Laravel runs failed() on a fresh copy of the job, so the in-memory
newVersionIsHealthy flag was always false there and a failure after the
old container stopped removed the only running container. Keep the flag
in the cache, keyed by the deployment UUID.
Closes#12253
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pg_dump ran with --no-acl --no-owner, so single-database backups lost
all GRANTs and a restored Supabase database did not work. The import
already skips owners and privileges unless "Keep owners and privileges"
is selected, so the backup now keeps them.
Closes#12244
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sentinel keeps raw samples for the last 24-48 hours and one-minute
averages before that. LTTB buckets by point count, so 7-day and 30-day
charts gave most points to the raw part. Average those ranges per
minute before LTTB.
Closes#12281
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Wait for each ifconfig.io lookup alone instead of through
Process::concurrently(), which throws on the first timeout and discards
the sibling result. Add --max-time 10 so a stalled lookup ends early.
Closes#12275
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ROOT_USERNAME with a space (or a password with #, $ or quotes) was written
unquoted, so phpdotenv failed to parse .env and Coolify returned HTTP 500.
Closes#12276
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On a fresh install, install.sh removed every authorized_keys line that
contained "coolify", including unrelated operator keys such as one
commented "coolify-disposable". Remove only lines whose comment is
exactly "coolify", the comment of the installer's own key.
Closes#12278
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Import:
- Check every uuid in a bundle against a strict id format before any
write, and quote the SSH mux socket and key paths in local shell
commands. A bundle uuid could run commands in the Coolify container.
- Validate bundle fqdns, git source URLs, paths, networks, cron
expressions, and database ports; cap the number of items.
- Do not confirm that another team has a uuid.
- Refuse a project icon path with a uuid that is not a plain id.
Claim, finish, and migrate:
- Pass checklist step keys to wire:click with Js::from (stored XSS).
- Link only to https target server URLs.
- Validate target_instance_url in /transfer/complete; never prefill an
unverified URL for a transfer back; scope the transfer-back token to
write+deploy for 1 hour.
- Release on an owner marker only when it is newer than the own claim.
- Do not touch apps that only use the server as an additional
destination when an archive is released or deleted.
- Give Sentinel a new token on claim.
- Add a checklist step to remove the previous instance's SSH key.
- Block a transfer while backups or scheduled tasks run.
- Authorize refreshMigration and PrivateKey checkConnection, clear
tokens from Livewire state, hide migration log/error from members.
Archives:
- Refuse ip, user, port, private key, and Cloudflare tunnel changes.
- Throttle Enable management and require a free server slot for it and
for a transfer back.
- Skip cloud provider calls.
- Re-read force_disabled before each SSH command, so running jobs stop.
- Probe the import check target at the resolved address only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Rate limit the import check probe and refuse private, loopback, and
link-local targets on Cloud.
- Rate limit the SSH validation that an import starts, like other
server validations.
- Count only managed servers for the server limit, the limit check job,
and the subscription page. Archives of transferred servers are left out.
- Do not show the name of another team's archived server in the import check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Volume backup notifications built links with route(), which uses APP_URL
in queue jobs and gave http://localhost links. Build them from base_url().
Closes#12285
- Make the dark sidebar a flat neutral #0d0d0d with neutral tiles, text,
search, and account button; only the current item stays purple.
- Remove the resource row and spacer at the top of the main menu, so
Dashboard sits under Search, and drop the unused nav context name.
- Route hard-coded brand purple, canvas, and card colors through tokens
that the custom theme overrides, so sidebar, buttons, accents, cards,
and tables follow the picked color.
- Paint page-level button and view-toggle tints over the canvas so the
floating navigation dots do not show through.
- Document the new sidebar and token rules in DESIGN.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Fit the embedded history to the logs height and page size to the screen
- Show status as a dot with short start time; add source, duration, and
server as a second line; make whole rows clickable
- Switch the logs viewer to another deployment without a page load
- Use View and Export menus and the runtime logs search in the toolbar
- Export visible logs from the server with secrets hidden; redact app
secrets in the full log download
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the container accordion with Deployment and Service selectors
that show one stream, merging replica containers by timestamp. The
viewer fills the page, opens in text view, keeps whitespace, and only
lets grid rows expand when the detail shows more than the row.
Based on the proposal in discussion #12176 by PhilippMolitor.
Add a settings-subsection component and merge small cards on the
advanced settings, application advanced, healthcheck, Docker cleanup,
and GitLab/Gitea source pages. Update outdated tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Skip TrimStrings and ConvertEmptyStringsToNull on the import route; an empty shared variable failed the whole import
- Keep compose parser versions, static ports, legacy variable keys, and only the bundle's variables and destinations
- Give the transfer back token the deploy permission that the import needs
- Move the Cloudflare tunnel DNS record with the server and park it on the source
- Refuse cloud server deletes, power on, tunnel and DNS changes, and scp for archives; skip their backup alerts and provider polling
- Add a column-level round-trip test, archive guard tests, and a live full-coverage transfer test
- Advance the GitLab App sequence in the dev seeder
- Add a main-menu row that reopens the resource menu, with a placeholder row
- Show only the other view as an icon in the view switcher
- Remove the active tile glow and the collapsed Search frame
- Tint the dark command palette purple and whiten focused-row details
- Soften the toast edge and give the toast icon tile 3D depth
- Document the decisions in DESIGN.md
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dark mode keeps a black canvas, paints cards at #121212, and tints the sidebar purple-black. Active navigation, secondary buttons, and the view switcher use brand purple; warning yellow stays for real warnings.
Co-authored-by: Andras Bacsai <andrasbacsai@users.noreply.github.com>
- Retry CDN requests only for transient errors and honor Retry-After
(Cloudflare error 1200 sends 60 s), with jitter.
- Read helper and Sentinel versions from the local versions.json, which
the hourly update check refreshes, instead of fetching per job/server.
- Replace the random 0-600 s delay with a stable per-instance offset
inside the cron interval (max 1 h).
- Manual update checks and upgrades make one CDN attempt only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
