validateOS matched only ID from /etc/os-release, so derivatives such as
Omarchy, CachyOS, Manjaro or Linux Mint failed validation before the
Docker checks ran. Check ID first, then each ID_LIKE entry, and keep the
exactly-one-match rule. Move the parsing into a testable function.
Closes#12033
Co-authored-by: Furox <177975472+Furox-Art@users.noreply.github.com>
Remove the explicit 10-second timeout from the cloudflared health check so
it uses the default remote process timeout. Add a feature test confirming
the health check runs with sudo on non-root servers, and that the server is
marked as using a Cloudflare tunnel with its IP set to the SSH domain.
The repository URL rule rejected ssh://user@host:port/path, so deploy-key
resources on servers with a custom SSH port needed a manual URL edit after
creation. Accept ssh:// URLs and keep them unchanged for deploy keys so the
port reaches the clone. Rename scpStyleGitUrlToHttps to sshGitUrlToHttps and
let it convert ssh:// URLs too, so public flows, repository links and GitHub
App repository slugs handle them.
Closes#12161
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Remove old helper, realtime and sentinel images by name with --format
instead of parsing the default table, which changed in Docker 29. Also
remove unused images pulled by digest.
Closes#12148
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub reports team-granted and private org members as CONTRIBUTOR or
NONE, so their same-repository PRs were silently skipped when public PR
deployments were off. A same-repository branch already requires push
access, so gate only on fork status, treat an unknown head repository as
a fork, and log skipped fork PRs.
Closes#9271
Retry the installation token request on GitHub 5xx and connection errors,
and report the HTTP status when GitHub sends no error message. Retry the
repository import when SSH drops the connection (exit code 255), after
stopping the interrupted clone and removing the partial checkout.
Closes#8004
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CheckHelperImageJob now logs a warning and returns when the versions
endpoint fails instead of sending an internal notification and
rethrowing. The next scheduled run retries. PullTemplatesFromCDN also
no longer sends internal notifications on non-success responses or
exceptions; it still logs them.
Add tests checking that the stored helper version is kept and that no
notification is sent when the CDN is unavailable.
- Fetch every page of pull request files so watch paths match PRs with more than 30 files.
- Deploy the preview and log a warning when the changed-file list is unknown (API error or truncated compare list).
- Log when watch paths decline a preview deployment.
- Keep the GitHub App installation token in memory per instance, so a deployment requests one token instead of 3-5.
Closes#12169
Instance backup settings, started ClickHouse/KeyDB/Dragonfly databases,
and destinations saved read-only fields back to the database, so a
password manager autofill could overwrite stored credentials.
Closes#12173
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Load the running containers of a service even when the service status is
degraded, instead of blocking the whole terminal. Also respect the server
terminal setting for service databases.
Closes#12174
- Runtime logs: add a compact text view, move display options and log level filters into a View menu, move copy and download into an Export menu, and remove the extra top margin.
- Replace spinner loading cards with skeletons on the logs, dynamic configurations, proxy, TLS certificates, Docker images, environment variables, preview deployments, rollback, subscription, cloud provider, and new resource pages.
Count invalid keys, tokens, and deleted webhooks in a new failure_count column
on each notification settings table, like servers.unreachable_count. After 3
failures in a row the channel is disabled and the team is told by instance
email and its other channels. Rate limits and server errors are retried and
not counted; test notifications never count.
Move all git examples into ApplicationSeeder on railpack, using the
reorganized coollabsio/coolify-examples main branch, and drop the
separate Railpack Examples project. Add DEV_SEED_IP to set the IP for
seeded sslip.io domains (e.g. a Tailscale IP).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Applications and service applications can now use the server resolver,
no resolver ("none"), or a custom resolver name. This allows servers
that mix Let's Encrypt domains with domains that use their own
certificates, such as Cloudflare Origin CA. The setting is available in
the UI and the API.
Closes#12138
Set the resolver to null when saved Traefik configuration has no active letsencrypt resolver. Preserve existing settings for active or unknown configurations and log parsing failures.
Add regression coverage for missing, active, unknown, and malformed configurations.
Coolify always added tls.certresolver=letsencrypt to generated HTTPS
routers, so Traefik logged errors when the proxy used its own
certificates (for example Cloudflare Origin CA) without that resolver.
Add a server setting (default letsencrypt) in the proxy page and API.
An empty value omits the resolver from resource labels, the Coolify
dashboard routes, and the catch-all router.
Closes#12138
Pin development and production images to serversideup PHP v4.5.1 to
avoid the v5 user-bundle relocation that breaks startup.
Bump Coolify to 4.4.6 in the default config and version manifests.
Use the helper's RAILPACK_VERSION, falling back to the installed CLI
version, instead of a hardcoded frontend version. Add regression tests
for both version sources and application-variable isolation.
- Stop the Redis username accessor from creating REDIS_USERNAME on read
- Keep source values when cloning applications (no duplicate NIXPACKS_NODE_VERSION)
- Match exact keys when adding default database environment variables
- Write content files before database containers start
- Resolve the database proxy upstream through Docker DNS on each connection
- Remove existing duplicate REDIS_USERNAME and NIXPACKS_NODE_VERSION rows
Store server IPs in one form (no brackets, short lower-case IPv6) and
write each address in the form its context needs:
- URLs and host:port (Sentinel, database URLs, SFTP backup download,
DNS servers, SMTP, webhook base URLs, links, health checks) get
brackets through formatHostForUrl().
- Traefik Host() rules use the address without brackets, so IPv6
domains no longer return 404; saved labels are fixed at deploy.
Caddy keeps the brackets.
- SSH keeps the plain address.
- Hetzner gives an IPv6 /64 network; IPv6-only servers now get the
server address (prefix::1) instead of the unusable prefix::64.
- sslip labels, registry image names with an IPv6 host, the API domain
list, allowlist matching and duplicate checks handle IPv6.
A migration normalizes stored IPv6 server addresses, repairs Hetzner
servers saved as ::64 that are not reachable, and adds brackets to
saved Sentinel URLs.
Andras BacsaiandFurox
🏔️ Peak