- apt: use apt-get with DEBIAN_FRONTEND=noninteractive and keep changed
configuration files (--force-confdef/--force-confold). A single package
uses install --only-upgrade, so it is never installed when missing.
- pacman: do not run `pacman -Sy` on the live database during the check.
Use checkupdates (with fakeroot) or a temporary sync database, the same
method checkupdates uses. pacman 7 downloads as the alpm user, so the
temporary directory is 755. Arch allows only "Update all" (-Syu), because
partial upgrades are unsupported.
https://man.archlinux.org/man/checkupdates.8https://wiki.archlinux.org/title/System_maintenance#Partial_upgrades_are_unsupported
- dnf: list upgrades with `repoquery --upgrades --latest-limit 1 --qf`
(dnf5 needs the explicit \n, dnf4 prints empty lines) and read the
current versions from `rpm -qa`. The package name has no .arch suffix.
https://dnf5.readthedocs.io/en/latest/changes_from_dnf4.html
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rollback now also lists the commit images of the last 10 successful
deployments when the application pushes to a Docker registry. The
deployment pulls such an image when the server no longer has it.
The page and the API share GetRollbackImages, and the API returns a
source field (local or registry).
Resolve conflicts between main's security fixes and v4.5 features:
- Keep v4.5 features (log redaction, multi-S3 backups, transfer flow,
scheduled task modal, sidebar) and port main's fixes into them.
- Reuse RequiresDeployAbility for the Hostinger create endpoint.
- Align MCP tool abilities and descriptions with main's new deploy
requirements, and use deploy tokens in the affected MCP tests.
- Drop the duplicate DockerCleanupJobTest helper and tests, and the
exportBundle test for a method v4.5 removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Require deploy permission for API changes that trigger server side effects, including resource deletion, storage access, provider operations, and database imports. Also escape Docker cleanup filters and sanitize log drain server names.
Require deploy permission when setting a post-install script or extra SSH keys, document the 403 response, and cover both denial and allowed deployment cases.
- Database variants: use the same database name in Forgejo and the database
container (`forgejo` by default); Postgres stayed unhealthy and MySQL/MariaDB
installs failed with access denied.
- SSH: publish ${FORGEJO_SSH_PORT:-22222} and set SSH_PORT, DOMAIN and
SSH_DOMAIN, so clone URLs are correct and several instances fit on a server.
- Runner variants: start Forgejo from /usr/bin/s6-svscan, lock the install
with a generated admin, register runner 13.2.0 with a generated shared
secret, and enable the templates.
Closes#11924
oldRawParser made the bind directory of a long-syntax source like
../data at {workdir}./data, next to the path that Docker Compose uses.
Resolve the source with replaceLocalSource(), as the compose parsers do,
so Coolify makes the directory that the container mounts. A source that
resolves above / now stops the deployment before remote work.
Closes#4055
ServiceParserReferenceTest parses reference fixtures for serviceParser and
applicationParser (one service per feature, with setting variations and error
cases) and every template, and compares the output with expected files.
scripts/parser-snapshot-diff shows how a code change alters the output of all
cases (save / baseline). Template expected files are gitignored.
A service that declares SERVICE_FQDN_X_PORT while the named service declares
SERVICE_URL_X_PORT (same value) now counts as a copy, like an exact copy, so it
does not take the named service's domain. Also replace the Postgres-only
regex in the magic variable loop with the same check in PHP.
Generate now stores the new secret at once. The unsaved bar compares
fields with the saved secrets, so other drafts stay marked as unsaved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Call updateCompose() after saving an application's fqdn in the services
API urls handler so the domain is written back to the compose file.
Without this, StartService re-parsing the compose before deploy would
drop the domain and its SERVICE_URL_*/SERVICE_FQDN_* variables.
Add a feature test covering persistence after a second parse.
The template port 3003 sent API and realtime traffic to a port that the
containers do not listen on (502). Use port 80 as upstream does, update
images and env to the official 2.5.0 compose, drop the removed assistant
service, and default _APP_OPTIONS_FORCE_HTTPS to disabled (upstream
default) so installs on http domains reach the API.
When a compose service copies another service's SERVICE_URL_/SERVICE_FQDN_
declaration (old Twenty template: worker repeats SERVICE_URL_TWENTY_3000),
the parser and updateCompose wrote the variable from the copier's generated
domain, so a custom domain on the named service was lost on every deploy.
Skip exact copies; declarations with another path or port are unchanged.
Closes#11924
GNU tar exits with 1 when a file changes while it is read. The archive
is still valid, so only exit codes above 1 fail the backup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All instances share the same default update cron, so they request the
CDN at the same second and Cloudflare rejects the burst (error 1200).
Queue the CDN fetching jobs with a random 0-600s delay to spread the load.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Add a per-task overlap lock to ScheduledTaskJob that outlives the worker
timeout, so a long or killed run cannot overlap the next cron run.
- Mark the dropped occurrence as skipped instead of releasing the job.
Closes#11648
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A single service deploy with an unchanged config keeps the running
container, which is already on the network. The connect then logged a
false "already exists" error and a warning. Check the container's
networks first.
Closes#11295
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A custom config file written with tee gets the server umask. With umask
027 or 077 the file is not readable by the container user, so MySQL and
MariaDB ignored the whole config without an error.
- Set mode 644 on the MySQL, MariaDB, PostgreSQL, and MongoDB custom
config files after each write.
- Close the multiplexed SSH connection when the server user, IP, or port
changes, so the next command does not run as the old user.
Closes#11600
Docker Engine 27.0 to 28.0.0 reports an IPv6 network gateway with its
prefix length (fd00::1/64) until the daemon restarts (moby/moby#49520).
The Docker CLI 29 and Compose 5 in the helper image reject it, so
deployments failed and the upgrade left Coolify stopped.
- Stop the upgrade before it changes containers when the coolify network
has such a gateway, and tell the user to restart or upgrade Docker.
- Create a new coolify network again without IPv6 when Docker reports
its gateway with a prefix.
- Report an error, not "Upgrade complete", when the new Coolify
containers do not start.
- Add the fix to deployment errors that contain this ParseAddr failure.
Fixes#11583
Merge log rotation and the network pool into the existing daemon.json
instead of overwriting it. Skip the change and the Docker restart when
containers are running, unless DOCKER_POOL_FORCE_OVERRIDE=true.
Closes#11221
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Create the containers with --no-start, connect them to the destination
network, then start them. A container that crashed before the late
connect was restarting, the connect failed silently, and it never
joined the network.
Closes#11371
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Andras BacsaiandClaude Opus 5.5
