- Require write access on the target environment to clone or move a resource
- Check read access on shared variables before a reference is added or resolved
- Limit team credentials, git sources, and imports of other backups to team-wide writers
- Require the delete level for backup, volume, storage, and task deletes
- Require create access for previews, new projects, and git sources
- Use the token team for the access scope, and check team-wide access on Livewire updates
- Require instance admin to toggle the API and MCP server
- Hide server pickers and broadcast details from members without access
Add a /dashboard/canvas page that renders every team server with its
resources and their running or queued deployments, backed by a new
ServerCanvasController::dashboard endpoint and a per-server usage
endpoint for zone headers. The dashboard remembers the list/canvas
choice and each section (projects, servers) its own table/grid view.
- Show Deploying/Queued pills on canvas cards and a foldable recent
deployments panel; add shared CanvasControls component
- Allow backup downloads from the server host via the S3 download
storage (PrepareFileDownloadJob accepts a null container)
- Extract backup toggle/run actions into ManagesDatabaseBackup and
surface them in backup execution headers; merge S3 and retention
sections into the general backup settings
- Move deployments indicator to the top bar and add a main nav
resource menu with submenus; simplify breadcrumbs and settings
layouts
- Add shared variables overview canvas and scheduled task modals
- Add feature tests for dashboard canvas, view modes, navbar
submenus, backup S3 downloads and scheduled task modals
Every released Sentinel with traffic analytics (1.0.0 and later) has
the dashboard and series routes and the requests, bytes_in and app
fields, so the fallbacks for builds without them are not needed.
- Keep "no data" handling for Sentinel without traffic routes (0.0.x)
- Keep the resource-scope fallback, which Sentinel 1.0.1 needs
Allow validated host file and directory mounts outside resource directories
while protecting external paths from deletion.
Clean up cancelled deployment containers and clear tracked process IDs.
Preserve legacy KeyDB and Dragonfly password parsing, accept server backup
paths without extension restrictions, and allow Compose variable proxy ports.
Add audit events for account actions, server and application settings,
services, destinations, storage, backup schedules, and scheduled tasks.
Track changed fields and skip unchanged saves without logging file content.
Add regression coverage for audit events and changed-field detection.
Domain Connect used the unfiltered server IPs, so a private address could be
published. It now uses the first public IP and refuses with the no public IP
message when there is none, like automatic DNS.
- database import: add keep_owners (restore PostgreSQL owners and
privileges) and sqlite_database (pick the target SQLite file) to the
API, OpenAPI spec, and import form
- oauth: require password confirmation and support team selection on
OAuth login
- remote process: send team broadcast events to the team of the server
that ran the process instead of the causer's user id
- servers API: handle the legacy build server setting
- compose: support parent bind paths and volume driver options
- dns: improve record hints and provider management
- notifications: fix throttling and missing backup notifications
- ui: rework the confirmation modal
- add feature and unit tests for the new behavior
Mark DNS proposals, conflicts and server IP properties as #[Locked] so
clients cannot tamper with them. Re-resolve the zone per hostname,
lowercase hostnames, validate record content server-side and use the
resource's team id for DNS lookups and jobs.
Move modal-confirmation submitAction parsing into a tested JS helper
that strips quotes and keeps commas, parentheses and escaped quotes
inside quoted arguments. Pass the hostname to replaceManagedDnsRecord
through it instead of Js::from.
Rework member-permission tests to open the real DNS dialog rather than
setting locked properties directly.
- Editing a domain (UI application, service and preview domains, the
General form, API application, preview, service, and service
application updates) now releases the hostnames that the edit
removed, like removing a domain does. Records that another live
resource still uses are kept.
- A per-hostname lock (managed-dns:{team}:{hostname}) now covers the
release (re-check, Cloudflare delete, row delete) and the create
paths. A release can no longer delete a record that is being added
again; a busy lock makes the release retry and the create wait or
retry, and a create after a release makes the record again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Proxy: list and delete Traefik ACME certificates from the server proxy
page via new TraefikAcmeService and Get/DeleteTraefikCertificate actions
- DNS: track ownership and cross-resource references for managed DNS
records so records are only deleted when no longer referenced; release
records asynchronously on resource deletion via ReleaseManagedDnsRecordsJob
and ManagedDnsRecordCleanup; harden Cloudflare provider deletion results
- Databases: fail closed on start when prerequisites or the CA certificate
are missing (DatabaseStartException, Server::ensureCaCertificate) and
clean up stale start activities via ResourceStartActivity
- Webhooks: throttle repeated manual webhook signature failures for
GitHub, GitLab, Gitea and Bitbucket
- Deployments: improve compose build-context handling and compose file
load error reporting
- Install scripts: rework terminal UI output in install.sh (stable and
nightly)
- Misc: settings sidebar accordion fixes, log drain toggle rollback,
add Serverside to README sponsors
- Add migrations and tests covering the above
Address review findings on the fleet metrics page.
Data correctness:
- bucket raw Sentinel samples into epoch-aligned windows (5m/30m/2h per range)
and average them, replacing per-server LTTB. Every server now reports the
same bucket timestamps, so the fleet sums add up point by point instead of
zigzagging between servers (and RX+TX really combine)
- keep only the root mount in disk history, matching HasMetrics::getDiskMetrics
- leave sparkline gaps as null instead of 0, so absent samples read as gaps
Robustness:
- normalize containerMetric in mount()/updatedContainerMetric(), so
/metrics?cmetric=foo no longer throws an undefined array key
- include the server uuid in the container row wire:key; system containers
share one Sentinel id across servers
- round the range start to the minute so the 60s history cache can hit
- cap the Sentinel curl with --max-time 10, so one hung request cannot stall
the serial per-server loop
UI:
- pass the spark time axis on first paint, so tooltips no longer show 1970
- show the active series name (RX/TX) in the server network chart tooltip
Refine the /metrics fleet page and align the per-server metrics page with it.
Fleet overview:
- add live sparklines to the CPU/Memory/Disk/Network KPI tiles (shared axis,
capped to ~40 points per sparkline)
- fill the Servers online + Containers tiles (fleet-health bar, hottest
container) so all six tiles read as one system
- scope-aware labels: drop the "Fleet" prefix and helper copy when a single
server is selected
Trend charts:
- hero layout: CPU spans full width, the other four form a 2x2 grid
- apply the same hero layout + skeleton to the per-server page for consistency
Hottest containers table:
- add a rank column and a per-row magnitude bar scaled to the busiest container
- fix a leaked Blade @break directive that rendered literally and forced
horizontal scroll on the Network tab
- keep the value column a fixed width so bars align across rows
Live refresh:
- add analytics-style loading feedback to the range tabs and server filter
- stable wire:key on table rows + width transitions on bars so data glides
on live refresh instead of snapping
Generalize the shared _sparkline partial (optional color/label/format) so it
serves non-traffic metrics without changing analytics behaviour.
Move database import temp/container cleanup into a queued listener with retries, and clear the import running state on failed restore starts. Tighten Cloudflare replace/delete to the current server IP and owning resource, notify when DNS jobs fail, and pass domain-removal confirmation through remove-by-key. Document import request oneOf schemas without extra properties.
ConfigureDnsRecordJob requires a string content value. Guard
configureDnsAfterDomainAdd with the same blank and FILTER_VALIDATE_IP
checks used by createManagedDnsRecord so a missing or hostname-only
server address cannot TypeError after the domain is saved.
- Mark Analytics, Dashboard\TrafficAnalytics and Project\Application\Analytics
Livewire components #[Lazy] with skeleton placeholder() views so pages render
instantly while Sentinel data loads in a deferred request
- Add SentinelTrafficClient::prefetchServerWide() to warm all server-wide
endpoints in a single batched docker exec instead of ~14-15 serial SSH
round-trips, and refactor overview/paths/breakdown URL building into shared
helpers
- Cap per-app leaderboard overviews fetched via MAX_LEADERBOARD_APPS to bound
requests on servers with many apps
- Add hasRequestSeries() to detect empty request charts and render a no-data
state instead of a blank chart
- Gate ServerSetting's automatic Sentinel restart on is_sentinel_enabled so
tuning geoip/traffic settings no longer silently enables Sentinel
- Add reusable skeleton UI components (skeleton, skeleton/table, skeleton/tiles)
for the new placeholder views
Replace the stacked status-over-time chart with a single requests
area series and a separate status-codes breakdown. Add p95 latency
sparklines to KPI cards, wire requests/latency into chart payloads,
and hide live refresh outside the 24h range.
Extend TrafficSeriesBucketData with requests, bytesIn, bytesOut,
uniqueVisitors, and p95 fields, and aggregate them per bucket in the
global, dashboard, and application analytics Livewire components.
Add bandwidthSpark() and uniquesSpark() to BuildsTrafficChartPayload
and wire them into the chart payloads and blade views.
Also add a compactNumber() helper for dense metric columns, a
--chart-spark-bandwidth CSS variable, and improve the traffic globe
with focus/resume controls, shortest-path angle interpolation, and
brighter base/marker theme colors.
Swap the static world-map partial for a cobe-based 3D globe
(traffic-globe.js) driven by per-country marker data. Extract shared
sparkline/device/geo derivations into BuildsTrafficChartPayload and
reuse it across global, dashboard, and per-application analytics
components. Add device-donut, hosts-list, and sparkline partials, and
extend breakdown dimensions with protocol/cache/status. Default live
refresh to off until manually armed.
Andras Bacsai
