Reject delete_from_provider values that are not booleans, and reject the
request when the team has no token for a linked cloud provider. Before,
both cases removed the server from Coolify but kept the cloud VM running.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With APP_ENV=local the deployment log showed every build-time value (raw,
stripped and escaped) and the old and new value of overrides. Print only the
key, the type and the value length.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
remote_process() stored the full shell command as plain text in
activity_log and kept it for 60 days. Database starts store the compose file
with the database passwords, imports store S3 keys, and the Cloudflare
tunnel setup stores its token.
- Store the command encrypted. The queue worker decrypts it right before the
SSH call and still reads plain commands of tasks queued before the upgrade.
- Remove the command when the task is finished: after a successful run, in
failed() when no attempt is left, and for a stopped import. A failed attempt
that the queue retries keeps it.
- Do not write a command preview into the error log.
- Migration: remove stored commands from activities that no longer run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The All button read $wire.numberOfLines, which does not update while the user
types or pastes a new number, so All stayed highlighted. Keep the state in
Alpine instead: All loads set it, and any input in the number field clears it
unless the value is -1.
Show a spinner in the All button while all logs load, and in place of the
Lines label while a new line count loads. Both keep their width.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The import looked up the key in all teams and stopped with "already exists
on another team", which also told the user that another team has the key.
Keys are unique per team, so reuse a key of the target team or create one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Login, registration and OAuth set a currentTeam attribute on the user model
that is not a database column, so a save of the user in the same request
would fail. Keep the team in the session and read it with currentTeam().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fixes the denial of service advisory GHSA-8rr7-cvq3-gmfh (affected
versions >=1.5.0,<2.10.0). nette/schema moves to 1.3.6 with it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SSH_COMMAND_TIMEOUT=0 (or an invalid value) removed the time limit of every
remote command, and imports could then be marked stale while still running.
Use the default of 3600 seconds for values that are not positive.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
resend-php 1.x reads the statusCode of Resend errors and knows more error
names. Coolify only uses emails->send and the exception classes, which did
not change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The duplicate check used the signed-in user's current team, or all teams
when there was none. Check the team the key belongs to.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub, Gitea and Bitbucket manual webhooks accepted any signature when
APP_ENV=local. GitLab and the GitHub App webhook already did not.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A 200 response with an empty body or an error page replaced the local
templates and the shared cache, so the service list became empty.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
resend-php 0.18 reads a "code" key that the Resend API does not send
(it sends statusCode), so every Resend error failed with Undefined array
key "code". Errors with names that the SDK does not know were returned as
a normal response and counted as a sent email. Read statusCode and name from
the error, and treat a response without an email id as an error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add a Lima backend to scripts/dev. Auto mode picks it on macOS when
limactl (Lima >= 2.0) is installed, and COOLIFY_DEV_SERVER_BACKEND=lima
forces it. Lima VMs are named coolify-dev-<slot>-<profile>. Coolify
connects to them through Lima's forwarded SSH port on
host.docker.internal, and only guest ports 80/443 are forwarded to
the host.
dev:qemu:seed now takes --ip and --port options, so the seeded server
can use a forwarded SSH address instead of the profile IP.
Add tests for the Lima start flow and for seeding with an overridden
address, and document the macOS setup in AGENTS.md.
- Configuration diff: report all settings when an app has no earlier
snapshot, so older apps show "configuration changed" again (#11430).
- DigitalOcean/Vultr: do not repeat the "API error:" prefix.
- HasSecretManager: the deleting listener returns nothing, so later
deleting listeners still run.
- GitLab webhook: use new_public_id() like the other webhooks.
- Team danger zone: show the link and open the page only for the team owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security:
- Settings email: authorize the SMTP and Resend toggles.
- Server navbar: show Sentinel status only to users who can view Sentinel.
- GitHub source: permission gates on Sync name and Delete.
Broken features:
- Profile: avatar upload (missing import and file uploads trait).
- API tokens: keep the "Never" expiry choice.
- Environment variables: show validation errors instead of a generic error.
- Servers API: read the server uuid from the route in domains_by_server,
so ?uuid=<application> filters instead of returning 404.
- Cloud servers: Power On for stopped Hetzner, DigitalOcean and Vultr servers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Let instant_remote_process throw on failed SSH/docker commands so the
real error (e.g. a missing coolify-sentinel container or an unreadable
SSH key) is reported. A null result, such as a literal "null" body, is
turned into an empty string, which guard() rejects as an invalid response.
Run curl with -sS so progress output stays out of the output while
errors are still reported.
Add tests for a failed docker exec and a literal null body.
The redesign removed the only way to call testConnection on GitHub sources;
GitLab sources still have the button.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Revert the app code changes of d666a0a95, 69eeb2f62, 1e66c9f9b and
a32082b03, so login, registration, OAuth, team danger zone, service
templates, and the other touched files are back to their earlier state.
Keep the removal of unused components and markup-only tests (d666a0a95
also contained those deletions by mistake).
StartupExecutionCleanupTest now fakes the template CDN with the current
file content, so app:init in the test no longer empties
templates/service-templates-latest.json.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Delete Blade components, component classes, Livewire components and
views that nothing uses after the redesign.
- Delete tests that only compare Blade/CSS source text; keep the source
checks for authorization gates, stable wire:key values and escaping.
- Update stale tests to the current UI and behaviour.
- Update DESIGN.md to the current navigation and layout.
- Add a lesson: test behaviour, not source markup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- TrustHosts: validate the Host header also when the FQDN cache is cold.
- Settings email: authorize the SMTP and Resend toggles.
- Server navbar: show Sentinel status only to users who can view Sentinel.
- GitHub source: restore permission gates on Sync name and Delete, and the
Test connection button.
- Profile: make avatar upload work (missing import and file uploads trait).
- API tokens: keep the "Never" expiry choice.
- Environment variables: show validation errors instead of a generic error.
- Servers API: read the server uuid from the route in domains_by_server.
- Configuration diff: report all settings when no earlier snapshot exists.
- Cloud servers: restore Power On for stopped servers; do not repeat the
provider error prefix.
- HasSecretManager: do not stop later deleting listeners.
- GitLab webhook: use new_public_id() like the other webhooks.
- Dev: show the Lima VM start command on the localhost server page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A 200 response with an empty body or an error page replaced the local
templates and the shared cache, so the service list became empty.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Login, registration and OAuth set a fake currentTeam attribute on the user.
When refreshSession() saved the user in the same request, the query wrote
a currentTeam column that does not exist. Keep the team only in the session
and read it through currentTeam().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Legacy Compose applications keep the old name of an external volume. The
deployment log now tells the user why and how to move to the external
volume. The storage page shows external volumes as a read-only list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
