Andras Bacsai
70021c8d5e
fix(api): handle destination create races as conflicts
2026-07-02 15:33:01 +02:00
Andras Bacsai
4ef884e1ac
Merge remote-tracking branch 'origin/next' into feat/api-destinations
2026-07-02 15:14:13 +02:00
Andras Bacsai
20b5b90cf9
Merge remote-tracking branch 'origin/next' into improve-s3-storage-handling
2026-07-02 15:06:11 +02:00
Andras Bacsai
78d9244caa
fix: improve s3 storage handling
2026-07-02 15:05:05 +02:00
Andras Bacsai and GitHub
bed058b826
Improve outbound URL validation ( #10833 )
2026-07-02 15:02:37 +02:00
Andras Bacsai
a06c1a7bf5
Improve storage mount path handling
2026-07-02 14:54:38 +02:00
Andras Bacsai
c7f014017b
Improve outbound URL validation
2026-07-02 14:46:46 +02:00
Andras Bacsai
a121386ab4
Merge branch 'next' into improve-resource-route-handling
2026-07-02 13:25:47 +02:00
Andras Bacsai
fb2d477e48
fix: improve team resource route handling
2026-07-02 13:05:27 +02:00
Andras Bacsai
74f4d04f53
fix(backups): default S3 storage for backup schedules
...
Show the S3 storage selector even when S3 backups are disabled, save
storage changes immediately, and improve responsive confirmation buttons.
2026-07-02 12:47:54 +02:00
Andras Bacsai
22b31f5671
fix(backups): require valid S3 storage selection
...
Preserve S3 backups when a single valid storage is available, require
explicit selection when multiple storages exist, and disable S3 when none
are available.
Make backup action controls responsive on narrow screens.
2026-07-01 11:14:20 +02:00
Andras Bacsai
78374b566a
fix members smtp pw update
2026-06-30 15:29:19 +02:00
Andras Bacsai and GitHub
63d6d835a9
Align resource creation permissions ( #10799 )
2026-06-29 15:59:46 +02:00
Andras Bacsai
29445bf177
fix: align resource creation permissions
2026-06-29 15:57:17 +02:00
Andras Bacsai and GitHub
f2d11d9300
fix(railpack): interpolate build-time env variables by sourcing build… ( #10768 )
2026-06-29 11:08:19 +02:00
Andras Bacsai
7d65a4b496
Merge remote-tracking branch 'origin/next' into harden-database-import-files
2026-06-29 10:35:35 +02:00
Andras Bacsai
2d63d51237
fix: harden database backup imports
2026-06-29 10:27:01 +02:00
Andras Bacsai
9a64b2ea0a
Merge remote-tracking branch 'origin/next' into fix/railpack-buildtime-env-interpolation
2026-06-29 10:20:07 +02:00
Andras Bacsai
2dc34f61ff
fix(railpack): create empty build-time env file
2026-06-29 10:19:22 +02:00
Andras Bacsai
a630532308
fix(deploy): preserve deploy key command metadata
2026-06-29 10:17:09 +02:00
Andras Bacsai
3729b5c074
improve github webhook
2026-06-28 15:25:58 +02:00
Andras Bacsai
1a5b8d3612
fix(deploy): skip logging deploy key commands
2026-06-28 13:15:18 +02:00
Andras Bacsai
87d4744390
Validate environment variable keys
2026-06-25 18:19:58 +02:00
Aditya Tripathi
623bf89543
fix(railpack): interpolate build-time env variables by sourcing build-time .env
...
Railpack builds forwarded build-time variables inline as `env 'KEY=VALUE'`,
which single-quotes each value and prevents shell interpolation. References
like BETTER_AUTH_URL=$COOLIFY_URL reached the build as the literal string
"$COOLIFY_URL" instead of the resolved URL, breaking builds that validate
their env (e.g. SvelteKit/better-auth).
Wrap the railpack `docker buildx build` invocation with the same
wrap_build_command_with_env_export() helper used by the Dockerfile and
Nixpacks build paths, sourcing the build-time .env file (which writes
COOLIFY_* first and double-quotes normal vars to allow $VAR expansion).
Only buildpack control variables (NIXPACKS_/RAILPACK_), excluded from that
file and never needing interpolation, remain inline. Secret flags are
unchanged and read the interpolated values from the exported environment.
Fixes #10736
2026-06-24 20:11:46 +00:00
Andras Bacsai
00c5a630cf
fix(subscription): clamp dynamic quantity to MIN_SERVER_LIMIT on update
2026-06-19 08:27:41 +02:00
Andras Bacsai
9e021c4037
fix(api): enforce destination access and cleanup networks
...
Require admin team membership for destination mutations, return invalid-token
responses for tokenless requests, and remove standalone Docker networks when
deleting destinations.
2026-06-15 17:15:56 +02:00
Andras Bacsai
9665aa292c
fix(api): block invalid destination types and service deletions
2026-06-15 17:03:01 +02:00
Andras Bacsai
506643603c
Merge remote-tracking branch 'origin/next' into feat/api-destinations
2026-06-15 17:02:24 +02:00
Andras Bacsai
d2deaa8363
fix(auth): restrict Sentinel access and register S3 policy
2026-06-15 12:31:30 +02:00
Andras Bacsai
78d8afa602
Merge remote-tracking branch 'origin/next' into audit-policies
2026-06-15 12:05:19 +02:00
Andras Bacsai and GitHub
52739141ee
fix(previews): clean up closed PR previews after update failures ( #10180 )
2026-06-12 20:08:34 +02:00
Andras Bacsai
61d2d17f52
feat(subscription): add Stripe action controls
...
Add subscription action handling and tests for cancel, resume, and refund flows while resolving StripeClient through the container.
2026-06-12 15:54:21 +02:00
vuguul
4c77504b5e
fix(service): limit Grafana extra fields to Grafana images
2026-06-05 14:29:29 -06:00
Andras Bacsai
22f9f96db6
chore: inspect staged changes for commit message
2026-06-04 15:24:53 +02:00
Andras Bacsai
5973bb4d4f
fix(security): hide notification secrets from non-admins
...
Prevent users without update permission from reading notification credentials and manual webhook secrets in Livewire state or rendered forms.
2026-06-04 11:24:19 +02:00
Andras Bacsai
062ad57740
fix(security): enforce team access on mutable actions
...
Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.
2026-06-04 11:03:06 +02:00
Andras Bacsai
9dca7ca351
Merge remote-tracking branch 'origin/next' into audit-policies
2026-06-04 10:18:54 +02:00
Andras Bacsai
981b670eb4
feat(services): show template update timestamps
2026-06-04 09:34:11 +02:00
Andras Bacsai and GitHub
33f3a0b100
fix(git): write deploy key to per-deployment path, not root's id_rsa ( #10440 )
2026-06-03 15:09:45 +02:00
Andras Bacsai
e39a9ad827
fix(git): use deploy key path for PR fetches
2026-06-03 14:39:05 +02:00
Andras Bacsai
08735e6cc8
feat(postgres): add internal database upgrade script
...
Publish upgrade-postgres.sh with install and upgrade flows, include the
PostgreSQL compose override when present, and sync the script to BunnyCDN.
2026-06-03 14:27:01 +02:00
Andras Bacsai
3eb5463e3e
Merge remote-tracking branch 'origin/next' into fix/deploy-key-dedicated-path-race
2026-06-03 14:00:34 +02:00
Andras Bacsai
81cff9f486
Merge remote-tracking branch 'origin/next' into feat/api-destinations
2026-06-03 13:57:04 +02:00
Andras Bacsai and GitHub
f8960f44fa
fix(api): apply private_key_uuid in update_server ( #10416 )
2026-06-03 13:49:36 +02:00
Andras Bacsai
217541a987
fix(api): allow disabling build server mode
2026-06-03 13:48:31 +02:00
Andras Bacsai and GitHub
acc929a7b0
feat(ui): add search functionality for environment variables ( #10421 )
2026-06-03 13:48:03 +02:00
Andras Bacsai
1802522c60
fix(env-vars): treat search wildcards literally
...
Escape SQL LIKE wildcard characters in environment variable searches and hide production or preview sections when the filtered results are empty.
2026-06-03 13:43:26 +02:00
Andras Bacsai
09d8ba0d89
fix(api): prevent partial server updates on invalid disk schedule
2026-06-03 13:03:12 +02:00
Andras Bacsai
36d44faaf9
fix(git): apply HTTP transport config to PR checkouts
2026-06-03 12:59:45 +02:00
Andras Bacsai
ffe37fc892
Merge remote-tracking branch 'origin/next' into 5251-large-repo-deploy-bug
2026-06-03 12:56:27 +02:00
Andras Bacsai
Aditya Tripathi
vuguul