An upgrade pulls new images and recreates the Coolify containers. A full
disk during an upgrade can leave Coolify broken.
- Measure free space on the Docker root dir and /data/coolify of localhost;
require 5 GB. An unknown value does not block.
- Manual upgrade: show the free and required space, with Run Docker cleanup,
Check again, and a confirmed Upgrade anyway override.
- Automatic upgrade: skip it and notify the team (disk usage channels, at
most once per 24 hours per server).
- upgrade.sh: stop before any change when the disk is low. A new 5th
argument skips the check (used by the override).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Block new upgrades while a recent upgrade is running, allowing retries after 15 minutes without a status update.
Add request timeouts and polling guards to keep upgrade progress responsive during restarts.
Caddy logs a site only when its container labels contain the log
directives. Deployments reuse the stored custom_labels, so applications
whose labels were stored before analytics was enabled never got the log
directives, and a redeploy did not help.
Toggling traffic analytics on a Caddy server now regenerates the stored
labels of applications with read-only labels. The destination uses the
current server instance, because the cached server can still have the
old analytics setting.
Fixes#12117
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add an authorized update button with activity logs to pull the latest image and recreate the tunnel container in the background.
Persist new Compose files under /data/coolify/cloudflared and support existing /tmp configurations. Cover updates, missing configuration, and member restrictions with tests.
Allow full, anonymized, or disabled IP recording per server through the UI
and API, and pass the selected mode to Sentinel. Adapt traffic breakdowns
to the effective IP mode, including views that aggregate multiple servers.
A stop or delete no longer queues a full cleanup each time. It skips the
cleanup when one finished on the server in the last hour, and the queued
run only cleans when disk usage is at or above the server cleanup
threshold. The docker_cleanup API flag keeps its default of true.
Scheduled, manual and stop-triggered cleanups share one per-server lock.
Stop-triggered cleanups wait 60 seconds and are coalesced per server, so
a bulk stop queues one cleanup. Remote commands share a 540 second
deadline below the 600 second job timeout, and application images are
scanned with a fixed number of remote commands.
- Start Sentinel with --restart unless-stopped so Docker restarts it
after a crash or reboot.
- Make CheckAndStartSentinelJob unique per server so copies cannot
collect in a slow queue.
- Read X-Sentinel-Version on push and update an outdated Sentinel
without SSH; skip the hourly SSH version check for servers that
report their version.
- Regenerate SSL Certificates now writes server.crt/server.key for every
engine except MongoDB, which keeps the combined server.pem. Before, the
button always wrote server.pem, so Postgres, MySQL, MariaDB, Redis, KeyDB
and Dragonfly failed to start after a regenerate.
- The certificate renewal job uses the same rule, so MongoDB no longer
switches to server.crt/server.key on renewal and fails on restart.
- Starting an SSL database writes the CA that signs its certificate to
/data/coolify/ssl/coolify-ca.crt, so a stale CA file (for example one
written by another server entry for the same host) no longer causes
"certificate signature failure".
- Saving a custom CA certificate that does not match the stored CA
private key is rejected.
- The CA file write commands live in SslHelper::caCertificateFileCommands().
Fixes#10388Fixes#6771Fixes#11926
A non-root SSH user cannot open redirects, expand globs, or cd into
/data/coolify (9999:root 0700). Several remote commands relied on that
and failed on non-root servers.
- Write README files with `tee` instead of shell redirects in database
starts and application deployments
- Clear Postgres init scripts with `find` instead of a glob
- Split the proxy config backfill if/else so each branch gets sudo
- Start the log drain with `docker compose -f` instead of `cd`
- Wrap the preserved-repository compose start in `sh -c` for non-root
- Stage clone archives outside /data/coolify via StagesCloneArchives
- Extend the sudo parser and add non-root command tests
Development mode rewrote /data/coolify paths to the dev Docker volume
for every server. That is only right for the testing-host backend,
which uses the host Docker daemon. The KVM localhost and other dev VMs
have their own /data/coolify, so bind mounts, Compose content files,
the Traefik and Caddy traffic mounts, Sentinel, and database proxies
pointed to wrong paths there.
- Server::sharesDevHostDocker() and devHostDockerPath() decide per
server; only the testing-host server (ip coolify-testing-host) gets
the volume path. Production is unchanged.
- The testing-host volume names come from the Compose project
(DEV_COOLIFY_DATA_VOLUME, DEV_COOLIFY_BACKUPS_VOLUME), with the
legacy names as fallback.
- In development, saved proxy configurations with the old path are
fixed when they load and ask for a proxy restart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Servers with caddy-docker-proxy older than 2.9 show a warning on the
Proxy page and the traffic analytics settings, with the fix.
- Caddy 2.9+ images get the basic_auth label; older ones keep the
deprecated basicauth, which Caddy 2.7 still needs.
- Caddy mounts StartSentinel::trafficLogDirectory() as /traffic, so
Caddy and Sentinel use the same access log, also in development.
- The development data volume is configurable (DEV_COOLIFY_DATA_VOLUME,
same default as before) and shared by Traefik, Caddy, and Sentinel.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Traffic analytics now covers every resource on both proxies:
- Caddy: Compose applications and services get access-log labels. The
log_append key is {uuid}-{service}, the same key Sentinel reads from
Traefik router names.
- A resource owns the Sentinel key {uuid} and every key that starts
with {uuid}-. Application pages and the traffic card now merge all
keys, so Compose applications and previews show data on Traefik too.
- Global analytics: the leaderboard groups the keys of one resource
into one row, lists services, and never names keys of other teams.
- New service analytics page (project.service.analytics) with the same
view and authorization as the application page.
- Switching the proxy type restarts Sentinel when analytics is on, so
it reads the new log path. Sentinel gets no traffic mount when the
proxy has no analytics support.
- Caddy servers show a note that resources log only after a redeploy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Traffic analytics:
- Reject enabling unless the server runs a Coolify-managed Traefik or
Caddy proxy, and show the reason in the settings UI
- Save the proxy configuration before the setting so a failure leaves
both unchanged; allow disabling after the proxy was removed
- Skip the proxy restart when the proxy is stopped and report that the
config applies on next start
- Preserve the user's own Traefik --accesslog* flags and restore them
when analytics is disabled
- Rotate the Traefik access log in the sidecar with BusyBox tools
(copytruncate, 5 gzip rotations)
- Create the access log before starting Sentinel, which opens it once
Terminal:
- Detect and surface WebSocket connection rejections in the browser
terminal, with shared helpers in terminal-connection.js and
terminal-utils.js
Database import:
- Restore PostgreSQL backups in a single transaction; SQL replace
restores go into a temporary database and swap in only on success,
leaving the current database untouched on failure
Apply analytics settings to existing proxy configurations while retaining custom options, including managed Traefik log rotation and Caddy traffic volumes. Upgrade new Traefik configurations to v3.7.
Use the Coolify data volume path in local env so Sentinel can read access.log instead of the production proxy path. Cover the directory and TRAFFIC_ACCESS_LOG_PATH in tests.
- Only send GEOIP_MAXMIND_LICENSE_KEY to Sentinel when GeoIP is enabled
- Skip restarting Sentinel when disabling analytics unless it was already running
- Validate Sentinel API responses are JSON objects before reading them
- Restore "live" toggle state from localStorage instead of only disabling it
- Use content-based wire:key for breakdown/path rows instead of loop index
- Add missing Kosovo country code and require update permission for geoip listbox
InstallPrerequisites had no alpine branch and threw before Docker
install was ever reached. Enable the community repository (commented
out on some images) and install curl/wget/git/jq with apk.
The Docker install now also pulls docker-cli-compose, which
validateDockerCompose() requires, creates /etc/docker since Alpine's
docker package does not ship it, and enables/starts the OpenRC service.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GXciegHbJhXbGvVn7mwgbR
Adds ConfigureTrafficAnalytics::run(Server, bool) which sets the
is_traffic_analytics_enabled flag, force-regenerates the proxy config,
dispatches RestartProxyJob, and recreates Sentinel with restart: true.
Ensure a Sentinel endpoint from instance FQDN/IP when enabling, use process dialogs for validation with install state, and tidy server create, boarding, metrics empty state, and log timestamps.
Andras BacsaiandClaude Opus 5.5
Aditya Tripathi
Dion VH
Benoît de BiolleyandClaude Opus 5