- Set env var version and compose parsing version while creating, so a create writes one row
- Record no rows for the auto-created preview copy of an env var
- Record env and application API updates only with the fields that really changed
- Store no change data for new env vars, and null for empty change data
- Store metadata team_id as an integer
- Drop the unused level and resource indexes of audit_events
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Preview containers (-pr-<id>) came and went with pull requests and
invalidated the build cache of every app on the network. A build server
got the IPs of the deployment server network, which it cannot reach.
Add a per-app setting to turn off network hosts during the build.
Closes#12452
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add GET /gitea-apps, POST /applications/private-gitea-app, and
gitea_app_uuid in PATCH /applications/{uuid}, with OpenAPI docs and MCP tool support.
Closes#12459
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Read compound and fractional durations (1m30s, 1.5m), quoted values,
only the flags before CMD, the escape parser directive, and NONE with
flags. Zero and sub-second values no longer become 0 seconds.
Closes#12455
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Add a hint to failed command messages when the exit code is 255,
which explains that the SSH connection to the server closed before
the command finished.
- Return no services from applicationParser and serviceParser when the
compose `services` key is empty or is not a map, so parsing does not
fail.
- Move Server::getIp() out of the sshEndpointInUse() docblock, where it
was misplaced and broke the class.
- Add tests for the SSH hint, for services keys that are not maps, and
for saved compose variable values that must survive a redeploy
(#6995).
A locked variable used by Docker Compose could not be changed, unlocked,
or deleted, so a lock by mistake had no fix in the UI. A locked value can
now be replaced without showing it. The lock is permanent in the UI, the
API, and MCP, and Lock asks for confirmation.
Closes#6803
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Containers without sh (distroless or scratch images) could not run
scheduled tasks, because Coolify always ran the command with sh -c.
Turn off "Run in a shell" to split the command into arguments and run
it directly. The option is also in the API, the MCP tools, and the
server transfer.
Closes#8244
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The queue counted every running deployment against the deployment server,
and the job picked a build server at random. So the deployment server
limit capped builds on build servers, and the build server limit was
never read. Count each build on the server that runs it, reserve a build
server with a free slot when the deployment starts, and start waiting
deployments of other servers when a build server slot is freed.
Closes#7649
caddy-docker-proxy reloads Caddy whenever any proxied container changes,
and Caddy closes every WebSocket on reload by default. Set
stream_close_delay on app, service, and dashboard reverse_proxy routes.
Closes#7942
The MinIO client rejects endpoints such as `/storage/v1/s3`. Transfers to
these endpoints now use curl with a presigned URL that Coolify signs, for
database backups, volume backups, and S3 restores.
Closes#8530
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Team notifications sent through the instance email settings, the S3
connection error alert, and the channel disabled alert now use the
optional notification from address and name. Account mails keep the
default sender. Remove the unused emails command and its views.
Each new SSH connection opens a systemd-logind session. Some systemd
versions leak closed sessions until the host refuses logins at 8192.
The connection check now opens one new login (the probe), not three.
Closes#9148
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A preview deployment set COOLIFY_BRANCH in three places with three
values: the Compose shell variables used the application branch
(main), the Compose parser used pull/<id>/head, and other build packs
used the fetched refspec (pull/<id>/head:pr-<id>-coolify) or the
application branch. A variable that refers to ${COOLIFY_BRANCH} then
got a different value than the container. All paths now use
Application::coolifyBranch(), which gives pull/<id>/head for previews
and git_branch for production deployments.
Closes#9572
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
S3 storages with a self-signed or private CA certificate failed with
"cURL error 60", because the Coolify container and the backup helper do
not use the CA certificates of the host. The new opt-in setting turns off
the certificate check in the PHP S3 clients and sets MC_INSECURE for mc.
Closes#9762
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deleting a server with "Delete all resources" (UI) or ?force=true (API)
deleted every application that used the server, also applications that
use it only as an additional destination, for example after Promote.
Server delete now deletes only resources whose main destination is on
the server. Applications that use it only as an additional destination
lose their additional_destinations row for the server, and their
containers on it are stopped (best effort). The check for resources and
the transfer archive path use the same Server::primaryResources().
The delete confirmation lists the resources to delete and the
applications that keep running on another server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The stuck resources cleanup selected every column of every deployment,
including logs, and ran out of memory during app:init. Select only the
id and application_id. Also drop the unused executions property on the
backup pages and an unused execution loader.
Closes#12435
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mc keeps one --resolve IP per host, and Coolify always pinned the IPv4
address of a dual-stack endpoint. On servers without IPv4, uploads failed
with "network is unreachable". A helper container on the upload network
now connects to each validated IP, IPv4 first, and the first IP that
connects is pinned. S3 restores are now pinned in the same way.
Closes#12397
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Once Coolify is healthy, install.sh switches the instance to that update channel with php artisan app:update-channel
- The command and the update page share the rule that keeps the updates of the old channel after a switch to a more stable one
- Adds the channels stable, preview, nightly and custom
- Preview and nightly read /coolify/release.json on the CDN and take the newest version of their channel and the more stable ones, nightly gets a new build of next or the release branch twice a day
- Custom installs any image tag of ghcr.io by hand, such as pr-1234 for the build of pull request 1234
- After a switch to a more stable channel, the instance keeps the updates of the channel it left until the stable release of its version is out
- The local versions.json moves to storage/app and is replaced in one step, a channel change replaces it without the version of the old channel
- Require write access on the target environment to clone or move a resource
- Check read access on shared variables before a reference is added or resolved
- Limit team credentials, git sources, and imports of other backups to team-wide writers
- Require the delete level for backup, volume, storage, and task deletes
- Require create access for previews, new projects, and git sources
- Use the token team for the access scope, and check team-wide access on Livewire updates
- Require instance admin to toggle the API and MCP server
- Hide server pickers and broadcast details from members without access
Keep the description, permissions, scopes, and expiry. Move the row actions into a dropdown menu and measure the dropdown panel after it is shown, so menus at the right edge stay on screen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The browser uses only the /app/{key} WebSocket. Laravel sends events to
Reverb over 127.0.0.1, so the generated Traefik and Caddy configs no longer
route /apps to port 6001, and the WebSocket rule only matches /app/.
Closes#12390
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Re-inviting an email after its invitation expired, or re-inviting a user
who never set a password, sent a link that needs a login the user cannot
complete. Unused invited accounts now get a magic link again, and changing
another user's password no longer ends the current session.
Two applications that build the same Docker image name push the same
tags (commit SHA, latest, pr-<id>), so one can run the image of the
other. Deployments, the General form, and the API now reject such a
name for applications of the same team.
Closes#9834
ServerManagerJob and the Docker cleanup step of ScheduledJobManager
load the settings of every server with SELECT *. That reads the
patch_check_result JSON, which holds the full update list of each
server. With 12,709 rows, the scan took about 4 ms, but the full fetch
took 390-536 ms and 294 MB of PHP memory. Without the column it took
74 ms and 111 MB.
Add ServerSetting::withoutPatchCheckResult() and use it in both loops.
Queued jobs reload the full settings through SerializesModels.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
