3728 Commits
Author SHA1 Message Date
Andras BacsaiandClaude Opus 5.5 957c01fcc8 fix(image-scan): ship the scanner templates and show the scan error log
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-09 14:44:55 +01:00
Andras BacsaiandClaude Opus 5.5 f6b2fdc113 fix(image-scan): show the Vulnerabilities page again
The view still read the $allowed variable that the component no longer
passes after the instance switch was removed, so /vulnerabilities
returned a 500 error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-09 13:02:39 +01:00
Andras Bacsai 0c74db833d Merge remote-tracking branch 'origin/main' into next 2026-11-09 11:39:07 +01:00
Andras BacsaiandClaude Opus 5.5 c589449c3e fix(ui): make banners readable in light mode
Refs #12494

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-09 11:32:10 +01:00
Andras Bacsai adec9911cf Merge remote-tracking branch 'origin/main' into next 2026-11-09 10:16:31 +01:00
Andras BacsaiandClaude Opus 5.5 65dba32385 feat(server-security): scan host OS packages for vulnerabilities (#12482)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-09 10:12:56 +01:00
Andras BacsaiandClaude Opus 5.5 1d21a27812 refactor(image-scan): remove the instance switch and the vulnerability DB URL
Scanning is now controlled per server and per app. Each server downloads
the Grype database from its default source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-08 15:49:05 +01:00
Andras Bacsai 8011d0d6ab fix(access): check server and credential access for scoped members (#12488) 2026-11-07 18:59:17 +01:00
Andras Bacsai eb5f238a45 fix(server): show the disabled server message on the localhost page
Closes #12475
2026-11-06 19:52:05 +01:00
Andras Bacsai f7ea962145 fix(server): enable disabled self-hosted servers again on validation
On self-hosted, a validation that connects now clears force_disabled. The unreachable cleanup skips the localhost server, and the server page explains why a server is disabled. Cloud and transferred servers stay disabled.

Closes #12475
2026-11-06 18:57:06 +01:00
Andras BacsaiandClaude Opus 5.5 5af4715b8a feat(ui): put the star button after the status in the top bar
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:29:43 +01:00
Andras BacsaiandClaude Opus 5.5 c648f4ec6a feat(ui): star servers and resources for quick access on the dashboard
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:16:25 +01:00
Andras BacsaiandClaude Opus 5.5 cab5ae9903 feat(ui): show server usage on mobile in the dashboard server table
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:16:16 +01:00
Andras BacsaiandClaude Opus 5.5 1652a1d091 feat(ui): show the finish time of recent deployments on the dashboard
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 17:46:54 +01:00
Andras BacsaiandClaude Opus 5.5 973cd8684a feat(ui): show the logo and name on the resource creation screen
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 15:23:07 +01:00
Andras BacsaiandClaude Opus 5.5 17a9fa624e feat(ui): move maintenance mode to its own page with a confirmed toggle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 15:20:41 +01:00
Andras BacsaiandClaude Opus 5.5 53e21abe97 fix(services): do not warn about the port when a domain has no port
An empty port routes to the required port, so it needs no confirmation.
The edit dialog shows the effective port, the warning buttons name the
ports, and domain conflicts ignore the container port.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 15:17:35 +01:00
033f0c84da v4.7 (#12478)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Co-authored-by: Aditya Tripathi <aditya@climactic.co>
2026-11-06 14:25:02 +01:00
Andras Bacsai d5ac1ba27e fix(storage): require a saved SFTP host key, saved only by an admin validation
- Restores, downloads, and the import check refuse an SFTP storage without a saved host key.
- Only Validate, Save, Create, and the API validate endpoint save a new key; backup and
  revalidation jobs do not.
- An endpoint change or a host key reset marks the storage unusable.
- Save the key only when the endpoint did not change during the connection test.
2026-11-06 13:44:03 +01:00
Andras Bacsai 06ff1e1e31 fix(email): keep saved provider on failed switch, fall back to SMTP sender for Resend
- Restore the saved SMTP/Resend flags when a provider switch fails validation, so a
  later event toggle cannot save a half-configured Resend (team and instance pages).
- Resend uses smtp_from_* when resend_from_* is blank, as before the Resend sender fields.
- Require the Resend sender only when Resend is enabled.
- Replace wire:confirm in the SMTP server picker with x-modal-confirmation.
2026-11-06 13:44:03 +01:00
Andras Bacsai 7c348d6239 Merge remote-tracking branch 'origin/main' into next
# Conflicts:
#	app/Livewire/Project/Resource/Create.php
2026-11-06 12:45:11 +01:00
Andras Bacsai b7dc2e435b feat(database): default new Redis databases to the Valkey image
Change the standalone_redis image column default to
valkey/valkey:9-alpine. Existing databases keep their current image.
Update the API docs, OpenAPI specs and image helper text to name Valkey
as the default and redis:8 as the Redis example.

Also restyle the status badges and database image cards on the new
resource page.
2026-11-06 12:44:00 +01:00
Andras Bacsai e540a1a978 Merge remote-tracking branch 'origin/main' into next 2026-11-06 12:43:10 +01:00
Andras Bacsai 145569bea6 fix(db): bump Supabase and PostGIS default images
Supabase PostgreSQL 17.4.1.032 -> 17.11.0.018, PostGIS 17-3.5-alpine -> 18-3.7-alpine.
2026-11-06 12:39:53 +01:00
Andras BacsaiandClaude Opus 5.5 41877198b3 feat(database): offer Valkey as an image of the Redis database type
When a user creates a Redis database, a new step asks for Redis 7.2
(default) or Valkey 9. Valkey uses the same binaries (redis-* symlinks),
config, and data format, so the Redis start action runs it unchanged.
The UI now names the type "Redis / Valkey" and shows a combined logo,
and global search accepts "new valkey".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 12:37:36 +01:00
Andras BacsaiandClaude Opus 5.5 5960814df5 fix(ui): match deploy canvas card border to resource tiles
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 12:24:59 +01:00
Andras BacsaiandClaude Opus 5.5 91d233be59 feat(ui): add list view to the new resource page
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 12:18:37 +01:00
Andras Bacsai 7bab8f76ad Merge remote-tracking branch 'origin/main' into next 2026-11-06 12:08:06 +01:00
Andras BacsaiandClaude Opus 5.5 00d0b4be1d fix(ui): add coolify.io ref to integration token provider links
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 11:28:15 +01:00
Andras BacsaiandClaude Opus 5.5 693cf0486d fix(ui): link secret manager token forms to their provider dashboards
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 11:22:49 +01:00
Andras BacsaiandClaude Opus 5.5 b12c965fbe fix(ui): use bare status badges and show backup S3 storage as plain text
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 10:49:21 +01:00
Andras BacsaiandClaude Opus 5.5 ba966846e1 fix(ui): show relative start time with exact date tooltip in service backup executions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 10:39:28 +01:00
Andras BacsaiandClaude Opus 5.5 3115980c77 fix(ui): copy service backup path and show S3 badge only for runs stored in S3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 10:38:49 +01:00
Andras BacsaiandClaude Opus 5.5 7fbc5d7797 fix(ui): align service backup tables and sort executions by column
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 10:38:18 +01:00
Aditya TripathiandAndras Bacsai 3c33f61d7b feat(image-scan): container image vulnerability scanning with a security status per resource (#12377)
Co-authored-by: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
2026-11-06 10:31:27 +01:00
Andras Bacsai 0db8f60bdd feat(storage): add SFTP, FTPS, and WebDAV backup destinations (#12417) 2026-11-06 10:28:30 +01:00
cdc45e5736 fix: merge fixes-next into next (security hardening and fixes) (#12460)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
2026-11-06 10:18:19 +01:00
Andras BacsaiandClaude Opus 5.5 e7e952fcad fix(deploy): keep preview and build server hosts out of build --add-host
Preview containers (-pr-<id>) came and went with pull requests and
invalidated the build cache of every app on the network. A build server
got the IPs of the deployment server network, which it cannot reach.
Add a per-app setting to turn off network hosts during the build.

Closes #12452

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-05 23:34:53 +01:00
Andras Bacsai a58588faa0 feat(gitea): support Forgejo and Codeberg in the Gitea App source 2026-11-05 13:20:03 +01:00
Andras BacsaiandClaude Opus 5.5 19762a7950 fix(ui): keep volume data checkboxes next to their labels
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-05 12:56:03 +01:00
Andras Bacsai 30a8e3357a fix(server): refresh the server page after background validation
ServerValidated and ServerPatchCheckFinished used broadcastAs(), so Echo
listeners without a leading dot never matched them. Close the validation
dialog that a background job opened when the job finishes.
2026-11-05 12:53:54 +01:00
Andras BacsaiandClaude Opus 5.5 4a1228c611 feat(scheduled-tasks): disable tasks that keep failing
Disable a scheduled task after at least 5 failed runs in a row with no
success for 3 days, notify the team, and show the reason on the task page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-05 12:17:49 +01:00
Andras BacsaiandClaude Opus 5.5 f7867923b7 feat(email): add named SMTP servers, provider templates, Resend sender (#12471)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-05 11:38:17 +01:00
Andras BacsaiandClaude Opus 5.5 bf4b6ad921 feat(github): sync deployment status to GitHub Deployments (#12451)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-05 11:37:10 +01:00
Andras BacsaiandClaude Opus 5.5 59481c7bb6 fix(api-tokens): keep token search in sync after create, edit, and revoke
Closes #12465

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-05 10:29:24 +01:00
Andras Bacsai 9e64998d68 refactor(ui): drop deprecated -webkit-overflow-scrolling declarations
Remove the obsolete -webkit-overflow-scrolling: touch rule from the
table and log scroll containers in app.css, and the matching inline
styles from the scrollable bodies of modals, dialogs, the global
search create modals, the domain settings, subscription and upgrade
views. Modern iOS Safari scrolls with momentum by default, so these
declarations no longer did anything.
2026-11-05 10:18:06 +01:00
Andras Bacsai 860e786481 fix(backups): back up the instance database on localhost and show why the pre-update backup failed
The pre-update backup now skips a disabled schedule.
2026-11-04 06:34:44 +01:00
Andras BacsaiandClaude Opus 5.5 232e8b8616 fix(backups): back up all databases by default for Odoo services
Odoo keeps its data in databases that the user creates in Odoo, so the
POSTGRES_DB=postgres database that the backup used was empty. Also show the
sections of the edit backup schedule modal without nested cards.

Closes #7555

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-03 22:49:38 +01:00
Andras BacsaiandClaude Opus 5.5 da7779d061 fix(env): keep locked variables locked but allow a new value
A locked variable used by Docker Compose could not be changed, unlocked,
or deleted, so a lock by mistake had no fix in the UI. A locked value can
now be replaced without showing it. The lock is permanent in the UI, the
API, and MCP, and Lock asks for confirmation.

Closes #6803

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-03 22:42:52 +01:00
Andras Bacsai e0ae59deca fix(storage): explain the UUID prefix of new volume names
Closes #8620
2026-11-03 22:35:26 +01:00