starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-09-26 01:10:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(reverb): align ports, host validation, and dev instance tooling

Browse Source
This commit is contained in:
Andras Bacsai
2026-09-22 09:58:28 +02:00
parent 57acc7f832
commit e3ab63e7d8
9 changed files with 27 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/coolify-next-build.yml
-3
View File
@@ -6,11 +6,8 @@ on:
paths-ignore:
- .github/workflows/coolify-helper.yml
- .github/workflows/coolify-helper-next.yml
- .github/workflows/coolify-realtime.yml
- .github/workflows/coolify-realtime-next.yml
- .github/workflows/pr-quality.yaml
- docker/coolify-helper/Dockerfile
- docker/coolify-realtime/Dockerfile
- docker/testing-host/Dockerfile
- templates/**
- CHANGELOG.md
app/Http/Middleware/TrustHosts.php
-3
View File
@@ -14,7 +14,6 @@ class TrustHosts extends Middleware
* Handle the incoming request.
*
* Skip host validation for certain routes:
* - Terminal auth routes (called by realtime container)
* - API routes (use token-based authentication, not host validation)
* - Webhook endpoints (use cryptographic signature validation)
*/
@@ -22,8 +21,6 @@ class TrustHosts extends Middleware
{
// Skip host validation for these routes
if ($request->is(
'terminal/auth',
'terminal/auth/ips',
'api/*',
'webhooks/*'
)) {
docker-compose.prod.yml
+1 -1
View File
@@ -25,7 +25,7 @@ services:
- /data/coolify/source/.env
ports:
- "${APP_PORT:-8000}:8080"
- "${SOKETI_PORT:-6001}:6001"
- "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"
- "${TERMINAL_PORT:-6002}:6002"
expose:
- "${APP_PORT:-8000}"
docker-compose.windows.yml
+1 -1
View File
@@ -51,7 +51,7 @@ services:
- IS_WINDOWS_DOCKER_DESKTOP=true
ports:
- "${APP_PORT:-8000}:8080"
- "${SOKETI_PORT:-6001}:6001"
- "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"
- "${TERMINAL_PORT:-6002}:6002"
expose:
- "${APP_PORT:-8000}"
other/nightly/docker-compose.prod.yml
+1 -1
View File
@@ -25,7 +25,7 @@ services:
- /data/coolify/source/.env
ports:
- "${APP_PORT:-8000}:8080"
- "${SOKETI_PORT:-6001}:6001"
- "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"
- "${TERMINAL_PORT:-6002}:6002"
expose:
- "${APP_PORT:-8000}"
other/nightly/docker-compose.windows.yml
+1 -1
View File
@@ -50,7 +50,7 @@ services:
- IS_WINDOWS_DOCKER_DESKTOP=true
ports:
- "${APP_PORT:-8000}:8080"
- "${SOKETI_PORT:-6001}:6001"
- "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"
- "${TERMINAL_PORT:-6002}:6002"
expose:
- "${APP_PORT:-8000}"
scripts/dev-instances
+4 -3
View File
@@ -265,18 +265,19 @@ cmd_urls() {
parse_args "$@"
names=("${NAMES[@]}")
fi
printf '%-6s %-28s %-8s %-8s %-12s\n' "NAME" "URL" "DB" "REDIS" "SOKETI"
printf '%-6s %-28s %-8s %-8s %-12s %-12s\n' "NAME" "URL" "DB" "REDIS" "REVERB" "TERMINAL"
local name envf
for name in "${names[@]}"; do
name="$(normalize_name "$name")"
ensure_env "$name" >/dev/null
envf="$(env_file "$name")"
printf '%-6s %-28s %-8s %-8s %-12s\n' \
printf '%-6s %-28s %-8s %-8s %-12s %-12s\n' \
"$name" \
"$(grep -E '^APP_URL=' "$envf" | cut -d= -f2-)" \
"$(grep -E '^FORWARD_DB_PORT=' "$envf" | cut -d= -f2-)" \
"$(grep -E '^FORWARD_REDIS_PORT=' "$envf" | cut -d= -f2-)" \
"$(grep -E '^FORWARD_PUSHER_PORT=' "$envf" | cut -d= -f2-)"
"$(grep -E '^FORWARD_PUSHER_PORT=' "$envf" | cut -d= -f2-)" \
"$(grep -E '^FORWARD_TERMINAL_PORT=' "$envf" | cut -d= -f2-)"
done
}
tests/Feature/ReverbAndTerminalPackagingTest.php
+8 -1
View File
@@ -129,7 +129,7 @@ it('keeps the public websocket port adaptive and configures only the internal Re
it('does not use the browser websocket port as the Docker host port', function (string $composeFile) {
expect(file_get_contents(base_path($composeFile)))
->toContain('"${SOKETI_PORT:-6001}:6001"')
->toContain('"${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"')
->not->toContain('"${PUSHER_PORT:-6001}:6001"');
})->with([
'production compose' => ['docker-compose.prod.yml'],
@@ -166,8 +166,15 @@ it('stops publishing or preserving the obsolete realtime image', function () {
->and(is_dir(base_path('docker/coolify-realtime')))->toBeFalse()
->and(file_exists(base_path('.github/workflows/coolify-realtime.yml')))->toBeFalse()
->and(file_exists(base_path('.github/workflows/coolify-realtime-next.yml')))->toBeFalse()
->and(file_get_contents(base_path('.github/workflows/coolify-next-build.yml')))->not->toContain('coolify-realtime')
->and($productionInstallScript)->not->toContain('LATEST_REALTIME_VERSION')
->not->toContain('| Realtime')
->and($nightlyInstallScript)->not->toContain('LATEST_REALTIME_VERSION')
->not->toContain('| Realtime');
});
it('uses current Reverb and terminal names in development tooling', function () {
expect(file_get_contents(base_path('scripts/dev-instances')))
->toContain('"REVERB" "TERMINAL"')
->not->toContain('"SOKETI"');
});
tests/Feature/Security/TrustHostsMiddlewareTest.php
+11 -9
View File
@@ -229,24 +229,26 @@ it('caches negative results when no FQDN is configured', function () {
expect($hosts2)->not->toBeEmpty();
});
it('skips host validation for terminal auth routes', function () {
// These routes should be accessible with any Host header (for internal container communication)
it('allows terminal auth requests from the local terminal server', function () {
$response = $this->postJson('/terminal/auth', [], [
'Host' => 'coolify:8080', // Internal Docker host
'Host' => '127.0.0.1:8080',
]);
// Should not get 400 Bad Host (might get 401 Unauthorized instead)
expect($response->status())->not->toBe(400);
});
it('skips host validation for terminal auth ips route', function () {
// These routes should be accessible with any Host header (for internal container communication)
it('enforces host validation for terminal auth routes', function () {
InstanceSettings::updateOrCreate(
['id' => 0],
['fqdn' => 'https://coolify.example.com']
);
Cache::forget('instance_settings_fqdn_host');
$response = $this->postJson('/terminal/auth/ips', [], [
'Host' => 'soketi:6002', // Another internal Docker host
'Host' => 'evil.com',
]);
// Should not get 400 Bad Host (might get 401 Unauthorized instead)
expect($response->status())->not->toBe(400);
expect($response->status())->toBe(400);
});
it('still enforces host validation for non-terminal routes', function () {