An empty port routes to the required port, so it needs no confirmation.
The edit dialog shows the effective port, the warning buttons name the
ports, and domain conflicts ignore the container port.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Anonymize the audit events of a deleted user, store only the ID and
name of other users, and drop the metadata copy of actor_email.
Store URLs without query strings, registries without user info, and
the exception class instead of raw SSH errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Set env var version and compose parsing version while creating, so a create writes one row
- Record no rows for the auto-created preview copy of an env var
- Record env and application API updates only with the fields that really changed
- Store no change data for new env vars, and null for empty change data
- Store metadata team_id as an integer
- Drop the unused level and resource indexes of audit_events
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Return 429 after 30 failed (401/403/404) requests per minute for one
token or IP, also for unknown API routes (API_FAILED_REQUEST_RATE_LIMIT)
- Notify the team once a day when a token reaches the limit
- Deduplicate ability_denied and scope_denied audit events for 5 minutes
Preview containers (-pr-<id>) came and went with pull requests and
invalidated the build cache of every app on the network. A build server
got the IPs of the deployment server network, which it cannot reach.
Add a per-app setting to turn off network hosts during the build.
Closes#12452
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Reply 410 for deleted servers and 402 for unpaid teams, with Retry-After
- Remove the Sentinel container of unpaid servers once a day, and before a server is deleted
- Record server_not_found and subscription_unpaid push failures once per hour
- Audit scheduled task API updates only for fields that really changed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Updating the image of a service named like "api.test" wrote a nested
"test" key into the "api" service, because data_get/data_set split the
name on dots. Use array key paths instead. Also refuse service names that
Docker cannot use as a container name prefix, with a clear error on save.
Closes#12456
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add GET /gitea-apps, POST /applications/private-gitea-app, and
gitea_app_uuid in PATCH /applications/{uuid}, with OpenAPI docs and MCP tool support.
Closes#12459
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub rejects new RSA SSH keys smaller than 3072 bits, and phpseclib
made 2048-bit keys by default, so new RSA deploy keys from Coolify
could not authenticate.
Closes#12461
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Read compound and fractional durations (1m30s, 1.5m), quoted values,
only the flags before CMD, the escape parser directive, and NONE with
flags. Zero and sub-second values no longer become 0 seconds.
Closes#12455
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Add a hint to failed command messages when the exit code is 255,
which explains that the SSH connection to the server closed before
the command finished.
- Return no services from applicationParser and serviceParser when the
compose `services` key is empty or is not a map, so parsing does not
fail.
- Move Server::getIp() out of the sshEndpointInUse() docblock, where it
was misplaced and broke the class.
- Add tests for the SSH hint, for services keys that are not maps, and
for saved compose variable values that must survive a redeploy
(#6995).
Containers without the Coolify default variables sent no project,
environment, or service to the drain. The fluentd driver now also sends
the Coolify container labels; the built-in configs use them as a
fallback and add coolify.service_name.
Closes#8415
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The queue counted every running deployment against the deployment server,
and the job picked a build server at random. So the deployment server
limit capped builds on build servers, and the build server limit was
never read. Count each build on the server that runs it, reserve a build
server with a free slot when the deployment starts, and start waiting
deployments of other servers when a build server slot is freed.
Closes#7649
caddy-docker-proxy reloads Caddy whenever any proxied container changes,
and Caddy closes every WebSocket on reload by default. Set
stream_close_delay on app, service, and dashboard reverse_proxy routes.
Closes#7942
A preview renames its services to <name>-pr-<id>, so services that call
each other by their Compose names failed to start. Add the original name as an alias on the preview network.
Closes#8030
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Docker Compose gives a recreated container the old mount at each path
that the image declares with VOLUME, also a volume deleted in Coolify.
Before `up`, remove only containers that still mount a Coolify volume
whose storage entry was deleted. The stale volume delete dialog now
warns when a container still uses the volume.
Closes#6875
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Team notifications sent through the instance email settings, the S3
connection error alert, and the channel disabled alert now use the
optional notification from address and name. Account mails keep the
default sender. Remove the unused emails command and its views.
A preview deployment set COOLIFY_BRANCH in three places with three
values: the Compose shell variables used the application branch
(main), the Compose parser used pull/<id>/head, and other build packs
used the fetched refspec (pull/<id>/head:pr-<id>-coolify) or the
application branch. A variable that refers to ${COOLIFY_BRANCH} then
got a different value than the container. All paths now use
Application::coolifyBranch(), which gives pull/<id>/head for previews
and git_branch for production deployments.
Closes#9572
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Rybbit template had a proxy route only for the client, so the
/api requests of the browser got a 404 from the client and sign-up
and login failed. The backend now declares SERVICE_URL_RYBBIT_3001=/api
on the same host and keeps the /api prefix. The backend is listed
before the client, so SERVICE_URL_RYBBIT (used in BASE_URL) stays the
root URL.
Closes#9055
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retry GET requests of githubApi() up to three times when GitHub answers
with a 5xx error or the connection fails. One 502 or one timeout on the
repository lookup before a deployment failed the deployment. Writes are
not retried, so a pull request comment is not posted two times. The
installation token request uses the same retry rule.
Closes#9785
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stop calling /zen before each installation token request. A short
network problem to GitHub failed deployments with a cURL timeout on
/zen. assertGithubClockInSync now takes the failed response and reads
its Date header, so the "System time is out of sync" error still shows
when GitHub rejects the JWT.
Call it on failed JWT requests in the webhook installation check, the
permission job, the source connection test, and the server transfer
checklist. Remove the /zen fakes from the tests.
S3 storages with a self-signed or private CA certificate failed with
"cURL error 60", because the Coolify container and the backup helper do
not use the CA certificates of the host. The new opt-in setting turns off
the certificate check in the PHP S3 clients and sets MC_INSECURE for mc.
Closes#9762
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Unset the helper's build secret variables before Compose pulls or starts
services, so containers get the runtime .env values. Give build secrets
the raw stored value instead of the quoted .env form.
Closes#12409
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Every channel has a block of its own, every version after this one reads only these blocks
- Every stable sync also fills the coolify and traefik keys older instances read
- An instance keeps a copy of versions.json and reads upstream.json of the image until it has one
- Adds the channels stable, preview, nightly and custom
- Preview and nightly read /coolify/release.json on the CDN and take the newest version of their channel and the more stable ones, nightly gets a new build of next or the release branch twice a day
- Custom installs any image tag of ghcr.io by hand, such as pr-1234 for the build of pull request 1234
- After a switch to a more stable channel, the instance keeps the updates of the channel it left until the stable release of its version is out
- The local versions.json moves to storage/app and is replaced in one step, a channel change replaces it without the version of the old channel
- Docker Compose builds the development helper from the main branch of that repository, scripts/dev-helper from there or from a local checkout
- Remove buildHelperImage from the settings, nothing calls it since its button was removed
- On a resource page, the main menu starts with a row that shows the
resource name and opens the deepest resource menu again.
- Pass the resource name to registerMainNavContext() again.
- Document the row in DESIGN.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
