2789 Commits
Author SHA1 Message Date
Cursor AgentandAndras Bacsai 8df39bc637 Refresh the dark dashboard around the coolLabs purple brand.
Dark mode keeps a black canvas, paints cards at #121212, and tints the sidebar purple-black. Active navigation, secondary buttons, and the view switcher use brand purple; warning yellow stays for real warnings.

Co-authored-by: Andras Bacsai <andrasbacsai@users.noreply.github.com>
2026-10-22 07:13:38 +00:00
Andras Bacsai 91ea7d851e Fix/secret manager request timeout (#12270) 2026-10-21 22:58:00 +02:00
Andras Bacsai 5a92340ae3 Merge remote-tracking branch 'origin/main' 2026-10-21 22:56:42 +02:00
Andras Bacsai c465371356 Merge remote-tracking branch 'origin/main' into fix/secret-manager-request-timeout
# Conflicts:
#	other/nightly/versions.json
#	tests/Feature/Security/IntegrationTokenFormTest.php
#	versions.json
2026-10-21 22:44:50 +02:00
Andras Bacsai 8d400e3d6b fix(ui): refine service resources and settings section styling 2026-10-21 21:01:24 +02:00
Andras BacsaiandClaude Opus 5.5 ab71f1af61 fix(ui): align dashboard deployments heading and unify muted table headers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 18:45:49 +02:00
Andras BacsaiandClaude Opus 5.5 dbc3fb91bf fix(cdn): fetch versions.json once per hour, spread evenly across instances
- Retry CDN requests only for transient errors and honor Retry-After
  (Cloudflare error 1200 sends 60 s), with jitter.
- Read helper and Sentinel versions from the local versions.json, which
  the hourly update check refreshes, instead of fetching per job/server.
- Replace the random 0-600 s delay with a stable per-instance offset
  inside the cron interval (max 1 h).
- Manual update checks and upgrades make one CDN attempt only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 18:10:48 +02:00
Andras BacsaiandClaude Opus 5.5 c4bc9ae8bf fix(canvas): show servers without resources on the servers canvas
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 18:02:02 +02:00
Andras BacsaiandClaude Opus 5.5 b1f2abf868 fix(cloud): refresh local versions.json hourly on every node
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 17:18:56 +02:00
Andras Bacsai 666ae60c2c Merge remote-tracking branch 'origin/main' into release/v4.5 2026-10-21 16:49:31 +02:00
Andras Bacsai d404da904f feat(app-key): re-encrypt stored secrets after key rotation 2026-10-21 16:47:51 +02:00
Andras Bacsai d730ab48fd feat(security): add command to re-encrypt secrets after key rotation 2026-10-21 16:47:40 +02:00
Andras Bacsai e9f69ce95b Merge remote-tracking branch 'origin/main' into fix/secret-manager-request-timeout 2026-10-21 16:23:00 +02:00
🏔️ Peak ff642008f1 fix(security): releease v4.4.7 (#12257) 2026-10-21 16:18:27 +02:00
peaklabs-dev eeda30719f feat(cdn): add patch.sh to sync:cdn 2026-10-21 16:16:13 +02:00
Andras BacsaiandClaude Opus 5.5 0ae8faa07b fix(domains): remove the in-page title and domain count
- The sidebar already names the page; resource pages have no in-flow heading
- Toolbar puts search on the left and actions on the right

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 14:23:04 +02:00
Andras Bacsai 58b7f85e1e feat(ui): add Projects page to the sidebar 2026-10-21 13:31:37 +02:00
Andras BacsaiandClaude Opus 5.5 0d3f6d5dbe fix(server): remove patch summary from server list header
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 13:04:11 +02:00
Andras BacsaiandClaude Opus 5.5 64b748008e fix(server): list the active private key first
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 11:28:48 +02:00
Andras Bacsai 0732e74553 fix(server-transfer): require deploy permission for import checks
Require write and deploy abilities on the import check endpoint, and clarify the target token permissions in transfer messages and UI.
2026-10-20 14:15:30 +02:00
Andras Bacsai 4e55c58a28 fix(storage): keep long-form bind sources with variable or vault references
Docker Compose resolves these values from the .env file, so the parser no
longer rejects or misresolves them. Also copy the expected parser fixtures
when parser-snapshot-diff compares with a git ref.
2026-10-20 13:47:41 +02:00
Andras BacsaiandClaude Opus 5.5 65a7bd5c05 chore: merge main into release/v4.5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-20 13:37:20 +02:00
e0f6b41dac chore: merge main into release/v4.5 (#12206)
Co-authored-by: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Andras Bacsai <andrasbacsai@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-20 13:26:07 +02:00
Andras Bacsai 87dade4517 fix(secret-manager): add configurable request timeout for Infisical and Vault 2026-10-20 13:00:38 +02:00
Andras Bacsai 2ade696375 fix(storage): resolve ${VAR:-default} bind sources and safe conversion (#12227) 2026-10-20 11:41:54 +02:00
Andras Bacsai 5925c8403a fix(log-drain): replace server name whitespace with hyphens (#12239) 2026-10-20 11:29:11 +02:00
Andras Bacsai 57faba1b96 fix(logs): prevent URL redaction from spanning log lines (#12238) 2026-10-20 10:49:29 +02:00
Andras Bacsai d55852ee94 fix(proxy): persist running status from Sentinel push updates (#12237) 2026-10-20 10:49:26 +02:00
Andras Bacsai bf957e425f fix(docker): parse quoted and hyphenated custom docker option values (#12208) 2026-10-19 23:12:16 +02:00
Andras Bacsai cf71fda5c1 feat(gitea): add Gitea App sources and private repo deployments (#12234) 2026-10-19 21:58:30 +02:00
Andras Bacsai 71131804f6 fix: require notification and log drain fields only when enabled (#12232) 2026-10-19 21:47:33 +02:00
Andras Bacsai 62be8674bc feat(proxy): add optional permanent redirects for apps and services (#12233) 2026-10-19 21:46:12 +02:00
Andras Bacsai fb6d3e7c9b fix(proxy): exclude SSE streams from Traefik compression (#12229) 2026-10-19 21:43:51 +02:00
Andras Bacsai 5ae125ad39 fix(tasks): run scheduled tasks only in running app containers (#12226) 2026-10-19 21:28:54 +02:00
Andras Bacsai 6d36605176 fix(proxy): require coolify-proxy container name outside Swarm (#12225) 2026-10-19 21:23:12 +02:00
Andras Bacsai c089f8a328 fix(backups): use configured databases when container env is missing (#12212) 2026-10-19 21:21:53 +02:00
Andras Bacsai 54315b10e5 fix(compose): strip UTF-8 BOM before parsing Docker Compose YAML (#12223) 2026-10-19 21:21:15 +02:00
Andras Bacsai d043c10c11 fix(postgresql): set PGPASSWORD for healthchecks and backups (#12224) 2026-10-19 21:20:17 +02:00
Andras Bacsai 3acfa6b9a6 fix(telegram): show API errors when sending test notifications (#12219) 2026-10-19 21:17:35 +02:00
Andras Bacsai b4c3101b29 fix(compose): reject scale and replicas greater than one (#12213) 2026-10-19 21:08:06 +02:00
Andras Bacsai 59793b060c fix(api): point rejected fqdn field to domains on application writes (#12217) 2026-10-19 21:07:51 +02:00
Andras Bacsai 3b407c8413 fix(backups): send Content-MD5 for S3-only volume backups on Object Lock (#12215) 2026-10-19 21:05:38 +02:00
Andras BacsaiandClaude Opus 5.5 63153aa8b4 fix(cloud): rework unsubscribed team cleanup and account deletion (#12210)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 17:32:16 +02:00
Andras Bacsai dd456625ec Merge remote-tracking branch 'origin/release/v4.5' into release/v4.5 2026-10-19 15:03:38 +02:00
Andras BacsaiandClaude Opus 5.5 ad6e929a93 feat(gpu): fix GPU compose settings and show detected server GPUs
- Build a valid compose device request (device_ids list, options mapping, blank driver)
- Map --gpus N to count and drop --gpus when GPU settings are enabled
- Validate only changed GPU values so stored legacy values keep working
- Detect NVIDIA GPUs and the container toolkit with the server details
- Show detected GPUs with a refresh button in the application GPU section

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 15:00:31 +02:00
Andras BacsaiandClaude Opus 5.5 f9e4323839 fix(patches): turn on automatic updates with the time in the Maintenance window field
Turn on used the saved time and the confirmation showed the time from
page load, so an unsaved new time was ignored. Turn on now validates
and saves the time in the field, and the confirmation refers to the
field instead of a fixed time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 13:54:46 +02:00
Andras BacsaiandClaude Opus 5.5 3bc7e47a86 feat(patches): confirm before turning automatic security updates on or off
Automatic security updates now have their own "Turn on" / "Turn off"
action with a confirmation, instead of a field that the Save bar
applied. The confirmation explains what can stop:

- Docker from the operating system packages (docker.io, moby-engine)
  restarts on a security update, so all containers stop and start.
- Docker CE from the Docker repository is not updated: its repository
  has no security origin (apt) and no security advisories (dnf).
  Checked on Debian 12 (unattended-upgrade --dry-run skips docker-ce)
  and CentOS Stream 9.
- Services that use an updated library can restart; a new kernel is
  installed without a reboot.

The on/off state is locked, so only the confirmed action can change it.
A new maintenance window is applied to the server on Save only when the
updates are on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 13:51:21 +02:00
Andras BacsaiandClaude Opus 5.5 3c0c7cc93d refactor(patches): move schedule and automatic updates into the Server patching section
The check frequency, automatic security updates, and maintenance window
are now fields of the first section, in one row, instead of two extra
boxes. The "not supported" note moved into the existing callout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 13:43:31 +02:00
Andras Bacsai 975048bad8 fix(security): encrypt plaintext secrets at rest 2026-10-19 12:28:23 +02:00
Andras BacsaiandClaude Opus 5.5 f32ecca44c feat(patches): record package updates, reboots, and auto-update changes in the audit log
- ui.server.packages_update_requested: user, server, packages (or all),
  package manager, and the activity of the update.
- ui.server.packages_update_finished: written when the remote process
  finishes (also when it fails), with the result and the exit code of
  the activity. The update gets a fresh type_uuid (an indexed activity
  property), so the listener finds exactly this activity. The actor
  comes from the request, because the listener runs in the queue.
- ui.server.reboot_requested with result started or failed.
- ui.server.auto_security_updates_updated (enabled, time, package
  manager, result) and ui.server.patch_settings_updated for a changed
  check frequency.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 10:44:03 +02:00