value";
-        })->join("\n");
+                return "$item->key=$item->value";
+            })->join("\n");
     }
 
     public function switch()
@@ -908,8 +910,7 @@ class All extends Component
         $deletedCount = $this->deleteRemovedVariables(false, $variables);
         if ($deletedCount > 0) {
             $changesMade = true;
-        } elseif ($deletedCount === 0 && $this->resource->environment_variables()->whereNotIn('key', array_keys($variables))->exists()) {
-            // If we tried to delete but couldn't (due to Docker Compose), mark as error
+        } elseif ($deletedCount < 0) {
             $errorOccurred = true;
         }
 
@@ -926,8 +927,7 @@ class All extends Component
             $deletedPreviewCount = $this->deleteRemovedVariables(true, $previewVariables);
             if ($deletedPreviewCount > 0) {
                 $changesMade = true;
-            } elseif ($deletedPreviewCount === 0 && $this->resource->environment_variables_preview()->whereNotIn('key', array_keys($previewVariables))->exists()) {
-                // If we tried to delete but couldn't (due to Docker Compose), mark as error
+            } elseif ($deletedPreviewCount < 0) {
                 $errorOccurred = true;
             }
 
@@ -988,6 +988,12 @@ class All extends Component
         // Get all environment variables that will be deleted
         $variablesToDelete = $this->resource->$method()->whereNotIn('key', array_keys($variables))->get();
 
+        // Generated Compose variables are managed by Coolify and must survive a bulk
+        // replacement even when they are omitted from the pasted environment file.
+        $variablesToDelete = $variablesToDelete->reject(
+            fn (EnvironmentVariable $environmentVariable): bool => $this->isProtectedEnvironmentVariable($environmentVariable->key)
+        );
+
         // If there are no variables to delete, return 0
         if ($variablesToDelete->isEmpty()) {
             return 0;
@@ -1001,13 +1007,13 @@ class All extends Component
                 if ($isUsed) {
                     $this->dispatch('error', "Cannot delete environment variable '{$envVar->key}' <br><br>Please remove it from the Docker Compose file first.");
 
-                    return 0;
+                    return -1;
                 }
             }
         }
 
         // If we get here, no variables are used in Docker Compose, so we can delete them
-        $this->resource->$method()->whereNotIn('key', array_keys($variables))->delete();
+        $this->resource->$method()->whereKey($variablesToDelete->modelKeys())->delete();
 
         return $variablesToDelete->count();
     }
diff --git a/tests/Feature/EnvironmentVariableAsyncLoadTest.php b/tests/Feature/EnvironmentVariableAsyncLoadTest.php
index 2cbc5537a1..4d83862b6e 100644
--- a/tests/Feature/EnvironmentVariableAsyncLoadTest.php
+++ b/tests/Feature/EnvironmentVariableAsyncLoadTest.php
@@ -121,3 +121,69 @@ it('is idempotent when loadEnvironmentVariables is called twice', function () {
     expect($component->instance()->environmentVariables->pluck('key')->all())
         ->toContain('API_KEY');
 });
+
+it('preserves generated compose variables during bulk replacement', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'build_pack' => 'dockercompose',
+        'docker_compose' => <<<'YAML'
+services:
+  api:
+    image: nginx:alpine
+    environment:
+      SERVICE_URL_API: /api
+YAML,
+    ]);
+
+    foreach ([
+        'SERVICE_URL_API' => 'https://api.example.com/api',
+        'SERVICE_FQDN_API' => 'api.example.com/api',
+        'OLD_VARIABLE' => 'remove-me',
+    ] as $key => $value) {
+        EnvironmentVariable::create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+        ]);
+    }
+
+    Livewire::test(All::class, ['resource' => $application])
+        ->set('variables', 'NEW_VARIABLE=keep-me')
+        ->call('submit')
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
+
+    expect($application->environment_variables()->pluck('value', 'key')->all())
+        ->toBe([
+            'SERVICE_URL_API' => 'https://api.example.com/api',
+            'SERVICE_FQDN_API' => 'api.example.com/api',
+            'NEW_VARIABLE' => 'keep-me',
+        ]);
+});
+
+it('hides generated compose variables from developer view', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'build_pack' => 'dockercompose',
+    ]);
+
+    foreach ([
+        'SERVICE_URL_API' => 'https://api.example.com',
+        'SERVICE_FQDN_API' => 'api.example.com',
+        'API_URL' => '$SERVICE_URL_API',
+    ] as $key => $value) {
+        EnvironmentVariable::create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+        ]);
+    }
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->call('switch');
+
+    expect($component->get('variables'))
+        ->toBe('API_URL=$SERVICE_URL_API');
+});

From dba3d114e5ed2be9a466c030c8cbc2ec58b498d9 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:09:53 +0200
Subject: [PATCH 24/48] chore(release): bump Coolify version to 4.3.18

---
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 2 +-
 tests/Unit/ProductionImageWorkflowTest.php | 4 ++--
 versions.json                              | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 7ad0c4594f..22d5e10118 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.17',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.18',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 0e83c0cf74..97ab3b3a6a 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.17"
+            "version": "4.3.18"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 140a6276f2..206cf5f34e 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.17'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.17')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.18'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.18')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index 0e83c0cf74..97ab3b3a6a 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.17"
+            "version": "4.3.18"
         },
         "nightly": {
             "version": "4.4-rc.1"

From 9c3fb1da396bdd26ece4711f673c46540287039f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 20:56:08 +0200
Subject: [PATCH 25/48] fix(domains): limit instance addresses to localhost DNS
 hints

---
 .../InteractsWithCloudflareDomainConnect.php  | 27 +++++----
 app/Livewire/Project/Application/Domains.php  |  5 ++
 app/Livewire/Project/Service/Domains.php      |  5 ++
 tests/Feature/ApplicationDomainsTest.php      | 57 +++++++++++++++++++
 tests/Feature/ServiceDomainsTest.php          | 18 ++++++
 5 files changed, 100 insertions(+), 12 deletions(-)

diff --git a/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php b/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
index 44dba0d5e8..6ecea8e96f 100644
--- a/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
+++ b/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
@@ -209,19 +209,20 @@ trait InteractsWithCloudflareDomainConnect
             }
         }
 
-        // Prefer instance public IPv6 when the destination IP is IPv4-only (and vice versa).
-        try {
-            $settings = instanceSettings();
-            $publicV4 = data_get($settings, 'public_ipv4');
-            $publicV6 = data_get($settings, 'public_ipv6');
-            if ($ipv4 === null && is_string($publicV4) && filter_var($publicV4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
-                $ipv4 = $publicV4;
+        if ($this->usesInstanceNetworkAddressesForDnsHints()) {
+            try {
+                $settings = instanceSettings();
+                $publicV4 = data_get($settings, 'public_ipv4');
+                $publicV6 = data_get($settings, 'public_ipv6');
+                if ($ipv4 === null && is_string($publicV4) && filter_var($publicV4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+                    $ipv4 = $publicV4;
+                }
+                if ($ipv6 === null && is_string($publicV6) && filter_var($publicV6, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+                    $ipv6 = $publicV6;
+                }
+            } catch (\Throwable) {
+                //
             }
-            if ($ipv6 === null && is_string($publicV6) && filter_var($publicV6, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
-                $ipv6 = $publicV6;
-            }
-        } catch (\Throwable) {
-            //
         }
 
         return [$ipv4, $ipv6];
@@ -253,5 +254,7 @@ trait InteractsWithCloudflareDomainConnect
         return null;
     }
 
+    abstract protected function usesInstanceNetworkAddressesForDnsHints(): bool;
+
     abstract protected function authorizeUpdateForDomainConnect(): void;
 }
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index d7797935f5..839c61e36a 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -661,6 +661,11 @@ class Domains extends Component
         $this->authorize('update', $this->application);
     }
 
+    protected function usesInstanceNetworkAddressesForDnsHints(): bool
+    {
+        return $this->application->destination?->server?->id === 0;
+    }
+
     public function checkAllDns(): void
     {
         $this->authorize('update', $this->application);
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index d5254e093a..4ac2f40b2b 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -459,6 +459,11 @@ class Domains extends Component
         $this->authorize('update', $this->service);
     }
 
+    protected function usesInstanceNetworkAddressesForDnsHints(): bool
+    {
+        return $this->service->server?->id === 0;
+    }
+
     public function checkAllDns(): void
     {
         $this->authorize('update', $this->service);
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index f2beb22f13..396cccbfc9 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -716,6 +716,63 @@ it('lists dns entries for domains that still need dns and omits working configur
         ->not->toContain('app.example.com');
 });
 
+it('does not use instance network addresses for dns entries on a remote server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $this->application->update(['fqdn' => 'https://app.example.com']);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $records = $component->instance()->dnsRecordHints();
+
+    expect($records)->toBe([
+        [
+            'type' => 'A',
+            'name' => 'app.example.com',
+            'value' => '203.0.113.10',
+        ],
+    ]);
+});
+
+it('uses instance network addresses for dns entries on the localhost server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $localhost = Server::factory()->create([
+        'id' => 0,
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->server->private_key_id,
+        'ip' => 'localhost',
+    ]);
+    $destination = StandaloneDocker::withoutEvents(fn () => StandaloneDocker::forceCreate([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'localhost-docker',
+        'network' => 'coolify-localhost',
+        'server_id' => $localhost->id,
+    ]));
+    $this->application->update([
+        'destination_id' => $destination->id,
+        'fqdn' => 'https://app.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+
+    expect($component->instance()->dnsRecordHints())->toBe([
+        [
+            'type' => 'A',
+            'name' => 'app.example.com',
+            'value' => '198.51.100.20',
+        ],
+        [
+            'type' => 'AAAA',
+            'name' => 'app.example.com',
+            'value' => '2001:db8::20',
+        ],
+    ]);
+});
+
 it('shows cloudflare domain connect only on cloud with a key', function () {
     config([
         'constants.coolify.self_hosted' => false,
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 4f825f8e24..c93a4f1e9d 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -280,6 +280,24 @@ it('lists dns entries for service hosts that still need dns', function () {
         ->not->toContain('web.example.com');
 });
 
+it('does not use instance network addresses for service dns entries on a remote server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $this->apiApp->update(['fqdn' => 'https://api.example.com']);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
+
+    expect($component->instance()->dnsRecordHints())->toBe([
+        [
+            'type' => 'A',
+            'name' => 'api.example.com',
+            'value' => '203.0.113.10',
+        ],
+    ]);
+});
+
 it('persists a service redirect when its dropdown changes', function () {
     $this->webApp->update(['fqdn' => 'https://web.example.com', 'redirect' => 'both']);
 

From 3c0e43f482317dd2d5b0db99fc272b563b8c9c9b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 21:15:06 +0200
Subject: [PATCH 26/48] feat(settings): configure CDN URL for stored images

Add a persisted instance setting for S3 image CDN URLs and use it when building image links. Cache profile avatars and project icons with immutable one-year headers.
---
 .env.development.example                      |  1 -
 .env.windows-docker-desktop.example           |  1 -
 .../Controllers/ProfileAvatarController.php   |  2 +-
 .../Controllers/ProjectIconController.php     |  5 +++-
 app/Livewire/Settings/Advanced.php            |  5 ++++
 app/Models/InstanceSettings.php               |  1 +
 bootstrap/helpers/shared.php                  |  2 +-
 config/constants.php                          |  1 -
 ...age_cdn_url_to_instance_settings_table.php | 28 +++++++++++++++++++
 .../livewire/settings/advanced.blade.php      |  6 ++--
 tests/Feature/ProfileAvatarTest.php           |  9 +++---
 tests/Feature/ProjectIconTest.php             |  9 +++---
 tests/Feature/SettingsAccessListboxTest.php   | 28 +++++++++++++++++++
 13 files changed, 82 insertions(+), 16 deletions(-)
 create mode 100644 database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php

diff --git a/.env.development.example b/.env.development.example
index 56c17128ce..380f10a446 100644
--- a/.env.development.example
+++ b/.env.development.example
@@ -53,4 +53,3 @@ DUSK_DRIVER_URL=http://selenium:4444
 BUNNY_API_KEY=
 # For asset uploads
 BUNNY_STORAGE_API_KEY=
-AVATAR_CDN_URL=
diff --git a/.env.windows-docker-desktop.example b/.env.windows-docker-desktop.example
index 626d76ff63..b067b4c5c0 100644
--- a/.env.windows-docker-desktop.example
+++ b/.env.windows-docker-desktop.example
@@ -11,4 +11,3 @@ REDIS_PASSWORD=coolify
 PUSHER_APP_ID=coolify
 PUSHER_APP_KEY=coolify
 PUSHER_APP_SECRET=coolify
-AVATAR_CDN_URL=
diff --git a/app/Http/Controllers/ProfileAvatarController.php b/app/Http/Controllers/ProfileAvatarController.php
index 2cf01400e8..f53cef7c51 100644
--- a/app/Http/Controllers/ProfileAvatarController.php
+++ b/app/Http/Controllers/ProfileAvatarController.php
@@ -14,7 +14,7 @@ class ProfileAvatarController extends Controller
 
         return response($contents, 200, [
             'Content-Type' => 'image/jpeg',
-            'Cache-Control' => 'private, max-age=300',
+            'Cache-Control' => 'private, max-age=31536000, immutable',
         ]);
     }
 }
diff --git a/app/Http/Controllers/ProjectIconController.php b/app/Http/Controllers/ProjectIconController.php
index fb7ebc8860..d99e9166d0 100644
--- a/app/Http/Controllers/ProjectIconController.php
+++ b/app/Http/Controllers/ProjectIconController.php
@@ -15,6 +15,9 @@ class ProjectIconController extends Controller
 
         abort_if($contents === null, 404);
 
-        return response($contents)->header('Content-Type', 'image/jpeg');
+        return response($contents, 200, [
+            'Content-Type' => 'image/jpeg',
+            'Cache-Control' => 'private, max-age=31536000, immutable',
+        ]);
     }
 }
diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php
index fd5ee616d9..45aff3f3c9 100644
--- a/app/Livewire/Settings/Advanced.php
+++ b/app/Livewire/Settings/Advanced.php
@@ -53,6 +53,8 @@ class Advanced extends Component
 
     public string $avatar_storage = 'local';
 
+    public ?string $image_cdn_url = null;
+
     public array $avatar_storage_options = [];
 
     public function rules()
@@ -71,6 +73,7 @@ class Advanced extends Component
             'webhook_allowed_internal_hosts' => 'nullable|string',
             'webhook_allow_localhost' => 'boolean',
             'domain_connect_private_key' => 'nullable|string',
+            'image_cdn_url' => 'nullable|url|max:255',
         ];
     }
 
@@ -97,6 +100,7 @@ class Advanced extends Component
         $this->avatar_storage = $this->settings->avatar_storage_type === 's3' && $this->settings->avatar_s3_storage_id
             ? 's3:'.$this->settings->avatar_s3_storage_id
             : 'local';
+        $this->image_cdn_url = $this->settings->image_cdn_url;
         $this->avatar_storage_options = [
             ['value' => 'local', 'label' => 'Local storage'],
             ...S3Storage::query()
@@ -210,6 +214,7 @@ class Advanced extends Component
             $this->settings->is_mcp_server_enabled = $this->is_mcp_server_enabled;
             $this->settings->webhook_allowed_internal_hosts = $webhookAllowedInternalHosts ?? $this->settings->webhook_allowed_internal_hosts ?? [];
             $this->settings->webhook_allow_localhost = $this->webhook_allow_localhost;
+            $this->settings->image_cdn_url = filled($this->image_cdn_url) ? rtrim($this->image_cdn_url, '/') : null;
             $this->saveAvatarStorageSetting();
             $this->settings->save();
             $this->dispatch('success', 'Settings updated!');
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index eb01fa7ada..26aceec354 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -56,6 +56,7 @@ class InstanceSettings extends Model
         'webhook_allow_localhost',
         'avatar_storage_type',
         'avatar_s3_storage_id',
+        'image_cdn_url',
         'is_dashboard_force_https_enabled',
     ];
 
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index f9bf44dffa..bc5af1e86e 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -860,7 +860,7 @@ function s3_image_url(?int $storageId, ?string $path, int $version): ?string
         return null;
     }
 
-    $baseUrl = config('constants.coolify.avatar_cdn_url') ?: $storage->awsUrl();
+    $baseUrl = instanceSettings()->image_cdn_url ?: $storage->awsUrl();
 
     return rtrim($baseUrl, '/').'/'.ltrim($path, '/').'?v='.$version;
 }
diff --git a/config/constants.php b/config/constants.php
index 22d5e10118..bdcd5d7c9d 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -14,7 +14,6 @@ return [
         'realtime_image' => env('REALTIME_IMAGE', env('REGISTRY_URL', 'docker.io').'/coollabsio/coolify-realtime'),
         'is_windows_docker_desktop' => env('IS_WINDOWS_DOCKER_DESKTOP', false),
         'cdn_url' => env('CDN_URL', 'https://cdn.coollabs.io'),
-        'avatar_cdn_url' => env('AVATAR_CDN_URL'),
         'versions_url' => env('VERSIONS_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/versions.json'),
         'upgrade_script_url' => env('UPGRADE_SCRIPT_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/upgrade.sh'),
         'releases_url' => env('RELEASES_URL', 'https://cdn.coollabs.io/coolify/releases.json'),
diff --git a/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php b/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php
new file mode 100644
index 0000000000..1c898dd5da
--- /dev/null
+++ b/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->string('image_cdn_url')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('image_cdn_url');
+        });
+    }
+};
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index 94927ba257..4c11cb41d4 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -9,7 +9,7 @@
                  listboxes (API, MCP, telemetry, …) update the snapshot on the server
                  immediately; without wire:target they briefly flash this bar. --}}
             <x-unsaved-bar action="submit"
-                targets="custom_dns_servers,allowed_ips,webhook_allowed_internal_hosts,webhook_allow_localhost,domain_connect_private_key" />
+                targets="custom_dns_servers,allowed_ips,webhook_allowed_internal_hosts,webhook_allow_localhost,domain_connect_private_key,image_cdn_url" />
 
             <x-application.settings-section id="access-section" title="Access">
                 <div class="grid gap-4 lg:grid-cols-2">
@@ -144,9 +144,11 @@
 
             <x-application.settings-section id="avatar-storage-section" title="Image storage"
                 helper="Choose where compressed profile pictures and project icons are stored. Use S3 for multi-instance or cloud deployments so every application replica can access the same files.">
-                <div class="max-w-md">
+                <div class="flex max-w-md flex-col gap-4">
                     <x-forms.listbox id="avatar_storage" label="Storage destination" onChange="instantSave"
                         :options="$avatar_storage_options" />
+                    <x-forms.input id="image_cdn_url" label="Image CDN URL"
+                        helper="Optional public CDN URL for profile pictures and project icons stored on S3. Leave empty to use the S3 endpoint." placeholder="https://images.example.com" />
                 </div>
                 @if (count($avatar_storage_options) === 1)
                     <x-callout type="info" title="No usable S3 storage configured" class="mt-4">
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index 68ced553d5..3512fccea3 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -72,11 +72,14 @@ it('serves the authenticated users profile picture', function () {
     $this->withoutMiddleware()->actingAs($user)
         ->get(route('profile.avatar'))
         ->assertSuccessful()
-        ->assertHeader('content-type', 'image/jpeg');
+        ->assertHeader('content-type', 'image/jpeg')
+        ->assertHeader('cache-control', 'immutable, max-age=31536000, private');
 });
 
 it('loads an S3 profile picture from the configured CDN', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    InstanceSettings::findOrFail(0)->update([
+        'image_cdn_url' => 'https://avatars.example.com/media',
+    ]);
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -98,7 +101,6 @@ it('loads an S3 profile picture from the configured CDN', function () {
 });
 
 it('loads an S3 profile picture directly from S3 when the CDN is not configured', function () {
-    config()->set('constants.coolify.avatar_cdn_url');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -120,7 +122,6 @@ it('loads an S3 profile picture directly from S3 when the CDN is not configured'
 });
 
 it('does not use an unrelated S3 storage URL for a profile picture', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
     $storage = S3Storage::query()->create([
         'team_id' => Team::factory()->create()->id,
         'name' => 'Unrelated storage',
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index fc03c9f30e..99a6c0ac5b 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -61,7 +61,8 @@ it('serves a project icon only to a member of its team', function () {
 
     $this->withoutMiddleware()->get(route('project.icon', ['project_uuid' => $this->project->uuid]))
         ->assertSuccessful()
-        ->assertHeader('content-type', 'image/jpeg');
+        ->assertHeader('content-type', 'image/jpeg')
+        ->assertHeader('cache-control', 'immutable, max-age=31536000, private');
 
     $otherUser = User::factory()->create();
     $otherTeam = Team::factory()->create();
@@ -104,7 +105,9 @@ it('exposes the icon URL on the projects index', function () {
 });
 
 it('loads an S3 project icon from the configured CDN', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    InstanceSettings::findOrFail(0)->update([
+        'image_cdn_url' => 'https://avatars.example.com/media',
+    ]);
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -127,7 +130,6 @@ it('loads an S3 project icon from the configured CDN', function () {
 });
 
 it('loads an S3 project icon directly from S3 when the CDN is not configured', function () {
-    config()->set('constants.coolify.avatar_cdn_url');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -149,7 +151,6 @@ it('loads an S3 project icon directly from S3 when the CDN is not configured', f
 });
 
 it('does not use an unusable S3 storage URL for a project icon', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
diff --git a/tests/Feature/SettingsAccessListboxTest.php b/tests/Feature/SettingsAccessListboxTest.php
index 4ec9dceb9e..c1508bf73b 100644
--- a/tests/Feature/SettingsAccessListboxTest.php
+++ b/tests/Feature/SettingsAccessListboxTest.php
@@ -29,6 +29,12 @@ test('settings advanced access section always uses listboxes', function () {
         ->not->toContain('Two-step confirmations enabled');
 });
 
+test('image storage fields use the standard settings field gap', function () {
+    $contents = file_get_contents(resource_path('views/livewire/settings/advanced.blade.php'));
+
+    expect($contents)->toContain('<div class="flex max-w-md flex-col gap-4">');
+});
+
 test('instance admin can toggle registration via listbox instantSave', function () {
     $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
     Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
@@ -82,6 +88,28 @@ test('instance admin can toggle two-step confirmation via listbox instantSave',
     expect((bool) $settings->fresh()->disable_two_step_confirmation)->toBeTrue();
 });
 
+test('instance admin can configure the image CDN URL at runtime', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
+    $settings = InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $user = User::factory()->create();
+    $rootTeam->members()->attach($user->id, ['role' => 'admin']);
+
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::test(Advanced::class)
+        ->assertSee('Image CDN URL')
+        ->set('image_cdn_url', 'https://images.example.com/media/')
+        ->call('submit')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($settings->fresh()->image_cdn_url)->toBe('https://images.example.com/media');
+});
+
 test('open API allowlist warning is hidden when API access is disabled', function () {
     $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
     Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);

From 27c7dc6a243d5362419e88e60e919829682054de Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Sat, 5 Sep 2026 12:29:14 +0200
Subject: [PATCH 27/48] chore(notifications): remove broken notification
 interface

---
 app/Notifications/Notification.php | 22 ----------------------
 1 file changed, 22 deletions(-)
 delete mode 100644 app/Notifications/Notification.php

diff --git a/app/Notifications/Notification.php b/app/Notifications/Notification.php
deleted file mode 100644
index d37716a8b4..0000000000
--- a/app/Notifications/Notification.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-
-namespace Illuminate\Notifications;
-
-use App\Notifications\Channels\SendsEmail;
-use App\Notifications\Dto\DiscordMessage;
-use App\Notifications\Dto\PushoverMessage;
-use App\Notifications\Dto\SlackMessage;
-use Illuminate\Notifications\Messages\MailMessage;
-
-interface Notification
-{
-    public function toMail(SendsEmail $notifiable): MailMessage;
-
-    public function toPushover(): PushoverMessage;
-
-    public function toDiscord(): DiscordMessage;
-
-    public function toSlack(): SlackMessage;
-
-    public function toTelegram();
-}

From 5303ff12460eac76a31045cdbce3e0cd3c8bdc2b Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Sat, 5 Sep 2026 12:32:25 +0200
Subject: [PATCH 28/48] fix(notifications): hetzner deletion failure channel
 name

---
 app/Notifications/Server/HetznerDeletionFailed.php   | 3 +--
 tests/Unit/HetznerDeletionFailedNotificationTest.php | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/app/Notifications/Server/HetznerDeletionFailed.php b/app/Notifications/Server/HetznerDeletionFailed.php
index bb452b054b..a109a4360d 100644
--- a/app/Notifications/Server/HetznerDeletionFailed.php
+++ b/app/Notifications/Server/HetznerDeletionFailed.php
@@ -17,8 +17,7 @@ class HetznerDeletionFailed extends CustomEmailNotification
 
     public function via(object $notifiable): array
     {
-
-        return $notifiable->getEnabledChannels('hetzner_deletion_failed');
+        return $notifiable->getEnabledChannels('hetzner_deletion_failure');
     }
 
     public function toMail(): MailMessage
diff --git a/tests/Unit/HetznerDeletionFailedNotificationTest.php b/tests/Unit/HetznerDeletionFailedNotificationTest.php
index 22d5e80db3..bcd3f294ee 100644
--- a/tests/Unit/HetznerDeletionFailedNotificationTest.php
+++ b/tests/Unit/HetznerDeletionFailedNotificationTest.php
@@ -19,7 +19,7 @@ it('can be instantiated with correct properties', function () {
         ->and($notification->errorMessage)->toBe('Hetzner API error: Server not found');
 });
 
-it('uses hetzner_deletion_failed event for channels', function () {
+it('uses the always-send hetzner_deletion_failure event for channels', function () {
     $notification = new HetznerDeletionFailed(
         hetznerServerId: 12345,
         teamId: 1,
@@ -28,7 +28,7 @@ it('uses hetzner_deletion_failed event for channels', function () {
 
     $mockNotifiable = Mockery::mock();
     $mockNotifiable->shouldReceive('getEnabledChannels')
-        ->with('hetzner_deletion_failed')
+        ->with('hetzner_deletion_failure')
         ->once()
         ->andReturn([]);
 

From 9f6ed823ce5d1639ccc7ea5b254c0f6a7a95b877 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Sat, 5 Sep 2026 12:33:06 +0200
Subject: [PATCH 29/48] fix(notifications): add toWebhook payload to Hetzner
 deletion failure notification

---
 app/Notifications/Server/HetznerDeletionFailed.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/app/Notifications/Server/HetznerDeletionFailed.php b/app/Notifications/Server/HetznerDeletionFailed.php
index a109a4360d..6c2712b68d 100644
--- a/app/Notifications/Server/HetznerDeletionFailed.php
+++ b/app/Notifications/Server/HetznerDeletionFailed.php
@@ -65,4 +65,16 @@ class HetznerDeletionFailed extends CustomEmailNotification
             color: SlackMessage::errorColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "[ACTION REQUIRED] Failed to delete Hetzner server #{$this->hetznerServerId} from Hetzner Cloud. The server has been removed from Coolify, but may still exist in your Hetzner Cloud account.",
+            'event' => 'hetzner_deletion_failed',
+            'hetzner_server_id' => $this->hetznerServerId,
+            'error' => $this->errorMessage,
+            'url' => base_url().'/servers',
+        ];
+    }
 }

From fb393da352afd6c0ca41a9e6795f955b37a1db06 Mon Sep 17 00:00:00 2001
From: Bo Sundgaard <46848138+bosund@users.noreply.github.com>
Date: Sat, 5 Sep 2026 13:00:04 +0200
Subject: [PATCH 30/48] fix(docker): raise nginx request header buffers above
 the 8k default (#11404)

Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
---
 docker/development/etc/nginx/conf.d/custom.conf | 6 ++++++
 docker/production/etc/nginx/conf.d/custom.conf  | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/docker/development/etc/nginx/conf.d/custom.conf b/docker/development/etc/nginx/conf.d/custom.conf
index f26dc30495..4672e3de55 100644
--- a/docker/development/etc/nginx/conf.d/custom.conf
+++ b/docker/development/etc/nginx/conf.d/custom.conf
@@ -2,3 +2,9 @@
 
 # Disable access logs
 access_log off;
+
+# Allow request headers up to 32k (nginx default is 8k). Large JWT cookies can push the
+# Cookie header past 8k, and nginx would then reject the request with a bare 400
+# before it reaches the application.
+client_header_buffer_size 8k;
+large_client_header_buffers 8 32k;
diff --git a/docker/production/etc/nginx/conf.d/custom.conf b/docker/production/etc/nginx/conf.d/custom.conf
index f26dc30495..4672e3de55 100644
--- a/docker/production/etc/nginx/conf.d/custom.conf
+++ b/docker/production/etc/nginx/conf.d/custom.conf
@@ -2,3 +2,9 @@
 
 # Disable access logs
 access_log off;
+
+# Allow request headers up to 32k (nginx default is 8k). Large JWT cookies can push the
+# Cookie header past 8k, and nginx would then reject the request with a bare 400
+# before it reaches the application.
+client_header_buffer_size 8k;
+large_client_header_buffers 8 32k;

From 94bf7910ad5c2bbb12fdebee42bdf7f90c3f9147 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9F=8F=94=EF=B8=8F=20Peak?=
 <122374094+peaklabs-dev@users.noreply.github.com>
Date: Sat, 5 Sep 2026 14:00:58 +0200
Subject: [PATCH 31/48] fix(service): persist service database public access
 (#11633)

---
 app/Livewire/Project/Service/Index.php | 36 +++++++++++++++++---------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index 7980e07056..3b8ca7af19 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -307,36 +307,48 @@ class Index extends Component
 
     public function instantSave()
     {
+        $this->authorize('update', $this->serviceDatabase);
         try {
-            $this->authorize('update', $this->serviceDatabase);
-            if ($this->isPublic && ! $this->publicPort) {
-                $this->dispatch('error', 'Public port is required.');
-                $this->isPublic = false;
-
-                return;
-            }
-            $this->syncDatabaseData(true);
-            if ($this->serviceDatabase->is_public) {
-                if (! str($this->serviceDatabase->status)->startsWith('running')) {
-                    $this->dispatch('error', 'Database must be started to be publicly accessible.');
+            if ($this->isPublic) {
+                if (! $this->publicPort) {
+                    $this->dispatch('error', 'Public port is required.');
                     $this->isPublic = false;
-                    $this->serviceDatabase->is_public = false;
 
                     return;
                 }
+                if (! str($this->serviceDatabase->status)->startsWith('running')) {
+                    $this->dispatch('error', 'Database must be started to be publicly accessible.');
+                    $this->isPublic = false;
+
+                    return;
+                }
+                $this->persistPublicAccess();
                 StartDatabaseProxy::run($this->serviceDatabase);
                 $this->db_url_public = $this->serviceDatabase->getServiceDatabaseUrl();
                 $this->dispatch('success', 'Database is now publicly accessible.');
             } else {
+                $this->persistPublicAccess();
                 StopDatabaseProxy::run($this->serviceDatabase);
                 $this->db_url_public = null;
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
         } catch (\Throwable $e) {
+            $this->isPublic = ! $this->isPublic;
+            $this->persistPublicAccess();
+
             return handleError($e, $this);
         }
     }
 
+    private function persistPublicAccess(): void
+    {
+        $this->serviceDatabase->update([
+            'is_public' => $this->isPublic,
+            'public_port' => $this->publicPort ?: null,
+            'public_port_timeout' => $this->publicPortTimeout ?: null,
+        ]);
+    }
+
     public function submitDatabase()
     {
         try {

From 16295e1ab33bc8f7012d1daa2b58416ca55e1ed9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Devrim=20Tun=C3=A7er?=
 <151394142+devrim-1283@users.noreply.github.com>
Date: Sat, 5 Sep 2026 15:10:21 +0300
Subject: [PATCH 32/48] fix(ui): keep modal content across re-renders (#11294)

---
 resources/views/components/modal-input.blade.php | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index 588032e039..144a1a9f9a 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -15,10 +15,6 @@
     'isLarge' => false,
 ])
 
-@php
-    $modalId = 'modal-' . uniqid();
-@endphp
-
 <div x-data="{ modalOpen: @if ($wireOpen) $wire.entangle(@js($wireOpen)) @else false @endif }"
     x-init="$watch('modalOpen', value => { if (!value) { $wire.dispatch('modalClosed') } })"
     :class="{ 'z-40': modalOpen }" @keydown.window.escape="modalOpen=false"
@@ -48,7 +44,7 @@
                 x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
                 class="absolute inset-0 w-full h-full bg-black/50 backdrop-blur-[2px]"></div>
             <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-2 sm:items-center sm:p-4">
-                <div id="{{ $modalId }}" x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
                     x-transition:enter="ease-out duration-100"
                     x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
                     x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"

From 208f7720bcc75fa6edca198e8875b9018a52cd59 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 5 Sep 2026 14:19:38 +0200
Subject: [PATCH 33/48] fix: avoid inherited compose ports and defer archive
 inspection

Prevent multi-service Compose domains from inheriting the application port, and defer PostgreSQL custom-format archive inspection to pg_restore.
---
 app/Livewire/Project/Application/Domains.php  |  7 ++
 .../Project/Application/PreviewDomains.php    |  7 ++
 app/Support/DatabaseBackupFileValidator.php   |  9 +--
 bootstrap/helpers/parsers.php                 |  6 +-
 bootstrap/helpers/shared.php                  |  8 ++-
 tests/Feature/ApplicationDomainsTest.php      | 65 +++++++++++++++++++
 ...licationParserDockerComposeDomainsTest.php | 34 ++++++++++
 .../DatabaseBackupUploadValidationTest.php    |  8 +--
 8 files changed, 130 insertions(+), 14 deletions(-)

diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 839c61e36a..62153d1757 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -569,6 +569,13 @@ class Domains extends Component
             ];
         }
 
+        if ($this->isCompose && $service !== null && count($this->composeServices) > 1) {
+            return [
+                'internal_port' => null,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index e6e9f5d60f..66eb2f5e01 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -537,6 +537,13 @@ class PreviewDomains extends Component
             ];
         }
 
+        if ($this->preview->application->build_pack === 'dockercompose' && $service !== null && count($this->composeServices()) > 1) {
+            return [
+                'internal_port' => null,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->preview->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
diff --git a/app/Support/DatabaseBackupFileValidator.php b/app/Support/DatabaseBackupFileValidator.php
index 84e629fe1a..2c1de948ba 100644
--- a/app/Support/DatabaseBackupFileValidator.php
+++ b/app/Support/DatabaseBackupFileValidator.php
@@ -90,11 +90,8 @@ class DatabaseBackupFileValidator
 
     public static function containsPostgresqlProgramExecution(string $sql): bool
     {
-        $requireStatementBoundary = true;
-
         if (str_starts_with($sql, 'PGDMP')) {
-            $sql = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]+/', "\n", $sql) ?? $sql;
-            $requireStatementBoundary = false;
+            return false;
         }
 
         $withoutComments = self::stripSqlComments($sql);
@@ -103,9 +100,7 @@ class DatabaseBackupFileValidator
             return true;
         }
 
-        $copyPrefix = $requireStatementBoundary ? '(?:^|;)\s*' : '\b';
-
-        return preg_match('/'.$copyPrefix.'copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
+        return preg_match('/(?:^|;)\s*copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
     }
 
     private static function extensionFor(string $name): ?string
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 03ebf5af7a..dd8ea29c88 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -390,6 +390,9 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
         return collect([]);
     }
     $services = data_get($yaml, 'services', collect([]));
+    $applicationServiceCount = collect($services)
+        ->reject(fn (mixed $service): bool => isDatabaseImage(data_get($service, 'image')))
+        ->count();
     $topLevel = collect([
         'volumes' => collect(data_get($yaml, 'volumes', [])),
         'networks' => collect(data_get($yaml, 'networks', [])),
@@ -1355,7 +1358,8 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                 ? ($previewForPorts?->domain_port_overrides ?? [])
                 : ($originalResource->domain_port_overrides ?? []);
             $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
-            $onlyPort = firstDockerComposeServicePort($service) ?? ($exposedPorts[0] ?? null);
+            $onlyPort = firstDockerComposeServicePort($service)
+                ?? ($applicationServiceCount === 1 ? ($exposedPorts[0] ?? null) : null);
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index bc5af1e86e..f5db32e886 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3318,7 +3318,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
         if ($pull_request_id !== 0) {
             $definedNetwork = collect(["{$resource->uuid}-$pull_request_id"]);
         }
-        $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $server, $pull_request_id, $preview_id) {
+        $usesSharedApplicationPort = collect($services)
+            ->reject(fn (mixed $service): bool => isDatabaseImage(data_get($service, 'image')))
+            ->count() === 1;
+        $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $server, $pull_request_id, $preview_id, $usesSharedApplicationPort) {
             $serviceVolumes = collect(data_get($service, 'volumes', []));
             $servicePorts = collect(data_get($service, 'ports', []));
             $serviceNetworks = collect(data_get($service, 'networks', []));
@@ -3916,7 +3919,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                             ? ($resource->domain_port_overrides ?? [])
                             : ($preview?->domain_port_overrides ?? []);
                         $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
-                        $onlyPort = firstDockerComposeServicePort($service) ?? ($exposedPorts[0] ?? null);
+                        $onlyPort = firstDockerComposeServicePort($service)
+                            ?? ($usesSharedApplicationPort ? ($exposedPorts[0] ?? null) : null);
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 396cccbfc9..1cc6d05e13 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -2436,6 +2436,25 @@ it('shows the detected compose service port as the inherited internal port', fun
         ->assertDontSee('Internal port 3000');
 });
 
+it('does not show an application port as the inherited port for a compose service without a declared port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  backend:\n    build: ./backend\n  frontend:\n    build: ./frontend\n",
+        'docker_compose_domains' => json_encode([
+            'backend' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertSet('domainRows.1.internal_port', null)
+        ->assertDontSee('Internal port 3000');
+});
+
 it('shows the detected compose service port for preview domains', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
@@ -2459,6 +2478,27 @@ it('shows the detected compose service port for preview domains', function () {
         ->assertDontSee('Internal port 3000');
 });
 
+it('does not show an application port for a preview compose service without a declared port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  backend:\n    build: ./backend\n  frontend:\n    build: ./frontend\n",
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 8070,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/8070',
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://preview.example.com'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertDontSee('Internal port 3000');
+});
+
 it('keeps a legacy port-bearing url port in the edit field as an internal port override', function () {
     $this->application->update([
         'ports_exposes' => '3000,8080',
@@ -2514,6 +2554,31 @@ it('stores compose domain port overrides without wiping other services', functio
         ->toHaveKey('https://api.example.com', 4000);
 });
 
+it('saves an unrecognized compose domain port after confirming the warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  frontend:\n    build: ./frontend\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '80')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://app.example.com' => 80]);
+});
+
 it('prunes a compose domain port override when that domain is removed', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 30305ef596..c207782022 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -631,3 +631,37 @@ YAML,
     'short port syntax' => "    ports:\n      - '18069:8069'",
     'long port syntax' => "    ports:\n      - target: 8069\n        published: 18069",
 ]);
+
+test('applicationParser does not apply an application port to compose services without a declared port', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  postgres:
+    image: postgres:16-alpine
+  backend:
+    build: ./backend
+  frontend:
+    build: ./frontend
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'backend' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+    ]));
+
+    $services = data_get(applicationParser($application->fresh()), 'services');
+    $backendLabels = collect(data_get($services, 'backend.labels'));
+    $frontendLabels = collect(data_get($services, 'frontend.labels'));
+
+    expect($backendLabels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($frontendLabels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse();
+});
diff --git a/tests/Feature/DatabaseBackupUploadValidationTest.php b/tests/Feature/DatabaseBackupUploadValidationTest.php
index 88978eeaba..f8416fe6c7 100644
--- a/tests/Feature/DatabaseBackupUploadValidationTest.php
+++ b/tests/Feature/DatabaseBackupUploadValidationTest.php
@@ -220,16 +220,16 @@ test('file scanner allows ordinary gzipped dumps', function () {
     expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($gzClean))->toBeFalse();
 });
 
-test('file scanner detects program execution payloads inside custom format archives', function () {
+test('file scanner defers custom format archives to pg_restore inspection', function () {
     $archive = writeScanPayload("PGDMP\0binary COPY records FROM PROGRAM payload");
 
-    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeTrue();
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeFalse();
 });
 
-test('file scanner detects program execution payloads inside gzipped custom format archives', function () {
+test('file scanner defers gzipped custom format archives to pg_restore inspection', function () {
     $archive = writeScanPayload("PGDMP\0binary COPY records FROM PROGRAM payload", gzip: true);
 
-    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeTrue();
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeFalse();
 });
 
 test('file scanner allows custom format archives without program execution', function () {

From 47c61feb8470e353f953baceca774735bae86b6d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 5 Sep 2026 14:24:24 +0200
Subject: [PATCH 34/48] fix(api): persist Docker Compose domain ports as
 overrides

Normalize Compose domains on create and update, retaining explicit ports in
`domain_port_overrides` while storing port-free domain values. Preserve empty
Compose FQDNs and cover both API flows with feature tests.
---
 .../Api/ApplicationsController.php            | 36 ++++++++++++
 app/Models/Application.php                    |  9 ++-
 .../Api/ApplicationSettingsApiTest.php        | 55 +++++++++++++++++++
 3 files changed, 97 insertions(+), 3 deletions(-)

diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 487d319e18..dbe0f86336 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -27,6 +27,7 @@ use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
@@ -1455,7 +1456,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $repository_url_parsed = Url::fromString($request->git_repository);
             $git_host = $repository_url_parsed->getHost();
@@ -1719,7 +1722,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $application->fqdn = $fqdn;
             $application->git_repository = str($gitRepository)->trim()->toString();
@@ -1950,7 +1955,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $application->fqdn = $fqdn;
             $application->private_key_id = $privateKey->id;
@@ -3369,7 +3376,12 @@ class ApplicationsController extends Controller
         }
 
         if ($dockerComposeDomainsJson->count() > 0) {
+            [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts(
+                $dockerComposeDomainsJson,
+                $application->domain_port_overrides,
+            );
             data_set($data, 'docker_compose_domains', json_encode($dockerComposeDomainsJson));
+            data_set($data, 'domain_port_overrides', $domainPortOverrides);
         }
         $requestHasNoindexDomains = $request->has('noindex_domains');
         data_forget($data, 'noindex_domains');
@@ -6116,4 +6128,28 @@ class ApplicationsController extends Controller
 
         return response()->json(['message' => 'Destination detached.']);
     }
+
+    /**
+     * @param  Collection<string, array{domain: ?string, redirect?: string}>  $domains
+     * @param  array<string, int|string>|null  $existingOverrides
+     * @return array{Collection<string, array{domain: ?string, redirect?: string}>, ?array<string, int>}
+     */
+    private function normalizeDockerComposeDomainPorts(Collection $domains, ?array $existingOverrides = null): array
+    {
+        $allDomains = $domains
+            ->pluck('domain')
+            ->filter()
+            ->implode(',');
+        $normalized = DomainPortOverrides::normalize($allDomains, $existingOverrides);
+
+        $domains = $domains->map(function (array $entry): array {
+            $entry['domain'] = collect(ValidationPatterns::applicationDomainList($entry['domain'] ?? null))
+                ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                ->implode(',');
+
+            return $entry;
+        });
+
+        return [$domains, $normalized['overrides']];
+    }
 }
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 7f7ce5ea1f..2ac352149f 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -3,6 +3,7 @@
 namespace App\Models;
 
 use App\Enums\ApplicationDeploymentStatus;
+use App\Enums\BuildPackTypes;
 use App\Services\ConfigurationGenerator;
 use App\Services\DeploymentConfiguration\ApplicationConfigurationSnapshot;
 use App\Services\DeploymentConfiguration\ConfigurationDiff;
@@ -291,9 +292,11 @@ class Application extends BaseModel
                 if ($application->fqdn === '') {
                     $application->fqdn = null;
                 }
-                $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
-                $application->fqdn = $normalized['fqdn'];
-                $application->domain_port_overrides = $normalized['overrides'];
+                if ($application->build_pack !== BuildPackTypes::DOCKERCOMPOSE->value || filled($application->fqdn)) {
+                    $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
+                    $application->fqdn = $normalized['fqdn'];
+                    $application->domain_port_overrides = $normalized['overrides'];
+                }
                 $payload['fqdn'] = $application->fqdn;
                 $application->syncNoindexDomains();
             }
diff --git a/tests/Feature/Api/ApplicationSettingsApiTest.php b/tests/Feature/Api/ApplicationSettingsApiTest.php
index 55d25927a3..a4c22a2b7c 100644
--- a/tests/Feature/Api/ApplicationSettingsApiTest.php
+++ b/tests/Feature/Api/ApplicationSettingsApiTest.php
@@ -165,6 +165,61 @@ test('changing a domain port regenerates managed labels with the requested port'
         ->and($labels)->not->toContain('loadbalancer.server.port=3000');
 });
 
+test('compose domain ports are stored as overrides when updating through the API', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  api:\n    image: nginx\n  frontend:\n    image: nginx\n",
+        'docker_compose_domains' => json_encode([
+            'api' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+    ]);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'docker_compose_domains' => [
+                ['name' => 'api', 'domain' => 'https://api.example.com'],
+                ['name' => 'frontend', 'domain' => 'https://app.example.com:80'],
+            ],
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+    $domains = json_decode($application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'frontend.domain'))->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 80,
+        ]);
+});
+
+test('compose domain ports are stored as overrides when creating through the API', function () {
+    Queue::fake();
+
+    $response = $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->postJson('/api/v1/applications/public', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'git_repository' => 'https://gitlab.com/coolify/compose-domain-port-test',
+            'git_branch' => 'main',
+            'build_pack' => 'dockercompose',
+            'autogenerate_domain' => false,
+            'docker_compose_domains' => [
+                ['name' => 'frontend', 'domain' => 'https://app.example.com:80'],
+            ],
+        ])
+        ->assertCreated();
+
+    $application = Application::where('uuid', $response->json('uuid'))->firstOrFail();
+    $domains = json_decode($application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'frontend.domain'))->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 80,
+        ]);
+});
+
 test('http basic auth updates regenerate managed labels', function () {
     $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
     $this->application->update([

From 2a25e0490e3672e25a6a6cbe166849debd80edef Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 5 Sep 2026 15:18:26 +0200
Subject: [PATCH 35/48] fix(storage): persist S3 settings for new volume
 backups (#11635)

---
 .../Project/Shared/Storages/VolumeBackups.php |  16 ++-
 tests/Feature/VolumeBackupTest.php            | 112 +++++++++++++++++-
 2 files changed, 119 insertions(+), 9 deletions(-)

diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index a10eb5ad03..a8e2d72df1 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -147,7 +147,11 @@ class VolumeBackups extends Component
         }
 
         $this->resetErrorBag('s3StorageId');
-        $this->backup?->update(['s3_storage_id' => $this->s3StorageId]);
+        if (! $this->validateSettings()) {
+            return;
+        }
+
+        $this->backup = $this->persistBackup($this->enabled);
         $this->dispatch('success', 'S3 storage updated.');
     }
 
@@ -163,11 +167,11 @@ class VolumeBackups extends Component
 
         $this->saveToS3 = ! $this->saveToS3;
         $this->disableLocalBackup = $this->saveToS3 && $this->disableLocalBackup;
-        $this->backup?->update([
-            'save_s3' => $this->saveToS3,
-            'disable_local_backup' => $this->disableLocalBackup,
-            's3_storage_id' => $this->s3StorageId,
-        ]);
+        if (! $this->validateSettings()) {
+            return;
+        }
+
+        $this->backup = $this->persistBackup($this->enabled);
         $this->dispatch('success', $this->saveToS3 ? 'S3 backups enabled.' : 'S3 backups disabled.');
     }
 
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index b24b45dcad..9c6897632a 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -960,6 +960,67 @@ it('enables and disables volume S3 backups from the S3 title action', function (
     expect($backup->refresh()->save_s3)->toBeFalse();
 });
 
+it('persists S3 settings the first time when a volume backup schedule does not exist yet', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Volume backups',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->assertSet('s3StorageId', $s3Storage->id)
+        ->call('toggleS3')
+        ->assertSet('saveToS3', true)
+        ->assertDispatched('success');
+
+    $backup = ScheduledVolumeBackup::query()->sole();
+
+    expect($backup->enabled)->toBeFalse()
+        ->and($backup->save_s3)->toBeTrue()
+        ->and($backup->s3_storage_id)->toBe($s3Storage->id);
+});
+
+it('persists the selected S3 storage when a volume backup schedule does not exist yet', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Volume backups',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->set('s3StorageId', $s3Storage->id)
+        ->assertDispatched('success');
+
+    $backup = ScheduledVolumeBackup::query()->sole();
+
+    expect($backup->enabled)->toBeFalse()
+        ->and($backup->s3_storage_id)->toBe($s3Storage->id);
+});
+
 it('shows and saves volume S3 retention while S3 backups are disabled', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);
@@ -1004,7 +1065,7 @@ it('allows team owners to edit volume backup retention settings', function () {
     ])->assertDontSee('You do not have permission to perform this action.');
 });
 
-it('only updates S3 fields when toggling volume S3 backups', function () {
+it('does not enable S3 backups when another volume backup setting is invalid', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);
     [$application, $volume] = createVolumeBackupApplication($team);
@@ -1031,9 +1092,54 @@ it('only updates S3 fields when toggling volume S3 backups', function () {
     ])
         ->set('frequency', 'not a valid schedule')
         ->call('toggleS3')
-        ->assertDispatched('success');
+        ->assertHasErrors('frequency')
+        ->assertNotDispatched('success');
 
-    expect($backup->refresh()->save_s3)->toBeTrue()
+    expect($backup->refresh()->save_s3)->toBeFalse()
+        ->and($backup->frequency)->toBe('daily');
+});
+
+it('does not change S3 storage when another volume backup setting is invalid', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $firstS3Storage = S3Storage::create([
+        'name' => 'First storage',
+        'region' => 'us-east-1',
+        'key' => 'first-key',
+        'secret' => 'secret',
+        'bucket' => 'first-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $secondS3Storage = S3Storage::create([
+        'name' => 'Second storage',
+        'region' => 'us-east-1',
+        'key' => 'second-key',
+        'secret' => 'secret',
+        'bucket' => 'second-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        's3_storage_id' => $firstS3Storage->id,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->set('frequency', 'not a valid schedule')
+        ->set('s3StorageId', $secondS3Storage->id)
+        ->assertHasErrors('frequency')
+        ->assertNotDispatched('success');
+
+    expect($backup->refresh()->s3_storage_id)->toBe($firstS3Storage->id)
         ->and($backup->frequency)->toBe('daily');
 });
 

From bf874029d81a6350ca828cd585a5af6ae161a0d2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 5 Sep 2026 15:18:37 +0200
Subject: [PATCH 36/48] fix(terminal): preserve PATH for SSH proxy commands
 (#11638)

---
 config/constants.php                          |  2 +-
 docker-compose.prod.yml                       |  2 +-
 docker-compose.windows.yml                    |  2 +-
 docker/coolify-realtime/terminal-server.js    |  3 ++-
 docker/coolify-realtime/terminal-utils.js     |  8 ++++++
 .../coolify-realtime/terminal-utils.test.js   | 27 +++++++++++++++++++
 6 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index bdcd5d7c9d..1e6d40b7b6 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -4,7 +4,7 @@ return [
     'coolify' => [
         'version' => env('COOLIFY_VERSION') ?: '4.3.18',
         'helper_version' => '1.0.16',
-        'realtime_version' => '1.0.18',
+        'realtime_version' => '1.0.19',
         'railpack_version' => '0.23.0',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index ebf12379d5..d611fc69f7 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.19'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index cc266e5562..6a52a0126a 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -97,7 +97,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.19'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/docker/coolify-realtime/terminal-server.js b/docker/coolify-realtime/terminal-server.js
index b72574c8d0..09f5bd5e12 100755
--- a/docker/coolify-realtime/terminal-server.js
+++ b/docker/coolify-realtime/terminal-server.js
@@ -8,6 +8,7 @@ import {
     extractSshArgs,
     extractTargetHost,
     extractTimeout,
+    getTerminalProcessEnv,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     sanitizeSshArgs,
@@ -401,7 +402,7 @@ async function handleCommand(ws, command, userId) {
         cols: 80,
         rows: 30,
         cwd: process.env.HOME,
-        env: {},
+        env: getTerminalProcessEnv(),
     };
 
     // NOTE: - Initiates a process within the Terminal container
diff --git a/docker/coolify-realtime/terminal-utils.js b/docker/coolify-realtime/terminal-utils.js
index 4e86dc1f73..0d13dc18f1 100644
--- a/docker/coolify-realtime/terminal-utils.js
+++ b/docker/coolify-realtime/terminal-utils.js
@@ -1,5 +1,13 @@
 export const MAX_TERMINAL_SESSION_TIMEOUT_SECONDS = 8 * 60 * 60;
 
+const DEFAULT_TERMINAL_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+
+export function getTerminalProcessEnv(environment = process.env) {
+    return {
+        PATH: environment.PATH || DEFAULT_TERMINAL_PATH,
+    };
+}
+
 export function getTerminalSessionTimeout() {
     return MAX_TERMINAL_SESSION_TIMEOUT_SECONDS;
 }
diff --git a/docker/coolify-realtime/terminal-utils.test.js b/docker/coolify-realtime/terminal-utils.test.js
index 5ca0be8304..21625eece4 100644
--- a/docker/coolify-realtime/terminal-utils.test.js
+++ b/docker/coolify-realtime/terminal-utils.test.js
@@ -4,6 +4,7 @@ import {
     MAX_TERMINAL_SESSION_TIMEOUT_SECONDS,
     extractSshArgs,
     extractTargetHost,
+    getTerminalProcessEnv,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     normalizeHostForAuthorization,
@@ -11,6 +12,32 @@ import {
     validateSshArgs,
 } from './terminal-utils.js';
 
+test('getTerminalProcessEnv preserves the PATH needed by SSH proxy commands', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        PATH: '/usr/local/bin:/usr/bin:/bin',
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/bin:/usr/bin:/bin',
+    });
+});
+
+test('getTerminalProcessEnv uses the default PATH when PATH is absent', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+    });
+});
+
+test('getTerminalProcessEnv uses the default PATH when PATH is empty', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        PATH: '',
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+    });
+});
+
 test('extractTargetHost normalizes quoted IPv4 hosts from generated ssh commands', () => {
     const sshArgs = extractSshArgs(
         "timeout 3600 ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ServerAliveInterval=20 -o ConnectTimeout=10 'root'@'10.0.0.5' 'bash -se' << \\\\$abc\necho hi\nabc"

From b351e94c98cf21c1cfba193c0cc457ac6665dcc5 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 5 Sep 2026 15:18:51 +0200
Subject: [PATCH 37/48] fix(api): return task execution duration as float
 (#11636)

---
 app/Models/ScheduledTaskExecution.php       | 2 +-
 tests/Feature/ModelFillableCreationTest.php | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/app/Models/ScheduledTaskExecution.php b/app/Models/ScheduledTaskExecution.php
index 1e26c7be3f..8f496fc1e6 100644
--- a/app/Models/ScheduledTaskExecution.php
+++ b/app/Models/ScheduledTaskExecution.php
@@ -39,7 +39,7 @@ class ScheduledTaskExecution extends BaseModel
             'started_at' => 'datetime',
             'finished_at' => 'datetime',
             'retry_count' => 'integer',
-            'duration' => 'decimal:2',
+            'duration' => 'float',
         ];
     }
 
diff --git a/tests/Feature/ModelFillableCreationTest.php b/tests/Feature/ModelFillableCreationTest.php
index 46d9c36daa..1e06ea22d3 100644
--- a/tests/Feature/ModelFillableCreationTest.php
+++ b/tests/Feature/ModelFillableCreationTest.php
@@ -1047,14 +1047,15 @@ it('creates ScheduledTaskExecution with all fillable attributes', function () {
         'finished_at' => now()->toISOString(),
         'started_at' => now()->subMinute()->toISOString(),
         'retry_count' => 0,
-        'duration' => 60,
+        'duration' => '60.25',
         'error_details' => null,
     ]);
 
     expect($execution->exists)->toBeTrue();
     expect($execution->scheduled_task_id)->toBe($task->id);
     expect($execution->status)->toBe('success');
-    expect((float) $execution->duration)->toBe(60.0);
+    expect($execution->duration)->toBe(60.25);
+    expect($execution->toArray()['duration'])->toBe(60.25);
     expect($execution->retry_count)->toBe(0);
 });
 

From 3764771293e4b747930acd34a8d3ddd9d1748e04 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 5 Sep 2026 15:18:59 +0200
Subject: [PATCH 38/48] fix(webhooks): handle closed PRs after base branch
 changes (#11634)

---
 app/Http/Controllers/Webhook/Github.php       |  10 +-
 .../GithubPullRequestWebhookRoutingTest.php   | 156 ++++++++++++++++++
 2 files changed, 164 insertions(+), 2 deletions(-)
 create mode 100644 tests/Feature/GithubPullRequestWebhookRoutingTest.php

diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index 28e92dcd49..c4fdc5fd5c 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -83,7 +83,10 @@ class Github extends Controller
                 }
             }
             if ($x_github_event === 'pull_request') {
-                $applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
+                if ($action !== 'closed') {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $this->manualWebhookApplications($applications, $full_name);
                 if ($applications->isEmpty()) {
                     return response("Nothing to do. No applications found for repo $full_name and branch '$base_branch'.");
                 }
@@ -334,7 +337,10 @@ class Github extends Controller
                 }
             }
             if ($x_github_event === 'pull_request') {
-                $applications = $applications->where('git_branch', $base_branch)->get();
+                if ($action !== 'closed') {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $applications->get();
                 if ($applications->isEmpty()) {
                     return response("Nothing to do. No applications found with branch '$base_branch'.");
                 }
diff --git a/tests/Feature/GithubPullRequestWebhookRoutingTest.php b/tests/Feature/GithubPullRequestWebhookRoutingTest.php
new file mode 100644
index 0000000000..7768dbd903
--- /dev/null
+++ b/tests/Feature/GithubPullRequestWebhookRoutingTest.php
@@ -0,0 +1,156 @@
+<?php
+
+use App\Jobs\ProcessGithubPullRequestWebhook;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+function createGithubPullRequestWebhookApplication(array $overrides = []): Application
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    return Application::create(array_merge([
+        'name' => 'github-pr-webhook-app',
+        'git_repository' => 'https://github.com/test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ], $overrides));
+}
+
+function githubPullRequestPayload(string $action, string $baseBranch): array
+{
+    return [
+        'action' => $action,
+        'number' => 42,
+        'repository' => [
+            'id' => 987654321,
+            'full_name' => 'test-org/test-repo',
+        ],
+        'pull_request' => [
+            'html_url' => 'https://github.com/test-org/test-repo/pull/42',
+            'title' => 'Stacked change',
+            'author_association' => 'OWNER',
+            'head' => [
+                'ref' => 'feature/child',
+                'sha' => 'head-sha',
+            ],
+            'base' => [
+                'ref' => $baseBranch,
+            ],
+        ],
+    ];
+}
+
+it('routes a closed GitHub App pull request to its application after the base branch changes', function () {
+    Queue::fake();
+
+    $team = Team::factory()->create();
+    $githubApp = GithubApp::create([
+        'name' => 'github-app-webhook-test',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 1234567890,
+        'webhook_secret' => 'test-secret',
+        'is_public' => false,
+        'team_id' => $team->id,
+    ]);
+    $application = createGithubPullRequestWebhookApplication([
+        'repository_project_id' => 987654321,
+        'source_id' => $githubApp->id,
+        'source_type' => GithubApp::class,
+    ]);
+
+    $body = json_encode(githubPullRequestPayload('closed', 'feature/parent'), JSON_THROW_ON_ERROR);
+    $response = $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'pull_request',
+        'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    $response->assertOk();
+    expect($response->getContent())->toContain('PR webhook received');
+    Queue::assertPushed(ProcessGithubPullRequestWebhook::class, fn (ProcessGithubPullRequestWebhook $job): bool => $job->applicationId === $application->id
+        && $job->action === 'closed'
+        && $job->pullRequestId === 42);
+});
+
+it('routes a closed manual pull request to its application after the base branch changes', function () {
+    Queue::fake();
+
+    $application = createGithubPullRequestWebhookApplication();
+    $payload = githubPullRequestPayload('closed', 'feature/parent');
+    $body = json_encode($payload, JSON_THROW_ON_ERROR);
+
+    $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'pull_request',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, $application->manual_webhook_secret_github),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    $response->assertOk();
+    Queue::assertPushed(ProcessGithubPullRequestWebhook::class, fn (ProcessGithubPullRequestWebhook $job): bool => $job->applicationId === $application->id
+        && $job->action === 'closed'
+        && $job->pullRequestId === 42);
+});
+
+it('continues to filter non-closed pull requests by base branch', function (string $endpoint) {
+    Queue::fake();
+
+    if ($endpoint === 'app') {
+        $team = Team::factory()->create();
+        $githubApp = GithubApp::create([
+            'name' => 'github-app-webhook-test',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'app_id' => 1234567890,
+            'webhook_secret' => 'test-secret',
+            'is_public' => false,
+            'team_id' => $team->id,
+        ]);
+        createGithubPullRequestWebhookApplication([
+            'repository_project_id' => 987654321,
+            'source_id' => $githubApp->id,
+            'source_type' => GithubApp::class,
+        ]);
+
+        $body = json_encode(githubPullRequestPayload('opened', 'feature/parent'), JSON_THROW_ON_ERROR);
+        $response = $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'pull_request',
+            'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+            'CONTENT_TYPE' => 'application/json',
+        ], $body);
+    } else {
+        $application = createGithubPullRequestWebhookApplication();
+        $body = json_encode(githubPullRequestPayload('opened', 'feature/parent'), JSON_THROW_ON_ERROR);
+        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'pull_request',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, $application->manual_webhook_secret_github),
+            'CONTENT_TYPE' => 'application/json',
+        ], $body);
+    }
+
+    $response->assertOk();
+    Queue::assertNotPushed(ProcessGithubPullRequestWebhook::class);
+})->with(['app', 'manual']);

From 08f68016dd342fe944564f79969f4ceceddc88d6 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 5 Sep 2026 15:58:12 +0200
Subject: [PATCH 39/48] fix(storage): prevent PR suffix dropdown clipping
 (#11637)

---
 resources/css/app.css                         |  5 +-
 .../views/components/forms/listbox.blade.php  | 57 ++++++-----
 .../project/shared/storages/all.blade.php     | 98 +++++++++++--------
 .../Feature/ListboxTriggerTruncationTest.php  |  7 ++
 .../PersistentStorageVolumesLayoutTest.php    | 68 +++++++++++++
 .../Browser/ApplicationConfigurationTest.php  | 56 +++++++++++
 6 files changed, 223 insertions(+), 68 deletions(-)

diff --git a/resources/css/app.css b/resources/css/app.css
index 40af521c69..06f0b251af 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -2673,7 +2673,10 @@ input[type="search"]::-webkit-search-results-decoration {
     }
 
     .volumes-col-backup {
-        align-items: flex-start;
+        flex-direction: row;
+        align-items: center;
+        justify-content: flex-start;
+        gap: 0.5rem;
     }
 
     .volumes-cell-actions {
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index d04a5f57e5..4c572596d6 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -123,7 +123,8 @@
         {{ $attributes->whereStartsWith('x-model') }}
         {{ $attributes->whereStartsWith('x-effect') }}
         @if ($preserveValue) wire:ignore @endif
-        @click.outside="open = false" @keydown.escape="open = false" @resize.window="open && positionPanel()">
+        @click.outside="open = false" @keydown.escape="open = false" @resize.window="open && positionPanel()"
+        @scroll.window.capture="open && positionPanel()">
         <button x-ref="trigger" id="{{ $triggerId }}" type="button" class="listbox-trigger" @click="toggle()"
             @disabled($disabled) {{ $attributes->whereStartsWith('x-bind:disabled') }} aria-haspopup="listbox"
             :aria-expanded="open" @if ($tooltip) :title="current" @endif>
@@ -134,33 +135,35 @@
             </svg>
         </button>
         @if ($portal)
-            <div id="{{ $panelId }}" class="listbox-panel"
-                style="position: fixed; z-index: 9999; visibility: hidden" x-show="open"
-                x-cloak :style="{ visibility: positioned ? 'visible' : 'hidden' }"
-                x-transition:enter="transition ease-out duration-100"
-                x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
-                x-transition:enter-end="opacity-100 translate-y-0 scale-100"
-                x-transition:leave="transition ease-in duration-75"
-                x-transition:leave-start="opacity-100 translate-y-0 scale-100"
-                x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
-                x-effect="if (open) requestAnimationFrame(() => positionPanel($el))" role="listbox">
-                <div x-show="options.length === 0"
-                    class="px-3 py-2 text-[13px] text-neutral-500 dark:text-fg-dim">
-                    {{ $emptyText }}
+            <template x-teleport="body">
+                <div id="{{ $panelId }}" class="listbox-panel"
+                    style="position: fixed; z-index: 9999; visibility: hidden" x-show="open"
+                    x-cloak :style="{ visibility: positioned ? 'visible' : 'hidden' }"
+                    x-transition:enter="transition ease-out duration-100"
+                    x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
+                    x-transition:enter-end="opacity-100 translate-y-0 scale-100"
+                    x-transition:leave="transition ease-in duration-75"
+                    x-transition:leave-start="opacity-100 translate-y-0 scale-100"
+                    x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
+                    x-effect="if (open) requestAnimationFrame(() => positionPanel($el))" role="listbox">
+                    <div x-show="options.length === 0"
+                        class="px-3 py-2 text-[13px] text-neutral-500 dark:text-fg-dim">
+                        {{ $emptyText }}
+                    </div>
+                    <template x-for="option in options" :key="String(option.value)">
+                        <button type="button" class="listbox-option" role="option"
+                            :class="{ 'listbox-option-disabled': option.disabled }"
+                            :aria-selected="String(option.value) === String(value)" @click="choose(option)">
+                            <span class="truncate" x-text="option.label"></span>
+                            <svg x-show="String(option.value) === String(value)" xmlns="http://www.w3.org/2000/svg"
+                                fill="none" viewBox="0 0 24 24" stroke-width="2.5" stroke="currentColor"
+                                class="size-3.5 shrink-0">
+                                <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
+                            </svg>
+                        </button>
+                    </template>
                 </div>
-                <template x-for="option in options" :key="String(option.value)">
-                    <button type="button" class="listbox-option" role="option"
-                        :class="{ 'listbox-option-disabled': option.disabled }"
-                        :aria-selected="String(option.value) === String(value)" @click="choose(option)">
-                        <span class="truncate" x-text="option.label"></span>
-                        <svg x-show="String(option.value) === String(value)" xmlns="http://www.w3.org/2000/svg"
-                            fill="none" viewBox="0 0 24 24" stroke-width="2.5" stroke="currentColor"
-                            class="size-3.5 shrink-0">
-                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                        </svg>
-                    </button>
-                </template>
-            </div>
+            </template>
         @else
             <div x-ref="panel" class="listbox-panel" x-show="open" x-cloak
                 x-transition:enter="transition ease-out duration-100"
diff --git a/resources/views/livewire/project/shared/storages/all.blade.php b/resources/views/livewire/project/shared/storages/all.blade.php
index 25a4fd7492..98521c8204 100644
--- a/resources/views/livewire/project/shared/storages/all.blade.php
+++ b/resources/views/livewire/project/shared/storages/all.blade.php
@@ -21,10 +21,10 @@
                 <span class="volumes-col-source">Source Path</span>
                 <span>Destination Path</span>
                 @if ($supportsPreviewSuffix)
-                    <span class="volumes-col-pr"
-                        title="Whether preview deployments receive an isolated -pr-N volume suffix.">
-                        PR suffix
-                    </span>
+                    <div class="volumes-col-pr flex items-center gap-1.5">
+                        <span>PR suffix</span>
+                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                    </div>
                 @endif
                 <span class="volumes-col-backup text-center">Backup</span>
                 @if ($showActionsColumn)
@@ -74,7 +74,10 @@
 
                             @if ($supportsPreviewSuffix)
                                 <div class="volumes-col-pr min-w-0">
-                                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
+                                    <div class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">
+                                        <span>PR suffix</span>
+                                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                                    </div>
                                     <span>{{ $form['isPreviewSuffixEnabled'] ? 'Add suffix' : 'Share volume' }}</span>
                                 </div>
                             @endif
@@ -82,16 +85,22 @@
                             <div class="volumes-col-backup flex items-center justify-center gap-1.5">
                                 <span class="volumes-mobile-label volumes-field-label">Backup</span>
                                 @if ($hasEnabledBackup)
-                                    <a @if ($backupUrl) href="{{ $backupUrl }}" @endif title="Volume backup is enabled">
-                                        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                            stroke-width="2" stroke="currentColor" class="size-4">
-                                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                                        </svg>
-                                    </a>
-                                    <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
-                                        title="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
-                                        {{ $hasS3Backup ? 'S3' : 'Local' }}
-                                    </span>
+                                    @if ($backupUrl)
+                                        <a href="{{ $backupUrl }}" @class([
+                                            'table-badge underline-offset-2 hover:underline',
+                                            'table-badge-success' => $hasS3Backup,
+                                        ])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </a>
+                                    @else
+                                        <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </span>
+                                    @endif
                                 @else
                                     <span class="data-table-cell-dash">-</span>
                                 @endif
@@ -103,10 +112,10 @@
                                     @if ($canUpdate)
                                         <x-modal-input title="Configure Volume Backup" :wireIgnore="false">
                                             <x-slot:content>
-                                                <button type="button" class="icon-button" title="Configure backup"
-                                                    aria-label="Configure backup">
-                                                    <x-reicon name="database" class="size-4" />
-                                                </button>
+                                                <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                    :canResource="$resource">
+                                                    Backup
+                                                </x-forms.button>
                                             </x-slot:content>
                                             @if ($resource instanceof \App\Models\Application)
                                                 <livewire:project.application.backup.create :application="$resource"
@@ -165,27 +174,36 @@
 
                             @if ($supportsPreviewSuffix)
                                 <div class="volumes-col-pr min-w-0">
-                                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                                    <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" :options="[
+                                    <div class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">
+                                        <span>PR suffix</span>
+                                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                                    </div>
+                                    <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" portal :options="[
                                         ['value' => true, 'label' => 'Add suffix'],
                                         ['value' => false, 'label' => 'Share volume'],
-                                    ]" />
+                                    ]" canGate="update" :canResource="$resource" />
                                 </div>
                             @endif
 
                             <div class="volumes-col-backup flex items-center justify-center gap-1.5">
                                 <span class="volumes-mobile-label volumes-field-label">Backup</span>
                                 @if ($hasEnabledBackup)
-                                    <a @if ($backupUrl) href="{{ $backupUrl }}" @endif title="Volume backup is enabled">
-                                        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                            stroke-width="2" stroke="currentColor" class="size-4">
-                                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                                        </svg>
-                                    </a>
-                                    <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
-                                        title="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
-                                        {{ $hasS3Backup ? 'S3' : 'Local' }}
-                                    </span>
+                                    @if ($backupUrl)
+                                        <a href="{{ $backupUrl }}" @class([
+                                            'table-badge underline-offset-2 hover:underline',
+                                            'table-badge-success' => $hasS3Backup,
+                                        ])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </a>
+                                    @else
+                                        <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </span>
+                                    @endif
                                 @else
                                     <span class="data-table-cell-dash">-</span>
                                 @endif
@@ -200,10 +218,10 @@
                                 @if ($showBackupAction)
                                     <x-modal-input title="Configure Volume Backup" :wireIgnore="false">
                                         <x-slot:content>
-                                            <button type="button" class="icon-button" title="Configure backup"
-                                                aria-label="Configure backup">
-                                                <x-reicon name="database" class="size-4" />
-                                            </button>
+                                            <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                :canResource="$resource">
+                                                Backup
+                                            </x-forms.button>
                                         </x-slot:content>
                                         @if ($resource instanceof \App\Models\Application)
                                             <livewire:project.application.backup.create :application="$resource"
@@ -218,10 +236,10 @@
                                 @elseif (method_exists($resource, 'isBackupSolutionAvailable') && $resource->isBackupSolutionAvailable())
                                     <x-modal-input title="New Scheduled Backup" :wireIgnore="false">
                                         <x-slot:content>
-                                            <button type="button" class="icon-button" title="Configure backup"
-                                                aria-label="Configure backup">
-                                                <x-reicon name="database" class="size-4" />
-                                            </button>
+                                            <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                :canResource="$resource">
+                                                Backup
+                                            </x-forms.button>
                                         </x-slot:content>
                                         <livewire:project.database.create-scheduled-backup :database="$resource"
                                             wire:key="configure-database-backup-{{ $id }}" />
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index 82e526bb3b..a7cd462954 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -78,6 +78,13 @@ test('portaled listboxes measure content without inheriting the viewport width',
         ->toContain('Math.max(triggerRect.width, panel.offsetWidth)');
 });
 
+test('portaled listboxes stay anchored when a scroll container moves', function () {
+    $listbox = file_get_contents(resource_path('views/components/forms/listbox.blade.php'));
+
+    expect($listbox)
+        ->toContain('@scroll.window.capture="open && positionPanel()"');
+});
+
 test('searchable listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.searchable-listbox id="tz" label="Timezone"
diff --git a/tests/Feature/PersistentStorageVolumesLayoutTest.php b/tests/Feature/PersistentStorageVolumesLayoutTest.php
index f3938b87ff..91dcab3d26 100644
--- a/tests/Feature/PersistentStorageVolumesLayoutTest.php
+++ b/tests/Feature/PersistentStorageVolumesLayoutTest.php
@@ -211,11 +211,79 @@ it('renders volumes as a data table with shared column headers', function () {
         ->toContain('12rem')
         ->not->toContain('17.5rem');
 
+    expect($allView)
+        ->toContain("'table-badge', 'table-badge-success' => \$hasS3Backup")
+        ->not->toContain('<path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />');
+
+    expect($css)->toMatch('/@media \(max-width: 768px\)[\s\S]*?\.volumes-col-backup\s*\{[^}]*flex-direction:\s*row;[^}]*align-items:\s*center;/');
+
     // Settings form labels are 13px (not Tailwind text-sm 14px).
     expect($css)
         ->toMatch('/\.application-settings-form label\s*\{[^}]*font-size:\s*13px/s');
 });
 
+it('renders volume actions and PR suffix controls as valid markup', function () {
+    [$application] = createApplicationWithVolume();
+    LocalPersistentVolume::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => $application->uuid.'-cache',
+        'mount_path' => '/cache',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+        'is_preview_suffix_enabled' => true,
+    ]);
+
+    $html = Livewire::test(All::class, ['resource' => $application])->html();
+    $document = new DOMDocument;
+    $previousState = libxml_use_internal_errors(true);
+    $loaded = $document->loadHTML($html);
+    libxml_clear_errors();
+    libxml_use_internal_errors($previousState);
+    $xpath = new DOMXPath($document);
+    $helperText = 'Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews.';
+
+    expect($loaded)->toBeTrue()
+        ->and($xpath->query("//*[contains(concat(' ', normalize-space(@class), ' '), ' volumes-col-actions ')]//button[normalize-space(.)='Backup']"))->toHaveCount(2)
+        ->and($xpath->query("//*[contains(concat(' ', normalize-space(@class), ' '), ' volumes-col-actions ')]//button[normalize-space(.)='Backup']//svg"))->toHaveCount(0)
+        ->and($xpath->query("//button[@aria-label='More information']/following-sibling::*[@role='tooltip'][contains(normalize-space(.), '{$helperText}')]"))->toHaveCount(3)
+        ->and($xpath->query("//template[@x-teleport='body']/*[@role='listbox']"))->toHaveCount(2);
+});
+
+it('declares explicit authorization on the changed storage controls', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
+
+    preg_match(
+        '/<x-forms\.listbox\s+id="forms\.\{\{ \$id \}\}\.isPreviewSuffixEnabled"[\s\S]*?\/>/',
+        $view,
+        $previewSuffixListbox
+    );
+
+    expect($previewSuffixListbox[0] ?? '')
+        ->toContain('canGate="update"')
+        ->toContain(':canResource="$resource"');
+
+    preg_match_all('/<x-forms\.button\b[^>]*>\s*Backup\s*<\/x-forms\.button>/s', $view, $backupButtons);
+
+    expect($backupButtons[0])->toHaveCount(3);
+
+    foreach ($backupButtons[0] as $backupButton) {
+        expect($backupButton)
+            ->toContain('canGate="update"')
+            ->toContain(':canResource="$resource"');
+    }
+});
+
+it('uses valid block wrappers around PR suffix helpers', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
+
+    expect($view)
+        ->not->toContain('<span class="volumes-col-pr flex items-center gap-1.5">')
+        ->not->toContain('<span class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">');
+
+    expect(substr_count($view, '<x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />'))
+        ->toBe(3);
+});
+
 it('creates and exposes volume backups for service storage', function () {
     $service = Service::factory()->create([
         'environment_id' => $this->environment->id,
diff --git a/tests/v4/Browser/ApplicationConfigurationTest.php b/tests/v4/Browser/ApplicationConfigurationTest.php
index fa7fb4ffa3..161f96f661 100644
--- a/tests/v4/Browser/ApplicationConfigurationTest.php
+++ b/tests/v4/Browser/ApplicationConfigurationTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\LocalPersistentVolume;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Visus\Cuid2\Cuid2;
 
@@ -37,6 +38,61 @@ it('shows application configuration sections and navigation', function () {
         ->screenshot(filename: 'application-configuration-overview');
 });
 
+it('keeps the PR suffix listbox visible outside the volumes table while scrolling', function () {
+    foreach (range(1, 8) as $index) {
+        LocalPersistentVolume::create([
+            'uuid' => (string) new Cuid2,
+            'name' => $this->application->uuid.'-data-'.$index,
+            'mount_path' => '/data/'.$index,
+            'resource_id' => $this->application->id,
+            'resource_type' => $this->application->getMorphClass(),
+            'is_preview_suffix_enabled' => true,
+        ]);
+    }
+
+    loginAndSkipBoarding();
+
+    $url = applicationConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->application
+    ).'/persistent-storage';
+
+    $page = visit($url);
+    $page->assertSee('PR suffix')
+        ->assertSee('Add suffix')
+        ->assertScript(<<<'JS'
+            () => {
+                const table = document.querySelector('.data-table');
+                const trigger = document.querySelector('[id$="isPreviewSuffixEnabled-trigger"]');
+                window.__volumeTableScrollHeight = table.scrollHeight;
+                trigger.click();
+
+                return true;
+            }
+            JS)
+        ->wait(0.2)
+        ->assertScript(<<<'JS'
+            () => {
+                const table = document.querySelector('.data-table');
+                const panel = document.querySelector('[id$="isPreviewSuffixEnabled-panel"]');
+                const beforeScroll = panel.getBoundingClientRect();
+                window.scrollBy(0, 100);
+                const afterScroll = panel.getBoundingClientRect();
+
+                return panel.parentElement === document.body
+                    && table.scrollHeight === window.__volumeTableScrollHeight
+                    && window.scrollY > 0
+                    && beforeScroll.top >= 0
+                    && beforeScroll.bottom <= window.innerHeight
+                    && afterScroll.top >= 0
+                    && afterScroll.bottom <= window.innerHeight;
+            }
+            JS)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-persistent-storage-pr-suffix-listbox');
+});
+
 it('saves application name description and ports from the general form', function () {
     loginAndSkipBoarding();
 

From 6293cd418c483e389e22b43d824740f3607c9f66 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 5 Sep 2026 21:10:10 +0200
Subject: [PATCH 40/48] feat(backups): stream S3-only volume archives directly
 (#11642)

---
 app/Jobs/VolumeBackupJob.php       |  96 ++++++++++++++-----
 tests/Feature/VolumeBackupTest.php | 147 +++++++++++++++++++++++++++++
 2 files changed, 221 insertions(+), 22 deletions(-)

diff --git a/app/Jobs/VolumeBackupJob.php b/app/Jobs/VolumeBackupJob.php
index b567a71b7f..0b13c66609 100644
--- a/app/Jobs/VolumeBackupJob.php
+++ b/app/Jobs/VolumeBackupJob.php
@@ -73,6 +73,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         $filename = str($this->backup->targetType())->lower().'-'.str($this->backup->targetName())->slug().'-'.Carbon::now()->timestamp.'.tar.gz';
         $backupLocation = $backupDirectory.'/'.$filename;
         $this->execution->update(['filename' => $backupLocation]);
+        $streamToS3 = $this->backup->save_s3 && $this->backup->disable_local_backup;
 
         try {
             $source = $this->backup->sourcePath();
@@ -86,11 +87,17 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
 
             $compressorCommand = BackupCompression::compressorCommand($compressionCpuPercentage);
             $archiveScript = "compressor=\$({$compressorCommand}); tar -I \"\$compressor\" -cf - -C /volume .";
-            $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
-                .' -v '.escapeshellarg($source.':/volume:ro')
-                .' '.escapeshellarg($image)
-                .' sh -c '.escapeshellarg($archiveScript)
-                .' > '.escapeshellarg($backupLocation);
+            if ($streamToS3) {
+                $this->execution->update(['local_storage_deleted' => true]);
+                $archiveCommand = $this->streamToS3Command($archiveScript, $backupLocation, $source, $containerName, $image);
+                $this->execution->update(['s3_cleanup_pending' => true]);
+            } else {
+                $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
+                    .' -v '.escapeshellarg($source.':/volume:ro')
+                    .' '.escapeshellarg($image)
+                    .' sh -c '.escapeshellarg($archiveScript)
+                    .' > '.escapeshellarg($backupLocation);
+            }
 
             if ($this->backup->stop_during_backup) {
                 $containers = $this->containersUsingVolume($source, $server);
@@ -104,21 +111,23 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
                 }
             }
 
-            instant_remote_process([
+            $archiveOutput = instant_remote_process(array_filter([
                 $verifySourceCommand,
-                'mkdir -p '.escapeshellarg($backupDirectory),
+                $streamToS3 ? null : 'mkdir -p '.escapeshellarg($backupDirectory),
                 $archiveCommand,
-            ], $server, timeout: $this->timeout, disableMultiplexing: true);
+            ]), $server, timeout: $this->timeout, disableMultiplexing: true);
             $this->execution->update([
                 'stop_container_ids' => null,
                 'stop_recovery_pending' => false,
             ]);
 
-            $size = (int) instant_remote_process(
-                ['du -b '.escapeshellarg($backupLocation).' | cut -f1'],
-                $server,
-                disableMultiplexing: true,
-            );
+            $size = $streamToS3
+                ? (int) str($archiveOutput)->trim()->afterLast("\n")->toString()
+                : (int) instant_remote_process(
+                    ['du -b '.escapeshellarg($backupLocation).' | cut -f1'],
+                    $server,
+                    disableMultiplexing: true,
+                );
 
             if ($size <= 0) {
                 throw new \RuntimeException('The storage backup archive is empty or was not created.');
@@ -127,9 +136,12 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $warning = null;
             $s3Uploaded = null;
             $s3CleanupPending = false;
-            $localStorageDeleted = false;
+            $localStorageDeleted = $streamToS3;
 
-            if ($this->backup->save_s3) {
+            if ($streamToS3) {
+                $s3Uploaded = true;
+                $this->execution->update(['s3_cleanup_pending' => false]);
+            } elseif ($this->backup->save_s3) {
                 $s3CleanupPending = true;
                 $this->execution->update(['s3_cleanup_pending' => true]);
 
@@ -181,13 +193,23 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             }
         } catch (Throwable $exception) {
             $recoveryError = $this->recoverIncompleteBackup($this->execution);
-            $archiveDeleted = false;
+            $archiveDeleted = $streamToS3;
 
-            try {
-                deleteBackupsLocally($backupLocation, $server, throwError: true);
-                $archiveDeleted = true;
-            } catch (Throwable $cleanupException) {
-                $recoveryError .= ' Archive cleanup failed: '.$cleanupException->getMessage();
+            if ($streamToS3) {
+                $exception = new \RuntimeException(
+                    'S3-only streaming backup failed: '.$exception->getMessage()
+                    .'. The S3 destination may not support streaming uploads. Enable local backups to use the local archive upload method.',
+                    previous: $exception,
+                );
+            }
+
+            if (! $streamToS3) {
+                try {
+                    deleteBackupsLocally($backupLocation, $server, throwError: true);
+                    $archiveDeleted = true;
+                } catch (Throwable $cleanupException) {
+                    $recoveryError .= ' Archive cleanup failed: '.$cleanupException->getMessage();
+                }
             }
 
             $s3CleanupPending = $this->execution->fresh()->s3_cleanup_pending;
@@ -195,7 +217,9 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $this->execution->update([
                 'status' => 'failed',
                 'message' => $exception->getMessage().$recoveryError,
-                'filename' => $archiveDeleted && ! $s3CleanupPending ? null : $backupLocation,
+                'filename' => $streamToS3
+                    ? ($s3CleanupPending ? $backupLocation : null)
+                    : ($archiveDeleted && ! $s3CleanupPending ? null : $backupLocation),
                 'local_storage_deleted' => $archiveDeleted,
             ]);
 
@@ -338,6 +362,34 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function streamToS3Command(string $archiveScript, string $backupLocation, string $source, string $containerName, string $image): string
+    {
+        $s3 = $this->backup->s3;
+
+        if (! $s3) {
+            $this->backup->update(['save_s3' => false, 's3_storage_id' => null]);
+
+            throw new \RuntimeException('The selected S3 storage no longer exists. S3 backup has been disabled.');
+        }
+
+        $s3->testConnection(shouldSave: true);
+        $resolveOptions = collect(SafeWebhookUrl::minioClientResolveOptions($s3->endpoint, $s3->trustedInternalHosts()))
+            ->map(fn (string $option): string => '--resolve '.escapeshellarg($option))
+            ->implode(' ');
+        $resolveOptions = $resolveOptions === '' ? '' : ' '.$resolveOptions;
+        $destination = 'temporary/'.$s3->bucket.$backupLocation;
+        $streamScript = 'set -o pipefail; mc alias set'.$resolveOptions.' temporary '
+            .escapeshellarg($s3->endpoint).' '.escapeshellarg($s3->key).' '.escapeshellarg($s3->secret)
+            .' >/dev/null && ('.$archiveScript.' | mc pipe --quiet'.$resolveOptions.' '.escapeshellarg($destination).' >/dev/null)'
+            .' && mc stat --json'.$resolveOptions.' '.escapeshellarg($destination)
+            .' | sed -n '.escapeshellarg('s/.*"size":\([0-9][0-9]*\).*/\1/p');
+
+        return 'docker run --rm --name '.escapeshellarg($containerName)
+            .' -v '.escapeshellarg($source.':/volume:ro')
+            .' '.escapeshellarg($image)
+            .' sh -c '.escapeshellarg($streamScript);
+    }
+
     private function logCompressorInDevelopment(string $image, Server $server, int $compressionCpuPercentage): void
     {
         if (! isDev()) {
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index 9c6897632a..36a04cecaa 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -28,6 +28,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Filesystem\FilesystemAdapter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Queue\Middleware\WithoutOverlapping;
@@ -1902,6 +1903,152 @@ it('keeps the upload destination on the volume backup execution', function () {
         ->and($execution->s3->is($s3Storage))->toBeTrue();
 });
 
+it('streams S3-only volume backups without creating or copying a local archive', function () {
+    config(['broadcasting.default' => 'null']);
+    defined('CURLOPT_RESOLVE') || define('CURLOPT_RESOLVE', 10203);
+    Carbon::setTestNow('2026-08-15 12:00:00');
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Streaming destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->once()->andReturn([]);
+    $disk->shouldReceive('delete')->zeroOrMoreTimes()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->once()->andReturn($disk);
+    Process::fake([
+        '*mc pipe*' => "Added `temporary` successfully.\n128 bytes -> `temporary/bucket/archive.tar.gz`\n128",
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup))->handle();
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    $expectedFilename = 'volume-app-data-1786795200.tar.gz';
+    Process::assertRan(fn ($process) => str_contains($process->command, 'tar -I')
+        && str_contains($process->command, 'mc pipe')
+        && str_contains($process->command, '>/dev/null && (compressor=')
+        && str_contains($process->command, '>/dev/null) && mc stat')
+        && str_contains($process->command, 'temporary/bucket/')
+        && str_contains($process->command, $expectedFilename)
+        && substr_count($process->command, '--resolve') === 3
+        && substr_count($process->command, '>/dev/null') >= 2
+        && ! str_contains($process->command, ' > ')
+        && ! str_contains($process->command, 'mc cp'));
+    expect($execution->status)->toBe('success')
+        ->and($execution->size)->toBe(128)
+        ->and($execution->s3_uploaded)->toBeTrue()
+        ->and($execution->local_storage_deleted)->toBeTrue();
+});
+
+it('fails an unsupported S3 stream without falling back to a local archive', function () {
+    config(['broadcasting.default' => 'null']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Unsupported streaming destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->zeroOrMoreTimes()->andReturn([]);
+    $disk->shouldReceive('delete')->once()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->zeroOrMoreTimes()->andReturn($disk);
+    Process::fake([
+        '*mc pipe*' => Process::result(errorOutput: 'streaming upload is unsupported', exitCode: 1),
+        '*' => '',
+    ]);
+
+    expect(fn () => (new VolumeBackupJob($backup))->handle())
+        ->toThrow(RuntimeException::class, 'Enable local backups to use the local archive upload method.');
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    expect($execution->status)->toBe('failed')
+        ->and($execution->message)->toContain('The S3 destination may not support streaming uploads.')
+        ->and($execution->message)->toContain('Enable local backups to use the local archive upload method.')
+        ->and($execution->filename)->toBeNull()
+        ->and($execution->local_storage_deleted)->toBeTrue();
+    Process::assertRan(fn ($process) => str_contains($process->command, 'mc pipe')
+        && ! str_contains($process->command, 'mc cp')
+        && ! str_contains($process->command, ' > '));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'mkdir -p')
+        || (str_contains($process->command, 'rm -f') && str_contains($process->command, '.tar.gz')));
+});
+
+it('keeps local-first archive creation and mc copy when retaining a local volume backup', function () {
+    config(['broadcasting.default' => 'null']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Copied destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => false,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->once()->andReturn([]);
+    $disk->shouldReceive('delete')->zeroOrMoreTimes()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->once()->andReturn($disk);
+    Process::fake([
+        '*du -b*' => '128',
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup))->handle();
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'tar -I')
+        && str_contains($process->command, '>')
+        && ! str_contains($process->command, 'mc pipe'));
+    Process::assertRan(fn ($process) => str_contains($process->command, 'mc cp')
+        && ! str_contains($process->command, 'mc pipe'));
+});
+
 it('removes local volume backups older than the configured retention days', function () {
     config(['broadcasting.default' => 'null']);
     InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));

From 778a6985531854f87134b3907d0d8a633f648c9c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:01:48 +0200
Subject: [PATCH 41/48] fix(api): align service domain validation with UI rules

---
 .../Api/ServiceApplicationsController.php     |  3 +-
 .../Controllers/Api/ServicesController.php    |  6 +-
 .../ApplicationDomainValidationApiTest.php    | 86 +++++++++++++++++++
 tests/Feature/ServiceApplicationsApiTest.php  | 33 +++++++
 4 files changed, 124 insertions(+), 4 deletions(-)
 create mode 100644 tests/Feature/Api/ApplicationDomainValidationApiTest.php

diff --git a/app/Http/Controllers/Api/ServiceApplicationsController.php b/app/Http/Controllers/Api/ServiceApplicationsController.php
index e8446467de..5bf51bc027 100644
--- a/app/Http/Controllers/Api/ServiceApplicationsController.php
+++ b/app/Http/Controllers/Api/ServiceApplicationsController.php
@@ -9,6 +9,7 @@ use App\Actions\Service\UpdateServiceApplicationFromApi;
 use App\Http\Controllers\Controller;
 use App\Models\Service;
 use App\Models\ServiceApplication;
+use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Collection;
@@ -333,7 +334,7 @@ class ServiceApplicationsController extends Controller
         ];
 
         $validationRules = [
-            'url' => 'nullable|string',
+            'url' => ValidationPatterns::applicationDomainRules(),
             'noindex_domains' => 'sometimes|array|nullable',
             'noindex_domains.*' => 'string',
             'human_name' => 'nullable|string|max:255',
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index 9bfcfd8539..1a199c07ec 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -386,7 +386,7 @@ class ServicesController extends Controller
             'urls' => 'array|nullable',
             'urls.*' => 'array:name,url',
             'urls.*.name' => 'string|required',
-            'urls.*.url' => 'string|nullable',
+            'urls.*.url' => ValidationPatterns::applicationDomainRules(),
             'force_domain_override' => 'boolean',
             'is_container_label_escape_enabled' => 'boolean',
             'tags' => 'array|nullable',
@@ -602,7 +602,7 @@ class ServicesController extends Controller
                 'urls' => 'array|nullable',
                 'urls.*' => 'array:name,url',
                 'urls.*.name' => 'string|required',
-                'urls.*.url' => 'string|nullable',
+                'urls.*.url' => ValidationPatterns::applicationDomainRules(),
                 'force_domain_override' => 'boolean',
                 'is_container_label_escape_enabled' => 'boolean',
                 'tags' => 'array|nullable',
@@ -1187,7 +1187,7 @@ class ServicesController extends Controller
             'urls' => 'array|nullable',
             'urls.*' => 'array:name,url',
             'urls.*.name' => 'string|required',
-            'urls.*.url' => 'string|nullable',
+            'urls.*.url' => ValidationPatterns::applicationDomainRules(),
             'force_domain_override' => 'boolean',
             'is_container_label_escape_enabled' => 'boolean',
         ];
diff --git a/tests/Feature/Api/ApplicationDomainValidationApiTest.php b/tests/Feature/Api/ApplicationDomainValidationApiTest.php
new file mode 100644
index 0000000000..88533ce760
--- /dev/null
+++ b/tests/Feature/Api/ApplicationDomainValidationApiTest.php
@@ -0,0 +1,86 @@
+<?php
+
+use App\Enums\ProxyTypes;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.store' => 'array']);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->token = $this->user->createToken('test-token', ['*']);
+    $this->bearerToken = $this->token->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = $this->server->standaloneDockers()->firstOrCreate(
+            ['network' => 'coolify'],
+            ['uuid' => (string) new Cuid2, 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+
+    // Project boot event auto-creates a 'production' environment
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+});
+
+it('rejects wildcard domains on application updates regardless of proxy configuration', function (string $proxyType) {
+    $this->server->proxy = ['type' => $proxyType];
+    $this->server->save();
+    $originalDomain = $this->application->fqdn;
+
+    $this->withToken($this->bearerToken)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://*.example.com',
+            'force_domain_override' => true,
+        ])
+        ->assertUnprocessable()
+        ->assertJsonPath('message', 'Validation failed.')
+        ->assertJsonPath('errors', fn (array $errors): bool => collect($errors)->flatten()->contains('Invalid URL: https://*.example.com'));
+
+    expect($this->application->fresh()->fqdn)->toBe($originalDomain);
+})->with([ProxyTypes::NONE->value, ProxyTypes::TRAEFIK->value]);
+
+it('rejects wildcard domains on application creation', function (string $proxyType) {
+    $this->server->proxy = ['type' => $proxyType];
+    $this->server->save();
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $count = Application::count();
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/applications/dockerimage', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'docker_registry_image_name' => 'nginx',
+            'ports_exposes' => '80',
+            'domains' => 'https://*.example.com',
+        ])
+        ->assertUnprocessable()
+        ->assertJsonPath('message', 'Validation failed.')
+        ->assertJsonPath('errors', fn (array $errors): bool => collect($errors)->flatten()->contains('Invalid URL: https://*.example.com'));
+
+    expect(Application::count())->toBe($count);
+})->with([ProxyTypes::NONE->value, ProxyTypes::TRAEFIK->value]);
diff --git a/tests/Feature/ServiceApplicationsApiTest.php b/tests/Feature/ServiceApplicationsApiTest.php
index d6c687fbc5..3d7309ee32 100644
--- a/tests/Feature/ServiceApplicationsApiTest.php
+++ b/tests/Feature/ServiceApplicationsApiTest.php
@@ -410,3 +410,36 @@ describe('GET /api/v1/services/{uuid}/applications/{app_uuid}/logs', function ()
         $response->assertJsonFragment(['message' => 'Server is not functional.']);
     });
 });
+
+it('applies UI domain validation to service API updates', function (string $target, string $url) {
+    $ctx = createServiceWithApplicationForApiTest($this);
+    $ctx->serviceApplication->update(['fqdn' => 'https://original.example.com']);
+    $isApplication = $target === 'application';
+    $path = $isApplication
+        ? "/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}"
+        : "/api/v1/services/{$ctx->service->uuid}";
+    $payload = $isApplication ? ['url' => $url] : ['urls' => [['name' => 'web', 'url' => $url]]];
+
+    $this->withToken($this->bearerToken)->patchJson($path, $payload)
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors($isApplication ? 'url' : 'urls.0.url');
+
+    expect($ctx->serviceApplication->fresh()->fqdn)->toBe('https://original.example.com');
+})->with(['application', 'service'])->with([
+    'wildcard' => 'https://*.example.com',
+    'too long' => 'https://example.com/'.str_repeat('a', 2048),
+]);
+
+it('rejects oversized service domains before creating a service', function () {
+    $count = Service::count();
+
+    $this->withToken($this->bearerToken)->postJson('/api/v1/services', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'server_uuid' => $this->server->uuid,
+        'docker_compose_raw' => base64_encode("services:\n  web:\n    image: nginx:alpine\n"),
+        'urls' => [['name' => 'web', 'url' => 'https://example.com/'.str_repeat('a', 2048)]],
+    ])->assertUnprocessable()->assertJsonValidationErrors('urls.0.url');
+
+    expect(Service::count())->toBe($count);
+});

From 4766a662fe5365bc4fff498a67f651ec9eb91496 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:08:11 +0200
Subject: [PATCH 42/48] fix: preserve shell negation in sudo commands

---
 bootstrap/helpers/sudo.php                    |  9 +++-
 tests/Unit/ParseCommandsByLineForSudoTest.php | 46 +++++++++++++++++++
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/bootstrap/helpers/sudo.php b/bootstrap/helpers/sudo.php
index 397efc387c..98dbe3af7a 100644
--- a/bootstrap/helpers/sudo.php
+++ b/bootstrap/helpers/sudo.php
@@ -59,13 +59,18 @@ function parseCommandsByLineForSudo(Collection $commands, Server $server): array
             return $line;
         }
 
+        // Negation belongs to the shell, before the elevated command.
+        if (preg_match('/^\s*!\s+/', $line)) {
+            return preg_replace('/^(\s*(?:!\s+)+)/', '$1sudo ', $line);
+        }
+
         // Check all keywords with word boundary matching
         // Match keyword followed by space, semicolon, or end of line
         foreach ($bashKeywords as $keyword) {
             if (preg_match('/^'.preg_quote($keyword, '/').'(\s|;|$)/', $trimmedLine)) {
-                // Special handling for 'if' - insert sudo after 'if '
+                // Keep any shell negation before sudo in the condition.
                 if ($keyword === 'if') {
-                    return preg_replace('/^(\s*)if\s+/', '$1if sudo ', $line);
+                    return preg_replace('/^(\s*if\s+(?:!\s+)*)/', '$1sudo ', $line);
                 }
 
                 return $line;
diff --git a/tests/Unit/ParseCommandsByLineForSudoTest.php b/tests/Unit/ParseCommandsByLineForSudoTest.php
index b741b875f2..93c9f8b643 100644
--- a/tests/Unit/ParseCommandsByLineForSudoTest.php
+++ b/tests/Unit/ParseCommandsByLineForSudoTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Server;
+use Symfony\Component\Process\Process;
 
 beforeEach(function () {
     // Create a mock server with non-root user
@@ -184,6 +185,50 @@ test('handles if statements by adding sudo to condition', function () {
     expect($result[0])->toBe('if sudo command -v docker');
 });
 
+test('preserves shell negation before sudo', function (string $command, string $expected) {
+    expect(parseCommandsByLineForSudo(collect([$command]), $this->server))->toBe([$expected]);
+})->with([
+    'negated condition' => ['if ! docker inspect coolify-proxy; then', 'if ! sudo docker inspect coolify-proxy; then'],
+    'indented condition' => ["\tif  !  docker inspect coolify-proxy; then", "\tif  !  sudo docker inspect coolify-proxy; then"],
+    'negated pipeline' => [
+        '    if ! docker ps -a --format "{{.Names}}" | grep -q "^coolify-proxy$"; then',
+        '    if ! sudo docker ps -a --format "{{.Names}}" | sudo grep -q "^coolify-proxy$"; then',
+    ],
+    'standalone negation' => ['! docker inspect coolify-proxy', '! sudo docker inspect coolify-proxy'],
+    'repeated negation' => ['if ! ! docker inspect coolify-proxy; then', 'if ! ! sudo docker inspect coolify-proxy; then'],
+    'literal exclamation argument' => ['echo "! docker"', 'echo "! docker"'],
+]);
+
+test('proxy removal loop exits only once the container is absent', function (string $containers, string $expected) {
+    $commands = collect([
+        'for i in {1..15}; do',
+        '    if ! docker ps -a --format "{{.Names}}" | grep -q "^coolify-proxy$"; then',
+        '        echo "Container removed successfully."',
+        '        break',
+        '    fi',
+        '    echo "Waiting for container to be removed... ($i/15)"',
+        'done',
+    ]);
+    $script = <<<'BASH'
+sudo() { "$@"; }
+docker() { printf '%s\n' "$CONTAINERS"; }
+BASH;
+    $script .= "\n".implode("\n", parseCommandsByLineForSudo($commands, $this->server));
+    $process = new Process(['bash', '-c', $script], env: ['CONTAINERS' => $containers]);
+    $process->run();
+
+    expect($process->isSuccessful())->toBeTrue()
+        ->and($process->getErrorOutput())->toBe('')
+        ->and($process->getOutput())->toBe($expected);
+})->with([
+    'removed' => ['', "Container removed successfully.\n"],
+    'other containers remain' => ['another-container', "Container removed successfully.\n"],
+    'still present' => ['coolify-proxy', implode('', array_map(
+        fn (int $attempt): string => "Waiting for container to be removed... ($attempt/15)\n",
+        range(1, 15),
+    ))],
+]);
+
 test('skips sudo for fi statements', function () {
     $commands = collect([
         'fi',
@@ -457,6 +502,7 @@ test('handles real-world proxy startup with for loop from StartProxy action', fu
 
     // Verify other control structures remain correct
     expect($result[0])->toStartWith('if sudo docker ps');
+    expect($result[6])->toBe('        if ! sudo docker ps -a --format "{{.Names}}" | sudo grep -q "^coolify-proxy$"; then');
     expect($result[8])->toBe('        fi');
     expect($result[13])->toBe('fi');
 });

From 0b462f6a58641b40f2c49b3045dc28cb426a9e7e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:09:42 +0200
Subject: [PATCH 43/48] feat(backups): alert when scheduled backups are missing
 (#11433)

---
 app/Console/Kernel.php                        |   2 +
 .../Controllers/Api/DatabasesController.php   |  10 +-
 app/Jobs/CheckMissingDatabaseBackupsJob.php   |  59 ++++++++
 app/Livewire/Project/Database/BackupEdit.php  |   5 +
 app/Models/ScheduledDatabaseBackup.php        |   4 +
 .../ScheduledDatabaseBackupExecution.php      |   7 +
 .../Channels/TelegramChannel.php              |   4 +-
 app/Notifications/Database/BackupMissing.php  |  83 ++++++++++++
 ...ds_to_scheduled_database_backups_table.php |  28 ++++
 .../views/emails/backup-missing.blade.php     |   7 +
 .../database/backup-edit/general.blade.php    |   3 +
 tests/Feature/Api/LifecycleApisTest.php       |  15 ++-
 .../MissingDatabaseBackupNotificationTest.php | 126 ++++++++++++++++++
 13 files changed, 349 insertions(+), 4 deletions(-)
 create mode 100644 app/Jobs/CheckMissingDatabaseBackupsJob.php
 create mode 100644 app/Notifications/Database/BackupMissing.php
 create mode 100644 database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php
 create mode 100644 resources/views/emails/backup-missing.blade.php
 create mode 100644 tests/Feature/MissingDatabaseBackupNotificationTest.php

diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index 8eb010b8ac..79660c2490 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -5,6 +5,7 @@ namespace App\Console;
 use App\Jobs\ApiTokenExpirationWarningJob;
 use App\Jobs\CheckForUpdatesJob;
 use App\Jobs\CheckHelperImageJob;
+use App\Jobs\CheckMissingDatabaseBackupsJob;
 use App\Jobs\CheckTraefikVersionJob;
 use App\Jobs\CleanupInstanceStuffsJob;
 use App\Jobs\CleanupOrphanedPreviewContainersJob;
@@ -53,6 +54,7 @@ class Kernel extends ConsoleKernel
             ->runInBackground();
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
+        $this->scheduleInstance->job(new CheckMissingDatabaseBackupsJob)->hourly()->onOneServer();
 
         if (isDev()) {
             // Instance Jobs
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index aeb69ac8b4..881aa5a897 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -769,6 +769,7 @@ class DatabasesController extends Controller
                         'database_backup_retention_days_s3' => ['type' => 'integer', 'description' => 'Number of days to retain backups in S3'],
                         'database_backup_retention_max_storage_s3' => ['type' => 'number', 'description' => 'Max storage (GB) for S3 backups'],
                         'timeout' => ['type' => 'integer', 'description' => 'Backup job timeout in seconds (min: 60, max: 36000)', 'default' => 3600],
+                        'missing_backup_notification_days' => ['type' => 'integer', 'description' => 'Alert after this many days without an execution; 0 disables alerts', 'minimum' => 0, 'maximum' => 365, 'default' => 0],
                     ],
                 ),
             )
@@ -805,7 +806,7 @@ class DatabasesController extends Controller
     )]
     public function create_backup(Request $request)
     {
-        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout'];
+        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout', 'missing_backup_notification_days'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -833,6 +834,7 @@ class DatabasesController extends Controller
             'database_backup_retention_days_s3' => 'integer|min:0',
             'database_backup_retention_max_storage_s3' => 'numeric|min:0',
             'timeout' => 'integer|min:60|max:36000',
+            'missing_backup_notification_days' => 'integer|min:0|max:365',
         ]);
 
         if ($validator->fails()) {
@@ -1025,6 +1027,7 @@ class DatabasesController extends Controller
                         'database_backup_retention_days_s3' => ['type' => 'integer', 'description' => 'Retention days of the backup in s3'],
                         'database_backup_retention_max_storage_s3' => ['type' => 'number', 'description' => 'Max storage of the backup in S3'],
                         'timeout' => ['type' => 'integer', 'description' => 'Backup job timeout in seconds (min: 60, max: 36000)', 'default' => 3600],
+                        'missing_backup_notification_days' => ['type' => 'integer', 'description' => 'Alert after this many days without an execution; 0 disables alerts', 'minimum' => 0, 'maximum' => 365],
                     ],
                 ),
             )
@@ -1054,7 +1057,7 @@ class DatabasesController extends Controller
     )]
     public function update_backup(Request $request)
     {
-        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout'];
+        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout', 'missing_backup_notification_days'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -1080,6 +1083,7 @@ class DatabasesController extends Controller
             'database_backup_retention_days_s3' => 'integer|min:0',
             'database_backup_retention_max_storage_s3' => 'numeric|min:0',
             'timeout' => 'integer|min:60|max:36000',
+            'missing_backup_notification_days' => 'integer|min:0|max:365',
         ]);
         if ($validator->fails()) {
             return response()->json([
@@ -4885,6 +4889,8 @@ class DatabasesController extends Controller
                 'id',
                 'created_at',
                 'updated_at',
+                'last_execution_at',
+                'missing_backup_notification_sent_at',
             ])->fill([
                 'uuid' => new_public_id(),
                 'database_id' => $newDatabase->id,
diff --git a/app/Jobs/CheckMissingDatabaseBackupsJob.php b/app/Jobs/CheckMissingDatabaseBackupsJob.php
new file mode 100644
index 0000000000..06ba79a33f
--- /dev/null
+++ b/app/Jobs/CheckMissingDatabaseBackupsJob.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Notifications\Database\BackupMissing;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+class CheckMissingDatabaseBackupsJob implements ShouldBeEncrypted, ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public function handle(): void
+    {
+        ScheduledDatabaseBackup::query()
+            ->with(['team', 'database', 'latest_log'])
+            ->where('enabled', true)
+            ->where('missing_backup_notification_days', '>', 0)
+            ->chunkById(100, function ($backups): void {
+                foreach ($backups as $backup) {
+                    $this->notifyIfMissing($backup);
+                }
+            });
+    }
+
+    private function notifyIfMissing(ScheduledDatabaseBackup $backup): void
+    {
+        $lastExecutionAt = $backup->last_execution_at ?? $backup->latest_log?->created_at;
+        $lastActivityAt = $lastExecutionAt ?? $backup->created_at;
+
+        if (! $lastActivityAt || $lastActivityAt->isAfter(now()->subDays($backup->missing_backup_notification_days))) {
+            return;
+        }
+
+        if ($backup->missing_backup_notification_sent_at?->greaterThanOrEqualTo($lastActivityAt)) {
+            return;
+        }
+
+        if (! $backup->team) {
+            Log::warning("Cannot send missing backup notification for backup {$backup->id}: team not found");
+
+            return;
+        }
+
+        if ($backup->team->getEnabledChannels('backup_failure') === []) {
+            return;
+        }
+
+        $backup->team->notify(new BackupMissing($backup, $lastExecutionAt));
+        $backup->forceFill(['missing_backup_notification_sent_at' => now()])->save();
+    }
+}
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 28f7e02556..64f6844757 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -85,6 +85,9 @@ class BackupEdit extends Component
     #[Validate(['required', 'int', 'min:60', 'max:36000'])]
     public int|string $timeout = 3600;
 
+    #[Validate(['required', 'integer', 'min:0', 'max:365'])]
+    public int $missingBackupNotificationDays = 0;
+
     public function getListeners(): array
     {
         // Keep "Backup Now" in sync when the database starts/stops without a full page refresh.
@@ -152,6 +155,7 @@ class BackupEdit extends Component
             $this->backup->databases_to_backup = $this->databasesToBackup;
             $this->backup->dump_all = $this->dumpAll;
             $this->backup->timeout = $this->timeout;
+            $this->backup->missing_backup_notification_days = $this->missingBackupNotificationDays;
             $this->customValidate();
             $this->backup->save();
         } else {
@@ -170,6 +174,7 @@ class BackupEdit extends Component
             $this->databasesToBackup = $this->backup->databases_to_backup;
             $this->dumpAll = $this->backup->dump_all;
             $this->timeout = $this->backup->timeout;
+            $this->missingBackupNotificationDays = $this->backup->missing_backup_notification_days;
         }
     }
 
diff --git a/app/Models/ScheduledDatabaseBackup.php b/app/Models/ScheduledDatabaseBackup.php
index e41c793c86..7a26658e4f 100644
--- a/app/Models/ScheduledDatabaseBackup.php
+++ b/app/Models/ScheduledDatabaseBackup.php
@@ -14,6 +14,9 @@ class ScheduledDatabaseBackup extends BaseModel
             'dump_all' => 'boolean',
             'database_backup_retention_max_storage_locally' => 'float',
             'database_backup_retention_max_storage_s3' => 'float',
+            'missing_backup_notification_days' => 'integer',
+            'missing_backup_notification_sent_at' => 'datetime',
+            'last_execution_at' => 'datetime',
         ];
     }
 
@@ -37,6 +40,7 @@ class ScheduledDatabaseBackup extends BaseModel
         'database_backup_retention_max_storage_s3',
         'timeout',
         'disable_local_backup',
+        'missing_backup_notification_days',
     ];
 
     public static function ownedByCurrentTeam()
diff --git a/app/Models/ScheduledDatabaseBackupExecution.php b/app/Models/ScheduledDatabaseBackupExecution.php
index 8c5de1e8b1..1a479772cf 100644
--- a/app/Models/ScheduledDatabaseBackupExecution.php
+++ b/app/Models/ScheduledDatabaseBackupExecution.php
@@ -6,6 +6,13 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class ScheduledDatabaseBackupExecution extends BaseModel
 {
+    protected static function booted(): void
+    {
+        static::created(function (ScheduledDatabaseBackupExecution $execution): void {
+            $execution->scheduledDatabaseBackup()->update(['last_execution_at' => $execution->created_at ?? now()]);
+        });
+    }
+
     protected $fillable = [
         'uuid',
         'scheduled_database_backup_id',
diff --git a/app/Notifications/Channels/TelegramChannel.php b/app/Notifications/Channels/TelegramChannel.php
index a52feda087..118ad4269c 100644
--- a/app/Notifications/Channels/TelegramChannel.php
+++ b/app/Notifications/Channels/TelegramChannel.php
@@ -9,6 +9,7 @@ use App\Notifications\Application\RestartLimitReached;
 use App\Notifications\Application\StatusChanged;
 use App\Notifications\Container\ContainerRestarted;
 use App\Notifications\Database\BackupFailed;
+use App\Notifications\Database\BackupMissing;
 use App\Notifications\Database\BackupSuccess;
 use App\Notifications\ScheduledTask\TaskFailed;
 use App\Notifications\ScheduledTask\TaskSuccess;
@@ -40,7 +41,8 @@ class TelegramChannel
             RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id,
 
             BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
-            BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
+            BackupFailed::class,
+            BackupMissing::class => $settings->telegram_notifications_backup_failure_thread_id,
 
             TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
             TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
diff --git a/app/Notifications/Database/BackupMissing.php b/app/Notifications/Database/BackupMissing.php
new file mode 100644
index 0000000000..d7f127ce3c
--- /dev/null
+++ b/app/Notifications/Database/BackupMissing.php
@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Notifications\Database;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Notifications\CustomEmailNotification;
+use App\Notifications\Dto\DiscordMessage;
+use App\Notifications\Dto\PushoverMessage;
+use App\Notifications\Dto\SlackMessage;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Carbon;
+
+class BackupMissing extends CustomEmailNotification
+{
+    public string $databaseName;
+
+    public function __construct(public ScheduledDatabaseBackup $backup, public ?Carbon $lastExecutionAt)
+    {
+        $this->onQueue('high');
+        $this->databaseName = $backup->database?->name ?? $backup->description ?? $backup->uuid;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return $notifiable->getEnabledChannels('backup_failure');
+    }
+
+    public function toMail(): MailMessage
+    {
+        return (new MailMessage)
+            ->subject("Coolify: [ACTION REQUIRED] No recent backup for {$this->databaseName}")
+            ->view('emails.backup-missing', $this->messageData());
+    }
+
+    public function toDiscord(): DiscordMessage
+    {
+        return new DiscordMessage(
+            title: ':warning: Scheduled database backup missing',
+            description: $this->description(),
+            color: DiscordMessage::errorColor(),
+            isCritical: true,
+        );
+    }
+
+    public function toTelegram(): array
+    {
+        return ['message' => 'Coolify: '.$this->description()];
+    }
+
+    public function toPushover(): PushoverMessage
+    {
+        return new PushoverMessage(title: 'Scheduled database backup missing', level: 'error', message: $this->description());
+    }
+
+    public function toSlack(): SlackMessage
+    {
+        return new SlackMessage(title: 'Scheduled database backup missing', description: $this->description(), color: SlackMessage::errorColor());
+    }
+
+    public function toWebhook(): array
+    {
+        return array_merge($this->messageData(), [
+            'success' => false,
+            'message' => 'Scheduled database backup missing',
+            'event' => 'backup_missing',
+            'backup_uuid' => $this->backup->uuid,
+        ]);
+    }
+
+    private function description(): string
+    {
+        return "The enabled backup schedule for {$this->databaseName} has produced no executions in the last {$this->backup->missing_backup_notification_days} day(s).";
+    }
+
+    private function messageData(): array
+    {
+        return [
+            'database_name' => $this->databaseName,
+            'days' => $this->backup->missing_backup_notification_days,
+            'last_execution_at' => $this->lastExecutionAt?->toDateTimeString(),
+        ];
+    }
+}
diff --git a/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php b/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php
new file mode 100644
index 0000000000..fe7c1e6292
--- /dev/null
+++ b/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('scheduled_database_backups', function (Blueprint $table) {
+            $table->unsignedInteger('missing_backup_notification_days')->default(0);
+            $table->timestamp('missing_backup_notification_sent_at')->nullable();
+            $table->timestamp('last_execution_at')->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('scheduled_database_backups', function (Blueprint $table) {
+            $table->dropColumn([
+                'missing_backup_notification_days',
+                'missing_backup_notification_sent_at',
+                'last_execution_at',
+            ]);
+        });
+    }
+};
diff --git a/resources/views/emails/backup-missing.blade.php b/resources/views/emails/backup-missing.blade.php
new file mode 100644
index 0000000000..69728c26f3
--- /dev/null
+++ b/resources/views/emails/backup-missing.blade.php
@@ -0,0 +1,7 @@
+The enabled backup schedule for {{ $database_name }} has produced no executions in the last {{ $days }} day(s).
+
+@if ($last_execution_at)
+The last execution was at {{ $last_execution_at }}.
+@else
+This schedule has never produced an execution.
+@endif
diff --git a/resources/views/livewire/project/database/backup-edit/general.blade.php b/resources/views/livewire/project/database/backup-edit/general.blade.php
index caabf249ac..5dddec8edd 100644
--- a/resources/views/livewire/project/database/backup-edit/general.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/general.blade.php
@@ -91,6 +91,9 @@
                     required />
                 <x-forms.input label="Timeout" id="timeout" type="number" min="60"
                     helper="Maximum backup runtime in seconds." required />
+                <x-forms.input label="Missing backup alert after" id="missingBackupNotificationDays" type="number"
+                    min="0" max="365" suffix="days" canGate="manageBackups" :canResource="$backup->database"
+                    helper="Notify through backup failure channels after this many days without an execution. Use 0 to disable." required />
             </div>
         </div>
     </section>
diff --git a/tests/Feature/Api/LifecycleApisTest.php b/tests/Feature/Api/LifecycleApisTest.php
index 4973453e93..49d6f66359 100644
--- a/tests/Feature/Api/LifecycleApisTest.php
+++ b/tests/Feature/Api/LifecycleApisTest.php
@@ -138,6 +138,16 @@ describe('POST /api/v1/databases/{uuid}/clone', function () {
             'destination_id' => $this->destination->id,
             'destination_type' => $this->destination->getMorphClass(),
         ]);
+        $backup = $database->scheduledBackups()->create([
+            'team_id' => $this->team->id,
+            'enabled' => true,
+            'frequency' => '0 0 * * *',
+            'save_s3' => false,
+        ]);
+        $backup->forceFill([
+            'last_execution_at' => now()->subDay(),
+            'missing_backup_notification_sent_at' => now(),
+        ])->save();
 
         $response = $this->withHeaders($this->headers)
             ->postJson("/api/v1/databases/{$database->uuid}/clone", [
@@ -149,11 +159,14 @@ describe('POST /api/v1/databases/{uuid}/clone', function () {
             ->assertJsonPath('message', 'Database cloned.');
 
         $cloned = StandalonePostgresql::where('uuid', $response->json('uuid'))->first();
+        $clonedBackup = $cloned->scheduledBackups()->sole();
         expect($cloned)->not->toBeNull()
             ->and($cloned->name)->toBe('cloned-db')
             ->and($cloned->environment_id)->toBe($database->environment_id)
             ->and($cloned->destination_id)->toBe($this->destination->id)
-            ->and(str($cloned->status)->startsWith('exited'))->toBeTrue();
+            ->and(str($cloned->status)->startsWith('exited'))->toBeTrue()
+            ->and($clonedBackup->last_execution_at)->toBeNull()
+            ->and($clonedBackup->missing_backup_notification_sent_at)->toBeNull();
     });
 
     test('creates renamed volumes when cloning a database with clone_volumes', function () {
diff --git a/tests/Feature/MissingDatabaseBackupNotificationTest.php b/tests/Feature/MissingDatabaseBackupNotificationTest.php
new file mode 100644
index 0000000000..f4f2efd191
--- /dev/null
+++ b/tests/Feature/MissingDatabaseBackupNotificationTest.php
@@ -0,0 +1,126 @@
+<?php
+
+use App\Jobs\CheckMissingDatabaseBackupsJob;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Team;
+use App\Notifications\Database\BackupMissing;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Notification;
+
+uses(RefreshDatabase::class);
+
+afterEach(fn () => Carbon::setTestNow());
+
+function missingBackupSchedule(Team $team, array $attributes = []): ScheduledDatabaseBackup
+{
+    $backup = ScheduledDatabaseBackup::create(array_merge([
+        'enabled' => true,
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => 'App\\Models\\StandalonePostgresql',
+        'database_id' => 999,
+        'team_id' => $team->id,
+        'missing_backup_notification_days' => 2,
+    ], $attributes));
+
+    ScheduledDatabaseBackup::whereKey($backup->id)->update(['created_at' => now()->subDays(3)]);
+
+    return $backup->refresh();
+}
+
+function teamWithBackupFailureNotifications(): Team
+{
+    $team = Team::create(['name' => 'Test team']);
+    $team->emailNotificationSettings->update([
+        'smtp_enabled' => true,
+        'backup_failure_email_notifications' => true,
+    ]);
+
+    return $team;
+}
+
+it('notifies the team when an enabled backup has no executions for the configured days', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentTo($team, BackupMissing::class, fn (BackupMissing $notification) => $notification->backup->is($backup));
+    expect($backup->fresh()->missing_backup_notification_sent_at)->not->toBeNull();
+});
+
+it('does not notify for recent disabled or unconfigured backup schedules', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    missingBackupSchedule($team, ['enabled' => false]);
+    missingBackupSchedule($team, ['missing_backup_notification_days' => 0]);
+    $recent = missingBackupSchedule($team);
+    ScheduledDatabaseBackup::whereKey($recent->id)->update(['created_at' => now()->subDay()]);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertNothingSent();
+});
+
+it('notifies once per period without executions and rearms after another execution', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 1);
+
+    Carbon::setTestNow(now()->addMinute());
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'app',
+    ]);
+    Carbon::setTestNow(now()->addDays(3));
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 2);
+});
+
+it('preserves the last execution checkpoint when execution history is deleted', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    Carbon::setTestNow(now()->addMinute());
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'app',
+    ]);
+    $execution->delete();
+    Carbon::setTestNow(now()->addDays(3));
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 2);
+});
+
+it('waits to mark an incident sent until a notification channel is enabled', function () {
+    Notification::fake();
+    $team = Team::create(['name' => 'Test team']);
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    expect($backup->fresh()->missing_backup_notification_sent_at)->toBeNull();
+
+    $team->emailNotificationSettings->update([
+        'smtp_enabled' => true,
+        'backup_failure_email_notifications' => true,
+    ]);
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentTo($team, BackupMissing::class);
+});

From 183e28682c480b9c78502370eba6e665057f782f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 7 Sep 2026 15:17:23 +0200
Subject: [PATCH 44/48] fix(domains): route Compose domains using service ports

Resolve routing ports per Compose service, preserve legacy embedded ports, and ignore non-TCP declarations.
---
 app/Livewire/Project/Application/Domains.php  |  24 ++--
 .../Project/Application/PreviewDomains.php    |  24 ++--
 app/Models/Application.php                    |  12 +-
 app/Models/Service.php                        |   5 +-
 app/Models/ServiceApplication.php             |  66 +++++++++-
 bootstrap/helpers/docker.php                  |  24 +++-
 bootstrap/helpers/parsers.php                 |  48 +-------
 bootstrap/helpers/shared.php                  |  37 ++----
 tests/Feature/ApplicationDomainsTest.php      | 116 +++++++++++++++++-
 ...licationParserDockerComposeDomainsTest.php |  34 +++--
 tests/Feature/DockerComposeHttpPortsTest.php  |  19 +++
 .../Feature/LegacyServiceRoutingPortTest.php  |  94 ++++++++++++++
 .../PreviewDomainPortOverridesTest.php        |  98 ++++++++++++++-
 .../Service/EditDomainPortValidationTest.php  |  62 ++++++++++
 tests/Feature/ServiceRoutingPortTest.php      |  62 ++++++++++
 .../Feature/ServiceTemplatePortLookupTest.php |   6 +
 16 files changed, 609 insertions(+), 122 deletions(-)
 create mode 100644 tests/Feature/DockerComposeHttpPortsTest.php
 create mode 100644 tests/Feature/LegacyServiceRoutingPortTest.php
 create mode 100644 tests/Feature/ServiceRoutingPortTest.php

diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 62153d1757..80eb9bf0a8 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -554,13 +554,6 @@ class Domains extends Component
             ];
         }
 
-        if ($this->application->settings?->is_static) {
-            return [
-                'internal_port' => 80,
-                'has_port_override' => false,
-            ];
-        }
-
         $composePort = dockerComposeServicePort($this->application->docker_compose_raw, $service);
         if ($composePort !== null) {
             return [
@@ -569,13 +562,20 @@ class Domains extends Component
             ];
         }
 
-        if ($this->isCompose && $service !== null && count($this->composeServices) > 1) {
+        if ($this->isCompose && $service !== null) {
             return [
                 'internal_port' => null,
                 'has_port_override' => false,
             ];
         }
 
+        if ($this->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
@@ -613,7 +613,7 @@ class Domains extends Component
         return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
     }
 
-    protected function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    protected function shouldConfirmPort(?int $port, ?int $currentPort = null, ?string $serviceName = null): bool
     {
         if ($this->forceUseUnknownPort || $port === null) {
             return false;
@@ -622,7 +622,7 @@ class Domains extends Component
             return false;
         }
 
-        return $this->application->portRequiresConfirmation($port);
+        return $this->application->portRequiresConfirmation($port, $serviceName);
     }
 
     protected function openPortWarning(?int $port, string $action): void
@@ -1018,7 +1018,7 @@ class Domains extends Component
                 }
             }
 
-            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts), serviceName: $this->newDomainService)) {
                 $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
 
                 return;
@@ -1415,7 +1415,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl), $service)) {
                 $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
 
                 return;
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index 66eb2f5e01..2f0ee91ab8 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -74,7 +74,7 @@ class PreviewDomains extends Component
 
             return;
         }
-        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts), serviceName: $this->newDomainService)) {
             $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
 
             return;
@@ -173,7 +173,7 @@ class PreviewDomains extends Component
             return;
         }
         $oldUrl = $this->domainRows[$this->editingIndex]['url'];
-        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl), $this->domainRows[$this->editingIndex]['service'])) {
             $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
 
             return;
@@ -478,7 +478,7 @@ class PreviewDomains extends Component
         return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
     }
 
-    private function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    private function shouldConfirmPort(?int $port, ?int $currentPort = null, ?string $serviceName = null): bool
     {
         if ($this->forceUseUnknownPort || $port === null) {
             return false;
@@ -487,7 +487,7 @@ class PreviewDomains extends Component
             return false;
         }
 
-        return $this->preview->application->portRequiresConfirmation($port);
+        return $this->preview->application->portRequiresConfirmation($port, $serviceName);
     }
 
     private function openPortWarning(?int $port, string $action): void
@@ -522,13 +522,6 @@ class PreviewDomains extends Component
             ];
         }
 
-        if ($this->preview->application->settings?->is_static) {
-            return [
-                'internal_port' => 80,
-                'has_port_override' => false,
-            ];
-        }
-
         $composePort = dockerComposeServicePort($this->preview->application->docker_compose_raw, $service);
         if ($composePort !== null) {
             return [
@@ -537,13 +530,20 @@ class PreviewDomains extends Component
             ];
         }
 
-        if ($this->preview->application->build_pack === 'dockercompose' && $service !== null && count($this->composeServices()) > 1) {
+        if ($this->preview->application->build_pack === 'dockercompose' && $service !== null) {
             return [
                 'internal_port' => null,
                 'has_port_override' => false,
             ];
         }
 
+        if ($this->preview->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->preview->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 2ac352149f..cec8d501ab 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -964,12 +964,16 @@ class Application extends BaseModel
     }
 
     /**
-     * Ports the container is expected to listen on: Ports Exposes plus ports already used by application domains.
+     * Ports declared by the selected Compose service, or exposed and previously used application ports.
      *
      * @return list<int>
      */
-    public function availableInternalPorts(): array
+    public function availableInternalPorts(?string $serviceName = null): array
     {
+        if ($this->build_pack === 'dockercompose') {
+            return dockerComposeServicePorts($this->docker_compose_raw, $serviceName);
+        }
+
         $ports = collect($this->settings?->is_static ? [80] : $this->ports_exposes_array)
             ->filter(fn (mixed $port): bool => is_numeric($port) && (int) $port > 0)
             ->map(fn (mixed $port): int => (int) $port);
@@ -994,13 +998,13 @@ class Application extends BaseModel
         return $ports->unique()->sort()->values()->all();
     }
 
-    public function portRequiresConfirmation(?int $port): bool
+    public function portRequiresConfirmation(?int $port, ?string $serviceName = null): bool
     {
         if ($port === null || $port <= 0) {
             return false;
         }
 
-        return ! in_array($port, $this->availableInternalPorts(), true);
+        return ! in_array($port, $this->availableInternalPorts($serviceName), true);
     }
 
     public function detectPortFromEnvironment(?bool $isPreview = false): ?int
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 1e6a33ad69..3b80a19412 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -1477,7 +1477,10 @@ class Service extends BaseModel
     {
         try {
             $services = get_service_templates();
-            $serviceName = $this->service_type ?: str($this->name)->beforeLast('-')->value();
+            if (blank($this->service_type)) {
+                return null;
+            }
+            $serviceName = $this->service_type;
             $service = data_get($services, $serviceName, []);
             $port = data_get($service, 'port');
 
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index cf0faef5bd..cba18c1f23 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -201,7 +201,7 @@ class ServiceApplication extends BaseModel
     }
 
     /**
-     * Return the public URLs with their persisted internal port overrides.
+     * Return editable URLs with persisted overrides or legacy embedded ports.
      */
     protected function url(): Attribute
     {
@@ -220,7 +220,7 @@ class ServiceApplication extends BaseModel
                         $port = $overrides[$canonical] ?? null;
 
                         if ($port === null) {
-                            return $canonical;
+                            return $url;
                         }
 
                         $parts = DomainUrlParts::split($canonical);
@@ -366,7 +366,7 @@ class ServiceApplication extends BaseModel
             }
 
             $dockerCompose = Yaml::parse($dockerComposeRaw);
-            $serviceConfig = data_get($dockerCompose, "services.{$this->name}");
+            $serviceConfig = $dockerCompose['services'][$this->name] ?? null;
             if (! $serviceConfig) {
                 return $this->service->getRequiredPort();
             }
@@ -417,9 +417,21 @@ class ServiceApplication extends BaseModel
                 return $portFound;
             }
 
+            $composePort = firstDockerComposeServicePort($serviceConfig);
+            if ($composePort !== null) {
+                return $composePort;
+            }
+
             // HTTP-facing compose services that only declare SERVICE_URL/FQDN (no _PORT
             // suffix), such as WordPress, inherit the one-click template `# port:`.
             if ($declaresHttpUrl) {
+                if (blank($this->service->service_type)) {
+                    $savedPort = $this->getSavedLegacyRoutingPort($serviceConfig);
+                    if ($savedPort !== null) {
+                        return $savedPort;
+                    }
+                }
+
                 return $this->service->getRequiredPort();
             }
 
@@ -428,4 +440,52 @@ class ServiceApplication extends BaseModel
             return null;
         }
     }
+
+    /**
+     * Preserve only an unambiguous upstream from this legacy container's saved labels.
+     */
+    private function getSavedLegacyRoutingPort(array $serviceConfig): ?int
+    {
+        $savedCompose = Yaml::parse($this->service->docker_compose ?? '');
+        $savedService = $savedCompose['services'][$this->name] ?? null;
+        $image = $serviceConfig['image'] ?? null;
+        if (! is_string($image) || $image === '' || ($savedService['image'] ?? null) !== $image) {
+            return null;
+        }
+
+        $labels = $savedService['labels'] ?? [];
+        if (! is_array($labels)) {
+            return null;
+        }
+
+        $ports = [];
+        foreach ($labels as $key => $value) {
+            if (is_int($key)) {
+                if (! is_string($value)) {
+                    return null;
+                }
+                [$key, $value] = array_pad(explode('=', $value, 2), 2, null);
+            }
+
+            if (preg_match('/^traefik\.http\.services\.[^.]+\.loadbalancer\.server\.port$/', $key)) {
+                $port = $value;
+            } elseif (preg_match('/^caddy(?:_\d+)?\..*reverse_proxy$/', $key)) {
+                if (! is_string($value) || ! preg_match('/^\{\{upstreams ([0-9]+)\}\}$/', $value, $matches)) {
+                    return null;
+                }
+                $port = $matches[1];
+            } else {
+                continue;
+            }
+
+            if ((! is_string($port) && ! is_int($port)) || ! preg_match('/^[0-9]+$/', (string) $port) || (int) $port < 1 || (int) $port > 65535) {
+                return null;
+            }
+            $ports[] = (int) $port;
+        }
+
+        $ports = array_values(array_unique($ports));
+
+        return count($ports) === 1 ? $ports[0] : null;
+    }
 }
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 84232a8d72..613a104e0e 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -607,6 +607,13 @@ function firstDockerComposeServicePort(mixed $service): ?int
         ->merge(data_get($service, 'ports', []));
 
     foreach ($portDefinitions as $definition) {
+        $protocol = is_array($definition)
+            ? data_get($definition, 'protocol', 'tcp')
+            : (str_contains((string) $definition, '/') ? str((string) $definition)->afterLast('/')->value() : 'tcp');
+        if ($protocol !== 'tcp') {
+            continue;
+        }
+
         $port = is_array($definition)
             ? data_get($definition, 'target')
             : str((string) $definition)->before('/')->afterLast(':')->value();
@@ -620,18 +627,29 @@ function firstDockerComposeServicePort(mixed $service): ?int
 }
 
 function dockerComposeServicePort(?string $compose, ?string $serviceName): ?int
+{
+    return dockerComposeServicePorts($compose, $serviceName)[0] ?? null;
+}
+
+function dockerComposeServicePorts(?string $compose, ?string $serviceName): array
 {
     if (blank($compose) || blank($serviceName)) {
-        return null;
+        return [];
     }
 
     try {
         $services = data_get(Yaml::parse($compose), 'services', []);
     } catch (Throwable) {
-        return null;
+        return [];
     }
 
-    return firstDockerComposeServicePort(is_array($services) ? ($services[$serviceName] ?? null) : null);
+    $service = is_array($services) ? ($services[$serviceName] ?? []) : [];
+
+    return collect(data_get($service, 'expose', []))
+        ->merge(data_get($service, 'ports', []))
+        ->map(fn ($definition) => firstDockerComposeServicePort(['expose' => [$definition]]))
+        ->filter(fn ($port) => $port !== null)
+        ->unique()->values()->all();
 }
 
 function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [])
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index dd8ea29c88..e50b852eca 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -390,9 +390,6 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
         return collect([]);
     }
     $services = data_get($yaml, 'services', collect([]));
-    $applicationServiceCount = collect($services)
-        ->reject(fn (mixed $service): bool => isDatabaseImage(data_get($service, 'image')))
-        ->count();
     $topLevel = collect([
         'volumes' => collect(data_get($yaml, 'volumes', [])),
         'networks' => collect(data_get($yaml, 'networks', [])),
@@ -1357,9 +1354,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $domainPortOverrides = $isPullRequest
                 ? ($previewForPorts?->domain_port_overrides ?? [])
                 : ($originalResource->domain_port_overrides ?? []);
-            $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
-            $onlyPort = firstDockerComposeServicePort($service)
-                ?? ($applicationServiceCount === 1 ? ($exposedPorts[0] ?? null) : null);
+            $onlyPort = firstDockerComposeServicePort($service);
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -1566,7 +1561,6 @@ function serviceParser(Service $resource): Collection
     $envComments = extractYamlEnvironmentComments($compose);
 
     $server = data_get($resource, 'server');
-    $allServices = get_service_templates();
 
     try {
         $yaml = Yaml::parse($compose);
@@ -1699,22 +1693,7 @@ function serviceParser(Service $resource): Collection
 
         $containerName = "$serviceName-{$resource->uuid}";
 
-        if ($serviceName === 'registry') {
-            $tempServiceName = 'docker-registry';
-        } else {
-            $tempServiceName = $serviceName;
-        }
-        if (str(data_get($service, 'image'))->contains('glitchtip')) {
-            $tempServiceName = 'glitchtip';
-        }
-        if ($serviceName === 'supabase-kong') {
-            $tempServiceName = 'supabase';
-        }
-        $serviceDefinition = data_get($allServices, $tempServiceName);
-        $predefinedPort = data_get($serviceDefinition, 'port');
-        if ($serviceName === 'plausible') {
-            $predefinedPort = '8000';
-        }
+        $predefinedPort = $resource->getRequiredPort();
 
         if ($migratedApp || $migratedDb) {
             // Use the already determined migrated service
@@ -2084,22 +2063,7 @@ function serviceParser(Service $resource): Collection
 
         $containerName = "$serviceName-{$resource->uuid}";
 
-        if ($serviceName === 'registry') {
-            $tempServiceName = 'docker-registry';
-        } else {
-            $tempServiceName = $serviceName;
-        }
-        if (str(data_get($service, 'image'))->contains('glitchtip')) {
-            $tempServiceName = 'glitchtip';
-        }
-        if ($serviceName === 'supabase-kong') {
-            $tempServiceName = 'supabase';
-        }
-        $serviceDefinition = data_get($allServices, $tempServiceName);
-        $predefinedPort = data_get($serviceDefinition, 'port');
-        if ($serviceName === 'plausible') {
-            $predefinedPort = '8000';
-        }
+        $predefinedPort = $resource->getRequiredPort();
 
         if ($migratedApp || $migratedDb) {
             // Use the already determined migrated service
@@ -2642,7 +2606,7 @@ function serviceParser(Service $resource): Collection
                 ? data_get($originalResource, 'redirect')
                 : 'both';
             $onlyPort = $originalResource instanceof ServiceApplication
-                ? ($originalResource->getRequiredPort() ?? $predefinedPort)
+                ? $originalResource->getRequiredPort()
                 : $predefinedPort;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
@@ -2677,7 +2641,7 @@ function serviceParser(Service $resource): Collection
                             service_name: $serviceName,
                             image: $image,
                             onlyPort: $onlyPort,
-                            predefinedPort: $predefinedPort,
+                            predefinedPort: $onlyPort,
                             domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
@@ -2710,7 +2674,7 @@ function serviceParser(Service $resource): Collection
                     service_name: $serviceName,
                     image: $image,
                     onlyPort: $onlyPort,
-                    predefinedPort: $predefinedPort,
+                    predefinedPort: $onlyPort,
                     domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index f5db32e886..fbfbc9b566 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -2486,7 +2486,6 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
             } catch (Exception $e) {
                 throw new RuntimeException($e->getMessage());
             }
-            $allServices = get_service_templates();
             $topLevelVolumes = collect(data_get($yaml, 'volumes', []));
             $topLevelNetworks = collect(data_get($yaml, 'networks', []));
             $topLevelConfigs = collect(data_get($yaml, 'configs', []));
@@ -2512,25 +2511,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                 }
                 $topLevelVolumes = collect($tempTopLevelVolumes);
             }
-            $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $allServices, $envComments) {
-                // Workarounds for beta users.
-                if ($serviceName === 'registry') {
-                    $tempServiceName = 'docker-registry';
-                } else {
-                    $tempServiceName = $serviceName;
-                }
-                if (str(data_get($service, 'image'))->contains('glitchtip')) {
-                    $tempServiceName = 'glitchtip';
-                }
-                if ($serviceName === 'supabase-kong') {
-                    $tempServiceName = 'supabase';
-                }
-                $serviceDefinition = data_get($allServices, $tempServiceName);
-                $predefinedPort = data_get($serviceDefinition, 'port');
-                if ($serviceName === 'plausible') {
-                    $predefinedPort = '8000';
-                }
-                // End of workarounds for beta users.
+            $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $envComments) {
+                $predefinedPort = $resource->getRequiredPort();
                 $serviceVolumes = collect(data_get($service, 'volumes', []));
                 $servicePorts = collect(data_get($service, 'ports', []));
                 $serviceNetworks = collect(data_get($service, 'networks', []));
@@ -3107,7 +3089,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                             ? ($savedService->domain_port_overrides ?? [])
                             : [];
                         $onlyPort = $savedService instanceof ServiceApplication
-                            ? ($savedService->getRequiredPort() ?? $predefinedPort)
+                            ? $savedService->getRequiredPort()
                             : $predefinedPort;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($resource->server->proxyType()) {
@@ -3139,7 +3121,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
                                         onlyPort: $onlyPort,
-                                        predefinedPort: $predefinedPort,
+                                        predefinedPort: $onlyPort,
                                         noindex_domains: $noindexDomains,
                                         redirect_direction: $redirectDirection,
                                         domainPortOverrides: $domainPortOverrides,
@@ -3172,7 +3154,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
                                 onlyPort: $onlyPort,
-                                predefinedPort: $predefinedPort,
+                                predefinedPort: $onlyPort,
                                 noindex_domains: $noindexDomains,
                                 redirect_direction: $redirectDirection,
                                 domainPortOverrides: $domainPortOverrides,
@@ -3318,10 +3300,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
         if ($pull_request_id !== 0) {
             $definedNetwork = collect(["{$resource->uuid}-$pull_request_id"]);
         }
-        $usesSharedApplicationPort = collect($services)
-            ->reject(fn (mixed $service): bool => isDatabaseImage(data_get($service, 'image')))
-            ->count() === 1;
-        $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $server, $pull_request_id, $preview_id, $usesSharedApplicationPort) {
+        $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $server, $pull_request_id, $preview_id) {
             $serviceVolumes = collect(data_get($service, 'volumes', []));
             $servicePorts = collect(data_get($service, 'ports', []));
             $serviceNetworks = collect(data_get($service, 'networks', []));
@@ -3918,9 +3897,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $domainPortOverrides = $pull_request_id === 0
                             ? ($resource->domain_port_overrides ?? [])
                             : ($preview?->domain_port_overrides ?? []);
-                        $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
-                        $onlyPort = firstDockerComposeServicePort($service)
-                            ?? ($usesSharedApplicationPort ? ($exposedPorts[0] ?? null) : null);
+                        $onlyPort = firstDockerComposeServicePort($service);
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 1cc6d05e13..96b0446886 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -2524,7 +2524,7 @@ it('stores compose domain port overrides without wiping other services', functio
         'build_pack' => 'dockercompose',
         'fqdn' => null,
         'ports_exposes' => '3000,8080',
-        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n  api:\n    image: node:alpine\n",
         'docker_compose_domains' => json_encode([
             'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
         ]),
@@ -2773,3 +2773,117 @@ it('does not warn when editing an application domain to a port already used by a
         ->assertSet('showPortWarningModal', false)
         ->assertDispatched('success');
 });
+
+it('does not inherit the application port for single-service compose domains', function (string $extraService, bool $isPreview, bool $isStatic) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: httpd:2.4-alpine\n".$extraService,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://apache.example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    $this->application->settings()->update(['is_static' => $isStatic]);
+
+    if ($isPreview) {
+        $preview = ApplicationPreview::create([
+            'application_id' => $this->application->id,
+            'pull_request_id' => 1,
+            'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/1',
+            'docker_compose_domains' => $this->application->docker_compose_domains,
+        ]);
+        $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    } else {
+        $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    }
+
+    $component->assertSet('domainRows.0.internal_port', null)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertDontSee('Internal port 3000');
+})->with([
+    'web only' => '',
+    'web and database' => "  database:\n    image: postgres:16-alpine\n",
+])->with([false, true])->with([false, true]);
+
+it('checks compose ports against the selected service when saving domains', function (string $action, int $port, bool $warn) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    expose:
+      - 8080
+      - 8081
+    ports:
+      - target: 8082
+        published: 18082
+      - "18083:8083"
+  api:
+    image: nginx:alpine
+    expose:
+      - 9090
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://existing.example.com'],
+            'api' => ['domain' => 'https://api.example.com:9090'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    if ($action === 'add') {
+        $component->set('newDomainService', 'web')
+            ->set('newDomainParts.host', 'new.example.com')
+            ->set('newDomainParts.port', (string) $port)
+            ->call('addDomain');
+        $domain = 'https://new.example.com';
+    } else {
+        $component->call('startEdit', 0)
+            ->set('editingDomainParts.port', (string) $port)
+            ->call('updateDomain');
+        $domain = 'https://existing.example.com';
+    }
+
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', $warn);
+
+    if ($warn) {
+        expect($this->application->fresh()->domain_port_overrides ?? [])->not->toHaveKey($domain);
+        $component->assertSet('unrecognizedPort', $port)
+            ->call('confirmUseUnknownPort')
+            ->assertSet('showPortWarningModal', false);
+    }
+
+    $component->assertDispatched('success');
+    expect($this->application->fresh()->domain_port_overrides[$domain] ?? null)->toBe($port);
+})->with(['add', 'edit'])->with([
+    'first exposed port' => [8080, false],
+    'second exposed port' => [8081, false],
+    'long syntax target' => [8082, false],
+    'short syntax target' => [8083, false],
+    'global port' => [3000, true],
+    'another service port' => [9090, true],
+    'published host port' => [18082, true],
+]);
+
+it('keeps an existing custom compose port without another warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '7070')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->domain_port_overrides['https://existing.example.com'] ?? null)->toBe(7070);
+});
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index c207782022..10e312b545 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\PrivateKey;
 use App\Models\Project;
@@ -570,17 +571,19 @@ YAML,
         ->toBeTrue();
 });
 
-test('applicationParser compose labels use the first ports_exposes value when a portless domain has no override', function () {
+test('single-service compose leaves undeclared ports to proxy discovery', function (int $parserVersion, string $extraService, bool $isPreview) {
     $application = disableExactProxyLabels(Application::factory()->create([
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
         'destination_type' => StandaloneDocker::class,
         'build_pack' => 'dockercompose',
+        'compose_parsing_version' => $parserVersion,
         'ports_exposes' => '3000,8080',
-        'docker_compose_raw' => <<<'YAML'
+        'docker_compose_raw' => <<<YAML
 services:
   frontend:
-    image: myapp/frontend:latest
+    image: httpd:2.4-alpine
+{$extraService}
 YAML,
         'fqdn' => null,
         'domain_port_overrides' => null,
@@ -589,16 +592,29 @@ YAML,
         ]),
     ]));
 
-    $parsedCompose = applicationParser($application->fresh());
-    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+    $preview = $isPreview ? ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 1,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/1',
+        'docker_compose_domains' => $application->docker_compose_domains,
+    ]) : null;
 
-    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=3000')))
-        ->toBeTrue()
-        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 3000}}')))
+    $parsedCompose = $application->fresh()->parse(
+        pull_request_id: $preview?->pull_request_id ?? 0,
+        preview_id: $preview?->id,
+    );
+    $labels = collect(data_get($parsedCompose, 'services'))->flatMap(fn ($service) => data_get($service, 'labels', []));
+
+    expect($labels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams}}')))
         ->toBeTrue()
         ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
         ->toBeTrue();
-});
+})->with([2, 3])->with([
+    'web only' => '',
+    'web and database' => "  database:\n    image: postgres:16-alpine",
+])->with([false, true]);
 
 test('applicationParser compose labels prefer the service exposed port over application ports_exposes', function (string $portConfiguration) {
     $application = disableExactProxyLabels(Application::factory()->create([
diff --git a/tests/Feature/DockerComposeHttpPortsTest.php b/tests/Feature/DockerComposeHttpPortsTest.php
new file mode 100644
index 0000000000..6b3adaa935
--- /dev/null
+++ b/tests/Feature/DockerComposeHttpPortsTest.php
@@ -0,0 +1,19 @@
+<?php
+
+use Symfony\Component\Yaml\Yaml;
+
+it('selects only TCP container ports for HTTP routing and confirmation', function (array $service, array $expected) {
+    $compose = Yaml::dump(['services' => ['web' => $service]]);
+
+    expect(firstDockerComposeServicePort($service))->toBe($expected[0] ?? null)
+        ->and(dockerComposeServicePort($compose, 'web'))->toBe($expected[0] ?? null)
+        ->and(dockerComposeServicePorts($compose, 'web'))->toBe($expected);
+})->with([
+    'expose UDP first' => [['expose' => ['53/udp', '8080/tcp']], [8080]],
+    'published UDP first' => [['ports' => ['53:53/udp', '18080:8080/tcp']], [8080]],
+    'long syntax UDP first' => [['ports' => [['target' => 53, 'protocol' => 'udp'], ['target' => 8080, 'published' => 18080, 'protocol' => 'tcp']]], [8080]],
+    'implicit TCP' => [['expose' => [80], 'ports' => [['target' => 8080], '18081:8081']], [80, 8080, 8081]],
+    'UDP only' => [['expose' => ['53/udp'], 'ports' => [['target' => 67, 'protocol' => 'udp']]], []],
+    'other protocol' => [['ports' => ['9000:9000/sctp', '8080']], [8080]],
+    'duplicates' => [['expose' => ['8080/udp', '8080/tcp'], 'ports' => ['18080:8080']], [8080]],
+]);
diff --git a/tests/Feature/LegacyServiceRoutingPortTest.php b/tests/Feature/LegacyServiceRoutingPortTest.php
new file mode 100644
index 0000000000..41f0e17179
--- /dev/null
+++ b/tests/Feature/LegacyServiceRoutingPortTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+it('only preserves an unambiguous saved upstream for the same legacy container', function (array $labels, ?int $expected, array $rawChanges = [], array $savedChanges = [], ?string $type = null) {
+    $raw = array_replace(['image' => 'httpd:2.4-alpine', 'environment' => ['SERVICE_URL_WEB']], $rawChanges);
+    $saved = array_replace(['image' => 'httpd:2.4-alpine', 'labels' => $labels], $savedChanges);
+    $service = new Service;
+    $service->forceFill([
+        'service_type' => $type,
+        'docker_compose_raw' => Yaml::dump(['services' => ['web' => $raw]]),
+        'docker_compose' => Yaml::dump(['services' => ['web' => $saved, 'other' => ['image' => 'httpd:2.4-alpine', 'labels' => ['traefik.http.services.other.loadbalancer.server.port=9000']]]]),
+    ]);
+    $application = new ServiceApplication(['name' => 'web']);
+    $application->setRelation('service', $service);
+
+    expect($application->getRequiredPort())->toBe($expected);
+})->with([
+    'Traefik list' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000],
+    'Traefik map' => [['traefik.http.services.web.loadbalancer.server.port' => '3000'], 3000],
+    'Caddy list' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'], 3000],
+    'Caddy map' => [['caddy_0.handle_path.0_reverse_proxy' => '{{upstreams 3000}}'], 3000],
+    'matching proxies' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'], 3000],
+    'conflicting proxies' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}'], null],
+    'multiple Traefik ports' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'traefik.http.services.api.loadbalancer.server.port=4000'], null],
+    'malformed port' => [['traefik.http.services.web.loadbalancer.server.port=3000oops'], null],
+    'out of range' => [['traefik.http.services.web.loadbalancer.server.port=65536'], null],
+    'negative' => [['traefik.http.services.web.loadbalancer.server.port=-1'], null],
+    'mixed malformed' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy=oops'], null],
+    'map bare FQDN' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000, ['environment' => ['SERVICE_FQDN_WEB' => null]]],
+    'UDP only preserves HTTP upstream' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000, ['expose' => ['53/udp']]],
+    'zero' => [['traefik.http.services.web.loadbalancer.server.port=0'], null],
+    'malformed Caddy' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams 3000oops}}'], null],
+    'discovery Caddy' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams}}'], null],
+    'no cross container' => [[], null],
+    'changed image' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, [], ['image' => 'httpd:latest']],
+    'missing saved image' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, [], ['image' => null]],
+    'no direct declaration' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, ['environment' => ['URL=${SERVICE_URL_WEB}']]],
+    'explicit magic wins' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 8080, ['environment' => ['SERVICE_URL_WEB_8080']]],
+    'Compose port wins' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 8080, ['expose' => [8080]]],
+    'known template excluded' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 80, [], [], 'wordpress-without-database'],
+]);
+
+it('preserves legacy upstreams across repeated parsing without adding public ports', function (int $version, ?int $override) {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['generate_exact_labels' => false]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'name' => 'legacy-stack',
+        'service_type' => null,
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  web:\n    image: httpd:2.4-alpine\n    environment:\n      - SERVICE_URL_WEB\n",
+        'docker_compose' => Yaml::dump(['services' => ['web' => ['image' => 'httpd:2.4-alpine', 'labels' => ['traefik.http.services.web.loadbalancer.server.port=3000']]]]),
+        'compose_parsing_version' => (string) $version,
+    ]);
+    ServiceApplication::create([
+        'name' => 'web',
+        'service_id' => $service->id,
+        'image' => 'httpd:2.4-alpine',
+        'fqdn' => 'https://legacy.example.com',
+        'domain_port_overrides' => $override === null ? null : ['https://legacy.example.com' => $override],
+    ]);
+
+    for ($iteration = 0; $iteration < 2; $iteration++) {
+        $parsed = $service->fresh()->parse();
+        $labels = collect($parsed['services']['web']['labels']);
+        $ports = $labels->filter(fn ($label) => str_contains($label, '.loadbalancer.server.port='));
+        expect($ports)->not->toBeEmpty();
+        foreach ($ports as $port) {
+            expect($port)->toEndWith('='.($override ?? 3000));
+        }
+        expect($labels->filter(fn ($label) => str_contains($label, 'reverse_proxy'))->implode(' '))->toContain('{{upstreams '.($override ?? 3000).'}}');
+        expect($service->fresh()->applications()->first()->fqdn)->toBe('https://legacy.example.com');
+    }
+})->with([4, 5])->with([null, 8080]);
diff --git a/tests/Feature/PreviewDomainPortOverridesTest.php b/tests/Feature/PreviewDomainPortOverridesTest.php
index b40193cb29..18d3829334 100644
--- a/tests/Feature/PreviewDomainPortOverridesTest.php
+++ b/tests/Feature/PreviewDomainPortOverridesTest.php
@@ -269,7 +269,7 @@ it('rejects adding a preview domain whose portless URL is already configured', f
 it('saves compose preview domain port overrides per service without putting the port in the public URL', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
-        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n  api:\n    image: nginx:alpine\n    expose: [3000]\n",
         'docker_compose_domains' => null,
     ]);
 
@@ -537,7 +537,7 @@ YAML,
         ->toBeFalse();
 });
 
-it('uses ports_exposes as the compose preview fallback when a domain has no override', function () {
+it('leaves single-service compose preview ports to proxy discovery when a domain has no override', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
         'compose_parsing_version' => '3',
@@ -565,9 +565,9 @@ YAML,
     $parsedCompose = applicationParser($this->application->fresh(), 118, $preview->id);
     $labels = collect(data_get($parsedCompose, 'services.frontend-pr-118.labels'));
 
-    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=4000')))
-        ->toBeTrue()
-        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 4000}}')))
+    expect($labels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams}}')))
         ->toBeTrue();
 });
 
@@ -672,3 +672,91 @@ it('does not warn when re-saving a preview domain with the same custom port', fu
         ->assertSet('showPortWarningModal', false)
         ->assertDispatched('success');
 });
+
+it('checks compose preview ports against the selected service when saving domains', function (string $action, int $port, bool $warn) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    expose:
+      - 8080
+      - 8081
+    ports:
+      - target: 8082
+        published: 18082
+      - "18083:8083"
+  api:
+    image: nginx:alpine
+    expose:
+      - 9090
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://existing.example.com'],
+            'api' => ['domain' => 'https://api.example.com:9090'],
+        ]),
+    ]);
+    $preview = createPreviewForPortTests($this->application, 130, [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com']]),
+        'fqdn' => 'https://existing.example.com',
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    if ($action === 'add') {
+        $component->set('newDomainService', 'web')
+            ->set('newDomainParts.host', 'new.example.com')
+            ->set('newDomainParts.port', (string) $port)
+            ->call('addDomain');
+        $domain = 'https://new.example.com';
+    } else {
+        $component->call('startEdit', 0)
+            ->set('editingDomainParts.port', (string) $port)
+            ->call('updateDomain');
+        $domain = 'https://existing.example.com';
+    }
+
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', $warn);
+
+    if ($warn) {
+        expect($preview->fresh()->domain_port_overrides ?? [])->not->toHaveKey($domain);
+        $component->assertSet('unrecognizedPort', $port)
+            ->call('confirmUseUnknownPort')
+            ->assertSet('showPortWarningModal', false);
+    }
+
+    $component->assertDispatched('success');
+    expect($preview->fresh()->domain_port_overrides[$domain] ?? null)->toBe($port);
+})->with(['add', 'edit'])->with([
+    'first exposed port' => [8080, false],
+    'second exposed port' => [8081, false],
+    'long syntax target' => [8082, false],
+    'short syntax target' => [8083, false],
+    'global port' => [3000, true],
+    'another service port' => [9090, true],
+    'published host port' => [18082, true],
+]);
+
+it('keeps an existing custom compose preview port without another warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+    ]);
+    $preview = createPreviewForPortTests($this->application, 131, [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+        'fqdn' => 'https://existing.example.com:7070',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '7070')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->domain_port_overrides['https://existing.example.com'] ?? null)->toBe(7070);
+});
diff --git a/tests/Feature/Service/EditDomainPortValidationTest.php b/tests/Feature/Service/EditDomainPortValidationTest.php
index 0d569574ff..29e1f0b339 100644
--- a/tests/Feature/Service/EditDomainPortValidationTest.php
+++ b/tests/Feature/Service/EditDomainPortValidationTest.php
@@ -48,6 +48,7 @@ beforeEach(function () {
     // Create service with a name that maps to a template with required port
     $this->service = Service::factory()->create([
         'name' => 'supabase-test123',
+        'service_type' => 'supabase',
         'server_id' => $this->server->id,
         'destination_id' => $this->destination->id,
         'destination_type' => $this->destination->getMorphClass(),
@@ -99,6 +100,67 @@ it('loads a persisted port override in the service application editor', function
         ->assertOk();
 });
 
+it('preserves a legacy embedded port when only the description changes', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication->fresh(),
+    ])
+        ->set('description', 'Updated description')
+        ->call('submitApplication')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('fqdn', 'http://example.com:8080');
+
+    expect($this->serviceApplication->fresh())
+        ->description->toBe('Updated description')
+        ->fqdn->toBe('http://example.com')
+        ->domain_port_overrides->toBe(['http://example.com' => 8080]);
+});
+
+it('loads a legacy embedded port in the domain editor', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->assertSet('fqdn', 'http://example.com:8080')
+        ->assertOk();
+});
+
+it('prefers a persisted override over a legacy embedded port', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => json_encode(['http://example.com' => 3000]),
+    ]);
+
+    expect($this->serviceApplication->fresh()->url)->toBe('http://example.com:3000');
+});
+
+it('allows explicit removal of a legacy embedded port', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->set('fqdn', 'http://example.com')
+        ->call('submit')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmRemovePort')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false);
+
+    expect($this->serviceApplication->fresh())
+        ->fqdn->toBe('http://example.com')
+        ->url->toBe('http://example.com')
+        ->domain_port_overrides->toBeNull();
+});
+
 it('initializes route state when mounting a service application directly', function () {
     Livewire::test(Index::class, [
         'serviceApplication' => $this->serviceApplication,
diff --git a/tests/Feature/ServiceRoutingPortTest.php b/tests/Feature/ServiceRoutingPortTest.php
new file mode 100644
index 0000000000..dc4b489290
--- /dev/null
+++ b/tests/Feature/ServiceRoutingPortTest.php
@@ -0,0 +1,62 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('does not infer a custom service port from a coincidental template name', function (int $version, string $name, ?string $type, string $declarations, ?int $expected) {
+    expect(config('database.connections.'.config('database.default').'.driver'))->toBe('sqlite');
+    expect(config('database.connections.'.config('database.default').'.database'))->toBe(':memory:');
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['generate_exact_labels' => false]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'name' => 'custom-stack',
+        'service_type' => $type,
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  {$name}:\n    image: httpd:2.4-alpine\n{$declarations}",
+        'compose_parsing_version' => (string) $version,
+    ]);
+    ServiceApplication::create([
+        'name' => $name,
+        'service_id' => $service->id,
+        'image' => 'httpd:2.4-alpine',
+        'fqdn' => 'https://apache.example.com',
+    ]);
+    $parsed = $service->fresh()->parse();
+    $labels = collect(data_get($parsed, 'services'))->flatMap(fn ($entry) => data_get($entry, 'labels', []));
+    $ports = $labels->filter(fn ($label) => str_contains($label, '.loadbalancer.server.port='))->values()->all();
+    if ($expected === null) {
+        expect($ports)->toBeEmpty();
+        expect($labels->filter(fn ($label) => str_contains($label, 'reverse_proxy'))->implode(' '))->not->toContain('upstreams 3000');
+    } else {
+        expect($ports)->not->toBeEmpty();
+        foreach ($ports as $port) {
+            expect($port)->toEndWith('.loadbalancer.server.port='.$expected);
+        }
+    }
+})->with([4, 5])->with([
+    'UDP before HTTP' => ['web', null, "    expose: ['53/udp', '8080/tcp']\n", 8080],
+    'UDP only discovery' => ['web', null, "    expose: ['53/udp']\n", null],
+    'custom collision' => ['grafana', null, "    expose: [80]\n", 80],
+    'custom discovery' => ['grafana', null, '', null],
+    'unrelated template child' => ['web', 'grafana', '', null],
+    'real template' => ['wordpress', 'wordpress-without-database', "    environment:\n      - SERVICE_URL_WORDPRESS\n", 80],
+    'explicit magic port' => ['web', null, "    expose: [80]\n    environment:\n      - SERVICE_URL_WEB_8080\n", 8080],
+]);
diff --git a/tests/Feature/ServiceTemplatePortLookupTest.php b/tests/Feature/ServiceTemplatePortLookupTest.php
index 1e228811dd..28f8cee3c4 100644
--- a/tests/Feature/ServiceTemplatePortLookupTest.php
+++ b/tests/Feature/ServiceTemplatePortLookupTest.php
@@ -25,3 +25,9 @@ YAML,
 
     expect($app->getRequiredPort())->toBe(80);
 });
+
+it('does not infer a template port from a custom display name', function () {
+    $service = new Service(['name' => 'grafana-custom', 'service_type' => null]);
+
+    expect($service->getRequiredPort())->toBeNull();
+});

From b123356acd82cc137f67f207fba900a660e1f756 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 7 Sep 2026 16:46:37 +0200
Subject: [PATCH 45/48] feat: add backup controls, resource search, and
 Sentinel enablement

Unify service backup history with pagination, schedule settings actions, S3 destination details, and team-safe access checks. Display server built-ins as read-only variables and add loading and empty states for searchable resources.
---
 app/Livewire/Project/Database/BackupEdit.php  |   8 +
 app/Livewire/Project/Database/BackupNow.php   |   7 +
 .../Database/CreateScheduledBackup.php        |   3 +-
 .../Project/Service/BackupExecutions.php      | 128 +++++---
 .../Project/Service/VolumeBackup/Index.php    |  16 +
 app/Livewire/Server/Resources.php             |  51 ++-
 app/Livewire/Server/Sentinel/Logs.php         |  30 ++
 resources/css/app.css                         |   2 +-
 .../shared-variables/editor.blade.php         |  36 ++-
 .../database/backup-edit/general.blade.php    |   6 +-
 .../project/database/backup-edit/s3.blade.php |   4 +-
 .../project/database/backup-now.blade.php     |   4 +-
 .../service/backup-executions.blade.php       |  22 +-
 .../service/volume-backup/index.blade.php     |  28 +-
 .../views/livewire/server/resources.blade.php |  64 ++--
 .../livewire/server/sentinel/logs.blade.php   |  30 +-
 .../shared-variables/server/show.blade.php    |   3 +-
 tests/Feature/BackupEditValidationTest.php    |  38 ++-
 tests/Feature/BackupNowAvailabilityTest.php   | 132 ++++++++
 .../CreateScheduledBackupValidationTest.php   |  15 +-
 tests/Feature/Livewire/SentinelLogsTest.php   | 127 ++++++++
 .../Feature/ServerResourcesPaginationTest.php | 141 +++++++++
 tests/Feature/ServiceResourceRoutingTest.php  | 296 +++++++++++++++++-
 tests/Feature/SharedVariableDevViewTest.php   |  35 +++
 24 files changed, 1110 insertions(+), 116 deletions(-)
 create mode 100644 tests/Feature/BackupNowAvailabilityTest.php
 create mode 100644 tests/Feature/Livewire/SentinelLogsTest.php
 create mode 100644 tests/Feature/ServerResourcesPaginationTest.php

diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 64f6844757..4a709d2b96 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -242,6 +242,14 @@ class BackupEdit extends Component
         try {
             $this->authorize('manageBackups', $this->backup->database);
 
+            $database = $this->backup->database->refresh();
+            $this->status = $database->status;
+            if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
+                $this->dispatch('error', 'The database must be running to start a backup.');
+
+                return;
+            }
+
             DatabaseBackupJob::dispatch($this->backup);
             $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
 
diff --git a/app/Livewire/Project/Database/BackupNow.php b/app/Livewire/Project/Database/BackupNow.php
index e4ed2a366c..8c83e33556 100644
--- a/app/Livewire/Project/Database/BackupNow.php
+++ b/app/Livewire/Project/Database/BackupNow.php
@@ -17,6 +17,13 @@ class BackupNow extends Component
         try {
             $this->authorize('manageBackups', $this->backup->database);
 
+            $database = $this->backup->database->refresh();
+            if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
+                $this->dispatch('error', 'The database must be running to start a backup.');
+
+                return;
+            }
+
             DatabaseBackupJob::dispatch($this->backup);
             $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Project/Database/CreateScheduledBackup.php b/app/Livewire/Project/Database/CreateScheduledBackup.php
index b4236b215a..96d2ac7aaf 100644
--- a/app/Livewire/Project/Database/CreateScheduledBackup.php
+++ b/app/Livewire/Project/Database/CreateScheduledBackup.php
@@ -85,11 +85,10 @@ class CreateScheduledBackup extends Component
             $databaseBackup = ScheduledDatabaseBackup::create($payload);
             if ($database->getMorphClass() === ServiceDatabase::class) {
                 $service = $database->service;
-                $this->redirectRoute('project.service.database.backup.show', [
+                $this->redirectRoute('project.service.volume-backups.index', [
                     'project_uuid' => $service->project()->uuid,
                     'environment_uuid' => $service->environment->uuid,
                     'service_uuid' => $service->uuid,
-                    'stack_service_uuid' => $database->uuid,
                     'backup_uuid' => $databaseBackup->uuid,
                 ], navigate: true);
             } else {
diff --git a/app/Livewire/Project/Service/BackupExecutions.php b/app/Livewire/Project/Service/BackupExecutions.php
index 87f24fb1da..6d7fb97f68 100644
--- a/app/Livewire/Project/Service/BackupExecutions.php
+++ b/app/Livewire/Project/Service/BackupExecutions.php
@@ -9,16 +9,21 @@ use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
+use Illuminate\Database\Query\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
+use Livewire\WithPagination;
 
 class BackupExecutions extends Component
 {
     use AuthorizesRequests;
+    use WithPagination;
 
     public Service $service;
 
+    public int $perPage = 10;
+
     public bool $executionModalOpen = false;
 
     public ?array $selectedExecution = null;
@@ -40,10 +45,18 @@ class BackupExecutions extends Component
         $this->authorize('view', $this->service);
     }
 
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+        $this->resetPage('executionsPage');
+    }
+
     public function openExecution(string $executionUuid): void
     {
-        $this->selectedExecution = $this->executions()->firstWhere('uuid', $executionUuid);
-        abort_unless($this->selectedExecution, 404);
+        $this->authorize('view', $this->service);
+        $execution = $this->executionQuery($executionUuid)->first();
+        abort_unless($execution, 404);
+        $this->selectedExecution = $this->formatExecutions(collect([$execution]))->first();
         $this->executionModalOpen = true;
     }
 
@@ -55,70 +68,89 @@ class BackupExecutions extends Component
 
     public function render(): View
     {
+        $this->authorize('view', $this->service);
+        $executions = $this->executionQuery()->paginate($this->perPage, pageName: 'executionsPage');
+        if ($executions->currentPage() > $executions->lastPage()) {
+            $this->setPage($executions->lastPage(), 'executionsPage');
+            $executions = $this->executionQuery()->paginate($this->perPage, pageName: 'executionsPage');
+        }
+        $executions->setCollection($this->formatExecutions($executions->getCollection()));
+
         return view('livewire.project.service.backup-executions', [
-            'executions' => $this->executions(),
+            'executions' => $executions,
         ]);
     }
 
-    private function executions(): Collection
+    private function executionQuery(?string $uuid = null): Builder
     {
         $databaseScheduleIds = ScheduledDatabaseBackup::query()
             ->where('database_type', (new ServiceDatabase)->getMorphClass())
             ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
-            ->pluck('id');
+            ->select('id');
+        $volumeScheduleIds = ScheduledVolumeBackup::query()
+            ->forService($this->service)
+            ->select('id');
 
         $databaseExecutions = ScheduledDatabaseBackupExecution::query()
-            ->with('scheduledDatabaseBackup.database')
+            ->select('id', 'uuid', 'created_at')
+            ->selectRaw("'database' as type")
             ->whereIn('scheduled_database_backup_id', $databaseScheduleIds)
-            ->latest()
-            ->limit(100)
-            ->get()
-            ->map(fn (ScheduledDatabaseBackupExecution $execution): array => [
-                'id' => 'database:'.$execution->id,
+            ->when($uuid !== null, fn ($query) => $query->where('uuid', $uuid));
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->select('id', 'uuid', 'created_at')
+            ->selectRaw("'storage' as type")
+            ->whereIn('scheduled_volume_backup_id', $volumeScheduleIds)
+            ->when($uuid !== null, fn ($query) => $query->where('uuid', $uuid));
+
+        return $databaseExecutions->toBase()
+            ->unionAll($volumeExecutions->toBase())
+            ->orderByDesc('created_at')
+            ->orderByDesc('id')
+            ->orderBy('type');
+    }
+
+    private function formatExecutions(Collection $rows): Collection
+    {
+        $databaseExecutions = ScheduledDatabaseBackupExecution::query()
+            ->with(['scheduledDatabaseBackup.database', 'scheduledDatabaseBackup.s3'])
+            ->whereIn('id', $rows->where('type', 'database')->pluck('id'))
+            ->get()->keyBy('id');
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->with(['scheduledVolumeBackup.backupable.resource', 's3'])
+            ->whereIn('id', $rows->where('type', 'storage')->pluck('id'))
+            ->get()->keyBy('id');
+
+        return $rows->map(function (object $row) use ($databaseExecutions, $volumeExecutions): array {
+            $isDatabase = $row->type === 'database';
+            $execution = $isDatabase ? $databaseExecutions->get($row->id) : $volumeExecutions->get($row->id);
+            $schedule = $isDatabase ? $execution->scheduledDatabaseBackup : $execution->scheduledVolumeBackup;
+            $storage = $isDatabase ? ($schedule->save_s3 ? $schedule->s3 : null) : $execution->s3;
+            if ($storage?->team_id !== currentTeam()->id) {
+                $storage = null;
+            }
+            $storageLabel = $storage ? $storage->name.' (bucket: '.$storage->bucket.')' : 'Unavailable';
+            if ($isDatabase && ! $schedule->save_s3) {
+                $storageLabel = 'Not configured';
+            } elseif (! $isDatabase && ! $execution->s3_storage_id && ! $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
+                $storageLabel = 'No destination recorded';
+            }
+
+            return [
+                'id' => $row->type.':'.$execution->id,
                 'uuid' => $execution->uuid,
-                'target' => $execution->scheduledDatabaseBackup->database->human_name ?: $execution->scheduledDatabaseBackup->database->name,
-                'type' => 'Database',
-                'schedule' => $execution->scheduledDatabaseBackup->frequency,
+                'target' => $isDatabase ? ($schedule->database->human_name ?: $schedule->database->name) : $schedule->targetName(),
+                'type' => $isDatabase ? 'Database' : $schedule->targetType(),
+                'schedule' => $schedule->frequency,
+                's3_tooltip' => ($isDatabase ? 'Current schedule S3 storage: ' : 'S3 storage: ').$storageLabel,
                 'status' => $execution->status,
                 'started_at' => $execution->created_at,
                 'size' => $execution->size,
                 'message' => $execution->message,
                 'filename' => $execution->filename,
                 'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
-                    ? route('download.backup', $execution->id)
+                    ? route($isDatabase ? 'download.backup' : 'download.volume-backup', $execution->id)
                     : null,
-            ]);
-
-        $volumeSchedules = ScheduledVolumeBackup::query()
-            ->with('backupable.resource')
-            ->forService($this->service)
-            ->get()
-            ->keyBy('id');
-        $volumeExecutions = ScheduledVolumeBackupExecution::query()
-            ->whereIn('scheduled_volume_backup_id', $volumeSchedules->keys())
-            ->latest()
-            ->limit(100)
-            ->get()
-            ->map(function (ScheduledVolumeBackupExecution $execution) use ($volumeSchedules): array {
-                $schedule = $volumeSchedules->get($execution->scheduled_volume_backup_id);
-
-                return [
-                    'id' => 'storage:'.$execution->id,
-                    'uuid' => $execution->uuid,
-                    'target' => $schedule->targetName(),
-                    'type' => $schedule->targetType(),
-                    'schedule' => $schedule->frequency,
-                    'status' => $execution->status,
-                    'started_at' => $execution->created_at,
-                    'size' => $execution->size,
-                    'message' => $execution->message,
-                    'filename' => $execution->filename,
-                    'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
-                        ? route('download.volume-backup', $execution->id)
-                        : null,
-                ];
-            });
-
-        return $databaseExecutions->concat($volumeExecutions)->sortByDesc('started_at')->values();
+            ];
+        });
     }
 }
diff --git a/app/Livewire/Project/Service/VolumeBackup/Index.php b/app/Livewire/Project/Service/VolumeBackup/Index.php
index e856d1373a..600b8b9047 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Index.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Index.php
@@ -11,6 +11,7 @@ use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Url;
 use Livewire\Component;
 
 class Index extends Component
@@ -23,6 +24,9 @@ class Index extends Component
 
     public string $search = '';
 
+    #[Url(as: 'backup_uuid', except: '')]
+    public string $backupUuid = '';
+
     public bool $scheduleModalOpen = false;
 
     public ?ScheduledDatabaseBackup $selectedDatabaseBackup = null;
@@ -38,6 +42,7 @@ class Index extends Component
         return [
             'refreshVolumeBackups' => '$refresh',
             'modalClosed' => 'closeScheduleModal',
+            "echo-private:team.{$teamId},ServiceChecked" => '$refresh',
             "echo-private:team.{$teamId},BackupCreated" => '$refresh',
         ];
     }
@@ -49,10 +54,14 @@ class Index extends Component
         $this->parameters = get_route_parameters();
         $this->search = request()->string('search')->toString();
 
+        if ($this->backupUuid !== '') {
+            $this->openSchedule($this->backupUuid);
+        }
     }
 
     public function openSchedule(string $backupUuid): void
     {
+        $this->authorize('update', $this->service);
         $this->loadSelectedSchedule($backupUuid);
         $this->s3s = currentTeam()->s3s;
         $this->scheduleModalOpen = true;
@@ -60,6 +69,7 @@ class Index extends Component
 
     public function closeScheduleModal(): void
     {
+        $this->backupUuid = '';
         $this->scheduleModalOpen = false;
         $this->selectedDatabaseBackup = null;
         $this->selectedVolumeBackup = null;
@@ -72,6 +82,12 @@ class Index extends Component
                 $this->loadSelectedSchedule($backupUuid);
                 abort_unless($this->selectedDatabaseBackup, 404);
                 $this->authorize('manageBackups', $this->selectedDatabaseBackup->database);
+                if (! str($this->selectedDatabaseBackup->database->status)->startsWith('running')) {
+                    $this->selectedDatabaseBackup = null;
+                    $this->dispatch('error', 'The database must be running to start a backup.');
+
+                    return;
+                }
                 DatabaseBackupJob::dispatch($this->selectedDatabaseBackup);
             } else {
                 abort_unless($type === 'storage', 404);
diff --git a/app/Livewire/Server/Resources.php b/app/Livewire/Server/Resources.php
index 9ea87161d8..5d0d2538bd 100644
--- a/app/Livewire/Server/Resources.php
+++ b/app/Livewire/Server/Resources.php
@@ -5,11 +5,29 @@ namespace App\Livewire\Server;
 use App\Models\Server;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Pagination\LengthAwarePaginator;
 use Livewire\Component;
+use Livewire\WithPagination;
 
 class Resources extends Component
 {
     use AuthorizesRequests;
+    use WithPagination;
+
+    public int $perPage = 10;
+
+    public string $search = '';
+
+    public function updatedSearch(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+        $this->resetPage();
+    }
 
     public ?Server $server = null;
 
@@ -93,6 +111,10 @@ class Resources extends Component
     public function loadManagedContainers()
     {
         try {
+            if ($this->activeTab !== 'managed') {
+                $this->search = '';
+                $this->resetPage();
+            }
             $this->activeTab = 'managed';
             $this->server->refresh();
         } catch (\Throwable $e) {
@@ -102,6 +124,10 @@ class Resources extends Component
 
     public function loadUnmanagedContainers()
     {
+        if ($this->activeTab !== 'unmanaged') {
+            $this->search = '';
+            $this->resetPage();
+        }
         $this->activeTab = 'unmanaged';
         try {
             $this->unmanagedContainers = $this->server->loadUnmanagedContainers()->toArray();
@@ -125,6 +151,29 @@ class Resources extends Component
 
     public function render()
     {
-        return view('livewire.server.resources');
+        $resources = $this->activeTab === 'managed'
+            ? $this->server->definedResources()->sortBy('name', SORT_NATURAL)
+            : collect($this->unmanagedContainers)->sortBy('Names', SORT_NATURAL);
+        $search = trim($this->search);
+        if ($search !== '') {
+            $nameKey = $this->activeTab === 'managed' ? 'name' : 'Names';
+            $resources = $resources->filter(fn ($resource) => str((string) data_get($resource, $nameKey))
+                ->contains($search, ignoreCase: true));
+        }
+        $this->perPage = max(1, min(100, $this->perPage));
+        $lastPage = max(1, (int) ceil($resources->count() / $this->perPage));
+        $page = max(1, min((int) $this->getPage(), $lastPage));
+        if ($page !== $this->getPage()) {
+            $this->setPage($page);
+        }
+
+        return view('livewire.server.resources', [
+            'resources' => new LengthAwarePaginator(
+                $resources->forPage($page, $this->perPage)->values(),
+                $resources->count(),
+                $this->perPage,
+                $page,
+            ),
+        ]);
     }
 }
diff --git a/app/Livewire/Server/Sentinel/Logs.php b/app/Livewire/Server/Sentinel/Logs.php
index 1190cd59a1..49739ac6dd 100644
--- a/app/Livewire/Server/Sentinel/Logs.php
+++ b/app/Livewire/Server/Sentinel/Logs.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Server\Sentinel;
 
+use App\Actions\Server\StartSentinel;
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\View\View;
@@ -29,6 +30,35 @@ class Logs extends Component
         $this->authorize('viewSentinel', $this->server);
     }
 
+    public function enableSentinel(): void
+    {
+        $this->authorize('manageSentinel', $this->server);
+
+        try {
+            $this->server->refresh();
+            if ($this->server->isBuildServer()) {
+                $this->dispatch('error', 'Sentinel cannot be enabled on build servers.');
+
+                return;
+            }
+            if ($this->server->isSwarm()) {
+                $this->dispatch('error', 'Sentinel cannot be enabled on Swarm servers.');
+
+                return;
+            }
+            if ($this->server->isSentinelEnabled()) {
+                return;
+            }
+
+            StartSentinel::run($this->server, true);
+            $this->server->refresh();
+            $this->dispatch('refreshServerShow');
+            $this->dispatch('success', 'Sentinel has been enabled.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function render(): View
     {
         return view('livewire.server.sentinel.logs');
diff --git a/resources/css/app.css b/resources/css/app.css
index 06f0b251af..65bce6327d 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -2521,7 +2521,7 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 .service-backup-table-grid {
-    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 7.5rem;
+    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 12.5rem;
     width: 100%;
 }
 
diff --git a/resources/views/components/shared-variables/editor.blade.php b/resources/views/components/shared-variables/editor.blade.php
index 810b7f69cf..c2c85a3e4e 100644
--- a/resources/views/components/shared-variables/editor.blade.php
+++ b/resources/views/components/shared-variables/editor.blade.php
@@ -5,6 +5,7 @@
     'title',
     'view',
     'variablesLabel',
+    'readOnlyKeys' => [],
 ])
 
 @php
@@ -105,15 +106,32 @@
                     <div class="data-table-header env-table-grid-shared order-[-1]">
                         <span>Name</span>
                         <span>Scope</span>
-                        <span>Comment</span>
+                        <span>{{ count($readOnlyKeys) ? 'Value / comment' : 'Comment' }}</span>
                         <span class="text-center">Multiline</span>
                         <span></span>
                     </div>
                     @foreach ($variables as $env)
-                        <livewire:project.shared.environment-variable.show
-                            wire:key="shared-variable-{{ $type }}-{{ $env->id }}" :env="$env"
-                            :type="$type" :tableAlphabeticalOrder="$alphabeticalPositions[$env->id]"
-                            :tableCreationOrder="$loop->index" />
+                        @if (in_array($env->key, $readOnlyKeys))
+                            <div wire:key="shared-variable-{{ $type }}-{{ $env->id }}" class="env-table-item"
+                                :style="`order: ${sharedSort === 'alphabetical' ? {{ $alphabeticalPositions[$env->id] }} : {{ $loop->index }}}`"
+                                x-show="@js(mb_strtolower($env->key . ' ' . ($env->comment ?? '') . ' ' . $type)).includes(sharedSearch.trim().toLowerCase())">
+                                <div class="data-table-row env-table-grid-shared">
+                                    <div class="min-w-0">
+                                        <div class="env-key-label truncate font-mono text-[13px]" title="{{ $env->key }}">{{ $env->key }}</div>
+                                        <div class="text-[11px] text-neutral-500 dark:text-fg-dim">Built-in · Read-only</div>
+                                    </div>
+                                    <span class="env-type-desktop text-[13px] text-neutral-500 dark:text-fg-dim">{{ str($type)->headline() }}</span>
+                                    <span class="min-w-0 truncate font-mono text-[13px]" title="{{ $env->value }}">{{ $env->value }}</span>
+                                    <span class="data-table-cell-dash">-</span>
+                                    <span class="justify-self-end text-neutral-400 dark:text-fg-faint" title="Built-in variable, managed by Coolify"><x-reicon name="lock" class="size-3.5" /></span>
+                                </div>
+                            </div>
+                        @else
+                            <livewire:project.shared.environment-variable.show
+                                wire:key="shared-variable-{{ $type }}-{{ $env->id }}" :env="$env"
+                                :type="$type" :tableAlphabeticalOrder="$alphabeticalPositions[$env->id]"
+                                :tableCreationOrder="$loop->index" />
+                        @endif
                     @endforeach
                     <div
                         class="order-[9999] flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
@@ -122,6 +140,14 @@
                 </div>
             @endif
         @else
+            @if ($variables->whereIn('key', $readOnlyKeys)->isNotEmpty())
+                <div class="border-b border-neutral-200 p-4 dark:border-white/[0.08]">
+                    <div class="mb-2 text-[12px] text-neutral-500 dark:text-fg-dim">Built-in · Read-only</div>
+                    @foreach ($variables->whereIn('key', $readOnlyKeys)->sortBy('key') as $env)
+                        <div class="break-all font-mono text-[13px]">{{ $env->key }}={{ $env->value }}</div>
+                    @endforeach
+                </div>
+            @endif
             <form wire:submit="submit" class="p-4">
                 <x-unsaved-bar action="submit" />
                 <x-forms.textarea canGate="update" :canResource="$resource" rows="20"
diff --git a/resources/views/livewire/project/database/backup-edit/general.blade.php b/resources/views/livewire/project/database/backup-edit/general.blade.php
index 5dddec8edd..08c64b1171 100644
--- a/resources/views/livewire/project/database/backup-edit/general.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/general.blade.php
@@ -19,9 +19,9 @@
                         Disable backup
                     </x-forms.button>
                 @endif
-                @if (str($status)->startsWith('running'))
-                    <x-forms.button type="button" wire:click="backupNow">Back up now</x-forms.button>
-                @endif
+                <x-forms.button type="button" wire:click="backupNow"
+                    :disabled="! str($status)->startsWith('running')"
+                    :tooltip="! str($status)->startsWith('running') ? 'The database must be running to start a backup.' : null">Back up now</x-forms.button>
             </div>
         </div>
 
diff --git a/resources/views/livewire/project/database/backup-edit/s3.blade.php b/resources/views/livewire/project/database/backup-edit/s3.blade.php
index 180ff0a169..a06792bb09 100644
--- a/resources/views/livewire/project/database/backup-edit/s3.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/s3.blade.php
@@ -35,12 +35,12 @@
                 @endif
             </div>
             <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="s3StorageId" label="S3 storage" :required="$saveS3"
+                <x-forms.listbox id="s3StorageId" label="S3 storage" portal :required="$saveS3"
                     :options="$availableS3Storages->map(fn ($s3) => [
                         'value' => $s3->id,
                         'label' => $s3->name,
                     ])->values()->all()" />
-                <x-forms.listbox id="disableLocalBackup" label="Local copy" :disabled="! $saveS3"
+                <x-forms.listbox id="disableLocalBackup" label="Local copy" portal :disabled="! $saveS3"
                     :options="[
                         ['value' => false, 'label' => 'Keep local backup'],
                         ['value' => true, 'label' => 'Delete after S3 upload'],
diff --git a/resources/views/livewire/project/database/backup-now.blade.php b/resources/views/livewire/project/database/backup-now.blade.php
index e5b1daf8d8..6e91428573 100644
--- a/resources/views/livewire/project/database/backup-now.blade.php
+++ b/resources/views/livewire/project/database/backup-now.blade.php
@@ -1 +1,3 @@
-<x-forms.button wire:click='backupNow'>Backup Now</x-forms.button>
+<x-forms.button wire:click="backupNow"
+    :disabled="! str($backup->database->status)->startsWith('running')"
+    :tooltip="! str($backup->database->status)->startsWith('running') ? 'The database must be running to start a backup.' : null">Back up now</x-forms.button>
diff --git a/resources/views/livewire/project/service/backup-executions.blade.php b/resources/views/livewire/project/service/backup-executions.blade.php
index b5c2057cfd..ee992b9a47 100644
--- a/resources/views/livewire/project/service/backup-executions.blade.php
+++ b/resources/views/livewire/project/service/backup-executions.blade.php
@@ -21,11 +21,17 @@
 
     <x-application.settings-section title="Executions"
         helper="Review backup runs across every database and storage target in this service." flush>
+        @if ($executions->total() > 10)
+            <x-slot:actions>
+                <x-page-size-select model="perPage" livewire />
+            </x-slot:actions>
+        @endif
         @if ($executions->isEmpty())
             <x-empty size="sm" title="No backup executions"
                 description="Execution history appears here after a backup schedule runs." icon-name="browser-terminal" />
         @else
-            <div class="data-table w-full overflow-x-auto">
+            <div class="data-table relative w-full overflow-x-auto">
+                <x-table.loading target="previousPage,nextPage,setPage,perPage" text="Loading executions..." />
                 <div class="data-table-header grid min-w-[820px] grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px]">
                     <span>Target</span><span>Type</span><span>Schedule</span><span>Status</span><span>Started</span><span>Size</span><span class="text-right">Actions</span>
                 </div>
@@ -42,7 +48,13 @@
                         wire:click="openExecution('{{ $execution['uuid'] }}')"
                         wire:keydown.enter="openExecution('{{ $execution['uuid'] }}')" role="button" tabindex="0"
                         class="data-table-row grid min-w-[820px] cursor-pointer grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px] text-left text-[13px] text-neutral-700 dark:text-fg-dim">
-                        <span class="truncate font-medium text-neutral-950 dark:text-fg" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                        <span class="flex min-w-0 items-center gap-2 font-medium text-neutral-950 dark:text-fg">
+                            <span class="truncate" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                            <span tabindex="0" data-tooltip="{{ $execution['s3_tooltip'] }}"
+                                aria-label="{{ $execution['s3_tooltip'] }}" class="shrink-0 text-neutral-500 dark:text-fg-dim">
+                                <x-reicon name="cloud" class="size-3.5" aria-hidden="true" />
+                            </span>
+                        </span>
                         <span>{{ $execution['type'] }}</span><span>{{ $execution['schedule'] }}</span>
                         <span><x-status-badge :status="str($execution['status'])->headline()" :type="$statusType" /></span>
                         <span>{{ $execution['started_at']->diffForHumans() }}</span>
@@ -58,6 +70,12 @@
                         </span>
                     </div>
                 @endforeach
+                @if ($executions->hasPages())
+                    <x-table-pagination :from="$executions->firstItem()" :to="$executions->lastItem()"
+                        :total="$executions->total()" :current-page="$executions->currentPage()" :last-page="$executions->lastPage()"
+                        wire-target="previousPage,nextPage,setPage,perPage"
+                        previous-action="previousPage('executionsPage')" next-action="nextPage('executionsPage')" />
+                @endif
             </div>
         @endif
     </x-application.settings-section>
diff --git a/resources/views/livewire/project/service/volume-backup/index.blade.php b/resources/views/livewire/project/service/volume-backup/index.blade.php
index f69d3f0db2..9ac25ec39d 100644
--- a/resources/views/livewire/project/service/volume-backup/index.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/index.blade.php
@@ -240,7 +240,7 @@
 
             @if ($backups->isNotEmpty() || $databaseBackups->isNotEmpty())
                 <div class="data-table w-full overflow-x-auto" x-show="filteredBackups.length > 0">
-                    <div class="min-w-[59rem]">
+                    <div class="min-w-[64rem]">
                     <div class="data-table-header backup-table-grid service-backup-table-grid">
                         <span>Target</span>
                         <span>Type</span>
@@ -268,6 +268,8 @@
                                 default => 'neutral',
                             };
                             $databaseBackupId = 'database:'.$databaseBackup->id;
+                            $databaseS3 = $databaseBackup->s3?->team_id === currentTeam()->id ? $databaseBackup->s3 : null;
+                            $databaseS3Tooltip = ! $databaseBackup->save_s3 ? 'S3 storage: Not configured' : ($databaseS3 ? 'S3 storage: '.$databaseS3->name.' (bucket: '.$databaseS3->bucket.')' : 'S3 storage: Unavailable');
                         @endphp
                         <div wire:key="database-backup-{{ $databaseBackup->uuid }}"
                             x-show="isVisible(@js($databaseBackupId))"
@@ -282,14 +284,19 @@
                             <span>{{ $databaseBackup->frequency }}</span>
                             <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
                             <span>
-                                <x-status-badge :status="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                    :type="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'success' : 'error') : 'neutral'" />
+                                <x-status-badge :status="$databaseBackup->save_s3 ? ($databaseS3 ? 'Configured' : 'Unavailable') : 'Not set'"
+                                    :type="$databaseBackup->save_s3 ? ($databaseS3 ? 'success' : 'error') : 'neutral'"
+                                    :data-tooltip="$databaseS3Tooltip" :aria-label="$databaseS3Tooltip" tabindex="0" />
                             </span>
                             <span>{{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}</span>
-                            <span class="flex justify-end">
+                            <span class="flex justify-end gap-2" x-on:keydown.enter.stop>
                                 <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    :disabled="! str($databaseBackup->database->status)->startsWith('running')"
+                                    :tooltip="! str($databaseBackup->database->status)->startsWith('running') ? 'The database must be running to start a backup.' : null"
                                     wire:click.stop="backupNow('database', '{{ $databaseBackup->uuid }}')"
                                     wire:target="backupNow('database', '{{ $databaseBackup->uuid }}')">Back up now</x-forms.button>
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="openSchedule('{{ $databaseBackup->uuid }}')">Settings</x-forms.button>
                             </span>
                         </div>
                     @endforeach
@@ -297,6 +304,8 @@
                     @foreach ($backups as $backup)
                         @php
                             $latestExecution = $backup->latestExecution;
+                            $volumeS3 = $backup->s3?->team_id === currentTeam()->id ? $backup->s3 : null;
+                            $volumeS3Tooltip = ! $backup->save_s3 ? 'S3 storage: Not configured' : ($volumeS3 ? 'S3 storage: '.$volumeS3->name.' (bucket: '.$volumeS3->bucket.')' : 'S3 storage: Unavailable');
                             $status = $latestExecution?->status;
                             $statusLabel = match ($status) {
                                 'running' => 'In progress',
@@ -324,17 +333,20 @@
                             <span>{{ $backup->targetType() }}</span>
                             <span>{{ $backup->frequency }}</span>
                             <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
-                            <span title="{{ $backup->save_s3 ? ($backup->s3?->name ?? 'S3 storage unavailable') : 'S3 storage is not configured' }}">
-                                <x-status-badge :status="$backup->save_s3 ? ($backup->s3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                    :type="$backup->save_s3 ? ($backup->s3 ? 'success' : 'error') : 'neutral'" />
+                            <span>
+                                <x-status-badge :status="$backup->save_s3 ? ($volumeS3 ? 'Configured' : 'Unavailable') : 'Not set'"
+                                    :type="$backup->save_s3 ? ($volumeS3 ? 'success' : 'error') : 'neutral'"
+                                    :data-tooltip="$volumeS3Tooltip" :aria-label="$volumeS3Tooltip" tabindex="0" />
                             </span>
                             <span>
                                 {{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}
                             </span>
-                            <span class="flex justify-end">
+                            <span class="flex justify-end gap-2" x-on:keydown.enter.stop>
                                 <x-forms.button type="button" canGate="update" :canResource="$service"
                                     wire:click.stop="backupNow('storage', '{{ $backup->uuid }}')"
                                     wire:target="backupNow('storage', '{{ $backup->uuid }}')">Back up now</x-forms.button>
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="openSchedule('{{ $backup->uuid }}')">Settings</x-forms.button>
                             </span>
                         </div>
                     @endforeach
diff --git a/resources/views/livewire/server/resources.blade.php b/resources/views/livewire/server/resources.blade.php
index 9fb2ca2fcc..78ed0eb01a 100644
--- a/resources/views/livewire/server/resources.blade.php
+++ b/resources/views/livewire/server/resources.blade.php
@@ -30,9 +30,27 @@
                 </x-forms.button>
             </x-slot:actions>
 
+            <div class="border-b border-neutral-200 p-3 dark:border-white/[0.08]">
+                <div class="relative w-full max-w-sm">
+                    <x-reicon name="search"
+                        class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                    <input wire:model.live.debounce.300ms="search" type="search" placeholder="Search resources by name"
+                        aria-label="Search resources by name"
+                        class="h-8! w-full rounded-lg! border-neutral-200! bg-white! py-0! pr-8! pl-8! text-[12px]! shadow-none! placeholder:text-neutral-400 focus:border-accent! focus:ring-0! dark:border-white/[0.08]! dark:bg-white/[0.035]! dark:text-fg! dark:placeholder:text-fg-faint">
+                    <button type="button" wire:click="$set('search', '')" @class([
+                        'absolute top-1/2 right-2 flex size-5 -translate-y-1/2 items-center justify-center rounded text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.07] dark:hover:text-fg',
+                        'hidden' => blank($search),
+                    ]) aria-label="Clear search">
+                        <x-reicon name="x" class="size-3" />
+                    </button>
+                </div>
+            </div>
+
+            <div class="relative">
+            <div class="transition-all" wire:loading.class="pointer-events-none opacity-40 blur-[2px]"
+                wire:loading.attr="inert" wire:target="search">
             @if ($activeTab === 'managed')
-                @php($managedResources = $server->definedResources()->sortBy('name', SORT_NATURAL))
-                @if ($managedResources->count() > 0)
+                @if ($resources->total() > 0)
                     <div class="data-table">
                         <div class="data-table-header server-resources-managed-table-grid">
                             <span>Name</span>
@@ -41,9 +59,9 @@
                             <span>Type</span>
                             <span>Status</span>
                         </div>
-                        @foreach ($managedResources as $resource)
+                        @foreach ($resources as $resource)
                             @php($resourceStatus = (string) data_get($resource, 'status', 'unknown'))
-                            <div
+                            <div wire:key="managed-{{ $resource->type() }}-{{ $resource->uuid }}"
                                 class="data-table-row server-resources-managed-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
                                 <div class="min-w-0">
                                     <a class="block max-w-full truncate text-[12px] font-medium text-neutral-950 hover:underline dark:text-fg"
@@ -72,22 +90,16 @@
                                 </div>
                             </div>
                         @endforeach
-                        <div
-                            class="flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
-                            {{ $managedResources->count() }}
-                            {{ Str::plural('managed resource', $managedResources->count()) }}
-                        </div>
                     </div>
                 @else
                     <div class="p-6">
-                        <x-empty size="sm" title="No managed resources"
-                            description="Resources assigned to this server will appear here."
+                        <x-empty size="sm" :title="trim($search) !== '' ? 'No matching resources' : 'No managed resources'"
+                            :description="trim($search) !== '' ? 'Try another name or clear the search.' : 'Resources assigned to this server will appear here.'"
                             icon-name="projects" />
                     </div>
                 @endif
             @else
-                @if (count($unmanagedContainers) > 0)
-                    @php($sortedUnmanagedContainers = collect($unmanagedContainers)->sortBy('name', SORT_NATURAL))
+                @if ($resources->total() > 0)
                     <div class="data-table">
                         <div class="data-table-header server-resources-unmanaged-table-grid">
                             <span>Name</span>
@@ -95,9 +107,9 @@
                             <span>Status</span>
                             <span>Actions</span>
                         </div>
-                        @foreach ($sortedUnmanagedContainers as $resource)
+                        @foreach ($resources as $resource)
                             @php($containerState = (string) data_get($resource, 'State', 'unknown'))
-                            <div
+                            <div wire:key="unmanaged-{{ data_get($resource, 'ID') }}"
                                 class="data-table-row server-resources-unmanaged-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
                                 <div class="min-w-0 truncate text-[12px] font-medium text-neutral-950 dark:text-fg">
                                     {{ data_get($resource, 'Names') }}
@@ -139,20 +151,28 @@
                                 </div>
                             </div>
                         @endforeach
-                        <div
-                            class="flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
-                            {{ $sortedUnmanagedContainers->count() }}
-                            {{ Str::plural('unmanaged container', $sortedUnmanagedContainers->count()) }}
-                        </div>
                     </div>
                 @else
                     <div class="p-6">
-                        <x-empty size="sm" title="No unmanaged containers"
-                            description="All detected Docker containers are managed by Coolify."
+                        <x-empty size="sm" :title="trim($search) !== '' ? 'No matching containers' : 'No unmanaged containers'"
+                            :description="trim($search) !== '' ? 'Try another name or clear the search.' : 'All detected Docker containers are managed by Coolify.'"
                             icon-name="servers" />
                     </div>
                 @endif
             @endif
+            @if ($resources->total() > 0)
+                <x-table-pagination :from="$resources->firstItem()" :to="$resources->lastItem()"
+                    :total="$resources->total()" :current-page="$resources->currentPage()"
+                    :last-page="$resources->lastPage()" wire-target="previousPage,nextPage,perPage"
+                    previous-action="previousPage" next-action="nextPage">
+                    <x-slot:pageSize>
+                        <x-page-size-select model="perPage" livewire storage-key="coolify.page-size.server-resources" />
+                    </x-slot:pageSize>
+                </x-table-pagination>
+            @endif
+            </div>
+                <x-table.loading target="search" text="Searching resources..." />
+            </div>
         </x-application.settings-section>
         </div>
     </div>
diff --git a/resources/views/livewire/server/sentinel/logs.blade.php b/resources/views/livewire/server/sentinel/logs.blade.php
index 455bb55bb2..37f8367fd1 100644
--- a/resources/views/livewire/server/sentinel/logs.blade.php
+++ b/resources/views/livewire/server/sentinel/logs.blade.php
@@ -10,15 +10,27 @@
             <x-application.settings-section title="Sentinel logs"
                 helper="Search, filter, follow, copy, or download recent output from the Sentinel container."
                 flush class="logs-settings-section">
-                <x-slot:actions>
-                    <x-status-badge :status="$server->isSentinelLive() ? 'In sync' : 'Out of sync'"
-                        :type="$server->isSentinelLive() ? 'success' : 'warning'"
-                        class="logs-section-status-badge" />
-                </x-slot:actions>
-                <div class="settings-log-panel">
-                    <livewire:project.shared.get-logs :server="$server" container="coolify-sentinel"
-                        displayName="Sentinel" :collapsible="false" />
-                </div>
+                @if ($server->isSentinelEnabled())
+                    <x-slot:actions>
+                        <x-status-badge :status="$server->isSentinelLive() ? 'In sync' : 'Out of sync'"
+                            :type="$server->isSentinelLive() ? 'success' : 'warning'"
+                            class="logs-section-status-badge" />
+                    </x-slot:actions>
+                    <div class="settings-log-panel">
+                        <livewire:project.shared.get-logs :server="$server" container="coolify-sentinel"
+                            displayName="Sentinel" :collapsible="false" />
+                    </div>
+                @else
+                    <x-slot:actions>
+                        <x-forms.button canGate="manageSentinel" :canResource="$server" isHighlighted
+                            wire:click="enableSentinel">
+                            Enable Sentinel
+                        </x-forms.button>
+                    </x-slot:actions>
+                    <x-empty size="sm" title="Sentinel is disabled"
+                        description="Enable Sentinel to view its logs."
+                        icon-name="dashboard" />
+                @endif
             </x-application.settings-section>
         </div>
     </div>
diff --git a/resources/views/livewire/shared-variables/server/show.blade.php b/resources/views/livewire/shared-variables/server/show.blade.php
index 4bba5eb064..445b6899e9 100644
--- a/resources/views/livewire/shared-variables/server/show.blade.php
+++ b/resources/views/livewire/shared-variables/server/show.blade.php
@@ -4,7 +4,8 @@
     </x-slot>
 
     <x-shared-variables.editor :resource="$server"
-        :variables="$server->environment_variables->whereNotIn('key', ['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME'])"
+        :variables="$server->environment_variables"
+        :readOnlyKeys="['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME']"
         type="server" title="{{ $server->name }}"
         :view="$view" variablesLabel="Server shared variables" />
 </div>
diff --git a/tests/Feature/BackupEditValidationTest.php b/tests/Feature/BackupEditValidationTest.php
index 42a430a491..03af1bea4f 100644
--- a/tests/Feature/BackupEditValidationTest.php
+++ b/tests/Feature/BackupEditValidationTest.php
@@ -247,6 +247,7 @@ it('redirects to executions after queuing a database backup with unusable S3 sto
         'timeout' => 3600,
     ]);
     $database = $backup->database;
+    $database->update(['status' => 'running:healthy']);
     $parameters = [
         'project_uuid' => $database->project()->uuid,
         'environment_uuid' => $database->environment->uuid,
@@ -509,7 +510,7 @@ it('subscribes to database status broadcasts so Backup Now can refresh without a
         ->toHaveKey('databaseUpdated');
 });
 
-it('shows Backup Now after refresh when the database becomes running', function () {
+it('enables Back up now after refresh when the database becomes running', function () {
     $backup = createBackupForEditValidationTest($this->team, [
         'enabled' => true,
     ]);
@@ -521,17 +522,21 @@ it('shows Backup Now after refresh when the database becomes running', function
         'availableS3Storages' => $this->team->s3s,
         'status' => 'exited:unhealthy',
     ])
-        ->assertDontSee('Backup Now')
+        ->assertSee('Back up now')
         ->assertSet('status', 'exited:unhealthy');
 
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
+
     $database->update(['status' => 'running:healthy']);
 
     $component->call('refreshStatus')
         ->assertSet('status', 'running:healthy')
-        ->assertSee('Backup Now');
+        ->assertSee('Back up now');
+
+    expect($component->html())->not->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
 });
 
-it('hides Backup Now after refresh when the database stops', function () {
+it('disables Back up now after refresh when the database stops', function () {
     $backup = createBackupForEditValidationTest($this->team, [
         'enabled' => true,
     ]);
@@ -543,12 +548,33 @@ it('hides Backup Now after refresh when the database stops', function () {
         'availableS3Storages' => $this->team->s3s,
         'status' => 'running:healthy',
     ])
-        ->assertSee('Backup Now')
+        ->assertSee('Back up now')
         ->assertSet('status', 'running:healthy');
 
     $database->update(['status' => 'exited:unhealthy']);
 
     $component->call('refreshStatus')
         ->assertSet('status', 'exited:unhealthy')
-        ->assertDontSee('Backup Now');
+        ->assertSee('Back up now');
+
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
+});
+
+it('renders S3 backup selectors outside the scrollable modal', function () {
+    createS3StorageForBackupEditValidationTest($this->team);
+    $backup = createBackupForEditValidationTest($this->team);
+    $html = Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+        'section' => 's3',
+    ])->html();
+
+    $dom = new DOMDocument;
+    @$dom->loadHTML($html);
+    $xpath = new DOMXPath($dom);
+    foreach (['s3StorageId-panel', 'disableLocalBackup-panel'] as $panelId) {
+        $panels = $xpath->query('//template[@x-teleport="body"]/div[@id="'.$panelId.'"]');
+        expect($panels->length)->toBe(1);
+        expect($panels->item(0)->getAttribute('style'))->toContain('position: fixed', 'z-index: 9999');
+    }
 });
diff --git a/tests/Feature/BackupNowAvailabilityTest.php b/tests/Feature/BackupNowAvailabilityTest.php
new file mode 100644
index 0000000000..7c103e001f
--- /dev/null
+++ b/tests/Feature/BackupNowAvailabilityTest.php
@@ -0,0 +1,132 @@
+<?php
+
+use App\Jobs\DatabaseBackupJob;
+use App\Livewire\Project\Database\BackupEdit;
+use App\Livewire\Project\Database\BackupNow;
+use App\Livewire\Project\Service\VolumeBackup\Index;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $resourceAttributes = [
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ];
+    $this->service = Service::factory()->create(['server_id' => $server->id, ...$resourceAttributes]);
+    $this->databases = [
+        'standalone' => StandalonePostgresql::create([
+            ...$resourceAttributes,
+            'name' => 'postgres',
+            'postgres_password' => 'password',
+        ]),
+        'service' => ServiceDatabase::create([
+            'service_id' => $this->service->id,
+            'name' => 'postgres',
+            'image' => 'postgres:16-alpine',
+            'custom_type' => 'postgresql',
+        ]),
+    ];
+    $this->backups = collect($this->databases)->map(fn ($database) => ScheduledDatabaseBackup::create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(),
+    ]));
+    Queue::fake();
+});
+
+dataset('database backup controls', [
+    'standalone settings' => [BackupEdit::class, 'standalone'],
+    'service settings' => [BackupEdit::class, 'service'],
+    'standalone button' => [BackupNow::class, 'standalone'],
+    'service button' => [BackupNow::class, 'service'],
+    'service list' => [Index::class, 'service'],
+]);
+
+it('only enables and queues database backups for running targets', function (string $componentClass, string $type, string $status, bool $running) {
+    $database = $this->databases[$type];
+    $database->update(['status' => $status]);
+    $backup = $this->backups[$type]->fresh();
+    $parameters = $componentClass === Index::class
+        ? ['service' => $this->service]
+        : ['backup' => $backup, ...($componentClass === BackupEdit::class ? ['availableS3Storages' => collect()] : [])];
+    $component = Livewire::test($componentClass, $parameters);
+    $dom = new DOMDocument;
+    @$dom->loadHTML($component->html());
+    $buttons = (new DOMXPath($dom))->query('//button');
+    $backupButtons = [];
+    foreach ($buttons as $button) {
+        if (str_starts_with($button->getAttribute('wire:click'), 'backupNow') || str_starts_with($button->getAttribute('wire:click.stop'), 'backupNow')) {
+            $backupButtons[] = $button;
+        }
+    }
+    expect($backupButtons)->toHaveCount(1);
+    expect($backupButtons[0]->hasAttribute('disabled'))->toBe(! $running);
+
+    $component->call('backupNow', ...($componentClass === Index::class ? ['database', $backup->uuid] : []));
+    if ($running) {
+        Queue::assertPushed(DatabaseBackupJob::class);
+    } else {
+        $component->assertDispatched('error')->assertNotDispatched('success')->assertNoRedirect();
+        Queue::assertNotPushed(DatabaseBackupJob::class);
+    }
+})->with('database backup controls')->with([
+    ['running:healthy', true],
+    ['running:unhealthy', true],
+    ['exited:unhealthy', false],
+    ['restarting:unhealthy', false],
+]);
+
+it('checks current database status before queuing from a stale page', function (string $componentClass, string $type) {
+    $database = $this->databases[$type];
+    $database->update(['status' => 'running:healthy']);
+    $backup = $this->backups[$type]->fresh();
+    $parameters = $componentClass === Index::class
+        ? ['service' => $this->service]
+        : ['backup' => $backup, ...($componentClass === BackupEdit::class ? ['availableS3Storages' => collect()] : [])];
+    $component = Livewire::test($componentClass, $parameters);
+    $database->update(['status' => 'exited:unhealthy']);
+
+    $component->call('backupNow', ...($componentClass === Index::class ? ['database', $backup->uuid] : []))
+        ->assertDispatched('error')->assertNotDispatched('success')->assertNoRedirect();
+    Queue::assertNotPushed(DatabaseBackupJob::class);
+})->with('database backup controls');
+
+it('refreshes service backup buttons when the service status check completes', function () {
+    $database = $this->databases['service'];
+    $database->update(['status' => 'exited:unhealthy']);
+    $component = Livewire::test(Index::class, ['service' => $this->service]);
+    $database->update(['status' => 'running:healthy']);
+
+    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
+    expect($component->html())->not->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
+
+    $database->update(['status' => 'exited:unhealthy']);
+    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
+});
diff --git a/tests/Feature/CreateScheduledBackupValidationTest.php b/tests/Feature/CreateScheduledBackupValidationTest.php
index 1b18c31b41..a96e776a05 100644
--- a/tests/Feature/CreateScheduledBackupValidationTest.php
+++ b/tests/Feature/CreateScheduledBackupValidationTest.php
@@ -82,11 +82,10 @@ it('creates a service database backup without S3 and opens its configuration', f
 
     $backup = ScheduledDatabaseBackup::query()->sole();
 
-    $component->assertRedirectToRoute('project.service.database.backup.show', [
+    $component->assertRedirectToRoute('project.service.volume-backups.index', [
         'project_uuid' => $this->project->uuid,
         'environment_uuid' => $this->environment->uuid,
         'service_uuid' => $service->uuid,
-        'stack_service_uuid' => $database->uuid,
         'backup_uuid' => $backup->uuid,
     ]);
 
@@ -114,14 +113,22 @@ it('selects a service database when creating a backup from the unified backups p
         'custom_type' => 'postgresql',
     ]);
 
-    Livewire::test(CreateScheduledBackup::class, ['service' => $service])
+    $component = Livewire::test(CreateScheduledBackup::class, ['service' => $service])
         ->assertSee('Database')
         ->assertSee('analytics')
         ->set('selectedDatabaseUuid', $analytics->uuid)
         ->set('frequency', 'daily')
         ->call('submit');
 
-    expect(ScheduledDatabaseBackup::query()->sole()->database->is($analytics))->toBeTrue();
+    $backup = ScheduledDatabaseBackup::query()->sole();
+    expect($backup->database->is($analytics))->toBeTrue();
+
+    $component->assertRedirectToRoute('project.service.volume-backups.index', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'service_uuid' => $service->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]);
 });
 
 it('creates a clickhouse backup for its configured database', function () {
diff --git a/tests/Feature/Livewire/SentinelLogsTest.php b/tests/Feature/Livewire/SentinelLogsTest.php
new file mode 100644
index 0000000000..99d2fa1051
--- /dev/null
+++ b/tests/Feature/Livewire/SentinelLogsTest.php
@@ -0,0 +1,127 @@
+<?php
+
+use App\Actions\Server\StartSentinel;
+use App\Livewire\Project\Shared\GetLogs;
+use App\Livewire\Server\Sentinel\Logs;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::create(['id' => 0]);
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $team->members()->attach($user->id, ['role' => 'owner']);
+    session(['currentTeam' => $team]);
+    $this->actingAs($user);
+    $this->server = Server::factory()->create(['team_id' => $team->id]);
+});
+
+it('does not show sync status or fetch logs when sentinel is disabled', function (bool $recentHeartbeat) {
+    $this->server->sentinelHeartbeat(isReset: ! $recentHeartbeat);
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertSee('Sentinel is disabled')
+        ->assertSeeHtml('wire:click="enableSentinel"')
+        ->assertDontSee('Out of sync')
+        ->assertDontSee('In sync')
+        ->assertDontSeeLivewire(GetLogs::class);
+})->with([false, true]);
+
+it('shows sync status and logs when sentinel is enabled', function (bool $metricsOnly, bool $recentHeartbeat) {
+    $this->server->sentinelHeartbeat(isReset: ! $recentHeartbeat);
+    $this->server->settings()->update([
+        'is_sentinel_enabled' => ! $metricsOnly,
+        'is_metrics_enabled' => $metricsOnly,
+        'is_build_server' => false,
+    ]);
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertDontSee('Sentinel is disabled')
+        ->assertSee($recentHeartbeat ? 'In sync' : 'Out of sync')
+        ->assertSeeLivewire(GetLogs::class);
+})->with([false, true])->with([false, true]);
+
+it('enables sentinel from the logs page', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    StartSentinel::shouldRun()->once()->withArgs(function (Server $server, bool $restart): bool {
+        expect($server->id)->toBe($this->server->id);
+        expect($restart)->toBeTrue();
+        $server->settings->update(['is_sentinel_enabled' => true]);
+
+        return true;
+    });
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertDontSee('Sentinel is disabled')
+        ->assertDontSee('Enable Sentinel')
+        ->assertSeeLivewire(GetLogs::class)
+        ->assertDispatched('refreshServerShow')
+        ->assertDispatched('success');
+
+    expect($this->server->fresh()->isSentinelEnabled())->toBeTrue();
+});
+
+it('keeps sentinel disabled when startup fails', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    StartSentinel::shouldRun()->once()->andThrow(new RuntimeException('Startup failed'));
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertSee('Sentinel is disabled')
+        ->assertDontSeeLivewire(GetLogs::class)
+        ->assertDispatched('error')
+        ->assertNotDispatched('success');
+
+    expect($this->server->fresh()->isSentinelEnabled())->toBeFalse();
+});
+
+it('does not enable sentinel on unsupported servers', function (string $setting) {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false, $setting => true]);
+    StartSentinel::shouldRun()->never();
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertSee('Sentinel is disabled')
+        ->assertDispatched('error');
+})->with(['is_build_server', 'is_swarm_manager', 'is_swarm_worker']);
+
+it('denies enabling sentinel to members and users outside the server team', function (bool $crossTeam) {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    $user = User::factory()->create();
+    if (! $crossTeam) {
+        $this->server->team->members()->attach($user->id, ['role' => 'member']);
+    }
+    $this->actingAs($user);
+    StartSentinel::shouldRun()->never();
+    $component = new Logs;
+    $component->server = $this->server->fresh();
+
+    expect(fn () => $component->enableSentinel())
+        ->toThrow(AuthorizationException::class);
+    expect($this->server->fresh()->isSentinelEnabled())->toBeFalse();
+})->with([false, true]);
+
+it('does not restart sentinel when it is already enabled', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => true, 'is_build_server' => false]);
+    StartSentinel::shouldRun()->never();
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertSeeLivewire(GetLogs::class)
+        ->call('enableSentinel')
+        ->assertNotDispatched('success');
+});
diff --git a/tests/Feature/ServerResourcesPaginationTest.php b/tests/Feature/ServerResourcesPaginationTest.php
new file mode 100644
index 0000000000..0f9efaae40
--- /dev/null
+++ b/tests/Feature/ServerResourcesPaginationTest.php
@@ -0,0 +1,141 @@
+<?php
+
+use App\Livewire\Server\Resources;
+use App\Models\Server;
+
+beforeEach(function () {
+    $this->component = new Resources;
+    $this->component->server = Mockery::mock(Server::class)->makePartial();
+});
+
+it('paginates sorted resources on both tabs', function (string $tab, string $nameKey) {
+    $rows = collect(range(23, 1))->map(fn (int $id) => [$nameKey => "Resource $id"]);
+    $this->component->activeTab = $tab;
+    if ($tab === 'managed') {
+        $this->component->server->shouldReceive('definedResources')->andReturn($rows);
+    } else {
+        $this->component->unmanagedContainers = $rows->all();
+    }
+
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->total())->toBe(23)
+        ->and($page->count())->toBe(10)
+        ->and($page->pluck($nameKey)->all())->toBe(array_map(fn ($id) => "Resource $id", range(1, 10)));
+
+    $this->component->nextPage();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe(2)->and($page->count())->toBe(10)
+        ->and($page->first()[$nameKey])->toBe('Resource 11');
+
+    $this->component->nextPage();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->count())->toBe(3)->and($page->first()[$nameKey])->toBe('Resource 21');
+
+    $this->component->previousPage();
+    expect($this->component->render()->getData()['resources']->currentPage())->toBe(2);
+})->with([['managed', 'name'], ['unmanaged', 'Names']]);
+
+it('resets pagination and search when switching tabs but preserves them on refresh', function () {
+    $this->component->server->shouldReceive('refresh')->andReturnSelf();
+    $this->component->server->shouldReceive('loadUnmanagedContainers')->andReturn(collect());
+    $this->component->setPage(3);
+    $this->component->search = 'managed resource';
+    $this->component->loadUnmanagedContainers();
+    expect($this->component->getPage())->toBe(1)
+        ->and($this->component->search)->toBe('');
+    $this->component->setPage(2);
+    $this->component->search = 'container';
+    $this->component->loadUnmanagedContainers();
+    expect($this->component->getPage())->toBe(2)
+        ->and($this->component->search)->toBe('container');
+    $this->component->loadManagedContainers();
+    expect($this->component->getPage())->toBe(1)
+        ->and($this->component->search)->toBe('');
+    $this->component->setPage(2);
+    $this->component->search = 'application';
+    $this->component->loadManagedContainers();
+    expect($this->component->getPage())->toBe(2)
+        ->and($this->component->search)->toBe('application');
+});
+
+it('clamps page size and resets the page', function (int $size, int $expected) {
+    $this->component->setPage(3);
+    $this->component->perPage = $size;
+    $this->component->updatedPerPage();
+    expect($this->component->perPage)->toBe($expected)
+        ->and($this->component->getPage())->toBe(1);
+})->with([[25, 25], [0, 1], [200, 100]]);
+
+it('clamps stale pages after resources disappear including an empty list', function (int $count, int $expectedPage) {
+    $this->component->activeTab = 'unmanaged';
+    $this->component->unmanagedContainers = array_fill(0, $count, ['Names' => 'Container']);
+    $this->component->setPage(9);
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe($expectedPage)
+        ->and($this->component->getPage())->toBe($expectedPage)
+        ->and($page->total())->toBe($count);
+})->with([[12, 2], [0, 1]]);
+
+it('renders shared pagination for both resource tabs with stable row identities', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+    expect($view)->toContain('<x-table-pagination')
+        ->toContain('<x-page-size-select')
+        ->toContain('previous-action="previousPage"')
+        ->toContain('next-action="nextPage"')
+        ->toContain('wire:key="managed-')
+        ->toContain('wire:key="unmanaged-')
+        ->not->toContain('$server->definedResources()');
+});
+
+it('searches names across all pages before pagination on both tabs', function (string $tab, string $nameKey) {
+    $rows = collect(range(1, 25))->map(fn (int $id) => [$nameKey => "Resource $id"]);
+    $this->component->activeTab = $tab;
+    if ($tab === 'managed') {
+        $this->component->server->shouldReceive('definedResources')->andReturn($rows);
+    } else {
+        $this->component->unmanagedContainers = $rows->all();
+    }
+
+    $this->component->setPage(3);
+    $this->component->search = '  RESOURCE 2  ';
+    $this->component->updatedSearch();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe(1)
+        ->and($page->total())->toBe(7)
+        ->and($page->pluck($nameKey)->all())->toBe([
+            'Resource 2', 'Resource 20', 'Resource 21', 'Resource 22',
+            'Resource 23', 'Resource 24', 'Resource 25',
+        ]);
+
+    $this->component->search = 'missing';
+    $this->component->updatedSearch();
+    expect($this->component->render()->getData()['resources']->total())->toBe(0);
+
+    $this->component->search = '';
+    $this->component->updatedSearch();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->total())->toBe(25)->and($page->currentPage())->toBe(1);
+
+    $this->component->search = '   ';
+    expect($this->component->render()->getData()['resources']->total())->toBe(25);
+})->with([['managed', 'name'], ['unmanaged', 'Names']]);
+
+it('provides accessible live search and a distinct no-results message', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+
+    expect($view)->toContain('wire:model.live.debounce.300ms="search"')
+        ->toContain('aria-label="Search resources by name"')
+        ->toContain('aria-label="Clear search"')
+        ->toContain('No matching resources')
+        ->toContain('No matching containers');
+});
+
+it('shows search feedback and prevents interaction with stale results while searching', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+
+    expect($view)
+        ->toContain('<x-table.loading target="search" text="Searching resources..." />')
+        ->not->toContain('wire:loading.inline-flex wire:target="search"')
+        ->toContain('wire:loading.class="pointer-events-none opacity-40 blur-[2px]"')
+        ->toContain('wire:loading.attr="inert" wire:target="search"');
+});
diff --git a/tests/Feature/ServiceResourceRoutingTest.php b/tests/Feature/ServiceResourceRoutingTest.php
index 9d5ac5a8a8..ede6fb6fc0 100644
--- a/tests/Feature/ServiceResourceRoutingTest.php
+++ b/tests/Feature/ServiceResourceRoutingTest.php
@@ -3,14 +3,17 @@
 use App\Jobs\DatabaseBackupJob;
 use App\Jobs\VolumeBackupJob;
 use App\Livewire\Project\Database\Import as DatabaseImport;
+use App\Livewire\Project\Service\BackupExecutions;
 use App\Livewire\Project\Service\Heading;
 use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\LocalPersistentVolume;
 use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -20,6 +23,7 @@ use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
@@ -234,6 +238,7 @@ test('service database backup schedules open in the Livewire component', functio
 
 test('service database backups can be queued from the Livewire component', function () {
     Queue::fake();
+    $this->ownServiceDatabase->update(['status' => 'running:healthy']);
     $backup = ScheduledDatabaseBackup::create([
         'team_id' => $this->teamA->id,
         'frequency' => 'daily',
@@ -448,5 +453,294 @@ test('service storage backups page includes schedules from all compose databases
         ->assertSee('own-db')
         ->assertSee('analytics-db')
         ->assertSee("wire:click=\"openSchedule('{$backups->first()->uuid}')\"", false)
-        ->assertSee("wire:click=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
+        ->assertSee("wire:click.stop=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
+});
+
+test('service backup settings open automatically from the creation redirect', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('selectedDatabaseBackup.uuid', $backup->uuid)
+        ->assertSee('S3');
+});
+
+test('service backup settings reject a backup belonging to another team', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamB->id,
+        'frequency' => 'daily',
+        'database_id' => $this->otherServiceDatabase->id,
+        'database_type' => $this->otherServiceDatabase->getMorphClass(),
+    ]);
+
+    $this->expectException(ModelNotFoundException::class);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService]);
+});
+
+test('service backups have explicit settings actions for database and storage schedules', function () {
+    $databaseBackup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeBackup = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+    ]);
+
+    $html = Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])->html();
+    $dom = new DOMDocument;
+    @$dom->loadHTML($html);
+    $xpath = new DOMXPath($dom);
+    $buttons = $xpath->query('//button[contains(., "Settings")]');
+    $actions = [];
+    foreach ($buttons as $button) {
+        $actions[] = $button->getAttribute('wire:click.stop');
+    }
+
+    expect($actions)->toContain("openSchedule('{$databaseBackup->uuid}')", "openSchedule('{$volumeBackup->uuid}')");
+
+    foreach (['database' => $databaseBackup, 'storage' => $volumeBackup] as $type => $backup) {
+        $backupAction = "wire:click.stop=\"backupNow('{$type}', '{$backup->uuid}')\"";
+        $settingsAction = "wire:click.stop=\"openSchedule('{$backup->uuid}')\"";
+        expect(strpos($html, $backupAction))->toBeLessThan(strpos($html, $settingsAction));
+    }
+
+});
+
+test('members cannot open service backup settings', function () {
+    $this->userA->teams()->updateExistingPivot($this->teamA->id, ['role' => 'member']);
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertForbidden();
+});
+
+test('closing service backup settings clears the backup query parameter', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    $component = Livewire::withQueryParams(['backup_uuid' => $backup->uuid, 'search' => 'own-db'])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('backupUuid', $backup->uuid);
+
+    expect($component->effects['url']['backupUuid'])
+        ->toMatchArray(['as' => 'backup_uuid', 'use' => 'replace', 'except' => '']);
+
+    $component->dispatch('modalClosed')
+        ->assertSet('scheduleModalOpen', false)
+        ->assertSet('selectedDatabaseBackup', null)
+        ->assertSet('selectedVolumeBackup', null)
+        ->assertSet('backupUuid', '')
+        ->assertSet('search', 'own-db')
+        ->assertNoRedirect();
+});
+
+test('service execution history paginates both backup types without truncating older runs', function () {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $databaseExecutions = collect(range(1, 105))->map(fn ($index) => ScheduledDatabaseBackupExecution::forceCreate([
+        'scheduled_database_backup_id' => $schedule->id,
+        'status' => 'success',
+        'created_at' => now()->subMinutes($index),
+    ]));
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeSchedule = $volume->scheduledBackups()->create(['team_id' => $this->teamA->id, 'frequency' => 'daily']);
+    $volumeExecution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $volumeSchedule->id,
+        'status' => 'success',
+    ]);
+
+    $component = Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertViewHas('executions', function ($executions) use ($volumeExecution, $databaseExecutions) {
+            expect($executions)->toBeInstanceOf(LengthAwarePaginator::class)
+                ->and($executions->total())->toBe(106)
+                ->and($executions->count())->toBe(10)
+                ->and($executions->first()['uuid'])->toBe($volumeExecution->uuid)
+                ->and($executions->last()['uuid'])->toBe($databaseExecutions[8]->uuid);
+
+            return true;
+        })
+        ->assertSeeHtml('aria-label="Next page"');
+
+    $component->call('openExecution', $volumeExecution->uuid)
+        ->assertSet('selectedExecution.uuid', $volumeExecution->uuid)
+        ->call('closeExecutionModal');
+    $component->call('nextPage', 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 2 && $executions->first()['uuid'] === $databaseExecutions[9]->uuid);
+    $component->call('setPage', 11, 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->count() === 6 && $executions->last()['uuid'] === $databaseExecutions->last()->uuid)
+        ->call('openExecution', $databaseExecutions->last()->uuid)
+        ->assertSet('executionModalOpen', true)
+        ->assertSet('selectedExecution.uuid', $databaseExecutions->last()->uuid);
+    $component->set('perPage', 25)
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 1 && $executions->count() === 25);
+    $component->call('setPage', 999, 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 5 && $executions->count() === 6);
+    $component->set('perPage', 1000)->assertSet('perPage', 100);
+    $component->set('perPage', 0)->assertSet('perPage', 1);
+});
+
+test('service execution pagination excludes other teams and denies opening their runs', function (string $type) {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamB->id,
+        'frequency' => 'daily',
+        'database_id' => $this->otherServiceDatabase->id,
+        'database_type' => $this->otherServiceDatabase->getMorphClass(),
+    ]);
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $schedule->id,
+        'status' => 'success',
+    ]);
+
+    if ($type === 'storage') {
+        $volume = LocalPersistentVolume::create([
+            'name' => 'other-service-data',
+            'mount_path' => '/data',
+            'resource_id' => $this->otherServiceDatabase->id,
+            'resource_type' => $this->otherServiceDatabase->getMorphClass(),
+        ]);
+        $volumeSchedule = $volume->scheduledBackups()->create(['team_id' => $this->teamB->id, 'frequency' => 'daily']);
+        $execution = ScheduledVolumeBackupExecution::create([
+            'scheduled_volume_backup_id' => $volumeSchedule->id,
+            'status' => 'success',
+        ]);
+    }
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertViewHas('executions', fn ($executions) => $executions->isEmpty())
+        ->assertDontSeeHtml('aria-label="Next page"')
+        ->call('openExecution', $execution->uuid)
+        ->assertNotFound();
+})->with(['database', 'storage']);
+
+test('execution page size remains adjustable when all runs fit on one page', function () {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    foreach (range(1, 11) as $index) {
+        $schedule->executions()->create(['status' => 'success']);
+    }
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->set('perPage', 25)
+        ->assertSeeHtml('aria-label="Items per page"')
+        ->assertDontSeeHtml('aria-label="Next page"')
+        ->set('perPage', 10)
+        ->assertSeeHtml('aria-label="Next page"');
+});
+
+test('service backup lists identify the configured S3 storage without extra columns', function () {
+    foreach (['Cloudflare R2', 'Railway S3', 'Maxio S3'] as $name) {
+        $volume = LocalPersistentVolume::create([
+            'name' => 'service-data-'.str($name)->slug(),
+            'mount_path' => '/data',
+            'resource_id' => $this->ownServiceDatabase->id,
+            'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+        ]);
+        $storage = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => $name, 'bucket' => 'backups']);
+        ScheduledDatabaseBackup::create([
+            'team_id' => $this->teamA->id,
+            'frequency' => 'daily',
+            'database_id' => $this->ownServiceDatabase->id,
+            'database_type' => $this->ownServiceDatabase->getMorphClass(),
+            'save_s3' => true,
+            's3_storage_id' => $storage->id,
+        ]);
+        $volume->scheduledBackups()->create([
+            'team_id' => $this->teamA->id,
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_id' => $storage->id,
+        ]);
+    }
+
+    $html = Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])->html();
+    foreach (['Cloudflare R2', 'Railway S3', 'Maxio S3'] as $name) {
+        expect(substr_count($html, 'data-tooltip="S3 storage: '.$name.' (bucket: backups)"'))->toBe(2);
+    }
+});
+
+test('execution tooltips distinguish current database storage from the recorded storage destination', function () {
+    $original = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => 'Cloudflare R2', 'bucket' => 'original']);
+    $current = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => 'Railway S3', 'bucket' => 'current']);
+    $databaseSchedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+        'save_s3' => true,
+        's3_storage_id' => $current->id,
+    ]);
+    $databaseSchedule->executions()->create(['status' => 'success', 's3_uploaded' => true]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeSchedule = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        's3_storage_id' => $current->id,
+    ]);
+    $volumeSchedule->executions()->create(['status' => 'success', 's3_uploaded' => true, 's3_storage_id' => $original->id]);
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Railway S3 (bucket: current)"')
+        ->assertSeeHtml('data-tooltip="S3 storage: Cloudflare R2 (bucket: original)"');
+
+    $current->update(['team_id' => $this->teamB->id]);
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertDontSee('Railway S3')
+        ->assertSeeHtml('data-tooltip="S3 storage: Unavailable"');
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertDontSee('Railway S3')
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Unavailable"');
+
+    $databaseSchedule->update(['save_s3' => false]);
+    $original->delete();
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Not configured"')
+        ->assertDontSeeHtml('data-tooltip="S3 storage: Cloudflare R2 (bucket: original)"')
+        ->assertSeeHtml('data-tooltip="S3 storage: Unavailable"');
 });
diff --git a/tests/Feature/SharedVariableDevViewTest.php b/tests/Feature/SharedVariableDevViewTest.php
index 34767cf06d..9b434ef994 100644
--- a/tests/Feature/SharedVariableDevViewTest.php
+++ b/tests/Feature/SharedVariableDevViewTest.php
@@ -168,3 +168,38 @@ test('server shared variable dev view updates existing variable', function () {
     expect($var->value)->toBe('new_value')
         ->and($var->comment)->toBe('updated comment');
 });
+
+test('server shared variables display built-ins as read-only rows', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertSee('COOLIFY_SERVER_NAME')
+        ->assertSee('Built-in · Read-only')
+        ->assertDontSee('Add a variable to make it available to resources in this scope.')
+        ->assertDontSee('data-env-settings-trigger', false)
+        ->assertSet('variables', '')
+        ->call('switch')
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertSee('COOLIFY_SERVER_NAME')
+        ->assertSet('variables', '')
+        ->set('variables', "COOLIFY_SERVER_UUID=changed\nCOOLIFY_SERVER_NAME=changed\nCUSTOM=value")
+        ->call('submit');
+
+    expect($server->environment_variables()->pluck('value', 'key')->all())
+        ->toMatchArray(['COOLIFY_SERVER_UUID' => $server->uuid, 'COOLIFY_SERVER_NAME' => $server->name, 'CUSTOM' => 'value']);
+});
+
+test('server built-ins are visible to team members but not other teams', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertDontSee('Add variable');
+
+    $otherServer = Server::factory()->create(['team_id' => Team::factory()->create()->id]);
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $otherServer->uuid])
+        ->assertRedirect(route('dashboard'))
+        ->assertDontSee($otherServer->uuid);
+});

From d75881fa96b49f28f00979a18457d9960f05b60a Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 7 Sep 2026 18:29:58 +0200
Subject: [PATCH 46/48] feat(domains): keep domain drafts and move preview
 settings

Preserve in-progress domain edits and redirects across Livewire
refreshes, copy www port overrides for service redirect pairs, and
relocate preview deployment toggles from Advanced to Previews.
Unsaved bars can stay dirty via Alpine while a modal is closed, and
service domain tables stack at narrow widths.
---
 DESIGN.md                                     |   5 +-
 app/Livewire/Project/Application/Advanced.php |  10 -
 app/Livewire/Project/Application/Domains.php  |  25 +-
 app/Livewire/Project/Application/Previews.php |  22 ++
 app/Livewire/Project/Service/Domains.php      |  42 +++-
 resources/css/app.css                         |  60 +++++
 .../views/components/unsaved-bar.blade.php    |   5 +-
 .../project/application/advanced.blade.php    |  14 +-
 .../project/application/domains.blade.php     | 220 +++++++++--------
 .../application/partials/domain-row.blade.php | 143 ++++-------
 .../project/application/previews.blade.php    |  23 ++
 .../project/service/domains.blade.php         | 151 ++++++++----
 .../service/partials/domain-table.blade.php   | 131 ++++------
 tests/Feature/ApplicationDomainsTest.php      | 202 +++++++++++++---
 .../ApplicationPreviewSettingsTest.php        | 139 +++++++++++
 tests/Feature/ServiceDomainsTest.php          | 224 ++++++++++++++++--
 .../Browser/ApplicationConfigurationTest.php  |  85 +++++++
 tests/v4/Browser/ServiceConfigurationTest.php | 129 ++++++++++
 18 files changed, 1204 insertions(+), 426 deletions(-)
 create mode 100644 tests/Feature/ApplicationPreviewSettingsTest.php

diff --git a/DESIGN.md b/DESIGN.md
index a7b26bb666..b27ed68f2d 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -520,7 +520,10 @@ Do not restore the old full-width footer.
 Deferred fields in one Livewire component use one floating unsaved bar and one
 submit action. Do not add a separate “Save configuration” button to every
 card. Selectors that are safe to persist independently should use the existing
-instant-save pattern.
+instant-save pattern. When those requests share a component with a modal draft,
+pass the unsaved bar a `dirty` Alpine expression comparing that draft with its
+initial values, so unrelated saves do not hide pending changes. Mount modal save
+bars only while the modal is open to avoid inactive keyboard shortcuts.
 
 ---
 
diff --git a/app/Livewire/Project/Application/Advanced.php b/app/Livewire/Project/Application/Advanced.php
index 45e284c5dc..a9e1c0be28 100644
--- a/app/Livewire/Project/Application/Advanced.php
+++ b/app/Livewire/Project/Application/Advanced.php
@@ -27,12 +27,6 @@ class Advanced extends Component
     #[Validate(['boolean'])]
     public bool $isGitShallowCloneEnabled = false;
 
-    #[Validate(['boolean'])]
-    public bool $isPreviewDeploymentsEnabled = false;
-
-    #[Validate(['boolean'])]
-    public bool $isPrDeploymentsPublicEnabled = false;
-
     #[Validate(['boolean'])]
     public bool $isAutoDeployEnabled = true;
 
@@ -107,8 +101,6 @@ class Advanced extends Component
             $this->application->settings->is_git_submodules_enabled = $this->isGitSubmodulesEnabled;
             $this->application->settings->is_git_lfs_enabled = $this->isGitLfsEnabled;
             $this->application->settings->is_git_shallow_clone_enabled = $this->isGitShallowCloneEnabled;
-            $this->application->settings->is_preview_deployments_enabled = $this->isPreviewDeploymentsEnabled;
-            $this->application->settings->is_pr_deployments_public_enabled = $this->isPrDeploymentsPublicEnabled;
             $this->application->settings->is_auto_deploy_enabled = $this->isAutoDeployEnabled;
             $this->application->settings->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->application->settings->is_gpu_enabled = $this->isGpuEnabled;
@@ -136,8 +128,6 @@ class Advanced extends Component
             $this->isGitSubmodulesEnabled = $this->application->settings->is_git_submodules_enabled;
             $this->isGitLfsEnabled = $this->application->settings->is_git_lfs_enabled;
             $this->isGitShallowCloneEnabled = $this->application->settings->is_git_shallow_clone_enabled ?? false;
-            $this->isPreviewDeploymentsEnabled = $this->application->settings->is_preview_deployments_enabled;
-            $this->isPrDeploymentsPublicEnabled = $this->application->settings->is_pr_deployments_public_enabled ?? false;
             $this->isAutoDeployEnabled = $this->application->settings->is_auto_deploy_enabled;
             $this->isGpuEnabled = $this->application->settings->is_gpu_enabled;
             $this->gpuDriver = $this->application->settings->gpu_driver;
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 80eb9bf0a8..906cc147a0 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -150,7 +150,15 @@ class Domains extends Component
 
     public function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
+
         $this->loadDomainState();
+
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && ($row['service'] ?? null) === ($editingRow['service'] ?? null));
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     public function pollDnsChecks(): void
@@ -227,7 +235,9 @@ class Domains extends Component
 
         $this->isCompose = $this->application->build_pack === 'dockercompose';
         $this->labelsAreWritable = $this->application->settings->is_container_label_readonly_enabled === false;
-        $this->redirect = $this->application->redirect ?? 'both';
+        if ($this->pendingAction !== 'redirect' || $this->isCompose) {
+            $this->redirect = $this->application->redirect ?? 'both';
+        }
         $this->isForceHttpsEnabled = $this->application->isForceHttpsEnabled();
 
         $settings = instanceSettings();
@@ -254,6 +264,9 @@ class Domains extends Component
         }
 
         $this->composeServices = [];
+        $pendingRedirect = $this->pendingRedirectService !== null
+            ? ($this->serviceRedirects[$this->serviceRedirectWireKey($this->pendingRedirectService)] ?? null)
+            : null;
         $this->serviceRedirects = [];
         if ($this->isCompose) {
             try {
@@ -290,7 +303,9 @@ class Domains extends Component
                 $serviceEntry = $domains[$serviceName] ?? null;
                 $storedRedirect = is_array($serviceEntry) ? ($serviceEntry['redirect'] ?? null) : null;
                 $this->serviceRedirects[$this->serviceRedirectWireKey($serviceName)] = $this->normalizeRedirect(
-                    is_string($storedRedirect) ? $storedRedirect : null
+                    $this->pendingAction === 'redirect' && $serviceName === $this->pendingRedirectService
+                        ? $pendingRedirect
+                        : (is_string($storedRedirect) ? $storedRedirect : null)
                 );
             }
         }
@@ -973,7 +988,13 @@ class Domains extends Component
             return;
         }
 
+        $this->authorize('update', $this->application);
+        $wasRedirect = $this->pendingAction === 'redirect';
         $this->pendingAction = null;
+        $this->pendingRedirectService = null;
+        if ($wasRedirect) {
+            $this->refreshDomains();
+        }
     }
 
     public function addDomain(): void
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index fa0272bd64..832a0d55cf 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -19,6 +19,10 @@ class Previews extends Component
 
     public Application $application;
 
+    public bool $isPreviewDeploymentsEnabled = false;
+
+    public bool $isPrDeploymentsPublicEnabled = false;
+
     public string $deployment_uuid;
 
     public array $parameters;
@@ -41,11 +45,29 @@ class Previews extends Component
 
     public function mount()
     {
+        $this->isPreviewDeploymentsEnabled = $this->application->settings->is_preview_deployments_enabled;
+        $this->isPrDeploymentsPublicEnabled = $this->application->settings->is_pr_deployments_public_enabled ?? false;
         $this->pull_requests = collect();
         $this->parameters = get_route_parameters();
         $this->syncDockerTags();
     }
 
+    public function savePreviewSettings(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->validate([
+            'isPreviewDeploymentsEnabled' => 'boolean',
+            'isPrDeploymentsPublicEnabled' => 'boolean',
+        ]);
+
+        $this->application->settings->is_preview_deployments_enabled = $this->isPreviewDeploymentsEnabled;
+        $this->application->settings->is_pr_deployments_public_enabled = $this->isPrDeploymentsPublicEnabled;
+        $this->application->settings->save();
+
+        $this->dispatch('success', 'Settings saved.');
+        $this->dispatch('configurationChanged');
+    }
+
     private function syncDockerTags(): void
     {
         $this->previewDockerTags = [];
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index 4ac2f40b2b..b4f76d12d9 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -129,9 +129,17 @@ class Domains extends Component
 
     public function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
+
         $this->service->refresh();
         $this->service->load(['applications', 'server']);
         $this->loadDomainState();
+
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && (int) $row['service_application_id'] === (int) $editingRow['service_application_id']);
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     public function pollDnsChecks(): void
@@ -239,9 +247,14 @@ class Domains extends Component
             ])
             ->all();
 
+        $pendingRedirect = $this->serviceRedirects[$this->pendingRedirectServiceApplicationId] ?? null;
         $this->serviceRedirects = [];
         foreach ($this->service->applications as $app) {
-            $this->serviceRedirects[$app->id] = $this->normalizeRedirect($app->redirect ?? null);
+            $this->serviceRedirects[$app->id] = $this->normalizeRedirect(
+                $this->pendingAction === 'redirect' && $app->id === $this->pendingRedirectServiceApplicationId
+                    ? $pendingRedirect
+                    : $app->redirect
+            );
         }
 
         if ($this->newServiceApplicationId === null && count($this->serviceApps) > 0) {
@@ -924,6 +937,7 @@ class Domains extends Component
         }
 
         $toAdd = collect();
+        $portOverrides = $app->domain_port_overrides ?? [];
         foreach ($current as $url) {
             $counterpart = $this->wwwCounterpartUrl($url, forRedirectPairing: true);
             if ($counterpart === null) {
@@ -940,6 +954,11 @@ class Domains extends Component
                 continue;
             }
 
+            $port = $this->effectiveDomainInternalPort($url, $app);
+            if ($port['has_port_override']) {
+                $portOverrides[DomainPortOverrides::withoutPort($counterpart)] = $port['internal_port'];
+            }
+
             $knownHosts[$hostKey] = true;
             $toAdd->push($counterpart);
         }
@@ -948,12 +967,13 @@ class Domains extends Component
             return true;
         }
 
+        $app->domain_port_overrides = $portOverrides ?: null;
         $merged = $current->merge($toAdd)->unique()->values();
         $this->pendingAction = 'redirect';
         $this->pendingRedirectServiceApplicationId = $app->id;
 
-        // Skip DNS: pairing for redirects must still be configured even when DNS is not ready.
-        if (! $this->saveDomainListForApp($app, $merged)) {
+        // Counterparts inherit an existing port, so only domain conflicts need confirmation.
+        if (! $this->saveDomainListForApp($app, $merged, checkPorts: false)) {
             return false;
         }
 
@@ -980,11 +1000,24 @@ class Domains extends Component
             return;
         }
 
+        if ($this->pendingAction === 'redirect' && $this->pendingRedirectServiceApplicationId) {
+            $this->setServiceRedirect($this->pendingRedirectServiceApplicationId);
+
+            return;
+        }
+
         $this->addDomain();
     }
 
     public function cancelRemovePort(): void
     {
+        $this->authorize('update', $this->service);
+
+        if ($this->pendingAction === 'redirect' && $this->pendingRedirectServiceApplicationId) {
+            $app = $this->findServiceApp($this->pendingRedirectServiceApplicationId);
+            $this->serviceRedirects[$this->pendingRedirectServiceApplicationId] = $this->normalizeRedirect($app?->redirect);
+        }
+        $this->pendingRedirectServiceApplicationId = null;
         $this->showPortWarningModal = false;
         $this->forceSaveDomains = false;
         $this->forceRemovePort = false;
@@ -1421,6 +1454,7 @@ class Domains extends Component
         ServiceApplication $app,
         Collection $domains,
         bool $checkConflicts = true,
+        bool $checkPorts = true,
     ): bool {
         $domainString = $domains->filter()->unique()->implode(',');
         $domainString = $domainString === '' ? null : ValidationPatterns::normalizeApplicationDomains($domainString);
@@ -1447,7 +1481,7 @@ class Domains extends Component
             }
         }
 
-        if (! $this->forceRemovePort) {
+        if ($checkPorts && ! $this->forceRemovePort) {
             $requiredPort = $app->getRequiredPort();
             if ($requiredPort !== null && $domainString) {
                 $previousFqdn = $app->getOriginal('fqdn');
diff --git a/resources/css/app.css b/resources/css/app.css
index 65bce6327d..e3e20cf75e 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -4396,3 +4396,63 @@ a.command-palette-item:focus-visible {
 .dark .command-palette-arch-badge {
     color: #fcd34d;
 }
+
+/* Service domains prioritize public addresses; configuration lives in settings. */
+#service-domains-section,
+.domains-overview-container {
+    container: service-domains / inline-size;
+}
+
+.service-domains-overview-grid {
+    grid-template-columns: minmax(0, 1fr) 7.25rem 7.5rem 5.5rem 6.5rem 8rem 6.5rem;
+    column-gap: 0.75rem;
+}
+
+.data-table-row.service-domains-overview-grid {
+    padding-block: 0.5rem;
+}
+
+.service-domain-detail {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-width: 0;
+    font-size: 12px;
+}
+
+.service-domains-overview-grid > span:not(:first-child):not(:last-child) {
+    text-align: center;
+}
+
+.service-domain-detail-label {
+    display: none;
+}
+
+.service-domains-https .listbox-trigger {
+    min-width: 7rem;
+}
+
+@container service-domains (max-width: 980px) {
+    .data-table-header.service-domains-overview-grid {
+        display: none;
+    }
+
+    .data-table-row.service-domains-overview-grid {
+        grid-template-columns: repeat(2, minmax(0, 1fr));
+        gap: 0.75rem;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child {
+        grid-column: 1 / -1;
+    }
+
+    .service-domain-detail {
+        justify-content: space-between;
+        gap: 0.5rem;
+    }
+
+    .service-domain-detail-label {
+        display: inline;
+        color: var(--coollabs-fg-dim);
+    }
+}
diff --git a/resources/views/components/unsaved-bar.blade.php b/resources/views/components/unsaved-bar.blade.php
index 8d029c2fb3..cbc137e07b 100644
--- a/resources/views/components/unsaved-bar.blade.php
+++ b/resources/views/components/unsaved-bar.blade.php
@@ -5,6 +5,8 @@
     // appears when those fields differ from the last server snapshot — not on
     // incidental component state (e.g. $wire.set from x-init, display-only props).
     'targets' => null,
+    // Optional Alpine expression for drafts that survive unrelated server requests.
+    'dirty' => null,
 ])
 
 {{-- Floating "unsaved changes" pill (bottom center). Reveals itself via
@@ -40,7 +42,8 @@
         window.visualViewport?.removeEventListener('scroll', this.updateKeyboardInset);
         window.removeEventListener('resize', this.updateKeyboardInset);
     },
-}" x-bind:style="`--keyboard-inset: ${keyboardInset}px`" wire:dirty.class="is-dirty"
+}" x-bind:style="`--keyboard-inset: ${keyboardInset}px`"
+    @if ($dirty) x-bind:class="{ 'is-dirty': {{ $dirty }} }" @else wire:dirty.class="is-dirty" @endif
     wire:loading.class="is-saving"
     @keydown.enter.window="
         if ($el.classList.contains('is-dirty') &&
diff --git a/resources/views/livewire/project/application/advanced.blade.php b/resources/views/livewire/project/application/advanced.blade.php
index 429689ce7b..c6113808c5 100644
--- a/resources/views/livewire/project/application/advanced.blade.php
+++ b/resources/views/livewire/project/application/advanced.blade.php
@@ -55,7 +55,7 @@
 
         @if ($application->git_based())
             <x-application.settings-section id="advanced-deployment-section" title="Deployment"
-                helper="Automatic deployments and pull request previews.">
+                helper="Automatic deployments from Git webhooks.">
                 <div class="grid w-full gap-4 sm:grid-cols-2">
                     <x-forms.listbox id="isAutoDeployEnabled" label="Auto deploy" onChange="instantSave"
                         helper="Automatically deploy new commits based on Git webhooks."
@@ -63,18 +63,6 @@
                             ['value' => true, 'label' => 'Deploy on push (webhooks)'],
                             ['value' => false, 'label' => 'Manual deployments only'],
                         ]" :disabled="! $canUpdate" />
-                    <x-forms.listbox id="isPreviewDeploymentsEnabled" label="Preview deployments" onChange="instantSave"
-                        helper="Automatically deploy Preview Deployments for all opened PRs.<br><br>Closing a PR deletes its Preview Deployment."
-                        :options="[
-                            ['value' => false, 'label' => 'Disabled'],
-                            ['value' => true, 'label' => 'Deploy opened pull requests'],
-                        ]" :disabled="! $canUpdate" />
-                    <x-forms.listbox id="isPrDeploymentsPublicEnabled" label="PR deployment access" onChange="instantSave"
-                        helper="When public, anyone can trigger PR deployments. Otherwise fork PRs are blocked and only repository owners, members, and collaborators can trigger them."
-                        :options="[
-                            ['value' => false, 'label' => 'Repository members only'],
-                            ['value' => true, 'label' => 'Public (fork PRs allowed)'],
-                        ]" :disabled="! $canUpdate || ! $isPreviewDeploymentsEnabled" />
                 </div>
             </x-application.settings-section>
 
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index b80085b9d5..93edafde59 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -6,26 +6,31 @@
     $composeDomainGroups = collect($domainRows)
         ->groupBy(fn ($row) => $row['service'] ?? '__unknown')
         ->filter(fn ($rows) => $rows->contains(fn ($row) => ! ($row['is_suggested'] ?? false)));
-    $helperText = $isCompose
-        ? 'Manage domains for every service in this Docker Compose application.'
-        : 'Manage domains for this application.';
     $hasHttpsDomains = collect($domainRows)->contains(
         fn ($row) => ! ($row['is_suggested'] ?? false) && str_starts_with(strtolower($row['url']), 'https://')
     );
 @endphp
 
-<div class="flex flex-col gap-4"
+<div id="application-domains-section" class="domains-overview-container flex flex-col gap-4"
     x-data="{
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: @js($editingService ?? ''),
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.modalOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal && !$wire.showDomainConflictModal;
+        },
         openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
             this.editingServiceLabel = $wire.editingService || '';
             this.modalOpen = true;
-            this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
+            this.$nextTick(() => document.getElementById('editingDomainParts-host')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
+            this.editingDomainBaseline = null;
             this.editingServiceLabel = '';
         },
         matchesDomainSearch(value) {
@@ -40,56 +45,29 @@
     @if ($hasDnsChecksInProgress)
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
-    <x-application.settings-section id="domains-section" title="Domains">
-        @can('update', $application)
-            <x-slot:actions>
-                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
-                    <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
-                </x-forms.button>
-            </x-slot:actions>
-        @endcan
+    @if ($labelsAreWritable)
+        <x-callout type="warning" title="Domains managed via labels" class="mb-4">
+            Container label readonly mode is disabled. Domains must be set in the Labels section on the General page.
+        </x-callout>
+    @endif
 
-        @if ($labelsAreWritable)
-            <x-callout type="warning" title="Domains managed via labels" class="mb-4">
-                Container label readonly mode is disabled. Domains must be set in the Labels section on the General page.
-            </x-callout>
-        @endif
+    @if ($isCompose && count($composeServices) === 0)
+        <x-callout type="info" title="No services">
+            No non-database services found in the Docker Compose file. Domains can only be assigned to application
+            services.
+        </x-callout>
+    @endif
 
-        @if ($isCompose && count($composeServices) === 0)
-            <x-callout type="info" title="No services">
-                No non-database services found in the Docker Compose file. Domains can only be assigned to application
-                services.
-            </x-callout>
-        @endif
-
-        @cannot('update', $application)
-            <x-callout type="danger" title="Insufficient permissions">
-                You don't have permission to manage domains. Contact your team administrator for access.
-            </x-callout>
-        @endcannot
-
-        <p class="text-sm text-neutral-500 dark:text-fg-dim">
-            {{ $helperText }}
-        </p>
-
-        @if ($hasHttpsDomains && ! $labelsAreWritable)
-            <div class="mt-4 max-w-md">
-                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
-                    onChange="updateForceHttps"
-                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
-                    :options="[
-                        ['value' => true, 'label' => 'Enabled'],
-                        ['value' => false, 'label' => 'Disabled'],
-                    ]" :disabled="! auth()->user()->can('update', $application)" />
-            </div>
-        @endif
-
-    </x-application.settings-section>
+    @cannot('update', $application)
+        <x-callout type="danger" title="Insufficient permissions">
+            You don't have permission to manage domains. Contact your team administrator for access.
+        </x-callout>
+    @endcannot
 
     {{-- Toolbar --}}
-    <div class="mt-2 flex flex-wrap items-center gap-2">
+    <div class="flex flex-wrap items-center gap-2">
         <div class="min-w-0 flex-1">
+            <h2 id="domains-section">Domains</h2>
             <p class="text-[13px] text-neutral-500 dark:text-fg-dim">
                 {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }}
                 @if ($suggestedCount > 0)
@@ -98,7 +76,7 @@
             </p>
         </div>
         <div class="ml-auto flex flex-wrap items-center gap-2">
-            @if ($isCompose && $composeDomainGroups->isNotEmpty())
+            @if ($hasRows)
                 <div class="relative w-full sm:w-64">
                     <x-reicon name="search"
                         class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
@@ -107,6 +85,10 @@
                 </div>
             @endif
             @can('update', $application)
+                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
+                    <x-reicon name="refresh" class="size-3.5" />
+                    Check all DNS
+                </x-forms.button>
                 <div class="relative shrink-0">
                     @include('livewire.project.shared.cloudflare-autoconfigure')
                 </div>
@@ -118,7 +100,7 @@
                                 <button type="button"
                                     class="button button-highlighted">
                                     <x-reicon name="plus" class="size-3.5" />
-                                    Add
+                                    Add domain
                                 </button>
                             </x-slot:content>
                             <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
@@ -168,20 +150,46 @@
         </div>
     </div>
 
+    @if ($hasHttpsDomains && ! $labelsAreWritable)
+        <div class="flex flex-wrap items-center justify-end gap-2 service-domains-https">
+            <label for="isForceHttpsEnabled-trigger" class="mb-0! text-[12px]!">Redirect HTTP to HTTPS</label>
+            <x-helper helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL." />
+            <div class="w-28 shrink-0">
+                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled"
+                    onChange="updateForceHttps" portal
+                    :options="[
+                        ['value' => true, 'label' => 'Enabled'],
+                        ['value' => false, 'label' => 'Disabled'],
+                    ]" :disabled="! auth()->user()->can('update', $application)" />
+            </div>
+        </div>
+    @endif
+
     {{-- Table / empty --}}
     <div id="domains-table-section"
         class="application-settings-section-body mt-1 scroll-mt-28 {{ $hasRows ? 'is-flush' : '' }} w-full">
+        @if ($hasRows)
+            <div class="data-table-header service-domains-overview-grid">
+                <span>Domain</span>
+                <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+                <span class="text-right">Actions</span>
+            </div>
+        @endif
         @if ($isCompose && count($composeServices) === 0 && ! $hasRows)
             <x-empty size="sm" title="No services available"
                 description="No non-database services found in the Docker Compose file."
                 icon-name="globe" />
         @elseif ($isCompose && $composeDomainGroups->isEmpty())
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above. Choose which service receives it."
+                description="Add your first domain with the Add domain button above. Choose which service receives it."
                 icon-name="globe" />
         @elseif (! $hasRows)
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above, or generate one with the server wildcard domain."
+                description="Add your first domain with the Add domain button above, or generate one with the server wildcard domain."
                 icon-name="globe" />
         @elseif ($isCompose)
             @php
@@ -213,36 +221,10 @@
                             <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">
                                 {{ $serviceName }}
                             </span>
-                            <div class="flex shrink-0 items-center gap-2">
-                                <span class="hidden text-xs text-neutral-500 sm:inline dark:text-fg-dim">Direction</span>
-                                @if (auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                                    <x-forms.listbox id="domain-direction-service-{{ $redirectWireKey }}" :wire="false"
-                                        :value="$serviceRedirects[$redirectWireKey] ?? 'both'" preserveValue
-                                        onChange="updateServiceRedirect" :onChangeArgs="[$serviceName]" portal :options="[
-                                            ['value' => 'both', 'label' => 'Allow www & non-www'],
-                                            ['value' => 'www', 'label' => 'Redirect to www'],
-                                            ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                                        ]" />
-                                @else
-                                    <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                                        {{ match ($serviceRedirects[$redirectWireKey] ?? 'both') {
-                                            'www' => 'Redirect to www',
-                                            'non-www' => 'Redirect to non-www',
-                                            default => 'Allow both',
-                                        } }}
-                                    </span>
-                                @endif
-                            </div>
                         </div>
 
-                        <div wire:key="application-compose-domain-rows-{{ $redirectWireKey }}-{{ md5(serialize($rows->all())) }}"
+                        <div wire:key="application-compose-domain-rows-{{ $redirectWireKey }}"
                             class="data-table w-full">
-                            <div class="data-table-header domains-table-grid-service">
-                                <span>Domain</span>
-                                <span>DNS Check</span>
-                                <span class="whitespace-nowrap">Search engine indexing</span>
-                                <span></span>
-                            </div>
                             @foreach ($rows as $row)
                                 @php
                                     $index = collect($domainRows)->search(
@@ -256,9 +238,7 @@
                                     'row' => $row,
                                     'application' => $application,
                                     'labelsAreWritable' => $labelsAreWritable,
-                                    'isCompose' => false,
-                                    'showDirectionControl' => false,
-                                    'domainGridClass' => 'domains-table-grid-service',
+                                    'isCompose' => true,
                                 ])
                             @endforeach
                         </div>
@@ -273,13 +253,6 @@
             </div>
         @else
             <div class="data-table w-full">
-                <div class="data-table-header domains-table-grid">
-                    <span>Domain</span>
-                    <span>DNS Check</span>
-                    <span class="whitespace-nowrap">Search engine indexing</span>
-                    <span>Direction</span>
-                    <span></span>
-                </div>
                 @foreach ($domainRows as $index => $row)
                     @include('livewire.project.application.partials.domain-row', [
                         'index' => $index,
@@ -290,10 +263,15 @@
                     ])
                 @endforeach
             </div>
+            <div x-cloak x-show="domainSearch.trim() && !hasDomainSearchResults(@js(collect($domainRows)->pluck('url')->values()))"
+                class="px-4 py-8">
+                <x-empty size="sm" title="No domains found"
+                    description="No domain matches your search." icon-name="search" />
+            </div>
         @endif
     </div>
 
-    {{-- Edit domain modal: open/close is Alpine-only; server runs only on Save / Continue. --}}
+    {{-- One dialog for address edits and automatically saved domain settings. --}}
     <div class="relative h-auto w-auto" :class="{ 'z-40': modalOpen }"
         @keydown.window.escape="if (modalOpen) { closeEditDomain() }">
         <template x-teleport="body">
@@ -315,7 +293,7 @@
                         class="application-settings-form application-settings-section relative flex max-h-[calc(100dvh-2rem)] w-full flex-col overflow-hidden lg:w-auto lg:min-w-2xl lg:max-w-4xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header class="flex-nowrap!">
-                            <h3 class="min-w-0 flex-1 truncate">Edit domain</h3>
+                            <h3 class="min-w-0 flex-1 truncate">Domain settings</h3>
                             <button type="button" @click="closeEditDomain()"
                                 class="icon-button shrink-0" aria-label="Close">
                                 <x-reicon name="x" class="size-4" />
@@ -324,6 +302,10 @@
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
                             <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                                <template x-if="modalOpen">
+                                    <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges"
+                                        targets="updateDomain,confirmUpdateDomainDespiteDns" />
+                                </template>
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service</label>
@@ -344,19 +326,47 @@
                                     </x-callout>
                                 @endif
 
-                                <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
-                                    @if ($editDomainDnsFailed)
-                                        <x-forms.button type="button" isError
-                                            wire:click="confirmUpdateDomainDespiteDns">
-                                            Continue
-                                        </x-forms.button>
-                                    @else
-                                        <x-forms.button type="submit" wire:target="updateDomain" isHighlighted>
-                                            Save
-                                        </x-forms.button>
-                                    @endif
-                                </div>
+                                @if ($editDomainDnsFailed)
+                                    <x-forms.button type="button" isError wire:click="confirmUpdateDomainDespiteDns">Continue</x-forms.button>
+                                @endif
                             </form>
+                            @php
+                                $editingRow = $editingIndex !== null ? ($domainRows[$editingIndex] ?? null) : null;
+                            @endphp
+                            @if ($editingRow && ! $labelsAreWritable)
+                                @can('update', $application)
+                                    @php
+                                        $editingKey = hash('sha256', $editingRow['url'].'|'.($editingRow['service'] ?? ''));
+                                        $editingRedirectKey = $isCompose ? $this->serviceRedirectWireKey($editingRow['service']) : null;
+                                        $editingRedirectProperty = $isCompose ? 'serviceRedirects.'.$editingRedirectKey : 'redirect';
+                                    @endphp
+                                    <div wire:key="editing-application-domain-settings-{{ $editingKey }}"
+                                        class="mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                        <p class="sm:col-span-2 text-[12px] text-neutral-500 dark:text-fg-dim">Indexing and redirect changes save automatically.</p>
+                                        <x-forms.listbox id="application-domain-indexing-{{ $editingKey }}"
+                                            label="Search engine indexing" :wire="false" preserveValue
+                                            :value="$application->isDomainNoindexed($editingRow['url']) ? 'noindex' : 'index'"
+                                            onChange="toggleNoindexDomain" :onChangeArgs="[$editingRow['url']]" portal
+                                            :options="[
+                                                ['value' => 'index', 'label' => 'Indexable'],
+                                                ['value' => 'noindex', 'label' => 'Noindex'],
+                                            ]" />
+                                        <x-forms.listbox id="application-domain-direction-{{ $editingKey }}"
+                                            label="www redirect" :wire="false" preserveValue
+                                            :value="$isCompose ? ($serviceRedirects[$editingRedirectKey] ?? 'both') : $redirect"
+                                            :x-effect="'value = $wire.get('.json_encode($editingRedirectProperty).')'"
+                                            :helper="$isCompose ? 'Applies to all domains for this Compose service.' : 'Applies to all domains for this application.'"
+                                            :onChange="$isCompose ? 'updateServiceRedirect' : 'updateRedirect'"
+                                            :onChangeArgs="$isCompose ? [$editingRow['service']] : []" portal
+                                            :options="[
+                                                ['value' => 'both', 'label' => 'No redirect'],
+                                                ['value' => 'www', 'label' => 'Redirect to www'],
+                                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                            ]" />
+                                    </div>
+                                @endcan
+                            @endif
+
                         </div>
                     </div>
                 </div>
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index cf8970d814..da06c91464 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -7,49 +7,35 @@
         default => 'neutral',
     };
     $dnsLabel = match ($row['dns_status']) {
-        'ok' => 'DNS OK',
+        'ok' => 'DNS matches',
         'failed' => 'DNS mismatch',
         'skipped' => 'DNS skipped',
         'checking' => 'Checking DNS...',
-        'pending' => 'DNS pending',
+        'pending' => 'Not checked',
         default => 'DNS unknown',
     };
-    $gridClass = $domainGridClass ?? (($isCompose ?? false) ? 'domains-table-grid-compose' : 'domains-table-grid');
-    $domainParts = $isSuggested ? null : parse_url($row['url']);
+    $gridClass = 'service-domains-overview-grid';
+    $publicUrl = getFqdnWithoutPort($row['url']);
+    $domainParts = $isSuggested ? null : parse_url($publicUrl);
     $faviconUrl = is_array($domainParts) && isset($domainParts['scheme'], $domainParts['host'])
-        ? $domainParts['scheme'].'://'.$domainParts['host'].(isset($domainParts['port']) ? ':'.$domainParts['port'] : '').'/favicon.ico'
+        ? $domainParts['scheme'].'://'.$domainParts['host'].'/favicon.ico'
         : null;
-    $redirectPairKey = function (string $url): string {
-        $parts = parse_url($url);
-        if (! is_array($parts) || ! isset($parts['host'])) {
-            return $url;
-        }
-
-        $host = preg_replace('/^www\./i', '', $parts['host']);
-
-        return strtolower(($parts['scheme'] ?? '').'://'.$host.':'.($parts['port'] ?? '').($parts['path'] ?? ''));
-    };
-    $pairKey = $redirectPairKey($row['url']);
-    $firstPairRowIndex = collect($domainRows)
-        ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
-        ->filter(fn ($item) => ($item['service'] ?? null) === ($row['service'] ?? null))
-        ->filter(fn ($item) => $redirectPairKey($item['url']) === $pairKey)
-        ->keys()
-        ->first();
-    $showDirection = ($showDirectionControl ?? true) && ! $isSuggested && $firstPairRowIndex === $index;
+    $rowDirection = $isCompose
+        ? ($serviceRedirects[$this->serviceRedirectWireKey($row['service'])] ?? 'both')
+        : $redirect;
+    $isNoindexed = $application->isDomainNoindexed($row['url']);
     $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
 @endphp
 
 <div wire:key="domain-row-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
-    class="env-table-item">
+    x-show="matchesDomainSearch(@js(($row['service'] ?? '').' '.$row['url']))" class="env-table-item">
     <div @class([
         'data-table-row',
         $gridClass,
         'domains-row-suggested' => $isSuggested,
-        'domains-row-without-direction' => ! $showDirection,
     ])>
         <div class="flex min-w-0 flex-col gap-1">
-            <div class="flex min-w-0 flex-wrap items-center gap-2">
+            <div class="flex min-w-0 items-center gap-2">
                 @if ($isSuggested)
                     <span
                         class="min-w-0 text-[13px] text-black sm:truncate dark:text-white"
@@ -69,29 +55,15 @@
                                 class="invisible absolute inset-0 size-4 rounded-sm" />
                         </span>
                     @endif
-                    <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                        class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                        title="{{ $row['url'] }}">
-                        {{ $row['url'] }}
+                    <a href="{{ $publicUrl }}" target="_blank" rel="noopener noreferrer"
+                        class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                        title="{{ $publicUrl }}">
+                        {{ $publicUrl }}
                     </a>
-                    @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                        <span class="table-badge shrink-0"
-                            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
-                            Internal port {{ $row['internal_port'] }}
-                        </span>
-                    @else
-                        <span class="table-badge table-badge-danger shrink-0"
-                            title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
-                            No internal port
-                        </span>
-                    @endif
                 @endif
                 @if ($isSuggested && ! empty($row['suggestion_label']))
                     <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
                 @endif
-                @if ($isCompose ?? false)
-                    <span class="domains-service-mobile table-badge shrink-0">{{ $row['service'] ?? '-' }}</span>
-                @endif
             </div>
             @if ($isSuggested && filled($row['dns_message']))
                 <p class="text-[12px] leading-4 text-amber-700 sm:truncate dark:text-amber-400/90"
@@ -101,12 +73,32 @@
             @endif
         </div>
 
-        @if ($isCompose ?? false)
-            <div class="domains-service-desktop min-w-0 truncate text-[13px] text-neutral-500 dark:text-fg-dim"
-                title="{{ $row['service'] ?? '' }}">
-                {{ $row['service'] ?? '-' }}
-            </div>
-        @endif
+        <div class="service-domain-detail" title="Protocol redirect">
+            <span class="service-domain-detail-label">Protocol redirect</span>
+            <span>{{ str_starts_with($row['url'], 'https://') && $isForceHttpsEnabled ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+        </div>
+        <div class="service-domain-detail" title="Domain redirect">
+            <span class="service-domain-detail-label">Domain redirect</span>
+            <span>{{ match ($rowDirection) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+        </div>
+        <div class="service-domain-detail"
+            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the application or Compose service port' }}">
+            <span class="service-domain-detail-label">Internal port</span>
+            @if (filled($row['internal_port'] ?? null))
+                <span aria-label="Internal port {{ $row['internal_port'] }}">{{ $row['internal_port'] }}</span>
+            @else
+                <span role="img" aria-label="No internal port" title="No internal port. Set Ports Exposes or a per-domain internal port so the proxy can route this domain." class="text-red-500 dark:text-red-400">
+                    <x-reicon name="alert-triangle" class="size-4" />
+                </span>
+            @endif
+        </div>
+        <div class="service-domain-detail">
+            <span class="service-domain-detail-label">Search indexing</span>
+            <span role="img" aria-label="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}"
+                title="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}">
+                <x-reicon :name="$isNoindexed ? 'x' : 'check'" class="size-4" />
+            </span>
+        </div>
 
         <div class="flex min-w-0 items-center">
             @if ($row['dns_status'] === 'failed')
@@ -118,55 +110,6 @@
             @endif
         </div>
 
-        <div class="min-w-0" title="Search engine indexing">
-            @unless ($isSuggested)
-                <span class="domains-mobile-label">Search engine indexing</span>
-            @endunless
-            @if ($isSuggested)
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">-</span>
-            @elseif (auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                <x-forms.listbox id="domain-indexing-{{ $index }}" :wire="false"
-                    preserveValue
-                    :value="$application->isDomainNoindexed($row['url']) ? 'noindex' : 'index'"
-                    onChange="toggleNoindexDomain" :onChangeArgs="[$row['url']]" portal :options="[
-                        ['value' => 'index', 'label' => 'Indexable'],
-                        ['value' => 'noindex', 'label' => 'Noindex'],
-                    ]" />
-            @else
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                    {{ $application->isDomainNoindexed($row['url']) ? 'Noindex' : 'Indexable' }}
-                </span>
-            @endif
-        </div>
-
-        @if ($showDirectionControl ?? true)
-        <div class="min-w-0" title="Direction">
-            @php
-                $rowDirection = $domainDirection ?? $redirect;
-                $directionLabel = match ($rowDirection) {
-                    'www' => 'Redirect to www',
-                    'non-www' => 'Redirect to non-www',
-                    default => 'Allow both',
-                };
-            @endphp
-            @if ($showDirection)
-                <span class="domains-mobile-label">Direction</span>
-            @endif
-            @if ($showDirection && auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                <x-forms.listbox id="domain-direction-{{ $index }}" :wire="false" :value="$rowDirection"
-                    preserveValue
-                    :onChange="$isCompose ? 'updateServiceRedirect' : 'updateRedirect'"
-                    :onChangeArgs="$isCompose ? [$row['service']] : []" portal :options="[
-                        ['value' => 'both', 'label' => 'Allow www & non-www'],
-                        ['value' => 'www', 'label' => 'Redirect to www'],
-                        ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                    ]" />
-            @elseif ($showDirection)
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">{{ $directionLabel }}</span>
-            @endif
-        </div>
-        @endif
-
         <div class="flex items-center justify-end gap-1">
             @can('update', $application)
                 <button type="button" wire:click="checkDomainDns({{ $index }})"
@@ -193,7 +136,7 @@
                     @else
                         <button type="button" wire:click="startEdit({{ $index }})"
                             class="icon-button shrink-0"
-                            title="Edit domain" aria-label="Edit domain">
+                            title="Domain settings" aria-label="Settings for {{ $publicUrl }}">
                             <x-reicon name="settings" class="size-3.5" />
                         </button>
                         <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?" buttonTitle="Remove"
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index ac616b84a3..b85d769af3 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -1,4 +1,27 @@
 <div class="flex flex-col gap-6">
+    @if ($application->git_based())
+        @php
+            $canUpdate = auth()->user()->can('update', $application);
+        @endphp
+        <x-application.settings-section id="preview-settings-section" title="Preview settings"
+            helper="Automatic pull request deployments and who can trigger them.">
+            <div class="grid w-full gap-4 sm:grid-cols-2">
+                <x-forms.listbox id="isPreviewDeploymentsEnabled" label="Preview deployments" onChange="savePreviewSettings"
+                    helper="Automatically deploy Preview Deployments for all opened PRs.<br><br>Closing a PR deletes its Preview Deployment."
+                    :options="[
+                        ['value' => false, 'label' => 'Disabled'],
+                        ['value' => true, 'label' => 'Deploy opened pull requests'],
+                    ]" :disabled="! $canUpdate" />
+                <x-forms.listbox id="isPrDeploymentsPublicEnabled" label="PR deployment access" onChange="savePreviewSettings"
+                    helper="When public, anyone can trigger PR deployments. Otherwise fork PRs are blocked and only repository owners, members, and collaborators can trigger them."
+                    :options="[
+                        ['value' => false, 'label' => 'Repository members only'],
+                        ['value' => true, 'label' => 'Public (fork PRs allowed)'],
+                    ]" :disabled="! $canUpdate || ! $isPreviewDeploymentsEnabled" />
+            </div>
+        </x-application.settings-section>
+    @endif
+
     <livewire:project.application.preview.form :application="$application" />
 
     @if (count($application->additional_servers) > 0)
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index a02d5ae758..1f2bc6f5f1 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -15,18 +15,26 @@
     })->values();
 @endphp
 
-<div class="flex flex-col gap-4"
+<div id="service-domains-section" class="flex flex-col gap-4"
     x-data="{
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: '',
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.modalOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal && !$wire.showDomainConflictModal;
+        },
         openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
             this.editingServiceLabel = $wire.serviceApps.find(app => app.id === $wire.editingServiceApplicationId)?.name || '';
             this.modalOpen = true;
-            this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
+            this.$nextTick(() => document.getElementById('editingDomainParts-host')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
+            this.editingDomainBaseline = null;
             this.editingServiceLabel = '';
         },
         matchesDomainSearch(value) {
@@ -41,37 +49,23 @@
     @if ($hasDnsChecksInProgress)
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
-    <x-application.settings-section id="service-domains-section" title="Domains">
-        @can('update', $service)
-            <x-slot:actions>
-                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled"
-                    wire:target="checkAllDns,checkDomainDns">
-                    <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
-                </x-forms.button>
-            </x-slot:actions>
-        @endcan
-
-        @cannot('update', $service)
-            <x-callout type="danger" title="Insufficient permissions">
-                You don't have permission to manage domains. Contact your team administrator for access.
-            </x-callout>
-        @endcannot
-
-        <p class="text-sm text-neutral-500 dark:text-fg-dim">
-            Manage domains and www/non-www redirects for applications in this stack.
-        </p>
-
-    </x-application.settings-section>
+    @cannot('update', $service)
+        <x-callout type="danger" title="Insufficient permissions">
+            You don't have permission to manage domains. Contact your team administrator for access.
+        </x-callout>
+    @endcannot
 
     {{-- Toolbar --}}
     <div class="mt-2 flex flex-wrap items-center gap-2">
-        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
-            {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }}
-            @if ($suggestedCount > 0)
-                · {{ $suggestedCount }} not added
-            @endif
-        </p>
+        <div class="min-w-0 flex-1">
+            <h3>Domains</h3>
+            <p class="text-[13px] text-neutral-500 dark:text-fg-dim">
+                {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }} across {{ $domainGroups->count() }} service{{ $domainGroups->count() === 1 ? '' : 's' }}
+                @if ($suggestedCount > 0)
+                    · {{ $suggestedCount }} not added
+                @endif
+            </p>
+        </div>
         <div class="ml-auto flex flex-wrap items-center gap-2">
             @if ($domainGroups->isNotEmpty())
                 <div class="relative w-full sm:w-64">
@@ -82,6 +76,13 @@
                 </div>
             @endif
             @can('update', $service)
+                @if ($configuredCount > 0)
+                    <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled"
+                        wire:target="checkAllDns,checkDomainDns">
+                        <x-reicon name="refresh" class="size-3.5" />
+                        Check all DNS
+                    </x-forms.button>
+                @endif
                 @if ($serviceAppCount > 0)
                     <div class="relative shrink-0">
                         @include('livewire.project.shared.cloudflare-autoconfigure')
@@ -92,12 +93,12 @@
                             <button type="button"
                                 class="button button-highlighted">
                                 <x-reicon name="plus" class="size-3.5" />
-                                Add
+                                Add domain
                             </button>
                         </x-slot:content>
                         <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                             {{-- Always show which service receives the domain --}}
-                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required
+                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required portal
                                 helper="Domain will be assigned to this compose service application."
                                 :options="collect($serviceApps)->map(fn ($app) => [
                                     'value' => $app['id'],
@@ -153,12 +154,21 @@
     @elseif (! $hasRows)
         <div class="application-settings-section-body mt-1 w-full scroll-mt-28">
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above. Choose which service application receives it."
+                description="Add your first domain with the Add domain button above. Choose which service application receives it."
                 icon-name="globe" />
         </div>
     @else
         <div wire:key="service-domains-list"
             class="application-settings-section-body is-flush mt-1 w-full scroll-mt-28 overflow-visible">
+            <div class="data-table-header service-domains-overview-grid">
+                <span>Domain</span>
+                <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+                <span class="text-right">Actions</span>
+            </div>
             @foreach ($domainGroups as $appId => $rows)
                 @php
                     $app = collect($serviceApps)->firstWhere('id', (int) $appId);
@@ -173,12 +183,13 @@
                     <div class="flex w-full flex-wrap items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]">
                         <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">{{ $heading }}</span>
                         @if ($hasHttpsDomains)
-                            <div class="w-full sm:w-72">
+                            <div class="flex w-full items-center gap-2 sm:w-auto service-domains-https">
+                                <label for="service-force-https-{{ $appId }}-trigger" class="mb-0! whitespace-nowrap text-[12px]!">Redirect HTTP to HTTPS</label>
+                                <x-helper helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL." />
                                 <x-forms.listbox canGate="update" :canResource="$service" id="forceHttpsRedirects.{{ $appId }}"
-                                    htmlId="service-force-https-{{ $appId }}"
-                                    label="Redirect HTTP to HTTPS" onChange="updateForceHttps"
+                                    htmlId="service-force-https-{{ $appId }}" preserveValue
+                                    onChange="updateForceHttps"
                                     :onChangeArgs="[(int) $appId]"
-                                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
                                     :options="[
                                         ['value' => true, 'label' => 'Enabled'],
                                         ['value' => false, 'label' => 'Disabled'],
@@ -187,13 +198,13 @@
                         @endif
                     </div>
 
-                    <div wire:key="service-domain-rows-{{ $appId }}-{{ md5(serialize($rows->all())) }}">
+                    <div wire:key="service-domain-rows-{{ $appId }}">
                         @include('livewire.project.service.partials.domain-table', [
                             'rows' => $rows,
                             'domainRows' => $domainRows,
                             'service' => $service,
                             'showServiceColumn' => false,
-                            'showHeader' => true,
+                            'showHeader' => false,
                         ])
                     </div>
                 </section>
@@ -207,7 +218,7 @@
         </div>
     @endif
 
-    {{-- Edit domain modal: open/close is Alpine-only; server runs only on Save / Continue. --}}
+    {{-- One dialog for the address and domain settings. --}}
     <div class="relative h-auto w-auto" :class="{ 'z-40': modalOpen }"
         @keydown.window.escape="if (modalOpen) { closeEditDomain() }">
         <template x-teleport="body">
@@ -229,7 +240,7 @@
                         class="application-settings-form application-settings-section relative flex max-h-[calc(100dvh-2rem)] w-full flex-col overflow-hidden lg:w-auto lg:min-w-2xl lg:max-w-4xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header class="flex-nowrap!">
-                            <h3 class="min-w-0 flex-1 truncate">Edit domain</h3>
+                            <h3 class="min-w-0 flex-1 truncate">Domain settings</h3>
                             <button type="button" @click="closeEditDomain()" class="icon-button shrink-0"
                                 aria-label="Close">
                                 <x-reicon name="x" class="size-4" />
@@ -238,6 +249,10 @@
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
                             <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                                <template x-if="modalOpen">
+                                    <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges"
+                                        targets="updateDomain,confirmUpdateDomainDespiteDns" />
+                                </template>
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service application</label>
@@ -261,19 +276,50 @@
                                     </x-callout>
                                 @endif
 
-                                <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
-                                    @if ($editDomainDnsFailed)
-                                        <x-forms.button type="button" isError
-                                            wire:click="confirmUpdateDomainDespiteDns">
+                                @if ($editDomainDnsFailed)
+                                    <div class="flex justify-end">
+                                        <x-forms.button type="button" isError wire:click="confirmUpdateDomainDespiteDns">
                                             Continue
                                         </x-forms.button>
-                                    @else
-                                        <x-forms.button type="submit" wire:target="updateDomain" isHighlighted>
-                                            Save
-                                        </x-forms.button>
-                                    @endif
-                                </div>
+                                    </div>
+                                @endif
                             </form>
+                            @php
+                                $editingRow = $editingIndex !== null ? ($domainRows[$editingIndex] ?? null) : null;
+                            @endphp
+                            @if ($editingRow)
+                                @can('update', $service)
+                                    @php
+                                        $editingAppId = (int) $editingRow['service_application_id'];
+                                        $editingDomainKey = hash('sha256', $editingRow['url'].'|'.$editingAppId);
+                                        $editingNoindex = $service->applications->firstWhere('id', $editingAppId)?->isDomainNoindexed($editingRow['url']);
+                                    @endphp
+                                    <div wire:key="editing-domain-settings-{{ $editingDomainKey }}"
+                                        class="mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                        <p class="sm:col-span-2 text-[12px] text-neutral-500 dark:text-fg-dim">Indexing and redirect changes save automatically.</p>
+                                        <x-forms.listbox id="service-domain-indexing-{{ $editingAppId }}-{{ $editingDomainKey }}"
+                                            label="Search engine indexing" :wire="false" preserveValue
+                                            :value="$editingNoindex ? 'noindex' : 'index'"
+                                            onChange="toggleNoindexDomain"
+                                            :onChangeArgs="[$editingAppId, $editingRow['url']]" portal
+                                            :options="[
+                                                ['value' => 'index', 'label' => 'Indexable'],
+                                                ['value' => 'noindex', 'label' => 'Noindex'],
+                                            ]" />
+                                        <x-forms.listbox id="service-domain-direction-{{ $editingAppId }}-{{ $editingDomainKey }}"
+                                            label="www redirect" :wire="false" :value="$serviceRedirects[$editingAppId] ?? 'both'" preserveValue
+                                            x-effect="value = $wire.serviceRedirects[{{ $editingAppId }}] ?? 'both'"
+                                            helper="Applies to all domains for this service application."
+                                            onChange="updateServiceRedirect" :onChangeArgs="[$editingAppId]" portal
+                                            :options="[
+                                                ['value' => 'both', 'label' => 'No redirect'],
+                                                ['value' => 'www', 'label' => 'Redirect to www'],
+                                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                            ]" />
+                                    </div>
+                                @endcan
+                            @endif
+
                         </div>
                     </div>
                 </div>
@@ -311,7 +357,8 @@
 
                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                 <x-forms.button type="button"
-                                    @click="modalOpen = false; $wire.call('cancelRemovePort')">
+                                    wire:click="cancelRemovePort"
+                                    @click="modalOpen = false">
                                     Keep required port
                                 </x-forms.button>
                                 <x-forms.button type="button" wire:click="confirmRemovePort"
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index 444d1bfd28..fdf14e287a 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -1,7 +1,7 @@
 @php
     $showServiceColumn = $showServiceColumn ?? false;
     $showHeader = $showHeader ?? true;
-    $gridClass = $showServiceColumn ? 'domains-table-grid-compose' : 'domains-table-grid';
+    $gridClass = 'service-domains-overview-grid';
 @endphp
 
 <div class="data-table w-full">
@@ -11,10 +11,12 @@
             @if ($showServiceColumn)
                 <span>Service</span>
             @endif
-            <span>DNS Check</span>
-            <span class="whitespace-nowrap">Search engine indexing</span>
-            <span>Direction</span>
-            <span></span>
+            <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+            <span class="text-right">Actions</span>
         </div>
     @endif
     @foreach ($rows as $row)
@@ -32,35 +34,28 @@
                 default => 'neutral',
             };
             $dnsLabel = match ($row['dns_status']) {
-                'ok' => 'DNS OK',
+                'ok' => 'DNS matches',
                 'failed' => 'DNS mismatch',
                 'skipped' => 'DNS skipped',
                 'checking' => 'Checking DNS...',
-                'pending' => 'DNS pending',
+                'pending' => 'Not checked',
                 default => 'DNS unknown',
             };
             $serviceLabel = filled($row['service_name'] ?? null)
                 ? \Illuminate\Support\Str::headline($row['service_name'])
                 : '-';
-            $domainParts = $isSuggested ? null : parse_url($row['url']);
+            $publicUrl = getFqdnWithoutPort($row['url']);
+            $domainParts = $isSuggested ? null : parse_url($publicUrl);
+            $isNoindexed = $service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']);
+            $rowDirection = $serviceRedirects[$row['service_application_id']] ?? 'both';
+            $directionLabel = match ($rowDirection) {
+                'www' => 'Redirect to www',
+                'non-www' => 'Redirect to non-www',
+                default => 'Both www and non-www',
+            };
             $faviconUrl = is_array($domainParts) && isset($domainParts['scheme'], $domainParts['host'])
                 ? $domainParts['scheme'].'://'.$domainParts['host'].(isset($domainParts['port']) ? ':'.$domainParts['port'] : '').'/favicon.ico'
                 : null;
-            $redirectPairKey = function (string $url): string {
-                $parts = parse_url($url);
-                if (! is_array($parts) || ! isset($parts['host'])) {
-                    return $url;
-                }
-
-                $host = preg_replace('/^www\./i', '', $parts['host']);
-
-                return strtolower(($parts['scheme'] ?? '').'://'.$host.':'.($parts['port'] ?? '').($parts['path'] ?? ''));
-            };
-            $pairKey = $redirectPairKey($row['url']);
-            $firstPairRowUrl = collect($rows)
-                ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
-                ->first(fn ($item) => $redirectPairKey($item['url']) === $pairKey)['url'] ?? null;
-            $showDirection = ! $isSuggested && $firstPairRowUrl === $row['url'];
             $domainKey = hash('sha256', $row['url'].'|'.($row['service_application_id'] ?? ''));
         @endphp
 
@@ -70,10 +65,9 @@
                 'data-table-row',
                 $gridClass,
                 'domains-row-suggested' => $isSuggested,
-                'domains-row-without-direction' => ! $showDirection,
             ])>
                 <div class="flex min-w-0 flex-col gap-1">
-                    <div class="flex min-w-0 flex-wrap items-center gap-2">
+                    <div class="flex min-w-0 items-center gap-2">
                         @if ($isSuggested)
                             <span
                                 class="min-w-0 text-[13px] text-black sm:truncate dark:text-white"
@@ -93,17 +87,11 @@
                                         class="invisible absolute inset-0 size-4 rounded-sm" />
                                 </span>
                             @endif
-                            <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                                class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                                title="{{ $row['url'] }}">
-                                {{ $row['url'] }}
+                            <a href="{{ $publicUrl }}" target="_blank" rel="noopener noreferrer"
+                                class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs [overflow-wrap:anywhere] dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                title="{{ $publicUrl }}">
+                                {{ $publicUrl }}
                             </a>
-                            @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                                <span class="table-badge shrink-0"
-                                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
-                                    Internal port {{ $row['internal_port'] }}
-                                </span>
-                            @endif
                         @endif
                         @if ($isSuggested && ! empty($row['suggestion_label']))
                             <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
@@ -124,6 +112,27 @@
                     </div>
                 @endif
 
+                <div class="service-domain-detail" title="Protocol redirect">
+                    <span class="service-domain-detail-label">Protocol redirect</span>
+                    <span>{{ str_starts_with($row['url'], 'https://') && ($forceHttpsRedirects[$row['service_application_id']] ?? true) ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+                </div>
+                <div class="service-domain-detail" title="{{ $directionLabel }}">
+                    <span class="service-domain-detail-label">Domain redirect</span>
+                    <span>{{ match ($rowDirection) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+                </div>
+                <div class="service-domain-detail"
+                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
+                    <span class="service-domain-detail-label">Internal port</span>
+                    <span @if (filled($row['internal_port'] ?? null)) aria-label="Internal port {{ $row['internal_port'] }}" @endif>{{ $row['internal_port'] ?? '—' }}</span>
+                </div>
+                <div class="service-domain-detail">
+                    <span class="service-domain-detail-label">Search indexing</span>
+                    <span role="img" aria-label="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}"
+                        title="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}">
+                        <x-reicon :name="$isNoindexed ? 'x' : 'check'" class="size-4" />
+                    </span>
+                </div>
+
                 <div class="flex min-w-0 items-center">
                     @if ($row['dns_status'] === 'failed')
                         <x-status-badge as="button" @click="$dispatch('open-dns-records-modal')" :status="$dnsLabel" :type="$dnsType"
@@ -134,54 +143,6 @@
                     @endif
                 </div>
 
-                <div class="min-w-0">
-                    @unless ($isSuggested)
-                        <span class="domains-mobile-label">Search engine indexing</span>
-                    @endunless
-                    @if ($isSuggested)
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">-</span>
-                    @elseif (auth()->user()?->can('update', $service))
-                        <x-forms.listbox id="service-domain-indexing-{{ $row['service_application_id'] }}-{{ $index }}"
-                            :wire="false"
-                            preserveValue
-                            :value="$service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']) ? 'noindex' : 'index'"
-                            onChange="toggleNoindexDomain"
-                            :onChangeArgs="[(int) $row['service_application_id'], $row['url']]" portal :options="[
-                                ['value' => 'index', 'label' => 'Indexable'],
-                                ['value' => 'noindex', 'label' => 'Noindex'],
-                            ]" />
-                    @else
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                            {{ $service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']) ? 'Noindex' : 'Indexable' }}
-                        </span>
-                    @endif
-                </div>
-
-                <div class="min-w-0">
-                    @php
-                        $rowDirection = $serviceRedirects[$row['service_application_id']] ?? 'both';
-                        $directionLabel = match ($rowDirection) {
-                            'www' => 'Redirect to www',
-                            'non-www' => 'Redirect to non-www',
-                            default => 'Allow both',
-                        };
-                    @endphp
-                    @if ($showDirection)
-                        <span class="domains-mobile-label">Direction</span>
-                    @endif
-                    @if ($showDirection && auth()->user()?->can('update', $service))
-                        <x-forms.listbox id="service-domain-direction-{{ $row['service_application_id'] }}-{{ $index }}"
-                            :wire="false" :value="$rowDirection" preserveValue onChange="updateServiceRedirect"
-                            :onChangeArgs="[(int) $row['service_application_id']]" portal :options="[
-                                ['value' => 'both', 'label' => 'Allow www & non-www'],
-                                ['value' => 'www', 'label' => 'Redirect to www'],
-                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                            ]" />
-                    @elseif ($showDirection)
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">{{ $directionLabel }}</span>
-                    @endif
-                </div>
-
                 <div class="flex items-center justify-end gap-1">
                     @can('update', $service)
                         <button type="button" wire:click="checkDomainDns({{ $index }})"
@@ -209,8 +170,8 @@
                                 </x-forms.button>
                             @endif
                         @else
-                            <button type="button" wire:click="startEdit({{ $index }})"
-                                class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
+                            <button type="button" class="icon-button shrink-0" title="Domain settings" aria-label="Settings for {{ $publicUrl }}"
+                                wire:click="startEdit({{ $index }})" wire:loading.attr="disabled" wire:target="startEdit">
                                 <x-reicon name="settings" class="size-3.5" />
                             </button>
                             <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 96b0446886..5169c9e35d 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -618,10 +618,10 @@ it('lists existing domains as individual rows', function () {
         ->assertSee('class="invisible absolute inset-0 size-4 rounded-sm"', false)
         ->assertSee('$el.previousElementSibling.classList.add(\'hidden\')', false)
         ->assertSee('x-on:error="$el.remove()"', false)
-        ->assertSee('class="min-w-0 flex-1 text-[13px]', false)
+        ->assertSee('class="min-w-0 flex-1 truncate text-[13px]', false)
         ->html();
 
-    expect(substr_count($html, 'this.$wire.updateRedirect('))->toBe(2);
+    expect(substr_count($html, 'this.$wire.updateRedirect('))->toBe(0);
 });
 
 it('shows the HTTP redirect control for HTTPS domains and persists changes', function () {
@@ -645,7 +645,7 @@ it('hides the HTTP redirect control for HTTP-only domains', function () {
         ->assertDontSee('Redirect HTTP to HTTPS');
 });
 
-it('shows one redirect direction control in each compose service header', function () {
+it('shows the compose service redirect control in domain settings', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
         'docker_compose_raw' => "services:\n  api:\n    image: nginx:alpine\n",
@@ -660,11 +660,13 @@ it('shows one redirect direction control in each compose service header', functi
     $html = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSuccessful()
         ->assertSee('api')
+        ->call('startEdit', 0)
+        ->assertSee('www redirect')
         ->html();
 
     expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(1)
         ->and(substr_count($html, 'this.$wire.updateRedirect('))->toBe(0)
-        ->and(substr_count($html, 'domain-direction-service-api'))->toBeGreaterThan(0);
+        ->and(substr_count($html, 'application-domain-direction-'))->toBeGreaterThan(0);
 });
 
 it('shows dns entries control next to Add', function () {
@@ -805,7 +807,7 @@ it('shows cloudflare domain connect only on cloud with a key', function () {
 
 it('adds a domain to the application', function () {
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
-        ->assertSee('+ Add')
+        ->assertSee('Add domain')
         ->set('newDomain', 'https://app.example.com')
         ->call('addDomain')
         ->assertHasNoErrors()
@@ -909,7 +911,7 @@ it('updates a domain in place via modal', function () {
         ->call('startEdit', 0)
         ->assertSet('showEditDomainModal', true)
         ->assertSet('editingDomain', 'https://old.example.com')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('Search engine indexing')
         ->set('editingDomainParts.scheme', 'https')
         ->set('editingDomainParts.host', 'new.example.com')
@@ -1287,7 +1289,7 @@ it('hides dns message text when dns status is ok', function () {
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSet('domainRows.0.dns_status', 'ok')
-        ->assertSee('DNS OK')
+        ->assertSee('DNS matches')
         ->assertDontSee('DNS points to 203.0.113.10')
         ->assertDontSee('Last checked');
 });
@@ -1886,33 +1888,33 @@ it('uses the compact service domains layout for compose applications', function
         ->toContain('application-compose-domain-group-{{ $redirectWireKey }}')
         ->toContain('class="application-settings-section-body mt-1 scroll-mt-28')
         ->toContain('bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]')
-        ->toContain('class="data-table-header domains-table-grid-service"')
-        ->toContain('<span>Direction</span>')
-        ->toContain('<span class="whitespace-nowrap">Search engine indexing</span>')
+        ->toContain('class="data-table-header service-domains-overview-grid"')
+        ->toContain('<span>Domain redirect</span>')
+        ->toContain('<span>Search indexing</span>')
         ->not->toContain('<span>Last checked</span>')
         ->not->toContain('id="edit-domain-direction"')
-        ->toContain('id="domain-direction-service-{{ $redirectWireKey }}"')
-        ->toContain('onChange="updateServiceRedirect"')
-        ->toContain("'showDirectionControl' => false")
+        ->toContain('wire:key="application-compose-domain-rows-{{ $redirectWireKey }}"')
+        ->toContain('id="application-domain-direction-{{ $editingKey }}"')
+        ->toContain("\$isCompose ? 'updateServiceRedirect' : 'updateRedirect'")
         ->not->toContain('title="No domains for this service"');
 });
 
-it('keeps search engine indexing table headers on one line', function () {
+it('uses concise search indexing headers in application and service domain tables', function () {
     $applicationView = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
     $serviceView = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
 
-    expect(substr_count($applicationView, '<span class="whitespace-nowrap">Search engine indexing</span>'))
-        ->toBe(2)
+    expect(substr_count($applicationView, '<span>Search indexing</span>'))
+        ->toBe(1)
         ->and($serviceView)
-        ->toContain('<span class="whitespace-nowrap">Search engine indexing</span>');
+        ->toContain('<span>Search indexing</span>');
 });
 
-it('shows domain guidance in the application domains section', function () {
+it('shows save guidance in the application domain settings', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
 
     expect($view)
-        ->toContain('<p class="text-sm text-neutral-500 dark:text-fg-dim">')
-        ->toContain('{{ $helperText }}');
+        ->toContain('Indexing and redirect changes save automatically.')
+        ->toContain('<x-unsaved-bar action="updateDomain"');
 });
 
 it('does not render a last checked column in the domains table', function () {
@@ -1928,13 +1930,13 @@ it('uses compact labeled domain cards on mobile', function () {
     $row = file_get_contents(resource_path('views/livewire/project/application/partials/domain-row.blade.php'));
 
     expect($styles)
-        ->toContain('@media (max-width: 768px)')
-        ->toContain('.domains-mobile-label')
-        ->toContain('.domains-table-grid .listbox-trigger')
+        ->toContain('@container service-domains (max-width: 980px)')
+        ->toContain('.service-domain-detail-label')
+        ->toContain('.service-domains-overview-grid')
         ->and($row)
-        ->toContain('domains-mobile-label')
-        ->toContain('Search engine indexing')
-        ->toContain('Direction');
+        ->toContain('service-domain-detail-label')
+        ->toContain('Search indexing')
+        ->toContain('Domain redirect');
 });
 
 it('uses segmented fields when adding and editing application domains', function () {
@@ -2132,10 +2134,11 @@ it('updates search engine indexing from the domains view', function () {
     $this->application->update(['fqdn' => 'https://app.example.com,https://staging.example.com']);
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
         ->assertSee('Noindex')
         ->assertSee('Indexable')
         ->assertSee('Search engine indexing')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('toggleNoindexDomain', false)
         ->assertSee('updateRedirect', false)
         ->assertSee('wire:ignore', false)
@@ -2376,7 +2379,7 @@ it('renders a portless domain link with an internal port badge for overrides', f
         ->not->toContain('Inherited from Ports Exposes');
 });
 
-it('shows an error badge when a domain has no internal port and ports exposes is empty', function () {
+it('shows a warning when a domain has no internal port and ports exposes is empty', function () {
     $this->application->update([
         'ports_exposes' => null,
         'fqdn' => 'https://example.com',
@@ -2387,7 +2390,8 @@ it('shows an error badge when a domain has no internal port and ports exposes is
         ->assertSet('domainRows.0.internal_port', null)
         ->assertSee('No internal port')
         ->assertDontSee('Internal port ')
-        ->assertSee('table-badge-danger', false);
+        ->assertSee('aria-label="No internal port"', false)
+        ->assertSee('Set Ports Exposes or a per-domain internal port', false);
 });
 
 it('keeps the internal port badge when a domain override exists without ports exposes', function () {
@@ -2413,7 +2417,7 @@ it('distinguishes an inherited internal port from a domain port override', funct
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSee('Internal port 3000')
-        ->assertSee('Inherited from Ports Exposes', false)
+        ->assertSee('Inherited from the application or Compose service port', false)
         ->assertDontSee('Custom internal port for this domain', false);
 });
 
@@ -2887,3 +2891,141 @@ it('keeps an existing custom compose port without another warning', function ()
 
     expect($this->application->fresh()->domain_port_overrides['https://existing.example.com'] ?? null)->toBe(7070);
 });
+
+it('keeps the selected application domain when a refresh reorders dns rows', function (bool $compose) {
+    $first = 'https://first.example.com';
+    $second = 'https://second.example.com';
+    $this->application->update($compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => "$first,$second"]]),
+    ] : ['fqdn' => "$first,$second"]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'renamed.example.com');
+    $this->application->update(['domain_dns_statuses' => [
+        ($compose ? 'web|' : '').$second => ['status' => 'failed', 'message' => 'Mismatch'],
+    ]]);
+
+    $component->call('refreshDomains')
+        ->assertSet('editingIndex', 1)
+        ->assertSet('editingDomainParts.host', 'renamed.example.com')
+        ->call('toggleNoindexDomain', $first, 'noindex')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    $this->application->refresh();
+    $domains = $compose ? json_decode($this->application->docker_compose_domains, true)['web']['domain'] : $this->application->fqdn;
+    expect(explode(',', $domains))->toBe(['https://renamed.example.com', $second]);
+})->with([false, true]);
+
+it('inherits application counterpart ports without changing configured counterparts', function (bool $compose, ?int $override, string $redirect) {
+    $host = $redirect === 'www' ? 'app.example.com' : 'www.app.example.com';
+    $counterpart = $redirect === 'www' ? 'www.app.example.com' : 'app.example.com';
+    $url = "https://$host/blog";
+    $pairedUrl = "https://$counterpart/blog";
+    $existing = 'http://existing.example.com,https://www.existing.example.com';
+    $this->application->update(array_merge([
+        'ports_exposes' => '80',
+        'domain_port_overrides' => array_filter([
+            $url => $override,
+            'https://www.existing.example.com' => 9090,
+        ], fn ($port) => $port !== null),
+    ], $compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => "$url,$existing"]]),
+    ] : ['fqdn' => "$url,$existing"]));
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    if ($compose) {
+        $component->call('updateServiceRedirect', 'web', $redirect);
+    } else {
+        $component->call('updateRedirect', $redirect);
+    }
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', false);
+
+    $this->application->refresh();
+    $domains = $compose ? json_decode($this->application->docker_compose_domains, true)['web']['domain'] : $this->application->fqdn;
+    expect($domains)->toContain($pairedUrl)->toContain($existing)
+        ->and($this->application->domain_port_overrides[$pairedUrl] ?? 80)->toBe($override ?? 80)
+        ->and($this->application->domain_port_overrides[$url] ?? null)->toBe($override)
+        ->and($this->application->domain_port_overrides['https://www.existing.example.com'])->toBe(9090);
+})->with([false, true])->with([null, 8080])->with(['www', 'non-www']);
+
+it('preserves pending application redirect through refresh and resolves its domain conflict', function (bool $compose, bool $cancel) {
+    Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => 'https://www.pending.example.com',
+        'build_pack' => 'nixpacks',
+    ]);
+    $url = 'https://pending.example.com';
+    $this->application->update(array_merge([
+        'domain_port_overrides' => [$url => 8080],
+    ], $compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web.app:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode([
+            'web.app' => ['domain' => $url, 'redirect' => 'both'],
+            'occupied' => ['domain' => 'https://www.pending.example.com'],
+        ]),
+    ] : ['fqdn' => $url]));
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $property = $compose ? 'serviceRedirects.'.str_replace('.', '__dot__', 'web.app') : 'redirect';
+    if ($compose) {
+        $component->call('updateServiceRedirect', 'web.app', 'www');
+    } else {
+        $component->call('updateRedirect', 'www');
+    }
+    $component->assertSet('showDomainConflictModal', true)
+        ->call('refreshDomains')
+        ->assertSet($property, 'www');
+
+    if ($cancel) {
+        $component->set('showDomainConflictModal', false)
+            ->assertSet($property, 'both')
+            ->assertSet('pendingAction', null)
+            ->assertSet('pendingRedirectService', null);
+    } else {
+        $component->call('confirmDomainUsage')
+            ->assertHasNoErrors()
+            ->assertSet('pendingAction', null)
+            ->assertSet('pendingRedirectService', null)
+            ->assertSet($property, 'www');
+    }
+
+    $this->application->refresh();
+    $storedRedirect = $compose ? json_decode($this->application->docker_compose_domains, true)['web.app']['redirect'] : $this->application->redirect;
+    expect($storedRedirect)->toBe($cancel ? 'both' : 'www');
+    if (! $cancel) {
+        expect($this->application->domain_port_overrides['https://www.pending.example.com'] ?? null)->toBe(8080);
+    }
+})->with([false, true])->with([false, true]);
+
+it('keeps the selected application domain when removing an earlier row', function () {
+    $this->application->update(['fqdn' => 'https://first.example.com,https://second.example.com']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->call('removeDomain', 0)
+        ->assertSet('editingIndex', 0)
+        ->set('editingDomainParts.host', 'renamed.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($this->application->fresh()->fqdn)->toBe('https://renamed.example.com');
+});
+
+it('prevents members from cancelling protected application redirect conflict state', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->actingAs($this->user->fresh());
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('showDomainConflictModal', true)
+        ->set('showDomainConflictModal', false)
+        ->assertForbidden();
+});
diff --git a/tests/Feature/ApplicationPreviewSettingsTest.php b/tests/Feature/ApplicationPreviewSettingsTest.php
new file mode 100644
index 0000000000..5a938e0d01
--- /dev/null
+++ b/tests/Feature/ApplicationPreviewSettingsTest.php
@@ -0,0 +1,139 @@
+<?php
+
+use App\Livewire\Project\Application\Previews;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        [
+            'id' => 0,
+            'is_dns_validation_enabled' => false,
+        ]
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $key = PrivateKey::withoutEvents(fn () => PrivateKey::forceCreate([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]));
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $key->id,
+        'ip' => '203.0.113.10',
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Preview App',
+        'preview_url_template' => '{{pr_id}}.{{domain}}',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => null,
+        'redirect' => 'both',
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $this->application->settings()->update([
+        'is_container_label_readonly_enabled' => true,
+    ]);
+});
+
+it('shows preview settings and persists changes independently of preview inputs', function () {
+    Livewire::test(Previews::class, ['application' => $this->application])
+        ->assertSee('PR deployment access')
+        ->assertSet('isPreviewDeploymentsEnabled', false)
+        ->set('manualPullRequestId', -1)
+        ->set('isPreviewDeploymentsEnabled', true)
+        ->set('isPrDeploymentsPublicEnabled', true)
+        ->call('savePreviewSettings')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->settings)
+        ->is_preview_deployments_enabled->toBeTrue()
+        ->is_pr_deployments_public_enabled->toBeTrue();
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->assertSet('isPreviewDeploymentsEnabled', true)
+        ->assertSet('isPrDeploymentsPublicEnabled', true)
+        ->set('isPreviewDeploymentsEnabled', false)
+        ->call('savePreviewSettings');
+
+    expect($this->application->fresh()->settings->is_preview_deployments_enabled)->toBeFalse();
+});
+
+it('does not show git preview settings for non-git applications', function (string $buildPack, ?string $dockerfile) {
+    $this->application->update(['build_pack' => $buildPack, 'dockerfile' => $dockerfile]);
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->assertDontSee('PR deployment access');
+})->with([['dockerimage', null], ['dockerfile', 'FROM nginx']]);
+
+it('denies preview setting changes without application update permission', function (string $role, bool $otherTeam) {
+    $user = User::factory()->create();
+    $team = $otherTeam ? Team::factory()->create() : $this->team;
+    $team->members()->attach($user->id, ['role' => $role]);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test(Previews::class, ['application' => $this->application])
+        ->set('isPreviewDeploymentsEnabled', true)
+        ->set('isPrDeploymentsPublicEnabled', true)
+        ->call('savePreviewSettings')
+        ->assertForbidden();
+
+    expect($this->application->fresh()->settings)
+        ->is_preview_deployments_enabled->toBeFalse()
+        ->is_pr_deployments_public_enabled->toBeFalse();
+})->with([['member', false], ['owner', true]]);
+
+it('removes preview settings from Advanced including its persistence path', function () {
+    expect(file_get_contents(resource_path('views/livewire/project/application/advanced.blade.php')))
+        ->not->toContain('isPreviewDeploymentsEnabled', 'isPrDeploymentsPublicEnabled');
+    expect(file_get_contents(app_path('Livewire/Project/Application/Advanced.php')))
+        ->not->toContain('is_preview_deployments_enabled', 'is_pr_deployments_public_enabled');
+});
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index c93a4f1e9d..6b47a085a7 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -12,6 +12,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Livewire\Livewire;
@@ -20,6 +21,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     $this->withoutVite();
+    config()->set('app.maintenance.store', 'array');
 
     InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
         ['id' => 0],
@@ -140,24 +142,22 @@ it('groups configured domains and shows redirect settings in the table', functio
 
     expect($html)
         ->toContain("service-domain-group-{$this->apiApp->id}")
-        ->toContain("id=\"service-domain-direction-{$this->apiApp->id}-0-trigger\"")
-        ->toContain("id=\"service-domain-indexing-{$this->apiApp->id}-0-trigger\"")
         ->toContain('src="https://api.example.com/favicon.ico"')
         ->toContain('class="relative size-4 shrink-0"')
         ->toContain('domain-favicon-fallback')
         ->toContain('class="invisible absolute inset-0 size-4 rounded-sm"')
         ->toContain('$el.previousElementSibling.classList.add(\'hidden\')')
         ->toContain('x-on:error="$el.remove()"')
-        ->toContain('class="min-w-0 flex-1 text-[13px]')
+        ->toContain('class="min-w-0 flex-1 truncate text-[13px]')
         ->toContain('class="listbox-trigger"')
         ->toContain('application-settings-section-body is-flush mt-1 w-full scroll-mt-28 overflow-visible')
         ->toContain('dark:bg-white/[0.04]')
         ->toContain('<span>Domain</span>')
-        ->toContain('<span>DNS Check</span>')
+        ->toContain('<span>DNS status</span>')
         ->not->toContain('<span>Last checked</span>')
         ->not->toContain("service-domain-group-{$this->webApp->id}")
         ->and(substr_count($html, '2 domains'))->toBe(1)
-        ->and(strpos($html, '>API</span>'))->toBeLessThan(strpos($html, '<span>Domain</span>'))
+        ->and(substr_count($html, '<span>Domain</span>'))->toBe(1)
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
 
@@ -194,16 +194,25 @@ it('hides the HTTP redirect control for HTTP-only service applications', functio
         ->assertDontSee('Redirect HTTP to HTTPS');
 });
 
-it('shows one redirect control for each www and non-www pair', function () {
-    $this->apiApp->update([
-        'fqdn' => 'https://api.example.com,https://www.api.example.com,https://admin.example.com,https://www.admin.example.com',
-    ]);
+it('opens address fields and service-wide redirects in the same settings dialog for every domain', function () {
+    $domains = ['https://api.example.com', 'https://www.api.example.com', 'https://admin.example.com', 'https://www.admin.example.com'];
+    $this->apiApp->update(['fqdn' => implode(',', $domains)]);
 
-    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertSuccessful()
-        ->html();
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
 
-    expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(2);
+    foreach ($domains as $index => $domain) {
+        $html = $component->call('startEdit', $index)
+            ->assertSet('editingDomain', $domain)
+            ->assertSee('Domain settings')
+            ->assertSee('Save changes')
+            ->assertDontSee('Save address')
+            ->assertSee('Search engine indexing')
+            ->assertSee('www redirect')
+            ->assertDontSee('Edit address and port')
+            ->html();
+
+        expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(1);
+    }
 });
 
 it('uses segmented fields when adding and editing service domains', function () {
@@ -246,12 +255,12 @@ it('shows dns entries control next to Add', function () {
         ->assertSee('Manual records');
 });
 
-it('rotates the dns entries chevron while its dropdown is open', function () {
+it('exposes the dns entries dropdown expanded state', function () {
     $view = file_get_contents(resource_path('views/livewire/project/shared/cloudflare-autoconfigure.blade.php'));
 
     expect($view)
-        ->toContain('class="inline-flex transition-transform"')
-        ->toContain(':class="dnsEntriesOpen && \'rotate-180\'"');
+        ->toContain('x-bind:aria-expanded="dnsEntriesOpen"')
+        ->toContain('x-show="dnsEntriesOpen"');
 });
 
 it('lists dns entries for service hosts that still need dns', function () {
@@ -418,7 +427,7 @@ it('keeps a stable key for the rendered domain list', function () {
 
     expect($view)
         ->toContain('wire:key="service-domains-list"')
-        ->toContain('wire:key="service-domain-rows-{{ $appId }}-{{ md5(serialize($rows->all())) }}"')
+        ->toContain('wire:key="service-domain-rows-{{ $appId }}"')
         ->not->toContain('md5(serialize($domainRows))');
 });
 
@@ -502,9 +511,9 @@ it('prunes the previous dns status when a service domain is renamed', function (
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->call('startEdit', 0)
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('Search engine indexing')
-        ->set('editingDomain', 'https://renamed.example.com')
+        ->set('editingDomainParts.host', 'renamed.example.com')
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertDispatched('edit-domain-saved')
@@ -757,7 +766,8 @@ it('shows service dns mismatches before other domain entries', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSet('domainRows.0.url', 'https://broken.example.com')
         ->assertSet('domainRows.0.dns_status', 'failed')
-        ->assertSet('domainRows.2.url', 'https://healthy.example.com');
+        ->assertCount('domainRows', 2)
+        ->assertSet('domainRows.1.url', 'https://healthy.example.com');
 });
 
 it('hides dns message text when service domain dns status is ok', function () {
@@ -773,7 +783,7 @@ it('hides dns message text when service domain dns status is ok', function () {
     ]);
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertSee('DNS OK')
+        ->assertSee('DNS matches')
         ->assertDontSee('DNS points to 203.0.113.10');
 });
 
@@ -827,7 +837,8 @@ it('hides dns check controls from read-only users', function () {
     $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertDontSee('Recheck DNS')
+        ->assertDontSee('Check all DNS')
+        ->assertDontSee('aria-label="Settings for', false)
         ->assertDontSee('Check DNS');
 });
 
@@ -846,10 +857,11 @@ it('exposes the stack domains route', function () {
 
 it('updates search engine indexing from the service domains view', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0)
         ->assertSee('Noindex')
         ->assertSee('Indexable')
         ->assertSee('Search engine indexing')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('toggleNoindexDomain', false)
         ->assertSee('updateServiceRedirect', false)
         ->assertSee('wire:ignore', false)
@@ -931,3 +943,169 @@ it('does not show an internal port badge when the service has no env port', func
         ->assertDontSee('Internal port ')
         ->assertDontSee('table-badge-danger', false);
 });
+
+it('prioritizes public addresses and moves domain configuration behind settings', function () {
+    $this->apiApp->update(['fqdn' => 'https://api.example.com:8080']);
+
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Check all DNS')
+        ->assertSee('Add domain')
+        ->assertSee('Domain settings')
+        ->call('startEdit', 0)
+        ->assertSee('Indexing and redirect changes save automatically.')
+        ->assertSee('Internal port 8080')
+        ->assertSee('Both www and non-www')
+        ->assertSee('Search indexing allowed')
+        ->assertDontSee('Manage domains and www/non-www redirects')
+        ->html();
+
+    expect($html)->toContain('title="https://api.example.com"')
+        ->not->toContain('title="https://api.example.com:8080"');
+});
+
+it('distinguishes unchecked domains from dns checks in progress', function () {
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => true]);
+    Cache::forget('instance_settings');
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Not checked')
+        ->assertDontSee('DNS pending');
+});
+
+it('keeps the edited domain selected when settings refresh and reorder rows', function () {
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0);
+
+    $this->webApp->update([
+        'fqdn' => 'https://broken.example.com',
+        'domain_dns_statuses' => [
+            'https://broken.example.com' => ['status' => 'failed', 'message' => 'Mismatch'],
+        ],
+    ]);
+
+    $component->call('refreshDomains')
+        ->assertSet('editingIndex', 1)
+        ->set('editingDomainParts.host', 'renamed.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($this->apiApp->fresh()->fqdn)->toBe('https://renamed.example.com')
+        ->and($this->webApp->fresh()->fqdn)->toBe('https://broken.example.com');
+});
+
+it('renders compact icon-only domain actions with accessible labels', function () {
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])->html();
+    $document = new DOMDocument;
+    @$document->loadHTML($html);
+    $xpath = new DOMXPath($document);
+
+    foreach (['Check DNS', 'Settings for https://api.example.com', 'Remove domain'] as $label) {
+        $buttons = $xpath->query('//button[@aria-label="'.$label.'"]');
+        expect($buttons->length)->toBe(1);
+        $button = $buttons->item(0);
+        expect(trim($button->textContent))->toBe('')
+            ->and($button->getAttribute('class'))->toContain('icon-button')
+            ->and($button->getAttribute('title'))->not->toBe('');
+    }
+
+    expect($html)->not->toContain('aria-label="More actions for');
+});
+
+it('reuses the floating save bar for pending domain address edits', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
+
+    expect($view)->toContain('<x-unsaved-bar action="updateDomain"')
+        ->toContain('dirty="hasAddressChanges"')
+        ->toContain('<template x-if="modalOpen">')
+        ->not->toContain('Save address');
+});
+
+it('inherits the counterpart internal port when enabling redirects without a port warning', function (?int $override, string $redirect) {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_URL_WEB_80\n  api:\n    image: node:alpine\n",
+    ]);
+    $host = $redirect === 'www' ? 'web.example.com' : 'www.web.example.com';
+    $counterpart = $redirect === 'www' ? 'www.web.example.com' : 'web.example.com';
+    $url = "https://{$host}/blog";
+    $pairedUrl = "https://{$counterpart}/blog";
+    $this->webApp->update([
+        'fqdn' => $url,
+        'redirect' => 'both',
+        'domain_port_overrides' => $override === null ? null : [$url => $override],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('updateServiceRedirect', $this->webApp->id, $redirect)
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('pendingAction', null)
+        ->assertDispatched('success', 'Redirect updated.')
+        ->call('refreshDomains')
+        ->assertSet("serviceRedirects.{$this->webApp->id}", $redirect);
+
+    $this->webApp->refresh();
+    expect($this->webApp->redirect)->toBe($redirect)
+        ->and($this->webApp->fqdn)->toContain($pairedUrl)
+        ->and($this->webApp->domain_port_overrides[$pairedUrl] ?? $this->webApp->getRequiredPort())->toBe($override ?? 80)
+        ->and($this->webApp->domain_port_overrides[$url] ?? null)->toBe($override);
+})->with([null, 80, 8080])->with(['www', 'non-www']);
+
+it('still warns and allows cancellation when manually adding a different port', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_FQDN_WEB_8000\n  api:\n    image: node:alpine\n",
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomain', 'https://web.example.com:3000')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('cancelRemovePort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('pendingAction', null)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true);
+
+    expect($this->webApp->fresh()->fqdn)->toBeNull();
+});
+
+it('still checks domain conflicts when inheriting a redirect counterpart port', function () {
+    $this->webApp->update([
+        'fqdn' => 'https://example.com',
+        'redirect' => 'both',
+        'domain_port_overrides' => ['https://example.com' => 8080],
+    ]);
+    $this->apiApp->update(['fqdn' => 'https://www.example.com']);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('updateServiceRedirect', $this->webApp->id, 'www')
+        ->assertSet('showDomainConflictModal', true)
+        ->assertSet('showPortWarningModal', false);
+
+    expect($this->webApp->fresh()->redirect)->toBe('both');
+
+    $component->call('refreshDomains')
+        ->call('confirmDomainUsage')
+        ->assertSet('showDomainConflictModal', false)
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success', 'Redirect updated.');
+
+    expect($this->webApp->fresh()->redirect)->toBe('www')
+        ->and($this->webApp->fresh()->domain_port_overrides['https://www.example.com'])->toBe(8080);
+});
+
+it('renders domain settings in compact columns instead of a second summary line', function () {
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])->html();
+    foreach (['Protocol redirect', 'Domain redirect', 'Internal port', 'Search indexing'] as $heading) {
+        expect($html)->toContain('<span>'.$heading.'</span>');
+    }
+    $view = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+    expect($view)->toContain('service-domain-detail')
+        ->not->toContain('gap-x-3 gap-y-1');
+});
+
+it('lays out the domain settings dropdowns in responsive columns', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
+    expect($view)->toContain('mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2')
+        ->toContain('class="sm:col-span-2 text-[12px]');
+});
diff --git a/tests/v4/Browser/ApplicationConfigurationTest.php b/tests/v4/Browser/ApplicationConfigurationTest.php
index 161f96f661..bd9084d3f5 100644
--- a/tests/v4/Browser/ApplicationConfigurationTest.php
+++ b/tests/v4/Browser/ApplicationConfigurationTest.php
@@ -1,7 +1,9 @@
 <?php
 
+use App\Models\InstanceSettings;
 use App\Models\LocalPersistentVolume;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Visus\Cuid2\Cuid2;
 
 uses(RefreshDatabase::class);
@@ -209,3 +211,86 @@ it('shows danger zone for application deletion', function () {
         ->assertSee('Config App')
         ->screenshot(filename: 'application-danger-zone');
 });
+
+it('uses compact application domains with unified settings and a floating save bar', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->application->update(['fqdn' => 'https://first.example.com,https://second.example.com', 'redirect' => 'both']);
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('Check all DNS')
+        ->assertSee('Protocol redirect')
+        ->assertSee('Search indexing')
+        ->assertDontSee('Search engine indexing')
+        ->fill('[aria-label="Search services or domains"]', 'missing.example.com')
+        ->assertSee('No domains found')
+        ->fill('[aria-label="Search services or domains"]', '')
+        ->click('[aria-label="Settings for https://first.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertValue('#editingDomainParts-host', 'first.example.com')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->fill('#editingDomainParts-path', '/blog')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->click('[id^="application-domain-indexing-"][id$="-trigger"]')
+        ->click('Noindex')
+        ->assertSee('Search engine indexing updated.')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'application-domain-unified-settings')
+        ->click('[wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertSee('https://first.example.com/blog')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-domains-compact');
+
+    $page->click('[aria-label="Settings for https://second.example.com"]')
+        ->fill('#editingDomainParts-path', '/discard')
+        ->click('Reset')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-path', '')
+        ->click('[aria-label="Close"]:visible')
+        ->click('[wire\\:key="domain-row-'.md5('https://first.example.com/blog|').'"] [aria-label="Remove domain"]')
+        ->assertSee('Remove domain?')
+        ->click('button:has([x-text="step2ButtonText"]):visible')
+        ->assertDontSee('https://first.example.com/blog')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-host', 'second.example.com')
+        ->click('[aria-label="Close"]:visible')
+        ->resize(390, 844)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-domains-mobile');
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+});
+
+it('edits Compose application domain redirects in the unified settings dialog', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web.api:\n    image: nginx:alpine\n    expose:\n      - '8080'\n",
+        'docker_compose_domains' => json_encode(['web.api' => ['domain' => 'https://web.example.com', 'redirect' => 'both']]),
+    ]);
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('web.api')
+        ->assertSee('Domain redirect')
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->assertSee('Domain settings')
+        ->click('[id^="application-domain-direction-"][id$="-trigger"]')
+        ->click('Redirect to www')
+        ->assertDontSee('Use a different port?')
+        ->assertSee('Redirect updated for web.api.')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-compose-domain-settings');
+
+    expect(json_decode($this->application->fresh()->docker_compose_domains, true)['web.api']['redirect'])->toBe('www');
+    $page->click('[aria-label="Close"]:visible')
+        ->assertSee('https://www.web.example.com')
+        ->screenshot(filename: 'application-compose-domain-overview');
+});
diff --git a/tests/v4/Browser/ServiceConfigurationTest.php b/tests/v4/Browser/ServiceConfigurationTest.php
index d5c840ae60..6f7919664a 100644
--- a/tests/v4/Browser/ServiceConfigurationTest.php
+++ b/tests/v4/Browser/ServiceConfigurationTest.php
@@ -1,6 +1,8 @@
 <?php
 
+use App\Models\InstanceSettings;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Visus\Cuid2\Cuid2;
 
 uses(RefreshDatabase::class);
@@ -189,3 +191,130 @@ it('shows service danger zone', function () {
         ->assertSee('Config Service')
         ->screenshot(filename: 'service-danger-zone');
 });
+
+it('keeps domain settings out of the overview and supports editing and removal', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->serviceApplication->update([
+        'fqdn' => 'https://long-public-domain-for-the-service.example.com,https://second.example.com',
+        'domain_port_overrides' => ['https://long-public-domain-for-the-service.example.com' => 8080],
+    ]);
+    loginAndSkipBoarding();
+
+    $url = serviceConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->service).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('Check all DNS')
+        ->assertVisible('[aria-label="Internal port 8080"]')
+        ->assertDontSee('Search engine indexing')
+        ->assertDontSee('Remove domain')
+        ->screenshot(filename: 'service-domains-overview');
+
+    expect($page->script("document.querySelector('.data-table-row.service-domains-overview-grid').getBoundingClientRect().height"))->toBeLessThanOrEqual(48);
+    expect($page->script("getComputedStyle(document.querySelector('.data-table-row.service-domains-overview-grid')).gridTemplateColumns.split(' ').length"))->toBe(7);
+
+    $page->click('[aria-label="Settings for https://long-public-domain-for-the-service.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertValue('#editingDomainParts-host', 'long-public-domain-for-the-service.example.com')
+        ->assertValue('#editingDomainParts-port', '8080')
+        ->assertDontSee('Edit address and port')
+        ->assertDontSee('Save address')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->assertSee('Search engine indexing')
+        ->screenshot(filename: 'service-domain-settings');
+
+    expect($page->script(<<<'JS'
+        (() => {
+            const indexing = document.querySelector('[id^="service-domain-indexing-"][id$="-trigger"]').getBoundingClientRect();
+            const redirect = document.querySelector('[id^="service-domain-direction-"][id$="-trigger"]').getBoundingClientRect();
+            return Math.abs(indexing.top - redirect.top) < 2 && redirect.left > indexing.right;
+        })()
+    JS))->toBeTrue();
+
+    $page->fill('#editingDomainParts-port', '80')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'service-domain-unsaved-changes');
+
+    $domainKey = hash('sha256', 'https://long-public-domain-for-the-service.example.com|'.$this->serviceApplication->id);
+    $page->click('#service-domain-indexing-'.$this->serviceApplication->id.'-'.$domainKey.'-trigger')
+        ->click('Noindex')
+        ->screenshot(filename: 'service-domain-indexing-saved')
+        ->assertSee('Domain settings')
+        ->assertVisible('[aria-label="Search indexing blocked"]')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->assertNoJavaScriptErrors();
+
+    expect($this->serviceApplication->fresh()->isDomainNoindexed('https://long-public-domain-for-the-service.example.com'))->toBeTrue();
+
+    $page->click('[wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertVisible('[aria-label="Internal port 80"] >> nth=0');
+
+    $page->click('[wire\\:key="svc-domain-'.$this->serviceApplication->id.'-'.md5('https://long-public-domain-for-the-service.example.com').'"] [aria-label="Remove domain"]')
+        ->assertSee('Remove domain?')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-domain-removal-confirmation')
+        ->click('button:has([x-text="step2ButtonText"]):visible')
+        ->assertDontSee('https://long-public-domain-for-the-service.example.com')
+        ->assertSee('1 domain across 1 service')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertSee('www redirect')
+        ->assertValue('#editingDomainParts-host', 'second.example.com')
+        ->click('[aria-label="Close"]:visible')
+        ->assertDontSee('Domain settings')
+        ->assertNoJavaScriptErrors();
+
+    $page->click('[aria-label="Settings for https://second.example.com"]')
+        ->fill('#editingDomainParts-path', '/discard-this')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->click('Reset')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-path', '')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->click('[aria-label="Close"]:visible')
+        ->assertDontSee('Domain settings')
+        ->assertNoJavaScriptErrors();
+
+    $page->script("document.querySelectorAll('[aria-label=\"Dismiss\"]').forEach(button => button.click()); document.documentElement.classList.remove('dark');");
+    $page->screenshot(filename: 'service-domains-light');
+    $page->resize(390, 844)
+        ->assertSee('https://second.example.com')
+        ->assertVisible('[aria-label="Settings for https://second.example.com"]');
+    $page->script("document.getElementById('service-domains-section').scrollIntoView(); window.scrollBy(0, -80);");
+    $page->screenshot(filename: 'service-domains-mobile');
+
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+});
+
+it('inherits the internal port when enabling the www redirect without a warning', function (?int $override) {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_FQDN_WEB_80\n  api:\n    image: httpd:alpine\n",
+    ]);
+    $this->serviceApplication->update(['fqdn' => 'https://web.example.com', 'redirect' => 'both', 'domain_port_overrides' => $override === null ? null : ['https://web.example.com' => $override]]);
+    loginAndSkipBoarding();
+
+    $url = serviceConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->service).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->click('[id^="service-domain-direction-"][id$="-trigger"]')
+        ->click('Redirect to www')
+        ->assertDontSee('Use a different port?')
+        ->assertSee('Redirect updated.')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-redirect-port-'.($override ?? 80));
+
+    expect($this->serviceApplication->fresh()->redirect)->toBe('www')
+        ->and($this->serviceApplication->fresh()->domain_port_overrides['https://www.web.example.com'] ?? null)->toBe($override);
+
+    $page->navigate($url)
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->assertSee('Redirect to www')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-redirect-persisted-'.($override ?? 80));
+})->with([null, 8080]);

From 8a03647a705a1dd981dd5be14c96ac0fd75851c0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:24:46 +0200
Subject: [PATCH 47/48] feat(domains): compact mobile domain rows and isolate
 preview modals

Show routing summaries on domain tables below 600px instead of squeezing desktop columns. Scope preview add/edit Livewire events by preview id, authorize preview domain actions, and add search plus unsaved-edit handling.
---
 DESIGN.md                                     |   9 +
 .../Project/Application/PreviewDomains.php    |  45 ++-
 resources/css/app.css                         |  59 ++++
 .../application/partials/domain-row.blade.php |  17 +-
 .../application/preview-domains.blade.php     | 263 ++++++++++++------
 .../service/partials/domain-table.blade.php   |  17 +-
 tests/Feature/ApplicationDomainsTest.php      |   8 +-
 .../PreviewDomainPortOverridesTest.php        | 221 ++++++++++++++-
 tests/Feature/ServiceDomainsTest.php          |  10 +
 .../Browser/ApplicationConfigurationTest.php  |  64 +++++
 10 files changed, 604 insertions(+), 109 deletions(-)

diff --git a/DESIGN.md b/DESIGN.md
index b27ed68f2d..86550bd0f2 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -570,6 +570,15 @@ that hide secondary columns before allowing horizontal overflow.
 
 ---
 
+### Domain rows on mobile
+
+Domain tables become compact summary cards below 600px. Keep the public URL on
+its own line, followed by a short routing summary such as `HTTP → HTTPS · Port
+80 · Noindex`. Put DNS status and the existing icon actions on the final row.
+Do not squeeze desktop label/value columns into a mobile card or move settings
+behind an overflow menu. Long domains wrap, and icon actions retain 40px touch
+targets.
+
 ## 8. Modals, confirmations, and toasts
 
 ### Modals
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index 2f0ee91ab8..cba3f18b65 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -38,6 +38,7 @@ class PreviewDomains extends Component
 
     public function mount(): void
     {
+        $this->authorize('view', $this->preview->application);
         $this->refreshDomains();
         if ($this->preview->application->build_pack === 'dockercompose') {
             $this->newDomainService = $this->composeServices()[0] ?? null;
@@ -94,7 +95,7 @@ class PreviewDomains extends Component
             ? ($this->composeServices()[0] ?? null)
             : null;
         $this->forceUseUnknownPort = false;
-        $this->dispatch('close-modal');
+        $this->dispatch('close-preview-domain-add', previewId: $this->preview->id);
 
         try {
             $server = $this->preview->application->destination?->server;
@@ -149,6 +150,7 @@ class PreviewDomains extends Component
 
     public function startEdit(int $index): void
     {
+        $this->authorize('update', $this->preview->application);
         if (! isset($this->domainRows[$index])) {
             return;
         }
@@ -159,7 +161,8 @@ class PreviewDomains extends Component
         if (filled($savedPort)) {
             $this->editingDomainParts['port'] = (string) $savedPort;
         }
-        $this->dispatch('open-preview-domain-edit');
+        $this->resetErrorBag('editingDomainParts.host');
+        $this->dispatch('open-preview-domain-edit', previewId: $this->preview->id);
     }
 
     public function updateDomain(): void
@@ -193,7 +196,7 @@ class PreviewDomains extends Component
             return;
         }
         $this->forceUseUnknownPort = false;
-        $this->dispatch('close-preview-domain-edit');
+        $this->dispatch('close-preview-domain-edit', previewId: $this->preview->id);
         $this->dispatch('success', 'Domain updated.');
         $this->checkDomainDns($index);
     }
@@ -229,6 +232,12 @@ class PreviewDomains extends Component
         if (! isset($this->domainRows[$index])) {
             return;
         }
+        if ($this->editingIndex === $index) {
+            $this->editingIndex = null;
+            $this->dispatch('close-preview-domain-edit', previewId: $this->preview->id);
+        } elseif ($this->editingIndex !== null && $this->editingIndex > $index) {
+            $this->editingIndex--;
+        }
         unset($this->domainRows[$index]);
         $this->domainRows = array_values($this->domainRows);
         if (! $this->persistDomains()) {
@@ -268,6 +277,7 @@ class PreviewDomains extends Component
 
     public function pollDnsChecks(): void
     {
+        $this->authorize('view', $this->preview->application);
         $checkingRows = collect($this->domainRows)
             ->where('dns_status', 'checking')
             ->values();
@@ -321,6 +331,7 @@ class PreviewDomains extends Component
 
     private function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
         $this->preview->refresh();
         $statuses = $this->preview->domain_dns_statuses ?? [];
         $rows = [];
@@ -336,6 +347,11 @@ class PreviewDomains extends Component
             }
         }
         $this->domainRows = $rows;
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && $row['service'] === $editingRow['service']);
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     private function persistDomains(): bool
@@ -349,13 +365,16 @@ class PreviewDomains extends Component
 
                 return false;
             }
-            $domains = collect($composeServices)
-                ->mapWithKeys(fn (string $service): array => [$service => ['domain' => '']])
-                ->all();
+            $existingDomains = json_decode($this->preview->docker_compose_domains ?: '[]', true) ?: [];
+            $domains = [];
+            foreach ($composeServices as $service) {
+                $domains[$service] = is_array($existingDomains[$service] ?? null) ? $existingDomains[$service] : [];
+                $domains[$service]['domain'] = '';
+            }
             $validRows = collect($this->domainRows)
                 ->filter(fn (array $row): bool => in_array($row['service'] ?? null, $composeServices, true));
             foreach ($validRows->groupBy('service') as $service => $rows) {
-                $domains[$service] = ['domain' => $rows->pluck('url')->implode(',')];
+                $domains[$service]['domain'] = $rows->pluck('url')->implode(',');
             }
             $this->preview->docker_compose_domains = json_encode($domains);
             $this->preview->fqdn = $validRows->pluck('url')->implode(',') ?: null;
@@ -440,10 +459,22 @@ class PreviewDomains extends Component
     {
         $status = $statuses[$this->statusKey($url, $service)] ?? [];
         $port = $this->effectiveDomainInternalPort($url, $service);
+        $redirect = 'both';
+        if ($this->preview->application->build_pack === 'dockercompose' && $service !== null) {
+            $usesPreviewRedirect = (int) $this->preview->application->compose_parsing_version >= 3;
+            $domains = json_decode(($usesPreviewRedirect
+                ? $this->preview->docker_compose_domains
+                : $this->preview->application->docker_compose_domains) ?: '[]', true) ?: [];
+            $storedRedirect = $usesPreviewRedirect
+                ? ($domains[$service]['redirect'] ?? null)
+                : data_get($domains, "$service.redirect");
+            $redirect = in_array($storedRedirect, ['www', 'non-www', 'both'], true) ? $storedRedirect : 'both';
+        }
 
         return [
             'url' => $url,
             'service' => $service,
+            'redirect' => $redirect,
             'internal_port' => $port['internal_port'],
             'has_port_override' => $port['has_port_override'],
             'dns_status' => $status['status'] ?? 'pending',
diff --git a/resources/css/app.css b/resources/css/app.css
index e3e20cf75e..199f904d08 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -4428,6 +4428,10 @@ a.command-palette-item:focus-visible {
     display: none;
 }
 
+.service-domain-mobile-summary {
+    display: none;
+}
+
 .service-domains-https .listbox-trigger {
     min-width: 7rem;
 }
@@ -4456,3 +4460,58 @@ a.command-palette-item:focus-visible {
         color: var(--coollabs-fg-dim);
     }
 }
+
+@container service-domains (max-width: 600px) {
+    .data-table-row.service-domains-overview-grid {
+        grid-template-columns: minmax(0, 1fr) auto;
+        gap: 0.625rem 0.75rem;
+        padding: 0.875rem;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child {
+        grid-column: 1 / -1;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child a,
+    .data-table-row.service-domains-overview-grid > :first-child span[title] {
+        overflow: visible;
+        white-space: normal;
+        overflow-wrap: anywhere;
+        line-height: 1.35;
+    }
+
+    .service-domain-detail,
+    .domains-service-desktop {
+        display: none;
+    }
+
+    .service-domain-mobile-summary {
+        display: flex;
+        grid-column: 1 / -1;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: 0.375rem 0.75rem;
+        color: var(--coollabs-fg-dim);
+        font-size: 12px;
+        line-height: 1.25rem;
+    }
+
+    .service-domain-mobile-summary > span:not(:last-child)::after {
+        margin-left: 0.75rem;
+        color: var(--coollabs-line);
+        content: "·";
+    }
+
+    .service-domain-dns {
+        justify-self: start;
+    }
+
+    .service-domain-actions {
+        justify-self: end;
+    }
+
+    .service-domain-actions .icon-button {
+        width: 2.5rem;
+        height: 2.5rem;
+    }
+}
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index da06c91464..bcacb44dc5 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -100,7 +100,20 @@
             </span>
         </div>
 
-        <div class="flex min-w-0 items-center">
+        <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+            @if (str_starts_with($row['url'], 'https://') && $isForceHttpsEnabled)
+                <span>HTTP → HTTPS</span>
+            @endif
+            @if (in_array($rowDirection, ['www', 'non-www'], true))
+                <span>{{ $rowDirection === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+            @elseif (! str_starts_with($row['url'], 'https://') || ! $isForceHttpsEnabled)
+                <span>No redirects</span>
+            @endif
+            <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+            <span>{{ $isNoindexed ? 'Noindex' : 'Indexable' }}</span>
+        </div>
+
+        <div class="service-domain-dns flex min-w-0 items-center">
             @if ($row['dns_status'] === 'failed')
                 <x-status-badge as="button" @click="$dispatch('open-dns-records-modal')" :status="$dnsLabel" :type="$dnsType"
                     title="View DNS records to fix" class="cursor-pointer hover:bg-neutral-200 dark:hover:bg-white/[0.1]" />
@@ -110,7 +123,7 @@
             @endif
         </div>
 
-        <div class="flex items-center justify-end gap-1">
+        <div class="service-domain-actions flex items-center justify-end gap-1">
             @can('update', $application)
                 <button type="button" wire:click="checkDomainDns({{ $index }})"
                     wire:loading.attr="disabled"
diff --git a/resources/views/livewire/project/application/preview-domains.blade.php b/resources/views/livewire/project/application/preview-domains.blade.php
index 2a131e43cd..69e18a2e5c 100644
--- a/resources/views/livewire/project/application/preview-domains.blade.php
+++ b/resources/views/livewire/project/application/preview-domains.blade.php
@@ -1,26 +1,48 @@
-<div class="flex flex-col gap-3" x-data="{ editOpen: false }"
-    @open-preview-domain-edit.window="editOpen = true"
-    @close-preview-domain-edit.window="editOpen = false">
+<div class="domains-overview-container flex flex-col gap-3" x-data="{
+        editOpen: false,
+        domainSearch: '',
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.editOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal;
+        },
+        openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
+            this.editOpen = true;
+            this.$nextTick(() => this.$refs.editForm.querySelector('input[required]')?.focus());
+        },
+        closeEditDomain() { this.editOpen = false; this.editingDomainBaseline = null; },
+        matchesDomainSearch(value) { return !this.domainSearch.trim() || value.toLowerCase().includes(this.domainSearch.trim().toLowerCase()); },
+    }"
+    @open-preview-domain-edit.window="if ($event.detail.previewId === {{ $preview->id }}) openEditDomain()"
+    @close-preview-domain-edit.window="if ($event.detail.previewId === {{ $preview->id }}) closeEditDomain()"
+    @keydown.escape.window="if (editOpen && !$wire.showPortWarningModal) closeEditDomain()">
     @if (collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking'))
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
     <div class="flex flex-wrap items-center gap-2">
-        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+        <p class="min-w-0 flex-1 truncate text-[13px] text-neutral-500 dark:text-fg-dim">
             {{ count($domainRows) }} domain{{ count($domainRows) === 1 ? '' : 's' }}
         </p>
+        @if (count($domainRows) > 0)
+            <input type="search" x-model="domainSearch" aria-label="Search preview domains"
+                class="input h-8! w-full sm:w-64!" placeholder="Search services or domains" />
+        @endif
         @can('update', $preview->application)
             @if (count($domainRows) > 0)
                 <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
                     <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
+                    Check all DNS
                 </x-forms.button>
             @endif
             <x-modal-input title="Add domain" :closeOutside="false" :wireIgnore="false"
-                canGate="update" :canResource="$preview->application">
+                canGate="update" :canResource="$preview->application"
+                @close-preview-domain-add.window="if ($event.detail.previewId === {{ $preview->id }}) modalOpen = false">
                 <x-slot:content>
                     <button type="button" class="button button-highlighted">
                         <x-reicon name="plus" class="size-3.5" />
-                        Add
+                        Add domain
                     </button>
                 </x-slot:content>
                 <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
@@ -46,113 +68,170 @@
         </div>
     @else
         <div class="application-settings-section-body is-flush overflow-visible">
-            <div class="data-table-header domains-table-grid-service">
+            <div class="data-table-header service-domains-overview-grid">
                 <span>Domain</span>
-                <span>DNS check</span>
-                <span></span>
-                <span></span>
+                <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+                <span class="text-right">Actions</span>
             </div>
-            @foreach ($domainRows as $index => $row)
-                @php
-                    $dnsType = match ($row['dns_status']) {
-                        'ok' => 'success',
-                        'failed' => 'error',
-                        'skipped' => 'warning',
-                        default => 'neutral',
-                    };
-                    $dnsLabel = match ($row['dns_status']) {
-                        'ok' => 'DNS OK',
-                        'failed' => 'DNS mismatch',
-                        'skipped' => 'DNS skipped',
-                        default => 'DNS pending',
-                    };
-                    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
-                @endphp
-                <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" class="env-table-item">
-                    <div class="data-table-row domains-table-grid-service">
-                        <div class="flex min-w-0 flex-col gap-1">
-                            <div class="flex min-w-0 flex-wrap items-center gap-2">
-                                <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
-                                <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                                    class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                                    title="{{ $row['url'] }}">{{ $row['url'] }}</a>
-                                @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                                    <span class="table-badge shrink-0"
-                                        title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
-                                        Internal port {{ $row['internal_port'] }}
-                                    </span>
+            @foreach (collect($domainRows)->groupBy(fn ($row) => $row['service'] ?? '', preserveKeys: true) as $serviceName => $rows)
+                @if ($isCompose)
+                    <div wire:key="preview-domain-service-{{ md5($serviceName) }}"
+                        x-show="matchesDomainSearch(@js($serviceName.' '.$rows->pluck('url')->implode(' ')))"
+                        class="border-b border-neutral-200 bg-neutral-50 px-4 py-3 text-sm font-medium dark:border-white/10 dark:bg-white/[0.04]">{{ $serviceName }}</div>
+                @endif
+                @foreach ($rows as $index => $row)
+                    @php
+                        $dnsType = match ($row['dns_status']) {
+                            'ok' => 'success',
+                            'failed' => 'error',
+                            'skipped' => 'warning',
+                            default => 'neutral',
+                        };
+                        $dnsLabel = match ($row['dns_status']) {
+                            'ok' => 'DNS matches',
+                            'failed' => 'DNS mismatch',
+                            'skipped' => 'DNS skipped',
+                            'checking' => 'Checking DNS...',
+                            'pending' => 'Not checked',
+                            default => 'DNS unknown',
+                        };
+                        $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+                    @endphp
+                    <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" x-show="matchesDomainSearch(@js(($row['service'] ?? '').' '.$row['url']))" class="env-table-item">
+                        <div class="data-table-row service-domains-overview-grid">
+                            <div class="flex min-w-0 flex-col gap-1">
+                                <div class="flex min-w-0 items-center gap-2">
+                                    <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
+                                    <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank" rel="noopener noreferrer"
+                                        class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                        title="{{ getFqdnWithoutPort($row['url']) }}">{{ getFqdnWithoutPort($row['url']) }}</a>
+                                </div>
+                            </div>
+                            <div class="service-domain-detail" title="Protocol redirect">
+                                <span class="service-domain-detail-label">Protocol redirect</span>
+                                <span>{{ str_starts_with($row['url'], 'https://') && $preview->application->isForceHttpsEnabled() ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+                            </div>
+                            <div class="service-domain-detail" title="Domain redirect">
+                                <span class="service-domain-detail-label">Domain redirect</span>
+                                <span>{{ match (($row['redirect'] ?? 'both')) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+                            </div>
+                            <div class="service-domain-detail"
+                                title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the application or Compose service port' }}">
+                                <span class="service-domain-detail-label">Internal port</span>
+                                @if (filled($row['internal_port'] ?? null))
+                                    <span aria-label="Internal port {{ $row['internal_port'] }}">{{ $row['internal_port'] }}</span>
                                 @else
-                                    <span class="table-badge table-badge-danger shrink-0"
-                                        title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
-                                        No internal port
+                                    <span role="img" aria-label="No internal port" title="No internal port. Set Ports Exposes or a per-domain internal port so the proxy can route this domain." class="text-red-500 dark:text-red-400">
+                                        <x-reicon name="alert-triangle" class="size-4" />
                                     </span>
                                 @endif
-                                @if (filled($row['service']))
-                                    <span class="table-badge shrink-0">{{ $row['service'] }}</span>
-                                @endif
                             </div>
-                        </div>
-                        <div class="flex min-w-0 items-center">
-                            <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
-                        </div>
-                        <div class="hidden"></div>
-                        <div class="flex items-center justify-end gap-1">
-                            @can('update', $preview->application)
-                                <button type="button" wire:click="checkDomainDns({{ $index }})"
-                                    wire:loading.attr="disabled"
-                                    wire:target="checkDomainDns({{ $index }}),checkAllDns"
-                                    class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
-                                    <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
-                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
-                                    <x-loading-on-button wire:loading.delay
-                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
-                                </button>
-                                <button type="button" wire:click="startEdit({{ $index }})"
-                                    class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
-                                    <x-reicon name="settings" class="size-3.5" />
-                                </button>
-                                <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
-                                    buttonTitle="Remove" isErrorButton
-                                    submitAction="removeDomainByKey({{ $domainKey }})"
-                                    :actions="[
-                                        'This domain will be removed from the preview deployment.',
-                                        'Redeploy the preview to apply proxy changes.',
-                                    ]"
-                                    :confirmWithPassword="false" :confirmWithText="false"
-                                    step2ButtonText="Remove domain">
-                                    <x-slot:trigger>
-                                        <button type="button"
-                                            class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
-                                            title="Remove domain" aria-label="Remove domain">
-                                            <x-reicon name="trash" class="size-3.5" />
-                                        </button>
-                                    </x-slot:trigger>
-                                </x-modal-confirmation>
-                            @endcan
+                            <div class="service-domain-detail">
+                                <span class="service-domain-detail-label">Search indexing</span>
+                                <span role="img" aria-label="Search indexing blocked"
+                                    title="Search indexing blocked">
+                                    <x-reicon name="x" class="size-4" />
+                                </span>
+                            </div>
+
+                            <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+                                @if (str_starts_with($row['url'], 'https://') && $preview->application->isForceHttpsEnabled())
+                                    <span>HTTP → HTTPS</span>
+                                @endif
+                                @if (in_array($row['redirect'] ?? 'both', ['www', 'non-www'], true))
+                                    <span>{{ ($row['redirect'] ?? 'both') === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+                                @elseif (! str_starts_with($row['url'], 'https://') || ! $preview->application->isForceHttpsEnabled())
+                                    <span>No redirects</span>
+                                @endif
+                                <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+                                <span>Noindex</span>
+                            </div>
+
+                            <div class="service-domain-dns flex min-w-0 items-center">
+                                <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
+                            </div>
+                            <div class="service-domain-actions flex items-center justify-end gap-1">
+                                @can('update', $preview->application)
+                                    <button type="button" wire:click="checkDomainDns({{ $index }})"
+                                        wire:loading.attr="disabled"
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns"
+                                        class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
+                                        <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
+                                            wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                        <x-loading-on-button wire:loading.delay
+                                            wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                    </button>
+                                    <button type="button" wire:click="startEdit({{ $index }})"
+                                        class="icon-button shrink-0" title="Domain settings" aria-label="Settings for {{ getFqdnWithoutPort($row['url']) }}">
+                                        <x-reicon name="settings" class="size-3.5" />
+                                    </button>
+                                    <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
+                                        buttonTitle="Remove" isErrorButton
+                                        submitAction="removeDomainByKey({{ $domainKey }})"
+                                        :actions="[
+                                            'This domain will be removed from the preview deployment.',
+                                            'Redeploy the preview to apply proxy changes.',
+                                        ]"
+                                        :confirmWithPassword="false" :confirmWithText="false"
+                                        step2ButtonText="Remove domain">
+                                        <x-slot:trigger>
+                                            <button type="button"
+                                                class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
+                                                title="Remove domain" aria-label="Remove domain">
+                                                <x-reicon name="trash" class="size-3.5" />
+                                            </button>
+                                        </x-slot:trigger>
+                                    </x-modal-confirmation>
+                                @endcan
+                            </div>
                         </div>
                     </div>
-                </div>
+                @endforeach
             @endforeach
+            <div x-cloak x-show="domainSearch.trim() && !@js(collect($domainRows)->map(fn ($row) => ($row['service'] ?? '').' '.$row['url'])->values()).some(value => matchesDomainSearch(value))" class="px-4 py-8">
+                <x-empty size="sm" title="No domains found" description="No service or domain matches your search." icon-name="search" />
+            </div>
         </div>
     @endif
 
     <template x-teleport="body">
         <div x-show="editOpen" x-cloak class="fixed inset-0 z-99 overflow-y-auto">
-            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="editOpen = false"></div>
+            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="closeEditDomain()"></div>
             <div class="relative flex min-h-full items-center justify-center p-4">
                 <div x-show="editOpen" x-trap.inert.noscroll="editOpen"
-                    class="application-settings-form application-settings-section relative w-full max-w-3xl">
+                    data-preview-domain-dialog class="application-settings-form application-settings-section relative w-full max-w-3xl">
                     <header>
-                        <h3>Edit domain</h3>
-                        <button type="button" @click="editOpen = false" class="icon-button" aria-label="Close">
+                        <h3>Domain settings</h3>
+                        <button type="button" @click="closeEditDomain()" class="icon-button" aria-label="Close">
                             <x-reicon name="x" class="size-4" />
                         </button>
                     </header>
                     <div class="application-settings-section-body">
-                        <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                        <form x-ref="editForm" wire:submit="updateDomain" class="flex flex-col gap-4">
+                            <template x-if="editOpen">
+                                <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges" targets="updateDomain,confirmUseUnknownPort" />
+                            </template>
+                            @if ($editingIndex !== null && filled($domainRows[$editingIndex]['service'] ?? null))
+                                <x-forms.input label="Service" :value="$domainRows[$editingIndex]['service']" readonly />
+                            @endif
                             <x-forms.domain-input id="editingDomainParts" />
-                            <div class="flex justify-end">
-                                <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                            <div class="grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                <x-forms.listbox id="preview-domain-indexing-{{ $preview->id }}" label="Search engine indexing"
+                                    :wire="false" value="noindex" disabled
+                                    helper="Preview deployments are always excluded from search indexing."
+                                    :options="[['value' => 'noindex', 'label' => 'Noindex']]" />
+                                <x-forms.listbox id="preview-domain-direction-{{ $preview->id }}" label="www redirect"
+                                    :wire="false" :value="$editingIndex !== null ? ($domainRows[$editingIndex]['redirect'] ?? 'both') : 'both'" disabled
+                                    helper="Read-only preview routing configuration."
+                                    :options="[
+                                        ['value' => 'both', 'label' => 'No redirect'],
+                                        ['value' => 'www', 'label' => 'Redirect to www'],
+                                        ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                    ]" />
                             </div>
                         </form>
                     </div>
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index fdf14e287a..5b4c0d1e11 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -133,7 +133,20 @@
                     </span>
                 </div>
 
-                <div class="flex min-w-0 items-center">
+                <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+                    @if (str_starts_with($row['url'], 'https://') && ($forceHttpsRedirects[$row['service_application_id']] ?? true))
+                        <span>HTTP → HTTPS</span>
+                    @endif
+                    @if (in_array($rowDirection, ['www', 'non-www'], true))
+                        <span>{{ $rowDirection === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+                    @elseif (! str_starts_with($row['url'], 'https://') || ! ($forceHttpsRedirects[$row['service_application_id']] ?? true))
+                        <span>No redirects</span>
+                    @endif
+                    <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+                    <span>{{ $isNoindexed ? 'Noindex' : 'Indexable' }}</span>
+                </div>
+
+                <div class="service-domain-dns flex min-w-0 items-center">
                     @if ($row['dns_status'] === 'failed')
                         <x-status-badge as="button" @click="$dispatch('open-dns-records-modal')" :status="$dnsLabel" :type="$dnsType"
                             title="View DNS records to fix" class="cursor-pointer hover:bg-neutral-200 dark:hover:bg-white/[0.1]" />
@@ -143,7 +156,7 @@
                     @endif
                 </div>
 
-                <div class="flex items-center justify-end gap-1">
+                <div class="service-domain-actions flex items-center justify-end gap-1">
                     @can('update', $service)
                         <button type="button" wire:click="checkDomainDns({{ $index }})"
                             wire:loading.attr="disabled"
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 5169c9e35d..2c8ea4fe51 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -1933,10 +1933,12 @@ it('uses compact labeled domain cards on mobile', function () {
         ->toContain('@container service-domains (max-width: 980px)')
         ->toContain('.service-domain-detail-label')
         ->toContain('.service-domains-overview-grid')
+        ->toContain('@container service-domains (max-width: 600px)')
+        ->toContain('.service-domain-mobile-summary')
         ->and($row)
-        ->toContain('service-domain-detail-label')
-        ->toContain('Search indexing')
-        ->toContain('Domain redirect');
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('No redirects')
+        ->toContain('Noindex');
 });
 
 it('uses segmented fields when adding and editing application domains', function () {
diff --git a/tests/Feature/PreviewDomainPortOverridesTest.php b/tests/Feature/PreviewDomainPortOverridesTest.php
index 18d3829334..b8825353b0 100644
--- a/tests/Feature/PreviewDomainPortOverridesTest.php
+++ b/tests/Feature/PreviewDomainPortOverridesTest.php
@@ -235,7 +235,7 @@ it('prunes a preview domain port override when removing the domain', function ()
         ->toBe(['https://two-preview.example.com' => 3000]);
 });
 
-it('shows an error badge when a preview domain has no internal port and ports exposes is empty', function () {
+it('shows a warning when a preview domain has no internal port and ports exposes is empty', function () {
     $this->application->update([
         'ports_exposes' => null,
     ]);
@@ -246,8 +246,9 @@ it('shows an error badge when a preview domain has no internal port and ports ex
     ]);
 
     Livewire::test(PreviewDomains::class, ['preview' => $preview])
-        ->assertSee('No internal port')
-        ->assertDontSee('Internal port');
+        ->assertSee('aria-label="No internal port"', false)
+        ->assertSee('Set Ports Exposes or a per-domain internal port')
+        ->assertDontSee('aria-label="Internal port ', false);
 });
 
 it('rejects adding a preview domain whose portless URL is already configured', function () {
@@ -760,3 +761,217 @@ it('keeps an existing custom compose preview port without another warning', func
 
     expect($preview->fresh()->domain_port_overrides['https://existing.example.com'] ?? null)->toBe(7070);
 });
+
+it('keeps the selected preview domain identity across polling refreshes', function (bool $compose) {
+    $first = 'https://first-preview.example.com';
+    $second = 'https://second-preview.example.com';
+    if ($compose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+    }
+    $preview = createPreviewForPortTests($this->application, 140, $compose ? [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => $first], 'api' => ['domain' => $first]]),
+    ] : ['fqdn' => "$first,$second"]);
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com');
+
+    $preview->update($compose ? [
+        'docker_compose_domains' => json_encode(['api' => ['domain' => $first], 'web' => ['domain' => $first]]),
+    ] : ['fqdn' => "$second,$first"]);
+
+    $component->call('pollDnsChecks')
+        ->assertSet('editingIndex', 1)
+        ->assertSet('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+    if ($compose) {
+        expect(json_decode($preview->docker_compose_domains, true))
+            ->toMatchArray(['web' => ['domain' => 'https://renamed-preview.example.com'], 'api' => ['domain' => $first]]);
+    } else {
+        expect($preview->fqdn)->toBe("$second,https://renamed-preview.example.com");
+    }
+})->with([false, true]);
+
+it('keeps the selected preview domain when deleting an earlier row', function () {
+    $preview = createPreviewForPortTests($this->application, 141, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 1)
+        ->call('removeDomainByKey', hash('sha256', 'https://first-preview.example.com|'))
+        ->assertSet('editingIndex', 0)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($preview->fresh()->fqdn)->toBe('https://renamed-preview.example.com');
+});
+
+it('clears the selected preview domain when it is deleted', function () {
+    $preview = createPreviewForPortTests($this->application, 142, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->call('removeDomain', 0)
+        ->assertSet('editingIndex', null)
+        ->assertDispatched('close-preview-domain-edit', previewId: $preview->id)
+        ->set('editingDomainParts.host', 'wrong-preview.example.com')
+        ->call('updateDomain');
+
+    expect($preview->fresh()->fqdn)->toBe('https://second-preview.example.com');
+});
+
+it('scopes preview domain modal events to their preview', function () {
+    $preview = createPreviewForPortTests($this->application, 143, ['fqdn' => 'https://preview.example.com']);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->assertDispatched('open-preview-domain-edit', previewId: $preview->id)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertDispatched('close-preview-domain-edit', previewId: $preview->id)
+        ->set('newDomainParts.host', 'another-preview.example.com')
+        ->call('addDomain')
+        ->assertDispatched('close-preview-domain-add', previewId: $preview->id)
+        ->assertNotDispatched('close-modal');
+});
+
+it('prevents members from opening editable preview domain settings', function () {
+    $preview = createPreviewForPortTests($this->application, 144, ['fqdn' => 'https://preview.example.com']);
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->actingAs($this->user->fresh());
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSuccessful()
+        ->call('startEdit', 0)
+        ->assertForbidden();
+});
+
+it('prevents reading preview domains from another team', function () {
+    $preview = createPreviewForPortTests($this->application, 145, ['fqdn' => 'https://private-preview.example.com']);
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherTeam->members()->attach($otherUser->id, ['role' => 'owner']);
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])->assertForbidden();
+});
+
+it('rechecks preview view permission before polling domains', function () {
+    $preview = createPreviewForPortTests($this->application, 146, ['fqdn' => 'https://private-preview.example.com']);
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    $this->team->members()->detach($this->user->id);
+    $this->actingAs($this->user->fresh());
+
+    $component->call('pollDnsChecks')->assertForbidden();
+});
+
+it('reports the readonly preview redirect policy used by proxy labels', function (int $parserVersion, string $expectedRedirect) {
+    $compose = $parserVersion > 0;
+    $this->application->update(array_merge(['redirect' => 'www'], $compose ? [
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => (string) $parserVersion,
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [3000]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://production.example.com', 'redirect' => 'www']]),
+    ] : []));
+    $previewDomain = $expectedRedirect === 'non-www' ? 'https://www.preview.example.com' : 'https://preview.example.com';
+    $preview = createPreviewForPortTests($this->application, 147, array_merge([
+        'fqdn' => $previewDomain,
+    ], $compose ? [
+        'docker_compose_domains' => json_encode(['web' => [
+            'domain' => $previewDomain,
+            'redirect' => 'non-www',
+        ]]),
+    ] : []));
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.redirect', $expectedRedirect);
+
+    $labels = $compose
+        ? collect(data_get($this->application->fresh()->parse(147, $preview->id), 'services.web-pr-147.labels'))->implode("\n")
+        : implode("\n", generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+    expect($labels)->toContain('X-Robots-Tag=noindex, nofollow');
+    if ($expectedRedirect === 'both') {
+        expect($labels)->not->toContain('.redirectregex.');
+    } else {
+        expect($labels)->toContain('.redirectregex.');
+    }
+})->with([
+    'normal previews ignore the production redirect' => [0, 'both'],
+    'legacy compose previews use the production redirect' => [2, 'www'],
+    'current compose previews use their own stored redirect' => [3, 'non-www'],
+]);
+
+it('clears the previous preview address validation error when opening another domain', function () {
+    $preview = createPreviewForPortTests($this->application, 148, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'not a hostname')
+        ->call('updateDomain')
+        ->assertHasErrors('editingDomainParts.host')
+        ->call('startEdit', 1)
+        ->assertHasNoErrors('editingDomainParts.host');
+});
+
+it('inherits preview HTTPS redirect policy while always preventing indexing', function (bool $compose, bool $forceHttps) {
+    if ($compose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'compose_parsing_version' => '3',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [3000]\n",
+            'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://production.example.com']]),
+        ]);
+    }
+    $this->application->settings()->update(['is_force_https_enabled' => $forceHttps]);
+    $preview = createPreviewForPortTests($this->application, 149, array_merge([
+        'fqdn' => 'https://preview.example.com',
+    ], $compose ? [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://preview.example.com']]),
+    ] : []));
+
+    $labels = $compose
+        ? collect(data_get($this->application->fresh()->parse(149, $preview->id), 'services.web-pr-149.labels'))->implode("\n")
+        : implode("\n", generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)->toContain('X-Robots-Tag=noindex, nofollow');
+    expect((bool) preg_match('/\.middlewares=[^\n]*redirect-to-https/', $labels))->toBe($forceHttps);
+})->with([false, true])->with([false, true]);
+
+it('preserves readonly compose preview redirects when saving an address', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+    ]);
+    $preview = createPreviewForPortTests($this->application, 150, [
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://www.preview.example.com', 'redirect' => 'non-www'],
+            'api' => ['domain' => '', 'redirect' => 'www'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.redirect', 'non-www')
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'www.renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('domainRows.0.redirect', 'non-www');
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => 'https://www.renamed-preview.example.com', 'redirect' => 'non-www'],
+        'api' => ['domain' => '', 'redirect' => 'www'],
+    ]);
+});
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 6b47a085a7..e5f2768cd8 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -1011,6 +1011,16 @@ it('renders compact icon-only domain actions with accessible labels', function (
     expect($html)->not->toContain('aria-label="More actions for');
 });
 
+it('uses the shared mobile domain summary layout', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+
+    expect($view)
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('Domain routing summary')
+        ->toContain('No redirects')
+        ->toContain('Noindex');
+});
+
 it('reuses the floating save bar for pending domain address edits', function () {
     $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
 
diff --git a/tests/v4/Browser/ApplicationConfigurationTest.php b/tests/v4/Browser/ApplicationConfigurationTest.php
index bd9084d3f5..f3e5b6cc8c 100644
--- a/tests/v4/Browser/ApplicationConfigurationTest.php
+++ b/tests/v4/Browser/ApplicationConfigurationTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\ApplicationPreview;
 use App\Models\InstanceSettings;
 use App\Models\LocalPersistentVolume;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -294,3 +295,66 @@ it('edits Compose application domain redirects in the unified settings dialog',
         ->assertSee('https://www.web.example.com')
         ->screenshot(filename: 'application-compose-domain-overview');
 });
+
+it('uses compact preview domains and opens only the selected preview settings', function (bool $isCompose) {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    if ($isCompose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'compose_parsing_version' => '3',
+            'docker_compose_raw' => "services:\n  web.api:\n    image: nginx:alpine\n    expose:\n      - '8080'\n",
+            'docker_compose_domains' => json_encode(['web.api' => ['domain' => 'https://production.example.com']]),
+        ]);
+    }
+    foreach ([101, 102] as $number) {
+        ApplicationPreview::create([
+            'application_id' => $this->application->id,
+            'pull_request_id' => $number,
+            'pull_request_html_url' => "https://example.com/pull/{$number}",
+            'fqdn' => $isCompose ? null : "https://preview-{$number}.example.com",
+            'docker_compose_domains' => $isCompose ? json_encode(['web.api' => ['domain' => "https://preview-{$number}.example.com"]]) : null,
+        ]);
+    }
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/preview-deployments';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->click('[aria-label="Settings for https://preview-101.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertVisible('[aria-label="Search indexing blocked"] >> nth=0');
+    expect($page->script("[...document.querySelectorAll('[data-preview-domain-dialog]')].filter(el => el.getClientRects().length > 0).length"))->toBe(1);
+    $page->fill('#editingDomainParts-host:visible', 'renamed-preview.example.com')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'preview-domain-unified-settings')
+        ->click('.is-dirty [wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertSee('https://renamed-preview.example.com')
+        ->assertSee('https://preview-102.example.com')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'preview-domains-compact');
+    $page->click('[aria-label="Settings for https://preview-102.example.com"]')
+        ->assertSee('Domain settings')
+        ->fill('#editingDomainParts-path:visible', '/discard')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'preview-domain-before-reset')
+        ->click('.is-dirty button:has-text("Reset")')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://preview-102.example.com"]')
+        ->assertValue('#editingDomainParts-path:visible', '')
+        ->click('[data-preview-domain-dialog]:visible [aria-label="Close"]')
+        ->resize(390, 844)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'preview-domains-mobile');
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+})->with(['regular application' => false, 'Compose application' => true]);
+
+it('declares the compact preview domain layout and shared save bar', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+    expect($view)->toContain('service-domains-overview-grid')
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('Domain routing summary')
+        ->toContain('<x-unsaved-bar action="updateDomain"')
+        ->toContain('$event.detail.previewId');
+});

From ba30c64d7df802861a66f53a0c59e6b9a9018473 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:25:06 +0200
Subject: [PATCH 48/48] fix(stripe): prevent duplicate subscription checkouts
 (#11666)

---
 DESIGN.md                                     |   3 +-
 app/Actions/Stripe/CreateCheckoutSession.php  | 221 ++++++++++++
 .../CheckoutUnavailableException.php          |  18 +
 app/Jobs/StripeProcessJob.php                 |  15 +-
 app/Livewire/Subscription/Index.php           |  38 +-
 app/Livewire/Subscription/PricingPlans.php    |  81 ++---
 database/seeders/TeamSeeder.php               |   6 +-
 database/seeders/UserSeeder.php               |   3 +-
 resources/views/components/toast.blade.php    |  11 +-
 .../views/livewire/layout-popups.blade.php    |  16 +-
 .../CreateCheckoutSessionTest.php             | 338 ++++++++++++++++++
 .../Subscription/StripeProcessJobTest.php     |  77 +++-
 .../SubscriptionPricingPageTest.php           | 127 +++++++
 tests/Feature/TeamSeederTest.php              |  27 ++
 tests/Feature/ToastPositionTest.php           |  49 +++
 tests/Feature/UserSeederTest.php              |  48 +++
 16 files changed, 1004 insertions(+), 74 deletions(-)
 create mode 100644 app/Actions/Stripe/CreateCheckoutSession.php
 create mode 100644 app/Exceptions/CheckoutUnavailableException.php
 create mode 100644 tests/Feature/Subscription/CreateCheckoutSessionTest.php
 create mode 100644 tests/Feature/TeamSeederTest.php
 create mode 100644 tests/Feature/UserSeederTest.php

diff --git a/DESIGN.md b/DESIGN.md
index 86550bd0f2..11048ad5d2 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -638,8 +638,9 @@ Current toast behavior:
 - Reicon status tile for success, info, warning, danger, or default;
 - title plus optional description;
 - dismiss and copy-details actions;
-- up to four stacked notifications;
+- normally up to four stacked notifications, without evicting persistent notices;
 - four-second dismissal, paused while hovered;
+- `persistent: true` disables automatic dismissal, including after hover; users close these notices with the dismiss button;
 - support for all six screen positions and sanitized custom HTML.
 
 Do not bring back the old oversized dark rectangle.
diff --git a/app/Actions/Stripe/CreateCheckoutSession.php b/app/Actions/Stripe/CreateCheckoutSession.php
new file mode 100644
index 0000000000..42d14c0f25
--- /dev/null
+++ b/app/Actions/Stripe/CreateCheckoutSession.php
@@ -0,0 +1,221 @@
+<?php
+
+namespace App\Actions\Stripe;
+
+use App\Exceptions\CheckoutUnavailableException;
+use App\Models\Subscription;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+use Stripe\Stripe;
+use Stripe\StripeClient;
+use Throwable;
+
+class CreateCheckoutSession
+{
+    private const BLOCKING_SUBSCRIPTION_STATUSES = [
+        'active',
+        'incomplete',
+        'past_due',
+        'paused',
+        'trialing',
+        'unpaid',
+    ];
+
+    private const RECOVERABLE_SUBSCRIPTION_STATUSES = [
+        'incomplete',
+        'past_due',
+        'paused',
+        'unpaid',
+    ];
+
+    public function __construct(private ?StripeClient $stripe = null)
+    {
+        $this->stripe ??= app(StripeClient::class);
+    }
+
+    public static function lockKey(int $teamId): string
+    {
+        return "stripe-checkout:team:{$teamId}";
+    }
+
+    public function execute(Team $team, User $user, string $priceId): object
+    {
+        $lock = Cache::lock(self::lockKey($team->id), 30);
+
+        if (! $lock->get()) {
+            throw new CheckoutUnavailableException('A subscription checkout is already being created for this team.');
+        }
+
+        $previousMaxNetworkRetries = Stripe::getMaxNetworkRetries();
+        Stripe::setMaxNetworkRetries(2);
+
+        try {
+            return $this->createOrReuseSession($team, $user, $priceId);
+        } finally {
+            Stripe::setMaxNetworkRetries($previousMaxNetworkRetries);
+            $lock->release();
+        }
+    }
+
+    private function createOrReuseSession(Team $team, User $user, string $priceId): object
+    {
+        $subscription = Subscription::query()->firstOrNew(['team_id' => $team->id]);
+        $customerId = $subscription->stripe_customer_id;
+
+        if (! $customerId) {
+            $customer = $this->stripe->customers->create([
+                'email' => $user->email,
+                'metadata' => [
+                    'team_id' => $team->id,
+                ],
+            ], [
+                'idempotency_key' => "coolify-team-{$team->id}-customer",
+            ]);
+            $customerId = $customer->id;
+            $subscription->stripe_customer_id = $customerId;
+            $subscription->save();
+
+            Log::info('Stripe customer assigned for subscription checkout.', [
+                'team_id' => $team->id,
+                'stripe_customer_id' => $customerId,
+            ]);
+        }
+
+        $blockingSubscription = null;
+        foreach ($this->stripe->subscriptions->all([
+            'customer' => $customerId,
+            'limit' => 10,
+            'status' => 'all',
+        ])->autoPagingIterator() as $stripeSubscription) {
+            if (in_array($stripeSubscription->status, self::BLOCKING_SUBSCRIPTION_STATUSES, true)) {
+                $blockingSubscription = $stripeSubscription;
+                break;
+            }
+        }
+
+        $this->throwIfBlockingSubscription($team, $customerId, $blockingSubscription);
+
+        $sessions = $this->stripe->checkout->sessions->all([
+            'customer' => $customerId,
+            'limit' => 10,
+            'status' => 'open',
+        ]);
+        $subscriptionSessions = collect($sessions->data)->filter(
+            fn (object $session): bool => ($session->mode ?? null) === 'subscription'
+        );
+        $openSession = $subscriptionSessions->first(
+            fn (object $session): bool => ($session->status ?? null) === 'open'
+        );
+
+        if ($openSession) {
+            $lineItems = $this->stripe->checkout->sessions->allLineItems($openSession->id);
+            if (count($lineItems->data) === 1 && data_get($lineItems, 'data.0.price.id') === $priceId) {
+                Log::info('Reusing pending Stripe subscription checkout.', [
+                    'team_id' => $team->id,
+                    'stripe_customer_id' => $customerId,
+                    'stripe_checkout_session_id' => $openSession->id,
+                    'stripe_subscription_id' => $openSession->subscription ?? null,
+                ]);
+
+                return $openSession;
+            }
+
+            $this->stripe->checkout->sessions->expire($openSession->id);
+        }
+
+        $session = $this->stripe->checkout->sessions->create([
+            'allow_promotion_codes' => true,
+            'billing_address_collection' => 'required',
+            'client_reference_id' => $user->id.':'.$team->id,
+            'customer' => $customerId,
+            'customer_update' => [
+                'name' => 'auto',
+                'address' => 'auto',
+            ],
+            'line_items' => [[
+                'price' => $priceId,
+                'adjustable_quantity' => [
+                    'enabled' => true,
+                    'minimum' => 2,
+                ],
+                'quantity' => 2,
+            ]],
+            'tax_id_collection' => [
+                'enabled' => true,
+            ],
+            'automatic_tax' => [
+                'enabled' => true,
+            ],
+            'subscription_data' => [
+                'metadata' => [
+                    'user_id' => $user->id,
+                    'team_id' => $team->id,
+                ],
+            ],
+            'payment_method_collection' => 'if_required',
+            'mode' => 'subscription',
+            'expires_at' => now()->addMinutes(35)->timestamp,
+            'success_url' => route('dashboard', ['success' => true]),
+            'cancel_url' => route('subscription.index', ['cancelled' => true]),
+        ]);
+
+        Log::info('Stripe subscription checkout created.', [
+            'team_id' => $team->id,
+            'stripe_customer_id' => $customerId,
+            'stripe_checkout_session_id' => $session->id,
+            'stripe_subscription_id' => $session->subscription ?? null,
+        ]);
+
+        return $session;
+    }
+
+    private function throwIfBlockingSubscription(Team $team, string $customerId, ?object $blockingSubscription): void
+    {
+        if (! $blockingSubscription) {
+            return;
+        }
+
+        Log::warning('Stripe subscription checkout blocked by existing subscription.', [
+            'team_id' => $team->id,
+            'stripe_customer_id' => $customerId,
+            'stripe_subscription_id' => $blockingSubscription->id,
+            'stripe_subscription_status' => $blockingSubscription->status,
+        ]);
+
+        $portalUrl = in_array($blockingSubscription->status, self::RECOVERABLE_SUBSCRIPTION_STATUSES, true)
+            ? $this->billingPortalUrl($customerId)
+            : null;
+
+        throw new CheckoutUnavailableException(
+            $this->blockingSubscriptionMessage($blockingSubscription->status),
+            $portalUrl,
+        );
+    }
+
+    private function blockingSubscriptionMessage(string $status): string
+    {
+        return match ($status) {
+            'incomplete' => "This team's subscription payment is incomplete. Complete the payment in the billing portal.",
+            'past_due' => "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.",
+            'unpaid' => "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal.",
+            'paused' => "This team's subscription is paused. Resume it in the billing portal.",
+            default => 'Team already has an active subscription.',
+        };
+    }
+
+    private function billingPortalUrl(string $customerId): ?string
+    {
+        try {
+            $session = $this->stripe->billingPortal->sessions->create([
+                'customer' => $customerId,
+                'return_url' => route('subscription.show'),
+            ]);
+        } catch (Throwable) {
+            return null;
+        }
+
+        return is_string($session->url ?? null) ? $session->url : null;
+    }
+}
diff --git a/app/Exceptions/CheckoutUnavailableException.php b/app/Exceptions/CheckoutUnavailableException.php
new file mode 100644
index 0000000000..329941dbc6
--- /dev/null
+++ b/app/Exceptions/CheckoutUnavailableException.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Exceptions;
+
+use Exception;
+use Throwable;
+
+class CheckoutUnavailableException extends Exception
+{
+    public function __construct(
+        string $message = '',
+        public readonly ?string $billingPortalUrl = null,
+        int $code = 0,
+        ?Throwable $previous = null,
+    ) {
+        parent::__construct($message, $code, $previous);
+    }
+}
diff --git a/app/Jobs/StripeProcessJob.php b/app/Jobs/StripeProcessJob.php
index 6ddbfe145c..0f56476e25 100644
--- a/app/Jobs/StripeProcessJob.php
+++ b/app/Jobs/StripeProcessJob.php
@@ -74,7 +74,7 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                         // send_internal_notification("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}, subscriptionid: {$subscriptionId}.");
                         throw new \RuntimeException("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}, subscriptionid: {$subscriptionId}.");
                     }
-                    Subscription::updateOrCreate(
+                    $subscription = Subscription::updateOrCreate(
                         ['team_id' => $teamId],
                         [
                             'stripe_subscription_id' => $subscriptionId,
@@ -83,6 +83,12 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                             'stripe_past_due' => false,
                         ]
                     );
+                    logger()->info('Stripe subscription checkout completed.', [
+                        'team_id' => $team->id,
+                        'stripe_customer_id' => $customerId,
+                        'stripe_checkout_session_id' => data_get($data, 'id'),
+                        'stripe_subscription_id' => $subscription->stripe_subscription_id,
+                    ]);
                     break;
                 case 'invoice.paid':
                     $customerId = data_get($data, 'customer');
@@ -218,7 +224,7 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                         // send_internal_notification("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}.");
                         throw new \RuntimeException("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}.");
                     }
-                    Subscription::updateOrCreate(
+                    $subscription = Subscription::firstOrCreate(
                         ['team_id' => $teamId],
                         [
                             'stripe_subscription_id' => $subscriptionId,
@@ -226,6 +232,11 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                             'stripe_invoice_paid' => false,
                         ]
                     );
+                    if (! $subscription->stripe_subscription_id && $subscription->stripe_customer_id === $customerId) {
+                        $subscription->update(['stripe_subscription_id' => $subscriptionId]);
+                    } elseif ($subscription->stripe_customer_id !== $customerId) {
+                        throw new \RuntimeException("Stripe customer ID mismatch for team {$teamId}: stored {$subscription->stripe_customer_id}, event {$customerId}.");
+                    }
                     break;
                 case 'customer.subscription.updated':
                     $teamId = data_get($data, 'metadata.team_id');
diff --git a/app/Livewire/Subscription/Index.php b/app/Livewire/Subscription/Index.php
index 022f6fdeed..31f2e9141d 100644
--- a/app/Livewire/Subscription/Index.php
+++ b/app/Livewire/Subscription/Index.php
@@ -2,8 +2,11 @@
 
 namespace App\Livewire\Subscription;
 
+use App\Actions\Stripe\UpdateSubscriptionQuantity;
+use App\Jobs\ServerLimitCheckJob;
 use App\Models\InstanceSettings;
 use App\Providers\RouteServiceProvider;
+use Illuminate\Support\Facades\Cache;
 use Livewire\Component;
 use Stripe\StripeClient;
 
@@ -49,12 +52,19 @@ class Index extends Component
         return redirect($session->url);
     }
 
-    public function getStripeStatus()
+    public function getStripeStatus(): mixed
     {
+        $team = currentTeam();
+        $user = auth()->user();
+        abort_unless($team && $user?->isAdminOfTeam($team->id), 403);
+
         try {
-            $subscription = currentTeam()->subscription;
+            $subscription = $team->subscription()->first();
+            if (! $subscription?->stripe_customer_id) {
+                return null;
+            }
             $stripe = app(StripeClient::class);
-            $customer = $stripe->customers->retrieve(currentTeam()->subscription->stripe_customer_id);
+            $customer = $stripe->customers->retrieve($subscription->stripe_customer_id);
             if ($customer) {
                 $subscriptions = $stripe->subscriptions->all(['customer' => $customer->id]);
                 $currentTeam = currentTeam()->id ?? null;
@@ -65,6 +75,26 @@ class Index extends Component
                         $subscription->update([
                             'stripe_subscription_id' => $foundSubscription->id,
                         ]);
+                        if ($status === 'active') {
+                            $subscription->update([
+                                'stripe_invoice_paid' => true,
+                                'stripe_past_due' => false,
+                                'stripe_plan_id' => data_get($foundSubscription, 'items.data.0.price.id'),
+                                'stripe_cancel_at_period_end' => data_get($foundSubscription, 'cancel_at_period_end', false),
+                            ]);
+                            if (str(data_get($foundSubscription, 'items.data.0.price.lookup_key'))->contains('dynamic')) {
+                                $quantity = max(
+                                    UpdateSubscriptionQuantity::MIN_SERVER_LIMIT,
+                                    min((int) data_get($foundSubscription, 'items.data.0.quantity', 2), UpdateSubscriptionQuantity::MAX_SERVER_LIMIT)
+                                );
+                                $team->update(['custom_server_limit' => $quantity]);
+                                ServerLimitCheckJob::dispatch($team);
+                            }
+                            $team->unsetRelation('subscription');
+                            Cache::forget('user:'.$user->id.':team:'.$team->id);
+
+                            return redirect()->route('subscription.show');
+                        }
                         if ($status === 'unpaid') {
                             $this->isUnpaid = true;
                         }
@@ -82,6 +112,8 @@ class Index extends Component
         } finally {
             $this->loading = false;
         }
+
+        return null;
     }
 
     public function render()
diff --git a/app/Livewire/Subscription/PricingPlans.php b/app/Livewire/Subscription/PricingPlans.php
index 65966aea5f..e53c5c677b 100644
--- a/app/Livewire/Subscription/PricingPlans.php
+++ b/app/Livewire/Subscription/PricingPlans.php
@@ -2,22 +2,28 @@
 
 namespace App\Livewire\Subscription;
 
-use Illuminate\Support\Facades\Auth;
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
 use Livewire\Component;
-use Stripe\Checkout\Session;
-use Stripe\Stripe;
+use RuntimeException;
+use Stripe\Exception\ApiErrorException;
 
 class PricingPlans extends Component
 {
-    public function subscribeStripe($type)
+    public function subscribeStripe(string $type): mixed
     {
-        if (currentTeam()->subscription?->stripe_invoice_paid) {
-            $this->dispatch('error', 'Team already has an active subscription.');
+        $team = currentTeam();
+        $user = auth()->user();
 
-            return;
+        if (! $team || ! $user?->isAdminOfTeam($team->id)) {
+            abort(403);
         }
 
-        Stripe::setApiKey(config('subscription.stripe_api_key'));
+        if ($team->subscription?->stripe_invoice_paid) {
+            $this->dispatch('error', 'Team already has an active subscription.');
+
+            return null;
+        }
 
         $priceId = match ($type) {
             'dynamic-monthly' => config('subscription.stripe_price_id_dynamic_monthly'),
@@ -28,48 +34,29 @@ class PricingPlans extends Component
         if (! $priceId) {
             $this->dispatch('error', 'Price ID not found! Please contact the administrator.');
 
-            return;
+            return null;
         }
-        $payload = [
-            'allow_promotion_codes' => true,
-            'billing_address_collection' => 'required',
-            'client_reference_id' => Auth::id().':'.currentTeam()->id,
-            'line_items' => [[
-                'price' => $priceId,
-                'adjustable_quantity' => [
-                    'enabled' => true,
-                    'minimum' => 2,
-                ],
-                'quantity' => 2,
-            ]],
-            'tax_id_collection' => [
-                'enabled' => true,
-            ],
-            'automatic_tax' => [
-                'enabled' => true,
-            ],
-            'subscription_data' => [
-                'metadata' => [
-                    'user_id' => Auth::id(),
-                    'team_id' => currentTeam()->id,
-                ],
-            ],
-            'payment_method_collection' => 'if_required',
-            'mode' => 'subscription',
-            'success_url' => route('dashboard', ['success' => true]),
-            'cancel_url' => route('subscription.index', ['cancelled' => true]),
-        ];
+        try {
+            $session = app(CreateCheckoutSession::class)->execute($team, $user, $priceId);
+        } catch (ApiErrorException $exception) {
+            report($exception);
+            $this->dispatch('error', 'Unable to confirm checkout with Stripe. Please try again shortly.');
 
-        $customer = currentTeam()->subscription?->stripe_customer_id ?? null;
-        if ($customer) {
-            $payload['customer'] = $customer;
-            $payload['customer_update'] = [
-                'name' => 'auto',
-            ];
-        } else {
-            $payload['customer_email'] = Auth::user()->email;
+            return null;
+        } catch (CheckoutUnavailableException $exception) {
+            $message = $exception->getMessage();
+            if ($exception->billingPortalUrl) {
+                $message .= ' <a href="'.e($exception->billingPortalUrl).'" target="_blank" rel="noopener noreferrer" class="underline">Open billing portal</a>';
+            }
+            $this->dispatch('error', $message);
+
+            return null;
+        } catch (RuntimeException $exception) {
+            report($exception);
+            $this->dispatch('error', 'Unable to start checkout. Please try again shortly.');
+
+            return null;
         }
-        $session = Session::create($payload);
 
         return redirect($session->url, 303);
     }
diff --git a/database/seeders/TeamSeeder.php b/database/seeders/TeamSeeder.php
index 67c5ec4897..08426044c6 100644
--- a/database/seeders/TeamSeeder.php
+++ b/database/seeders/TeamSeeder.php
@@ -10,14 +10,14 @@ class TeamSeeder extends Seeder
 {
     public function run(): void
     {
-        $normal_user_in_root_team = User::find(1);
+        $normal_user_in_root_team = User::where('email', 'test2@example.com')->firstOrFail();
         $root_user_personal_team = Team::find(0);
         $root_user_personal_team->description = 'The root team';
         $root_user_personal_team->save();
 
         $normal_user_in_root_team->teams()->attach($root_user_personal_team);
-        $normal_user_not_in_root_team = User::find(2);
-        $normal_user_in_root_team_personal_team = Team::find(1);
+        $normal_user_not_in_root_team = User::where('email', 'test3@example.com')->firstOrFail();
+        $normal_user_in_root_team_personal_team = $normal_user_in_root_team->teams()->where('personal_team', true)->wherePivot('role', 'owner')->firstOrFail();
         $normal_user_not_in_root_team->teams()->attach($normal_user_in_root_team_personal_team, ['role' => 'admin']);
     }
 }
diff --git a/database/seeders/UserSeeder.php b/database/seeders/UserSeeder.php
index 2ac615cc01..9f237dc3b5 100644
--- a/database/seeders/UserSeeder.php
+++ b/database/seeders/UserSeeder.php
@@ -15,14 +15,13 @@ class UserSeeder extends Seeder
             'email' => 'test@example.com',
         ]);
         User::factory()->create([
-            'id' => 1,
             'name' => 'Normal User (but in root team)',
             'email' => 'test2@example.com',
         ]);
         User::factory()->create([
-            'id' => 2,
             'name' => 'Normal User (not in root team)',
             'email' => 'test3@example.com',
         ]);
+
     }
 }
diff --git a/resources/views/components/toast.blade.php b/resources/views/components/toast.blade.php
index 8c3eef13ef..7de075a2ba 100644
--- a/resources/views/components/toast.blade.php
+++ b/resources/views/components/toast.blade.php
@@ -8,6 +8,7 @@
                     description: options.description ?? '',
                     position: options.position ?? 'bottom-right',
                     html: options.html ?? '',
+                    persistent: options.persistent ?? false,
                 },
             }));
         } catch (error) {
@@ -29,14 +30,19 @@
                     type: event.detail.type,
                     html: event.detail.html ? window.sanitizeHTML(event.detail.html) : '',
                     timeout: null,
+                    persistent: event.detail.persistent === true,
                     copied: false,
                     copiedTimeout: null,
                 };
 
                 this.toasts.unshift(toast);
                 if (this.toasts.length > 4) {
-                    const removed = this.toasts.pop();
-                    clearTimeout(removed?.timeout);
+                    const index = this.toasts.findLastIndex(item => !item.persistent);
+                    if (index !== -1) {
+                        const [removed] = this.toasts.splice(index, 1);
+                        clearTimeout(removed.timeout);
+                        clearTimeout(removed.copiedTimeout);
+                    }
                 }
 
                 this.$nextTick(() => {
@@ -49,6 +55,7 @@
             },
             scheduleToast(toast, delay = 2000) {
                 clearTimeout(toast.timeout);
+                if (toast.persistent) return;
                 toast.timeout = setTimeout(() => this.removeToast(toast.id), delay);
             },
             pauseToast(toast) {
diff --git a/resources/views/livewire/layout-popups.blade.php b/resources/views/livewire/layout-popups.blade.php
index 693c332d95..938b08f4cc 100644
--- a/resources/views/livewire/layout-popups.blade.php
+++ b/resources/views/livewire/layout-popups.blade.php
@@ -212,17 +212,11 @@
         </x-banner>
     @endif
     @if (request()->query->get('success'))
-        <x-banner>
-            <div class="flex items-center gap-2">
-                <svg class="w-5 h-5 text-green-500 shrink-0" fill="currentColor" viewBox="0 0 20 20">
-                    <path fill-rule="evenodd"
-                        d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z"
-                        clip-rule="evenodd" />
-                </svg>
-                <span><span class="font-bold text-green-500">Welcome onboard!</span> Your subscription has been
-                    activated. It could take a few seconds before it's fully active.</span>
-            </div>
-        </x-banner>
+        <span x-init="$nextTick(() => window.toast('Welcome onboard!', {
+            type: 'success',
+            description: 'Your subscription has been activated. It could take a few seconds before it is fully active.',
+            persistent: true,
+        }))"></span>
     @endif
     @if (currentTeam()->subscriptionPastOverDue())
         <x-banner :closable=false>
diff --git a/tests/Feature/Subscription/CreateCheckoutSessionTest.php b/tests/Feature/Subscription/CreateCheckoutSessionTest.php
new file mode 100644
index 0000000000..6cb4e712b4
--- /dev/null
+++ b/tests/Feature/Subscription/CreateCheckoutSessionTest.php
@@ -0,0 +1,338 @@
+<?php
+
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
+use App\Models\Subscription;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Stripe\Exception\ApiConnectionException;
+use Stripe\Service\BillingPortal\SessionService as BillingPortalSessionService;
+use Stripe\Service\Checkout\SessionService;
+use Stripe\Service\CustomerService;
+use Stripe\Service\SubscriptionService;
+use Stripe\Stripe;
+use Stripe\StripeClient;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('cache.default', 'array');
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->stripe = Mockery::mock(StripeClient::class);
+    $this->checkoutSessions = Mockery::mock(SessionService::class);
+    $this->customers = Mockery::mock(CustomerService::class);
+    $this->stripeSubscriptions = Mockery::mock(SubscriptionService::class);
+    $this->stripe->checkout = (object) ['sessions' => $this->checkoutSessions];
+    $this->stripe->customers = $this->customers;
+    $this->stripe->subscriptions = $this->stripeSubscriptions;
+});
+
+function stripeCheckoutCollection(array $data, ?array $allPages = null): object
+{
+    $pages = $allPages ?? $data;
+
+    return new class($data, $pages)
+    {
+        public function __construct(
+            public array $data,
+            private array $allPages,
+        ) {}
+
+        public function autoPagingIterator(): iterable
+        {
+            yield from $this->allPages;
+        }
+    };
+}
+
+test('two near-simultaneous checkout requests reuse one open session', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $openSession = (object) ['id' => 'cs_open', 'url' => 'https://checkout.stripe.test/cs_open', 'status' => 'open', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]), stripeCheckoutCollection([$openSession]));
+    $this->checkoutSessions->shouldReceive('create')->once()->andReturn($openSession);
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_open')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+
+    $action = new CreateCheckoutSession($this->stripe);
+    $first = $action->execute($this->team, $this->user, 'price_monthly');
+    $second = $action->execute($this->team, $this->user, 'price_monthly');
+
+    expect($first->id)->toBe('cs_open')->and($second->id)->toBe('cs_open');
+});
+
+test('checkout session expiration includes a buffer above Stripe\'s 30-minute minimum', function () {
+    $this->freezeTime();
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(function (array $payload): bool {
+            expect($payload['expires_at'])->toBeGreaterThanOrEqual(now()->addMinutes(35)->timestamp)
+                ->and($payload['expires_at'])->toBeLessThanOrEqual(now()->addHours(24)->timestamp);
+
+            return $payload['customer'] === 'cus_existing';
+        })
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+});
+
+test('separate checkout attempts let the SDK manage idempotency', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $session = (object) ['id' => 'cs_retry', 'url' => 'https://checkout.stripe.test/cs_retry'];
+    $payloads = [];
+    $originalRetries = Stripe::getMaxNetworkRetries();
+
+    $this->stripeSubscriptions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->twice()
+        ->withArgs(function (array $payload, array $options = []) use (&$payloads): bool {
+            expect($options)->not->toHaveKey('idempotency_key');
+            expect(Stripe::getMaxNetworkRetries())->toBe(2);
+            $payloads[] = $payload;
+
+            return $payload['customer'] === 'cus_existing';
+        })->andReturn($session);
+
+    $action = new CreateCheckoutSession($this->stripe);
+    $action->execute($this->team, $this->user, 'price_monthly');
+    $this->travel(5)->seconds();
+    $action->execute($this->team, $this->user, 'price_monthly');
+
+    expect($payloads)->toHaveCount(2)
+        ->and($payloads[1]['expires_at'])->toBeGreaterThan($payloads[0]['expires_at'])
+        ->and(Stripe::getMaxNetworkRetries())->toBe($originalRetries);
+});
+
+test('an existing active Stripe subscription blocks checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing', 'stripe_subscription_id' => 'sub_active']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_active', 'status' => 'active']]));
+    $billingPortalSessions->shouldNotReceive('create');
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(CheckoutUnavailableException::class, 'active subscription');
+});
+
+test('blocking Stripe subscriptions explain the payment state instead of calling every status active', function (string $status, string $expected) {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_blocked', 'status' => $status]]));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->getMessage())
+            ->toBe($expected)
+            ->not->toContain('active subscription');
+    }
+})->with([
+    'incomplete' => ['incomplete', "This team's subscription payment is incomplete. Complete the payment in the billing portal."],
+    'past_due' => ['past_due', "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal."],
+    'unpaid' => ['unpaid', "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal."],
+    'paused' => ['paused', "This team's subscription is paused. Resume it in the billing portal."],
+]);
+
+test('recoverable blocked subscriptions include a billing portal link', function (string $status) {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_blocked', 'status' => $status]]));
+    $billingPortalSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload): bool => $payload['customer'] === 'cus_existing' && $payload['return_url'] === route('subscription.show'))
+        ->andReturn((object) ['url' => 'https://billing.stripe.test/session']);
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->billingPortalUrl)
+            ->toBe('https://billing.stripe.test/session')
+            ->and($exception->getMessage())->not->toContain('active subscription');
+    }
+})->with(['incomplete', 'past_due', 'unpaid', 'paused']);
+
+test('a past due subscription still blocks checkout when the billing portal cannot be opened', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_past_due', 'status' => 'past_due']]));
+    $billingPortalSessions->shouldReceive('create')->once()->andThrow(new ApiConnectionException('Connection failed'));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->getMessage())->toContain('past due')
+            ->and($exception->billingPortalUrl)->toBeNull();
+    }
+});
+
+test('a blocking Stripe subscription beyond the first page still blocks checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $firstPage = collect(range(1, 10))
+        ->map(fn (int $i): object => (object) ['id' => "sub_canceled_{$i}", 'status' => 'canceled'])
+        ->all();
+    $laterPageActive = (object) ['id' => 'sub_active_later', 'status' => 'active'];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(
+        stripeCheckoutCollection($firstPage, [...$firstPage, $laterPageActive])
+    );
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(CheckoutUnavailableException::class, 'active subscription');
+});
+
+test('checkout session lookup asks Stripe for open sessions only', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $openSession = (object) ['id' => 'cs_open', 'url' => 'https://checkout.stripe.test/cs_open', 'status' => 'open', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()
+        ->with(['customer' => 'cus_existing', 'limit' => 10, 'status' => 'open'])
+        ->andReturn(stripeCheckoutCollection([$openSession]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_open')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+
+    expect($session->id)->toBe('cs_open');
+});
+
+test('an expired checkout session permits a new checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $expired = (object) ['id' => 'cs_expired', 'status' => 'expired', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([$expired]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload, array $options = []): bool => $payload['customer'] === 'cus_existing' && ! isset($options['idempotency_key']))
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+    expect($session->id)->toBe('cs_new');
+});
+
+test('checkout creates and persists one Stripe customer for later attempts', function () {
+    $this->customers->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload, array $options): bool => $payload['metadata']['team_id'] === $this->team->id && $options['idempotency_key'] === 'coolify-team-'.$this->team->id.'-customer')
+        ->andReturn((object) ['id' => 'cus_new']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(function (array $payload): bool {
+            expect($payload['automatic_tax']['enabled'])->toBeTrue()
+                ->and($payload['billing_address_collection'])->toBe('required')
+                ->and($payload['customer_update'])->toMatchArray([
+                    'name' => 'auto',
+                    'address' => 'auto',
+                ]);
+
+            return $payload['customer'] === 'cus_new';
+        })
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+    expect($this->team->fresh()->subscription->stripe_customer_id)->toBe('cus_new');
+});
+
+test('a monthly subscription can move to yearly after Stripe confirms the old subscription ended', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    config()->set('subscription.stripe_price_id_dynamic_yearly', 'price_yearly');
+
+    Subscription::create([
+        'team_id' => $this->team->id,
+        'stripe_customer_id' => 'cus_existing',
+        'stripe_subscription_id' => 'sub_monthly_ended',
+        'stripe_plan_id' => 'price_monthly',
+        'stripe_invoice_paid' => false,
+    ]);
+
+    $this->customers->shouldNotReceive('create');
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([
+        (object) ['id' => 'sub_monthly_ended', 'status' => 'canceled'],
+    ]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload): bool => $payload['customer'] === 'cus_existing' && $payload['line_items'][0]['price'] === 'price_yearly')
+        ->andReturn((object) ['id' => 'cs_yearly', 'url' => 'https://checkout.stripe.test/cs_yearly']);
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly');
+
+    expect($session->id)->toBe('cs_yearly')
+        ->and($this->team->fresh()->subscription->stripe_customer_id)->toBe('cus_existing');
+});
+
+test('the checkout lock blocks a concurrent request before it calls Stripe', function () {
+    $lock = Cache::lock(CreateCheckoutSession::lockKey($this->team->id), 30);
+    expect($lock->get())->toBeTrue();
+
+    $this->customers->shouldNotReceive('create');
+    $this->stripeSubscriptions->shouldNotReceive('all');
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+            ->toThrow(CheckoutUnavailableException::class, 'already being created');
+    } finally {
+        $lock->release();
+    }
+});
+
+test('a Stripe connection failure releases the lock without creating another session', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $originalRetries = Stripe::getMaxNetworkRetries();
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()->andThrow(new ApiConnectionException('Connection failed'));
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(ApiConnectionException::class);
+    expect(Stripe::getMaxNetworkRetries())->toBe($originalRetries);
+    $lock = Cache::lock(CreateCheckoutSession::lockKey($this->team->id), 30);
+    try {
+        expect($lock->get())->toBeTrue();
+    } finally {
+        $lock->release();
+    }
+});
+
+test('changing checkout price expires the old session before creating the selected plan', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'cs_monthly', 'mode' => 'subscription', 'status' => 'open']]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_monthly')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldReceive('expire')->with('cs_monthly')->once()->globally()->ordered()->andReturn((object) ['status' => 'expired']);
+    $this->checkoutSessions->shouldReceive('create')->once()->globally()->ordered()
+        ->withArgs(fn (array $payload): bool => $payload['line_items'][0]['price'] === 'price_yearly')
+        ->andReturn((object) ['id' => 'cs_yearly']);
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly');
+    expect($session->id)->toBe('cs_yearly');
+});
+
+test('failed session expiration never creates a second checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'cs_monthly', 'mode' => 'subscription', 'status' => 'open']]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldReceive('expire')->once()->andThrow(new ApiConnectionException('Cannot confirm expiration'));
+    $this->checkoutSessions->shouldNotReceive('create');
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly'))
+        ->toThrow(ApiConnectionException::class);
+});
diff --git a/tests/Feature/Subscription/StripeProcessJobTest.php b/tests/Feature/Subscription/StripeProcessJobTest.php
index 302edf9e2e..f681ca4a5f 100644
--- a/tests/Feature/Subscription/StripeProcessJobTest.php
+++ b/tests/Feature/Subscription/StripeProcessJobTest.php
@@ -55,9 +55,13 @@ describe('customer.subscription.created does not fall through to updated', funct
         expect($subscription->stripe_invoice_paid)->toBeFalsy();
     });
 
-    test('created event updates existing subscription instead of duplicating', function () {
+    test('created event cannot overwrite a different recorded subscription', function () {
         Queue::fake();
 
+        $rootTeam = Team::factory()->create(['id' => 0]);
+        $rootTeam->discordNotificationSettings()->update(['discord_enabled' => true]);
+        Notification::fake();
+
         Subscription::create([
             'team_id' => $this->team->id,
             'stripe_subscription_id' => 'sub_old',
@@ -84,8 +88,46 @@ describe('customer.subscription.created does not fall through to updated', funct
 
         expect(Subscription::where('team_id', $this->team->id)->count())->toBe(1);
         $subscription = Subscription::where('team_id', $this->team->id)->first();
-        expect($subscription->stripe_subscription_id)->toBe('sub_new_123');
-        expect($subscription->stripe_customer_id)->toBe('cus_new_123');
+        expect($subscription->stripe_subscription_id)->toBe('sub_old');
+        expect($subscription->stripe_customer_id)->toBe('cus_old');
+        expect($subscription->stripe_invoice_paid)->toBeTruthy();
+
+        Notification::assertSentTo($rootTeam, GeneralNotification::class, function (GeneralNotification $notification) {
+            return str_contains($notification->message, 'StripeProcessJob error:')
+                && str_contains($notification->message, 'cus_old')
+                && str_contains($notification->message, 'cus_new_123');
+        });
+    });
+
+    test('created event rejects a pending record with a different stripe customer id', function () {
+        Queue::fake();
+
+        $rootTeam = Team::factory()->create(['id' => 0]);
+        $rootTeam->discordNotificationSettings()->update(['discord_enabled' => true]);
+        Notification::fake();
+
+        Subscription::create([
+            'team_id' => $this->team->id,
+            'stripe_customer_id' => 'cus_pending',
+            'stripe_invoice_paid' => false,
+        ]);
+
+        (new StripeProcessJob(['type' => 'customer.subscription.created', 'data' => ['object' => [
+            'id' => 'sub_other',
+            'customer' => 'cus_other',
+            'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+        ]]]))->handle();
+
+        $subscription = $this->team->subscription()->first();
+        expect($subscription->stripe_subscription_id)->toBeNull()
+            ->and($subscription->stripe_customer_id)->toBe('cus_pending')
+            ->and($subscription->stripe_invoice_paid)->toBeFalsy();
+
+        Notification::assertSentTo($rootTeam, GeneralNotification::class, function (GeneralNotification $notification) {
+            return str_contains($notification->message, 'StripeProcessJob error:')
+                && str_contains($notification->message, 'cus_pending')
+                && str_contains($notification->message, 'cus_other');
+        });
     });
 });
 
@@ -338,3 +380,32 @@ describe('missing subscription Stripe webhooks are ignored', function () {
         ]],
     ]);
 });
+
+test('late repeated subscription created events preserve confirmed payment', function () {
+    Queue::fake();
+    $completed = ['type' => 'checkout.session.completed', 'data' => ['object' => [
+        'client_reference_id' => $this->user->id.':'.$this->team->id,
+        'subscription' => 'sub_paid', 'customer' => 'cus_paid',
+    ]]];
+    (new StripeProcessJob($completed))->handle();
+    $created = ['type' => 'customer.subscription.created', 'data' => ['object' => [
+        'id' => 'sub_paid', 'customer' => 'cus_paid',
+        'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+    ]]];
+    foreach (range(1, 2) as $attempt) {
+        (new StripeProcessJob($created))->handle();
+        expect($this->team->subscription()->first()->stripe_invoice_paid)->toBeTruthy();
+    }
+    expect($this->team->subscription()->count())->toBe(1);
+});
+
+test('created event fills a pending customer record without granting access', function () {
+    Queue::fake();
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_pending', 'stripe_invoice_paid' => false]);
+    (new StripeProcessJob(['type' => 'customer.subscription.created', 'data' => ['object' => [
+        'id' => 'sub_pending', 'customer' => 'cus_pending',
+        'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+    ]]]))->handle();
+    expect($this->team->subscription()->first()->stripe_subscription_id)->toBe('sub_pending')
+        ->and($this->team->subscription()->first()->stripe_invoice_paid)->toBeFalsy();
+});
diff --git a/tests/Feature/Subscription/SubscriptionPricingPageTest.php b/tests/Feature/Subscription/SubscriptionPricingPageTest.php
index 98e0c9ad4b..f411d6425e 100644
--- a/tests/Feature/Subscription/SubscriptionPricingPageTest.php
+++ b/tests/Feature/Subscription/SubscriptionPricingPageTest.php
@@ -1,5 +1,8 @@
 <?php
 
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
+use App\Jobs\ServerLimitCheckJob;
 use App\Livewire\Subscription\Index;
 use App\Livewire\Subscription\PricingPlans;
 use App\Models\InstanceSettings;
@@ -7,12 +10,19 @@ use App\Models\Subscription;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Exceptions;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
+use Stripe\Exception\ApiConnectionException;
+use Stripe\Service\CustomerService;
+use Stripe\Service\SubscriptionService;
+use Stripe\StripeClient;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
     config()->set('constants.coolify.self_hosted', false);
     config()->set('subscription.provider', 'stripe');
     config()->set('subscription.stripe_api_key', 'sk_test_fake');
@@ -133,3 +143,120 @@ test('subscription plan page does not render a single-item plan tab strip', func
         ->and($html)->not->toContain(route('subscription.show'))
         ->and($html)->not->toContain(route('subscription.index'));
 });
+
+test('Stripe API failures show an error without redirecting or retrying checkout', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new ApiConnectionException('Connection failed'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', 'Unable to confirm checkout with Stripe. Please try again shortly.')
+        ->assertNoRedirect();
+});
+
+test('expected checkout unavailable errors keep their user-facing messages', function (string $message) {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    Exceptions::fake();
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new CheckoutUnavailableException($message));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', $message)
+        ->assertNoRedirect();
+
+    Exceptions::assertNothingReported();
+})->with([
+    'lock' => 'A subscription checkout is already being created for this team.',
+    'active' => 'Team already has an active subscription.',
+    'past_due' => "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.",
+    'incomplete' => "This team's subscription payment is incomplete. Complete the payment in the billing portal.",
+    'unpaid' => "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal.",
+]);
+
+test('pricing plans links recoverable checkout blocks to the billing portal', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    $message = "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.";
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new CheckoutUnavailableException($message, 'https://billing.stripe.test/session'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched(
+            'error',
+            $message.' <a href="https://billing.stripe.test/session" target="_blank" rel="noopener noreferrer" class="underline">Open billing portal</a>'
+        )
+        ->assertNoRedirect();
+});
+
+test('unexpected checkout RuntimeExceptions are reported without exposing internal messages', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    Exceptions::fake();
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new RuntimeException('SQLSTATE[HY000]: General error: 1 table subscriptions has no column named foo'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', 'Unable to start checkout. Please try again shortly.')
+        ->assertNoRedirect();
+
+    Exceptions::assertReported(RuntimeException::class);
+});
+
+test('subscription status check restores an active subscription after a missed webhook', function (int $quantity, int $expectedLimit, string $lookupKey) {
+    Queue::fake();
+    $this->team->update(['custom_server_limit' => 7]);
+    $subscription = Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_recover', 'stripe_invoice_paid' => false]);
+    $stripe = Mockery::mock(StripeClient::class);
+    $stripe->customers = Mockery::mock(CustomerService::class);
+    $stripe->subscriptions = Mockery::mock(SubscriptionService::class);
+    $stripe->customers->shouldReceive('retrieve')->with('cus_recover')->once()->andReturn((object) ['id' => 'cus_recover']);
+    $stripe->subscriptions->shouldReceive('all')->with(['customer' => 'cus_recover'])->once()->andReturn((object) ['data' => [(object) [
+        'id' => 'sub_recovered', 'status' => 'active', 'metadata' => (object) ['team_id' => (string) $this->team->id],
+        'cancel_at_period_end' => true, 'items' => (object) ['data' => [(object) ['quantity' => $quantity, 'price' => (object) ['id' => 'price_yearly', 'lookup_key' => $lookupKey]]]],
+    ]]]);
+    app()->instance(StripeClient::class, $stripe);
+
+    Livewire::test(Index::class)->call('getStripeStatus')->assertRedirect(route('subscription.show'));
+
+    expect((bool) $subscription->fresh()->stripe_invoice_paid)->toBeTrue()
+        ->and($subscription->fresh()->stripe_subscription_id)->toBe('sub_recovered')
+        ->and($subscription->fresh()->stripe_plan_id)->toBe('price_yearly')
+        ->and((bool) $subscription->fresh()->stripe_cancel_at_period_end)->toBeTrue()
+        ->and((bool) $subscription->fresh()->stripe_past_due)->toBeFalse()
+        ->and($this->team->fresh()->custom_server_limit)->toBe($expectedLimit);
+    if (str_contains($lookupKey, 'dynamic')) {
+        Queue::assertPushed(ServerLimitCheckJob::class);
+    } else {
+        Queue::assertNotPushed(ServerLimitCheckJob::class);
+    }
+})->with([[5, 5, 'dynamic_yearly'], [1, 2, 'dynamic_yearly'], [101, 100, 'dynamic_yearly'], [5, 7, 'legacy']]);
+
+test('subscription status check does not activate non-active or other-team subscriptions', function (string $status, bool $otherTeam) {
+    $subscription = Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_recover', 'stripe_invoice_paid' => false]);
+    $stripe = Mockery::mock(StripeClient::class);
+    $stripe->customers = Mockery::mock(CustomerService::class);
+    $stripe->subscriptions = Mockery::mock(SubscriptionService::class);
+    $stripe->customers->shouldReceive('retrieve')->once()->andReturn((object) ['id' => 'cus_recover']);
+    $stripe->subscriptions->shouldReceive('all')->once()->andReturn((object) ['data' => [(object) [
+        'id' => 'sub_other', 'status' => $status, 'metadata' => (object) ['team_id' => (string) ($otherTeam ? $this->team->id + 100 : $this->team->id)],
+    ]]]);
+    app()->instance(StripeClient::class, $stripe);
+
+    Livewire::test(Index::class)->call('getStripeStatus')->assertNoRedirect();
+    expect((bool) $subscription->fresh()->stripe_invoice_paid)->toBeFalse();
+    if ($otherTeam) {
+        expect($subscription->fresh()->stripe_subscription_id)->toBeNull();
+    }
+})->with([['incomplete', false], ['unpaid', false], ['canceled', false], ['active', true]]);
+
+test('team members cannot synchronize billing status', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->user->unsetRelation('teams');
+    Livewire::test(Index::class)->call('getStripeStatus')->assertForbidden();
+});
diff --git a/tests/Feature/TeamSeederTest.php b/tests/Feature/TeamSeederTest.php
new file mode 100644
index 0000000000..96cf3a19e3
--- /dev/null
+++ b/tests/Feature/TeamSeederTest.php
@@ -0,0 +1,27 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Database\Seeders\TeamSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('assigns seeded memberships without assuming normal user or personal team IDs', function () {
+    InstanceSettings::create(['id' => 0]);
+    $unrelatedUser = User::factory()->create();
+    User::factory()->create(['id' => 0, 'email' => 'test@example.com']);
+    $rootTeamMember = User::factory()->create(['id' => 10, 'email' => 'test2@example.com']);
+    $otherUser = User::factory()->create(['id' => 11, 'email' => 'test3@example.com']);
+    $personalTeam = $rootTeamMember->teams()->firstOrFail();
+
+    $this->seed(TeamSeeder::class);
+
+    expect(Team::findOrFail(0)->description)->toBe('The root team')
+        ->and($rootTeamMember->teams()->whereKey(0)->exists())->toBeTrue()
+        ->and($otherUser->teams()->whereKey($personalTeam->id)->firstOrFail()->pivot->role)->toBe('admin')
+        ->and($otherUser->teams()->whereKey(0)->exists())->toBeFalse()
+        ->and($unrelatedUser->teams()->count())->toBe(1)
+        ->and($otherUser->teams()->whereKey($unrelatedUser->teams()->firstOrFail()->id)->exists())->toBeFalse();
+});
diff --git a/tests/Feature/ToastPositionTest.php b/tests/Feature/ToastPositionTest.php
index 6bcfc898ea..d8b7e58790 100644
--- a/tests/Feature/ToastPositionTest.php
+++ b/tests/Feature/ToastPositionTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use Symfony\Component\Process\Process;
+
 test('toast messages default to the bottom right while supporting position overrides', function () {
     $toast = file_get_contents(resource_path('views/components/toast.blade.php'));
 
@@ -24,3 +26,50 @@ test('toast copy button shows temporary success feedback', function () {
         ->toContain('x-show="toast.copied"')
         ->toContain("'bg-emerald-100 text-emerald-700 dark:bg-emerald-500/10 dark:text-emerald-400': toast.copied");
 });
+
+test('subscription success uses a persistent standard toast instead of a banner', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+    if ($view === false) {
+        throw new RuntimeException('Could not read layout popups view.');
+    }
+
+    if (preg_match("/@if \\(request\\(\\)->query->get\\('success'\\)\\)(.*?)@endif/s", $view, $match) !== 1 || ! isset($match[1])) {
+        throw new RuntimeException('Could not locate the subscription success block.');
+    }
+
+    expect($match[1])->toContain("window.toast('Welcome onboard!'")
+        ->toContain('persistent: true')
+        ->not->toContain('<x-banner>');
+});
+
+test('persistent toasts survive timers hover and new notifications until dismissed', function () {
+    $process = new Process(['node', '-e', <<<'JS'
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const source = fs.readFileSync(process.argv[1], 'utf8');
+const data = source.match(/<ul x-data="([\s\S]*?)" @toast-show/)[1];
+const timers = new Map();
+let timerId = 0;
+global.setTimeout = callback => { timers.set(++timerId, callback); return timerId; };
+global.clearTimeout = id => timers.delete(id);
+const state = new Function(`return (${data})`)();
+state.$nextTick = callback => callback();
+state.addToast({ detail: { message: 'Persistent', persistent: true } });
+const persistent = state.toasts[0];
+assert.equal(timers.size, 0, 'persistent toast must not schedule dismissal');
+state.pauseToast(persistent);
+state.resumeToast(persistent);
+assert.equal(timers.size, 0, 'hover must not start a persistent toast timer');
+for (let i = 0; i < 5; i++) state.addToast({ detail: { message: 'Normal' } });
+assert(state.toasts.includes(persistent), 'new notifications must not evict persistent toast');
+assert(timers.size > 0, 'normal notifications still have timers');
+for (const callback of [...timers.values()]) callback();
+for (const callback of [...timers.values()]) callback();
+assert(state.toasts.includes(persistent), 'persistent toast survives elapsed timers');
+state.removeToast(persistent.id);
+for (const callback of [...timers.values()]) callback();
+assert(!state.toasts.includes(persistent), 'manual dismissal removes persistent toast');
+JS, resource_path('views/components/toast.blade.php')]);
+    $process->run();
+    expect($process->isSuccessful())->toBeTrue($process->getErrorOutput());
+});
diff --git a/tests/Feature/UserSeederTest.php b/tests/Feature/UserSeederTest.php
new file mode 100644
index 0000000000..ce7705453b
--- /dev/null
+++ b/tests/Feature/UserSeederTest.php
@@ -0,0 +1,48 @@
+<?php
+
+use App\Models\User;
+use Database\Seeders\UserSeeder;
+use Illuminate\Database\Schema\Blueprint;
+
+it('preserves the root ID and lets the database generate normal user IDs', function (string $connectionName, int $existingUsers) {
+    if ($connectionName === 'pgsql' && ! getenv('TEST_POSTGRES_SEEDER')) {
+        $this->markTestSkipped('Set TEST_POSTGRES_SEEDER=1 to test PostgreSQL using the configured pgsql connection.');
+    }
+
+    $originalConnectionName = config('database.default');
+    config()->set('database.default', $connectionName);
+    $connection = (new User)->getConnection();
+    $connection->beginTransaction();
+
+    try {
+        // A temporary table isolates this test from existing development users and their sequence.
+        $connection->getSchemaBuilder()->create('users', function (Blueprint $table) {
+            $table->temporary();
+            $table->id();
+            $table->string('name')->nullable();
+            $table->string('email')->unique();
+            $table->string('password');
+            $table->timestamp('email_verified_at')->nullable();
+            $table->rememberToken();
+            $table->timestamps();
+        });
+
+        User::withoutEvents(function () use ($existingUsers) {
+            User::factory()->count($existingUsers)->create();
+
+            $this->seed(UserSeeder::class);
+
+            expect(User::query()->whereIn('email', ['test@example.com', 'test2@example.com', 'test3@example.com'])->orderBy('id')->pluck('email', 'id')->all())->toBe([
+                0 => 'test@example.com',
+                $existingUsers + 1 => 'test2@example.com',
+                $existingUsers + 2 => 'test3@example.com',
+            ]);
+
+            expect(User::factory()->create()->id)->toBe($existingUsers + 3)
+                ->and(User::factory()->create()->id)->toBe($existingUsers + 4);
+        });
+    } finally {
+        $connection->rollBack();
+        config()->set('database.default', $originalConnectionName);
+    }
+})->with(['testing', 'pgsql'])->with([0, 5]);