diff --git a/.github/workflows/coolify-next-build.yml b/.github/workflows/coolify-next-build.yml index 965a98b6bc..db0f762653 100644 --- a/.github/workflows/coolify-next-build.yml +++ b/.github/workflows/coolify-next-build.yml @@ -6,11 +6,8 @@ on: paths-ignore: - .github/workflows/coolify-helper.yml - .github/workflows/coolify-helper-next.yml - - .github/workflows/coolify-realtime.yml - - .github/workflows/coolify-realtime-next.yml - .github/workflows/pr-quality.yaml - docker/coolify-helper/Dockerfile - - docker/coolify-realtime/Dockerfile - docker/testing-host/Dockerfile - templates/** - CHANGELOG.md diff --git a/app/Http/Middleware/TrustHosts.php b/app/Http/Middleware/TrustHosts.php index 5fca583d98..350d5359c1 100644 --- a/app/Http/Middleware/TrustHosts.php +++ b/app/Http/Middleware/TrustHosts.php @@ -14,7 +14,6 @@ class TrustHosts extends Middleware * Handle the incoming request. * * Skip host validation for certain routes: - * - Terminal auth routes (called by realtime container) * - API routes (use token-based authentication, not host validation) * - Webhook endpoints (use cryptographic signature validation) */ @@ -22,8 +21,6 @@ class TrustHosts extends Middleware { // Skip host validation for these routes if ($request->is( - 'terminal/auth', - 'terminal/auth/ips', 'api/*', 'webhooks/*' )) { diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 169a65393a..8764aa0563 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -25,7 +25,7 @@ services: - /data/coolify/source/.env ports: - "${APP_PORT:-8000}:8080" - - "${SOKETI_PORT:-6001}:6001" + - "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001" - "${TERMINAL_PORT:-6002}:6002" expose: - "${APP_PORT:-8000}" diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml index 499584c14d..c10edfb50c 100644 --- a/docker-compose.windows.yml +++ b/docker-compose.windows.yml @@ -51,7 +51,7 @@ services: - IS_WINDOWS_DOCKER_DESKTOP=true ports: - "${APP_PORT:-8000}:8080" - - "${SOKETI_PORT:-6001}:6001" + - "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001" - "${TERMINAL_PORT:-6002}:6002" expose: - "${APP_PORT:-8000}" diff --git a/other/nightly/docker-compose.prod.yml b/other/nightly/docker-compose.prod.yml index 169a65393a..8764aa0563 100644 --- a/other/nightly/docker-compose.prod.yml +++ b/other/nightly/docker-compose.prod.yml @@ -25,7 +25,7 @@ services: - /data/coolify/source/.env ports: - "${APP_PORT:-8000}:8080" - - "${SOKETI_PORT:-6001}:6001" + - "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001" - "${TERMINAL_PORT:-6002}:6002" expose: - "${APP_PORT:-8000}" diff --git a/other/nightly/docker-compose.windows.yml b/other/nightly/docker-compose.windows.yml index 302c89c27f..10898ae3c3 100644 --- a/other/nightly/docker-compose.windows.yml +++ b/other/nightly/docker-compose.windows.yml @@ -50,7 +50,7 @@ services: - IS_WINDOWS_DOCKER_DESKTOP=true ports: - "${APP_PORT:-8000}:8080" - - "${SOKETI_PORT:-6001}:6001" + - "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001" - "${TERMINAL_PORT:-6002}:6002" expose: - "${APP_PORT:-8000}" diff --git a/scripts/dev-instances b/scripts/dev-instances index 36437807e6..d0fb5dd0b3 100755 --- a/scripts/dev-instances +++ b/scripts/dev-instances @@ -265,18 +265,19 @@ cmd_urls() { parse_args "$@" names=("${NAMES[@]}") fi - printf '%-6s %-28s %-8s %-8s %-12s\n' "NAME" "URL" "DB" "REDIS" "SOKETI" + printf '%-6s %-28s %-8s %-8s %-12s %-12s\n' "NAME" "URL" "DB" "REDIS" "REVERB" "TERMINAL" local name envf for name in "${names[@]}"; do name="$(normalize_name "$name")" ensure_env "$name" >/dev/null envf="$(env_file "$name")" - printf '%-6s %-28s %-8s %-8s %-12s\n' \ + printf '%-6s %-28s %-8s %-8s %-12s %-12s\n' \ "$name" \ "$(grep -E '^APP_URL=' "$envf" | cut -d= -f2-)" \ "$(grep -E '^FORWARD_DB_PORT=' "$envf" | cut -d= -f2-)" \ "$(grep -E '^FORWARD_REDIS_PORT=' "$envf" | cut -d= -f2-)" \ - "$(grep -E '^FORWARD_PUSHER_PORT=' "$envf" | cut -d= -f2-)" + "$(grep -E '^FORWARD_PUSHER_PORT=' "$envf" | cut -d= -f2-)" \ + "$(grep -E '^FORWARD_TERMINAL_PORT=' "$envf" | cut -d= -f2-)" done } diff --git a/tests/Feature/ReverbAndTerminalPackagingTest.php b/tests/Feature/ReverbAndTerminalPackagingTest.php index 1461ec9707..a9ed6cdf72 100644 --- a/tests/Feature/ReverbAndTerminalPackagingTest.php +++ b/tests/Feature/ReverbAndTerminalPackagingTest.php @@ -129,7 +129,7 @@ it('keeps the public websocket port adaptive and configures only the internal Re it('does not use the browser websocket port as the Docker host port', function (string $composeFile) { expect(file_get_contents(base_path($composeFile))) - ->toContain('"${SOKETI_PORT:-6001}:6001"') + ->toContain('"${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"') ->not->toContain('"${PUSHER_PORT:-6001}:6001"'); })->with([ 'production compose' => ['docker-compose.prod.yml'], @@ -166,8 +166,15 @@ it('stops publishing or preserving the obsolete realtime image', function () { ->and(is_dir(base_path('docker/coolify-realtime')))->toBeFalse() ->and(file_exists(base_path('.github/workflows/coolify-realtime.yml')))->toBeFalse() ->and(file_exists(base_path('.github/workflows/coolify-realtime-next.yml')))->toBeFalse() + ->and(file_get_contents(base_path('.github/workflows/coolify-next-build.yml')))->not->toContain('coolify-realtime') ->and($productionInstallScript)->not->toContain('LATEST_REALTIME_VERSION') ->not->toContain('| Realtime') ->and($nightlyInstallScript)->not->toContain('LATEST_REALTIME_VERSION') ->not->toContain('| Realtime'); }); + +it('uses current Reverb and terminal names in development tooling', function () { + expect(file_get_contents(base_path('scripts/dev-instances'))) + ->toContain('"REVERB" "TERMINAL"') + ->not->toContain('"SOKETI"'); +}); diff --git a/tests/Feature/Security/TrustHostsMiddlewareTest.php b/tests/Feature/Security/TrustHostsMiddlewareTest.php index 9a44be14bc..8dfed89c95 100644 --- a/tests/Feature/Security/TrustHostsMiddlewareTest.php +++ b/tests/Feature/Security/TrustHostsMiddlewareTest.php @@ -229,24 +229,26 @@ it('caches negative results when no FQDN is configured', function () { expect($hosts2)->not->toBeEmpty(); }); -it('skips host validation for terminal auth routes', function () { - // These routes should be accessible with any Host header (for internal container communication) +it('allows terminal auth requests from the local terminal server', function () { $response = $this->postJson('/terminal/auth', [], [ - 'Host' => 'coolify:8080', // Internal Docker host + 'Host' => '127.0.0.1:8080', ]); - // Should not get 400 Bad Host (might get 401 Unauthorized instead) expect($response->status())->not->toBe(400); }); -it('skips host validation for terminal auth ips route', function () { - // These routes should be accessible with any Host header (for internal container communication) +it('enforces host validation for terminal auth routes', function () { + InstanceSettings::updateOrCreate( + ['id' => 0], + ['fqdn' => 'https://coolify.example.com'] + ); + Cache::forget('instance_settings_fqdn_host'); + $response = $this->postJson('/terminal/auth/ips', [], [ - 'Host' => 'soketi:6002', // Another internal Docker host + 'Host' => 'evil.com', ]); - // Should not get 400 Bad Host (might get 401 Unauthorized instead) - expect($response->status())->not->toBe(400); + expect($response->status())->toBe(400); }); it('still enforces host validation for non-terminal routes', function () {