mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-14 08:42:38 -04:00
Andras Bacsai
7fe40f4cf6
Require deploy permission for API changes that trigger server side effects, including resource deletion, storage access, provider operations, and database imports. Also escape Docker cleanup filters and sanitize log drain server names.
430 lines
17 KiB
PHP
430 lines
17 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Api;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Models\Server;
|
|
use App\Services\ServerTransfer\ServerTransferBundle;
|
|
use App\Services\ServerTransfer\ServerTransferClaimer;
|
|
use App\Services\ServerTransfer\ServerTransferExporter;
|
|
use App\Services\ServerTransfer\ServerTransferImporter;
|
|
use App\Services\ServerTransfer\ServerTransferMigrator;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Validation\ValidationException;
|
|
use OpenApi\Attributes as OA;
|
|
use Throwable;
|
|
|
|
class ServerTransferController extends Controller
|
|
{
|
|
public function __construct(
|
|
private ServerTransferExporter $exporter,
|
|
private ServerTransferImporter $importer,
|
|
private ServerTransferClaimer $claimer,
|
|
private ServerTransferMigrator $migrator,
|
|
) {
|
|
abort_unless(isDev(), 404);
|
|
}
|
|
|
|
#[OA\Post(
|
|
summary: 'Migrate server to another Coolify instance',
|
|
description: 'One-shot handoff: export this server, import+claim on the target instance (using the provided token), then disable automations here. Requires read:sensitive and write.',
|
|
path: '/servers/{uuid}/migrate',
|
|
operationId: 'migrate-server-between-instances',
|
|
security: [['bearerAuth' => []]],
|
|
tags: ['Servers'],
|
|
parameters: [
|
|
new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
|
|
],
|
|
requestBody: new OA\RequestBody(
|
|
required: true,
|
|
content: new OA\JsonContent(
|
|
required: ['target_url', 'target_token'],
|
|
properties: [
|
|
new OA\Property(property: 'target_url', type: 'string', example: 'https://coolify-b.example.com'),
|
|
new OA\Property(property: 'target_token', type: 'string', description: 'API token on the target instance (root or write)'),
|
|
new OA\Property(property: 'preserve_uuids', type: 'boolean', default: true),
|
|
new OA\Property(property: 'adopt_mode', type: 'boolean', default: true),
|
|
]
|
|
)
|
|
),
|
|
responses: [
|
|
new OA\Response(response: 200, description: 'Migrated'),
|
|
new OA\Response(response: 403, description: 'Missing sensitive permission'),
|
|
new OA\Response(response: 404, ref: '#/components/responses/404'),
|
|
new OA\Response(response: 422, description: 'Validation or remote import failed'),
|
|
]
|
|
)]
|
|
public function migrate(Request $request, string $uuid): JsonResponse
|
|
{
|
|
$teamId = getTeamIdFromToken();
|
|
if (is_null($teamId)) {
|
|
return invalidTokenResponse();
|
|
}
|
|
|
|
if (! $this->canReadSensitive($request)) {
|
|
return response()->json([
|
|
'message' => 'Migrating a server requires a token with read:sensitive (or root) ability and an admin/owner team role.',
|
|
], 403);
|
|
}
|
|
|
|
$server = Server::whereTeamId($teamId)->whereUuid($uuid)->first();
|
|
if (! $server) {
|
|
return response()->json(['message' => 'Server not found.'], 404);
|
|
}
|
|
|
|
$this->authorize('update', $server);
|
|
|
|
$return = validateIncomingRequest($request);
|
|
if ($return instanceof JsonResponse) {
|
|
return $return;
|
|
}
|
|
|
|
$validator = customApiValidator($request->all(), [
|
|
'target_url' => 'required|string|url',
|
|
'target_token' => 'required|string',
|
|
'preserve_uuids' => 'boolean|nullable',
|
|
'adopt_mode' => 'boolean|nullable',
|
|
]);
|
|
$allowedFields = ['target_url', 'target_token', 'preserve_uuids', 'adopt_mode'];
|
|
$extraFields = array_diff(array_keys($request->all()), $allowedFields);
|
|
if ($validator->fails() || $extraFields !== []) {
|
|
$errors = $validator->errors();
|
|
foreach ($extraFields as $field) {
|
|
$errors->add($field, 'This field is not allowed.');
|
|
}
|
|
|
|
return response()->json([
|
|
'message' => 'Validation failed.',
|
|
'errors' => $errors,
|
|
], 422);
|
|
}
|
|
|
|
try {
|
|
$result = $this->migrator->migrate(
|
|
server: $server,
|
|
targetUrl: $request->string('target_url')->toString(),
|
|
targetToken: $request->string('target_token')->toString(),
|
|
preserveUuids: $request->boolean('preserve_uuids', true),
|
|
adoptMode: $request->boolean('adopt_mode', true),
|
|
);
|
|
} catch (Throwable $e) {
|
|
return response()->json(['message' => $e->getMessage()], 422);
|
|
}
|
|
|
|
auditLog('api.server.migrate', [
|
|
'team_id' => $teamId,
|
|
'server_uuid' => $server->uuid,
|
|
'export_id' => $result['export_id'],
|
|
'target_url' => $result['target_url'],
|
|
]);
|
|
|
|
return response()->json($result);
|
|
}
|
|
|
|
#[OA\Get(
|
|
summary: 'Export server transfer bundle',
|
|
description: 'Export a server and all resources hosted on it as a versioned transfer bundle for moving between Coolify instances. Requires read:sensitive.',
|
|
path: '/servers/{uuid}/export',
|
|
operationId: 'export-server-transfer-bundle',
|
|
security: [['bearerAuth' => []]],
|
|
tags: ['Servers'],
|
|
parameters: [
|
|
new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
|
|
new OA\Parameter(name: 'encrypt', in: 'query', required: false, description: 'If true and passphrase is provided, return an encrypted envelope.', schema: new OA\Schema(type: 'boolean')),
|
|
new OA\Parameter(name: 'passphrase', in: 'query', required: false, description: 'Passphrase used when encrypt=true.', schema: new OA\Schema(type: 'string')),
|
|
],
|
|
responses: [
|
|
new OA\Response(response: 200, description: 'Transfer bundle'),
|
|
new OA\Response(response: 401, ref: '#/components/responses/401'),
|
|
new OA\Response(response: 403, description: 'Missing sensitive permission'),
|
|
new OA\Response(response: 404, ref: '#/components/responses/404'),
|
|
]
|
|
)]
|
|
public function export(Request $request, string $uuid): JsonResponse
|
|
{
|
|
$teamId = getTeamIdFromToken();
|
|
if (is_null($teamId)) {
|
|
return invalidTokenResponse();
|
|
}
|
|
|
|
if (! $this->canReadSensitive($request)) {
|
|
return response()->json([
|
|
'message' => 'Exporting a server requires a token with read:sensitive (or root) ability and an admin/owner team role.',
|
|
], 403);
|
|
}
|
|
|
|
$server = Server::whereTeamId($teamId)->whereUuid($uuid)->first();
|
|
if (! $server) {
|
|
return response()->json(['message' => 'Server not found.'], 404);
|
|
}
|
|
|
|
$this->authorize('view', $server);
|
|
|
|
try {
|
|
$bundle = $this->exporter->export($server, includeSensitive: true);
|
|
} catch (Throwable $e) {
|
|
return response()->json(['message' => $e->getMessage()], 422);
|
|
}
|
|
|
|
auditLog('api.server.export', [
|
|
'team_id' => $teamId,
|
|
'server_uuid' => $server->uuid,
|
|
'export_id' => data_get($bundle, 'export_id'),
|
|
]);
|
|
|
|
if ($request->boolean('encrypt') && $request->filled('passphrase')) {
|
|
return response()->json(
|
|
ServerTransferBundle::encryptWithPassphrase($bundle, $request->string('passphrase')->toString())
|
|
);
|
|
}
|
|
|
|
return response()->json($bundle);
|
|
}
|
|
|
|
#[OA\Post(
|
|
summary: 'Import server transfer bundle',
|
|
description: 'Import a server transfer bundle into this Coolify instance (adopt mode by default). This instance then manages the server, and Sentinel reports to it. Needs a token with the write and deploy permissions.',
|
|
path: '/servers/import',
|
|
operationId: 'import-server-transfer-bundle',
|
|
security: [['bearerAuth' => []]],
|
|
tags: ['Servers'],
|
|
requestBody: new OA\RequestBody(
|
|
required: true,
|
|
content: new OA\JsonContent(
|
|
properties: [
|
|
new OA\Property(property: 'bundle', type: 'object', description: 'Plain or encrypted transfer bundle'),
|
|
new OA\Property(property: 'passphrase', type: 'string', nullable: true),
|
|
new OA\Property(property: 'dry_run', type: 'boolean', default: false),
|
|
new OA\Property(property: 'preserve_uuids', type: 'boolean', default: true),
|
|
new OA\Property(property: 'adopt_mode', type: 'boolean', default: true, description: 'Import without forcing redeploy; keep statuses for adoption'),
|
|
]
|
|
)
|
|
),
|
|
responses: [
|
|
new OA\Response(response: 200, description: 'Dry-run result'),
|
|
new OA\Response(response: 201, description: 'Imported'),
|
|
new OA\Response(response: 401, ref: '#/components/responses/401'),
|
|
new OA\Response(response: 403, description: 'The token needs the write and deploy permissions.'),
|
|
new OA\Response(response: 422, description: 'Validation failed'),
|
|
]
|
|
)]
|
|
public function import(Request $request): JsonResponse
|
|
{
|
|
$teamId = getTeamIdFromToken();
|
|
if (is_null($teamId)) {
|
|
return invalidTokenResponse();
|
|
}
|
|
|
|
$this->authorize('create', Server::class);
|
|
|
|
$return = validateIncomingRequest($request);
|
|
if ($return instanceof JsonResponse) {
|
|
return $return;
|
|
}
|
|
|
|
$validator = customApiValidator($request->all(), [
|
|
'bundle' => 'required|array',
|
|
'passphrase' => 'string|nullable',
|
|
'dry_run' => 'boolean|nullable',
|
|
'preserve_uuids' => 'boolean|nullable',
|
|
'adopt_mode' => 'boolean|nullable',
|
|
]);
|
|
$allowedFields = ['bundle', 'passphrase', 'dry_run', 'preserve_uuids', 'adopt_mode'];
|
|
$extraFields = array_diff(array_keys($request->all()), $allowedFields);
|
|
if ($validator->fails() || $extraFields !== []) {
|
|
$errors = $validator->errors();
|
|
foreach ($extraFields as $field) {
|
|
$errors->add($field, 'This field is not allowed.');
|
|
}
|
|
|
|
return response()->json([
|
|
'message' => 'Validation failed.',
|
|
'errors' => $errors,
|
|
], 422);
|
|
}
|
|
|
|
$bundle = $request->input('bundle', []);
|
|
if (data_get($bundle, 'encrypted')) {
|
|
if (! $request->filled('passphrase')) {
|
|
return response()->json(['message' => 'Passphrase is required for encrypted bundles.'], 422);
|
|
}
|
|
try {
|
|
$bundle = ServerTransferBundle::decryptWithPassphrase($bundle, $request->string('passphrase')->toString());
|
|
} catch (Throwable $e) {
|
|
return response()->json(['message' => $e->getMessage()], 422);
|
|
}
|
|
}
|
|
|
|
try {
|
|
$result = $this->importer->import(
|
|
bundle: $bundle,
|
|
teamId: $teamId,
|
|
dryRun: $request->boolean('dry_run', false),
|
|
preserveUuids: $request->boolean('preserve_uuids', true),
|
|
adoptMode: $request->boolean('adopt_mode', true),
|
|
);
|
|
} catch (Throwable $e) {
|
|
$status = $e instanceof ValidationException ? 422 : 422;
|
|
$payload = ['message' => $e->getMessage()];
|
|
if ($e instanceof ValidationException) {
|
|
$payload['errors'] = $e->errors();
|
|
}
|
|
|
|
return response()->json($payload, $status);
|
|
}
|
|
|
|
auditLog('api.server.import', [
|
|
'team_id' => $teamId,
|
|
'server_uuid' => $result['server_uuid'],
|
|
'export_id' => $result['export_id'],
|
|
'dry_run' => $result['dry_run'],
|
|
]);
|
|
|
|
return response()->json($result, $result['dry_run'] ? 200 : 201);
|
|
}
|
|
|
|
#[OA\Post(
|
|
summary: 'Mark server transferred',
|
|
description: 'Source-instance step: disable automations after a successful export/import handoff.',
|
|
path: '/servers/{uuid}/transfer/complete',
|
|
operationId: 'complete-server-transfer',
|
|
security: [['bearerAuth' => []]],
|
|
tags: ['Servers'],
|
|
parameters: [
|
|
new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
|
|
],
|
|
requestBody: new OA\RequestBody(
|
|
content: new OA\JsonContent(
|
|
properties: [
|
|
new OA\Property(property: 'export_id', type: 'string', nullable: true),
|
|
new OA\Property(property: 'target_instance_url', type: 'string', nullable: true),
|
|
]
|
|
)
|
|
),
|
|
responses: [
|
|
new OA\Response(response: 200, description: 'Marked transferred'),
|
|
new OA\Response(response: 404, ref: '#/components/responses/404'),
|
|
]
|
|
)]
|
|
public function complete(Request $request, string $uuid): JsonResponse
|
|
{
|
|
$teamId = getTeamIdFromToken();
|
|
if (is_null($teamId)) {
|
|
return invalidTokenResponse();
|
|
}
|
|
|
|
$server = Server::whereTeamId($teamId)->whereUuid($uuid)->first();
|
|
if (! $server) {
|
|
return response()->json(['message' => 'Server not found.'], 404);
|
|
}
|
|
|
|
$this->authorize('update', $server);
|
|
|
|
$validator = customApiValidator($request->all(), [
|
|
'export_id' => 'string|nullable',
|
|
'target_instance_url' => 'string|nullable',
|
|
]);
|
|
if ($validator->fails()) {
|
|
return response()->json([
|
|
'message' => 'Validation failed.',
|
|
'errors' => $validator->errors(),
|
|
], 422);
|
|
}
|
|
|
|
try {
|
|
$result = $this->claimer->markTransferred(
|
|
$server,
|
|
exportId: $request->input('export_id'),
|
|
targetInstanceUrl: $request->input('target_instance_url'),
|
|
);
|
|
} catch (Throwable $e) {
|
|
return response()->json(['message' => $e->getMessage()], 422);
|
|
}
|
|
|
|
auditLog('api.server.transfer_complete', [
|
|
'team_id' => $teamId,
|
|
'server_uuid' => $server->uuid,
|
|
'export_id' => $request->input('export_id'),
|
|
]);
|
|
|
|
return response()->json($result);
|
|
}
|
|
|
|
#[OA\Post(
|
|
summary: 'Write transfer bundle to server mailbox',
|
|
description: 'Write an export bundle to /data/coolify/exports on the managed host for air-gapped import.',
|
|
path: '/servers/{uuid}/export/mailbox',
|
|
operationId: 'export-server-transfer-mailbox',
|
|
security: [['bearerAuth' => []]],
|
|
tags: ['Servers'],
|
|
parameters: [
|
|
new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
|
|
],
|
|
requestBody: new OA\RequestBody(
|
|
content: new OA\JsonContent(
|
|
properties: [
|
|
new OA\Property(property: 'passphrase', type: 'string', nullable: true),
|
|
]
|
|
)
|
|
),
|
|
responses: [
|
|
new OA\Response(response: 200, description: 'Mailbox write result'),
|
|
new OA\Response(response: 403, description: 'Missing sensitive permission'),
|
|
new OA\Response(response: 404, ref: '#/components/responses/404'),
|
|
]
|
|
)]
|
|
public function writeMailbox(Request $request, string $uuid): JsonResponse
|
|
{
|
|
$teamId = getTeamIdFromToken();
|
|
if (is_null($teamId)) {
|
|
return invalidTokenResponse();
|
|
}
|
|
|
|
if (! $this->canReadSensitive($request)) {
|
|
return response()->json([
|
|
'message' => 'Writing a transfer mailbox requires read:sensitive (or root) ability and an admin/owner team role.',
|
|
], 403);
|
|
}
|
|
|
|
$server = Server::whereTeamId($teamId)->whereUuid($uuid)->first();
|
|
if (! $server) {
|
|
return response()->json(['message' => 'Server not found.'], 404);
|
|
}
|
|
|
|
$this->authorize('view', $server);
|
|
|
|
try {
|
|
$bundle = $this->exporter->export($server, includeSensitive: true);
|
|
$result = $this->claimer->writeMailbox(
|
|
$server,
|
|
$bundle,
|
|
$request->filled('passphrase') ? $request->string('passphrase')->toString() : null,
|
|
);
|
|
} catch (Throwable $e) {
|
|
return response()->json(['message' => $e->getMessage()], 422);
|
|
}
|
|
|
|
auditLog('api.server.export_mailbox', [
|
|
'team_id' => $teamId,
|
|
'server_uuid' => $server->uuid,
|
|
'export_id' => data_get($bundle, 'export_id'),
|
|
'path' => $result['path'],
|
|
]);
|
|
|
|
return response()->json([
|
|
'export_id' => data_get($bundle, 'export_id'),
|
|
'path' => $result['path'],
|
|
'written' => $result['written'],
|
|
'message' => $result['written']
|
|
? 'Transfer bundle written to server mailbox.'
|
|
: 'Failed to write mailbox on remote host.',
|
|
], $result['written'] ? 200 : 422);
|
|
}
|
|
|
|
private function canReadSensitive(Request $request): bool
|
|
{
|
|
return (bool) $request->attributes->get('can_read_sensitive', false);
|
|
}
|
|
}
|