A Laravel app on a sibling subdomain with SESSION_DOMAIN=.example.com sets
a second XSRF-TOKEN cookie that the browser also sends to Coolify. The
terminal server forwarded only the first one, so Laravel answered 419 and
the terminal closed with 4401. Try each distinct token (at most five) and
keep the accepted one for the requests that follow on the connection.
Closes#10397
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The terminal server built the Laravel session cookie name from APP_NAME
with its own regex and ignored SESSION_COOKIE. When the name differed
from Laravel's, every connection closed with "Missing required tokens".
Forward the browser Cookie header so Laravel reads its own session.
Also remove the text rejection messages kept for terminal clients from
before close codes; the server and client now ship in the same image.
Closes#10549
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pin every helper download by SHA256 and the base images by digest, drop
the curl | bash installers, and add scripts/helper-checksums to refresh
the checksums. Update Alpine to 3.24, Docker CLI 29.9.2, Compose 5.6.1,
Buildx 0.38.1, pack 0.40.10, Railpack 0.43.0, and mise 2026.10.14.
Bump the helper to 1.0.19.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A reverse proxy that forwards only port 8000 (for example Tailscale Serve or a Cloudflare Tunnel without path rules) sent /app/ and /terminal/ws to Laravel. Proxy them to Reverb (6001) and the terminal server (6002) in the container.
Closes#11707
The serversideup/php base image now defines its user bundle (nginx,
php-fpm) in /etc/s6-overlay/user-bundles.d. A bundle in s6-rc.d/user
has priority over it, so the dev container started without nginx and
php-fpm and did not become healthy.
Pin development and production images to serversideup PHP v4.5.1 to
avoid the v5 user-bundle relocation that breaks startup.
Bump Coolify to 4.4.6 in the default config and version manifests.
The default stream_select() loop fails once a descriptor reaches 1024
(FD_SETSIZE). Install ext-uv and, only when an event loop extension is
available, raise the soft open-file limit of Reverb up to 65536.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the laravel/nightwatch package and its agent service from the
development and production s6-overlay configs. Remove the related
environment variables, constants, phpunit setting, Boost skill
registration, and configure-nightwatch agent skills. Update the
container role script test to stop expecting the nightwatch-agent
service.
Traffic analytics:
- Reject enabling unless the server runs a Coolify-managed Traefik or
Caddy proxy, and show the reason in the settings UI
- Save the proxy configuration before the setting so a failure leaves
both unchanged; allow disabling after the proxy was removed
- Skip the proxy restart when the proxy is stopped and report that the
config applies on next start
- Preserve the user's own Traefik --accesslog* flags and restore them
when analytics is disabled
- Rotate the Traefik access log in the sidecar with BusyBox tools
(copytruncate, 5 gzip rotations)
- Create the access log before starting Sentinel, which opens it once
Terminal:
- Detect and surface WebSocket connection rejections in the browser
terminal, with shared helpers in terminal-connection.js and
terminal-utils.js
Database import:
- Restore PostgreSQL backups in a single transaction; SQL replace
restores go into a temporary database and swap in only on success,
leaving the current database untouched on failure
Merge scripts/dev-instances into scripts/dev. Each branch gets its own
Compose project, container, volumes, port block, libvirt network, and
KVM VMs, so stop and start reuse the same data and worktrees do not
collide.
- Name instances after the branch; keep slots and APP_KEYs in the main
checkout's .dev-instances/ so they survive worktree removal
- Reuse existing QEMU VMs instead of recreating them; add dev:qemu --fresh
- Give each instance an isolated libvirt network (10.221.<slot>.0/24)
and VM names coolify-dev-<branch>--<profile>
- Publish per-instance browser ports and publish them with tailscale
serve when APP_URL is a tailnet host
- Add urls, exec, logs, container, destroy, and teardown commands; run
teardown from jean.json before Jean deletes a worktree
- Fix Reverb/terminal browser ports and the testing-host alias in the
instance compose file
- Keep fresh worktree instances working: pre-create laravel.log, log the
host dev:qemu call to stderr, and stop Vite from watching vendor/
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Andras BacsaiandClaude Opus 5.5
peaklabs-dev
Bo Sundgaardandpeaklabs-dev